Merge branch 'work.statx' into for-next

1251 files changed, 17873 insertions, 8823 deletions

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 986e44387dad..facc20a3f962 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -653,6 +653,9 @@
         cpuidle.off=1   [CPU_IDLE]
                         disable the cpuidle sub-system
 
+        cpufreq.off=1   [CPU_FREQ]
+                        disable the cpufreq sub-system
+
         cpu_init_udelay=N
                         [X86] Delay for N microsec between assert and de-assert
                         of APIC INIT to start processors.  This delay occurs
@@ -1183,6 +1186,12 @@
                         functions that can be changed at run time by the
                         set_graph_notrace file in the debugfs tracing directory.
 
+        ftrace_graph_max_depth=<uint>
+                        [FTRACE] Used with the function graph tracer. This is
+                        the max depth it will trace into a function. This value
+                        can be changed at run time by the max_graph_depth file
+                        in the tracefs tracing directory. default: 0 (no limit)
+
         gamecon.map[2|3]=
                         [HW,JOY] Multisystem joystick and NES/SNES/PSX pad
                         support via parallel port (up to 5 devices per port)
@@ -1716,6 +1725,12 @@
                         kernel and module base offset ASLR (Address Space
                         Layout Randomization).
 
+        kasan_multi_shot
+                        [KNL] Enforce KASAN (Kernel Address Sanitizer) to print
+                        report on every invalid memory access. Without this
+                        parameter KASAN will print report only for the first
+                        invalid access.
+
         keepinitrd      [HW,ARM]
 
         kernelcore=     [KNL,X86,IA-64,PPC]
diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt
index a71b8095dbd8..2f66683500b8 100644
--- a/Documentation/arm64/silicon-errata.txt
+++ b/Documentation/arm64/silicon-errata.txt
@@ -68,3 +68,4 @@ stable kernels.
 |                |                 |                 |                             |
 | Qualcomm Tech. | Falkor v1       | E1003           | QCOM_FALKOR_ERRATUM_1003    |
 | Qualcomm Tech. | Falkor v1       | E1009           | QCOM_FALKOR_ERRATUM_1009    |
+| Qualcomm Tech. | QDF2400 ITS     | E0065           | QCOM_QDF2400_ERRATUM_0065   |
diff --git a/Documentation/cgroup-v2.txt b/Documentation/cgroup-v2.txt
index 3b8449f8ac7e..49d7c997fa1e 100644
--- a/Documentation/cgroup-v2.txt
+++ b/Documentation/cgroup-v2.txt
@@ -1142,16 +1142,17 @@ used by the kernel.
 
   pids.max
 
- A read-write single value file which exists on non-root cgroups.  The
- default is "max".
+        A read-write single value file which exists on non-root
+        cgroups.  The default is "max".
 
- Hard limit of number of processes.
+        Hard limit of number of processes.
 
   pids.current
 
- A read-only single value file which exists on all cgroups.
+        A read-only single value file which exists on all cgroups.
 
- The number of processes currently in the cgroup and its descendants.
+        The number of processes currently in the cgroup and its
+        descendants.
 
 Organisational operations are not blocked by cgroup policies, so it is
 possible to have pids.current > pids.max.  This can be done by either
diff --git a/Documentation/dev-tools/kcov.rst b/Documentation/dev-tools/kcov.rst
index 2c41b713841f..44886c91e112 100644
--- a/Documentation/dev-tools/kcov.rst
+++ b/Documentation/dev-tools/kcov.rst
@@ -10,7 +10,7 @@ Note that kcov does not aim to collect as much coverage as possible. It aims
 to collect more or less stable coverage that is function of syscall inputs.
 To achieve this goal it does not collect coverage in soft/hard interrupts
 and instrumentation of some inherently non-deterministic parts of kernel is
-disbled (e.g. scheduler, locking).
+disabled (e.g. scheduler, locking).
 
 Usage
 -----
diff --git a/Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt b/Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt
index 30c546900b60..07dbb358182c 100644
--- a/Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt
+++ b/Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt
@@ -45,7 +45,7 @@ The following clocks are available:
    - 1 15       SATA
    - 1 16       SATA USB
    - 1 17       Main
-   - 1 18       SD/MMC
+   - 1 18       SD/MMC/GOP
    - 1 21       Slow IO (SPI, NOR, BootROM, I2C, UART)
    - 1 22       USB3H0
    - 1 23       USB3H1
@@ -65,7 +65,7 @@ Required properties:
         "cpm-audio", "cpm-communit", "cpm-nand", "cpm-ppv2", "cpm-sdio",
         "cpm-mg-domain", "cpm-mg-core", "cpm-xor1", "cpm-xor0", "cpm-gop-dp", "none",
         "cpm-pcie_x10", "cpm-pcie_x11", "cpm-pcie_x4", "cpm-pcie-xor", "cpm-sata",
-        "cpm-sata-usb", "cpm-main", "cpm-sd-mmc", "none", "none", "cpm-slow-io",
+        "cpm-sata-usb", "cpm-main", "cpm-sd-mmc-gop", "none", "none", "cpm-slow-io",
         "cpm-usb3h0", "cpm-usb3h1", "cpm-usb3dev", "cpm-eip150", "cpm-eip197";
 
 Example:
@@ -78,6 +78,6 @@ Example:
                 gate-clock-output-names = "cpm-audio", "cpm-communit", "cpm-nand", "cpm-ppv2", "cpm-sdio",
                         "cpm-mg-domain", "cpm-mg-core", "cpm-xor1", "cpm-xor0", "cpm-gop-dp", "none",
                         "cpm-pcie_x10", "cpm-pcie_x11", "cpm-pcie_x4", "cpm-pcie-xor", "cpm-sata",
-                        "cpm-sata-usb", "cpm-main", "cpm-sd-mmc", "none", "none", "cpm-slow-io",
+                        "cpm-sata-usb", "cpm-main", "cpm-sd-mmc-gop", "none", "none", "cpm-slow-io",
                         "cpm-usb3h0", "cpm-usb3h1", "cpm-usb3dev", "cpm-eip150", "cpm-eip197";
         };
diff --git a/Documentation/devicetree/bindings/display/exynos/exynos_dsim.txt b/Documentation/devicetree/bindings/display/exynos/exynos_dsim.txt
index a78265993665..ca5204b3bc21 100644
--- a/Documentation/devicetree/bindings/display/exynos/exynos_dsim.txt
+++ b/Documentation/devicetree/bindings/display/exynos/exynos_dsim.txt
@@ -4,7 +4,6 @@ Required properties:
   - compatible: value should be one of the following
                 "samsung,exynos3250-mipi-dsi" /* for Exynos3250/3472 SoCs */
                 "samsung,exynos4210-mipi-dsi" /* for Exynos4 SoCs */
-                "samsung,exynos4415-mipi-dsi" /* for Exynos4415 SoC */
                 "samsung,exynos5410-mipi-dsi" /* for Exynos5410/5420/5440 SoCs */
                 "samsung,exynos5422-mipi-dsi" /* for Exynos5422/5800 SoCs */
                 "samsung,exynos5433-mipi-dsi" /* for Exynos5433 SoCs */
diff --git a/Documentation/devicetree/bindings/display/exynos/samsung-fimd.txt b/Documentation/devicetree/bindings/display/exynos/samsung-fimd.txt
index 18645e0228b0..5837402c3ade 100644
--- a/Documentation/devicetree/bindings/display/exynos/samsung-fimd.txt
+++ b/Documentation/devicetree/bindings/display/exynos/samsung-fimd.txt
@@ -11,7 +11,6 @@ Required properties:
                 "samsung,s5pv210-fimd"; /* for S5PV210 SoC */
                 "samsung,exynos3250-fimd"; /* for Exynos3250/3472 SoCs */
                 "samsung,exynos4210-fimd"; /* for Exynos4 SoCs */
-                "samsung,exynos4415-fimd"; /* for Exynos4415 SoC */
                 "samsung,exynos5250-fimd"; /* for Exynos5250 SoCs */
                 "samsung,exynos5420-fimd"; /* for Exynos5420/5422/5800 SoCs */
 
diff --git a/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt b/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt
index ea9c1c9607f6..520d61dad6dd 100644
--- a/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt
+++ b/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt
@@ -13,7 +13,7 @@ Required Properties:
         - "rockchip,rk2928-dw-mshc": for Rockchip RK2928 and following,
                                                         before RK3288
         - "rockchip,rk3288-dw-mshc": for Rockchip RK3288
-        - "rockchip,rk1108-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RK1108
+        - "rockchip,rv1108-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RV1108
         - "rockchip,rk3036-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RK3036
         - "rockchip,rk3368-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RK3368
         - "rockchip,rk3399-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RK3399
diff --git a/Documentation/devicetree/bindings/phy/brcm,nsp-usb3-phy.txt b/Documentation/devicetree/bindings/phy/brcm,nsp-usb3-phy.txt
deleted file mode 100644
index e68ae5dec9c9..000000000000
--- a/Documentation/devicetree/bindings/phy/brcm,nsp-usb3-phy.txt
+++ /dev/null
@@ -1,39 +0,0 @@
-Broadcom USB3 phy binding for northstar plus SoC
-The USB3 phy is internal to the SoC and is accessed using mdio interface.
-
-Required mdio bus properties:
-- reg: Should be 0x0 for SoC internal USB3 phy
-- #address-cells: must be 1
-- #size-cells: must be 0
-
-Required USB3 PHY properties:
-- compatible: should be "brcm,nsp-usb3-phy"
-- reg: USB3 Phy address on SoC internal MDIO bus and it should be 0x10.
-- usb3-ctrl-syscon: handler of syscon node defining physical address
-  of usb3 control register.
-- #phy-cells: must be 0
-
-Required usb3 control properties:
-- compatible: should be "brcm,nsp-usb3-ctrl"
-- reg: offset and length of the control registers
-
-Example:
-
-        mdio@0 {
-                reg = <0x0>;
-                #address-cells = <1>;
-                #size-cells = <0>;
-
-                usb3_phy: usb-phy@10 {
-                        compatible = "brcm,nsp-usb3-phy";
-                        reg = <0x10>;
-                        usb3-ctrl-syscon = <&usb3_ctrl>;
-                        #phy-cells = <0>;
-                        status = "disabled";
-                };
-        };
-
-        usb3_ctrl: syscon@104408 {
-                compatible = "brcm,nsp-usb3-ctrl", "syscon";
-                reg = <0x104408 0x3fc>;
-        };
diff --git a/Documentation/devicetree/bindings/powerpc/4xx/emac.txt b/Documentation/devicetree/bindings/powerpc/4xx/emac.txt
index 712baf6c3e24..44b842b6ca15 100644
--- a/Documentation/devicetree/bindings/powerpc/4xx/emac.txt
+++ b/Documentation/devicetree/bindings/powerpc/4xx/emac.txt
@@ -71,6 +71,9 @@
                           For Axon it can be absent, though my current driver
                           doesn't handle phy-address yet so for now, keep
                           0x00ffffff in it.
+    - phy-handle        : Used to describe configurations where a external PHY
+                          is used. Please refer to:
+                          Documentation/devicetree/bindings/net/ethernet.txt
     - rx-fifo-size-gige : 1 cell, Rx fifo size in bytes for 1000 Mb/sec
                           operations (if absent the value is the same as
                           rx-fifo-size).  For Axon, either absent or 2048.
@@ -81,8 +84,22 @@
                           offload, phandle of the TAH device node.
     - tah-channel       : 1 cell, optional. If appropriate, channel used on the
                           TAH engine.
+    - fixed-link        : Fixed-link subnode describing a link to a non-MDIO
+                          managed entity. See
+                          Documentation/devicetree/bindings/net/fixed-link.txt
+                          for details.
+    - mdio subnode      : When the EMAC has a phy connected to its local
+                          mdio, which us supported by the kernel's network
+                          PHY library in drivers/net/phy, there must be device
+                          tree subnode with the following required properties:
+                                - #address-cells: Must be <1>.
+                                - #size-cells: Must be <0>.
 
-    Example:
+                          For PHY definitions: Please refer to
+                          Documentation/devicetree/bindings/net/phy.txt and
+                          Documentation/devicetree/bindings/net/ethernet.txt
+
+    Examples:
 
         EMAC0: ethernet@40000800 {
                 device_type = "network";
@@ -104,6 +121,48 @@
                 zmii-channel = <0>;
         };
 
+        EMAC1: ethernet@ef600c00 {
+                device_type = "network";
+                compatible = "ibm,emac-apm821xx", "ibm,emac4sync";
+                interrupt-parent = <&EMAC1>;
+                interrupts = <0 1>;
+                #interrupt-cells = <1>;
+                #address-cells = <0>;
+                #size-cells = <0>;
+                interrupt-map = <0 &UIC2 0x10 IRQ_TYPE_LEVEL_HIGH /* Status */
+                                 1 &UIC2 0x14 IRQ_TYPE_LEVEL_HIGH /* Wake */>;
+                reg = <0xef600c00 0x000000c4>;
+                local-mac-address = [000000000000]; /* Filled in by U-Boot */
+                mal-device = <&MAL0>;
+                mal-tx-channel = <0>;
+                mal-rx-channel = <0>;
+                cell-index = <0>;
+                max-frame-size = <9000>;
+                rx-fifo-size = <16384>;
+                tx-fifo-size = <2048>;
+                fifo-entry-size = <10>;
+                phy-mode = "rgmii";
+                phy-handle = <&phy0>;
+                phy-map = <0x00000000>;
+                rgmii-device = <&RGMII0>;
+                rgmii-channel = <0>;
+                tah-device = <&TAH0>;
+                tah-channel = <0>;
+                has-inverted-stacr-oc;
+                has-new-stacr-staopc;
+
+                mdio {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        phy0: ethernet-phy@0 {
+                                compatible = "ethernet-phy-ieee802.3-c22";
+                                reg = <0>;
+                        };
+                };
+        };
+
+
       ii) McMAL node
 
     Required properties:
@@ -145,4 +204,3 @@
     - revision           : as provided by the RGMII new version register if
                            available.
                            For Axon: 0x0000012a
-
diff --git a/Documentation/devicetree/bindings/regulator/ti-abb-regulator.txt b/Documentation/devicetree/bindings/regulator/ti-abb-regulator.txt
index c3f6546ebac7..6a23ad9ac53a 100644
--- a/Documentation/devicetree/bindings/regulator/ti-abb-regulator.txt
+++ b/Documentation/devicetree/bindings/regulator/ti-abb-regulator.txt
@@ -45,7 +45,7 @@ Required Properties:
 Optional Properties:
 - reg-names: In addition to the required properties, the following are optional
   - "efuse-address"     - Contains efuse base address used to pick up ABB info.
-  - "ldo-address"       - Contains address of ABB LDO overide register address.
+  - "ldo-address"       - Contains address of ABB LDO override register.
         "efuse-address" is required for this.
 - ti,ldovbb-vset-mask   - Required if ldo-address is set, mask for LDO override
         register to provide override vset value.
diff --git a/Documentation/devicetree/bindings/rng/omap_rng.txt b/Documentation/devicetree/bindings/rng/omap_rng.txt
index 471477299ece..9cf7876ab434 100644
--- a/Documentation/devicetree/bindings/rng/omap_rng.txt
+++ b/Documentation/devicetree/bindings/rng/omap_rng.txt
@@ -12,7 +12,8 @@ Required properties:
 - reg : Offset and length of the register set for the module
 - interrupts : the interrupt number for the RNG module.
                 Used for "ti,omap4-rng" and "inside-secure,safexcel-eip76"
-- clocks: the trng clock source
+- clocks: the trng clock source. Only mandatory for the
+  "inside-secure,safexcel-eip76" compatible.
 
 Example:
 /* AM335x */
diff --git a/Documentation/devicetree/bindings/usb/usb251xb.txt b/Documentation/devicetree/bindings/usb/usb251xb.txt
index 0c065f77658f..3957d4edaa74 100644
--- a/Documentation/devicetree/bindings/usb/usb251xb.txt
+++ b/Documentation/devicetree/bindings/usb/usb251xb.txt
@@ -7,18 +7,18 @@ Required properties :
  - compatible : Should be "microchip,usb251xb" or one of the specific types:
         "microchip,usb2512b", "microchip,usb2512bi", "microchip,usb2513b",
         "microchip,usb2513bi", "microchip,usb2514b", "microchip,usb2514bi"
- - hub-reset-gpios : Should specify the gpio for hub reset
+ - reset-gpios : Should specify the gpio for hub reset
+ - reg : I2C address on the selected bus (default is <0x2C>)
 
 Optional properties :
- - reg : I2C address on the selected bus (default is <0x2C>)
  - skip-config : Skip Hub configuration, but only send the USB-Attach command
- - vendor-id : USB Vendor ID of the hub (16 bit, default is 0x0424)
- - product-id : USB Product ID of the hub (16 bit, default depends on type)
- - device-id : USB Device ID of the hub (16 bit, default is 0x0bb3)
- - language-id : USB Language ID (16 bit, default is 0x0000)
- - manufacturer : USB Manufacturer string (max 31 characters long)
- - product : USB Product string (max 31 characters long)
- - serial : USB Serial string (max 31 characters long)
+ - vendor-id : Set USB Vendor ID of the hub (16 bit, default is 0x0424)
+ - product-id : Set USB Product ID of the hub (16 bit, default depends on type)
+ - device-id : Set USB Device ID of the hub (16 bit, default is 0x0bb3)
+ - language-id : Set USB Language ID (16 bit, default is 0x0000)
+ - manufacturer : Set USB Manufacturer string (max 31 characters long)
+ - product : Set USB Product string (max 31 characters long)
+ - serial : Set USB Serial string (max 31 characters long)
  - {bus,self}-powered : selects between self- and bus-powered operation (default
         is self-powered)
  - disable-hi-speed : disable USB Hi-Speed support
@@ -31,8 +31,10 @@ Optional properties :
         (default is individual)
  - dynamic-power-switching : enable auto-switching from self- to bus-powered
         operation if the local power source is removed or unavailable
- - oc-delay-{100us,4ms,8ms,16ms} : set over current timer delay (default is 8ms)
- - compound-device : indicated the hub is part of a compound device
+ - oc-delay-us : Delay time (in microseconds) for filtering the over-current
+        sense inputs. Valid values are 100, 4000, 8000 (default) and 16000. If
+        an invalid value is given, the default is used instead.
+ - compound-device : indicate the hub is part of a compound device
  - port-mapping-mode : enable port mapping mode
  - string-support : enable string descriptor support (required for manufacturer,
         product and serial string configuration)
@@ -40,34 +42,15 @@ Optional properties :
         device connected.
  - sp-disabled-ports : Specifies the ports which will be self-power disabled
  - bp-disabled-ports : Specifies the ports which will be bus-power disabled
- - max-sp-power : Specifies the maximum current the hub consumes from an
-        upstream port when operating as self-powered hub including the power
-        consumption of a permanently attached peripheral if the hub is
-        configured as a compound device. The value is given in mA in a 0 - 500
-        range (default is 2).
- - max-bp-power : Specifies the maximum current the hub consumes from an
-        upstream port when operating as bus-powered hub including the power
-        consumption of a permanently attached peripheral if the hub is
-        configured as a compound device. The value is given in mA in a 0 - 500
-        range (default is 100).
- - max-sp-current : Specifies the maximum current the hub consumes from an
-        upstream port when operating as self-powered hub EXCLUDING the power
-        consumption of a permanently attached peripheral if the hub is
-        configured as a compound device. The value is given in mA in a 0 - 500
-        range (default is 2).
- - max-bp-current : Specifies the maximum current the hub consumes from an
-        upstream port when operating as bus-powered hub EXCLUDING the power
-        consumption of a permanently attached peripheral if the hub is
-        configured as a compound device. The value is given in mA in a 0 - 500
-        range (default is 100).
- - power-on-time : Specifies the time it takes from the time the host initiates
-        the power-on sequence to a port until the port has adequate power. The
-        value is given in ms in a 0 - 510 range (default is 100ms).
+ - power-on-time-ms : Specifies the time it takes from the time the host
+        initiates the power-on sequence to a port until the port has adequate
+        power. The value is given in ms in a 0 - 510 range (default is 100ms).
 
 Examples:
         usb2512b@2c {
                 compatible = "microchip,usb2512b";
-                hub-reset-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+                reg = <0x2c>;
+                reset-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
         };
 
         usb2514b@2c {
diff --git a/Documentation/extcon/intel-int3496.txt b/Documentation/extcon/intel-int3496.txt
index af0b366c25b7..8155dbc7fad3 100644
--- a/Documentation/extcon/intel-int3496.txt
+++ b/Documentation/extcon/intel-int3496.txt
@@ -20,3 +20,8 @@ Index 1: The output gpio for enabling Vbus output from the device to the otg
 Index 2: The output gpio for muxing of the data pins between the USB host and
          the USB peripheral controller, write 1 to mux to the peripheral
          controller
+
+There is a mapping between indices and GPIO connection IDs as follows
+        id      index 0
+        vbus    index 1
+        mux     index 2
diff --git a/Documentation/filesystems/Locking b/Documentation/filesystems/Locking
index fdcfdd79682a..fe25787ff6d4 100644
--- a/Documentation/filesystems/Locking
+++ b/Documentation/filesystems/Locking
@@ -58,8 +58,7 @@ prototypes:
         int (*permission) (struct inode *, int, unsigned int);
         int (*get_acl)(struct inode *, int);
         int (*setattr) (struct dentry *, struct iattr *);
-        int (*getattr) (const struct path *, struct dentry *, struct kstat *,
-                        u32, unsigned int);
+        int (*getattr) (const struct path *, struct kstat *, u32, unsigned int);
         ssize_t (*listxattr) (struct dentry *, char *, size_t);
         int (*fiemap)(struct inode *, struct fiemap_extent_info *, u64 start, u64 len);
         void (*update_time)(struct inode *, struct timespec *, int);
diff --git a/Documentation/filesystems/porting b/Documentation/filesystems/porting
index 95280079c0b3..5fb17f49f7a2 100644
--- a/Documentation/filesystems/porting
+++ b/Documentation/filesystems/porting
@@ -600,3 +600,9 @@ in your dentry operations instead.
 [recommended]
         ->readlink is optional for symlinks.  Don't set, unless filesystem needs
         to fake something for readlink(2).
+--
+[mandatory]
+        ->getattr() is now passed a struct path rather than a vfsmount and
+        dentry separately, and it now has request_mask and query_flags arguments
+        to specify the fields and sync type requested by statx.  Filesystems not
+        supporting any statx-specific features may ignore the new arguments.
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index 569211703721..94dd27ef4a76 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -382,8 +382,7 @@ struct inode_operations {
         int (*permission) (struct inode *, int);
         int (*get_acl)(struct inode *, int);
         int (*setattr) (struct dentry *, struct iattr *);
-        int (*getattr) (const struct path *, struct dentry *, struct kstat *,
-                        u32, unsigned int);
+        int (*getattr) (const struct path *, struct kstat *, u32, unsigned int);
         ssize_t (*listxattr) (struct dentry *, char *, size_t);
         void (*update_time)(struct inode *, struct timespec *, int);
         int (*atomic_open)(struct inode *, struct dentry *, struct file *,
diff --git a/Documentation/gcc-plugins.txt b/Documentation/gcc-plugins.txt
index 891c69464434..433eaefb4aa1 100644
--- a/Documentation/gcc-plugins.txt
+++ b/Documentation/gcc-plugins.txt
@@ -18,8 +18,8 @@ because gcc versions 4.5 and 4.6 are compiled by a C compiler,
 gcc-4.7 can be compiled by a C or a C++ compiler,
 and versions 4.8+ can only be compiled by a C++ compiler.
 
-Currently the GCC plugin infrastructure supports only the x86, arm and arm64
-architectures.
+Currently the GCC plugin infrastructure supports only the x86, arm, arm64 and
+powerpc architectures.
 
 This infrastructure was ported from grsecurity [6] and PaX [7].
 
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index fc73eeb7b3b8..ab0230461377 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1006,7 +1006,8 @@ accept_redirects - BOOLEAN
                 FALSE (router)
 
 forwarding - BOOLEAN
-        Enable IP forwarding on this interface.
+        Enable IP forwarding on this interface.  This controls whether packets
+        received _on_ this interface can be forwarded.
 
 mc_forwarding - BOOLEAN
         Do multicast routing. The kernel needs to be compiled with CONFIG_MROUTE
diff --git a/Documentation/trace/kprobetrace.txt b/Documentation/trace/kprobetrace.txt
index e4991fb1eedc..41ef9d8efe95 100644
--- a/Documentation/trace/kprobetrace.txt
+++ b/Documentation/trace/kprobetrace.txt
@@ -12,7 +12,7 @@ kprobes can probe (this means, all functions body except for __kprobes
 functions). Unlike the Tracepoint based event, this can be added and removed
 dynamically, on the fly.
 
-To enable this feature, build your kernel with CONFIG_KPROBE_EVENT=y.
+To enable this feature, build your kernel with CONFIG_KPROBE_EVENTS=y.
 
 Similar to the events tracer, this doesn't need to be activated via
 current_tracer. Instead of that, add probe points via
diff --git a/Documentation/trace/uprobetracer.txt b/Documentation/trace/uprobetracer.txt
index fa7b680ee8a0..bf526a7c5559 100644
--- a/Documentation/trace/uprobetracer.txt
+++ b/Documentation/trace/uprobetracer.txt
@@ -7,7 +7,7 @@
 Overview
 --------
 Uprobe based trace events are similar to kprobe based trace events.
-To enable this feature, build your kernel with CONFIG_UPROBE_EVENT=y.
+To enable this feature, build your kernel with CONFIG_UPROBE_EVENTS=y.
 
 Similar to the kprobe-event tracer, this doesn't need to be activated via
 current_tracer. Instead of that, add probe points via
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index 069450938b79..fd106899afd1 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -951,6 +951,10 @@ This ioctl allows the user to create or modify a guest physical memory
 slot.  When changing an existing slot, it may be moved in the guest
 physical memory space, or its flags may be modified.  It may not be
 resized.  Slots may not overlap in guest physical address space.
+Bits 0-15 of "slot" specifies the slot id and this value should be
+less than the maximum number of user memory slots supported per VM.
+The maximum allowed slots can be queried using KVM_CAP_NR_MEMSLOTS,
+if this capability is supported by the architecture.
 
 If KVM_CAP_MULTI_ADDRESS_SPACE is available, bits 16-31 of "slot"
 specifies the address space which is being modified.  They must be
@@ -3373,6 +3377,69 @@ struct kvm_ppc_resize_hpt {
         __u32 pad;
 };
 
+4.104 KVM_X86_GET_MCE_CAP_SUPPORTED
+
+Capability: KVM_CAP_MCE
+Architectures: x86
+Type: system ioctl
+Parameters: u64 mce_cap (out)
+Returns: 0 on success, -1 on error
+
+Returns supported MCE capabilities. The u64 mce_cap parameter
+has the same format as the MSR_IA32_MCG_CAP register. Supported
+capabilities will have the corresponding bits set.
+
+4.105 KVM_X86_SETUP_MCE
+
+Capability: KVM_CAP_MCE
+Architectures: x86
+Type: vcpu ioctl
+Parameters: u64 mcg_cap (in)
+Returns: 0 on success,
+         -EFAULT if u64 mcg_cap cannot be read,
+         -EINVAL if the requested number of banks is invalid,
+         -EINVAL if requested MCE capability is not supported.
+
+Initializes MCE support for use. The u64 mcg_cap parameter
+has the same format as the MSR_IA32_MCG_CAP register and
+specifies which capabilities should be enabled. The maximum
+supported number of error-reporting banks can be retrieved when
+checking for KVM_CAP_MCE. The supported capabilities can be
+retrieved with KVM_X86_GET_MCE_CAP_SUPPORTED.
+
+4.106 KVM_X86_SET_MCE
+
+Capability: KVM_CAP_MCE
+Architectures: x86
+Type: vcpu ioctl
+Parameters: struct kvm_x86_mce (in)
+Returns: 0 on success,
+         -EFAULT if struct kvm_x86_mce cannot be read,
+         -EINVAL if the bank number is invalid,
+         -EINVAL if VAL bit is not set in status field.
+
+Inject a machine check error (MCE) into the guest. The input
+parameter is:
+
+struct kvm_x86_mce {
+        __u64 status;
+        __u64 addr;
+        __u64 misc;
+        __u64 mcg_status;
+        __u8 bank;
+        __u8 pad1[7];
+        __u64 pad2[3];
+};
+
+If the MCE being reported is an uncorrected error, KVM will
+inject it as an MCE exception into the guest. If the guest
+MCG_STATUS register reports that an MCE is in progress, KVM
+causes an KVM_EXIT_SHUTDOWN vmexit.
+
+Otherwise, if the MCE is a corrected error, KVM will just
+store it in the corresponding bank (provided this bank is
+not holding a previously reported uncorrected error).
+
 5. The kvm_run structure
 ------------------------
 
diff --git a/Documentation/vm/userfaultfd.txt b/Documentation/vm/userfaultfd.txt
index 0e5543a920e5..bb2f945f87ab 100644
--- a/Documentation/vm/userfaultfd.txt
+++ b/Documentation/vm/userfaultfd.txt
@@ -172,10 +172,6 @@ the same read(2) protocol as for the page fault notifications. The
 manager has to explicitly enable these events by setting appropriate
 bits in uffdio_api.features passed to UFFDIO_API ioctl:
 
-UFFD_FEATURE_EVENT_EXIT - enable notification about exit() of the
-non-cooperative process. When the monitored process exits, the uffd
-manager will get UFFD_EVENT_EXIT.
-
 UFFD_FEATURE_EVENT_FORK - enable userfaultfd hooks for fork(). When
 this feature is enabled, the userfaultfd context of the parent process
 is duplicated into the newly created process. The manager receives
diff --git a/MAINTAINERS b/MAINTAINERS
index c265a5fe4848..1b0a87ffffab 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3216,7 +3216,6 @@ F:	drivers/platform/chrome/
 
 CISCO VIC ETHERNET NIC DRIVER
 M:      Christian Benvenuti <benve@cisco.com>
-M:      Sujith Sankar <ssujith@cisco.com>
 M:      Govindarajulu Varadarajan <_govind@gmx.com>
 M:      Neel Patel <neepatel@cisco.com>
 S:      Supported
@@ -4776,6 +4775,12 @@ L:	linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/mpc85xx_edac.[ch]
 
+EDAC-PND2
+M:      Tony Luck <tony.luck@intel.com>
+L:      linux-edac@vger.kernel.org
+S:      Maintained
+F:      drivers/edac/pnd2_edac.[ch]
+
 EDAC-PASEMI
 M:      Egor Martovetsky <egor@pasemi.com>
 L:      linux-edac@vger.kernel.org
@@ -7774,13 +7779,6 @@ F:	include/net/mac80211.h
 F:      net/mac80211/
 F:      drivers/net/wireless/mac80211_hwsim.[ch]
 
-MACVLAN DRIVER
-M:      Patrick McHardy <kaber@trash.net>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/macvlan.c
-F:      include/linux/if_macvlan.h
-
 MAILBOX API
 M:      Jassi Brar <jassisinghbrar@gmail.com>
 L:      linux-kernel@vger.kernel.org
@@ -7853,6 +7851,8 @@ F:	drivers/net/ethernet/marvell/mvneta.*
 MARVELL MWIFIEX WIRELESS DRIVER
 M:      Amitkumar Karwar <akarwar@marvell.com>
 M:      Nishant Sarmukadam <nishants@marvell.com>
+M:      Ganapathi Bhat <gbhat@marvell.com>
+M:      Xinming Hu <huxm@marvell.com>
 L:      linux-wireless@vger.kernel.org
 S:      Maintained
 F:      drivers/net/wireless/marvell/mwifiex/
@@ -8307,7 +8307,6 @@ M:	Richard Leitner <richard.leitner@skidata.com>
 L:      linux-usb@vger.kernel.org
 S:      Maintained
 F:      drivers/usb/misc/usb251xb.c
-F:      include/linux/platform_data/usb251xb.h
 F:      Documentation/devicetree/bindings/usb/usb251xb.txt
 
 MICROSOFT SURFACE PRO 3 BUTTON DRIVER
@@ -13384,14 +13383,6 @@ W:	https://linuxtv.org
 S:      Maintained
 F:      drivers/media/platform/vivid/*
 
-VLAN (802.1Q)
-M:      Patrick McHardy <kaber@trash.net>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/macvlan.c
-F:      include/linux/if_*vlan.h
-F:      net/8021q/
-
 VLYNQ BUS
 M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      openwrt-devel@lists.openwrt.org (subscribers-only)
diff --git a/Makefile b/Makefile
index 165cf9783a5d..e11989d36c87 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 11
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc5
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
diff --git a/arch/arc/boot/dts/skeleton.dtsi b/arch/arc/boot/dts/skeleton.dtsi
index 65808fe0a290..2891cb266cf0 100644
--- a/arch/arc/boot/dts/skeleton.dtsi
+++ b/arch/arc/boot/dts/skeleton.dtsi
@@ -26,6 +26,7 @@
                         device_type = "cpu";
                         compatible = "snps,arc770d";
                         reg = <0>;
+                        clocks = <&core_clk>;
                 };
         };
 
diff --git a/arch/arc/boot/dts/skeleton_hs.dtsi b/arch/arc/boot/dts/skeleton_hs.dtsi
index 2dfe8037dfbb..5e944d3e5b74 100644
--- a/arch/arc/boot/dts/skeleton_hs.dtsi
+++ b/arch/arc/boot/dts/skeleton_hs.dtsi
@@ -21,6 +21,7 @@
                         device_type = "cpu";
                         compatible = "snps,archs38";
                         reg = <0>;
+                        clocks = <&core_clk>;
                 };
         };
 
diff --git a/arch/arc/boot/dts/skeleton_hs_idu.dtsi b/arch/arc/boot/dts/skeleton_hs_idu.dtsi
index 4c11079f3565..54b277d7dea0 100644
--- a/arch/arc/boot/dts/skeleton_hs_idu.dtsi
+++ b/arch/arc/boot/dts/skeleton_hs_idu.dtsi
@@ -19,8 +19,27 @@
 
                 cpu@0 {
                         device_type = "cpu";
-                        compatible = "snps,archs38xN";
+                        compatible = "snps,archs38";
                         reg = <0>;
+                        clocks = <&core_clk>;
+                };
+                cpu@1 {
+                        device_type = "cpu";
+                        compatible = "snps,archs38";
+                        reg = <1>;
+                        clocks = <&core_clk>;
+                };
+                cpu@2 {
+                        device_type = "cpu";
+                        compatible = "snps,archs38";
+                        reg = <2>;
+                        clocks = <&core_clk>;
+                };
+                cpu@3 {
+                        device_type = "cpu";
+                        compatible = "snps,archs38";
+                        reg = <3>;
+                        clocks = <&core_clk>;
                 };
         };
 
diff --git a/arch/arc/boot/dts/vdk_axs10x_mb.dtsi b/arch/arc/boot/dts/vdk_axs10x_mb.dtsi
index f0df59b23e21..459fc656b759 100644
--- a/arch/arc/boot/dts/vdk_axs10x_mb.dtsi
+++ b/arch/arc/boot/dts/vdk_axs10x_mb.dtsi
@@ -112,13 +112,19 @@
                         interrupts = <7>;
                         bus-width = <4>;
                 };
+        };
 
-                /* Embedded Vision subsystem UIO mappings; only relevant for EV VDK */
-                uio_ev: uio@0xD0000000 {
-                        compatible = "generic-uio";
-                        reg = <0xD0000000 0x2000 0xD1000000 0x2000 0x90000000 0x10000000 0xC0000000 0x10000000>;
-                        reg-names = "ev_gsa", "ev_ctrl", "ev_shared_mem", "ev_code_mem";
-                        interrupts = <23>;
-                };
+        /*
+         * Embedded Vision subsystem UIO mappings; only relevant for EV VDK
+         *
+         * This node is intentionally put outside of MB above becase
+         * it maps areas outside of MB's 0xEz-0xFz.
+         */
+        uio_ev: uio@0xD0000000 {
+                compatible = "generic-uio";
+                reg = <0xD0000000 0x2000 0xD1000000 0x2000 0x90000000 0x10000000 0xC0000000 0x10000000>;
+                reg-names = "ev_gsa", "ev_ctrl", "ev_shared_mem", "ev_code_mem";
+                interrupt-parent = <&mb_intc>;
+                interrupts = <23>;
         };
 };
diff --git a/arch/arc/include/asm/hugepage.h b/arch/arc/include/asm/hugepage.h
index 317ff773e1ca..b18fcb606908 100644
--- a/arch/arc/include/asm/hugepage.h
+++ b/arch/arc/include/asm/hugepage.h
@@ -11,6 +11,7 @@
 #define _ASM_ARC_HUGEPAGE_H
 
 #include <linux/types.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 static inline pte_t pmd_pte(pmd_t pmd)
diff --git a/arch/arc/include/asm/kprobes.h b/arch/arc/include/asm/kprobes.h
index 00bdbe167615..2e52d18e6bc7 100644
--- a/arch/arc/include/asm/kprobes.h
+++ b/arch/arc/include/asm/kprobes.h
@@ -54,9 +54,7 @@ int kprobe_fault_handler(struct pt_regs *regs, unsigned long cause);
 void kretprobe_trampoline(void);
 void trap_is_kprobe(unsigned long address, struct pt_regs *regs);
 #else
-static void trap_is_kprobe(unsigned long address, struct pt_regs *regs)
-{
-}
+#define trap_is_kprobe(address, regs)
 #endif /* CONFIG_KPROBES */
 
 #endif /* _ARC_KPROBES_H */
diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
index e94ca72b974e..ee22d40afef4 100644
--- a/arch/arc/include/asm/pgtable.h
+++ b/arch/arc/include/asm/pgtable.h
@@ -37,6 +37,7 @@
 
 #include <asm/page.h>
 #include <asm/mmu.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 #include <linux/const.h>
 
diff --git a/arch/arc/kernel/entry-arcv2.S b/arch/arc/kernel/entry-arcv2.S
index 2585632eaa68..cc558a25b8fa 100644
--- a/arch/arc/kernel/entry-arcv2.S
+++ b/arch/arc/kernel/entry-arcv2.S
@@ -100,15 +100,21 @@ END(handle_interrupt)
 ;################### Non TLB Exception Handling #############################
 
 ENTRY(EV_SWI)
-        flag 1
+        ; TODO: implement this
+        EXCEPTION_PROLOGUE
+        b   ret_from_exception
 END(EV_SWI)
 
 ENTRY(EV_DivZero)
-        flag 1
+        ; TODO: implement this
+        EXCEPTION_PROLOGUE
+        b   ret_from_exception
 END(EV_DivZero)
 
 ENTRY(EV_DCError)
-        flag 1
+        ; TODO: implement this
+        EXCEPTION_PROLOGUE
+        b   ret_from_exception
 END(EV_DCError)
 
 ; ---------------------------------------------
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 3093fa898a23..fa62404ba58f 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -10,6 +10,7 @@
 #include <linux/fs.h>
 #include <linux/delay.h>
 #include <linux/root_dev.h>
+#include <linux/clk.h>
 #include <linux/clk-provider.h>
 #include <linux/clocksource.h>
 #include <linux/console.h>
@@ -488,8 +489,9 @@ static int show_cpuinfo(struct seq_file *m, void *v)
 {
         char *str;
         int cpu_id = ptr_to_cpu(v);
-        struct device_node *core_clk = of_find_node_by_name(NULL, "core_clk");
-        u32 freq = 0;
+        struct device *cpu_dev = get_cpu_device(cpu_id);
+        struct clk *cpu_clk;
+        unsigned long freq = 0;
 
         if (!cpu_online(cpu_id)) {
                 seq_printf(m, "processor [%d]\t: Offline\n", cpu_id);
@@ -502,9 +504,15 @@ static int show_cpuinfo(struct seq_file *m, void *v)
 
         seq_printf(m, arc_cpu_mumbojumbo(cpu_id, str, PAGE_SIZE));
 
-        of_property_read_u32(core_clk, "clock-frequency", &freq);
+        cpu_clk = clk_get(cpu_dev, NULL);
+        if (IS_ERR(cpu_clk)) {
+                seq_printf(m, "CPU speed \t: Cannot get clock for processor [%d]\n",
+                           cpu_id);
+        } else {
+                freq = clk_get_rate(cpu_clk);
+        }
         if (freq)
-                seq_printf(m, "CPU speed\t: %u.%02u Mhz\n",
+                seq_printf(m, "CPU speed\t: %lu.%02lu Mhz\n",
                            freq / 1000000, (freq / 10000) % 100);
 
         seq_printf(m, "Bogo MIPS\t: %lu.%02lu\n",
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index d408fa21a07c..928562967f3c 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -633,6 +633,9 @@ noinline static void slc_entire_op(const int op)
 
         write_aux_reg(ARC_REG_SLC_INVALIDATE, 1);
 
+        /* Make sure "busy" bit reports correct stataus, see STAR 9001165532 */
+        read_aux_reg(r);
+
         /* Important to wait for flush to complete */
         while (read_aux_reg(r) & SLC_CTRL_BUSY);
 }
diff --git a/arch/arm/boot/dts/am335x-pcm-953.dtsi b/arch/arm/boot/dts/am335x-pcm-953.dtsi
index 02981eae96b9..1ec8e0d80191 100644
--- a/arch/arm/boot/dts/am335x-pcm-953.dtsi
+++ b/arch/arm/boot/dts/am335x-pcm-953.dtsi
@@ -63,14 +63,14 @@
                         label = "home";
                         linux,code = <KEY_HOME>;
                         gpios = <&gpio3 7 GPIO_ACTIVE_HIGH>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 button@1 {
                         label = "menu";
                         linux,code = <KEY_MENU>;
                         gpios = <&gpio3 8 GPIO_ACTIVE_HIGH>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
         };
diff --git a/arch/arm/boot/dts/am57xx-idk-common.dtsi b/arch/arm/boot/dts/am57xx-idk-common.dtsi
index 0d341c545b01..e5ac1d81d15c 100644
--- a/arch/arm/boot/dts/am57xx-idk-common.dtsi
+++ b/arch/arm/boot/dts/am57xx-idk-common.dtsi
@@ -315,6 +315,13 @@
                         /* ID & VBUS GPIOs provided in board dts */
                 };
         };
+
+        tpic2810: tpic2810@60 {
+                compatible = "ti,tpic2810";
+                reg = <0x60>;
+                gpio-controller;
+                #gpio-cells = <2>;
+        };
 };
 
 &mcspi3 {
@@ -330,13 +337,6 @@
                 spi-max-frequency = <1000000>;
                 spi-cpol;
         };
-
-        tpic2810: tpic2810@60 {
-                compatible = "ti,tpic2810";
-                reg = <0x60>;
-                gpio-controller;
-                #gpio-cells = <2>;
-        };
 };
 
 &uart3 {
diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
index 4fbb089cf5ad..00de62dc0042 100644
--- a/arch/arm/boot/dts/bcm5301x.dtsi
+++ b/arch/arm/boot/dts/bcm5301x.dtsi
@@ -66,14 +66,14 @@
                 timer@20200 {
                         compatible = "arm,cortex-a9-global-timer";
                         reg = <0x20200 0x100>;
-                        interrupts = <GIC_PPI 11 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_PPI 11 IRQ_TYPE_EDGE_RISING>;
                         clocks = <&periph_clk>;
                 };
 
                 local-timer@20600 {
                         compatible = "arm,cortex-a9-twd-timer";
                         reg = <0x20600 0x100>;
-                        interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_PPI 13 IRQ_TYPE_EDGE_RISING>;
                         clocks = <&periph_clk>;
                 };
 
diff --git a/arch/arm/boot/dts/bcm953012k.dts b/arch/arm/boot/dts/bcm953012k.dts
index bfd923096a8c..ae31a5826e91 100644
--- a/arch/arm/boot/dts/bcm953012k.dts
+++ b/arch/arm/boot/dts/bcm953012k.dts
@@ -48,15 +48,14 @@
         };
 
         memory {
-                reg = <0x00000000 0x10000000>;
+                reg = <0x80000000 0x10000000>;
         };
 };
 
 &uart0 {
-        clock-frequency = <62499840>;
+        status = "okay";
 };
 
 &uart1 {
-        clock-frequency = <62499840>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/bcm958522er.dts b/arch/arm/boot/dts/bcm958522er.dts
index 3f04a40eb90c..df05e7f568af 100644
--- a/arch/arm/boot/dts/bcm958522er.dts
+++ b/arch/arm/boot/dts/bcm958522er.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958525er.dts b/arch/arm/boot/dts/bcm958525er.dts
index 9fd542200d3d..4a3ab19c6281 100644
--- a/arch/arm/boot/dts/bcm958525er.dts
+++ b/arch/arm/boot/dts/bcm958525er.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958525xmc.dts b/arch/arm/boot/dts/bcm958525xmc.dts
index 41e7fd350fcd..81f78435d8c7 100644
--- a/arch/arm/boot/dts/bcm958525xmc.dts
+++ b/arch/arm/boot/dts/bcm958525xmc.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 31 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958622hr.dts b/arch/arm/boot/dts/bcm958622hr.dts
index 477c4860db52..c88b8fefcb2f 100644
--- a/arch/arm/boot/dts/bcm958622hr.dts
+++ b/arch/arm/boot/dts/bcm958622hr.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958623hr.dts b/arch/arm/boot/dts/bcm958623hr.dts
index c0a499d5ba44..d503fa0dde31 100644
--- a/arch/arm/boot/dts/bcm958623hr.dts
+++ b/arch/arm/boot/dts/bcm958623hr.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958625hr.dts b/arch/arm/boot/dts/bcm958625hr.dts
index f7eb5854a224..cc0363b843c1 100644
--- a/arch/arm/boot/dts/bcm958625hr.dts
+++ b/arch/arm/boot/dts/bcm958625hr.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm988312hr.dts b/arch/arm/boot/dts/bcm988312hr.dts
index 16666324fda8..74e15a3cd9f8 100644
--- a/arch/arm/boot/dts/bcm988312hr.dts
+++ b/arch/arm/boot/dts/bcm988312hr.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi b/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
index 49f466fe0b1d..dcfc97591433 100644
--- a/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
+++ b/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
@@ -121,11 +121,6 @@
         };
 };
 
-&cpu0 {
-        arm-supply = <&sw1a_reg>;
-        soc-supply = <&sw1c_reg>;
-};
-
 &fec1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_enet1>;
diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index 22332be72140..528b4e9c6d3d 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -266,7 +266,7 @@
                 };
 
                 usb1: ohci@00400000 {
-                        compatible = "atmel,sama5d2-ohci", "usb-ohci";
+                        compatible = "atmel,at91rm9200-ohci", "usb-ohci";
                         reg = <0x00400000 0x100000>;
                         interrupts = <41 IRQ_TYPE_LEVEL_HIGH 2>;
                         clocks = <&uhphs_clk>, <&uhphs_clk>, <&uhpck>;
diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
index 82d8c4771293..162e1eb5373d 100644
--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
+++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
@@ -14,6 +14,7 @@
 #include <dt-bindings/mfd/dbx500-prcmu.h>
 #include <dt-bindings/arm/ux500_pm_domains.h>
 #include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/clock/ste-ab8500.h>
 #include "skeleton.dtsi"
 
 / {
@@ -603,6 +604,11 @@
                                 interrupt-controller;
                                 #interrupt-cells = <2>;
 
+                                ab8500_clock: clock-controller {
+                                        compatible = "stericsson,ab8500-clk";
+                                        #clock-cells = <1>;
+                                };
+
                                 ab8500_gpio: ab8500-gpio {
                                         compatible = "stericsson,ab8500-gpio";
                                         gpio-controller;
@@ -686,6 +692,8 @@
 
                                 ab8500-pwm {
                                         compatible = "stericsson,ab8500-pwm";
+                                        clocks = <&ab8500_clock AB8500_SYSCLK_INT>;
+                                        clock-names = "intclk";
                                 };
 
                                 ab8500-debugfs {
@@ -700,6 +708,9 @@
                                         V-AMIC2-supply = <&ab8500_ldo_anamic2_reg>;
                                         V-DMIC-supply = <&ab8500_ldo_dmic_reg>;
 
+                                        clocks = <&ab8500_clock AB8500_SYSCLK_AUDIO>;
+                                        clock-names = "audioclk";
+
                                         stericsson,earpeice-cmv = <950>; /* Units in mV. */
                                 };
 
@@ -1095,6 +1106,14 @@
                         status = "disabled";
                 };
 
+                sound {
+                        compatible = "stericsson,snd-soc-mop500";
+                        stericsson,cpu-dai = <&msp1 &msp3>;
+                        stericsson,audio-codec = <&codec>;
+                        clocks = <&prcmu_clk PRCMU_SYSCLK>, <&ab8500_clock AB8500_SYSCLK_ULP>, <&ab8500_clock AB8500_SYSCLK_INT>;
+                        clock-names = "sysclk", "ulpclk", "intclk";
+                };
+
                 msp0: msp@80123000 {
                         compatible = "stericsson,ux500-msp-i2s";
                         reg = <0x80123000 0x1000>;
diff --git a/arch/arm/boot/dts/ste-href.dtsi b/arch/arm/boot/dts/ste-href.dtsi
index f37f9e10713c..9e359e4f342e 100644
--- a/arch/arm/boot/dts/ste-href.dtsi
+++ b/arch/arm/boot/dts/ste-href.dtsi
@@ -186,15 +186,6 @@
                         status = "okay";
                 };
 
-                sound {
-                        compatible = "stericsson,snd-soc-mop500";
-
-                        stericsson,cpu-dai = <&msp1 &msp3>;
-                        stericsson,audio-codec = <&codec>;
-                        clocks = <&prcmu_clk PRCMU_SYSCLK>;
-                        clock-names = "sysclk";
-                };
-
                 msp0: msp@80123000 {
                         pinctrl-names = "default";
                         pinctrl-0 = <&msp0_default_mode>;
diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
index dd5514def604..ade1d0d4e5f4 100644
--- a/arch/arm/boot/dts/ste-snowball.dts
+++ b/arch/arm/boot/dts/ste-snowball.dts
@@ -159,15 +159,6 @@
                                      "", "", "", "", "", "", "", "";
                 };
 
-                sound {
-                        compatible = "stericsson,snd-soc-mop500";
-
-                        stericsson,cpu-dai = <&msp1 &msp3>;
-                        stericsson,audio-codec = <&codec>;
-                        clocks = <&prcmu_clk PRCMU_SYSCLK>;
-                        clock-names = "sysclk";
-                };
-
                 msp0: msp@80123000 {
                         pinctrl-names = "default";
                         pinctrl-0 = <&msp0_default_mode>;
diff --git a/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts b/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts
index 72ec0d5ae052..bbf1c8cbaac6 100644
--- a/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts
+++ b/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts
@@ -167,7 +167,7 @@
                                         reg = <8>;
                                         label = "cpu";
                                         ethernet = <&gmac>;
-                                        phy-mode = "rgmii";
+                                        phy-mode = "rgmii-txid";
                                         fixed-link {
                                                 speed = <1000>;
                                                 full-duplex;
diff --git a/arch/arm/boot/dts/sun8i-a23-a33.dtsi b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
index a952cc0703cc..8a3ed21cb7bc 100644
--- a/arch/arm/boot/dts/sun8i-a23-a33.dtsi
+++ b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
@@ -495,7 +495,7 @@
                         resets = <&ccu RST_BUS_GPU>;
 
                         assigned-clocks = <&ccu CLK_GPU>;
-                        assigned-clock-rates = <408000000>;
+                        assigned-clock-rates = <384000000>;
                 };
 
                 gic: interrupt-controller@01c81000 {
diff --git a/arch/arm/boot/dts/sun8i-a33.dtsi b/arch/arm/boot/dts/sun8i-a33.dtsi
index 18c174fef84f..0467fb365bfc 100644
--- a/arch/arm/boot/dts/sun8i-a33.dtsi
+++ b/arch/arm/boot/dts/sun8i-a33.dtsi
@@ -113,8 +113,8 @@
                 simple-audio-card,mclk-fs = <512>;
                 simple-audio-card,aux-devs = <&codec_analog>;
                 simple-audio-card,routing =
-                        "Left DAC", "Digital Left DAC",
-                        "Right DAC", "Digital Right DAC";
+                        "Left DAC", "AIF1 Slot 0 Left",
+                        "Right DAC", "AIF1 Slot 0 Right";
                 status = "disabled";
 
                 simple-audio-card,cpu {
diff --git a/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi b/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
index 7097c18ff487..d6bd15898db6 100644
--- a/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
+++ b/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
@@ -50,8 +50,6 @@
 
         backlight: backlight {
                 compatible = "pwm-backlight";
-                pinctrl-names = "default";
-                pinctrl-0 = <&bl_en_pin>;
                 pwms = <&pwm 0 50000 PWM_POLARITY_INVERTED>;
                 brightness-levels = <0 10 20 30 40 50 60 70 80 90 100>;
                 default-brightness-level = <8>;
@@ -93,11 +91,6 @@
 };
 
 &pio {
-        bl_en_pin: bl_en_pin@0 {
-                pins = "PH6";
-                function = "gpio_in";
-        };
-
         mmc0_cd_pin: mmc0_cd_pin@0 {
                 pins = "PB4";
                 function = "gpio_in";
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index f2462a6bdba6..decd388d613d 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -188,6 +188,7 @@ CONFIG_WL12XX=m
 CONFIG_WL18XX=m
 CONFIG_WLCORE_SPI=m
 CONFIG_WLCORE_SDIO=m
+CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_JOYDEV=m
 CONFIG_INPUT_EVDEV=m
 CONFIG_KEYBOARD_ATKBD=m
diff --git a/arch/arm/include/asm/kvm_arm.h b/arch/arm/include/asm/kvm_arm.h
index e22089fb44dc..a3f0b3d50089 100644
--- a/arch/arm/include/asm/kvm_arm.h
+++ b/arch/arm/include/asm/kvm_arm.h
@@ -209,6 +209,7 @@
 #define HSR_EC_IABT_HYP (0x21)
 #define HSR_EC_DABT     (0x24)
 #define HSR_EC_DABT_HYP (0x25)
+#define HSR_EC_MAX      (0x3f)
 
 #define HSR_WFI_IS_WFE          (_AC(1, UL) << 0)
 
diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index cc495d799c67..31ee468ce667 100644
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -30,7 +30,6 @@
 #define __KVM_HAVE_ARCH_INTC_INITIALIZED
 
 #define KVM_USER_MEM_SLOTS 32
-#define KVM_PRIVATE_MEM_SLOTS 4
 #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
 #define KVM_HAVE_ONE_REG
 #define KVM_HALT_POLL_NS_DEFAULT 500000
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
index a8d656d9aec7..1c462381c225 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -20,6 +20,7 @@
 
 #else
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 #include <asm/memory.h>
 #include <asm/pgtable-hwdef.h>
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index c9a2103faeb9..96dba7cd8be7 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -221,6 +221,9 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
         case KVM_CAP_MAX_VCPUS:
                 r = KVM_MAX_VCPUS;
                 break;
+        case KVM_CAP_NR_MEMSLOTS:
+                r = KVM_USER_MEM_SLOTS;
+                break;
         case KVM_CAP_MSI_DEVID:
                 if (!kvm)
                         r = -EINVAL;
diff --git a/arch/arm/kvm/handle_exit.c b/arch/arm/kvm/handle_exit.c
index 4e40d1955e35..96af65a30d78 100644
--- a/arch/arm/kvm/handle_exit.c
+++ b/arch/arm/kvm/handle_exit.c
@@ -79,7 +79,19 @@ static int kvm_handle_wfx(struct kvm_vcpu *vcpu, struct kvm_run *run)
         return 1;
 }
 
+static int kvm_handle_unknown_ec(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        u32 hsr = kvm_vcpu_get_hsr(vcpu);
+
+        kvm_pr_unimpl("Unknown exception class: hsr: %#08x\n",
+                      hsr);
+
+        kvm_inject_undefined(vcpu);
+        return 1;
+}
+
 static exit_handle_fn arm_exit_handlers[] = {
+        [0 ... HSR_EC_MAX]      = kvm_handle_unknown_ec,
         [HSR_EC_WFI]            = kvm_handle_wfx,
         [HSR_EC_CP15_32]        = kvm_handle_cp15_32,
         [HSR_EC_CP15_64]        = kvm_handle_cp15_64,
@@ -98,13 +110,6 @@ static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu)
 {
         u8 hsr_ec = kvm_vcpu_trap_get_class(vcpu);
 
-        if (hsr_ec >= ARRAY_SIZE(arm_exit_handlers) ||
-            !arm_exit_handlers[hsr_ec]) {
-                kvm_err("Unknown exception class: hsr: %#08x\n",
-                        (unsigned int)kvm_vcpu_get_hsr(vcpu));
-                BUG();
-        }
-
         return arm_exit_handlers[hsr_ec];
 }
 
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 3d89b7905bd9..a277981f414d 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -289,6 +289,22 @@ static void at91_ddr_standby(void)
                 at91_ramc_write(1, AT91_DDRSDRC_LPR, saved_lpr1);
 }
 
+static void sama5d3_ddr_standby(void)
+{
+        u32 lpr0;
+        u32 saved_lpr0;
+
+        saved_lpr0 = at91_ramc_read(0, AT91_DDRSDRC_LPR);
+        lpr0 = saved_lpr0 & ~AT91_DDRSDRC_LPCB;
+        lpr0 |= AT91_DDRSDRC_LPCB_POWER_DOWN;
+
+        at91_ramc_write(0, AT91_DDRSDRC_LPR, lpr0);
+
+        cpu_do_idle();
+
+        at91_ramc_write(0, AT91_DDRSDRC_LPR, saved_lpr0);
+}
+
 /* We manage both DDRAM/SDRAM controllers, we need more than one value to
  * remember.
  */
@@ -323,7 +339,7 @@ static const struct of_device_id const ramc_ids[] __initconst = {
         { .compatible = "atmel,at91rm9200-sdramc", .data = at91rm9200_standby },
         { .compatible = "atmel,at91sam9260-sdramc", .data = at91sam9_sdram_standby },
         { .compatible = "atmel,at91sam9g45-ddramc", .data = at91_ddr_standby },
-        { .compatible = "atmel,sama5d3-ddramc", .data = at91_ddr_standby },
+        { .compatible = "atmel,sama5d3-ddramc", .data = sama5d3_ddr_standby },
         { /*sentinel*/ }
 };
 
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index 093458b62c8d..c89757abb0ae 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -241,6 +241,3 @@ obj-$(CONFIG_MACH_OMAP2_TUSB6010)	+= usb-tusb6010.o
 
 onenand-$(CONFIG_MTD_ONENAND_OMAP2)     := gpmc-onenand.o
 obj-y                                   += $(onenand-m) $(onenand-y)
-
-nand-$(CONFIG_MTD_NAND_OMAP2)           := gpmc-nand.o
-obj-y                                   += $(nand-m) $(nand-y)
diff --git a/arch/arm/mach-omap2/gpmc-nand.c b/arch/arm/mach-omap2/gpmc-nand.c
deleted file mode 100644
index f6ac027f3c3b..000000000000
--- a/arch/arm/mach-omap2/gpmc-nand.c
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
- * gpmc-nand.c
- *
- * Copyright (C) 2009 Texas Instruments
- * Vimal Singh <vimalsingh@ti.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/kernel.h>
-#include <linux/platform_device.h>
-#include <linux/io.h>
-#include <linux/omap-gpmc.h>
-#include <linux/mtd/nand.h>
-#include <linux/platform_data/mtd-nand-omap2.h>
-
-#include <asm/mach/flash.h>
-
-#include "soc.h"
-
-/* minimum size for IO mapping */
-#define NAND_IO_SIZE    4
-
-static bool gpmc_hwecc_bch_capable(enum omap_ecc ecc_opt)
-{
-        /* platforms which support all ECC schemes */
-        if (soc_is_am33xx() || soc_is_am43xx() || cpu_is_omap44xx() ||
-                 soc_is_omap54xx() || soc_is_dra7xx())
-                return 1;
-
-        if (ecc_opt == OMAP_ECC_BCH4_CODE_HW_DETECTION_SW ||
-                 ecc_opt == OMAP_ECC_BCH8_CODE_HW_DETECTION_SW) {
-                if (cpu_is_omap24xx())
-                        return 0;
-                else if (cpu_is_omap3630() && (GET_OMAP_REVISION() == 0))
-                        return 0;
-                else
-                        return 1;
-        }
-
-        /* OMAP3xxx do not have ELM engine, so cannot support ECC schemes
-         * which require H/W based ECC error detection */
-        if ((cpu_is_omap34xx() || cpu_is_omap3630()) &&
-            ((ecc_opt == OMAP_ECC_BCH4_CODE_HW) ||
-                 (ecc_opt == OMAP_ECC_BCH8_CODE_HW)))
-                return 0;
-
-        /* legacy platforms support only HAM1 (1-bit Hamming) ECC scheme */
-        if (ecc_opt == OMAP_ECC_HAM1_CODE_HW ||
-            ecc_opt == OMAP_ECC_HAM1_CODE_SW)
-                return 1;
-        else
-                return 0;
-}
-
-/* This function will go away once the device-tree convertion is complete */
-static void gpmc_set_legacy(struct omap_nand_platform_data *gpmc_nand_data,
-                            struct gpmc_settings *s)
-{
-        /* Enable RD PIN Monitoring Reg */
-        if (gpmc_nand_data->dev_ready) {
-                s->wait_on_read = true;
-                s->wait_on_write = true;
-        }
-
-        if (gpmc_nand_data->devsize == NAND_BUSWIDTH_16)
-                s->device_width = GPMC_DEVWIDTH_16BIT;
-        else
-                s->device_width = GPMC_DEVWIDTH_8BIT;
-}
-
-int gpmc_nand_init(struct omap_nand_platform_data *gpmc_nand_data,
-                   struct gpmc_timings *gpmc_t)
-{
-        int err = 0;
-        struct gpmc_settings s;
-        struct platform_device *pdev;
-        struct resource gpmc_nand_res[] = {
-                { .flags = IORESOURCE_MEM, },
-                { .flags = IORESOURCE_IRQ, },
-                { .flags = IORESOURCE_IRQ, },
-        };
-
-        BUG_ON(gpmc_nand_data->cs >= GPMC_CS_NUM);
-
-        err = gpmc_cs_request(gpmc_nand_data->cs, NAND_IO_SIZE,
-                              (unsigned long *)&gpmc_nand_res[0].start);
-        if (err < 0) {
-                pr_err("omap2-gpmc: Cannot request GPMC CS %d, error %d\n",
-                       gpmc_nand_data->cs, err);
-                return err;
-        }
-        gpmc_nand_res[0].end = gpmc_nand_res[0].start + NAND_IO_SIZE - 1;
-        gpmc_nand_res[1].start = gpmc_get_client_irq(GPMC_IRQ_FIFOEVENTENABLE);
-        gpmc_nand_res[2].start = gpmc_get_client_irq(GPMC_IRQ_COUNT_EVENT);
-
-        memset(&s, 0, sizeof(struct gpmc_settings));
-        gpmc_set_legacy(gpmc_nand_data, &s);
-
-        s.device_nand = true;
-
-        if (gpmc_t) {
-                err = gpmc_cs_set_timings(gpmc_nand_data->cs, gpmc_t, &s);
-                if (err < 0) {
-                        pr_err("omap2-gpmc: Unable to set gpmc timings: %d\n",
-                               err);
-                        return err;
-                }
-        }
-
-        err = gpmc_cs_program_settings(gpmc_nand_data->cs, &s);
-        if (err < 0)
-                goto out_free_cs;
-
-        err = gpmc_configure(GPMC_CONFIG_WP, 0);
-        if (err < 0)
-                goto out_free_cs;
-
-        if (!gpmc_hwecc_bch_capable(gpmc_nand_data->ecc_opt)) {
-                pr_err("omap2-nand: Unsupported NAND ECC scheme selected\n");
-                err = -EINVAL;
-                goto out_free_cs;
-        }
-
-
-        pdev = platform_device_alloc("omap2-nand", gpmc_nand_data->cs);
-        if (pdev) {
-                err = platform_device_add_resources(pdev, gpmc_nand_res,
-                                                    ARRAY_SIZE(gpmc_nand_res));
-                if (!err)
-                        pdev->dev.platform_data = gpmc_nand_data;
-        } else {
-                err = -ENOMEM;
-        }
-        if (err)
-                goto out_free_pdev;
-
-        err = platform_device_add(pdev);
-        if (err) {
-                dev_err(&pdev->dev, "Unable to register NAND device\n");
-                goto out_free_pdev;
-        }
-
-        return 0;
-
-out_free_pdev:
-        platform_device_put(pdev);
-out_free_cs:
-        gpmc_cs_free(gpmc_nand_data->cs);
-
-        return err;
-}
diff --git a/arch/arm/mach-omap2/gpmc-onenand.c b/arch/arm/mach-omap2/gpmc-onenand.c
index 8633c703546a..2944af820558 100644
--- a/arch/arm/mach-omap2/gpmc-onenand.c
+++ b/arch/arm/mach-omap2/gpmc-onenand.c
@@ -367,7 +367,7 @@ static int gpmc_onenand_setup(void __iomem *onenand_base, int *freq_ptr)
         return ret;
 }
 
-void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data)
+int gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data)
 {
         int err;
         struct device *dev = &gpmc_onenand_device.dev;
@@ -393,15 +393,17 @@ void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data)
         if (err < 0) {
                 dev_err(dev, "Cannot request GPMC CS %d, error %d\n",
                         gpmc_onenand_data->cs, err);
-                return;
+                return err;
         }
 
         gpmc_onenand_resource.end = gpmc_onenand_resource.start +
                                                         ONENAND_IO_SIZE - 1;
 
-        if (platform_device_register(&gpmc_onenand_device) < 0) {
+        err = platform_device_register(&gpmc_onenand_device);
+        if (err) {
                 dev_err(dev, "Unable to register OneNAND device\n");
                 gpmc_cs_free(gpmc_onenand_data->cs);
-                return;
         }
+
+        return err;
 }
diff --git a/arch/arm/mach-omap2/omap-headsmp.S b/arch/arm/mach-omap2/omap-headsmp.S
index fe36ce2734d4..4c6f14cf92a8 100644
--- a/arch/arm/mach-omap2/omap-headsmp.S
+++ b/arch/arm/mach-omap2/omap-headsmp.S
@@ -17,6 +17,7 @@
 
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 
 #include "omap44xx.h"
 
@@ -66,7 +67,7 @@ wait_2:	ldr	r2, =AUX_CORE_BOOT0_PA	@ read from AuxCoreBoot0
         cmp     r0, r4
         bne     wait_2
         ldr     r12, =API_HYP_ENTRY
-        adr     r0, hyp_boot
+        badr    r0, hyp_boot
         smc     #0
 hyp_boot:
         b       omap_secondary_startup
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index 56f917ec8621..1435fee39a89 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -2112,11 +2112,20 @@ static struct omap_hwmod_ocp_if omap3_l4_core__i2c3 = {
 };
 
 /* L4 CORE -> SR1 interface */
+static struct omap_hwmod_addr_space omap3_sr1_addr_space[] = {
+        {
+                .pa_start       = OMAP34XX_SR1_BASE,
+                .pa_end         = OMAP34XX_SR1_BASE + SZ_1K - 1,
+                .flags          = ADDR_TYPE_RT,
+        },
+        { },
+};
 
 static struct omap_hwmod_ocp_if omap34xx_l4_core__sr1 = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap34xx_sr1_hwmod,
         .clk            = "sr_l4_ick",
+        .addr           = omap3_sr1_addr_space,
         .user           = OCP_USER_MPU,
 };
 
@@ -2124,15 +2133,25 @@ static struct omap_hwmod_ocp_if omap36xx_l4_core__sr1 = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap36xx_sr1_hwmod,
         .clk            = "sr_l4_ick",
+        .addr           = omap3_sr1_addr_space,
         .user           = OCP_USER_MPU,
 };
 
 /* L4 CORE -> SR1 interface */
+static struct omap_hwmod_addr_space omap3_sr2_addr_space[] = {
+        {
+                .pa_start       = OMAP34XX_SR2_BASE,
+                .pa_end         = OMAP34XX_SR2_BASE + SZ_1K - 1,
+                .flags          = ADDR_TYPE_RT,
+        },
+        { },
+};
 
 static struct omap_hwmod_ocp_if omap34xx_l4_core__sr2 = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap34xx_sr2_hwmod,
         .clk            = "sr_l4_ick",
+        .addr           = omap3_sr2_addr_space,
         .user           = OCP_USER_MPU,
 };
 
@@ -2140,6 +2159,7 @@ static struct omap_hwmod_ocp_if omap36xx_l4_core__sr2 = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap36xx_sr2_hwmod,
         .clk            = "sr_l4_ick",
+        .addr           = omap3_sr2_addr_space,
         .user           = OCP_USER_MPU,
 };
 
@@ -3111,16 +3131,20 @@ static struct omap_hwmod_ocp_if *omap3xxx_dss_hwmod_ocp_ifs[] __initdata = {
  * Return: 0 if device named @dev_name is not likely to be accessible,
  * or 1 if it is likely to be accessible.
  */
-static int __init omap3xxx_hwmod_is_hs_ip_block_usable(struct device_node *bus,
-                                                       const char *dev_name)
+static bool __init omap3xxx_hwmod_is_hs_ip_block_usable(struct device_node *bus,
+                                                        const char *dev_name)
 {
+        struct device_node *node;
+        bool available;
+
         if (!bus)
-                return (omap_type() == OMAP2_DEVICE_TYPE_GP) ? 1 : 0;
+                return omap_type() == OMAP2_DEVICE_TYPE_GP;
 
-        if (of_device_is_available(of_find_node_by_name(bus, dev_name)))
-                return 1;
+        node = of_get_child_by_name(bus, dev_name);
+        available = of_device_is_available(node);
+        of_node_put(node);
 
-        return 0;
+        return available;
 }
 
 int __init omap3xxx_hwmod_init(void)
@@ -3189,15 +3213,20 @@ int __init omap3xxx_hwmod_init(void)
 
         if (h_sham && omap3xxx_hwmod_is_hs_ip_block_usable(bus, "sham")) {
                 r = omap_hwmod_register_links(h_sham);
-                if (r < 0)
+                if (r < 0) {
+                        of_node_put(bus);
                         return r;
+                }
         }
 
         if (h_aes && omap3xxx_hwmod_is_hs_ip_block_usable(bus, "aes")) {
                 r = omap_hwmod_register_links(h_aes);
-                if (r < 0)
+                if (r < 0) {
+                        of_node_put(bus);
                         return r;
+                }
         }
+        of_node_put(bus);
 
         /*
          * Register hwmod links specific to certain ES levels of a
diff --git a/arch/arm/tools/syscall.tbl b/arch/arm/tools/syscall.tbl
index 3c2cb5d5adfa..0bb0e9c6376c 100644
--- a/arch/arm/tools/syscall.tbl
+++ b/arch/arm/tools/syscall.tbl
@@ -411,3 +411,4 @@
 394     common  pkey_mprotect           sys_pkey_mprotect
 395     common  pkey_alloc              sys_pkey_alloc
 396     common  pkey_free               sys_pkey_free
+397     common  statx                   sys_statx
diff --git a/arch/arm/xen/mm.c b/arch/arm/xen/mm.c
index ce18c91b50a1..f0325d96b97a 100644
--- a/arch/arm/xen/mm.c
+++ b/arch/arm/xen/mm.c
@@ -198,6 +198,8 @@ static const struct dma_map_ops xen_swiotlb_dma_ops = {
         .unmap_page = xen_swiotlb_unmap_page,
         .dma_supported = xen_swiotlb_dma_supported,
         .set_dma_mask = xen_swiotlb_set_dma_mask,
+        .mmap = xen_swiotlb_dma_mmap,
+        .get_sgtable = xen_swiotlb_get_sgtable,
 };
 
 int __init xen_mm_init(void)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index a39029b5414e..3741859765cf 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -508,6 +508,16 @@ config QCOM_FALKOR_ERRATUM_1009
 
           If unsure, say Y.
 
+config QCOM_QDF2400_ERRATUM_0065
+        bool "QDF2400 E0065: Incorrect GITS_TYPER.ITT_Entry_size"
+        default y
+        help
+          On Qualcomm Datacenter Technologies QDF2400 SoC, ITS hardware reports
+          ITE size incorrectly. The GITS_TYPER.ITT_Entry_size field should have
+          been indicated as 16Bytes (0xf), not 8Bytes (0x7).
+
+          If unsure, say Y.
+
 endmenu
 
 
@@ -1063,6 +1073,10 @@ config SYSVIPC_COMPAT
         def_bool y
         depends on COMPAT && SYSVIPC
 
+config KEYS_COMPAT
+        def_bool y
+        depends on COMPAT && KEYS
+
 endmenu
 
 menu "Power management options"
diff --git a/arch/arm64/boot/dts/broadcom/ns2.dtsi b/arch/arm64/boot/dts/broadcom/ns2.dtsi
index 9f9e203c09c5..bcb03fc32665 100644
--- a/arch/arm64/boot/dts/broadcom/ns2.dtsi
+++ b/arch/arm64/boot/dts/broadcom/ns2.dtsi
@@ -114,6 +114,7 @@
         pcie0: pcie@20020000 {
                 compatible = "brcm,iproc-pcie";
                 reg = <0 0x20020000 0 0x1000>;
+                dma-coherent;
 
                 #interrupt-cells = <1>;
                 interrupt-map-mask = <0 0 0 0>;
@@ -144,6 +145,7 @@
         pcie4: pcie@50020000 {
                 compatible = "brcm,iproc-pcie";
                 reg = <0 0x50020000 0 0x1000>;
+                dma-coherent;
 
                 #interrupt-cells = <1>;
                 interrupt-map-mask = <0 0 0 0>;
@@ -174,6 +176,7 @@
         pcie8: pcie@60c00000 {
                 compatible = "brcm,iproc-pcie-paxc";
                 reg = <0 0x60c00000 0 0x1000>;
+                dma-coherent;
                 linux,pci-domain = <8>;
 
                 bus-range = <0x0 0x1>;
@@ -203,6 +206,7 @@
                               <0x61030000 0x100>;
                         reg-names = "amac_base", "idm_base", "nicpm_base";
                         interrupts = <GIC_SPI 341 IRQ_TYPE_LEVEL_HIGH>;
+                        dma-coherent;
                         phy-handle = <&gphy0>;
                         phy-mode = "rgmii";
                         status = "disabled";
@@ -213,6 +217,7 @@
                         reg = <0x612c0000 0x445>;  /* PDC FS0 regs */
                         interrupts = <GIC_SPI 187 IRQ_TYPE_LEVEL_HIGH>;
                         #mbox-cells = <1>;
+                        dma-coherent;
                         brcm,rx-status-len = <32>;
                         brcm,use-bcm-hdr;
                 };
@@ -222,6 +227,7 @@
                         reg = <0x612e0000 0x445>;  /* PDC FS1 regs */
                         interrupts = <GIC_SPI 189 IRQ_TYPE_LEVEL_HIGH>;
                         #mbox-cells = <1>;
+                        dma-coherent;
                         brcm,rx-status-len = <32>;
                         brcm,use-bcm-hdr;
                 };
@@ -231,6 +237,7 @@
                         reg = <0x61300000 0x445>;  /* PDC FS2 regs */
                         interrupts = <GIC_SPI 191 IRQ_TYPE_LEVEL_HIGH>;
                         #mbox-cells = <1>;
+                        dma-coherent;
                         brcm,rx-status-len = <32>;
                         brcm,use-bcm-hdr;
                 };
@@ -240,6 +247,7 @@
                         reg = <0x61320000 0x445>;  /* PDC FS3 regs */
                         interrupts = <GIC_SPI 193 IRQ_TYPE_LEVEL_HIGH>;
                         #mbox-cells = <1>;
+                        dma-coherent;
                         brcm,rx-status-len = <32>;
                         brcm,use-bcm-hdr;
                 };
@@ -644,6 +652,7 @@
                 sata: ahci@663f2000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
                         reg = <0x663f2000 0x1000>;
+                        dma-coherent;
                         reg-names = "ahci";
                         interrupts = <GIC_SPI 438 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
@@ -667,6 +676,7 @@
                         compatible = "brcm,sdhci-iproc-cygnus";
                         reg = <0x66420000 0x100>;
                         interrupts = <GIC_SPI 421 IRQ_TYPE_LEVEL_HIGH>;
+                        dma-coherent;
                         bus-width = <8>;
                         clocks = <&genpll_sw BCM_NS2_GENPLL_SW_SDIO_CLK>;
                         status = "disabled";
@@ -676,6 +686,7 @@
                         compatible = "brcm,sdhci-iproc-cygnus";
                         reg = <0x66430000 0x100>;
                         interrupts = <GIC_SPI 422 IRQ_TYPE_LEVEL_HIGH>;
+                        dma-coherent;
                         bus-width = <8>;
                         clocks = <&genpll_sw BCM_NS2_GENPLL_SW_SDIO_CLK>;
                         status = "disabled";
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 05310ad8c5ab..f31c48d0cd68 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -251,7 +251,7 @@ static inline bool system_supports_fpsimd(void)
 static inline bool system_uses_ttbr0_pan(void)
 {
         return IS_ENABLED(CONFIG_ARM64_SW_TTBR0_PAN) &&
-                !cpus_have_cap(ARM64_HAS_PAN);
+                !cpus_have_const_cap(ARM64_HAS_PAN);
 }
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/arm64/include/asm/current.h b/arch/arm64/include/asm/current.h
index 86c404171305..f6580d4afb0e 100644
--- a/arch/arm64/include/asm/current.h
+++ b/arch/arm64/include/asm/current.h
@@ -3,8 +3,6 @@
 
 #include <linux/compiler.h>
 
-#include <asm/sysreg.h>
-
 #ifndef __ASSEMBLY__
 
 struct task_struct;
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index f21fd3894370..e7705e7bb07b 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -30,8 +30,7 @@
 
 #define __KVM_HAVE_ARCH_INTC_INITIALIZED
 
-#define KVM_USER_MEM_SLOTS 32
-#define KVM_PRIVATE_MEM_SLOTS 4
+#define KVM_USER_MEM_SLOTS 512
 #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
 #define KVM_HALT_POLL_NS_DEFAULT 500000
 
diff --git a/arch/arm64/include/asm/pgtable-types.h b/arch/arm64/include/asm/pgtable-types.h
index 69b2fd41503c..345a072b5856 100644
--- a/arch/arm64/include/asm/pgtable-types.h
+++ b/arch/arm64/include/asm/pgtable-types.h
@@ -55,9 +55,13 @@ typedef struct { pteval_t pgprot; } pgprot_t;
 #define __pgprot(x)     ((pgprot_t) { (x) } )
 
 #if CONFIG_PGTABLE_LEVELS == 2
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 #elif CONFIG_PGTABLE_LEVELS == 3
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
+#elif CONFIG_PGTABLE_LEVELS == 4
+#include <asm-generic/5level-fixup.h>
 #endif
 
 #endif  /* __ASM_PGTABLE_TYPES_H */
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index e78ac26324bd..bdbeb06dc11e 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -44,7 +44,7 @@
 #define __ARM_NR_compat_cacheflush      (__ARM_NR_COMPAT_BASE+2)
 #define __ARM_NR_compat_set_tls         (__ARM_NR_COMPAT_BASE+5)
 
-#define __NR_compat_syscalls            394
+#define __NR_compat_syscalls            398
 #endif
 
 #define __ARCH_WANT_SYS_CLONE
diff --git a/arch/arm64/include/asm/unistd32.h b/arch/arm64/include/asm/unistd32.h
index b7e8ef16ff0d..c66b51aab195 100644
--- a/arch/arm64/include/asm/unistd32.h
+++ b/arch/arm64/include/asm/unistd32.h
@@ -809,6 +809,14 @@ __SYSCALL(__NR_copy_file_range, sys_copy_file_range)
 __SYSCALL(__NR_preadv2, compat_sys_preadv2)
 #define __NR_pwritev2 393
 __SYSCALL(__NR_pwritev2, compat_sys_pwritev2)
+#define __NR_pkey_mprotect 394
+__SYSCALL(__NR_pkey_mprotect, sys_pkey_mprotect)
+#define __NR_pkey_alloc 395
+__SYSCALL(__NR_pkey_alloc, sys_pkey_alloc)
+#define __NR_pkey_free 396
+__SYSCALL(__NR_pkey_free, sys_pkey_free)
+#define __NR_statx 397
+__SYSCALL(__NR_statx, sys_statx)
 
 /*
  * Please add new compat syscalls above this comment and update
diff --git a/arch/arm64/kernel/cpuidle.c b/arch/arm64/kernel/cpuidle.c
index 75a0f8acef66..fd691087dc9a 100644
--- a/arch/arm64/kernel/cpuidle.c
+++ b/arch/arm64/kernel/cpuidle.c
@@ -30,7 +30,7 @@ int arm_cpuidle_init(unsigned int cpu)
 }
 
 /**
- * cpu_suspend() - function to enter a low-power idle state
+ * arm_cpuidle_suspend() - function to enter a low-power idle state
  * @arg: argument to pass to CPU suspend operations
  *
  * Return: 0 on success, -EOPNOTSUPP if CPU suspend hook not initialized, CPU
diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
index 769f24ef628c..d7e90d97f5c4 100644
--- a/arch/arm64/kernel/kaslr.c
+++ b/arch/arm64/kernel/kaslr.c
@@ -131,11 +131,15 @@ u64 __init kaslr_early_init(u64 dt_phys, u64 modulo_offset)
         /*
          * The kernel Image should not extend across a 1GB/32MB/512MB alignment
          * boundary (for 4KB/16KB/64KB granule kernels, respectively). If this
-         * happens, increase the KASLR offset by the size of the kernel image.
+         * happens, increase the KASLR offset by the size of the kernel image
+         * rounded up by SWAPPER_BLOCK_SIZE.
          */
         if ((((u64)_text + offset + modulo_offset) >> SWAPPER_TABLE_SHIFT) !=
-            (((u64)_end + offset + modulo_offset) >> SWAPPER_TABLE_SHIFT))
-                offset = (offset + (u64)(_end - _text)) & mask;
+            (((u64)_end + offset + modulo_offset) >> SWAPPER_TABLE_SHIFT)) {
+                u64 kimg_sz = _end - _text;
+                offset = (offset + round_up(kimg_sz, SWAPPER_BLOCK_SIZE))
+                                & mask;
+        }
 
         if (IS_ENABLED(CONFIG_KASAN))
                 /*
diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
index 2a07aae5b8a2..c5c45942fb6e 100644
--- a/arch/arm64/kernel/probes/kprobes.c
+++ b/arch/arm64/kernel/probes/kprobes.c
@@ -372,12 +372,6 @@ int __kprobes kprobe_fault_handler(struct pt_regs *regs, unsigned int fsr)
         return 0;
 }
 
-int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
-                                       unsigned long val, void *data)
-{
-        return NOTIFY_DONE;
-}
-
 static void __kprobes kprobe_handler(struct pt_regs *regs)
 {
         struct kprobe *p, *cur_kprobe;
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index ef1caae02110..9b1036570586 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -944,7 +944,7 @@ static bool have_cpu_die(void)
 #ifdef CONFIG_HOTPLUG_CPU
         int any_cpu = raw_smp_processor_id();
 
-        if (cpu_ops[any_cpu]->cpu_die)
+        if (cpu_ops[any_cpu] && cpu_ops[any_cpu]->cpu_die)
                 return true;
 #endif
         return false;
diff --git a/arch/arm64/kernel/vdso/.gitignore b/arch/arm64/kernel/vdso/.gitignore
index b8cc94e9698b..f8b69d84238e 100644
--- a/arch/arm64/kernel/vdso/.gitignore
+++ b/arch/arm64/kernel/vdso/.gitignore
@@ -1,2 +1 @@
 vdso.lds
-vdso-offsets.h
diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c
index 1bfe30dfbfe7..fa1b18e364fc 100644
--- a/arch/arm64/kvm/handle_exit.c
+++ b/arch/arm64/kvm/handle_exit.c
@@ -135,7 +135,19 @@ static int kvm_handle_guest_debug(struct kvm_vcpu *vcpu, struct kvm_run *run)
         return ret;
 }
 
+static int kvm_handle_unknown_ec(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        u32 hsr = kvm_vcpu_get_hsr(vcpu);
+
+        kvm_pr_unimpl("Unknown exception class: hsr: %#08x -- %s\n",
+                      hsr, esr_get_class_string(hsr));
+
+        kvm_inject_undefined(vcpu);
+        return 1;
+}
+
 static exit_handle_fn arm_exit_handlers[] = {
+        [0 ... ESR_ELx_EC_MAX]  = kvm_handle_unknown_ec,
         [ESR_ELx_EC_WFx]        = kvm_handle_wfx,
         [ESR_ELx_EC_CP15_32]    = kvm_handle_cp15_32,
         [ESR_ELx_EC_CP15_64]    = kvm_handle_cp15_64,
@@ -162,13 +174,6 @@ static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu)
         u32 hsr = kvm_vcpu_get_hsr(vcpu);
         u8 hsr_ec = ESR_ELx_EC(hsr);
 
-        if (hsr_ec >= ARRAY_SIZE(arm_exit_handlers) ||
-            !arm_exit_handlers[hsr_ec]) {
-                kvm_err("Unknown exception class: hsr: %#08x -- %s\n",
-                        hsr, esr_get_class_string(hsr));
-                BUG();
-        }
-
         return arm_exit_handlers[hsr_ec];
 }
 
diff --git a/arch/arm64/kvm/hyp/tlb.c b/arch/arm64/kvm/hyp/tlb.c
index e8e7ba2bc11f..9e1d2b75eecd 100644
--- a/arch/arm64/kvm/hyp/tlb.c
+++ b/arch/arm64/kvm/hyp/tlb.c
@@ -18,14 +18,62 @@
 #include <asm/kvm_hyp.h>
 #include <asm/tlbflush.h>
 
+static void __hyp_text __tlb_switch_to_guest_vhe(struct kvm *kvm)
+{
+        u64 val;
+
+        /*
+         * With VHE enabled, we have HCR_EL2.{E2H,TGE} = {1,1}, and
+         * most TLB operations target EL2/EL0. In order to affect the
+         * guest TLBs (EL1/EL0), we need to change one of these two
+         * bits. Changing E2H is impossible (goodbye TTBR1_EL2), so
+         * let's flip TGE before executing the TLB operation.
+         */
+        write_sysreg(kvm->arch.vttbr, vttbr_el2);
+        val = read_sysreg(hcr_el2);
+        val &= ~HCR_TGE;
+        write_sysreg(val, hcr_el2);
+        isb();
+}
+
+static void __hyp_text __tlb_switch_to_guest_nvhe(struct kvm *kvm)
+{
+        write_sysreg(kvm->arch.vttbr, vttbr_el2);
+        isb();
+}
+
+static hyp_alternate_select(__tlb_switch_to_guest,
+                            __tlb_switch_to_guest_nvhe,
+                            __tlb_switch_to_guest_vhe,
+                            ARM64_HAS_VIRT_HOST_EXTN);
+
+static void __hyp_text __tlb_switch_to_host_vhe(struct kvm *kvm)
+{
+        /*
+         * We're done with the TLB operation, let's restore the host's
+         * view of HCR_EL2.
+         */
+        write_sysreg(0, vttbr_el2);
+        write_sysreg(HCR_HOST_VHE_FLAGS, hcr_el2);
+}
+
+static void __hyp_text __tlb_switch_to_host_nvhe(struct kvm *kvm)
+{
+        write_sysreg(0, vttbr_el2);
+}
+
+static hyp_alternate_select(__tlb_switch_to_host,
+                            __tlb_switch_to_host_nvhe,
+                            __tlb_switch_to_host_vhe,
+                            ARM64_HAS_VIRT_HOST_EXTN);
+
 void __hyp_text __kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa)
 {
         dsb(ishst);
 
         /* Switch to requested VMID */
         kvm = kern_hyp_va(kvm);
-        write_sysreg(kvm->arch.vttbr, vttbr_el2);
-        isb();
+        __tlb_switch_to_guest()(kvm);
 
         /*
          * We could do so much better if we had the VA as well.
@@ -46,7 +94,7 @@ void __hyp_text __kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa)
         dsb(ish);
         isb();
 
-        write_sysreg(0, vttbr_el2);
+        __tlb_switch_to_host()(kvm);
 }
 
 void __hyp_text __kvm_tlb_flush_vmid(struct kvm *kvm)
@@ -55,14 +103,13 @@ void __hyp_text __kvm_tlb_flush_vmid(struct kvm *kvm)
 
         /* Switch to requested VMID */
         kvm = kern_hyp_va(kvm);
-        write_sysreg(kvm->arch.vttbr, vttbr_el2);
-        isb();
+        __tlb_switch_to_guest()(kvm);
 
         __tlbi(vmalls12e1is);
         dsb(ish);
         isb();
 
-        write_sysreg(0, vttbr_el2);
+        __tlb_switch_to_host()(kvm);
 }
 
 void __hyp_text __kvm_tlb_flush_local_vmid(struct kvm_vcpu *vcpu)
@@ -70,14 +117,13 @@ void __hyp_text __kvm_tlb_flush_local_vmid(struct kvm_vcpu *vcpu)
         struct kvm *kvm = kern_hyp_va(kern_hyp_va(vcpu)->kvm);
 
         /* Switch to requested VMID */
-        write_sysreg(kvm->arch.vttbr, vttbr_el2);
-        isb();
+        __tlb_switch_to_guest()(kvm);
 
         __tlbi(vmalle1);
         dsb(nsh);
         isb();
 
-        write_sysreg(0, vttbr_el2);
+        __tlb_switch_to_host()(kvm);
 }
 
 void __hyp_text __kvm_flush_vm_context(void)
diff --git a/arch/arm64/mm/kasan_init.c b/arch/arm64/mm/kasan_init.c
index 55d1e9205543..687a358a3733 100644
--- a/arch/arm64/mm/kasan_init.c
+++ b/arch/arm64/mm/kasan_init.c
@@ -162,7 +162,7 @@ void __init kasan_init(void)
         clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END);
 
         vmemmap_populate(kimg_shadow_start, kimg_shadow_end,
-                         pfn_to_nid(virt_to_pfn(_text)));
+                         pfn_to_nid(virt_to_pfn(lm_alias(_text))));
 
         /*
          * vmemmap_populate() has populated the shadow region that covers the
diff --git a/arch/avr32/include/asm/pgtable-2level.h b/arch/avr32/include/asm/pgtable-2level.h
index 425dd567b5b9..d5b1c63993ec 100644
--- a/arch/avr32/include/asm/pgtable-2level.h
+++ b/arch/avr32/include/asm/pgtable-2level.h
@@ -8,6 +8,7 @@
 #ifndef __ASM_AVR32_PGTABLE_2LEVEL_H
 #define __ASM_AVR32_PGTABLE_2LEVEL_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 /*
diff --git a/arch/avr32/oprofile/backtrace.c b/arch/avr32/oprofile/backtrace.c
index 75d9ad6f99cf..29cf2f191bfd 100644
--- a/arch/avr32/oprofile/backtrace.c
+++ b/arch/avr32/oprofile/backtrace.c
@@ -14,7 +14,7 @@
  */
 
 #include <linux/oprofile.h>
-#include <linux/sched.h>
+#include <linux/ptrace.h>
 #include <linux/uaccess.h>
 
 /* The first two words of each frame on the stack look like this if we have
diff --git a/arch/c6x/kernel/ptrace.c b/arch/c6x/kernel/ptrace.c
index a27e1f02ce18..8801dc98fd44 100644
--- a/arch/c6x/kernel/ptrace.c
+++ b/arch/c6x/kernel/ptrace.c
@@ -70,46 +70,6 @@ static int gpr_get(struct task_struct *target,
                                    0, sizeof(*regs));
 }
 
-static int gpr_set(struct task_struct *target,
-                   const struct user_regset *regset,
-                   unsigned int pos, unsigned int count,
-                   const void *kbuf, const void __user *ubuf)
-{
-        int ret;
-        struct pt_regs *regs = task_pt_regs(target);
-
-        /* Don't copyin TSR or CSR */
-        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                 &regs,
-                                 0, PT_TSR * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
-                                        PT_TSR * sizeof(long),
-                                        (PT_TSR + 1) * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                 &regs,
-                                 (PT_TSR + 1) * sizeof(long),
-                                 PT_CSR * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
-                                        PT_CSR * sizeof(long),
-                                        (PT_CSR + 1) * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                 &regs,
-                                 (PT_CSR + 1) * sizeof(long), -1);
-        return ret;
-}
-
 enum c6x_regset {
         REGSET_GPR,
 };
@@ -121,7 +81,6 @@ static const struct user_regset c6x_regsets[] = {
                 .size = sizeof(u32),
                 .align = sizeof(u32),
                 .get = gpr_get,
-                .set = gpr_set
         },
 };
 
diff --git a/arch/cris/arch-v32/drivers/cryptocop.c b/arch/cris/arch-v32/drivers/cryptocop.c
index ae6903d7fdbe..14970f11bbf2 100644
--- a/arch/cris/arch-v32/drivers/cryptocop.c
+++ b/arch/cris/arch-v32/drivers/cryptocop.c
@@ -2086,7 +2086,7 @@ static void cryptocop_job_queue_close(void)
                 dma_in_cfg.en = regk_dma_no;
                 REG_WR(dma, IN_DMA_INST, rw_cfg, dma_in_cfg);
 
-                /* Disble the cryptocop. */
+                /* Disable the cryptocop. */
                 rw_cfg = REG_RD(strcop, regi_strcop, rw_cfg);
                 rw_cfg.en = 0;
                 REG_WR(strcop, regi_strcop, rw_cfg, rw_cfg);
diff --git a/arch/cris/include/asm/pgtable.h b/arch/cris/include/asm/pgtable.h
index 2a3210ba4c72..fa3a73004cc5 100644
--- a/arch/cris/include/asm/pgtable.h
+++ b/arch/cris/include/asm/pgtable.h
@@ -6,6 +6,7 @@
 #define _CRIS_PGTABLE_H
 
 #include <asm/page.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #ifndef __ASSEMBLY__
diff --git a/arch/frv/include/asm/pgtable.h b/arch/frv/include/asm/pgtable.h
index a0513d463a1f..ab6e7e961b54 100644
--- a/arch/frv/include/asm/pgtable.h
+++ b/arch/frv/include/asm/pgtable.h
@@ -16,6 +16,7 @@
 #ifndef _ASM_PGTABLE_H
 #define _ASM_PGTABLE_H
 
+#include <asm-generic/5level-fixup.h>
 #include <asm/mem-layout.h>
 #include <asm/setup.h>
 #include <asm/processor.h>
diff --git a/arch/h8300/include/asm/pgtable.h b/arch/h8300/include/asm/pgtable.h
index 8341db67821d..7d265d28ba5e 100644
--- a/arch/h8300/include/asm/pgtable.h
+++ b/arch/h8300/include/asm/pgtable.h
@@ -1,5 +1,6 @@
 #ifndef _H8300_PGTABLE_H
 #define _H8300_PGTABLE_H
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 #include <asm-generic/pgtable.h>
 #define pgtable_cache_init()   do { } while (0)
diff --git a/arch/h8300/kernel/ptrace.c b/arch/h8300/kernel/ptrace.c
index 92075544a19a..0dc1c8f622bc 100644
--- a/arch/h8300/kernel/ptrace.c
+++ b/arch/h8300/kernel/ptrace.c
@@ -95,7 +95,8 @@ static int regs_get(struct task_struct *target,
         long *reg = (long *)&regs;
 
         /* build user regs in buffer */
-        for (r = 0; r < ARRAY_SIZE(register_offset); r++)
+        BUILD_BUG_ON(sizeof(regs) % sizeof(long) != 0);
+        for (r = 0; r < sizeof(regs) / sizeof(long); r++)
                 *reg++ = h8300_get_reg(target, r);
 
         return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
@@ -113,7 +114,8 @@ static int regs_set(struct task_struct *target,
         long *reg;
 
         /* build user regs in buffer */
-        for (reg = (long *)&regs, r = 0; r < ARRAY_SIZE(register_offset); r++)
+        BUILD_BUG_ON(sizeof(regs) % sizeof(long) != 0);
+        for (reg = (long *)&regs, r = 0; r < sizeof(regs) / sizeof(long); r++)
                 *reg++ = h8300_get_reg(target, r);
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
@@ -122,7 +124,7 @@ static int regs_set(struct task_struct *target,
                 return ret;
 
         /* write back to pt_regs */
-        for (reg = (long *)&regs, r = 0; r < ARRAY_SIZE(register_offset); r++)
+        for (reg = (long *)&regs, r = 0; r < sizeof(regs) / sizeof(long); r++)
                 h8300_put_reg(target, r, *reg++);
         return 0;
 }
diff --git a/arch/h8300/kernel/ptrace_h.c b/arch/h8300/kernel/ptrace_h.c
index fe3b5673baba..f5ff3b794c85 100644
--- a/arch/h8300/kernel/ptrace_h.c
+++ b/arch/h8300/kernel/ptrace_h.c
@@ -9,7 +9,7 @@
  */
 
 #include <linux/linkage.h>
-#include <linux/sched.h>
+#include <linux/sched/signal.h>
 #include <asm/ptrace.h>
 
 #define BREAKINST 0x5730 /* trapa #3 */
diff --git a/arch/hexagon/include/asm/pgtable.h b/arch/hexagon/include/asm/pgtable.h
index 49eab8136ec3..24a9177fb897 100644
--- a/arch/hexagon/include/asm/pgtable.h
+++ b/arch/hexagon/include/asm/pgtable.h
@@ -26,6 +26,7 @@
  */
 #include <linux/swap.h>
 #include <asm/page.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 /* A handy thing to have if one has the RAM. Declared in head.S */
diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
index 384794e665fc..6cc22c8d8923 100644
--- a/arch/ia64/include/asm/pgtable.h
+++ b/arch/ia64/include/asm/pgtable.h
@@ -587,8 +587,10 @@ extern struct page *zero_page_memmap_ptr;
 
 
 #if CONFIG_PGTABLE_LEVELS == 3
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 #endif
+#include <asm-generic/5level-fixup.h>
 #include <asm-generic/pgtable.h>
 
 #endif /* _ASM_IA64_PGTABLE_H */
diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
index 048bf076f7df..531cb9eb3319 100644
--- a/arch/m68k/configs/amiga_defconfig
+++ b/arch/m68k/configs/amiga_defconfig
@@ -25,6 +25,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -60,6 +61,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -71,6 +73,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -101,6 +104,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -298,6 +302,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -371,6 +377,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -383,6 +390,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_A2065=y
 CONFIG_ARIADNE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -404,7 +412,6 @@ CONFIG_ZORRO8390=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -564,6 +571,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -594,6 +603,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -605,6 +615,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -629,4 +640,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
index d4de24963f5f..ca91d39555da 100644
--- a/arch/m68k/configs/apollo_defconfig
+++ b/arch/m68k/configs/apollo_defconfig
@@ -26,6 +26,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -58,6 +59,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -69,6 +71,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -99,6 +102,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -296,6 +300,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -353,6 +359,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -362,6 +369,7 @@ CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -378,7 +386,6 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -523,6 +530,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -553,6 +562,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -564,6 +574,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -588,4 +599,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
index fc0fd3f871f3..23a3d8a691e2 100644
--- a/arch/m68k/configs/atari_defconfig
+++ b/arch/m68k/configs/atari_defconfig
@@ -25,6 +25,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -58,6 +59,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -69,6 +71,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -99,6 +102,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -296,6 +300,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -362,6 +368,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -372,6 +379,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_ATARILANCE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -389,7 +397,6 @@ CONFIG_NE2000=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_SMC91X=y
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -544,6 +551,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -574,6 +583,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -585,6 +595,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -609,4 +620,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
index 52e984a0aa69..95deb95140fe 100644
--- a/arch/m68k/configs/bvme6000_defconfig
+++ b/arch/m68k/configs/bvme6000_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68040=y
@@ -56,6 +57,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -67,6 +69,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -97,6 +100,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -294,6 +298,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -352,6 +358,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -361,6 +368,7 @@ CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -377,7 +385,6 @@ CONFIG_BVME6000_NET=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -515,6 +522,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -545,6 +554,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -556,6 +566,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -580,4 +591,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
index aaeed4422cc9..afae6958db2d 100644
--- a/arch/m68k/configs/hp300_defconfig
+++ b/arch/m68k/configs/hp300_defconfig
@@ -26,6 +26,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -58,6 +59,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -69,6 +71,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -99,6 +102,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -296,6 +300,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -353,6 +359,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -363,6 +370,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_HPLANCE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -379,7 +387,6 @@ CONFIG_HPLANCE=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -525,6 +532,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -555,6 +564,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -566,6 +576,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -590,4 +601,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
index 3bbc9b2f0dac..b010734729a7 100644
--- a/arch/m68k/configs/mac_defconfig
+++ b/arch/m68k/configs/mac_defconfig
@@ -25,6 +25,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -57,6 +58,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -68,6 +70,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -98,6 +101,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -298,6 +302,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -369,6 +375,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -379,6 +386,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_MACMACE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -398,7 +406,6 @@ CONFIG_MAC8390=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -547,6 +554,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -577,6 +586,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -588,6 +598,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -612,4 +623,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
index 8f2c0decb2f8..0e414549b235 100644
--- a/arch/m68k/configs/multi_defconfig
+++ b/arch/m68k/configs/multi_defconfig
@@ -21,6 +21,7 @@ CONFIG_SOLARIS_X86_PARTITION=y
 CONFIG_UNIXWARE_DISKLABEL=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -67,6 +68,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -78,6 +80,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -108,6 +111,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -308,6 +312,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -402,6 +408,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -419,6 +426,7 @@ CONFIG_HPLANCE=y
 CONFIG_MVME147_NET=y
 CONFIG_SUN3LANCE=y
 CONFIG_MACMACE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -444,7 +452,6 @@ CONFIG_ZORRO8390=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_SMC91X=y
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PLIP=m
@@ -627,6 +634,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -657,6 +666,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -668,6 +678,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -692,4 +703,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
index c743dd22e96f..b2e687a0ec3d 100644
--- a/arch/m68k/configs/mvme147_defconfig
+++ b/arch/m68k/configs/mvme147_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68030=y
@@ -55,6 +56,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -66,6 +68,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -96,6 +99,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -293,6 +297,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -351,6 +357,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -361,6 +368,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_MVME147_NET=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -377,7 +385,6 @@ CONFIG_MVME147_NET=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -515,6 +522,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -545,6 +554,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -556,6 +566,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -580,4 +591,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
index 2ccaca858f05..cbd8ee24d1bc 100644
--- a/arch/m68k/configs/mvme16x_defconfig
+++ b/arch/m68k/configs/mvme16x_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68040=y
@@ -56,6 +57,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -67,6 +69,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -97,6 +100,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -294,6 +298,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -352,6 +358,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -361,6 +368,7 @@ CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -377,7 +385,6 @@ CONFIG_MVME16x_NET=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -515,6 +522,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -545,6 +554,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -556,6 +566,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -580,4 +591,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
index 5599f3fd5fcd..1e82cc944339 100644
--- a/arch/m68k/configs/q40_defconfig
+++ b/arch/m68k/configs/q40_defconfig
@@ -26,6 +26,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68040=y
@@ -56,6 +57,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -67,6 +69,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -97,6 +100,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -294,6 +298,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -358,6 +364,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -369,6 +376,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 # CONFIG_NET_VENDOR_AMD is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -388,7 +396,6 @@ CONFIG_NE2000=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PLIP=m
@@ -538,6 +545,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -568,6 +577,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -579,6 +589,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -603,4 +614,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
index 313bf0a562ad..f9e77f57a972 100644
--- a/arch/m68k/configs/sun3_defconfig
+++ b/arch/m68k/configs/sun3_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_SUN3=y
@@ -53,6 +54,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -64,6 +66,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -94,6 +97,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -291,6 +295,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -349,6 +355,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -359,6 +366,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_SUN3LANCE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
@@ -375,7 +383,6 @@ CONFIG_SUN3_82586=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
 # CONFIG_NET_VENDOR_SUN is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -517,6 +524,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -546,6 +555,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -557,6 +567,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -581,4 +592,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
index 38b61365f769..3c394fcfb368 100644
--- a/arch/m68k/configs/sun3x_defconfig
+++ b/arch/m68k/configs/sun3x_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_SUN3X=y
@@ -53,6 +54,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -64,6 +66,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -94,6 +97,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -291,6 +295,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -349,6 +355,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -359,6 +366,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_SUN3LANCE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -375,7 +383,6 @@ CONFIG_SUN3LANCE=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -517,6 +524,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -547,6 +556,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -558,6 +568,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -582,4 +593,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/include/asm/bitops.h b/arch/m68k/include/asm/bitops.h
index b4a9b0d5928d..dda58cfe8c22 100644
--- a/arch/m68k/include/asm/bitops.h
+++ b/arch/m68k/include/asm/bitops.h
@@ -148,7 +148,7 @@ static inline void bfchg_mem_change_bit(int nr, volatile unsigned long *vaddr)
 #define __change_bit(nr, vaddr) change_bit(nr, vaddr)
 
 
-static inline int test_bit(int nr, const unsigned long *vaddr)
+static inline int test_bit(int nr, const volatile unsigned long *vaddr)
 {
         return (vaddr[nr >> 5] & (1UL << (nr & 31))) != 0;
 }
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index a857d82ec509..aab1edd0d4ba 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -4,7 +4,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define NR_syscalls             379
+#define NR_syscalls             380
 
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
diff --git a/arch/m68k/include/uapi/asm/unistd.h b/arch/m68k/include/uapi/asm/unistd.h
index 9fe674bf911f..25589f5b8669 100644
--- a/arch/m68k/include/uapi/asm/unistd.h
+++ b/arch/m68k/include/uapi/asm/unistd.h
@@ -384,5 +384,6 @@
 #define __NR_copy_file_range    376
 #define __NR_preadv2            377
 #define __NR_pwritev2           378
+#define __NR_statx              379
 
 #endif /* _UAPI_ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index d6fd6d9ced24..8c9fcfafe0dd 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -399,3 +399,4 @@ ENTRY(sys_call_table)
         .long sys_copy_file_range
         .long sys_preadv2
         .long sys_pwritev2
+        .long sys_statx
diff --git a/arch/metag/include/asm/pgtable.h b/arch/metag/include/asm/pgtable.h
index ffa3a3a2ecad..0c151e5af079 100644
--- a/arch/metag/include/asm/pgtable.h
+++ b/arch/metag/include/asm/pgtable.h
@@ -6,6 +6,7 @@
 #define _METAG_PGTABLE_H
 
 #include <asm/pgtable-bits.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 /* Invalid regions on Meta: 0x00000000-0x001FFFFF and 0xFFFF0000-0xFFFFFFFF */
diff --git a/arch/metag/kernel/ptrace.c b/arch/metag/kernel/ptrace.c
index 5fd16ee5280c..e615603a4b0a 100644
--- a/arch/metag/kernel/ptrace.c
+++ b/arch/metag/kernel/ptrace.c
@@ -26,6 +26,16 @@
  * user_regset definitions.
  */
 
+static unsigned long user_txstatus(const struct pt_regs *regs)
+{
+        unsigned long data = (unsigned long)regs->ctx.Flags;
+
+        if (regs->ctx.SaveMask & TBICTX_CBUF_BIT)
+                data |= USER_GP_REGS_STATUS_CATCH_BIT;
+
+        return data;
+}
+
 int metag_gp_regs_copyout(const struct pt_regs *regs,
                           unsigned int pos, unsigned int count,
                           void *kbuf, void __user *ubuf)
@@ -64,9 +74,7 @@ int metag_gp_regs_copyout(const struct pt_regs *regs,
         if (ret)
                 goto out;
         /* TXSTATUS */
-        data = (unsigned long)regs->ctx.Flags;
-        if (regs->ctx.SaveMask & TBICTX_CBUF_BIT)
-                data |= USER_GP_REGS_STATUS_CATCH_BIT;
+        data = user_txstatus(regs);
         ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
                                   &data, 4*25, 4*26);
         if (ret)
@@ -121,6 +129,7 @@ int metag_gp_regs_copyin(struct pt_regs *regs,
         if (ret)
                 goto out;
         /* TXSTATUS */
+        data = user_txstatus(regs);
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                  &data, 4*25, 4*26);
         if (ret)
@@ -246,6 +255,8 @@ int metag_rp_state_copyin(struct pt_regs *regs,
         unsigned long long *ptr;
         int ret, i;
 
+        if (count < 4*13)
+                return -EINVAL;
         /* Read the entire pipeline before making any changes */
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                  &rp, 0, 4*13);
@@ -305,7 +316,7 @@ static int metag_tls_set(struct task_struct *target,
                         const void *kbuf, const void __user *ubuf)
 {
         int ret;
-        void __user *tls;
+        void __user *tls = target->thread.tls_ptr;
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1);
         if (ret)
diff --git a/arch/microblaze/include/asm/page.h b/arch/microblaze/include/asm/page.h
index fd850879854d..d506bb0893f9 100644
--- a/arch/microblaze/include/asm/page.h
+++ b/arch/microblaze/include/asm/page.h
@@ -95,7 +95,8 @@ typedef struct { unsigned long pgd; } pgd_t;
 #   else /* CONFIG_MMU */
 typedef struct { unsigned long  ste[64]; }      pmd_t;
 typedef struct { pmd_t          pue[1]; }       pud_t;
-typedef struct { pud_t          pge[1]; }       pgd_t;
+typedef struct { pud_t          p4e[1]; }       p4d_t;
+typedef struct { p4d_t          pge[1]; }       pgd_t;
 #   endif /* CONFIG_MMU */
 
 # define pte_val(x)     ((x).pte)
diff --git a/arch/mips/cavium-octeon/cpu.c b/arch/mips/cavium-octeon/cpu.c
index a5b427909b5c..036d56cc4591 100644
--- a/arch/mips/cavium-octeon/cpu.c
+++ b/arch/mips/cavium-octeon/cpu.c
@@ -10,7 +10,9 @@
 #include <linux/irqflags.h>
 #include <linux/notifier.h>
 #include <linux/prefetch.h>
+#include <linux/ptrace.h>
 #include <linux/sched.h>
+#include <linux/sched/task_stack.h>
 
 #include <asm/cop2.h>
 #include <asm/current.h>
diff --git a/arch/mips/cavium-octeon/crypto/octeon-crypto.c b/arch/mips/cavium-octeon/crypto/octeon-crypto.c
index 4d22365844af..cfb4a146cf17 100644
--- a/arch/mips/cavium-octeon/crypto/octeon-crypto.c
+++ b/arch/mips/cavium-octeon/crypto/octeon-crypto.c
@@ -9,6 +9,7 @@
 #include <asm/cop2.h>
 #include <linux/export.h>
 #include <linux/interrupt.h>
+#include <linux/sched/task_stack.h>
 
 #include "octeon-crypto.h"
 
diff --git a/arch/mips/cavium-octeon/smp.c b/arch/mips/cavium-octeon/smp.c
index 4b94b7fbafa3..3de786545ded 100644
--- a/arch/mips/cavium-octeon/smp.c
+++ b/arch/mips/cavium-octeon/smp.c
@@ -12,6 +12,7 @@
 #include <linux/kernel_stat.h>
 #include <linux/sched.h>
 #include <linux/sched/hotplug.h>
+#include <linux/sched/task_stack.h>
 #include <linux/init.h>
 #include <linux/export.h>
 
diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
index 321752bcbab6..f94455f964ec 100644
--- a/arch/mips/include/asm/fpu.h
+++ b/arch/mips/include/asm/fpu.h
@@ -12,6 +12,7 @@
 
 #include <linux/sched.h>
 #include <linux/sched/task_stack.h>
+#include <linux/ptrace.h>
 #include <linux/thread_info.h>
 #include <linux/bitops.h>
 
diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h
index d21f3da7bdb6..6f94bed571c4 100644
--- a/arch/mips/include/asm/pgtable-32.h
+++ b/arch/mips/include/asm/pgtable-32.h
@@ -16,6 +16,7 @@
 #include <asm/cachectl.h>
 #include <asm/fixmap.h>
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 extern int temp_tlb_entry;
diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h
index 514cbc0a6a67..130a2a6c1531 100644
--- a/arch/mips/include/asm/pgtable-64.h
+++ b/arch/mips/include/asm/pgtable-64.h
@@ -17,6 +17,7 @@
 #include <asm/cachectl.h>
 #include <asm/fixmap.h>
 
+#define __ARCH_USE_5LEVEL_HACK
 #if defined(CONFIG_PAGE_SIZE_64KB) && !defined(CONFIG_MIPS_VA_BITS_48)
 #include <asm-generic/pgtable-nopmd.h>
 #else
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 339601267265..6931fe722a0b 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -456,7 +456,8 @@ static int fpr_set(struct task_struct *target,
                                           &target->thread.fpu,
                                           0, sizeof(elf_fpregset_t));
 
-        for (i = 0; i < NUM_FPU_REGS; i++) {
+        BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t));
+        for (i = 0; i < NUM_FPU_REGS && count >= sizeof(elf_fpreg_t); i++) {
                 err = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                          &fpr_val, i * sizeof(elf_fpreg_t),
                                          (i + 1) * sizeof(elf_fpreg_t));
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 3daa2cae50b0..1b070a76fcdd 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -11,6 +11,7 @@
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/sched/hotplug.h>
+#include <linux/sched/task_stack.h>
 #include <linux/mm.h>
 #include <linux/delay.h>
 #include <linux/smp.h>
diff --git a/arch/mips/kernel/smp-mt.c b/arch/mips/kernel/smp-mt.c
index e077ea3e11fb..e398cbc3d776 100644
--- a/arch/mips/kernel/smp-mt.c
+++ b/arch/mips/kernel/smp-mt.c
@@ -23,6 +23,7 @@
 #include <linux/interrupt.h>
 #include <linux/irqchip/mips-gic.h>
 #include <linux/compiler.h>
+#include <linux/sched/task_stack.h>
 #include <linux/smp.h>
 
 #include <linux/atomic.h>
diff --git a/arch/mips/loongson64/loongson-3/cop2-ex.c b/arch/mips/loongson64/loongson-3/cop2-ex.c
index ea13764d0a03..621d6af5f6eb 100644
--- a/arch/mips/loongson64/loongson-3/cop2-ex.c
+++ b/arch/mips/loongson64/loongson-3/cop2-ex.c
@@ -13,6 +13,7 @@
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/notifier.h>
+#include <linux/ptrace.h>
 
 #include <asm/fpu.h>
 #include <asm/cop2.h>
diff --git a/arch/mips/netlogic/common/smp.c b/arch/mips/netlogic/common/smp.c
index 10d86d54880a..bddf1ef553a4 100644
--- a/arch/mips/netlogic/common/smp.c
+++ b/arch/mips/netlogic/common/smp.c
@@ -35,6 +35,7 @@
 #include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/init.h>
+#include <linux/sched/task_stack.h>
 #include <linux/smp.h>
 #include <linux/irq.h>
 
diff --git a/arch/mips/netlogic/xlp/cop2-ex.c b/arch/mips/netlogic/xlp/cop2-ex.c
index 52bc5de42005..21e439b3db70 100644
--- a/arch/mips/netlogic/xlp/cop2-ex.c
+++ b/arch/mips/netlogic/xlp/cop2-ex.c
@@ -9,11 +9,14 @@
  * Copyright (C) 2009 Wind River Systems,
  *   written by Ralf Baechle <ralf@linux-mips.org>
  */
+#include <linux/capability.h>
 #include <linux/init.h>
 #include <linux/irqflags.h>
 #include <linux/notifier.h>
 #include <linux/prefetch.h>
+#include <linux/ptrace.h>
 #include <linux/sched.h>
+#include <linux/sched/task_stack.h>
 
 #include <asm/cop2.h>
 #include <asm/current.h>
diff --git a/arch/mips/sgi-ip22/ip28-berr.c b/arch/mips/sgi-ip22/ip28-berr.c
index 1f2a5bc4779e..75460e1e106b 100644
--- a/arch/mips/sgi-ip22/ip28-berr.c
+++ b/arch/mips/sgi-ip22/ip28-berr.c
@@ -9,6 +9,7 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/sched/debug.h>
+#include <linux/sched/signal.h>
 #include <linux/seq_file.h>
 
 #include <asm/addrspace.h>
diff --git a/arch/mips/sgi-ip27/ip27-berr.c b/arch/mips/sgi-ip27/ip27-berr.c
index d12879eb2b1f..83efe03d5c60 100644
--- a/arch/mips/sgi-ip27/ip27-berr.c
+++ b/arch/mips/sgi-ip27/ip27-berr.c
@@ -12,7 +12,9 @@
 #include <linux/signal.h>       /* for SIGBUS */
 #include <linux/sched.h>        /* schow_regs(), force_sig() */
 #include <linux/sched/debug.h>
+#include <linux/sched/signal.h>
 
+#include <asm/ptrace.h>
 #include <asm/sn/addrs.h>
 #include <asm/sn/arch.h>
 #include <asm/sn/sn0/hub.h>
diff --git a/arch/mips/sgi-ip27/ip27-smp.c b/arch/mips/sgi-ip27/ip27-smp.c
index f5ed45e8f442..4cd47d23d81a 100644
--- a/arch/mips/sgi-ip27/ip27-smp.c
+++ b/arch/mips/sgi-ip27/ip27-smp.c
@@ -8,10 +8,13 @@
  */
 #include <linux/init.h>
 #include <linux/sched.h>
+#include <linux/sched/task_stack.h>
 #include <linux/topology.h>
 #include <linux/nodemask.h>
+
 #include <asm/page.h>
 #include <asm/processor.h>
+#include <asm/ptrace.h>
 #include <asm/sn/arch.h>
 #include <asm/sn/gda.h>
 #include <asm/sn/intr.h>
diff --git a/arch/mips/sgi-ip32/ip32-berr.c b/arch/mips/sgi-ip32/ip32-berr.c
index 57d8c7486fe6..c1f12a9cf305 100644
--- a/arch/mips/sgi-ip32/ip32-berr.c
+++ b/arch/mips/sgi-ip32/ip32-berr.c
@@ -11,6 +11,7 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/sched/debug.h>
+#include <linux/sched/signal.h>
 #include <asm/traps.h>
 #include <linux/uaccess.h>
 #include <asm/addrspace.h>
diff --git a/arch/mips/sgi-ip32/ip32-reset.c b/arch/mips/sgi-ip32/ip32-reset.c
index 8bd415c8729f..b3b442def423 100644
--- a/arch/mips/sgi-ip32/ip32-reset.c
+++ b/arch/mips/sgi-ip32/ip32-reset.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/sched/signal.h>
 #include <linux/notifier.h>
 #include <linux/delay.h>
 #include <linux/rtc/ds1685.h>
diff --git a/arch/mn10300/include/asm/page.h b/arch/mn10300/include/asm/page.h
index 3810a6f740fd..dfe730a5ede0 100644
--- a/arch/mn10300/include/asm/page.h
+++ b/arch/mn10300/include/asm/page.h
@@ -57,6 +57,7 @@ typedef struct page *pgtable_t;
 #define __pgd(x)        ((pgd_t) { (x) })
 #define __pgprot(x)     ((pgprot_t) { (x) })
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #endif /* !__ASSEMBLY__ */
diff --git a/arch/nios2/include/asm/pgtable.h b/arch/nios2/include/asm/pgtable.h
index 298393c3cb42..db4f7d179220 100644
--- a/arch/nios2/include/asm/pgtable.h
+++ b/arch/nios2/include/asm/pgtable.h
@@ -22,6 +22,7 @@
 #include <asm/tlbflush.h>
 
 #include <asm/pgtable-bits.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #define FIRST_USER_ADDRESS      0UL
diff --git a/arch/openrisc/include/asm/cmpxchg.h b/arch/openrisc/include/asm/cmpxchg.h
index 5fcb9ac72693..f0a5d8b844d6 100644
--- a/arch/openrisc/include/asm/cmpxchg.h
+++ b/arch/openrisc/include/asm/cmpxchg.h
@@ -77,7 +77,11 @@ static inline unsigned long __xchg(unsigned long val, volatile void *ptr,
         return val;
 }
 
-#define xchg(ptr, with) \
-        ((typeof(*(ptr)))__xchg((unsigned long)(with), (ptr), sizeof(*(ptr))))
+#define xchg(ptr, with)                                                 \
+        ({                                                              \
+                (__typeof__(*(ptr))) __xchg((unsigned long)(with),      \
+                                            (ptr),                      \
+                                            sizeof(*(ptr)));            \
+        })
 
 #endif /* __ASM_OPENRISC_CMPXCHG_H */
diff --git a/arch/openrisc/include/asm/pgtable.h b/arch/openrisc/include/asm/pgtable.h
index 3567aa7be555..ff97374ca069 100644
--- a/arch/openrisc/include/asm/pgtable.h
+++ b/arch/openrisc/include/asm/pgtable.h
@@ -25,6 +25,7 @@
 #ifndef __ASM_OPENRISC_PGTABLE_H
 #define __ASM_OPENRISC_PGTABLE_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #ifndef __ASSEMBLY__
diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h
index 140faa16685a..1311e6b13991 100644
--- a/arch/openrisc/include/asm/uaccess.h
+++ b/arch/openrisc/include/asm/uaccess.h
@@ -211,7 +211,7 @@ do {									\
         case 1: __get_user_asm(x, ptr, retval, "l.lbz"); break;         \
         case 2: __get_user_asm(x, ptr, retval, "l.lhz"); break;         \
         case 4: __get_user_asm(x, ptr, retval, "l.lwz"); break;         \
-        case 8: __get_user_asm2(x, ptr, retval);                        \
+        case 8: __get_user_asm2(x, ptr, retval); break;                 \
         default: (x) = __get_user_bad();                                \
         }                                                               \
 } while (0)
diff --git a/arch/openrisc/kernel/or32_ksyms.c b/arch/openrisc/kernel/or32_ksyms.c
index 5c4695d13542..ee3e604959e1 100644
--- a/arch/openrisc/kernel/or32_ksyms.c
+++ b/arch/openrisc/kernel/or32_ksyms.c
@@ -30,6 +30,7 @@
 #include <asm/hardirq.h>
 #include <asm/delay.h>
 #include <asm/pgalloc.h>
+#include <asm/pgtable.h>
 
 #define DECLARE_EXPORT(name) extern void name(void); EXPORT_SYMBOL(name)
 
@@ -42,6 +43,9 @@ DECLARE_EXPORT(__muldi3);
 DECLARE_EXPORT(__ashrdi3);
 DECLARE_EXPORT(__ashldi3);
 DECLARE_EXPORT(__lshrdi3);
+DECLARE_EXPORT(__ucmpdi2);
 
+EXPORT_SYMBOL(empty_zero_page);
 EXPORT_SYMBOL(__copy_tofrom_user);
+EXPORT_SYMBOL(__clear_user);
 EXPORT_SYMBOL(memset);
diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c
index 828a29110459..f8da545854f9 100644
--- a/arch/openrisc/kernel/process.c
+++ b/arch/openrisc/kernel/process.c
@@ -90,6 +90,7 @@ void arch_cpu_idle(void)
 }
 
 void (*pm_power_off) (void) = machine_power_off;
+EXPORT_SYMBOL(pm_power_off);
 
 /*
  * When a process does an "exec", machine state like FPU and debug
diff --git a/arch/parisc/include/asm/cacheflush.h b/arch/parisc/include/asm/cacheflush.h
index 19c9c3c5f267..c7e15cc5c668 100644
--- a/arch/parisc/include/asm/cacheflush.h
+++ b/arch/parisc/include/asm/cacheflush.h
@@ -43,28 +43,9 @@ static inline void flush_kernel_dcache_page(struct page *page)
 
 #define flush_kernel_dcache_range(start,size) \
         flush_kernel_dcache_range_asm((start), (start)+(size));
-/* vmap range flushes and invalidates.  Architecturally, we don't need
- * the invalidate, because the CPU should refuse to speculate once an
- * area has been flushed, so invalidate is left empty */
-static inline void flush_kernel_vmap_range(void *vaddr, int size)
-{
-        unsigned long start = (unsigned long)vaddr;
-
-        flush_kernel_dcache_range_asm(start, start + size);
-}
-static inline void invalidate_kernel_vmap_range(void *vaddr, int size)
-{
-        unsigned long start = (unsigned long)vaddr;
-        void *cursor = vaddr;
 
-        for ( ; cursor < vaddr + size; cursor += PAGE_SIZE) {
-                struct page *page = vmalloc_to_page(cursor);
-
-                if (test_and_clear_bit(PG_dcache_dirty, &page->flags))
-                        flush_kernel_dcache_page(page);
-        }
-        flush_kernel_dcache_range_asm(start, start + size);
-}
+void flush_kernel_vmap_range(void *vaddr, int size);
+void invalidate_kernel_vmap_range(void *vaddr, int size);
 
 #define flush_cache_vmap(start, end)            flush_cache_all()
 #define flush_cache_vunmap(start, end)          flush_cache_all()
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
index fb4382c28259..8442727f28d2 100644
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
@@ -32,7 +32,8 @@
  * that put_user is the same as __put_user, etc.
  */
 
-#define access_ok(type, uaddr, size) (1)
+#define access_ok(type, uaddr, size)    \
+        ( (uaddr) == (uaddr) )
 
 #define put_user __put_user
 #define get_user __get_user
@@ -64,6 +65,15 @@ struct exception_table_entry {
         ".previous\n"
 
 /*
+ * ASM_EXCEPTIONTABLE_ENTRY_EFAULT() creates a special exception table entry
+ * (with lowest bit set) for which the fault handler in fixup_exception() will
+ * load -EFAULT into %r8 for a read or write fault, and zeroes the target
+ * register in case of a read fault in get_user().
+ */
+#define ASM_EXCEPTIONTABLE_ENTRY_EFAULT( fault_addr, except_addr )\
+        ASM_EXCEPTIONTABLE_ENTRY( fault_addr, except_addr + 1)
+
+/*
  * The page fault handler stores, in a per-cpu area, the following information
  * if a fixup routine is available.
  */
@@ -90,7 +100,7 @@ struct exception_data {
 #define __get_user(x, ptr)                               \
 ({                                                       \
         register long __gu_err __asm__ ("r8") = 0;       \
-        register long __gu_val __asm__ ("r9") = 0;       \
+        register long __gu_val;                          \
                                                          \
         load_sr2();                                      \
         switch (sizeof(*(ptr))) {                        \
@@ -106,22 +116,23 @@ struct exception_data {
 })
 
 #define __get_user_asm(ldx, ptr)                        \
-        __asm__("\n1:\t" ldx "\t0(%%sr2,%2),%0\n\t"     \
-                ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_1)\
+        __asm__("1: " ldx " 0(%%sr2,%2),%0\n"           \
+                "9:\n"                                  \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b) \
                 : "=r"(__gu_val), "=r"(__gu_err)        \
-                : "r"(ptr), "1"(__gu_err)               \
-                : "r1");
+                : "r"(ptr), "1"(__gu_err));
 
 #if !defined(CONFIG_64BIT)
 
 #define __get_user_asm64(ptr)                           \
-        __asm__("\n1:\tldw 0(%%sr2,%2),%0"              \
-                "\n2:\tldw 4(%%sr2,%2),%R0\n\t"         \
-                ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_2)\
-                ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_get_user_skip_1)\
+        __asm__("   copy %%r0,%R0\n"                    \
+                "1: ldw 0(%%sr2,%2),%0\n"               \
+                "2: ldw 4(%%sr2,%2),%R0\n"              \
+                "9:\n"                                  \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b) \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(2b, 9b) \
                 : "=r"(__gu_val), "=r"(__gu_err)        \
-                : "r"(ptr), "1"(__gu_err)               \
-                : "r1");
+                : "r"(ptr), "1"(__gu_err));
 
 #endif /* !defined(CONFIG_64BIT) */
 
@@ -147,32 +158,31 @@ struct exception_data {
  * The "__put_user/kernel_asm()" macros tell gcc they read from memory
  * instead of writing. This is because they do not write to any memory
  * gcc knows about, so there are no aliasing issues. These macros must
- * also be aware that "fixup_put_user_skip_[12]" are executed in the
- * context of the fault, and any registers used there must be listed
- * as clobbers. In this case only "r1" is used by the current routines.
- * r8/r9 are already listed as err/val.
+ * also be aware that fixups are executed in the context of the fault,
+ * and any registers used there must be listed as clobbers.
+ * r8 is already listed as err.
  */
 
 #define __put_user_asm(stx, x, ptr)                         \
         __asm__ __volatile__ (                              \
-                "\n1:\t" stx "\t%2,0(%%sr2,%1)\n\t"         \
-                ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_1)\
+                "1: " stx " %2,0(%%sr2,%1)\n"               \
+                "9:\n"                                      \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b)     \
                 : "=r"(__pu_err)                            \
-                : "r"(ptr), "r"(x), "0"(__pu_err)           \
-                : "r1")
+                : "r"(ptr), "r"(x), "0"(__pu_err))
 
 
 #if !defined(CONFIG_64BIT)
 
 #define __put_user_asm64(__val, ptr) do {                   \
         __asm__ __volatile__ (                              \
-                "\n1:\tstw %2,0(%%sr2,%1)"                  \
-                "\n2:\tstw %R2,4(%%sr2,%1)\n\t"             \
-                ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_2)\
-                ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_put_user_skip_1)\
+                "1: stw %2,0(%%sr2,%1)\n"                   \
+                "2: stw %R2,4(%%sr2,%1)\n"                  \
+                "9:\n"                                      \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b)     \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(2b, 9b)     \
                 : "=r"(__pu_err)                            \
-                : "r"(ptr), "r"(__val), "0"(__pu_err) \
-                : "r1");                                    \
+                : "r"(ptr), "r"(__val), "0"(__pu_err));     \
 } while (0)
 
 #endif /* !defined(CONFIG_64BIT) */
diff --git a/arch/parisc/include/uapi/asm/unistd.h b/arch/parisc/include/uapi/asm/unistd.h
index 6b0741e7a7ed..667c99421003 100644
--- a/arch/parisc/include/uapi/asm/unistd.h
+++ b/arch/parisc/include/uapi/asm/unistd.h
@@ -362,8 +362,9 @@
 #define __NR_copy_file_range    (__NR_Linux + 346)
 #define __NR_preadv2            (__NR_Linux + 347)
 #define __NR_pwritev2           (__NR_Linux + 348)
+#define __NR_statx              (__NR_Linux + 349)
 
-#define __NR_Linux_syscalls     (__NR_pwritev2 + 1)
+#define __NR_Linux_syscalls     (__NR_statx + 1)
 
 
 #define __IGNORE_select         /* newselect */
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index 0dc72d5de861..c32a09095216 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -616,3 +616,25 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
                 __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
         }
 }
+
+void flush_kernel_vmap_range(void *vaddr, int size)
+{
+        unsigned long start = (unsigned long)vaddr;
+
+        if ((unsigned long)size > parisc_cache_flush_threshold)
+                flush_data_cache();
+        else
+                flush_kernel_dcache_range_asm(start, start + size);
+}
+EXPORT_SYMBOL(flush_kernel_vmap_range);
+
+void invalidate_kernel_vmap_range(void *vaddr, int size)
+{
+        unsigned long start = (unsigned long)vaddr;
+
+        if ((unsigned long)size > parisc_cache_flush_threshold)
+                flush_data_cache();
+        else
+                flush_kernel_dcache_range_asm(start, start + size);
+}
+EXPORT_SYMBOL(invalidate_kernel_vmap_range);
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index a0ecdb4abcc8..c66c943d9322 100644
--- a/arch/parisc/kernel/module.c
+++ b/arch/parisc/kernel/module.c
@@ -620,6 +620,10 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
                          */
                         *loc = fsel(val, addend); 
                         break;
+                case R_PARISC_SECREL32:
+                        /* 32-bit section relative address. */
+                        *loc = fsel(val, addend);
+                        break;
                 case R_PARISC_DPREL21L:
                         /* left 21 bit of relative address */
                         val = lrsel(val - dp, addend);
@@ -807,6 +811,10 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
                          */
                         *loc = fsel(val, addend); 
                         break;
+                case R_PARISC_SECREL32:
+                        /* 32-bit section relative address. */
+                        *loc = fsel(val, addend);
+                        break;
                 case R_PARISC_FPTR64:
                         /* 64-bit function address */
                         if(in_local(me, (void *)(val + addend))) {
diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
index 7484b3d11e0d..c6d6272a934f 100644
--- a/arch/parisc/kernel/parisc_ksyms.c
+++ b/arch/parisc/kernel/parisc_ksyms.c
@@ -47,16 +47,6 @@ EXPORT_SYMBOL(__cmpxchg_u64);
 EXPORT_SYMBOL(lclear_user);
 EXPORT_SYMBOL(lstrnlen_user);
 
-/* Global fixups - defined as int to avoid creation of function pointers */
-extern int fixup_get_user_skip_1;
-extern int fixup_get_user_skip_2;
-extern int fixup_put_user_skip_1;
-extern int fixup_put_user_skip_2;
-EXPORT_SYMBOL(fixup_get_user_skip_1);
-EXPORT_SYMBOL(fixup_get_user_skip_2);
-EXPORT_SYMBOL(fixup_put_user_skip_1);
-EXPORT_SYMBOL(fixup_put_user_skip_2);
-
 #ifndef CONFIG_64BIT
 /* Needed so insmod can set dp value */
 extern int $global$;
diff --git a/arch/parisc/kernel/perf.c b/arch/parisc/kernel/perf.c
index e282a5131d77..6017a5af2e6e 100644
--- a/arch/parisc/kernel/perf.c
+++ b/arch/parisc/kernel/perf.c
@@ -39,7 +39,7 @@
  *  the PDC INTRIGUE calls.  This is done to eliminate bugs introduced
  *  in various PDC revisions.  The code is much more maintainable
  *  and reliable this way vs having to debug on every version of PDC
- *  on every box. 
+ *  on every box.
  */
 
 #include <linux/capability.h>
@@ -195,8 +195,8 @@ static int perf_config(uint32_t *image_ptr);
 static int perf_release(struct inode *inode, struct file *file);
 static int perf_open(struct inode *inode, struct file *file);
 static ssize_t perf_read(struct file *file, char __user *buf, size_t cnt, loff_t *ppos);
-static ssize_t perf_write(struct file *file, const char __user *buf, size_t count, 
-        loff_t *ppos);
+static ssize_t perf_write(struct file *file, const char __user *buf,
+        size_t count, loff_t *ppos);
 static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 static void perf_start_counters(void);
 static int perf_stop_counters(uint32_t *raddr);
@@ -222,7 +222,7 @@ extern void perf_intrigue_disable_perf_counters (void);
 /*
  * configure:
  *
- * Configure the cpu with a given data image.  First turn off the counters, 
+ * Configure the cpu with a given data image.  First turn off the counters,
  * then download the image, then turn the counters back on.
  */
 static int perf_config(uint32_t *image_ptr)
@@ -234,7 +234,7 @@ static int perf_config(uint32_t *image_ptr)
         error = perf_stop_counters(raddr);
         if (error != 0) {
                 printk("perf_config: perf_stop_counters = %ld\n", error);
-                return -EINVAL; 
+                return -EINVAL;
         }
 
 printk("Preparing to write image\n");
@@ -242,7 +242,7 @@ printk("Preparing to write image\n");
         error = perf_write_image((uint64_t *)image_ptr);
         if (error != 0) {
                 printk("perf_config: DOWNLOAD = %ld\n", error);
-                return -EINVAL; 
+                return -EINVAL;
         }
 
 printk("Preparing to start counters\n");
@@ -254,7 +254,7 @@ printk("Preparing to start counters\n");
 }
 
 /*
- * Open the device and initialize all of its memory.  The device is only 
+ * Open the device and initialize all of its memory.  The device is only
  * opened once, but can be "queried" by multiple processes that know its
  * file descriptor.
  */
@@ -298,19 +298,19 @@ static ssize_t perf_read(struct file *file, char __user *buf, size_t cnt, loff_t
  * called on the processor that the download should happen
  * on.
  */
-static ssize_t perf_write(struct file *file, const char __user *buf, size_t count, 
-        loff_t *ppos)
+static ssize_t perf_write(struct file *file, const char __user *buf,
+        size_t count, loff_t *ppos)
 {
         size_t image_size;
         uint32_t image_type;
         uint32_t interface_type;
         uint32_t test;
 
-        if (perf_processor_interface == ONYX_INTF) 
+        if (perf_processor_interface == ONYX_INTF)
                 image_size = PCXU_IMAGE_SIZE;
-        else if (perf_processor_interface == CUDA_INTF) 
+        else if (perf_processor_interface == CUDA_INTF)
                 image_size = PCXW_IMAGE_SIZE;
-        else 
+        else
                 return -EFAULT;
 
         if (!capable(CAP_SYS_ADMIN))
@@ -330,22 +330,22 @@ static ssize_t perf_write(struct file *file, const char __user *buf, size_t coun
 
         /* First check the machine type is correct for
            the requested image */
-        if (((perf_processor_interface == CUDA_INTF) &&
-                       (interface_type != CUDA_INTF)) ||
-            ((perf_processor_interface == ONYX_INTF) &&
-                       (interface_type != ONYX_INTF))) 
+        if (((perf_processor_interface == CUDA_INTF) &&
+                        (interface_type != CUDA_INTF)) ||
+                ((perf_processor_interface == ONYX_INTF) &&
+                        (interface_type != ONYX_INTF)))
                 return -EINVAL;
 
         /* Next check to make sure the requested image
            is valid */
-        if (((interface_type == CUDA_INTF) && 
+        if (((interface_type == CUDA_INTF) &&
                        (test >= MAX_CUDA_IMAGES)) ||
-            ((interface_type == ONYX_INTF) && 
-                       (test >= MAX_ONYX_IMAGES))) 
+            ((interface_type == ONYX_INTF) &&
+                       (test >= MAX_ONYX_IMAGES)))
                 return -EINVAL;
 
         /* Copy the image into the processor */
-        if (interface_type == CUDA_INTF) 
+        if (interface_type == CUDA_INTF)
                 return perf_config(cuda_images[test]);
         else
                 return perf_config(onyx_images[test]);
@@ -359,7 +359,7 @@ static ssize_t perf_write(struct file *file, const char __user *buf, size_t coun
 static void perf_patch_images(void)
 {
 #if 0 /* FIXME!! */
-/* 
+/*
  * NOTE:  this routine is VERY specific to the current TLB image.
  * If the image is changed, this routine might also need to be changed.
  */
@@ -367,9 +367,9 @@ static void perf_patch_images(void)
         extern void $i_dtlb_miss_2_0();
         extern void PA2_0_iva();
 
-        /* 
+        /*
          * We can only use the lower 32-bits, the upper 32-bits should be 0
-         * anyway given this is in the kernel 
+         * anyway given this is in the kernel
          */
         uint32_t itlb_addr  = (uint32_t)&($i_itlb_miss_2_0);
         uint32_t dtlb_addr  = (uint32_t)&($i_dtlb_miss_2_0);
@@ -377,21 +377,21 @@ static void perf_patch_images(void)
 
         if (perf_processor_interface == ONYX_INTF) {
                 /* clear last 2 bytes */
-                onyx_images[TLBMISS][15] &= 0xffffff00;  
+                onyx_images[TLBMISS][15] &= 0xffffff00;
                 /* set 2 bytes */
                 onyx_images[TLBMISS][15] |= (0x000000ff&((dtlb_addr) >> 24));
                 onyx_images[TLBMISS][16] = (dtlb_addr << 8)&0xffffff00;
                 onyx_images[TLBMISS][17] = itlb_addr;
 
                 /* clear last 2 bytes */
-                onyx_images[TLBHANDMISS][15] &= 0xffffff00;  
+                onyx_images[TLBHANDMISS][15] &= 0xffffff00;
                 /* set 2 bytes */
                 onyx_images[TLBHANDMISS][15] |= (0x000000ff&((dtlb_addr) >> 24));
                 onyx_images[TLBHANDMISS][16] = (dtlb_addr << 8)&0xffffff00;
                 onyx_images[TLBHANDMISS][17] = itlb_addr;
 
                 /* clear last 2 bytes */
-                onyx_images[BIG_CPI][15] &= 0xffffff00;  
+                onyx_images[BIG_CPI][15] &= 0xffffff00;
                 /* set 2 bytes */
                 onyx_images[BIG_CPI][15] |= (0x000000ff&((dtlb_addr) >> 24));
                 onyx_images[BIG_CPI][16] = (dtlb_addr << 8)&0xffffff00;
@@ -404,24 +404,24 @@ static void perf_patch_images(void)
 
         } else if (perf_processor_interface == CUDA_INTF) {
                 /* Cuda interface */
-                cuda_images[TLBMISS][16] =  
+                cuda_images[TLBMISS][16] =
                         (cuda_images[TLBMISS][16]&0xffff0000) |
                         ((dtlb_addr >> 8)&0x0000ffff);
-                cuda_images[TLBMISS][17] = 
+                cuda_images[TLBMISS][17] =
                         ((dtlb_addr << 24)&0xff000000) | ((itlb_addr >> 16)&0x000000ff);
                 cuda_images[TLBMISS][18] = (itlb_addr << 16)&0xffff0000;
 
-                cuda_images[TLBHANDMISS][16] = 
+                cuda_images[TLBHANDMISS][16] =
                         (cuda_images[TLBHANDMISS][16]&0xffff0000) |
                         ((dtlb_addr >> 8)&0x0000ffff);
-                cuda_images[TLBHANDMISS][17] = 
+                cuda_images[TLBHANDMISS][17] =
                         ((dtlb_addr << 24)&0xff000000) | ((itlb_addr >> 16)&0x000000ff);
                 cuda_images[TLBHANDMISS][18] = (itlb_addr << 16)&0xffff0000;
 
-                cuda_images[BIG_CPI][16] = 
+                cuda_images[BIG_CPI][16] =
                         (cuda_images[BIG_CPI][16]&0xffff0000) |
                         ((dtlb_addr >> 8)&0x0000ffff);
-                cuda_images[BIG_CPI][17] = 
+                cuda_images[BIG_CPI][17] =
                         ((dtlb_addr << 24)&0xff000000) | ((itlb_addr >> 16)&0x000000ff);
                 cuda_images[BIG_CPI][18] = (itlb_addr << 16)&0xffff0000;
         } else {
@@ -433,7 +433,7 @@ static void perf_patch_images(void)
 
 /*
  * ioctl routine
- * All routines effect the processor that they are executed on.  Thus you 
+ * All routines effect the processor that they are executed on.  Thus you
  * must be running on the processor that you wish to change.
  */
 
@@ -459,7 +459,7 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                         }
 
                         /* copy out the Counters */
-                        if (copy_to_user((void __user *)arg, raddr, 
+                        if (copy_to_user((void __user *)arg, raddr,
                                         sizeof (raddr)) != 0) {
                                 error =  -EFAULT;
                                 break;
@@ -487,7 +487,7 @@ static const struct file_operations perf_fops = {
         .open = perf_open,
         .release = perf_release
 };
-        
+
 static struct miscdevice perf_dev = {
         MISC_DYNAMIC_MINOR,
         PA_PERF_DEV,
@@ -595,7 +595,7 @@ static int perf_stop_counters(uint32_t *raddr)
                 /* OR sticky2 (bit 1496) to counter2 bit 32 */
                 tmp64 |= (userbuf[23] >> 8) & 0x0000000080000000;
                 raddr[2] = (uint32_t)tmp64;
-                
+
                 /* Counter3 is bits 1497 to 1528 */
                 tmp64 =  (userbuf[23] >> 7) & 0x00000000ffffffff;
                 /* OR sticky3 (bit 1529) to counter3 bit 32 */
@@ -617,7 +617,7 @@ static int perf_stop_counters(uint32_t *raddr)
                 userbuf[22] = 0;
                 userbuf[23] = 0;
 
-                /* 
+                /*
                  * Write back the zeroed bytes + the image given
                  * the read was destructive.
                  */
@@ -625,13 +625,13 @@ static int perf_stop_counters(uint32_t *raddr)
         } else {
 
                 /*
-                 * Read RDR-15 which contains the counters and sticky bits 
+                 * Read RDR-15 which contains the counters and sticky bits
                  */
                 if (!perf_rdr_read_ubuf(15, userbuf)) {
                         return -13;
                 }
 
-                /* 
+                /*
                  * Clear out the counters
                  */
                 perf_rdr_clear(15);
@@ -644,7 +644,7 @@ static int perf_stop_counters(uint32_t *raddr)
                 raddr[2] = (uint32_t)((userbuf[1] >> 32) & 0x00000000ffffffffUL);
                 raddr[3] = (uint32_t)(userbuf[1] & 0x00000000ffffffffUL);
         }
- 
+
         return 0;
 }
 
@@ -682,7 +682,7 @@ static int perf_rdr_read_ubuf(uint32_t	rdr_num, uint64_t *buffer)
         i = tentry->num_words;
         while (i--) {
                 buffer[i] = 0;
-        }       
+        }
 
         /* Check for bits an even number of 64 */
         if ((xbits = width & 0x03f) != 0) {
@@ -808,18 +808,22 @@ static int perf_write_image(uint64_t *memaddr)
         }
 
         runway = ioremap_nocache(cpu_device->hpa.start, 4096);
+        if (!runway) {
+                pr_err("perf_write_image: ioremap failed!\n");
+                return -ENOMEM;
+        }
 
         /* Merge intrigue bits into Runway STATUS 0 */
         tmp64 = __raw_readq(runway + RUNWAY_STATUS) & 0xffecfffffffffffful;
-        __raw_writeq(tmp64 | (*memaddr++ & 0x0013000000000000ul), 
+        __raw_writeq(tmp64 | (*memaddr++ & 0x0013000000000000ul),
                      runway + RUNWAY_STATUS);
-        
+
         /* Write RUNWAY DEBUG registers */
         for (i = 0; i < 8; i++) {
                 __raw_writeq(*memaddr++, runway + RUNWAY_DEBUG);
         }
 
-        return 0; 
+        return 0;
 }
 
 /*
@@ -843,7 +847,7 @@ printk("perf_rdr_write\n");
                         perf_rdr_shift_out_U(rdr_num, buffer[i]);
                 } else {
                         perf_rdr_shift_out_W(rdr_num, buffer[i]);
-                }       
+                }
         }
 printk("perf_rdr_write done\n");
 }
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index 06f7ca7fe70b..4516a5b53f38 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -142,6 +142,10 @@ void machine_power_off(void)
 
         printk(KERN_EMERG "System shut down completed.\n"
                "Please power this system off now.");
+
+        /* prevent soft lockup/stalled CPU messages for endless loop. */
+        rcu_sysrq_start();
+        for (;;);
 }
 
 void (*pm_power_off)(void) = machine_power_off;
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 3cfef1de8061..44aeaa9c039f 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -444,6 +444,7 @@
         ENTRY_SAME(copy_file_range)
         ENTRY_COMP(preadv2)
         ENTRY_COMP(pwritev2)
+        ENTRY_SAME(statx)
 
 
 .ifne (. - 90b) - (__NR_Linux_syscalls * (91b - 90b))
diff --git a/arch/parisc/lib/Makefile b/arch/parisc/lib/Makefile
index 8fa92b8d839a..f2dac4d73b1b 100644
--- a/arch/parisc/lib/Makefile
+++ b/arch/parisc/lib/Makefile
@@ -2,7 +2,7 @@
 # Makefile for parisc-specific library files
 #
 
-lib-y   := lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o \
+lib-y   := lusercopy.o bitops.o checksum.o io.o memset.o memcpy.o \
            ucmpdi2.o delay.o
 
 obj-y   := iomap.o
diff --git a/arch/parisc/lib/fixup.S b/arch/parisc/lib/fixup.S
deleted file mode 100644
index a5b72f22c7a6..000000000000
--- a/arch/parisc/lib/fixup.S
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Linux/PA-RISC Project (http://www.parisc-linux.org/)
- *
- *  Copyright (C) 2004  Randolph Chung <tausq@debian.org>
- *
- *    This program is free software; you can redistribute it and/or modify
- *    it under the terms of the GNU General Public License as published by
- *    the Free Software Foundation; either version 2, or (at your option)
- *    any later version.
- *
- *    This program is distributed in the hope that it will be useful,
- *    but WITHOUT ANY WARRANTY; without even the implied warranty of
- *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *    GNU General Public License for more details.
- *
- *    You should have received a copy of the GNU General Public License
- *    along with this program; if not, write to the Free Software
- *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- * 
- * Fixup routines for kernel exception handling.
- */
-#include <asm/asm-offsets.h>
-#include <asm/assembly.h>
-#include <asm/errno.h>
-#include <linux/linkage.h>
-
-#ifdef CONFIG_SMP
-        .macro  get_fault_ip t1 t2
-        loadgp
-        addil LT%__per_cpu_offset,%r27
-        LDREG RT%__per_cpu_offset(%r1),\t1
-        /* t2 = smp_processor_id() */
-        mfctl 30,\t2
-        ldw TI_CPU(\t2),\t2
-#ifdef CONFIG_64BIT
-        extrd,u \t2,63,32,\t2
-#endif
-        /* t2 = &__per_cpu_offset[smp_processor_id()]; */
-        LDREGX \t2(\t1),\t2 
-        addil LT%exception_data,%r27
-        LDREG RT%exception_data(%r1),\t1
-        /* t1 = this_cpu_ptr(&exception_data) */
-        add,l \t1,\t2,\t1
-        /* %r27 = t1->fault_gp - restore gp */
-        LDREG EXCDATA_GP(\t1), %r27
-        /* t1 = t1->fault_ip */
-        LDREG EXCDATA_IP(\t1), \t1
-        .endm
-#else
-        .macro  get_fault_ip t1 t2
-        loadgp
-        /* t1 = this_cpu_ptr(&exception_data) */
-        addil LT%exception_data,%r27
-        LDREG RT%exception_data(%r1),\t2
-        /* %r27 = t2->fault_gp - restore gp */
-        LDREG EXCDATA_GP(\t2), %r27
-        /* t1 = t2->fault_ip */
-        LDREG EXCDATA_IP(\t2), \t1
-        .endm
-#endif
-
-        .level LEVEL
-
-        .text
-        .section .fixup, "ax"
-
-        /* get_user() fixups, store -EFAULT in r8, and 0 in r9 */
-ENTRY_CFI(fixup_get_user_skip_1)
-        get_fault_ip %r1,%r8
-        ldo 4(%r1), %r1
-        ldi -EFAULT, %r8
-        bv %r0(%r1)
-        copy %r0, %r9
-ENDPROC_CFI(fixup_get_user_skip_1)
-
-ENTRY_CFI(fixup_get_user_skip_2)
-        get_fault_ip %r1,%r8
-        ldo 8(%r1), %r1
-        ldi -EFAULT, %r8
-        bv %r0(%r1)
-        copy %r0, %r9
-ENDPROC_CFI(fixup_get_user_skip_2)
-
-        /* put_user() fixups, store -EFAULT in r8 */
-ENTRY_CFI(fixup_put_user_skip_1)
-        get_fault_ip %r1,%r8
-        ldo 4(%r1), %r1
-        bv %r0(%r1)
-        ldi -EFAULT, %r8
-ENDPROC_CFI(fixup_put_user_skip_1)
-
-ENTRY_CFI(fixup_put_user_skip_2)
-        get_fault_ip %r1,%r8
-        ldo 8(%r1), %r1
-        bv %r0(%r1)
-        ldi -EFAULT, %r8
-ENDPROC_CFI(fixup_put_user_skip_2)
-
diff --git a/arch/parisc/lib/lusercopy.S b/arch/parisc/lib/lusercopy.S
index 56845de6b5df..f01188c044ee 100644
--- a/arch/parisc/lib/lusercopy.S
+++ b/arch/parisc/lib/lusercopy.S
@@ -5,6 +5,8 @@
  *    Copyright (C) 2000 Richard Hirst <rhirst with parisc-linux.org>
  *    Copyright (C) 2001 Matthieu Delahaye <delahaym at esiee.fr>
  *    Copyright (C) 2003 Randolph Chung <tausq with parisc-linux.org>
+ *    Copyright (C) 2017 Helge Deller <deller@gmx.de>
+ *    Copyright (C) 2017 John David Anglin <dave.anglin@bell.net>
  *
  *
  *    This program is free software; you can redistribute it and/or modify
@@ -132,4 +134,320 @@ ENDPROC_CFI(lstrnlen_user)
 
         .procend
 
+
+
+/*
+ * unsigned long pa_memcpy(void *dstp, const void *srcp, unsigned long len)
+ *
+ * Inputs:
+ * - sr1 already contains space of source region
+ * - sr2 already contains space of destination region
+ *
+ * Returns:
+ * - number of bytes that could not be copied.
+ *   On success, this will be zero.
+ *
+ * This code is based on a C-implementation of a copy routine written by
+ * Randolph Chung, which in turn was derived from the glibc.
+ *
+ * Several strategies are tried to try to get the best performance for various
+ * conditions. In the optimal case, we copy by loops that copy 32- or 16-bytes
+ * at a time using general registers.  Unaligned copies are handled either by
+ * aligning the destination and then using shift-and-write method, or in a few
+ * cases by falling back to a byte-at-a-time copy.
+ *
+ * Testing with various alignments and buffer sizes shows that this code is
+ * often >10x faster than a simple byte-at-a-time copy, even for strangely
+ * aligned operands. It is interesting to note that the glibc version of memcpy
+ * (written in C) is actually quite fast already. This routine is able to beat
+ * it by 30-40% for aligned copies because of the loop unrolling, but in some
+ * cases the glibc version is still slightly faster. This lends more
+ * credibility that gcc can generate very good code as long as we are careful.
+ *
+ * Possible optimizations:
+ * - add cache prefetching
+ * - try not to use the post-increment address modifiers; they may create
+ *   additional interlocks. Assumption is that those were only efficient on old
+ *   machines (pre PA8000 processors)
+ */
+
+        dst = arg0
+        src = arg1
+        len = arg2
+        end = arg3
+        t1  = r19
+        t2  = r20
+        t3  = r21
+        t4  = r22
+        srcspc = sr1
+        dstspc = sr2
+
+        t0 = r1
+        a1 = t1
+        a2 = t2
+        a3 = t3
+        a0 = t4
+
+        save_src = ret0
+        save_dst = ret1
+        save_len = r31
+
+ENTRY_CFI(pa_memcpy)
+        .proc
+        .callinfo NO_CALLS
+        .entry
+
+        /* Last destination address */
+        add     dst,len,end
+
+        /* short copy with less than 16 bytes? */
+        cmpib,>>=,n 15,len,.Lbyte_loop
+
+        /* same alignment? */
+        xor     src,dst,t0
+        extru   t0,31,2,t1
+        cmpib,<>,n  0,t1,.Lunaligned_copy
+
+#ifdef CONFIG_64BIT
+        /* only do 64-bit copies if we can get aligned. */
+        extru   t0,31,3,t1
+        cmpib,<>,n  0,t1,.Lalign_loop32
+
+        /* loop until we are 64-bit aligned */
+.Lalign_loop64:
+        extru   dst,31,3,t1
+        cmpib,=,n       0,t1,.Lcopy_loop_16
+20:     ldb,ma  1(srcspc,src),t1
+21:     stb,ma  t1,1(dstspc,dst)
+        b       .Lalign_loop64
+        ldo     -1(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+        ldi     31,t0
+.Lcopy_loop_16:
+        cmpb,COND(>>=),n t0,len,.Lword_loop
+
+10:     ldd     0(srcspc,src),t1
+11:     ldd     8(srcspc,src),t2
+        ldo     16(src),src
+12:     std,ma  t1,8(dstspc,dst)
+13:     std,ma  t2,8(dstspc,dst)
+14:     ldd     0(srcspc,src),t1
+15:     ldd     8(srcspc,src),t2
+        ldo     16(src),src
+16:     std,ma  t1,8(dstspc,dst)
+17:     std,ma  t2,8(dstspc,dst)
+
+        ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(11b,.Lcopy16_fault)
+        ASM_EXCEPTIONTABLE_ENTRY(12b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(13b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(14b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(15b,.Lcopy16_fault)
+        ASM_EXCEPTIONTABLE_ENTRY(16b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(17b,.Lcopy_done)
+
+        b       .Lcopy_loop_16
+        ldo     -32(len),len
+
+.Lword_loop:
+        cmpib,COND(>>=),n 3,len,.Lbyte_loop
+20:     ldw,ma  4(srcspc,src),t1
+21:     stw,ma  t1,4(dstspc,dst)
+        b       .Lword_loop
+        ldo     -4(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+#endif /* CONFIG_64BIT */
+
+        /* loop until we are 32-bit aligned */
+.Lalign_loop32:
+        extru   dst,31,2,t1
+        cmpib,=,n       0,t1,.Lcopy_loop_4
+20:     ldb,ma  1(srcspc,src),t1
+21:     stb,ma  t1,1(dstspc,dst)
+        b       .Lalign_loop32
+        ldo     -1(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+
+.Lcopy_loop_4:
+        cmpib,COND(>>=),n 15,len,.Lbyte_loop
+
+10:     ldw     0(srcspc,src),t1
+11:     ldw     4(srcspc,src),t2
+12:     stw,ma  t1,4(dstspc,dst)
+13:     stw,ma  t2,4(dstspc,dst)
+14:     ldw     8(srcspc,src),t1
+15:     ldw     12(srcspc,src),t2
+        ldo     16(src),src
+16:     stw,ma  t1,4(dstspc,dst)
+17:     stw,ma  t2,4(dstspc,dst)
+
+        ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(11b,.Lcopy8_fault)
+        ASM_EXCEPTIONTABLE_ENTRY(12b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(13b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(14b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(15b,.Lcopy8_fault)
+        ASM_EXCEPTIONTABLE_ENTRY(16b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(17b,.Lcopy_done)
+
+        b       .Lcopy_loop_4
+        ldo     -16(len),len
+
+.Lbyte_loop:
+        cmpclr,COND(<>) len,%r0,%r0
+        b,n     .Lcopy_done
+20:     ldb     0(srcspc,src),t1
+        ldo     1(src),src
+21:     stb,ma  t1,1(dstspc,dst)
+        b       .Lbyte_loop
+        ldo     -1(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+.Lcopy_done:
+        bv      %r0(%r2)
+        sub     end,dst,ret0
+
+
+        /* src and dst are not aligned the same way. */
+        /* need to go the hard way */
+.Lunaligned_copy:
+        /* align until dst is 32bit-word-aligned */
+        extru   dst,31,2,t1
+        cmpib,COND(=),n 0,t1,.Lcopy_dstaligned
+20:     ldb     0(srcspc,src),t1
+        ldo     1(src),src
+21:     stb,ma  t1,1(dstspc,dst)
+        b       .Lunaligned_copy
+        ldo     -1(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+.Lcopy_dstaligned:
+
+        /* store src, dst and len in safe place */
+        copy    src,save_src
+        copy    dst,save_dst
+        copy    len,save_len
+
+        /* len now needs give number of words to copy */
+        SHRREG  len,2,len
+
+        /*
+         * Copy from a not-aligned src to an aligned dst using shifts.
+         * Handles 4 words per loop.
+         */
+
+        depw,z src,28,2,t0
+        subi 32,t0,t0
+        mtsar t0
+        extru len,31,2,t0
+        cmpib,= 2,t0,.Lcase2
+        /* Make src aligned by rounding it down.  */
+        depi 0,31,2,src
+
+        cmpiclr,<> 3,t0,%r0
+        b,n .Lcase3
+        cmpiclr,<> 1,t0,%r0
+        b,n .Lcase1
+.Lcase0:
+        cmpb,= %r0,len,.Lcda_finish
+        nop
+
+1:      ldw,ma 4(srcspc,src), a3
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+1:      ldw,ma 4(srcspc,src), a0
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        b,n .Ldo3
+.Lcase1:
+1:      ldw,ma 4(srcspc,src), a2
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+1:      ldw,ma 4(srcspc,src), a3
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        ldo -1(len),len
+        cmpb,=,n %r0,len,.Ldo0
+.Ldo4:
+1:      ldw,ma 4(srcspc,src), a0
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        shrpw a2, a3, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+.Ldo3:
+1:      ldw,ma 4(srcspc,src), a1
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        shrpw a3, a0, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+.Ldo2:
+1:      ldw,ma 4(srcspc,src), a2
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        shrpw a0, a1, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+.Ldo1:
+1:      ldw,ma 4(srcspc,src), a3
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        shrpw a1, a2, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+        ldo -4(len),len
+        cmpb,<> %r0,len,.Ldo4
+        nop
+.Ldo0:
+        shrpw a2, a3, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+
+.Lcda_rdfault:
+.Lcda_finish:
+        /* calculate new src, dst and len and jump to byte-copy loop */
+        sub     dst,save_dst,t0
+        add     save_src,t0,src
+        b       .Lbyte_loop
+        sub     save_len,t0,len
+
+.Lcase3:
+1:      ldw,ma 4(srcspc,src), a0
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+1:      ldw,ma 4(srcspc,src), a1
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        b .Ldo2
+        ldo 1(len),len
+.Lcase2:
+1:      ldw,ma 4(srcspc,src), a1
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+1:      ldw,ma 4(srcspc,src), a2
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        b .Ldo1
+        ldo 2(len),len
+
+
+        /* fault exception fixup handlers: */
+#ifdef CONFIG_64BIT
+.Lcopy16_fault:
+10:     b       .Lcopy_done
+        std,ma  t1,8(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+#endif
+
+.Lcopy8_fault:
+10:     b       .Lcopy_done
+        stw,ma  t1,4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+
+        .exit
+ENDPROC_CFI(pa_memcpy)
+        .procend
+
         .end
diff --git a/arch/parisc/lib/memcpy.c b/arch/parisc/lib/memcpy.c
index f82ff10ed974..b3d47ec1d80a 100644
--- a/arch/parisc/lib/memcpy.c
+++ b/arch/parisc/lib/memcpy.c
@@ -2,7 +2,7 @@
  *    Optimized memory copy routines.
  *
  *    Copyright (C) 2004 Randolph Chung <tausq@debian.org>
- *    Copyright (C) 2013 Helge Deller <deller@gmx.de>
+ *    Copyright (C) 2013-2017 Helge Deller <deller@gmx.de>
  *
  *    This program is free software; you can redistribute it and/or modify
  *    it under the terms of the GNU General Public License as published by
@@ -21,474 +21,21 @@
  *    Portions derived from the GNU C Library
  *    Copyright (C) 1991, 1997, 2003 Free Software Foundation, Inc.
  *
- * Several strategies are tried to try to get the best performance for various
- * conditions. In the optimal case, we copy 64-bytes in an unrolled loop using 
- * fp regs. This is followed by loops that copy 32- or 16-bytes at a time using
- * general registers.  Unaligned copies are handled either by aligning the 
- * destination and then using shift-and-write method, or in a few cases by 
- * falling back to a byte-at-a-time copy.
- *
- * I chose to implement this in C because it is easier to maintain and debug,
- * and in my experiments it appears that the C code generated by gcc (3.3/3.4
- * at the time of writing) is fairly optimal. Unfortunately some of the 
- * semantics of the copy routine (exception handling) is difficult to express
- * in C, so we have to play some tricks to get it to work.
- *
- * All the loads and stores are done via explicit asm() code in order to use
- * the right space registers. 
- * 
- * Testing with various alignments and buffer sizes shows that this code is 
- * often >10x faster than a simple byte-at-a-time copy, even for strangely
- * aligned operands. It is interesting to note that the glibc version
- * of memcpy (written in C) is actually quite fast already. This routine is 
- * able to beat it by 30-40% for aligned copies because of the loop unrolling, 
- * but in some cases the glibc version is still slightly faster. This lends 
- * more credibility that gcc can generate very good code as long as we are 
- * careful.
- *
- * TODO:
- * - cache prefetching needs more experimentation to get optimal settings
- * - try not to use the post-increment address modifiers; they create additional
- *   interlocks
- * - replace byte-copy loops with stybs sequences
  */
 
-#ifdef __KERNEL__
 #include <linux/module.h>
 #include <linux/compiler.h>
 #include <linux/uaccess.h>
-#define s_space "%%sr1"
-#define d_space "%%sr2"
-#else
-#include "memcpy.h"
-#define s_space "%%sr0"
-#define d_space "%%sr0"
-#define pa_memcpy new2_copy
-#endif
 
 DECLARE_PER_CPU(struct exception_data, exception_data);
 
-#define preserve_branch(label)  do {                                    \
-        volatile int dummy = 0;                                         \
-        /* The following branch is never taken, it's just here to  */   \
-        /* prevent gcc from optimizing away our exception code. */      \
-        if (unlikely(dummy != dummy))                                   \
-                goto label;                                             \
-} while (0)
-
 #define get_user_space() (segment_eq(get_fs(), KERNEL_DS) ? 0 : mfsp(3))
 #define get_kernel_space() (0)
 
-#define MERGE(w0, sh_1, w1, sh_2)  ({                                   \
-        unsigned int _r;                                                \
-        asm volatile (                                                  \
-        "mtsar %3\n"                                                    \
-        "shrpw %1, %2, %%sar, %0\n"                                     \
-        : "=r"(_r)                                                      \
-        : "r"(w0), "r"(w1), "r"(sh_2)                                   \
-        );                                                              \
-        _r;                                                             \
-})
-#define THRESHOLD       16
-
-#ifdef DEBUG_MEMCPY
-#define DPRINTF(fmt, args...) do { printk(KERN_DEBUG "%s:%d:%s ", __FILE__, __LINE__, __func__ ); printk(KERN_DEBUG fmt, ##args ); } while (0)
-#else
-#define DPRINTF(fmt, args...)
-#endif
-
-#define def_load_ai_insn(_insn,_sz,_tt,_s,_a,_t,_e)     \
-        __asm__ __volatile__ (                          \
-        "1:\t" #_insn ",ma " #_sz "(" _s ",%1), %0\n\t" \
-        ASM_EXCEPTIONTABLE_ENTRY(1b,_e)                 \
-        : _tt(_t), "+r"(_a)                             \
-        :                                               \
-        : "r8")
-
-#define def_store_ai_insn(_insn,_sz,_tt,_s,_a,_t,_e)    \
-        __asm__ __volatile__ (                          \
-        "1:\t" #_insn ",ma %1, " #_sz "(" _s ",%0)\n\t" \
-        ASM_EXCEPTIONTABLE_ENTRY(1b,_e)                 \
-        : "+r"(_a)                                      \
-        : _tt(_t)                                       \
-        : "r8")
-
-#define ldbma(_s, _a, _t, _e) def_load_ai_insn(ldbs,1,"=r",_s,_a,_t,_e)
-#define stbma(_s, _t, _a, _e) def_store_ai_insn(stbs,1,"r",_s,_a,_t,_e)
-#define ldwma(_s, _a, _t, _e) def_load_ai_insn(ldw,4,"=r",_s,_a,_t,_e)
-#define stwma(_s, _t, _a, _e) def_store_ai_insn(stw,4,"r",_s,_a,_t,_e)
-#define flddma(_s, _a, _t, _e) def_load_ai_insn(fldd,8,"=f",_s,_a,_t,_e)
-#define fstdma(_s, _t, _a, _e) def_store_ai_insn(fstd,8,"f",_s,_a,_t,_e)
-
-#define def_load_insn(_insn,_tt,_s,_o,_a,_t,_e)         \
-        __asm__ __volatile__ (                          \
-        "1:\t" #_insn " " #_o "(" _s ",%1), %0\n\t"     \
-        ASM_EXCEPTIONTABLE_ENTRY(1b,_e)                 \
-        : _tt(_t)                                       \
-        : "r"(_a)                                       \
-        : "r8")
-
-#define def_store_insn(_insn,_tt,_s,_t,_o,_a,_e)        \
-        __asm__ __volatile__ (                          \
-        "1:\t" #_insn " %0, " #_o "(" _s ",%1)\n\t"     \
-        ASM_EXCEPTIONTABLE_ENTRY(1b,_e)                 \
-        :                                               \
-        : _tt(_t), "r"(_a)                              \
-        : "r8")
-
-#define ldw(_s,_o,_a,_t,_e)     def_load_insn(ldw,"=r",_s,_o,_a,_t,_e)
-#define stw(_s,_t,_o,_a,_e)     def_store_insn(stw,"r",_s,_t,_o,_a,_e)
-
-#ifdef  CONFIG_PREFETCH
-static inline void prefetch_src(const void *addr)
-{
-        __asm__("ldw 0(" s_space ",%0), %%r0" : : "r" (addr));
-}
-
-static inline void prefetch_dst(const void *addr)
-{
-        __asm__("ldd 0(" d_space ",%0), %%r0" : : "r" (addr));
-}
-#else
-#define prefetch_src(addr) do { } while(0)
-#define prefetch_dst(addr) do { } while(0)
-#endif
-
-#define PA_MEMCPY_OK            0
-#define PA_MEMCPY_LOAD_ERROR    1
-#define PA_MEMCPY_STORE_ERROR   2
-
-/* Copy from a not-aligned src to an aligned dst, using shifts. Handles 4 words
- * per loop.  This code is derived from glibc. 
- */
-static noinline unsigned long copy_dstaligned(unsigned long dst,
-                                        unsigned long src, unsigned long len)
-{
-        /* gcc complains that a2 and a3 may be uninitialized, but actually
-         * they cannot be.  Initialize a2/a3 to shut gcc up.
-         */
-        register unsigned int a0, a1, a2 = 0, a3 = 0;
-        int sh_1, sh_2;
-
-        /* prefetch_src((const void *)src); */
-
-        /* Calculate how to shift a word read at the memory operation
-           aligned srcp to make it aligned for copy.  */
-        sh_1 = 8 * (src % sizeof(unsigned int));
-        sh_2 = 8 * sizeof(unsigned int) - sh_1;
-
-        /* Make src aligned by rounding it down.  */
-        src &= -sizeof(unsigned int);
-
-        switch (len % 4)
-        {
-                case 2:
-                        /* a1 = ((unsigned int *) src)[0];
-                           a2 = ((unsigned int *) src)[1]; */
-                        ldw(s_space, 0, src, a1, cda_ldw_exc);
-                        ldw(s_space, 4, src, a2, cda_ldw_exc);
-                        src -= 1 * sizeof(unsigned int);
-                        dst -= 3 * sizeof(unsigned int);
-                        len += 2;
-                        goto do1;
-                case 3:
-                        /* a0 = ((unsigned int *) src)[0];
-                           a1 = ((unsigned int *) src)[1]; */
-                        ldw(s_space, 0, src, a0, cda_ldw_exc);
-                        ldw(s_space, 4, src, a1, cda_ldw_exc);
-                        src -= 0 * sizeof(unsigned int);
-                        dst -= 2 * sizeof(unsigned int);
-                        len += 1;
-                        goto do2;
-                case 0:
-                        if (len == 0)
-                                return PA_MEMCPY_OK;
-                        /* a3 = ((unsigned int *) src)[0];
-                           a0 = ((unsigned int *) src)[1]; */
-                        ldw(s_space, 0, src, a3, cda_ldw_exc);
-                        ldw(s_space, 4, src, a0, cda_ldw_exc);
-                        src -=-1 * sizeof(unsigned int);
-                        dst -= 1 * sizeof(unsigned int);
-                        len += 0;
-                        goto do3;
-                case 1:
-                        /* a2 = ((unsigned int *) src)[0];
-                           a3 = ((unsigned int *) src)[1]; */
-                        ldw(s_space, 0, src, a2, cda_ldw_exc);
-                        ldw(s_space, 4, src, a3, cda_ldw_exc);
-                        src -=-2 * sizeof(unsigned int);
-                        dst -= 0 * sizeof(unsigned int);
-                        len -= 1;
-                        if (len == 0)
-                                goto do0;
-                        goto do4;                       /* No-op.  */
-        }
-
-        do
-        {
-                /* prefetch_src((const void *)(src + 4 * sizeof(unsigned int))); */
-do4:
-                /* a0 = ((unsigned int *) src)[0]; */
-                ldw(s_space, 0, src, a0, cda_ldw_exc);
-                /* ((unsigned int *) dst)[0] = MERGE (a2, sh_1, a3, sh_2); */
-                stw(d_space, MERGE (a2, sh_1, a3, sh_2), 0, dst, cda_stw_exc);
-do3:
-                /* a1 = ((unsigned int *) src)[1]; */
-                ldw(s_space, 4, src, a1, cda_ldw_exc);
-                /* ((unsigned int *) dst)[1] = MERGE (a3, sh_1, a0, sh_2); */
-                stw(d_space, MERGE (a3, sh_1, a0, sh_2), 4, dst, cda_stw_exc);
-do2:
-                /* a2 = ((unsigned int *) src)[2]; */
-                ldw(s_space, 8, src, a2, cda_ldw_exc);
-                /* ((unsigned int *) dst)[2] = MERGE (a0, sh_1, a1, sh_2); */
-                stw(d_space, MERGE (a0, sh_1, a1, sh_2), 8, dst, cda_stw_exc);
-do1:
-                /* a3 = ((unsigned int *) src)[3]; */
-                ldw(s_space, 12, src, a3, cda_ldw_exc);
-                /* ((unsigned int *) dst)[3] = MERGE (a1, sh_1, a2, sh_2); */
-                stw(d_space, MERGE (a1, sh_1, a2, sh_2), 12, dst, cda_stw_exc);
-
-                src += 4 * sizeof(unsigned int);
-                dst += 4 * sizeof(unsigned int);
-                len -= 4;
-        }
-        while (len != 0);
-
-do0:
-        /* ((unsigned int *) dst)[0] = MERGE (a2, sh_1, a3, sh_2); */
-        stw(d_space, MERGE (a2, sh_1, a3, sh_2), 0, dst, cda_stw_exc);
-
-        preserve_branch(handle_load_error);
-        preserve_branch(handle_store_error);
-
-        return PA_MEMCPY_OK;
-
-handle_load_error:
-        __asm__ __volatile__ ("cda_ldw_exc:\n");
-        return PA_MEMCPY_LOAD_ERROR;
-
-handle_store_error:
-        __asm__ __volatile__ ("cda_stw_exc:\n");
-        return PA_MEMCPY_STORE_ERROR;
-}
-
-
-/* Returns PA_MEMCPY_OK, PA_MEMCPY_LOAD_ERROR or PA_MEMCPY_STORE_ERROR.
- * In case of an access fault the faulty address can be read from the per_cpu
- * exception data struct. */
-static noinline unsigned long pa_memcpy_internal(void *dstp, const void *srcp,
-                                        unsigned long len)
-{
-        register unsigned long src, dst, t1, t2, t3;
-        register unsigned char *pcs, *pcd;
-        register unsigned int *pws, *pwd;
-        register double *pds, *pdd;
-        unsigned long ret;
-
-        src = (unsigned long)srcp;
-        dst = (unsigned long)dstp;
-        pcs = (unsigned char *)srcp;
-        pcd = (unsigned char *)dstp;
-
-        /* prefetch_src((const void *)srcp); */
-
-        if (len < THRESHOLD)
-                goto byte_copy;
-
-        /* Check alignment */
-        t1 = (src ^ dst);
-        if (unlikely(t1 & (sizeof(double)-1)))
-                goto unaligned_copy;
-
-        /* src and dst have same alignment. */
-
-        /* Copy bytes till we are double-aligned. */
-        t2 = src & (sizeof(double) - 1);
-        if (unlikely(t2 != 0)) {
-                t2 = sizeof(double) - t2;
-                while (t2 && len) {
-                        /* *pcd++ = *pcs++; */
-                        ldbma(s_space, pcs, t3, pmc_load_exc);
-                        len--;
-                        stbma(d_space, t3, pcd, pmc_store_exc);
-                        t2--;
-                }
-        }
-
-        pds = (double *)pcs;
-        pdd = (double *)pcd;
-
-#if 0
-        /* Copy 8 doubles at a time */
-        while (len >= 8*sizeof(double)) {
-                register double r1, r2, r3, r4, r5, r6, r7, r8;
-                /* prefetch_src((char *)pds + L1_CACHE_BYTES); */
-                flddma(s_space, pds, r1, pmc_load_exc);
-                flddma(s_space, pds, r2, pmc_load_exc);
-                flddma(s_space, pds, r3, pmc_load_exc);
-                flddma(s_space, pds, r4, pmc_load_exc);
-                fstdma(d_space, r1, pdd, pmc_store_exc);
-                fstdma(d_space, r2, pdd, pmc_store_exc);
-                fstdma(d_space, r3, pdd, pmc_store_exc);
-                fstdma(d_space, r4, pdd, pmc_store_exc);
-
-#if 0
-                if (L1_CACHE_BYTES <= 32)
-                        prefetch_src((char *)pds + L1_CACHE_BYTES);
-#endif
-                flddma(s_space, pds, r5, pmc_load_exc);
-                flddma(s_space, pds, r6, pmc_load_exc);
-                flddma(s_space, pds, r7, pmc_load_exc);
-                flddma(s_space, pds, r8, pmc_load_exc);
-                fstdma(d_space, r5, pdd, pmc_store_exc);
-                fstdma(d_space, r6, pdd, pmc_store_exc);
-                fstdma(d_space, r7, pdd, pmc_store_exc);
-                fstdma(d_space, r8, pdd, pmc_store_exc);
-                len -= 8*sizeof(double);
-        }
-#endif
-
-        pws = (unsigned int *)pds;
-        pwd = (unsigned int *)pdd;
-
-word_copy:
-        while (len >= 8*sizeof(unsigned int)) {
-                register unsigned int r1,r2,r3,r4,r5,r6,r7,r8;
-                /* prefetch_src((char *)pws + L1_CACHE_BYTES); */
-                ldwma(s_space, pws, r1, pmc_load_exc);
-                ldwma(s_space, pws, r2, pmc_load_exc);
-                ldwma(s_space, pws, r3, pmc_load_exc);
-                ldwma(s_space, pws, r4, pmc_load_exc);
-                stwma(d_space, r1, pwd, pmc_store_exc);
-                stwma(d_space, r2, pwd, pmc_store_exc);
-                stwma(d_space, r3, pwd, pmc_store_exc);
-                stwma(d_space, r4, pwd, pmc_store_exc);
-
-                ldwma(s_space, pws, r5, pmc_load_exc);
-                ldwma(s_space, pws, r6, pmc_load_exc);
-                ldwma(s_space, pws, r7, pmc_load_exc);
-                ldwma(s_space, pws, r8, pmc_load_exc);
-                stwma(d_space, r5, pwd, pmc_store_exc);
-                stwma(d_space, r6, pwd, pmc_store_exc);
-                stwma(d_space, r7, pwd, pmc_store_exc);
-                stwma(d_space, r8, pwd, pmc_store_exc);
-                len -= 8*sizeof(unsigned int);
-        }
-
-        while (len >= 4*sizeof(unsigned int)) {
-                register unsigned int r1,r2,r3,r4;
-                ldwma(s_space, pws, r1, pmc_load_exc);
-                ldwma(s_space, pws, r2, pmc_load_exc);
-                ldwma(s_space, pws, r3, pmc_load_exc);
-                ldwma(s_space, pws, r4, pmc_load_exc);
-                stwma(d_space, r1, pwd, pmc_store_exc);
-                stwma(d_space, r2, pwd, pmc_store_exc);
-                stwma(d_space, r3, pwd, pmc_store_exc);
-                stwma(d_space, r4, pwd, pmc_store_exc);
-                len -= 4*sizeof(unsigned int);
-        }
-
-        pcs = (unsigned char *)pws;
-        pcd = (unsigned char *)pwd;
-
-byte_copy:
-        while (len) {
-                /* *pcd++ = *pcs++; */
-                ldbma(s_space, pcs, t3, pmc_load_exc);
-                stbma(d_space, t3, pcd, pmc_store_exc);
-                len--;
-        }
-
-        return PA_MEMCPY_OK;
-
-unaligned_copy:
-        /* possibly we are aligned on a word, but not on a double... */
-        if (likely((t1 & (sizeof(unsigned int)-1)) == 0)) {
-                t2 = src & (sizeof(unsigned int) - 1);
-
-                if (unlikely(t2 != 0)) {
-                        t2 = sizeof(unsigned int) - t2;
-                        while (t2) {
-                                /* *pcd++ = *pcs++; */
-                                ldbma(s_space, pcs, t3, pmc_load_exc);
-                                stbma(d_space, t3, pcd, pmc_store_exc);
-                                len--;
-                                t2--;
-                        }
-                }
-
-                pws = (unsigned int *)pcs;
-                pwd = (unsigned int *)pcd;
-                goto word_copy;
-        }
-
-        /* Align the destination.  */
-        if (unlikely((dst & (sizeof(unsigned int) - 1)) != 0)) {
-                t2 = sizeof(unsigned int) - (dst & (sizeof(unsigned int) - 1));
-                while (t2) {
-                        /* *pcd++ = *pcs++; */
-                        ldbma(s_space, pcs, t3, pmc_load_exc);
-                        stbma(d_space, t3, pcd, pmc_store_exc);
-                        len--;
-                        t2--;
-                }
-                dst = (unsigned long)pcd;
-                src = (unsigned long)pcs;
-        }
-
-        ret = copy_dstaligned(dst, src, len / sizeof(unsigned int));
-        if (ret)
-                return ret;
-
-        pcs += (len & -sizeof(unsigned int));
-        pcd += (len & -sizeof(unsigned int));
-        len %= sizeof(unsigned int);
-
-        preserve_branch(handle_load_error);
-        preserve_branch(handle_store_error);
-
-        goto byte_copy;
-
-handle_load_error:
-        __asm__ __volatile__ ("pmc_load_exc:\n");
-        return PA_MEMCPY_LOAD_ERROR;
-
-handle_store_error:
-        __asm__ __volatile__ ("pmc_store_exc:\n");
-        return PA_MEMCPY_STORE_ERROR;
-}
-
-
 /* Returns 0 for success, otherwise, returns number of bytes not transferred. */
-static unsigned long pa_memcpy(void *dstp, const void *srcp, unsigned long len)
-{
-        unsigned long ret, fault_addr, reference;
-        struct exception_data *d;
-
-        ret = pa_memcpy_internal(dstp, srcp, len);
-        if (likely(ret == PA_MEMCPY_OK))
-                return 0;
-
-        /* if a load or store fault occured we can get the faulty addr */
-        d = this_cpu_ptr(&exception_data);
-        fault_addr = d->fault_addr;
-
-        /* error in load or store? */
-        if (ret == PA_MEMCPY_LOAD_ERROR)
-                reference = (unsigned long) srcp;
-        else
-                reference = (unsigned long) dstp;
+extern unsigned long pa_memcpy(void *dst, const void *src,
+                                unsigned long len);
 
-        DPRINTF("pa_memcpy: fault type = %lu, len=%lu fault_addr=%lu ref=%lu\n",
-                ret, len, fault_addr, reference);
-
-        if (fault_addr >= reference)
-                return len - (fault_addr - reference);
-        else
-                return len;
-}
-
-#ifdef __KERNEL__
 unsigned long __copy_to_user(void __user *dst, const void *src,
                              unsigned long len)
 {
@@ -537,5 +84,3 @@ long probe_kernel_read(void *dst, const void *src, size_t size)
 
         return __probe_kernel_read(dst, src, size);
 }
-
-#endif
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index deab89a8915a..32ec22146141 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -150,6 +150,23 @@ int fixup_exception(struct pt_regs *regs)
                 d->fault_space = regs->isr;
                 d->fault_addr = regs->ior;
 
+                /*
+                 * Fix up get_user() and put_user().
+                 * ASM_EXCEPTIONTABLE_ENTRY_EFAULT() sets the least-significant
+                 * bit in the relative address of the fixup routine to indicate
+                 * that %r8 should be loaded with -EFAULT to report a userspace
+                 * access error.
+                 */
+                if (fix->fixup & 1) {
+                        regs->gr[8] = -EFAULT;
+
+                        /* zero target register for get_user() */
+                        if (parisc_acctyp(0, regs->iir) == VM_READ) {
+                                int treg = regs->iir & 0x1f;
+                                regs->gr[treg] = 0;
+                        }
+                }
+
                 regs->iaoq[0] = (unsigned long)&fix->fixup + fix->fixup;
                 regs->iaoq[0] &= ~3;
                 /*
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 494091762bd7..97a8bc8a095c 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -80,93 +80,99 @@ config ARCH_HAS_DMA_SET_COHERENT_MASK
 config PPC
         bool
         default y
-        select BUILDTIME_EXTABLE_SORT
+        #
+        # Please keep this list sorted alphabetically.
+        #
+        select ARCH_HAS_DEVMEM_IS_ALLOWED
+        select ARCH_HAS_DMA_SET_COHERENT_MASK
+        select ARCH_HAS_ELF_RANDOMIZE
+        select ARCH_HAS_GCOV_PROFILE_ALL
+        select ARCH_HAS_SCALED_CPUTIME          if VIRT_CPU_ACCOUNTING_NATIVE
+        select ARCH_HAS_SG_CHAIN
+        select ARCH_HAS_TICK_BROADCAST          if GENERIC_CLOCKEVENTS_BROADCAST
+        select ARCH_HAS_UBSAN_SANITIZE_ALL
+        select ARCH_HAVE_NMI_SAFE_CMPXCHG
         select ARCH_MIGHT_HAVE_PC_PARPORT
         select ARCH_MIGHT_HAVE_PC_SERIO
+        select ARCH_SUPPORTS_ATOMIC_RMW
+        select ARCH_SUPPORTS_DEFERRED_STRUCT_PAGE_INIT
+        select ARCH_USE_BUILTIN_BSWAP
+        select ARCH_USE_CMPXCHG_LOCKREF         if PPC64
+        select ARCH_WANT_IPC_PARSE_VERSION
         select BINFMT_ELF
-        select ARCH_HAS_ELF_RANDOMIZE
-        select OF
-        select OF_EARLY_FLATTREE
-        select OF_RESERVED_MEM
-        select HAVE_FTRACE_MCOUNT_RECORD
+        select BUILDTIME_EXTABLE_SORT
+        select CLONE_BACKWARDS
+        select DCACHE_WORD_ACCESS               if PPC64 && CPU_LITTLE_ENDIAN
+        select EDAC_ATOMIC_SCRUB
+        select EDAC_SUPPORT
+        select GENERIC_ATOMIC64                 if PPC32
+        select GENERIC_CLOCKEVENTS
+        select GENERIC_CLOCKEVENTS_BROADCAST    if SMP
+        select GENERIC_CMOS_UPDATE
+        select GENERIC_CPU_AUTOPROBE
+        select GENERIC_IRQ_SHOW
+        select GENERIC_IRQ_SHOW_LEVEL
+        select GENERIC_SMP_IDLE_THREAD
+        select GENERIC_STRNCPY_FROM_USER
+        select GENERIC_STRNLEN_USER
+        select GENERIC_TIME_VSYSCALL_OLD
+        select HAVE_ARCH_AUDITSYSCALL
+        select HAVE_ARCH_HARDENED_USERCOPY
+        select HAVE_ARCH_JUMP_LABEL
+        select HAVE_ARCH_KGDB
+        select HAVE_ARCH_SECCOMP_FILTER
+        select HAVE_ARCH_TRACEHOOK
+        select HAVE_CBPF_JIT                    if !PPC64
+        select HAVE_CONTEXT_TRACKING            if PPC64
+        select HAVE_DEBUG_KMEMLEAK
+        select HAVE_DEBUG_STACKOVERFLOW
+        select HAVE_DMA_API_DEBUG
         select HAVE_DYNAMIC_FTRACE
-        select HAVE_DYNAMIC_FTRACE_WITH_REGS if MPROFILE_KERNEL
-        select HAVE_FUNCTION_TRACER
+        select HAVE_DYNAMIC_FTRACE_WITH_REGS    if MPROFILE_KERNEL
+        select HAVE_EBPF_JIT                    if PPC64
+        select HAVE_EFFICIENT_UNALIGNED_ACCESS  if !(CPU_LITTLE_ENDIAN && POWER7_CPU)
+        select HAVE_FTRACE_MCOUNT_RECORD
         select HAVE_FUNCTION_GRAPH_TRACER
+        select HAVE_FUNCTION_TRACER
         select HAVE_GCC_PLUGINS
-        select SYSCTL_EXCEPTION_TRACE
-        select VIRT_TO_BUS if !PPC64
+        select HAVE_GENERIC_RCU_GUP
+        select HAVE_HW_BREAKPOINT               if PERF_EVENTS && (PPC_BOOK3S || PPC_8xx)
         select HAVE_IDE
         select HAVE_IOREMAP_PROT
-        select HAVE_EFFICIENT_UNALIGNED_ACCESS if !(CPU_LITTLE_ENDIAN && POWER7_CPU)
+        select HAVE_IRQ_EXIT_ON_IRQ_STACK
+        select HAVE_KERNEL_GZIP
         select HAVE_KPROBES
-        select HAVE_OPTPROBES if PPC64
-        select HAVE_ARCH_KGDB
         select HAVE_KRETPROBES
-        select HAVE_ARCH_TRACEHOOK
+        select HAVE_LIVEPATCH                   if HAVE_DYNAMIC_FTRACE_WITH_REGS
         select HAVE_MEMBLOCK
         select HAVE_MEMBLOCK_NODE_MAP
-        select HAVE_DMA_API_DEBUG
+        select HAVE_MOD_ARCH_SPECIFIC
+        select HAVE_NMI                         if PERF_EVENTS
         select HAVE_OPROFILE
-        select HAVE_DEBUG_KMEMLEAK
-        select ARCH_HAS_SG_CHAIN
-        select GENERIC_ATOMIC64 if PPC32
+        select HAVE_OPTPROBES                   if PPC64
         select HAVE_PERF_EVENTS
+        select HAVE_PERF_EVENTS_NMI             if PPC64
         select HAVE_PERF_REGS
         select HAVE_PERF_USER_STACK_DUMP
+        select HAVE_RCU_TABLE_FREE              if SMP
         select HAVE_REGS_AND_STACK_ACCESS_API
-        select HAVE_HW_BREAKPOINT if PERF_EVENTS && (PPC_BOOK3S || PPC_8xx)
-        select ARCH_WANT_IPC_PARSE_VERSION
-        select SPARSE_IRQ
+        select HAVE_SYSCALL_TRACEPOINTS
+        select HAVE_VIRT_CPU_ACCOUNTING
         select IRQ_DOMAIN
-        select GENERIC_IRQ_SHOW
-        select GENERIC_IRQ_SHOW_LEVEL
         select IRQ_FORCED_THREADING
-        select HAVE_RCU_TABLE_FREE if SMP
-        select HAVE_SYSCALL_TRACEPOINTS
-        select HAVE_CBPF_JIT if !PPC64
-        select HAVE_EBPF_JIT if PPC64
-        select HAVE_ARCH_JUMP_LABEL
-        select ARCH_HAVE_NMI_SAFE_CMPXCHG
-        select ARCH_HAS_GCOV_PROFILE_ALL
-        select GENERIC_SMP_IDLE_THREAD
-        select GENERIC_CMOS_UPDATE
-        select GENERIC_TIME_VSYSCALL_OLD
-        select GENERIC_CLOCKEVENTS
-        select GENERIC_CLOCKEVENTS_BROADCAST if SMP
-        select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
-        select GENERIC_STRNCPY_FROM_USER
-        select GENERIC_STRNLEN_USER
-        select HAVE_MOD_ARCH_SPECIFIC
         select MODULES_USE_ELF_RELA
-        select CLONE_BACKWARDS
-        select ARCH_USE_BUILTIN_BSWAP
-        select OLD_SIGSUSPEND
-        select OLD_SIGACTION if PPC32
-        select HAVE_DEBUG_STACKOVERFLOW
-        select HAVE_IRQ_EXIT_ON_IRQ_STACK
-        select ARCH_USE_CMPXCHG_LOCKREF if PPC64
-        select HAVE_ARCH_AUDITSYSCALL
-        select ARCH_SUPPORTS_ATOMIC_RMW
-        select DCACHE_WORD_ACCESS if PPC64 && CPU_LITTLE_ENDIAN
         select NO_BOOTMEM
-        select HAVE_GENERIC_RCU_GUP
-        select HAVE_PERF_EVENTS_NMI if PPC64
-        select HAVE_NMI if PERF_EVENTS
-        select EDAC_SUPPORT
-        select EDAC_ATOMIC_SCRUB
-        select ARCH_HAS_DMA_SET_COHERENT_MASK
-        select ARCH_HAS_DEVMEM_IS_ALLOWED
-        select HAVE_ARCH_SECCOMP_FILTER
-        select ARCH_HAS_UBSAN_SANITIZE_ALL
-        select ARCH_SUPPORTS_DEFERRED_STRUCT_PAGE_INIT
-        select HAVE_LIVEPATCH if HAVE_DYNAMIC_FTRACE_WITH_REGS
-        select GENERIC_CPU_AUTOPROBE
-        select HAVE_VIRT_CPU_ACCOUNTING
-        select ARCH_HAS_SCALED_CPUTIME if VIRT_CPU_ACCOUNTING_NATIVE
-        select HAVE_ARCH_HARDENED_USERCOPY
-        select HAVE_KERNEL_GZIP
-        select HAVE_CONTEXT_TRACKING if PPC64
+        select OF
+        select OF_EARLY_FLATTREE
+        select OF_RESERVED_MEM
+        select OLD_SIGACTION                    if PPC32
+        select OLD_SIGSUSPEND
+        select SPARSE_IRQ
+        select SYSCTL_EXCEPTION_TRACE
+        select VIRT_TO_BUS                      if !PPC64
+        #
+        # Please keep this list sorted alphabetically.
+        #
 
 config GENERIC_CSUM
         def_bool n
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 31286fa7873c..19b0d1a81959 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -72,8 +72,15 @@ GNUTARGET	:= powerpc
 MULTIPLEWORD    := -mmultiple
 endif
 
-cflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(call cc-option,-mbig-endian)
+ifdef CONFIG_PPC64
+cflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(call cc-option,-mabi=elfv1)
+cflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(call cc-option,-mcall-aixdesc)
+aflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(call cc-option,-mabi=elfv1)
+aflags-$(CONFIG_CPU_LITTLE_ENDIAN)      += -mabi=elfv2
+endif
+
 cflags-$(CONFIG_CPU_LITTLE_ENDIAN)      += -mlittle-endian
+cflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(call cc-option,-mbig-endian)
 ifneq ($(cc-name),clang)
   cflags-$(CONFIG_CPU_LITTLE_ENDIAN)    += -mno-strict-align
 endif
@@ -113,7 +120,9 @@ ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y)
 CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mabi=elfv2,$(call cc-option,-mcall-aixdesc))
 AFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mabi=elfv2)
 else
+CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mabi=elfv1)
 CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mcall-aixdesc)
+AFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mabi=elfv1)
 endif
 CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mcmodel=medium,$(call cc-option,-mminimal-toc))
 CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mno-pointers-to-nested-functions)
diff --git a/arch/powerpc/boot/zImage.lds.S b/arch/powerpc/boot/zImage.lds.S
index 861e72109df2..f080abfc2f83 100644
--- a/arch/powerpc/boot/zImage.lds.S
+++ b/arch/powerpc/boot/zImage.lds.S
@@ -68,6 +68,7 @@ SECTIONS
   }
 
 #ifdef CONFIG_PPC64_BOOT_WRAPPER
+  . = ALIGN(256);
   .got :
   {
     __toc_start = .;
diff --git a/arch/powerpc/crypto/crc32c-vpmsum_glue.c b/arch/powerpc/crypto/crc32c-vpmsum_glue.c
index 9fa046d56eba..411994551afc 100644
--- a/arch/powerpc/crypto/crc32c-vpmsum_glue.c
+++ b/arch/powerpc/crypto/crc32c-vpmsum_glue.c
@@ -52,7 +52,7 @@ static int crc32c_vpmsum_cra_init(struct crypto_tfm *tfm)
 {
         u32 *key = crypto_tfm_ctx(tfm);
 
-        *key = 0;
+        *key = ~0;
 
         return 0;
 }
diff --git a/arch/powerpc/include/asm/bitops.h b/arch/powerpc/include/asm/bitops.h
index 73eb794d6163..bc5fdfd22788 100644
--- a/arch/powerpc/include/asm/bitops.h
+++ b/arch/powerpc/include/asm/bitops.h
@@ -51,6 +51,10 @@
 #define PPC_BIT(bit)            (1UL << PPC_BITLSHIFT(bit))
 #define PPC_BITMASK(bs, be)     ((PPC_BIT(bs) - PPC_BIT(be)) | PPC_BIT(bs))
 
+/* Put a PPC bit into a "normal" bit position */
+#define PPC_BITEXTRACT(bits, ppc_bit, dst_bit)                  \
+        ((((bits) >> PPC_BITLSHIFT(ppc_bit)) & 1) << (dst_bit))
+
 #include <asm/barrier.h>
 
 /* Macro for generating the ***_bits() functions */
diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h b/arch/powerpc/include/asm/book3s/32/pgtable.h
index 012223638815..26ed228d4dc6 100644
--- a/arch/powerpc/include/asm/book3s/32/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/32/pgtable.h
@@ -1,6 +1,7 @@
 #ifndef _ASM_POWERPC_BOOK3S_32_PGTABLE_H
 #define _ASM_POWERPC_BOOK3S_32_PGTABLE_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #include <asm/book3s/32/hash.h>
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index 1eeeb72c7015..8f4d41936e5a 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -1,9 +1,12 @@
 #ifndef _ASM_POWERPC_BOOK3S_64_PGTABLE_H_
 #define _ASM_POWERPC_BOOK3S_64_PGTABLE_H_
 
+#include <asm-generic/5level-fixup.h>
+
 #ifndef __ASSEMBLY__
 #include <linux/mmdebug.h>
 #endif
+
 /*
  * Common bits between hash and Radix page table
  */
@@ -347,23 +350,58 @@ static inline int __ptep_test_and_clear_young(struct mm_struct *mm,
         __r;                                                    \
 })
 
+static inline int __pte_write(pte_t pte)
+{
+        return !!(pte_raw(pte) & cpu_to_be64(_PAGE_WRITE));
+}
+
+#ifdef CONFIG_NUMA_BALANCING
+#define pte_savedwrite pte_savedwrite
+static inline bool pte_savedwrite(pte_t pte)
+{
+        /*
+         * Saved write ptes are prot none ptes that doesn't have
+         * privileged bit sit. We mark prot none as one which has
+         * present and pviliged bit set and RWX cleared. To mark
+         * protnone which used to have _PAGE_WRITE set we clear
+         * the privileged bit.
+         */
+        return !(pte_raw(pte) & cpu_to_be64(_PAGE_RWX | _PAGE_PRIVILEGED));
+}
+#else
+#define pte_savedwrite pte_savedwrite
+static inline bool pte_savedwrite(pte_t pte)
+{
+        return false;
+}
+#endif
+
+static inline int pte_write(pte_t pte)
+{
+        return __pte_write(pte) || pte_savedwrite(pte);
+}
+
 #define __HAVE_ARCH_PTEP_SET_WRPROTECT
 static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr,
                                       pte_t *ptep)
 {
-        if ((pte_raw(*ptep) & cpu_to_be64(_PAGE_WRITE)) == 0)
-                return;
-
-        pte_update(mm, addr, ptep, _PAGE_WRITE, 0, 0);
+        if (__pte_write(*ptep))
+                pte_update(mm, addr, ptep, _PAGE_WRITE, 0, 0);
+        else if (unlikely(pte_savedwrite(*ptep)))
+                pte_update(mm, addr, ptep, 0, _PAGE_PRIVILEGED, 0);
 }
 
 static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
                                            unsigned long addr, pte_t *ptep)
 {
-        if ((pte_raw(*ptep) & cpu_to_be64(_PAGE_WRITE)) == 0)
-                return;
-
-        pte_update(mm, addr, ptep, _PAGE_WRITE, 0, 1);
+        /*
+         * We should not find protnone for hugetlb, but this complete the
+         * interface.
+         */
+        if (__pte_write(*ptep))
+                pte_update(mm, addr, ptep, _PAGE_WRITE, 0, 1);
+        else if (unlikely(pte_savedwrite(*ptep)))
+                pte_update(mm, addr, ptep, 0, _PAGE_PRIVILEGED, 1);
 }
 
 #define __HAVE_ARCH_PTEP_GET_AND_CLEAR
@@ -397,11 +435,6 @@ static inline void pte_clear(struct mm_struct *mm, unsigned long addr,
         pte_update(mm, addr, ptep, ~0UL, 0, 0);
 }
 
-static inline int pte_write(pte_t pte)
-{
-        return !!(pte_raw(pte) & cpu_to_be64(_PAGE_WRITE));
-}
-
 static inline int pte_dirty(pte_t pte)
 {
         return !!(pte_raw(pte) & cpu_to_be64(_PAGE_DIRTY));
@@ -465,19 +498,12 @@ static inline pte_t pte_clear_savedwrite(pte_t pte)
         VM_BUG_ON(!pte_protnone(pte));
         return __pte(pte_val(pte) | _PAGE_PRIVILEGED);
 }
-
-#define pte_savedwrite pte_savedwrite
-static inline bool pte_savedwrite(pte_t pte)
+#else
+#define pte_clear_savedwrite pte_clear_savedwrite
+static inline pte_t pte_clear_savedwrite(pte_t pte)
 {
-        /*
-         * Saved write ptes are prot none ptes that doesn't have
-         * privileged bit sit. We mark prot none as one which has
-         * present and pviliged bit set and RWX cleared. To mark
-         * protnone which used to have _PAGE_WRITE set we clear
-         * the privileged bit.
-         */
-        VM_BUG_ON(!pte_protnone(pte));
-        return !(pte_raw(pte) & cpu_to_be64(_PAGE_RWX | _PAGE_PRIVILEGED));
+        VM_WARN_ON(1);
+        return __pte(pte_val(pte) & ~_PAGE_WRITE);
 }
 #endif /* CONFIG_NUMA_BALANCING */
 
@@ -506,6 +532,8 @@ static inline unsigned long pte_pfn(pte_t pte)
 /* Generic modifiers for PTE bits */
 static inline pte_t pte_wrprotect(pte_t pte)
 {
+        if (unlikely(pte_savedwrite(pte)))
+                return pte_clear_savedwrite(pte);
         return __pte(pte_val(pte) & ~_PAGE_WRITE);
 }
 
@@ -926,6 +954,7 @@ static inline int pmd_protnone(pmd_t pmd)
 
 #define __HAVE_ARCH_PMD_WRITE
 #define pmd_write(pmd)          pte_write(pmd_pte(pmd))
+#define __pmd_write(pmd)        __pte_write(pmd_pte(pmd))
 #define pmd_savedwrite(pmd)     pte_savedwrite(pmd_pte(pmd))
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
@@ -982,11 +1011,10 @@ static inline int __pmdp_test_and_clear_young(struct mm_struct *mm,
 static inline void pmdp_set_wrprotect(struct mm_struct *mm, unsigned long addr,
                                       pmd_t *pmdp)
 {
-
-        if ((pmd_raw(*pmdp) & cpu_to_be64(_PAGE_WRITE)) == 0)
-                return;
-
-        pmd_hugepage_update(mm, addr, pmdp, _PAGE_WRITE, 0);
+        if (__pmd_write((*pmdp)))
+                pmd_hugepage_update(mm, addr, pmdp, _PAGE_WRITE, 0);
+        else if (unlikely(pmd_savedwrite(*pmdp)))
+                pmd_hugepage_update(mm, addr, pmdp, 0, _PAGE_PRIVILEGED);
 }
 
 static inline int pmd_trans_huge(pmd_t pmd)
diff --git a/arch/powerpc/include/asm/checksum.h b/arch/powerpc/include/asm/checksum.h
index 4e63787dc3be..842124b199b5 100644
--- a/arch/powerpc/include/asm/checksum.h
+++ b/arch/powerpc/include/asm/checksum.h
@@ -112,7 +112,7 @@ static inline __wsum csum_add(__wsum csum, __wsum addend)
 
 #ifdef __powerpc64__
         res += (__force u64)addend;
-        return (__force __wsum)((u32)res + (res >> 32));
+        return (__force __wsum) from64to32(res);
 #else
         asm("addc %0,%0,%1;"
             "addze %0,%0;"
diff --git a/arch/powerpc/include/asm/cpuidle.h b/arch/powerpc/include/asm/cpuidle.h
index fd321eb423cb..155731557c9b 100644
--- a/arch/powerpc/include/asm/cpuidle.h
+++ b/arch/powerpc/include/asm/cpuidle.h
@@ -70,8 +70,8 @@ static inline void report_invalid_psscr_val(u64 psscr_val, int err)
         std     r0,0(r1);                                       \
         ptesync;                                                \
         ld      r0,0(r1);                                       \
-1:      cmpd    cr0,r0,r0;                                      \
-        bne     1b;                                             \
+236:    cmpd    cr0,r0,r0;                                      \
+        bne     236b;                                           \
         IDLE_INST;                                              \
 
 #define IDLE_STATE_ENTER_SEQ_NORET(IDLE_INST)                   \
diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
index 93b9b84568e8..09bde6e34f5d 100644
--- a/arch/powerpc/include/asm/elf.h
+++ b/arch/powerpc/include/asm/elf.h
@@ -144,8 +144,8 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
 #define ARCH_DLINFO_CACHE_GEOMETRY                                      \
         NEW_AUX_ENT(AT_L1I_CACHESIZE, ppc64_caches.l1i.size);           \
         NEW_AUX_ENT(AT_L1I_CACHEGEOMETRY, get_cache_geometry(l1i));     \
-        NEW_AUX_ENT(AT_L1D_CACHESIZE, ppc64_caches.l1i.size);           \
-        NEW_AUX_ENT(AT_L1D_CACHEGEOMETRY, get_cache_geometry(l1i));     \
+        NEW_AUX_ENT(AT_L1D_CACHESIZE, ppc64_caches.l1d.size);           \
+        NEW_AUX_ENT(AT_L1D_CACHEGEOMETRY, get_cache_geometry(l1d));     \
         NEW_AUX_ENT(AT_L2_CACHESIZE, ppc64_caches.l2.size);             \
         NEW_AUX_ENT(AT_L2_CACHEGEOMETRY, get_cache_geometry(l2));       \
         NEW_AUX_ENT(AT_L3_CACHESIZE, ppc64_caches.l3.size);             \
diff --git a/arch/powerpc/include/asm/mce.h b/arch/powerpc/include/asm/mce.h
index f97d8cb6bdf6..ed62efe01e49 100644
--- a/arch/powerpc/include/asm/mce.h
+++ b/arch/powerpc/include/asm/mce.h
@@ -66,6 +66,55 @@
 
 #define P8_DSISR_MC_SLB_ERRORS          (P7_DSISR_MC_SLB_ERRORS | \
                                          P8_DSISR_MC_ERAT_MULTIHIT_SEC)
+
+/*
+ * Machine Check bits on power9
+ */
+#define P9_SRR1_MC_LOADSTORE(srr1)      (((srr1) >> PPC_BITLSHIFT(42)) & 1)
+
+#define P9_SRR1_MC_IFETCH(srr1) (       \
+        PPC_BITEXTRACT(srr1, 45, 0) |   \
+        PPC_BITEXTRACT(srr1, 44, 1) |   \
+        PPC_BITEXTRACT(srr1, 43, 2) |   \
+        PPC_BITEXTRACT(srr1, 36, 3) )
+
+/* 0 is reserved */
+#define P9_SRR1_MC_IFETCH_UE                            1
+#define P9_SRR1_MC_IFETCH_SLB_PARITY                    2
+#define P9_SRR1_MC_IFETCH_SLB_MULTIHIT                  3
+#define P9_SRR1_MC_IFETCH_ERAT_MULTIHIT                 4
+#define P9_SRR1_MC_IFETCH_TLB_MULTIHIT                  5
+#define P9_SRR1_MC_IFETCH_UE_TLB_RELOAD                 6
+/* 7 is reserved */
+#define P9_SRR1_MC_IFETCH_LINK_TIMEOUT                  8
+#define P9_SRR1_MC_IFETCH_LINK_TABLEWALK_TIMEOUT        9
+/* 10 ? */
+#define P9_SRR1_MC_IFETCH_RA                    11
+#define P9_SRR1_MC_IFETCH_RA_TABLEWALK          12
+#define P9_SRR1_MC_IFETCH_RA_ASYNC_STORE                13
+#define P9_SRR1_MC_IFETCH_LINK_ASYNC_STORE_TIMEOUT      14
+#define P9_SRR1_MC_IFETCH_RA_TABLEWALK_FOREIGN  15
+
+/* DSISR bits for machine check (On Power9) */
+#define P9_DSISR_MC_UE                                  (PPC_BIT(48))
+#define P9_DSISR_MC_UE_TABLEWALK                        (PPC_BIT(49))
+#define P9_DSISR_MC_LINK_LOAD_TIMEOUT                   (PPC_BIT(50))
+#define P9_DSISR_MC_LINK_TABLEWALK_TIMEOUT              (PPC_BIT(51))
+#define P9_DSISR_MC_ERAT_MULTIHIT                       (PPC_BIT(52))
+#define P9_DSISR_MC_TLB_MULTIHIT_MFTLB                  (PPC_BIT(53))
+#define P9_DSISR_MC_USER_TLBIE                          (PPC_BIT(54))
+#define P9_DSISR_MC_SLB_PARITY_MFSLB                    (PPC_BIT(55))
+#define P9_DSISR_MC_SLB_MULTIHIT_MFSLB                  (PPC_BIT(56))
+#define P9_DSISR_MC_RA_LOAD                             (PPC_BIT(57))
+#define P9_DSISR_MC_RA_TABLEWALK                        (PPC_BIT(58))
+#define P9_DSISR_MC_RA_TABLEWALK_FOREIGN                (PPC_BIT(59))
+#define P9_DSISR_MC_RA_FOREIGN                          (PPC_BIT(60))
+
+/* SLB error bits */
+#define P9_DSISR_MC_SLB_ERRORS          (P9_DSISR_MC_ERAT_MULTIHIT | \
+                                         P9_DSISR_MC_SLB_PARITY_MFSLB | \
+                                         P9_DSISR_MC_SLB_MULTIHIT_MFSLB)
+
 enum MCE_Version {
         MCE_V1 = 1,
 };
@@ -93,6 +142,9 @@ enum MCE_ErrorType {
         MCE_ERROR_TYPE_SLB = 2,
         MCE_ERROR_TYPE_ERAT = 3,
         MCE_ERROR_TYPE_TLB = 4,
+        MCE_ERROR_TYPE_USER = 5,
+        MCE_ERROR_TYPE_RA = 6,
+        MCE_ERROR_TYPE_LINK = 7,
 };
 
 enum MCE_UeErrorType {
@@ -121,6 +173,32 @@ enum MCE_TlbErrorType {
         MCE_TLB_ERROR_MULTIHIT = 2,
 };
 
+enum MCE_UserErrorType {
+        MCE_USER_ERROR_INDETERMINATE = 0,
+        MCE_USER_ERROR_TLBIE = 1,
+};
+
+enum MCE_RaErrorType {
+        MCE_RA_ERROR_INDETERMINATE = 0,
+        MCE_RA_ERROR_IFETCH = 1,
+        MCE_RA_ERROR_PAGE_TABLE_WALK_IFETCH = 2,
+        MCE_RA_ERROR_PAGE_TABLE_WALK_IFETCH_FOREIGN = 3,
+        MCE_RA_ERROR_LOAD = 4,
+        MCE_RA_ERROR_STORE = 5,
+        MCE_RA_ERROR_PAGE_TABLE_WALK_LOAD_STORE = 6,
+        MCE_RA_ERROR_PAGE_TABLE_WALK_LOAD_STORE_FOREIGN = 7,
+        MCE_RA_ERROR_LOAD_STORE_FOREIGN = 8,
+};
+
+enum MCE_LinkErrorType {
+        MCE_LINK_ERROR_INDETERMINATE = 0,
+        MCE_LINK_ERROR_IFETCH_TIMEOUT = 1,
+        MCE_LINK_ERROR_PAGE_TABLE_WALK_IFETCH_TIMEOUT = 2,
+        MCE_LINK_ERROR_LOAD_TIMEOUT = 3,
+        MCE_LINK_ERROR_STORE_TIMEOUT = 4,
+        MCE_LINK_ERROR_PAGE_TABLE_WALK_LOAD_STORE_TIMEOUT = 5,
+};
+
 struct machine_check_event {
         enum MCE_Version        version:8;      /* 0x00 */
         uint8_t                 in_use;         /* 0x01 */
@@ -166,6 +244,30 @@ struct machine_check_event {
                         uint64_t        effective_address;
                         uint8_t         reserved_2[16];
                 } tlb_error;
+
+                struct {
+                        enum MCE_UserErrorType user_error_type:8;
+                        uint8_t         effective_address_provided;
+                        uint8_t         reserved_1[6];
+                        uint64_t        effective_address;
+                        uint8_t         reserved_2[16];
+                } user_error;
+
+                struct {
+                        enum MCE_RaErrorType ra_error_type:8;
+                        uint8_t         effective_address_provided;
+                        uint8_t         reserved_1[6];
+                        uint64_t        effective_address;
+                        uint8_t         reserved_2[16];
+                } ra_error;
+
+                struct {
+                        enum MCE_LinkErrorType link_error_type:8;
+                        uint8_t         effective_address_provided;
+                        uint8_t         reserved_1[6];
+                        uint64_t        effective_address;
+                        uint8_t         reserved_2[16];
+                } link_error;
         } u;
 };
 
@@ -176,8 +278,12 @@ struct mce_error_info {
                 enum MCE_SlbErrorType slb_error_type:8;
                 enum MCE_EratErrorType erat_error_type:8;
                 enum MCE_TlbErrorType tlb_error_type:8;
+                enum MCE_UserErrorType user_error_type:8;
+                enum MCE_RaErrorType ra_error_type:8;
+                enum MCE_LinkErrorType link_error_type:8;
         } u;
-        uint8_t         reserved[2];
+        enum MCE_Severity       severity:8;
+        enum MCE_Initiator      initiator:8;
 };
 
 #define MAX_MC_EVT      100
diff --git a/arch/powerpc/include/asm/nohash/32/pgtable.h b/arch/powerpc/include/asm/nohash/32/pgtable.h
index ba9921bf202e..5134ade2e850 100644
--- a/arch/powerpc/include/asm/nohash/32/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/32/pgtable.h
@@ -1,6 +1,7 @@
 #ifndef _ASM_POWERPC_NOHASH_32_PGTABLE_H
 #define _ASM_POWERPC_NOHASH_32_PGTABLE_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #ifndef __ASSEMBLY__
diff --git a/arch/powerpc/include/asm/nohash/64/pgtable-4k.h b/arch/powerpc/include/asm/nohash/64/pgtable-4k.h
index d0db98793dd8..9f4de0a1035e 100644
--- a/arch/powerpc/include/asm/nohash/64/pgtable-4k.h
+++ b/arch/powerpc/include/asm/nohash/64/pgtable-4k.h
@@ -1,5 +1,8 @@
 #ifndef _ASM_POWERPC_NOHASH_64_PGTABLE_4K_H
 #define _ASM_POWERPC_NOHASH_64_PGTABLE_4K_H
+
+#include <asm-generic/5level-fixup.h>
+
 /*
  * Entries per page directory level.  The PTE level must use a 64b record
  * for each page table entry.  The PMD and PGD level use a 32b record for
diff --git a/arch/powerpc/include/asm/nohash/64/pgtable-64k.h b/arch/powerpc/include/asm/nohash/64/pgtable-64k.h
index 55b28ef3409a..1facb584dd29 100644
--- a/arch/powerpc/include/asm/nohash/64/pgtable-64k.h
+++ b/arch/powerpc/include/asm/nohash/64/pgtable-64k.h
@@ -1,6 +1,7 @@
 #ifndef _ASM_POWERPC_NOHASH_64_PGTABLE_64K_H
 #define _ASM_POWERPC_NOHASH_64_PGTABLE_64K_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 
 
diff --git a/arch/powerpc/include/asm/nohash/pgtable.h b/arch/powerpc/include/asm/nohash/pgtable.h
index 0cd8a3852763..e5805ad78e12 100644
--- a/arch/powerpc/include/asm/nohash/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/pgtable.h
@@ -230,7 +230,7 @@ static inline int hugepd_ok(hugepd_t hpd)
         return ((hpd_val(hpd) & 0x4) != 0);
 #else
         /* We clear the top bit to indicate hugepd */
-        return ((hpd_val(hpd) & PD_HUGE) ==  0);
+        return (hpd_val(hpd) && (hpd_val(hpd) & PD_HUGE) == 0);
 #endif
 }
 
diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
index d99bd442aacb..e7d6d86563ee 100644
--- a/arch/powerpc/include/asm/ppc-opcode.h
+++ b/arch/powerpc/include/asm/ppc-opcode.h
@@ -284,6 +284,13 @@
 #define PPC_INST_BRANCH_COND            0x40800000
 #define PPC_INST_LBZCIX                 0x7c0006aa
 #define PPC_INST_STBCIX                 0x7c0007aa
+#define PPC_INST_LWZX                   0x7c00002e
+#define PPC_INST_LFSX                   0x7c00042e
+#define PPC_INST_STFSX                  0x7c00052e
+#define PPC_INST_LFDX                   0x7c0004ae
+#define PPC_INST_STFDX                  0x7c0005ae
+#define PPC_INST_LVX                    0x7c0000ce
+#define PPC_INST_STVX                   0x7c0001ce
 
 /* macros to insert fields into opcodes */
 #define ___PPC_RA(a)    (((a) & 0x1f) << 16)
diff --git a/arch/powerpc/include/asm/prom.h b/arch/powerpc/include/asm/prom.h
index 4a90634e8322..35c00d7a0cf8 100644
--- a/arch/powerpc/include/asm/prom.h
+++ b/arch/powerpc/include/asm/prom.h
@@ -160,12 +160,18 @@ struct of_drconf_cell {
 #define OV5_PFO_HW_ENCR         0x1120  /* PFO Encryption Accelerator */
 #define OV5_SUB_PROCESSORS      0x1501  /* 1,2,or 4 Sub-Processors supported */
 #define OV5_XIVE_EXPLOIT        0x1701  /* XIVE exploitation supported */
-#define OV5_MMU_RADIX_300       0x1880  /* ISA v3.00 radix MMU supported */
-#define OV5_MMU_HASH_300        0x1840  /* ISA v3.00 hash MMU supported */
-#define OV5_MMU_SEGM_RADIX      0x1820  /* radix mode (no segmentation) */
-#define OV5_MMU_PROC_TBL        0x1810  /* hcall selects SLB or proc table */
-#define OV5_MMU_SLB             0x1800  /* always use SLB */
-#define OV5_MMU_GTSE            0x1808  /* Guest translation shootdown */
+/* MMU Base Architecture */
+#define OV5_MMU_SUPPORT         0x18C0  /* MMU Mode Support Mask */
+#define OV5_MMU_HASH            0x1800  /* Hash MMU Only */
+#define OV5_MMU_RADIX           0x1840  /* Radix MMU Only */
+#define OV5_MMU_EITHER          0x1880  /* Hash or Radix Supported */
+#define OV5_MMU_DYNAMIC         0x18C0  /* Hash or Radix Can Switch Later */
+#define OV5_NMMU                0x1820  /* Nest MMU Available */
+/* Hash Table Extensions */
+#define OV5_HASH_SEG_TBL        0x1980  /* In Memory Segment Tables Available */
+#define OV5_HASH_GTSE           0x1940  /* Guest Translation Shoot Down Avail */
+/* Radix Table Extensions */
+#define OV5_RADIX_GTSE          0x1A40  /* Guest Translation Shoot Down Avail */
 
 /* Option Vector 6: IBM PAPR hints */
 #define OV6_LINUX               0x02    /* Linux is our OS */
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index 4b369d83fe9c..1c9470881c4a 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -387,3 +387,4 @@ SYSCALL(copy_file_range)
 COMPAT_SYS_SPU(preadv2)
 COMPAT_SYS_SPU(pwritev2)
 SYSCALL(kexec_file_load)
+SYSCALL(statx)
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index eb1acee91a20..9ba11dbcaca9 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -12,7 +12,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define NR_syscalls             383
+#define NR_syscalls             384
 
 #define __NR__exit __NR_exit
 
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index 2f26335a3c42..b85f14228857 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -393,5 +393,6 @@
 #define __NR_preadv2            380
 #define __NR_pwritev2           381
 #define __NR_kexec_file_load    382
+#define __NR_statx              383
 
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index bb7a1890aeb7..e79b9daa873c 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -77,6 +77,7 @@ extern void __flush_tlb_power8(unsigned int action);
 extern void __flush_tlb_power9(unsigned int action);
 extern long __machine_check_early_realmode_p7(struct pt_regs *regs);
 extern long __machine_check_early_realmode_p8(struct pt_regs *regs);
+extern long __machine_check_early_realmode_p9(struct pt_regs *regs);
 #endif /* CONFIG_PPC64 */
 #if defined(CONFIG_E500)
 extern void __setup_cpu_e5500(unsigned long offset, struct cpu_spec* spec);
@@ -540,6 +541,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .cpu_setup              = __setup_cpu_power9,
                 .cpu_restore            = __restore_cpu_power9,
                 .flush_tlb              = __flush_tlb_power9,
+                .machine_check_early    = __machine_check_early_realmode_p9,
                 .platform               = "power9",
         },
         {       /* Power9 */
@@ -559,6 +561,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .cpu_setup              = __setup_cpu_power9,
                 .cpu_restore            = __restore_cpu_power9,
                 .flush_tlb              = __flush_tlb_power9,
+                .machine_check_early    = __machine_check_early_realmode_p9,
                 .platform               = "power9",
         },
         {       /* Cell Broadband Engine */
diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index 5f61cc0349c0..6fd08219248d 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -276,19 +276,21 @@ power_enter_stop:
  */
         andis.   r4,r3,PSSCR_EC_ESL_MASK_SHIFTED
         clrldi   r3,r3,60 /* r3 = Bits[60:63] = Requested Level (RL) */
-        bne      1f
+        bne      .Lhandle_esl_ec_set
         IDLE_STATE_ENTER_SEQ(PPC_STOP)
         li      r3,0  /* Since we didn't lose state, return 0 */
         b       pnv_wakeup_noloss
+
+.Lhandle_esl_ec_set:
 /*
  * Check if the requested state is a deep idle state.
  */
-1:      LOAD_REG_ADDRBASE(r5,pnv_first_deep_stop_state)
+        LOAD_REG_ADDRBASE(r5,pnv_first_deep_stop_state)
         ld      r4,ADDROFF(pnv_first_deep_stop_state)(r5)
         cmpd    r3,r4
-        bge     2f
+        bge     .Lhandle_deep_stop
         IDLE_STATE_ENTER_SEQ_NORET(PPC_STOP)
-2:
+.Lhandle_deep_stop:
 /*
  * Entering deep idle state.
  * Clear thread bit in PACA_CORE_IDLE_STATE, save SPRs to
@@ -447,9 +449,23 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
 _GLOBAL(pnv_wakeup_tb_loss)
         ld      r1,PACAR1(r13)
         /*
-         * Before entering any idle state, the NVGPRs are saved in the stack
-         * and they are restored before switching to the process context. Hence
-         * until they are restored, they are free to be used.
+         * Before entering any idle state, the NVGPRs are saved in the stack.
+         * If there was a state loss, or PACA_NAPSTATELOST was set, then the
+         * NVGPRs are restored. If we are here, it is likely that state is lost,
+         * but not guaranteed -- neither ISA207 nor ISA300 tests to reach
+         * here are the same as the test to restore NVGPRS:
+         * PACA_THREAD_IDLE_STATE test for ISA207, PSSCR test for ISA300,
+         * and SRR1 test for restoring NVGPRs.
+         *
+         * We are about to clobber NVGPRs now, so set NAPSTATELOST to
+         * guarantee they will always be restored. This might be tightened
+         * with careful reading of specs (particularly for ISA300) but this
+         * is already a slow wakeup path and it's simpler to be safe.
+         */
+        li      r0,1
+        stb     r0,PACA_NAPSTATELOST(r13)
+
+        /*
          *
          * Save SRR1 and LR in NVGPRs as they might be clobbered in
          * opal_call() (called in CHECK_HMI_INTERRUPT). SRR1 is required
diff --git a/arch/powerpc/kernel/mce.c b/arch/powerpc/kernel/mce.c
index c6923ff45131..a1475e6aef3a 100644
--- a/arch/powerpc/kernel/mce.c
+++ b/arch/powerpc/kernel/mce.c
@@ -58,6 +58,15 @@ static void mce_set_error_info(struct machine_check_event *mce,
         case MCE_ERROR_TYPE_TLB:
                 mce->u.tlb_error.tlb_error_type = mce_err->u.tlb_error_type;
                 break;
+        case MCE_ERROR_TYPE_USER:
+                mce->u.user_error.user_error_type = mce_err->u.user_error_type;
+                break;
+        case MCE_ERROR_TYPE_RA:
+                mce->u.ra_error.ra_error_type = mce_err->u.ra_error_type;
+                break;
+        case MCE_ERROR_TYPE_LINK:
+                mce->u.link_error.link_error_type = mce_err->u.link_error_type;
+                break;
         case MCE_ERROR_TYPE_UNKNOWN:
         default:
                 break;
@@ -90,13 +99,14 @@ void save_mce_event(struct pt_regs *regs, long handled,
         mce->gpr3 = regs->gpr[3];
         mce->in_use = 1;
 
-        mce->initiator = MCE_INITIATOR_CPU;
         /* Mark it recovered if we have handled it and MSR(RI=1). */
         if (handled && (regs->msr & MSR_RI))
                 mce->disposition = MCE_DISPOSITION_RECOVERED;
         else
                 mce->disposition = MCE_DISPOSITION_NOT_RECOVERED;
-        mce->severity = MCE_SEV_ERROR_SYNC;
+
+        mce->initiator = mce_err->initiator;
+        mce->severity = mce_err->severity;
 
         /*
          * Populate the mce error_type and type-specific error_type.
@@ -115,6 +125,15 @@ void save_mce_event(struct pt_regs *regs, long handled,
         } else if (mce->error_type == MCE_ERROR_TYPE_ERAT) {
                 mce->u.erat_error.effective_address_provided = true;
                 mce->u.erat_error.effective_address = addr;
+        } else if (mce->error_type == MCE_ERROR_TYPE_USER) {
+                mce->u.user_error.effective_address_provided = true;
+                mce->u.user_error.effective_address = addr;
+        } else if (mce->error_type == MCE_ERROR_TYPE_RA) {
+                mce->u.ra_error.effective_address_provided = true;
+                mce->u.ra_error.effective_address = addr;
+        } else if (mce->error_type == MCE_ERROR_TYPE_LINK) {
+                mce->u.link_error.effective_address_provided = true;
+                mce->u.link_error.effective_address = addr;
         } else if (mce->error_type == MCE_ERROR_TYPE_UE) {
                 mce->u.ue_error.effective_address_provided = true;
                 mce->u.ue_error.effective_address = addr;
@@ -239,6 +258,29 @@ void machine_check_print_event_info(struct machine_check_event *evt)
                 "Parity",
                 "Multihit",
         };
+        static const char *mc_user_types[] = {
+                "Indeterminate",
+                "tlbie(l) invalid",
+        };
+        static const char *mc_ra_types[] = {
+                "Indeterminate",
+                "Instruction fetch (bad)",
+                "Page table walk ifetch (bad)",
+                "Page table walk ifetch (foreign)",
+                "Load (bad)",
+                "Store (bad)",
+                "Page table walk Load/Store (bad)",
+                "Page table walk Load/Store (foreign)",
+                "Load/Store (foreign)",
+        };
+        static const char *mc_link_types[] = {
+                "Indeterminate",
+                "Instruction fetch (timeout)",
+                "Page table walk ifetch (timeout)",
+                "Load (timeout)",
+                "Store (timeout)",
+                "Page table walk Load/Store (timeout)",
+        };
 
         /* Print things out */
         if (evt->version != MCE_V1) {
@@ -315,6 +357,36 @@ void machine_check_print_event_info(struct machine_check_event *evt)
                         printk("%s    Effective address: %016llx\n",
                                level, evt->u.tlb_error.effective_address);
                 break;
+        case MCE_ERROR_TYPE_USER:
+                subtype = evt->u.user_error.user_error_type <
+                        ARRAY_SIZE(mc_user_types) ?
+                        mc_user_types[evt->u.user_error.user_error_type]
+                        : "Unknown";
+                printk("%s  Error type: User [%s]\n", level, subtype);
+                if (evt->u.user_error.effective_address_provided)
+                        printk("%s    Effective address: %016llx\n",
+                               level, evt->u.user_error.effective_address);
+                break;
+        case MCE_ERROR_TYPE_RA:
+                subtype = evt->u.ra_error.ra_error_type <
+                        ARRAY_SIZE(mc_ra_types) ?
+                        mc_ra_types[evt->u.ra_error.ra_error_type]
+                        : "Unknown";
+                printk("%s  Error type: Real address [%s]\n", level, subtype);
+                if (evt->u.ra_error.effective_address_provided)
+                        printk("%s    Effective address: %016llx\n",
+                               level, evt->u.ra_error.effective_address);
+                break;
+        case MCE_ERROR_TYPE_LINK:
+                subtype = evt->u.link_error.link_error_type <
+                        ARRAY_SIZE(mc_link_types) ?
+                        mc_link_types[evt->u.link_error.link_error_type]
+                        : "Unknown";
+                printk("%s  Error type: Link [%s]\n", level, subtype);
+                if (evt->u.link_error.effective_address_provided)
+                        printk("%s    Effective address: %016llx\n",
+                               level, evt->u.link_error.effective_address);
+                break;
         default:
         case MCE_ERROR_TYPE_UNKNOWN:
                 printk("%s  Error type: Unknown\n", level);
@@ -341,6 +413,18 @@ uint64_t get_mce_fault_addr(struct machine_check_event *evt)
                 if (evt->u.tlb_error.effective_address_provided)
                         return evt->u.tlb_error.effective_address;
                 break;
+        case MCE_ERROR_TYPE_USER:
+                if (evt->u.user_error.effective_address_provided)
+                        return evt->u.user_error.effective_address;
+                break;
+        case MCE_ERROR_TYPE_RA:
+                if (evt->u.ra_error.effective_address_provided)
+                        return evt->u.ra_error.effective_address;
+                break;
+        case MCE_ERROR_TYPE_LINK:
+                if (evt->u.link_error.effective_address_provided)
+                        return evt->u.link_error.effective_address;
+                break;
         default:
         case MCE_ERROR_TYPE_UNKNOWN:
                 break;
diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
index 7353991c4ece..763d6f58caa8 100644
--- a/arch/powerpc/kernel/mce_power.c
+++ b/arch/powerpc/kernel/mce_power.c
@@ -116,6 +116,51 @@ static void flush_and_reload_slb(void)
 }
 #endif
 
+static void flush_erat(void)
+{
+        asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
+}
+
+#define MCE_FLUSH_SLB 1
+#define MCE_FLUSH_TLB 2
+#define MCE_FLUSH_ERAT 3
+
+static int mce_flush(int what)
+{
+#ifdef CONFIG_PPC_STD_MMU_64
+        if (what == MCE_FLUSH_SLB) {
+                flush_and_reload_slb();
+                return 1;
+        }
+#endif
+        if (what == MCE_FLUSH_ERAT) {
+                flush_erat();
+                return 1;
+        }
+        if (what == MCE_FLUSH_TLB) {
+                if (cur_cpu_spec && cur_cpu_spec->flush_tlb) {
+                        cur_cpu_spec->flush_tlb(TLB_INVAL_SCOPE_GLOBAL);
+                        return 1;
+                }
+        }
+
+        return 0;
+}
+
+static int mce_handle_flush_derrors(uint64_t dsisr, uint64_t slb, uint64_t tlb, uint64_t erat)
+{
+        if ((dsisr & slb) && mce_flush(MCE_FLUSH_SLB))
+                dsisr &= ~slb;
+        if ((dsisr & erat) && mce_flush(MCE_FLUSH_ERAT))
+                dsisr &= ~erat;
+        if ((dsisr & tlb) && mce_flush(MCE_FLUSH_TLB))
+                dsisr &= ~tlb;
+        /* Any other errors we don't understand? */
+        if (dsisr)
+                return 0;
+        return 1;
+}
+
 static long mce_handle_derror(uint64_t dsisr, uint64_t slb_error_bits)
 {
         long handled = 1;
@@ -281,6 +326,9 @@ long __machine_check_early_realmode_p7(struct pt_regs *regs)
         long handled = 1;
         struct mce_error_info mce_error_info = { 0 };
 
+        mce_error_info.severity = MCE_SEV_ERROR_SYNC;
+        mce_error_info.initiator = MCE_INITIATOR_CPU;
+
         srr1 = regs->msr;
         nip = regs->nip;
 
@@ -352,6 +400,9 @@ long __machine_check_early_realmode_p8(struct pt_regs *regs)
         long handled = 1;
         struct mce_error_info mce_error_info = { 0 };
 
+        mce_error_info.severity = MCE_SEV_ERROR_SYNC;
+        mce_error_info.initiator = MCE_INITIATOR_CPU;
+
         srr1 = regs->msr;
         nip = regs->nip;
 
@@ -372,3 +423,189 @@ long __machine_check_early_realmode_p8(struct pt_regs *regs)
         save_mce_event(regs, handled, &mce_error_info, nip, addr);
         return handled;
 }
+
+static int mce_handle_derror_p9(struct pt_regs *regs)
+{
+        uint64_t dsisr = regs->dsisr;
+
+        return mce_handle_flush_derrors(dsisr,
+                        P9_DSISR_MC_SLB_PARITY_MFSLB |
+                        P9_DSISR_MC_SLB_MULTIHIT_MFSLB,
+
+                        P9_DSISR_MC_TLB_MULTIHIT_MFTLB,
+
+                        P9_DSISR_MC_ERAT_MULTIHIT);
+}
+
+static int mce_handle_ierror_p9(struct pt_regs *regs)
+{
+        uint64_t srr1 = regs->msr;
+
+        switch (P9_SRR1_MC_IFETCH(srr1)) {
+        case P9_SRR1_MC_IFETCH_SLB_PARITY:
+        case P9_SRR1_MC_IFETCH_SLB_MULTIHIT:
+                return mce_flush(MCE_FLUSH_SLB);
+        case P9_SRR1_MC_IFETCH_TLB_MULTIHIT:
+                return mce_flush(MCE_FLUSH_TLB);
+        case P9_SRR1_MC_IFETCH_ERAT_MULTIHIT:
+                return mce_flush(MCE_FLUSH_ERAT);
+        default:
+                return 0;
+        }
+}
+
+static void mce_get_derror_p9(struct pt_regs *regs,
+                struct mce_error_info *mce_err, uint64_t *addr)
+{
+        uint64_t dsisr = regs->dsisr;
+
+        mce_err->severity = MCE_SEV_ERROR_SYNC;
+        mce_err->initiator = MCE_INITIATOR_CPU;
+
+        if (dsisr & P9_DSISR_MC_USER_TLBIE)
+                *addr = regs->nip;
+        else
+                *addr = regs->dar;
+
+        if (dsisr & P9_DSISR_MC_UE) {
+                mce_err->error_type = MCE_ERROR_TYPE_UE;
+                mce_err->u.ue_error_type = MCE_UE_ERROR_LOAD_STORE;
+        } else if (dsisr & P9_DSISR_MC_UE_TABLEWALK) {
+                mce_err->error_type = MCE_ERROR_TYPE_UE;
+                mce_err->u.ue_error_type = MCE_UE_ERROR_PAGE_TABLE_WALK_LOAD_STORE;
+        } else if (dsisr & P9_DSISR_MC_LINK_LOAD_TIMEOUT) {
+                mce_err->error_type = MCE_ERROR_TYPE_LINK;
+                mce_err->u.link_error_type = MCE_LINK_ERROR_LOAD_TIMEOUT;
+        } else if (dsisr & P9_DSISR_MC_LINK_TABLEWALK_TIMEOUT) {
+                mce_err->error_type = MCE_ERROR_TYPE_LINK;
+                mce_err->u.link_error_type = MCE_LINK_ERROR_PAGE_TABLE_WALK_LOAD_STORE_TIMEOUT;
+        } else if (dsisr & P9_DSISR_MC_ERAT_MULTIHIT) {
+                mce_err->error_type = MCE_ERROR_TYPE_ERAT;
+                mce_err->u.erat_error_type = MCE_ERAT_ERROR_MULTIHIT;
+        } else if (dsisr & P9_DSISR_MC_TLB_MULTIHIT_MFTLB) {
+                mce_err->error_type = MCE_ERROR_TYPE_TLB;
+                mce_err->u.tlb_error_type = MCE_TLB_ERROR_MULTIHIT;
+        } else if (dsisr & P9_DSISR_MC_USER_TLBIE) {
+                mce_err->error_type = MCE_ERROR_TYPE_USER;
+                mce_err->u.user_error_type = MCE_USER_ERROR_TLBIE;
+        } else if (dsisr & P9_DSISR_MC_SLB_PARITY_MFSLB) {
+                mce_err->error_type = MCE_ERROR_TYPE_SLB;
+                mce_err->u.slb_error_type = MCE_SLB_ERROR_PARITY;
+        } else if (dsisr & P9_DSISR_MC_SLB_MULTIHIT_MFSLB) {
+                mce_err->error_type = MCE_ERROR_TYPE_SLB;
+                mce_err->u.slb_error_type = MCE_SLB_ERROR_MULTIHIT;
+        } else if (dsisr & P9_DSISR_MC_RA_LOAD) {
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_LOAD;
+        } else if (dsisr & P9_DSISR_MC_RA_TABLEWALK) {
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_PAGE_TABLE_WALK_LOAD_STORE;
+        } else if (dsisr & P9_DSISR_MC_RA_TABLEWALK_FOREIGN) {
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_PAGE_TABLE_WALK_LOAD_STORE_FOREIGN;
+        } else if (dsisr & P9_DSISR_MC_RA_FOREIGN) {
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_LOAD_STORE_FOREIGN;
+        }
+}
+
+static void mce_get_ierror_p9(struct pt_regs *regs,
+                struct mce_error_info *mce_err, uint64_t *addr)
+{
+        uint64_t srr1 = regs->msr;
+
+        switch (P9_SRR1_MC_IFETCH(srr1)) {
+        case P9_SRR1_MC_IFETCH_RA_ASYNC_STORE:
+        case P9_SRR1_MC_IFETCH_LINK_ASYNC_STORE_TIMEOUT:
+                mce_err->severity = MCE_SEV_FATAL;
+                break;
+        default:
+                mce_err->severity = MCE_SEV_ERROR_SYNC;
+                break;
+        }
+
+        mce_err->initiator = MCE_INITIATOR_CPU;
+
+        *addr = regs->nip;
+
+        switch (P9_SRR1_MC_IFETCH(srr1)) {
+        case P9_SRR1_MC_IFETCH_UE:
+                mce_err->error_type = MCE_ERROR_TYPE_UE;
+                mce_err->u.ue_error_type = MCE_UE_ERROR_IFETCH;
+                break;
+        case P9_SRR1_MC_IFETCH_SLB_PARITY:
+                mce_err->error_type = MCE_ERROR_TYPE_SLB;
+                mce_err->u.slb_error_type = MCE_SLB_ERROR_PARITY;
+                break;
+        case P9_SRR1_MC_IFETCH_SLB_MULTIHIT:
+                mce_err->error_type = MCE_ERROR_TYPE_SLB;
+                mce_err->u.slb_error_type = MCE_SLB_ERROR_MULTIHIT;
+                break;
+        case P9_SRR1_MC_IFETCH_ERAT_MULTIHIT:
+                mce_err->error_type = MCE_ERROR_TYPE_ERAT;
+                mce_err->u.erat_error_type = MCE_ERAT_ERROR_MULTIHIT;
+                break;
+        case P9_SRR1_MC_IFETCH_TLB_MULTIHIT:
+                mce_err->error_type = MCE_ERROR_TYPE_TLB;
+                mce_err->u.tlb_error_type = MCE_TLB_ERROR_MULTIHIT;
+                break;
+        case P9_SRR1_MC_IFETCH_UE_TLB_RELOAD:
+                mce_err->error_type = MCE_ERROR_TYPE_UE;
+                mce_err->u.ue_error_type = MCE_UE_ERROR_PAGE_TABLE_WALK_IFETCH;
+                break;
+        case P9_SRR1_MC_IFETCH_LINK_TIMEOUT:
+                mce_err->error_type = MCE_ERROR_TYPE_LINK;
+                mce_err->u.link_error_type = MCE_LINK_ERROR_IFETCH_TIMEOUT;
+                break;
+        case P9_SRR1_MC_IFETCH_LINK_TABLEWALK_TIMEOUT:
+                mce_err->error_type = MCE_ERROR_TYPE_LINK;
+                mce_err->u.link_error_type = MCE_LINK_ERROR_PAGE_TABLE_WALK_IFETCH_TIMEOUT;
+                break;
+        case P9_SRR1_MC_IFETCH_RA:
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_IFETCH;
+                break;
+        case P9_SRR1_MC_IFETCH_RA_TABLEWALK:
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_PAGE_TABLE_WALK_IFETCH;
+                break;
+        case P9_SRR1_MC_IFETCH_RA_ASYNC_STORE:
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_STORE;
+                break;
+        case P9_SRR1_MC_IFETCH_LINK_ASYNC_STORE_TIMEOUT:
+                mce_err->error_type = MCE_ERROR_TYPE_LINK;
+                mce_err->u.link_error_type = MCE_LINK_ERROR_STORE_TIMEOUT;
+                break;
+        case P9_SRR1_MC_IFETCH_RA_TABLEWALK_FOREIGN:
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_PAGE_TABLE_WALK_IFETCH_FOREIGN;
+                break;
+        default:
+                break;
+        }
+}
+
+long __machine_check_early_realmode_p9(struct pt_regs *regs)
+{
+        uint64_t nip, addr;
+        long handled;
+        struct mce_error_info mce_error_info = { 0 };
+
+        nip = regs->nip;
+
+        if (P9_SRR1_MC_LOADSTORE(regs->msr)) {
+                handled = mce_handle_derror_p9(regs);
+                mce_get_derror_p9(regs, &mce_error_info, &addr);
+        } else {
+                handled = mce_handle_ierror_p9(regs);
+                mce_get_ierror_p9(regs, &mce_error_info, &addr);
+        }
+
+        /* Handle UE error. */
+        if (mce_error_info.error_type == MCE_ERROR_TYPE_UE)
+                handled = mce_handle_ue_error(regs);
+
+        save_mce_event(regs, handled, &mce_error_info, nip, addr);
+        return handled;
+}
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index a3944540fe0d..1c1b44ec7642 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -168,6 +168,14 @@ static unsigned long __initdata prom_tce_alloc_start;
 static unsigned long __initdata prom_tce_alloc_end;
 #endif
 
+static bool __initdata prom_radix_disable;
+
+struct platform_support {
+        bool hash_mmu;
+        bool radix_mmu;
+        bool radix_gtse;
+};
+
 /* Platforms codes are now obsolete in the kernel. Now only used within this
  * file and ultimately gone too. Feel free to change them if you need, they
  * are not shared with anything outside of this file anymore
@@ -626,6 +634,12 @@ static void __init early_cmdline_parse(void)
                 prom_memory_limit = ALIGN(prom_memory_limit, 0x1000000);
 #endif
         }
+
+        opt = strstr(prom_cmd_line, "disable_radix");
+        if (opt) {
+                prom_debug("Radix disabled from cmdline\n");
+                prom_radix_disable = true;
+        }
 }
 
 #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_PPC_POWERNV)
@@ -695,6 +709,8 @@ struct option_vector5 {
         u8 byte22;
         u8 intarch;
         u8 mmu;
+        u8 hash_ext;
+        u8 radix_ext;
 } __packed;
 
 struct option_vector6 {
@@ -850,8 +866,9 @@ struct ibm_arch_vec __cacheline_aligned ibm_architecture_vec = {
                 .reserved3 = 0,
                 .subprocessors = 1,
                 .intarch = 0,
-                .mmu = OV5_FEAT(OV5_MMU_RADIX_300) | OV5_FEAT(OV5_MMU_HASH_300) |
-                        OV5_FEAT(OV5_MMU_PROC_TBL) | OV5_FEAT(OV5_MMU_GTSE),
+                .mmu = 0,
+                .hash_ext = 0,
+                .radix_ext = 0,
         },
 
         /* option vector 6: IBM PAPR hints */
@@ -990,6 +1007,92 @@ static int __init prom_count_smt_threads(void)
 
 }
 
+static void __init prom_parse_mmu_model(u8 val,
+                                        struct platform_support *support)
+{
+        switch (val) {
+        case OV5_FEAT(OV5_MMU_DYNAMIC):
+        case OV5_FEAT(OV5_MMU_EITHER): /* Either Available */
+                prom_debug("MMU - either supported\n");
+                support->radix_mmu = !prom_radix_disable;
+                support->hash_mmu = true;
+                break;
+        case OV5_FEAT(OV5_MMU_RADIX): /* Only Radix */
+                prom_debug("MMU - radix only\n");
+                if (prom_radix_disable) {
+                        /*
+                         * If we __have__ to do radix, we're better off ignoring
+                         * the command line rather than not booting.
+                         */
+                        prom_printf("WARNING: Ignoring cmdline option disable_radix\n");
+                }
+                support->radix_mmu = true;
+                break;
+        case OV5_FEAT(OV5_MMU_HASH):
+                prom_debug("MMU - hash only\n");
+                support->hash_mmu = true;
+                break;
+        default:
+                prom_debug("Unknown mmu support option: 0x%x\n", val);
+                break;
+        }
+}
+
+static void __init prom_parse_platform_support(u8 index, u8 val,
+                                               struct platform_support *support)
+{
+        switch (index) {
+        case OV5_INDX(OV5_MMU_SUPPORT): /* MMU Model */
+                prom_parse_mmu_model(val & OV5_FEAT(OV5_MMU_SUPPORT), support);
+                break;
+        case OV5_INDX(OV5_RADIX_GTSE): /* Radix Extensions */
+                if (val & OV5_FEAT(OV5_RADIX_GTSE)) {
+                        prom_debug("Radix - GTSE supported\n");
+                        support->radix_gtse = true;
+                }
+                break;
+        }
+}
+
+static void __init prom_check_platform_support(void)
+{
+        struct platform_support supported = {
+                .hash_mmu = false,
+                .radix_mmu = false,
+                .radix_gtse = false
+        };
+        int prop_len = prom_getproplen(prom.chosen,
+                                       "ibm,arch-vec-5-platform-support");
+        if (prop_len > 1) {
+                int i;
+                u8 vec[prop_len];
+                prom_debug("Found ibm,arch-vec-5-platform-support, len: %d\n",
+                           prop_len);
+                prom_getprop(prom.chosen, "ibm,arch-vec-5-platform-support",
+                             &vec, sizeof(vec));
+                for (i = 0; i < prop_len; i += 2) {
+                        prom_debug("%d: index = 0x%x val = 0x%x\n", i / 2
+                                                                  , vec[i]
+                                                                  , vec[i + 1]);
+                        prom_parse_platform_support(vec[i], vec[i + 1],
+                                                    &supported);
+                }
+        }
+
+        if (supported.radix_mmu && supported.radix_gtse) {
+                /* Radix preferred - but we require GTSE for now */
+                prom_debug("Asking for radix with GTSE\n");
+                ibm_architecture_vec.vec5.mmu = OV5_FEAT(OV5_MMU_RADIX);
+                ibm_architecture_vec.vec5.radix_ext = OV5_FEAT(OV5_RADIX_GTSE);
+        } else if (supported.hash_mmu) {
+                /* Default to hash mmu (if we can) */
+                prom_debug("Asking for hash\n");
+                ibm_architecture_vec.vec5.mmu = OV5_FEAT(OV5_MMU_HASH);
+        } else {
+                /* We're probably on a legacy hypervisor */
+                prom_debug("Assuming legacy hash support\n");
+        }
+}
 
 static void __init prom_send_capabilities(void)
 {
@@ -997,6 +1100,9 @@ static void __init prom_send_capabilities(void)
         prom_arg_t ret;
         u32 cores;
 
+        /* Check ibm,arch-vec-5-platform-support and fixup vec5 if required */
+        prom_check_platform_support();
+
         root = call_prom("open", 1, 1, ADDR("/"));
         if (root != 0) {
                 /* We need to tell the FW about the number of cores we support.
@@ -2993,6 +3099,11 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
          */
         prom_check_initrd(r3, r4);
 
+        /*
+         * Do early parsing of command line
+         */
+        early_cmdline_parse();
+
 #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_PPC_POWERNV)
         /*
          * On pSeries, inform the firmware about our capabilities
@@ -3009,11 +3120,6 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
                 copy_and_flush(0, kbase, 0x100, 0);
 
         /*
-         * Do early parsing of command line
-         */
-        early_cmdline_parse();
-
-        /*
          * Initialize memory management within prom_init
          */
         prom_init_mem();
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index adf2084f214b..9cfaa8b69b5f 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -408,7 +408,10 @@ static void init_cache_info(struct ppc_cache_info *info, u32 size, u32 lsize,
         info->line_size = lsize;
         info->block_size = bsize;
         info->log_block_size = __ilog2(bsize);
-        info->blocks_per_page = PAGE_SIZE / bsize;
+        if (bsize)
+                info->blocks_per_page = PAGE_SIZE / bsize;
+        else
+                info->blocks_per_page = 0;
 
         if (sets == 0)
                 info->assoc = 0xffff;
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index f3158fb16de3..8c68145ba1bd 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -601,7 +601,7 @@ int kvmppc_book3s_hv_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu,
                                                          hva, NULL, NULL);
                         if (ptep) {
                                 pte = kvmppc_read_update_linux_pte(ptep, 1);
-                                if (pte_write(pte))
+                                if (__pte_write(pte))
                                         write_ok = 1;
                         }
                         local_irq_restore(flags);
diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
index 6fca970373ee..ce6f2121fffe 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
@@ -256,7 +256,7 @@ long kvmppc_do_h_enter(struct kvm *kvm, unsigned long flags,
                 }
                 pte = kvmppc_read_update_linux_pte(ptep, writing);
                 if (pte_present(pte) && !pte_protnone(pte)) {
-                        if (writing && !pte_write(pte))
+                        if (writing && !__pte_write(pte))
                                 /* make the actual HPTE be read-only */
                                 ptel = hpte_make_readonly(ptel);
                         is_ci = pte_ci(pte);
diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
index 0e649d72fe8d..2b5e09020cfe 100644
--- a/arch/powerpc/lib/Makefile
+++ b/arch/powerpc/lib/Makefile
@@ -20,6 +20,7 @@ obj64-y	+= copypage_64.o copyuser_64.o usercopy_64.o mem_64.o hweight_64.o \
 
 obj64-$(CONFIG_SMP)     += locks.o
 obj64-$(CONFIG_ALTIVEC) += vmx-helper.o
+obj64-$(CONFIG_KPROBES_SANITY_TEST) += test_emulate_step.o
 
 obj-y                   += checksum_$(BITS).o checksum_wrappers.o
 
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index 846dba2c6360..9c542ec70c5b 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -1799,8 +1799,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 goto instr_done;
 
         case LARX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if (op.ea & (size - 1))
                         break;          /* can't handle misaligned */
                 if (!address_ok(regs, op.ea, size))
@@ -1823,8 +1821,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 goto ldst_done;
 
         case STCX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if (op.ea & (size - 1))
                         break;          /* can't handle misaligned */
                 if (!address_ok(regs, op.ea, size))
@@ -1849,8 +1845,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 goto ldst_done;
 
         case LOAD:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = read_mem(&regs->gpr[op.reg], op.ea, size, regs);
                 if (!err) {
                         if (op.type & SIGNEXT)
@@ -1862,8 +1856,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
 
 #ifdef CONFIG_PPC_FPU
         case LOAD_FP:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if (size == 4)
                         err = do_fp_load(op.reg, do_lfs, op.ea, size, regs);
                 else
@@ -1872,15 +1864,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
 #endif
 #ifdef CONFIG_ALTIVEC
         case LOAD_VMX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = do_vec_load(op.reg, do_lvx, op.ea & ~0xfUL, regs);
                 goto ldst_done;
 #endif
 #ifdef CONFIG_VSX
         case LOAD_VSX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = do_vsx_load(op.reg, do_lxvd2x, op.ea, regs);
                 goto ldst_done;
 #endif
@@ -1903,8 +1891,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 goto instr_done;
 
         case STORE:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if ((op.type & UPDATE) && size == sizeof(long) &&
                     op.reg == 1 && op.update_reg == 1 &&
                     !(regs->msr & MSR_PR) &&
@@ -1917,8 +1903,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
 
 #ifdef CONFIG_PPC_FPU
         case STORE_FP:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if (size == 4)
                         err = do_fp_store(op.reg, do_stfs, op.ea, size, regs);
                 else
@@ -1927,15 +1911,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
 #endif
 #ifdef CONFIG_ALTIVEC
         case STORE_VMX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = do_vec_store(op.reg, do_stvx, op.ea & ~0xfUL, regs);
                 goto ldst_done;
 #endif
 #ifdef CONFIG_VSX
         case STORE_VSX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = do_vsx_store(op.reg, do_stxvd2x, op.ea, regs);
                 goto ldst_done;
 #endif
diff --git a/arch/powerpc/lib/test_emulate_step.c b/arch/powerpc/lib/test_emulate_step.c
new file mode 100644
index 000000000000..2534c1447554
--- /dev/null
+++ b/arch/powerpc/lib/test_emulate_step.c
@@ -0,0 +1,434 @@
+/*
+ * Simple sanity test for emulate_step load/store instructions.
+ *
+ * Copyright IBM Corp. 2016
+ *
+ * This program is free software;  you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#define pr_fmt(fmt) "emulate_step_test: " fmt
+
+#include <linux/ptrace.h>
+#include <asm/sstep.h>
+#include <asm/ppc-opcode.h>
+
+#define IMM_L(i)                ((uintptr_t)(i) & 0xffff)
+
+/*
+ * Defined with TEST_ prefix so it does not conflict with other
+ * definitions.
+ */
+#define TEST_LD(r, base, i)     (PPC_INST_LD | ___PPC_RT(r) |           \
+                                        ___PPC_RA(base) | IMM_L(i))
+#define TEST_LWZ(r, base, i)    (PPC_INST_LWZ | ___PPC_RT(r) |          \
+                                        ___PPC_RA(base) | IMM_L(i))
+#define TEST_LWZX(t, a, b)      (PPC_INST_LWZX | ___PPC_RT(t) |         \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_STD(r, base, i)    (PPC_INST_STD | ___PPC_RS(r) |          \
+                                        ___PPC_RA(base) | ((i) & 0xfffc))
+#define TEST_LDARX(t, a, b, eh) (PPC_INST_LDARX | ___PPC_RT(t) |        \
+                                        ___PPC_RA(a) | ___PPC_RB(b) |   \
+                                        __PPC_EH(eh))
+#define TEST_STDCX(s, a, b)     (PPC_INST_STDCX | ___PPC_RS(s) |        \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_LFSX(t, a, b)      (PPC_INST_LFSX | ___PPC_RT(t) |         \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_STFSX(s, a, b)     (PPC_INST_STFSX | ___PPC_RS(s) |        \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_LFDX(t, a, b)      (PPC_INST_LFDX | ___PPC_RT(t) |         \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_STFDX(s, a, b)     (PPC_INST_STFDX | ___PPC_RS(s) |        \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_LVX(t, a, b)       (PPC_INST_LVX | ___PPC_RT(t) |          \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_STVX(s, a, b)      (PPC_INST_STVX | ___PPC_RS(s) |         \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_LXVD2X(s, a, b)    (PPC_INST_LXVD2X | VSX_XX1((s), R##a, R##b))
+#define TEST_STXVD2X(s, a, b)   (PPC_INST_STXVD2X | VSX_XX1((s), R##a, R##b))
+
+
+static void __init init_pt_regs(struct pt_regs *regs)
+{
+        static unsigned long msr;
+        static bool msr_cached;
+
+        memset(regs, 0, sizeof(struct pt_regs));
+
+        if (likely(msr_cached)) {
+                regs->msr = msr;
+                return;
+        }
+
+        asm volatile("mfmsr %0" : "=r"(regs->msr));
+
+        regs->msr |= MSR_FP;
+        regs->msr |= MSR_VEC;
+        regs->msr |= MSR_VSX;
+
+        msr = regs->msr;
+        msr_cached = true;
+}
+
+static void __init show_result(char *ins, char *result)
+{
+        pr_info("%-14s : %s\n", ins, result);
+}
+
+static void __init test_ld(void)
+{
+        struct pt_regs regs;
+        unsigned long a = 0x23;
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+        regs.gpr[3] = (unsigned long) &a;
+
+        /* ld r5, 0(r3) */
+        stepped = emulate_step(&regs, TEST_LD(5, 3, 0));
+
+        if (stepped == 1 && regs.gpr[5] == a)
+                show_result("ld", "PASS");
+        else
+                show_result("ld", "FAIL");
+}
+
+static void __init test_lwz(void)
+{
+        struct pt_regs regs;
+        unsigned int a = 0x4545;
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+        regs.gpr[3] = (unsigned long) &a;
+
+        /* lwz r5, 0(r3) */
+        stepped = emulate_step(&regs, TEST_LWZ(5, 3, 0));
+
+        if (stepped == 1 && regs.gpr[5] == a)
+                show_result("lwz", "PASS");
+        else
+                show_result("lwz", "FAIL");
+}
+
+static void __init test_lwzx(void)
+{
+        struct pt_regs regs;
+        unsigned int a[3] = {0x0, 0x0, 0x1234};
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+        regs.gpr[3] = (unsigned long) a;
+        regs.gpr[4] = 8;
+        regs.gpr[5] = 0x8765;
+
+        /* lwzx r5, r3, r4 */
+        stepped = emulate_step(&regs, TEST_LWZX(5, 3, 4));
+        if (stepped == 1 && regs.gpr[5] == a[2])
+                show_result("lwzx", "PASS");
+        else
+                show_result("lwzx", "FAIL");
+}
+
+static void __init test_std(void)
+{
+        struct pt_regs regs;
+        unsigned long a = 0x1234;
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+        regs.gpr[3] = (unsigned long) &a;
+        regs.gpr[5] = 0x5678;
+
+        /* std r5, 0(r3) */
+        stepped = emulate_step(&regs, TEST_STD(5, 3, 0));
+        if (stepped == 1 || regs.gpr[5] == a)
+                show_result("std", "PASS");
+        else
+                show_result("std", "FAIL");
+}
+
+static void __init test_ldarx_stdcx(void)
+{
+        struct pt_regs regs;
+        unsigned long a = 0x1234;
+        int stepped = -1;
+        unsigned long cr0_eq = 0x1 << 29; /* eq bit of CR0 */
+
+        init_pt_regs(&regs);
+        asm volatile("mfcr %0" : "=r"(regs.ccr));
+
+
+        /*** ldarx ***/
+
+        regs.gpr[3] = (unsigned long) &a;
+        regs.gpr[4] = 0;
+        regs.gpr[5] = 0x5678;
+
+        /* ldarx r5, r3, r4, 0 */
+        stepped = emulate_step(&regs, TEST_LDARX(5, 3, 4, 0));
+
+        /*
+         * Don't touch 'a' here. Touching 'a' can do Load/store
+         * of 'a' which result in failure of subsequent stdcx.
+         * Instead, use hardcoded value for comparison.
+         */
+        if (stepped <= 0 || regs.gpr[5] != 0x1234) {
+                show_result("ldarx / stdcx.", "FAIL (ldarx)");
+                return;
+        }
+
+
+        /*** stdcx. ***/
+
+        regs.gpr[5] = 0x9ABC;
+
+        /* stdcx. r5, r3, r4 */
+        stepped = emulate_step(&regs, TEST_STDCX(5, 3, 4));
+
+        /*
+         * Two possible scenarios that indicates successful emulation
+         * of stdcx. :
+         *  1. Reservation is active and store is performed. In this
+         *     case cr0.eq bit will be set to 1.
+         *  2. Reservation is not active and store is not performed.
+         *     In this case cr0.eq bit will be set to 0.
+         */
+        if (stepped == 1 && ((regs.gpr[5] == a && (regs.ccr & cr0_eq))
+                        || (regs.gpr[5] != a && !(regs.ccr & cr0_eq))))
+                show_result("ldarx / stdcx.", "PASS");
+        else
+                show_result("ldarx / stdcx.", "FAIL (stdcx.)");
+}
+
+#ifdef CONFIG_PPC_FPU
+static void __init test_lfsx_stfsx(void)
+{
+        struct pt_regs regs;
+        union {
+                float a;
+                int b;
+        } c;
+        int cached_b;
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+
+
+        /*** lfsx ***/
+
+        c.a = 123.45;
+        cached_b = c.b;
+
+        regs.gpr[3] = (unsigned long) &c.a;
+        regs.gpr[4] = 0;
+
+        /* lfsx frt10, r3, r4 */
+        stepped = emulate_step(&regs, TEST_LFSX(10, 3, 4));
+
+        if (stepped == 1)
+                show_result("lfsx", "PASS");
+        else
+                show_result("lfsx", "FAIL");
+
+
+        /*** stfsx ***/
+
+        c.a = 678.91;
+
+        /* stfsx frs10, r3, r4 */
+        stepped = emulate_step(&regs, TEST_STFSX(10, 3, 4));
+
+        if (stepped == 1 && c.b == cached_b)
+                show_result("stfsx", "PASS");
+        else
+                show_result("stfsx", "FAIL");
+}
+
+static void __init test_lfdx_stfdx(void)
+{
+        struct pt_regs regs;
+        union {
+                double a;
+                long b;
+        } c;
+        long cached_b;
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+
+
+        /*** lfdx ***/
+
+        c.a = 123456.78;
+        cached_b = c.b;
+
+        regs.gpr[3] = (unsigned long) &c.a;
+        regs.gpr[4] = 0;
+
+        /* lfdx frt10, r3, r4 */
+        stepped = emulate_step(&regs, TEST_LFDX(10, 3, 4));
+
+        if (stepped == 1)
+                show_result("lfdx", "PASS");
+        else
+                show_result("lfdx", "FAIL");
+
+
+        /*** stfdx ***/
+
+        c.a = 987654.32;
+
+        /* stfdx frs10, r3, r4 */
+        stepped = emulate_step(&regs, TEST_STFDX(10, 3, 4));
+
+        if (stepped == 1 && c.b == cached_b)
+                show_result("stfdx", "PASS");
+        else
+                show_result("stfdx", "FAIL");
+}
+#else
+static void __init test_lfsx_stfsx(void)
+{
+        show_result("lfsx", "SKIP (CONFIG_PPC_FPU is not set)");
+        show_result("stfsx", "SKIP (CONFIG_PPC_FPU is not set)");
+}
+
+static void __init test_lfdx_stfdx(void)
+{
+        show_result("lfdx", "SKIP (CONFIG_PPC_FPU is not set)");
+        show_result("stfdx", "SKIP (CONFIG_PPC_FPU is not set)");
+}
+#endif /* CONFIG_PPC_FPU */
+
+#ifdef CONFIG_ALTIVEC
+static void __init test_lvx_stvx(void)
+{
+        struct pt_regs regs;
+        union {
+                vector128 a;
+                u32 b[4];
+        } c;
+        u32 cached_b[4];
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+
+
+        /*** lvx ***/
+
+        cached_b[0] = c.b[0] = 923745;
+        cached_b[1] = c.b[1] = 2139478;
+        cached_b[2] = c.b[2] = 9012;
+        cached_b[3] = c.b[3] = 982134;
+
+        regs.gpr[3] = (unsigned long) &c.a;
+        regs.gpr[4] = 0;
+
+        /* lvx vrt10, r3, r4 */
+        stepped = emulate_step(&regs, TEST_LVX(10, 3, 4));
+
+        if (stepped == 1)
+                show_result("lvx", "PASS");
+        else
+                show_result("lvx", "FAIL");
+
+
+        /*** stvx ***/
+
+        c.b[0] = 4987513;
+        c.b[1] = 84313948;
+        c.b[2] = 71;
+        c.b[3] = 498532;
+
+        /* stvx vrs10, r3, r4 */
+        stepped = emulate_step(&regs, TEST_STVX(10, 3, 4));
+
+        if (stepped == 1 && cached_b[0] == c.b[0] && cached_b[1] == c.b[1] &&
+            cached_b[2] == c.b[2] && cached_b[3] == c.b[3])
+                show_result("stvx", "PASS");
+        else
+                show_result("stvx", "FAIL");
+}
+#else
+static void __init test_lvx_stvx(void)
+{
+        show_result("lvx", "SKIP (CONFIG_ALTIVEC is not set)");
+        show_result("stvx", "SKIP (CONFIG_ALTIVEC is not set)");
+}
+#endif /* CONFIG_ALTIVEC */
+
+#ifdef CONFIG_VSX
+static void __init test_lxvd2x_stxvd2x(void)
+{
+        struct pt_regs regs;
+        union {
+                vector128 a;
+                u32 b[4];
+        } c;
+        u32 cached_b[4];
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+
+
+        /*** lxvd2x ***/
+
+        cached_b[0] = c.b[0] = 18233;
+        cached_b[1] = c.b[1] = 34863571;
+        cached_b[2] = c.b[2] = 834;
+        cached_b[3] = c.b[3] = 6138911;
+
+        regs.gpr[3] = (unsigned long) &c.a;
+        regs.gpr[4] = 0;
+
+        /* lxvd2x vsr39, r3, r4 */
+        stepped = emulate_step(&regs, TEST_LXVD2X(39, 3, 4));
+
+        if (stepped == 1)
+                show_result("lxvd2x", "PASS");
+        else
+                show_result("lxvd2x", "FAIL");
+
+
+        /*** stxvd2x ***/
+
+        c.b[0] = 21379463;
+        c.b[1] = 87;
+        c.b[2] = 374234;
+        c.b[3] = 4;
+
+        /* stxvd2x vsr39, r3, r4 */
+        stepped = emulate_step(&regs, TEST_STXVD2X(39, 3, 4));
+
+        if (stepped == 1 && cached_b[0] == c.b[0] && cached_b[1] == c.b[1] &&
+            cached_b[2] == c.b[2] && cached_b[3] == c.b[3])
+                show_result("stxvd2x", "PASS");
+        else
+                show_result("stxvd2x", "FAIL");
+}
+#else
+static void __init test_lxvd2x_stxvd2x(void)
+{
+        show_result("lxvd2x", "SKIP (CONFIG_VSX is not set)");
+        show_result("stxvd2x", "SKIP (CONFIG_VSX is not set)");
+}
+#endif /* CONFIG_VSX */
+
+static int __init test_emulate_step(void)
+{
+        test_ld();
+        test_lwz();
+        test_lwzx();
+        test_std();
+        test_ldarx_stdcx();
+        test_lfsx_stfsx();
+        test_lfdx_stfdx();
+        test_lvx_stvx();
+        test_lxvd2x_stxvd2x();
+
+        return 0;
+}
+late_initcall(test_emulate_step);
diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
index 6aa3b76aa0d6..c22f207aa656 100644
--- a/arch/powerpc/mm/init_64.c
+++ b/arch/powerpc/mm/init_64.c
@@ -356,25 +356,48 @@ static void early_check_vec5(void)
         unsigned long root, chosen;
         int size;
         const u8 *vec5;
+        u8 mmu_supported;
 
         root = of_get_flat_dt_root();
         chosen = of_get_flat_dt_subnode_by_name(root, "chosen");
-        if (chosen == -FDT_ERR_NOTFOUND)
+        if (chosen == -FDT_ERR_NOTFOUND) {
+                cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX;
                 return;
+        }
         vec5 = of_get_flat_dt_prop(chosen, "ibm,architecture-vec-5", &size);
-        if (!vec5)
+        if (!vec5) {
+                cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX;
                 return;
-        if (size <= OV5_INDX(OV5_MMU_RADIX_300) ||
-            !(vec5[OV5_INDX(OV5_MMU_RADIX_300)] & OV5_FEAT(OV5_MMU_RADIX_300)))
-                /* Hypervisor doesn't support radix */
+        }
+        if (size <= OV5_INDX(OV5_MMU_SUPPORT)) {
                 cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX;
+                return;
+        }
+
+        /* Check for supported configuration */
+        mmu_supported = vec5[OV5_INDX(OV5_MMU_SUPPORT)] &
+                        OV5_FEAT(OV5_MMU_SUPPORT);
+        if (mmu_supported == OV5_FEAT(OV5_MMU_RADIX)) {
+                /* Hypervisor only supports radix - check enabled && GTSE */
+                if (!early_radix_enabled()) {
+                        pr_warn("WARNING: Ignoring cmdline option disable_radix\n");
+                }
+                if (!(vec5[OV5_INDX(OV5_RADIX_GTSE)] &
+                                                OV5_FEAT(OV5_RADIX_GTSE))) {
+                        pr_warn("WARNING: Hypervisor doesn't support RADIX with GTSE\n");
+                }
+                /* Do radix anyway - the hypervisor said we had to */
+                cur_cpu_spec->mmu_features |= MMU_FTR_TYPE_RADIX;
+        } else if (mmu_supported == OV5_FEAT(OV5_MMU_HASH)) {
+                /* Hypervisor only supports hash - disable radix */
+                cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX;
+        }
 }
 
 void __init mmu_early_init_devtree(void)
 {
         /* Disable radix mode based on kernel command line. */
-        /* We don't yet have the machinery to do radix as a guest. */
-        if (disable_radix || !(mfmsr() & MSR_HV))
+        if (disable_radix)
                 cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX;
 
         /*
@@ -383,7 +406,7 @@ void __init mmu_early_init_devtree(void)
          * even though the ibm,architecture-vec-5 property created by
          * skiboot doesn't have the necessary bits set.
          */
-        if (early_radix_enabled() && !(mfmsr() & MSR_HV))
+        if (!(mfmsr() & MSR_HV))
                 early_check_vec5();
 
         if (early_radix_enabled())
diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
index 2a590a98e652..c28165d8970b 100644
--- a/arch/powerpc/mm/pgtable-radix.c
+++ b/arch/powerpc/mm/pgtable-radix.c
@@ -186,6 +186,10 @@ static void __init radix_init_pgtable(void)
          */
         register_process_table(__pa(process_tb), 0, PRTB_SIZE_SHIFT - 12);
         pr_info("Process table %p and radix root for kernel: %p\n", process_tb, init_mm.pgd);
+        asm volatile("ptesync" : : : "memory");
+        asm volatile(PPC_TLBIE_5(%0,%1,2,1,1) : :
+                     "r" (TLBIEL_INVAL_SET_LPID), "r" (0));
+        asm volatile("eieio; tlbsync; ptesync" : : : "memory");
 }
 
 static void __init radix_init_partition_table(void)
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 595dd718ea87..2ff13249f87a 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -188,6 +188,8 @@ static inline void perf_get_data_addr(struct pt_regs *regs, u64 *addrp)
                         sdsync = POWER7P_MMCRA_SDAR_VALID;
                 else if (ppmu->flags & PPMU_ALT_SIPR)
                         sdsync = POWER6_MMCRA_SDSYNC;
+                else if (ppmu->flags & PPMU_NO_SIAR)
+                        sdsync = MMCRA_SAMPLE_ENABLE;
                 else
                         sdsync = MMCRA_SDSYNC;
 
diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
index e79fb5fb817d..cd951fd231c4 100644
--- a/arch/powerpc/perf/isa207-common.c
+++ b/arch/powerpc/perf/isa207-common.c
@@ -65,12 +65,41 @@ static bool is_event_valid(u64 event)
         return !(event & ~valid_mask);
 }
 
-static u64 mmcra_sdar_mode(u64 event)
+static inline bool is_event_marked(u64 event)
 {
-        if (cpu_has_feature(CPU_FTR_ARCH_300) && !cpu_has_feature(CPU_FTR_POWER9_DD1))
-                return p9_SDAR_MODE(event) << MMCRA_SDAR_MODE_SHIFT;
+        if (event & EVENT_IS_MARKED)
+                return true;
+
+        return false;
+}
 
-        return MMCRA_SDAR_MODE_TLB;
+static void mmcra_sdar_mode(u64 event, unsigned long *mmcra)
+{
+        /*
+         * MMCRA[SDAR_MODE] specifices how the SDAR should be updated in
+         * continous sampling mode.
+         *
+         * Incase of Power8:
+         * MMCRA[SDAR_MODE] will be programmed as "0b01" for continous sampling
+         * mode and will be un-changed when setting MMCRA[63] (Marked events).
+         *
+         * Incase of Power9:
+         * Marked event: MMCRA[SDAR_MODE] will be set to 0b00 ('No Updates'),
+         *               or if group already have any marked events.
+         * Non-Marked events (for DD1):
+         *      MMCRA[SDAR_MODE] will be set to 0b01
+         * For rest
+         *      MMCRA[SDAR_MODE] will be set from event code.
+         */
+        if (cpu_has_feature(CPU_FTR_ARCH_300)) {
+                if (is_event_marked(event) || (*mmcra & MMCRA_SAMPLE_ENABLE))
+                        *mmcra &= MMCRA_SDAR_MODE_NO_UPDATES;
+                else if (!cpu_has_feature(CPU_FTR_POWER9_DD1))
+                        *mmcra |=  p9_SDAR_MODE(event) << MMCRA_SDAR_MODE_SHIFT;
+                else if (cpu_has_feature(CPU_FTR_POWER9_DD1))
+                        *mmcra |= MMCRA_SDAR_MODE_TLB;
+        } else
+                *mmcra |= MMCRA_SDAR_MODE_TLB;
 }
 
 static u64 thresh_cmp_val(u64 value)
@@ -180,7 +209,7 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
                 value |= CNST_L1_QUAL_VAL(cache);
         }
 
-        if (event & EVENT_IS_MARKED) {
+        if (is_event_marked(event)) {
                 mask  |= CNST_SAMPLE_MASK;
                 value |= CNST_SAMPLE_VAL(event >> EVENT_SAMPLE_SHIFT);
         }
@@ -276,7 +305,7 @@ int isa207_compute_mmcr(u64 event[], int n_ev,
                 }
 
                 /* In continuous sampling mode, update SDAR on TLB miss */
-                mmcra |= mmcra_sdar_mode(event[i]);
+                mmcra_sdar_mode(event[i], &mmcra);
 
                 if (event[i] & EVENT_IS_L1) {
                         cache = event[i] >> EVENT_CACHE_SEL_SHIFT;
@@ -285,7 +314,7 @@ int isa207_compute_mmcr(u64 event[], int n_ev,
                         mmcr1 |= (cache & 1) << MMCR1_DC_QUAL_SHIFT;
                 }
 
-                if (event[i] & EVENT_IS_MARKED) {
+                if (is_event_marked(event[i])) {
                         mmcra |= MMCRA_SAMPLE_ENABLE;
 
                         val = (event[i] >> EVENT_SAMPLE_SHIFT) & EVENT_SAMPLE_MASK;
diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h
index cf9bd8990159..899210f14ee4 100644
--- a/arch/powerpc/perf/isa207-common.h
+++ b/arch/powerpc/perf/isa207-common.h
@@ -246,6 +246,7 @@
 #define MMCRA_THR_CMP_SHIFT             32
 #define MMCRA_SDAR_MODE_SHIFT           42
 #define MMCRA_SDAR_MODE_TLB             (1ull << MMCRA_SDAR_MODE_SHIFT)
+#define MMCRA_SDAR_MODE_NO_UPDATES      ~(0x3ull << MMCRA_SDAR_MODE_SHIFT)
 #define MMCRA_IFM_SHIFT                 30
 
 /* MMCR1 Threshold Compare bit constant for power9 */
diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S
index 6693f75e93d1..da8a0f7a035c 100644
--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
+++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
@@ -39,8 +39,8 @@ opal_tracepoint_refcount:
 BEGIN_FTR_SECTION;                                              \
         b       1f;                                             \
 END_FTR_SECTION(0, 1);                                          \
-        ld      r12,opal_tracepoint_refcount@toc(r2);           \
-        cmpdi   r12,0;                                          \
+        ld      r11,opal_tracepoint_refcount@toc(r2);           \
+        cmpdi   r11,0;                                          \
         bne-    LABEL;                                          \
 1:
 
diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
index 86d9fde93c17..e0f856bfbfe8 100644
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -395,7 +395,6 @@ static int opal_recover_mce(struct pt_regs *regs,
                                         struct machine_check_event *evt)
 {
         int recovered = 0;
-        uint64_t ea = get_mce_fault_addr(evt);
 
         if (!(regs->msr & MSR_RI)) {
                 /* If MSR_RI isn't set, we cannot recover */
@@ -404,26 +403,18 @@ static int opal_recover_mce(struct pt_regs *regs,
         } else if (evt->disposition == MCE_DISPOSITION_RECOVERED) {
                 /* Platform corrected itself */
                 recovered = 1;
-        } else if (ea && !is_kernel_addr(ea)) {
+        } else if (evt->severity == MCE_SEV_FATAL) {
+                /* Fatal machine check */
+                pr_err("Machine check interrupt is fatal\n");
+                recovered = 0;
+        } else if ((evt->severity == MCE_SEV_ERROR_SYNC) &&
+                        (user_mode(regs) && !is_global_init(current))) {
                 /*
-                 * Faulting address is not in kernel text. We should be fine.
-                 * We need to find which process uses this address.
                  * For now, kill the task if we have received exception when
                  * in userspace.
                  *
                  * TODO: Queue up this address for hwpoisioning later.
                  */
-                if (user_mode(regs) && !is_global_init(current)) {
-                        _exception(SIGBUS, regs, BUS_MCEERR_AR, regs->nip);
-                        recovered = 1;
-                } else
-                        recovered = 0;
-        } else if (user_mode(regs) && !is_global_init(current) &&
-                evt->severity == MCE_SEV_ERROR_SYNC) {
-                /*
-                 * If we have received a synchronous error when in userspace
-                 * kill the task.
-                 */
                 _exception(SIGBUS, regs, BUS_MCEERR_AR, regs->nip);
                 recovered = 1;
         }
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 6901a06da2f9..e36738291c32 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -1775,17 +1775,20 @@ static u64 pnv_pci_ioda_dma_get_required_mask(struct pci_dev *pdev)
 }
 
 static void pnv_ioda_setup_bus_dma(struct pnv_ioda_pe *pe,
-                                   struct pci_bus *bus)
+                                   struct pci_bus *bus,
+                                   bool add_to_group)
 {
         struct pci_dev *dev;
 
         list_for_each_entry(dev, &bus->devices, bus_list) {
                 set_iommu_table_base(&dev->dev, pe->table_group.tables[0]);
                 set_dma_offset(&dev->dev, pe->tce_bypass_base);
-                iommu_add_device(&dev->dev);
+                if (add_to_group)
+                        iommu_add_device(&dev->dev);
 
                 if ((pe->flags & PNV_IODA_PE_BUS_ALL) && dev->subordinate)
-                        pnv_ioda_setup_bus_dma(pe, dev->subordinate);
+                        pnv_ioda_setup_bus_dma(pe, dev->subordinate,
+                                        add_to_group);
         }
 }
 
@@ -2191,7 +2194,7 @@ found:
                 set_iommu_table_base(&pe->pdev->dev, tbl);
                 iommu_add_device(&pe->pdev->dev);
         } else if (pe->flags & (PNV_IODA_PE_BUS | PNV_IODA_PE_BUS_ALL))
-                pnv_ioda_setup_bus_dma(pe, pe->pbus);
+                pnv_ioda_setup_bus_dma(pe, pe->pbus, true);
 
         return;
  fail:
@@ -2426,6 +2429,8 @@ static void pnv_ioda2_take_ownership(struct iommu_table_group *table_group)
 
         pnv_pci_ioda2_set_bypass(pe, false);
         pnv_pci_ioda2_unset_window(&pe->table_group, 0);
+        if (pe->pbus)
+                pnv_ioda_setup_bus_dma(pe, pe->pbus, false);
         pnv_ioda2_table_free(tbl);
 }
 
@@ -2435,6 +2440,8 @@ static void pnv_ioda2_release_ownership(struct iommu_table_group *table_group)
                                                 table_group);
 
         pnv_pci_ioda2_setup_default_config(pe);
+        if (pe->pbus)
+                pnv_ioda_setup_bus_dma(pe, pe->pbus, false);
 }
 
 static struct iommu_table_group_ops pnv_pci_ioda2_ops = {
@@ -2624,6 +2631,9 @@ static long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
         level_shift = entries_shift + 3;
         level_shift = max_t(unsigned, level_shift, PAGE_SHIFT);
 
+        if ((level_shift - 3) * levels + page_shift >= 60)
+                return -EINVAL;
+
         /* Allocate TCE table */
         addr = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift,
                         levels, tce_table_size, &offset, &total_allocated);
@@ -2728,7 +2738,7 @@ static void pnv_pci_ioda2_setup_dma_pe(struct pnv_phb *phb,
         if (pe->flags & PNV_IODA_PE_DEV)
                 iommu_add_device(&pe->pdev->dev);
         else if (pe->flags & (PNV_IODA_PE_BUS | PNV_IODA_PE_BUS_ALL))
-                pnv_ioda_setup_bus_dma(pe, pe->pbus);
+                pnv_ioda_setup_bus_dma(pe, pe->pbus, true);
 }
 
 #ifdef CONFIG_PCI_MSI
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 251060cf1713..8b1fe895daa3 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -751,7 +751,9 @@ void __init hpte_init_pseries(void)
         mmu_hash_ops.flush_hash_range    = pSeries_lpar_flush_hash_range;
         mmu_hash_ops.hpte_clear_all      = pseries_hpte_clear_all;
         mmu_hash_ops.hugepage_invalidate = pSeries_lpar_hugepage_invalidate;
-        mmu_hash_ops.resize_hpt          = pseries_lpar_resize_hpt;
+
+        if (firmware_has_feature(FW_FEATURE_HPT_RESIZE))
+                mmu_hash_ops.resize_hpt = pseries_lpar_resize_hpt;
 }
 
 void radix_init_pseries(void)
diff --git a/arch/powerpc/purgatory/trampoline.S b/arch/powerpc/purgatory/trampoline.S
index f9760ccf4032..3696ea6c4826 100644
--- a/arch/powerpc/purgatory/trampoline.S
+++ b/arch/powerpc/purgatory/trampoline.S
@@ -116,13 +116,13 @@ dt_offset:
 
         .data
         .balign 8
-.globl sha256_digest
-sha256_digest:
+.globl purgatory_sha256_digest
+purgatory_sha256_digest:
         .skip   32
-        .size sha256_digest, . - sha256_digest
+        .size purgatory_sha256_digest, . - purgatory_sha256_digest
 
         .balign 8
-.globl sha_regions
-sha_regions:
+.globl purgatory_sha_regions
+purgatory_sha_regions:
         .skip   8 * 2 * 16
-        .size sha_regions, . - sha_regions
+        .size purgatory_sha_regions, . - purgatory_sha_regions
diff --git a/arch/powerpc/sysdev/axonram.c b/arch/powerpc/sysdev/axonram.c
index ada29eaed6e2..f523ac883150 100644
--- a/arch/powerpc/sysdev/axonram.c
+++ b/arch/powerpc/sysdev/axonram.c
@@ -274,7 +274,9 @@ failed:
                         if (bank->disk->major > 0)
                                 unregister_blkdev(bank->disk->major,
                                                 bank->disk->disk_name);
-                        del_gendisk(bank->disk);
+                        if (bank->disk->flags & GENHD_FL_UP)
+                                del_gendisk(bank->disk);
+                        put_disk(bank->disk);
                 }
                 device->dev.platform_data = NULL;
                 if (bank->io_addr != 0)
@@ -299,6 +301,7 @@ axon_ram_remove(struct platform_device *device)
         device_remove_file(&device->dev, &dev_attr_ecc);
         free_irq(bank->irq_id, device);
         del_gendisk(bank->disk);
+        put_disk(bank->disk);
         iounmap((void __iomem *) bank->io_addr);
         kfree(bank);
 
diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
index f9670eabfcfa..b53f80f0b4d8 100644
--- a/arch/powerpc/sysdev/xics/icp-opal.c
+++ b/arch/powerpc/sysdev/xics/icp-opal.c
@@ -91,6 +91,16 @@ static unsigned int icp_opal_get_irq(void)
 
 static void icp_opal_set_cpu_priority(unsigned char cppr)
 {
+        /*
+         * Here be dragons. The caller has asked to allow only IPI's and not
+         * external interrupts. But OPAL XIVE doesn't support that. So instead
+         * of allowing no interrupts allow all. That's still not right, but
+         * currently the only caller who does this is xics_migrate_irqs_away()
+         * and it works in that case.
+         */
+        if (cppr >= DEFAULT_PRIORITY)
+                cppr = LOWEST_PRIORITY;
+
         xics_set_base_cppr(cppr);
         opal_int_set_cppr(cppr);
         iosync();
diff --git a/arch/powerpc/sysdev/xics/xics-common.c b/arch/powerpc/sysdev/xics/xics-common.c
index 69d858e51ac7..23efe4e42172 100644
--- a/arch/powerpc/sysdev/xics/xics-common.c
+++ b/arch/powerpc/sysdev/xics/xics-common.c
@@ -20,6 +20,7 @@
 #include <linux/of.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
+#include <linux/delay.h>
 
 #include <asm/prom.h>
 #include <asm/io.h>
@@ -198,9 +199,6 @@ void xics_migrate_irqs_away(void)
         /* Remove ourselves from the global interrupt queue */
         xics_set_cpu_giq(xics_default_distrib_server, 0);
 
-        /* Allow IPIs again... */
-        icp_ops->set_priority(DEFAULT_PRIORITY);
-
         for_each_irq_desc(virq, desc) {
                 struct irq_chip *chip;
                 long server;
@@ -255,6 +253,19 @@ void xics_migrate_irqs_away(void)
 unlock:
                 raw_spin_unlock_irqrestore(&desc->lock, flags);
         }
+
+        /* Allow "sufficient" time to drop any inflight IRQ's */
+        mdelay(5);
+
+        /*
+         * Allow IPIs again. This is done at the very end, after migrating all
+         * interrupts, the expectation is that we'll only get woken up by an IPI
+         * interrupt beyond this point, but leave externals masked just to be
+         * safe. If we're using icp-opal this may actually allow all
+         * interrupts anyway, but that should be OK.
+         */
+        icp_ops->set_priority(DEFAULT_PRIORITY);
+
 }
 #endif /* CONFIG_HOTPLUG_CPU */
 
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index 143b1e00b818..4b176fe83da4 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -609,7 +609,7 @@ CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_UPROBE_EVENT=y
+CONFIG_UPROBE_EVENTS=y
 CONFIG_FUNCTION_PROFILER=y
 CONFIG_HIST_TRIGGERS=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index f05d2d6e1087..0de46cc397f6 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -560,7 +560,7 @@ CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_UPROBE_EVENT=y
+CONFIG_UPROBE_EVENTS=y
 CONFIG_FUNCTION_PROFILER=y
 CONFIG_HIST_TRIGGERS=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index 2358bf33c5ef..e167557b434c 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -558,7 +558,7 @@ CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_UPROBE_EVENT=y
+CONFIG_UPROBE_EVENTS=y
 CONFIG_FUNCTION_PROFILER=y
 CONFIG_HIST_TRIGGERS=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c
index d69ea495c4d7..716b17238599 100644
--- a/arch/s390/crypto/paes_s390.c
+++ b/arch/s390/crypto/paes_s390.c
@@ -474,8 +474,11 @@ static int ctr_paes_crypt(struct blkcipher_desc *desc, unsigned long modifier,
                         ret = blkcipher_walk_done(desc, walk, nbytes - n);
                 }
                 if (k < n) {
-                        if (__ctr_paes_set_key(ctx) != 0)
+                        if (__ctr_paes_set_key(ctx) != 0) {
+                                if (locked)
+                                        spin_unlock(&ctrblk_lock);
                                 return blkcipher_walk_done(desc, walk, -EIO);
+                        }
                 }
         }
         if (locked)
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 68bfd09f1b02..97189dbaf34b 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -179,7 +179,7 @@ CONFIG_FTRACE_SYSCALLS=y
 CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_UPROBE_EVENT=y
+CONFIG_UPROBE_EVENTS=y
 CONFIG_FUNCTION_PROFILER=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_KPROBES_SANITY_TEST=y
diff --git a/arch/s390/include/asm/cputime.h b/arch/s390/include/asm/cputime.h
index d1c407ddf703..9072bf63a846 100644
--- a/arch/s390/include/asm/cputime.h
+++ b/arch/s390/include/asm/cputime.h
@@ -8,31 +8,27 @@
 #define _S390_CPUTIME_H
 
 #include <linux/types.h>
-#include <asm/div64.h>
+#include <asm/timex.h>
 
 #define CPUTIME_PER_USEC 4096ULL
 #define CPUTIME_PER_SEC (CPUTIME_PER_USEC * USEC_PER_SEC)
 
 /* We want to use full resolution of the CPU timer: 2**-12 micro-seconds. */
 
-typedef unsigned long long __nocast cputime_t;
-typedef unsigned long long __nocast cputime64_t;
-
 #define cmpxchg_cputime(ptr, old, new) cmpxchg64(ptr, old, new)
 
-static inline unsigned long __div(unsigned long long n, unsigned long base)
-{
-        return n / base;
-}
-
 /*
- * Convert cputime to microseconds and back.
+ * Convert cputime to microseconds.
  */
-static inline unsigned int cputime_to_usecs(const cputime_t cputime)
+static inline u64 cputime_to_usecs(const u64 cputime)
 {
-        return (__force unsigned long long) cputime >> 12;
+        return cputime >> 12;
 }
 
+/*
+ * Convert cputime to nanoseconds.
+ */
+#define cputime_to_nsecs(cputime) tod_to_ns(cputime)
 
 u64 arch_cpu_idle_time(int cpu);
 
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 7ed1972b1920..93e37b12e882 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -24,6 +24,7 @@
  * the S390 page table tree.
  */
 #ifndef __ASSEMBLY__
+#include <asm-generic/5level-fixup.h>
 #include <linux/sched.h>
 #include <linux/mm_types.h>
 #include <linux/page-flags.h>
diff --git a/arch/s390/include/asm/sections.h b/arch/s390/include/asm/sections.h
index 5ce29fe100ba..fbd9116eb17b 100644
--- a/arch/s390/include/asm/sections.h
+++ b/arch/s390/include/asm/sections.h
@@ -4,6 +4,5 @@
 #include <asm-generic/sections.h>
 
 extern char _eshared[], _ehead[];
-extern char __start_ro_after_init[], __end_ro_after_init[];
 
 #endif
diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
index 354344dcc198..118535123f34 100644
--- a/arch/s390/include/asm/timex.h
+++ b/arch/s390/include/asm/timex.h
@@ -206,20 +206,16 @@ static inline unsigned long long get_tod_clock_monotonic(void)
  *    ns = (todval * 125) >> 9;
  *
  * In order to avoid an overflow with the multiplication we can rewrite this.
- * With a split todval == 2^32 * th + tl (th upper 32 bits, tl lower 32 bits)
+ * With a split todval == 2^9 * th + tl (th upper 55 bits, tl lower 9 bits)
  * we end up with
  *
- *    ns = ((2^32 * th + tl) * 125 ) >> 9;
- * -> ns = (2^23 * th * 125) + ((tl * 125) >> 9);
+ *    ns = ((2^9 * th + tl) * 125 ) >> 9;
+ * -> ns = (th * 125) + ((tl * 125) >> 9);
  *
  */
 static inline unsigned long long tod_to_ns(unsigned long long todval)
 {
-        unsigned long long ns;
-
-        ns = ((todval >> 32) << 23) * 125;
-        ns += ((todval & 0xffffffff) * 125) >> 9;
-        return ns;
+        return ((todval >> 9) * 125) + (((todval & 0x1ff) * 125) >> 9);
 }
 
 #endif
diff --git a/arch/s390/include/uapi/asm/unistd.h b/arch/s390/include/uapi/asm/unistd.h
index 4384bc797a54..152de9b796e1 100644
--- a/arch/s390/include/uapi/asm/unistd.h
+++ b/arch/s390/include/uapi/asm/unistd.h
@@ -313,7 +313,9 @@
 #define __NR_copy_file_range    375
 #define __NR_preadv2            376
 #define __NR_pwritev2           377
-#define NR_syscalls 378
+/* Number 378 is reserved for guarded storage */
+#define __NR_statx              379
+#define NR_syscalls 380
 
 /* 
  * There are some system calls that are not present on 64 bit, some
diff --git a/arch/s390/kernel/compat_wrapper.c b/arch/s390/kernel/compat_wrapper.c
index ae2cda5eee5a..e89cc2e71db1 100644
--- a/arch/s390/kernel/compat_wrapper.c
+++ b/arch/s390/kernel/compat_wrapper.c
@@ -178,3 +178,4 @@ COMPAT_SYSCALL_WRAP3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
 COMPAT_SYSCALL_WRAP6(sendto, int, fd, void __user *, buff, size_t, len, unsigned int, flags, struct sockaddr __user *, addr, int, addr_len);
 COMPAT_SYSCALL_WRAP3(mlock2, unsigned long, start, size_t, len, int, flags);
 COMPAT_SYSCALL_WRAP6(copy_file_range, int, fd_in, loff_t __user *, off_in, int, fd_out, loff_t __user *, off_out, size_t, len, unsigned int, flags);
+COMPAT_SYSCALL_WRAP5(statx, int, dfd, const char __user *, path, unsigned, flags, unsigned, mask, struct statx __user *, buffer);
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index dff2152350a7..6a7d737d514c 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -490,7 +490,7 @@ ENTRY(pgm_check_handler)
         jnz     .Lpgm_svcper            # -> single stepped svc
 1:      CHECK_STACK STACK_SIZE,__LC_SAVE_AREA_SYNC
         aghi    %r15,-(STACK_FRAME_OVERHEAD + __PT_SIZE)
-        j       3f
+        j       4f
 2:      UPDATE_VTIME %r14,%r15,__LC_SYNC_ENTER_TIMER
         lg      %r15,__LC_KERNEL_STACK
         lgr     %r14,%r12
@@ -499,8 +499,8 @@ ENTRY(pgm_check_handler)
         tm      __LC_PGM_ILC+2,0x02     # check for transaction abort
         jz      3f
         mvc     __THREAD_trap_tdb(256,%r14),0(%r13)
-3:      la      %r11,STACK_FRAME_OVERHEAD(%r15)
-        stg     %r10,__THREAD_last_break(%r14)
+3:      stg     %r10,__THREAD_last_break(%r14)
+4:      la      %r11,STACK_FRAME_OVERHEAD(%r15)
         stmg    %r0,%r7,__PT_R0(%r11)
         mvc     __PT_R8(64,%r11),__LC_SAVE_AREA_SYNC
         stmg    %r8,%r9,__PT_PSW(%r11)
@@ -509,14 +509,14 @@ ENTRY(pgm_check_handler)
         xc      __PT_FLAGS(8,%r11),__PT_FLAGS(%r11)
         stg     %r10,__PT_ARGS(%r11)
         tm      __LC_PGM_ILC+3,0x80     # check for per exception
-        jz      4f
+        jz      5f
         tmhh    %r8,0x0001              # kernel per event ?
         jz      .Lpgm_kprobe
         oi      __PT_FLAGS+7(%r11),_PIF_PER_TRAP
         mvc     __THREAD_per_address(8,%r14),__LC_PER_ADDRESS
         mvc     __THREAD_per_cause(2,%r14),__LC_PER_CODE
         mvc     __THREAD_per_paid(1,%r14),__LC_PER_ACCESS_ID
-4:      REENABLE_IRQS
+5:      REENABLE_IRQS
         xc      __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
         larl    %r1,pgm_check_table
         llgh    %r10,__PT_INT_CODE+2(%r11)
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index b67dafb7b7cf..e545ffe5155a 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -564,6 +564,8 @@ static struct kset *ipl_kset;
 
 static void __ipl_run(void *unused)
 {
+        if (MACHINE_IS_LPAR && ipl_info.type == IPL_TYPE_CCW)
+                diag308(DIAG308_LOAD_NORMAL_DUMP, NULL);
         diag308(DIAG308_LOAD_CLEAR, NULL);
         if (MACHINE_IS_VM)
                 __cpcmd("IPL", NULL, 0, NULL);
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 20cd339e11ae..f29e41c5e2ec 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -124,7 +124,10 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long new_stackp,
         clear_tsk_thread_flag(p, TIF_SINGLE_STEP);
         /* Initialize per thread user and system timer values */
         p->thread.user_timer = 0;
+        p->thread.guest_timer = 0;
         p->thread.system_timer = 0;
+        p->thread.hardirq_timer = 0;
+        p->thread.softirq_timer = 0;
 
         frame->sf.back_chain = 0;
         /* new return point is ret_from_fork */
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index 9b59e6212d8f..2659b5cfeddb 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -386,3 +386,5 @@ SYSCALL(sys_mlock2,compat_sys_mlock2)
 SYSCALL(sys_copy_file_range,compat_sys_copy_file_range) /* 375 */
 SYSCALL(sys_preadv2,compat_sys_preadv2)
 SYSCALL(sys_pwritev2,compat_sys_pwritev2)
+NI_SYSCALL
+SYSCALL(sys_statx,compat_sys_statx)
diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
index 5ccf95396251..72307f108c40 100644
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -63,11 +63,9 @@ SECTIONS
 
         . = ALIGN(PAGE_SIZE);
         __start_ro_after_init = .;
-        __start_data_ro_after_init = .;
         .data..ro_after_init : {
                  *(.data..ro_after_init)
         }
-        __end_data_ro_after_init = .;
         EXCEPTION_TABLE(16)
         . = ALIGN(PAGE_SIZE);
         __end_ro_after_init = .;
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index c14fc9029912..072d84ba42a3 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -111,7 +111,7 @@ static inline u64 scale_vtime(u64 vtime)
 }
 
 static void account_system_index_scaled(struct task_struct *p,
-                                        cputime_t cputime, cputime_t scaled,
+                                        u64 cputime, u64 scaled,
                                         enum cpu_usage_stat index)
 {
         p->stimescaled += cputime_to_nsecs(scaled);
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index b48dc5f1900b..463e5ef02304 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -608,12 +608,29 @@ void ptep_zap_key(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 bool test_and_clear_guest_dirty(struct mm_struct *mm, unsigned long addr)
 {
         spinlock_t *ptl;
+        pgd_t *pgd;
+        pud_t *pud;
+        pmd_t *pmd;
         pgste_t pgste;
         pte_t *ptep;
         pte_t pte;
         bool dirty;
 
-        ptep = get_locked_pte(mm, addr, &ptl);
+        pgd = pgd_offset(mm, addr);
+        pud = pud_alloc(mm, pgd, addr);
+        if (!pud)
+                return false;
+        pmd = pmd_alloc(mm, pud, addr);
+        if (!pmd)
+                return false;
+        /* We can't run guests backed by huge pages, but userspace can
+         * still set them up and then try to migrate them without any
+         * migration support.
+         */
+        if (pmd_large(*pmd))
+                return true;
+
+        ptep = pte_alloc_map_lock(mm, pmd, addr, &ptl);
         if (unlikely(!ptep))
                 return false;
 
diff --git a/arch/score/include/asm/pgtable.h b/arch/score/include/asm/pgtable.h
index 0553e5cd5985..46ff8fd678a7 100644
--- a/arch/score/include/asm/pgtable.h
+++ b/arch/score/include/asm/pgtable.h
@@ -2,6 +2,7 @@
 #define _ASM_SCORE_PGTABLE_H
 
 #include <linux/const.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #include <asm/fixmap.h>
diff --git a/arch/score/kernel/traps.c b/arch/score/kernel/traps.c
index e359ec675869..12daf45369b4 100644
--- a/arch/score/kernel/traps.c
+++ b/arch/score/kernel/traps.c
@@ -24,6 +24,7 @@
  */
 
 #include <linux/extable.h>
+#include <linux/ptrace.h>
 #include <linux/sched/mm.h>
 #include <linux/sched/signal.h>
 #include <linux/sched/debug.h>
diff --git a/arch/score/mm/extable.c b/arch/score/mm/extable.c
index ec871355fc2d..6736a3ad6286 100644
--- a/arch/score/mm/extable.c
+++ b/arch/score/mm/extable.c
@@ -24,6 +24,8 @@
  */
 
 #include <linux/extable.h>
+#include <linux/ptrace.h>
+#include <asm/extable.h>
 
 int fixup_exception(struct pt_regs *regs)
 {
diff --git a/arch/sh/boards/mach-cayman/setup.c b/arch/sh/boards/mach-cayman/setup.c
index 340fd40b381d..9c292c27e0d7 100644
--- a/arch/sh/boards/mach-cayman/setup.c
+++ b/arch/sh/boards/mach-cayman/setup.c
@@ -128,7 +128,6 @@ static int __init smsc_superio_setup(void)
         SMSC_SUPERIO_WRITE_INDEXED(1, SMSC_PRIMARY_INT_INDEX);
         SMSC_SUPERIO_WRITE_INDEXED(12, SMSC_SECONDARY_INT_INDEX);
 
-#ifdef CONFIG_IDE
         /*
          * Only IDE1 exists on the Cayman
          */
@@ -158,7 +157,6 @@ static int __init smsc_superio_setup(void)
         SMSC_SUPERIO_WRITE_INDEXED(0x01, 0xc5); /* GP45 = IDE1_IRQ */
         SMSC_SUPERIO_WRITE_INDEXED(0x00, 0xc6); /* GP46 = nIOROP */
         SMSC_SUPERIO_WRITE_INDEXED(0x00, 0xc7); /* GP47 = nIOWOP */
-#endif
 
         /* Exit the configuration state */
         outb(SMSC_EXIT_CONFIG_KEY, SMSC_CONFIG_PORT_ADDR);
diff --git a/arch/sh/include/asm/pgtable-2level.h b/arch/sh/include/asm/pgtable-2level.h
index 19bd89db17e7..f75cf4387257 100644
--- a/arch/sh/include/asm/pgtable-2level.h
+++ b/arch/sh/include/asm/pgtable-2level.h
@@ -1,6 +1,7 @@
 #ifndef __ASM_SH_PGTABLE_2LEVEL_H
 #define __ASM_SH_PGTABLE_2LEVEL_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 /*
diff --git a/arch/sh/include/asm/pgtable-3level.h b/arch/sh/include/asm/pgtable-3level.h
index 249a985d9648..9b1e776eca31 100644
--- a/arch/sh/include/asm/pgtable-3level.h
+++ b/arch/sh/include/asm/pgtable-3level.h
@@ -1,6 +1,7 @@
 #ifndef __ASM_SH_PGTABLE_3LEVEL_H
 #define __ASM_SH_PGTABLE_3LEVEL_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 
 /*
diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
index 56e49c8f770d..8a598528ec1f 100644
--- a/arch/sparc/include/asm/pgtable_64.h
+++ b/arch/sparc/include/asm/pgtable_64.h
@@ -12,6 +12,7 @@
  * the SpitFire page tables.
  */
 
+#include <asm-generic/5level-fixup.h>
 #include <linux/compiler.h>
 #include <linux/const.h>
 #include <asm/types.h>
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index df9e731a76f5..fc5124ccdb53 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -351,7 +351,7 @@ static int genregs64_set(struct task_struct *target,
         }
 
         if (!ret) {
-                unsigned long y;
+                unsigned long y = regs->y;
 
                 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                          &y,
diff --git a/arch/tile/include/asm/pgtable_32.h b/arch/tile/include/asm/pgtable_32.h
index d26a42279036..5f8c615cb5e9 100644
--- a/arch/tile/include/asm/pgtable_32.h
+++ b/arch/tile/include/asm/pgtable_32.h
@@ -74,6 +74,7 @@ extern unsigned long VMALLOC_RESERVE /* = CONFIG_VMALLOC_RESERVE */;
 #define MAXMEM          (_VMALLOC_START - PAGE_OFFSET)
 
 /* We have no pmd or pud since we are strictly a two-level page table */
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 static inline int pud_huge_page(pud_t pud)      { return 0; }
diff --git a/arch/tile/include/asm/pgtable_64.h b/arch/tile/include/asm/pgtable_64.h
index e96cec52f6d8..96fe58b45118 100644
--- a/arch/tile/include/asm/pgtable_64.h
+++ b/arch/tile/include/asm/pgtable_64.h
@@ -59,6 +59,7 @@
 #ifndef __ASSEMBLY__
 
 /* We have no pud since we are a three-level page table. */
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 
 /*
diff --git a/arch/um/include/asm/pgtable-2level.h b/arch/um/include/asm/pgtable-2level.h
index cfbe59752469..179c0ea87a0c 100644
--- a/arch/um/include/asm/pgtable-2level.h
+++ b/arch/um/include/asm/pgtable-2level.h
@@ -8,6 +8,7 @@
 #ifndef __UM_PGTABLE_2LEVEL_H
 #define __UM_PGTABLE_2LEVEL_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 /* PGDIR_SHIFT determines what a third-level page table entry can map */
diff --git a/arch/um/include/asm/pgtable-3level.h b/arch/um/include/asm/pgtable-3level.h
index bae8523a162f..c4d876dfb9ac 100644
--- a/arch/um/include/asm/pgtable-3level.h
+++ b/arch/um/include/asm/pgtable-3level.h
@@ -7,6 +7,7 @@
 #ifndef __UM_PGTABLE_3LEVEL_H
 #define __UM_PGTABLE_3LEVEL_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 
 /* PGDIR_SHIFT determines what a third-level page table entry can map */
diff --git a/arch/unicore32/include/asm/pgtable.h b/arch/unicore32/include/asm/pgtable.h
index 818d0f5598e3..a4f2bef37e70 100644
--- a/arch/unicore32/include/asm/pgtable.h
+++ b/arch/unicore32/include/asm/pgtable.h
@@ -12,6 +12,7 @@
 #ifndef __UNICORE_PGTABLE_H__
 #define __UNICORE_PGTABLE_H__
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 #include <asm/cpu-single.h>
 
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 2d449337a360..a94a4d10f2df 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -120,10 +120,6 @@ else
         # -funit-at-a-time shrinks the kernel .text considerably
         # unfortunately it makes reading oopses harder.
         KBUILD_CFLAGS += $(call cc-option,-funit-at-a-time)
-
-        # this works around some issues with generating unwind tables in older gccs
-        # newer gccs do it by default
-        KBUILD_CFLAGS += $(call cc-option,-maccumulate-outgoing-args)
 endif
 
 ifdef CONFIG_X86_X32
@@ -147,6 +143,37 @@ ifeq ($(CONFIG_KMEMCHECK),y)
         KBUILD_CFLAGS += $(call cc-option,-fno-builtin-memcpy)
 endif
 
+#
+# If the function graph tracer is used with mcount instead of fentry,
+# '-maccumulate-outgoing-args' is needed to prevent a GCC bug
+# (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=42109)
+#
+ifdef CONFIG_FUNCTION_GRAPH_TRACER
+  ifndef CONFIG_HAVE_FENTRY
+        ACCUMULATE_OUTGOING_ARGS := 1
+  else
+    ifeq ($(call cc-option-yn, -mfentry), n)
+        ACCUMULATE_OUTGOING_ARGS := 1
+    endif
+  endif
+endif
+
+#
+# Jump labels need '-maccumulate-outgoing-args' for gcc < 4.5.2 to prevent a
+# GCC bug (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=46226).  There's no way
+# to test for this bug at compile-time because the test case needs to execute,
+# which is a no-go for cross compilers.  So check the GCC version instead.
+#
+ifdef CONFIG_JUMP_LABEL
+  ifneq ($(ACCUMULATE_OUTGOING_ARGS), 1)
+        ACCUMULATE_OUTGOING_ARGS = $(call cc-if-fullversion, -lt, 040502, 1)
+  endif
+endif
+
+ifeq ($(ACCUMULATE_OUTGOING_ARGS), 1)
+        KBUILD_CFLAGS += -maccumulate-outgoing-args
+endif
+
 # Stackpointer is addressed different for 32 bit and 64 bit x86
 sp-$(CONFIG_X86_32) := esp
 sp-$(CONFIG_X86_64) := rsp
diff --git a/arch/x86/Makefile_32.cpu b/arch/x86/Makefile_32.cpu
index 6647ed49c66c..a45eb15b7cf2 100644
--- a/arch/x86/Makefile_32.cpu
+++ b/arch/x86/Makefile_32.cpu
@@ -45,24 +45,6 @@ cflags-$(CONFIG_MGEODE_LX)	+= $(call cc-option,-march=geode,-march=pentium-mmx)
 # cpu entries
 cflags-$(CONFIG_X86_GENERIC)    += $(call tune,generic,$(call tune,i686))
 
-# Work around the pentium-mmx code generator madness of gcc4.4.x which
-# does stack alignment by generating horrible code _before_ the mcount
-# prologue (push %ebp, mov %esp, %ebp) which breaks the function graph
-# tracer assumptions. For i686, generic, core2 this is set by the
-# compiler anyway
-ifeq ($(CONFIG_FUNCTION_GRAPH_TRACER), y)
-ADD_ACCUMULATE_OUTGOING_ARGS := y
-endif
-
-# Work around to a bug with asm goto with first implementations of it
-# in gcc causing gcc to mess up the push and pop of the stack in some
-# uses of asm goto.
-ifeq ($(CONFIG_JUMP_LABEL), y)
-ADD_ACCUMULATE_OUTGOING_ARGS := y
-endif
-
-cflags-$(ADD_ACCUMULATE_OUTGOING_ARGS) += $(call cc-option,-maccumulate-outgoing-args)
-
 # Bug fix for binutils: this option is required in order to keep
 # binutils from generating NOPL instructions against our will.
 ifneq ($(CONFIG_X86_P6_NOP),y)
diff --git a/arch/x86/boot/compressed/error.c b/arch/x86/boot/compressed/error.c
index 6248740b68b5..31922023de49 100644
--- a/arch/x86/boot/compressed/error.c
+++ b/arch/x86/boot/compressed/error.c
@@ -4,6 +4,7 @@
  * memcpy() and memmove() are defined for the compressed boot environment.
  */
 #include "misc.h"
+#include "error.h"
 
 void warn(char *m)
 {
diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
index 7ef4a099defc..6205d3b81e6d 100644
--- a/arch/x86/configs/x86_64_defconfig
+++ b/arch/x86/configs/x86_64_defconfig
@@ -176,6 +176,7 @@ CONFIG_E1000E=y
 CONFIG_SKY2=y
 CONFIG_FORCEDETH=y
 CONFIG_8139TOO=y
+CONFIG_R8169=y
 CONFIG_FDDI=y
 CONFIG_INPUT_POLLDEV=y
 # CONFIG_INPUT_MOUSEDEV_PSAUX is not set
diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
index afb222b63cae..c84584bb9402 100644
--- a/arch/x86/events/amd/core.c
+++ b/arch/x86/events/amd/core.c
@@ -604,7 +604,7 @@ amd_get_event_constraints_f15h(struct cpu_hw_events *cpuc, int idx,
                         return &amd_f15_PMC20;
                 }
         case AMD_EVENT_NB:
-                /* moved to perf_event_amd_uncore.c */
+                /* moved to uncore.c */
                 return &emptyconstraint;
         default:
                 return &emptyconstraint;
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 349d4d17aa7f..580b60f5ac83 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2101,8 +2101,8 @@ static int x86_pmu_event_init(struct perf_event *event)
 
 static void refresh_pce(void *ignored)
 {
-        if (current->mm)
-                load_mm_cr4(current->mm);
+        if (current->active_mm)
+                load_mm_cr4(current->active_mm);
 }
 
 static void x86_pmu_event_mapped(struct perf_event *event)
@@ -2110,6 +2110,18 @@ static void x86_pmu_event_mapped(struct perf_event *event)
         if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
                 return;
 
+        /*
+         * This function relies on not being called concurrently in two
+         * tasks in the same mm.  Otherwise one task could observe
+         * perf_rdpmc_allowed > 1 and return all the way back to
+         * userspace with CR4.PCE clear while another task is still
+         * doing on_each_cpu_mask() to propagate CR4.PCE.
+         *
+         * For now, this can't happen because all callers hold mmap_sem
+         * for write.  If this changes, we'll need a different solution.
+         */
+        lockdep_assert_held_exclusive(&current->mm->mmap_sem);
+
         if (atomic_inc_return(&current->mm->context.perf_rdpmc_allowed) == 1)
                 on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
 }
@@ -2244,6 +2256,7 @@ void arch_perf_update_userpage(struct perf_event *event,
                                struct perf_event_mmap_page *userpg, u64 now)
 {
         struct cyc2ns_data *data;
+        u64 offset;
 
         userpg->cap_user_time = 0;
         userpg->cap_user_time_zero = 0;
@@ -2251,11 +2264,13 @@ void arch_perf_update_userpage(struct perf_event *event,
                 !!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED);
         userpg->pmc_width = x86_pmu.cntval_bits;
 
-        if (!sched_clock_stable())
+        if (!using_native_sched_clock() || !sched_clock_stable())
                 return;
 
         data = cyc2ns_read_begin();
 
+        offset = data->cyc2ns_offset + __sched_clock_offset;
+
         /*
          * Internal timekeeping for enabled/running/stopped times
          * is always in the local_clock domain.
@@ -2263,7 +2278,7 @@ void arch_perf_update_userpage(struct perf_event *event,
         userpg->cap_user_time = 1;
         userpg->time_mult = data->cyc2ns_mul;
         userpg->time_shift = data->cyc2ns_shift;
-        userpg->time_offset = data->cyc2ns_offset - now;
+        userpg->time_offset = offset - now;
 
         /*
          * cap_user_time_zero doesn't make sense when we're using a different
@@ -2271,7 +2286,7 @@ void arch_perf_update_userpage(struct perf_event *event,
          */
         if (!event->attr.use_clockid) {
                 userpg->cap_user_time_zero = 1;
-                userpg->time_zero = data->cyc2ns_offset;
+                userpg->time_zero = offset;
         }
 
         cyc2ns_read_end(data);
diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
index aff4b5b69d40..238ae3248ba5 100644
--- a/arch/x86/events/intel/cstate.c
+++ b/arch/x86/events/intel/cstate.c
@@ -1,5 +1,5 @@
 /*
- * perf_event_intel_cstate.c: support cstate residency counters
+ * Support cstate residency counters
  *
  * Copyright (C) 2015, Intel Corp.
  * Author: Kan Liang (kan.liang@intel.com)
diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
index 22054ca49026..9d05c7e67f60 100644
--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -1,5 +1,5 @@
 /*
- * perf_event_intel_rapl.c: support Intel RAPL energy consumption counters
+ * Support Intel RAPL energy consumption counters
  * Copyright (C) 2013 Google, Inc., Stephane Eranian
  *
  * Intel RAPL interface is specified in the IA-32 Manual Vol3b
diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
index ad986c1e29bc..df5989f27b1b 100644
--- a/arch/x86/events/intel/uncore.h
+++ b/arch/x86/events/intel/uncore.h
@@ -360,7 +360,7 @@ extern struct list_head pci2phy_map_head;
 extern struct pci_extra_dev *uncore_extra_pci_dev;
 extern struct event_constraint uncore_constraint_empty;
 
-/* perf_event_intel_uncore_snb.c */
+/* uncore_snb.c */
 int snb_uncore_pci_init(void);
 int ivb_uncore_pci_init(void);
 int hsw_uncore_pci_init(void);
@@ -371,7 +371,7 @@ void nhm_uncore_cpu_init(void);
 void skl_uncore_cpu_init(void);
 int snb_pci2phy_map_init(int devid);
 
-/* perf_event_intel_uncore_snbep.c */
+/* uncore_snbep.c */
 int snbep_uncore_pci_init(void);
 void snbep_uncore_cpu_init(void);
 int ivbep_uncore_pci_init(void);
@@ -385,5 +385,5 @@ void knl_uncore_cpu_init(void);
 int skx_uncore_pci_init(void);
 void skx_uncore_cpu_init(void);
 
-/* perf_event_intel_uncore_nhmex.c */
+/* uncore_nhmex.c */
 void nhmex_uncore_cpu_init(void);
diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
index db64baf0e500..8bef70e7f3cc 100644
--- a/arch/x86/hyperv/hv_init.c
+++ b/arch/x86/hyperv/hv_init.c
@@ -158,13 +158,13 @@ void hyperv_init(void)
                 clocksource_register_hz(&hyperv_cs_tsc, NSEC_PER_SEC/100);
                 return;
         }
+register_msr_cs:
 #endif
         /*
          * For 32 bit guests just use the MSR based mechanism for reading
          * the partition counter.
          */
 
-register_msr_cs:
         hyperv_cs = &hyperv_cs_msr;
         if (ms_hyperv.features & HV_X64_MSR_TIME_REF_COUNT_AVAILABLE)
                 clocksource_register_hz(&hyperv_cs_msr, NSEC_PER_SEC/100);
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index 4e7772387c6e..b04bb6dfed7f 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -289,7 +289,8 @@
 #define X86_FEATURE_PKU         (16*32+ 3) /* Protection Keys for Userspace */
 #define X86_FEATURE_OSPKE       (16*32+ 4) /* OS Protection Keys Enable */
 #define X86_FEATURE_AVX512_VPOPCNTDQ (16*32+14) /* POPCNT for vectors of DW/QW */
-#define X86_FEATURE_RDPID       (16*32+ 22) /* RDPID instruction */
+#define X86_FEATURE_LA57        (16*32+16) /* 5-level page tables */
+#define X86_FEATURE_RDPID       (16*32+22) /* RDPID instruction */
 
 /* AMD-defined CPU features, CPUID level 0x80000007 (ebx), word 17 */
 #define X86_FEATURE_OVERFLOW_RECOV (17*32+0) /* MCA overflow recovery support */
diff --git a/arch/x86/include/asm/kvm_page_track.h b/arch/x86/include/asm/kvm_page_track.h
index d74747b031ec..c4eda791f877 100644
--- a/arch/x86/include/asm/kvm_page_track.h
+++ b/arch/x86/include/asm/kvm_page_track.h
@@ -46,6 +46,7 @@ struct kvm_page_track_notifier_node {
 };
 
 void kvm_page_track_init(struct kvm *kvm);
+void kvm_page_track_cleanup(struct kvm *kvm);
 
 void kvm_page_track_free_memslot(struct kvm_memory_slot *free,
                                  struct kvm_memory_slot *dont);
diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
index 72277b1028a5..50d35e3185f5 100644
--- a/arch/x86/include/asm/pgtable-3level.h
+++ b/arch/x86/include/asm/pgtable-3level.h
@@ -121,12 +121,9 @@ static inline void native_pmd_clear(pmd_t *pmd)
         *(tmp + 1) = 0;
 }
 
-#if !defined(CONFIG_SMP) || (defined(CONFIG_HIGHMEM64G) && \
-                defined(CONFIG_PARAVIRT))
 static inline void native_pud_clear(pud_t *pudp)
 {
 }
-#endif
 
 static inline void pud_clear(pud_t *pudp)
 {
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 1cfb36b8c024..585ee0d42d18 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -62,7 +62,7 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
 # define set_pud(pudp, pud)             native_set_pud(pudp, pud)
 #endif
 
-#ifndef __PAGETABLE_PMD_FOLDED
+#ifndef __PAGETABLE_PUD_FOLDED
 #define pud_clear(pud)                  native_pud_clear(pud)
 #endif
 
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index 8b4de22d6429..62484333673d 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -273,6 +273,8 @@ static inline pgdval_t pgd_flags(pgd_t pgd)
 }
 
 #if CONFIG_PGTABLE_LEVELS > 3
+#include <asm-generic/5level-fixup.h>
+
 typedef struct { pudval_t pud; } pud_t;
 
 static inline pud_t native_make_pud(pmdval_t val)
@@ -285,6 +287,7 @@ static inline pudval_t native_pud_val(pud_t pud)
         return pud.pud;
 }
 #else
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 
 static inline pudval_t native_pud_val(pud_t pud)
@@ -306,6 +309,7 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
         return pmd.pmd;
 }
 #else
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 static inline pmdval_t native_pmd_val(pmd_t pmd)
diff --git a/arch/x86/include/asm/pkeys.h b/arch/x86/include/asm/pkeys.h
index 34684adb6899..b3b09b98896d 100644
--- a/arch/x86/include/asm/pkeys.h
+++ b/arch/x86/include/asm/pkeys.h
@@ -46,6 +46,15 @@ extern int __arch_set_user_pkey_access(struct task_struct *tsk, int pkey,
 static inline
 bool mm_pkey_is_allocated(struct mm_struct *mm, int pkey)
 {
+        /*
+         * "Allocated" pkeys are those that have been returned
+         * from pkey_alloc().  pkey 0 is special, and never
+         * returned from pkey_alloc().
+         */
+        if (pkey <= 0)
+                return false;
+        if (pkey >= arch_max_pkey())
+                return false;
         return mm_pkey_allocation_map(mm) & (1U << pkey);
 }
 
@@ -82,12 +91,6 @@ int mm_pkey_alloc(struct mm_struct *mm)
 static inline
 int mm_pkey_free(struct mm_struct *mm, int pkey)
 {
-        /*
-         * pkey 0 is special, always allocated and can never
-         * be freed.
-         */
-        if (!pkey)
-                return -EINVAL;
         if (!mm_pkey_is_allocated(mm, pkey))
                 return -EINVAL;
 
diff --git a/arch/x86/include/asm/purgatory.h b/arch/x86/include/asm/purgatory.h
new file mode 100644
index 000000000000..d7da2729903d
--- /dev/null
+++ b/arch/x86/include/asm/purgatory.h
@@ -0,0 +1,20 @@
+#ifndef _ASM_X86_PURGATORY_H
+#define _ASM_X86_PURGATORY_H
+
+#ifndef __ASSEMBLY__
+#include <linux/purgatory.h>
+
+extern void purgatory(void);
+/*
+ * These forward declarations serve two purposes:
+ *
+ * 1) Make sparse happy when checking arch/purgatory
+ * 2) Document that these are required to be global so the symbol
+ *    lookup in kexec works
+ */
+extern unsigned long purgatory_backup_dest;
+extern unsigned long purgatory_backup_src;
+extern unsigned long purgatory_backup_sz;
+#endif  /* __ASSEMBLY__ */
+
+#endif /* _ASM_PURGATORY_H */
diff --git a/arch/x86/include/asm/timer.h b/arch/x86/include/asm/timer.h
index a04eabd43d06..27e9f9d769b8 100644
--- a/arch/x86/include/asm/timer.h
+++ b/arch/x86/include/asm/timer.h
@@ -12,6 +12,8 @@ extern int recalibrate_cpu_khz(void);
 
 extern int no_timer_check;
 
+extern bool using_native_sched_clock(void);
+
 /*
  * We use the full linear equation: f(x) = a + b*x, in order to allow
  * a continuous function in the face of dynamic freq changes.
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 6fa85944af83..fc5abff9b7fd 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -188,7 +188,7 @@ static inline void __native_flush_tlb_single(unsigned long addr)
 
 static inline void __flush_tlb_all(void)
 {
-        if (static_cpu_has(X86_FEATURE_PGE))
+        if (boot_cpu_has(X86_FEATURE_PGE))
                 __flush_tlb_global();
         else
                 __flush_tlb();
diff --git a/arch/x86/include/asm/uv/uv_hub.h b/arch/x86/include/asm/uv/uv_hub.h
index 72e8300b1e8a..9cffb44a3cf5 100644
--- a/arch/x86/include/asm/uv/uv_hub.h
+++ b/arch/x86/include/asm/uv/uv_hub.h
@@ -485,15 +485,17 @@ static inline unsigned long uv_soc_phys_ram_to_gpa(unsigned long paddr)
 
         if (paddr < uv_hub_info->lowmem_remap_top)
                 paddr |= uv_hub_info->lowmem_remap_base;
-        paddr |= uv_hub_info->gnode_upper;
-        if (m_val)
+
+        if (m_val) {
+                paddr |= uv_hub_info->gnode_upper;
                 paddr = ((paddr << uv_hub_info->m_shift)
                                                 >> uv_hub_info->m_shift) |
                         ((paddr >> uv_hub_info->m_val)
                                                 << uv_hub_info->n_lshift);
-        else
+        } else {
                 paddr |= uv_soc_phys_ram_to_nasid(paddr)
                                                 << uv_hub_info->gpa_shift;
+        }
         return paddr;
 }
 
diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
index 5138dacf8bb8..07244ea16765 100644
--- a/arch/x86/include/uapi/asm/bootparam.h
+++ b/arch/x86/include/uapi/asm/bootparam.h
@@ -58,7 +58,7 @@ struct setup_header {
         __u32   header;
         __u16   version;
         __u32   realmode_swtch;
-        __u16   start_sys;
+        __u16   start_sys_seg;
         __u16   kernel_version;
         __u8    type_of_loader;
         __u8    loadflags;
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index ae32838cac5f..b2879cc23db4 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -179,10 +179,15 @@ static int acpi_register_lapic(int id, u32 acpiid, u8 enabled)
                 return -EINVAL;
         }
 
+        if (!enabled) {
+                ++disabled_cpus;
+                return -EINVAL;
+        }
+
         if (boot_cpu_physical_apicid != -1U)
                 ver = boot_cpu_apic_version;
 
-        cpu = __generic_processor_info(id, ver, enabled);
+        cpu = generic_processor_info(id, ver);
         if (cpu >= 0)
                 early_per_cpu(x86_cpu_to_acpiid, cpu) = acpiid;
 
@@ -710,7 +715,7 @@ static void __init acpi_set_irq_model_ioapic(void)
 #ifdef CONFIG_ACPI_HOTPLUG_CPU
 #include <acpi/processor.h>
 
-int acpi_map_cpu2node(acpi_handle handle, int cpu, int physid)
+static int acpi_map_cpu2node(acpi_handle handle, int cpu, int physid)
 {
 #ifdef CONFIG_ACPI_NUMA
         int nid;
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 4261b3282ad9..8ccb7ef512e0 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1610,24 +1610,15 @@ static inline void try_to_enable_x2apic(int remap_mode) { }
 static inline void __x2apic_enable(void) { }
 #endif /* !CONFIG_X86_X2APIC */
 
-static int __init try_to_enable_IR(void)
-{
-#ifdef CONFIG_X86_IO_APIC
-        if (!x2apic_enabled() && skip_ioapic_setup) {
-                pr_info("Not enabling interrupt remapping due to skipped IO-APIC setup\n");
-                return -1;
-        }
-#endif
-        return irq_remapping_enable();
-}
-
 void __init enable_IR_x2apic(void)
 {
         unsigned long flags;
         int ret, ir_stat;
 
-        if (skip_ioapic_setup)
+        if (skip_ioapic_setup) {
+                pr_info("Not enabling interrupt remapping due to skipped IO-APIC setup\n");
                 return;
+        }
 
         ir_stat = irq_remapping_prepare();
         if (ir_stat < 0 && !x2apic_supported())
@@ -1645,7 +1636,7 @@ void __init enable_IR_x2apic(void)
 
         /* If irq_remapping_prepare() succeeded, try to enable it */
         if (ir_stat >= 0)
-                ir_stat = try_to_enable_IR();
+                ir_stat = irq_remapping_enable();
         /* ir_stat contains the remap mode or an error code */
         try_to_enable_x2apic(ir_stat);
 
@@ -2062,17 +2053,17 @@ static int allocate_logical_cpuid(int apicid)
 
         /* Allocate a new cpuid. */
         if (nr_logical_cpuids >= nr_cpu_ids) {
-                WARN_ONCE(1, "Only %d processors supported."
+                WARN_ONCE(1, "APIC: NR_CPUS/possible_cpus limit of %i reached. "
                              "Processor %d/0x%x and the rest are ignored.\n",
-                             nr_cpu_ids - 1, nr_logical_cpuids, apicid);
-                return -1;
+                             nr_cpu_ids, nr_logical_cpuids, apicid);
+                return -EINVAL;
         }
 
         cpuid_to_apicid[nr_logical_cpuids] = apicid;
         return nr_logical_cpuids++;
 }
 
-int __generic_processor_info(int apicid, int version, bool enabled)
+int generic_processor_info(int apicid, int version)
 {
         int cpu, max = nr_cpu_ids;
         bool boot_cpu_detected = physid_isset(boot_cpu_physical_apicid,
@@ -2130,11 +2121,9 @@ int __generic_processor_info(int apicid, int version, bool enabled)
         if (num_processors >= nr_cpu_ids) {
                 int thiscpu = max + disabled_cpus;
 
-                if (enabled) {
-                        pr_warning("APIC: NR_CPUS/possible_cpus limit of %i "
-                                   "reached. Processor %d/0x%x ignored.\n",
-                                   max, thiscpu, apicid);
-                }
+                pr_warning("APIC: NR_CPUS/possible_cpus limit of %i "
+                           "reached. Processor %d/0x%x ignored.\n",
+                           max, thiscpu, apicid);
 
                 disabled_cpus++;
                 return -EINVAL;
@@ -2186,23 +2175,13 @@ int __generic_processor_info(int apicid, int version, bool enabled)
                 apic->x86_32_early_logical_apicid(cpu);
 #endif
         set_cpu_possible(cpu, true);
-
-        if (enabled) {
-                num_processors++;
-                physid_set(apicid, phys_cpu_present_map);
-                set_cpu_present(cpu, true);
-        } else {
-                disabled_cpus++;
-        }
+        physid_set(apicid, phys_cpu_present_map);
+        set_cpu_present(cpu, true);
+        num_processors++;
 
         return cpu;
 }
 
-int generic_processor_info(int apicid, int version)
-{
-        return __generic_processor_info(apicid, version, true);
-}
-
 int hard_smp_processor_id(void)
 {
         return read_apic_id();
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index e9f8f8cdd570..86f20cc0a65e 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -1105,7 +1105,8 @@ void __init uv_init_hub_info(struct uv_hub_info_s *hi)
         node_id.v               = uv_read_local_mmr(UVH_NODE_ID);
         uv_cpuid.gnode_shift    = max_t(unsigned int, uv_cpuid.gnode_shift, mn.n_val);
         hi->gnode_extra         = (node_id.s.node_id & ~((1 << uv_cpuid.gnode_shift) - 1)) >> 1;
-        hi->gnode_upper         = (unsigned long)hi->gnode_extra << mn.m_val;
+        if (mn.m_val)
+                hi->gnode_upper = (u64)hi->gnode_extra << mn.m_val;
 
         if (uv_gp_table) {
                 hi->global_mmr_base     = uv_gp_table->mmr_base;
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 35a5d5dca2fa..c36140d788fe 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -556,10 +556,6 @@ static void early_init_amd(struct cpuinfo_x86 *c)
         if (c->x86_power & (1 << 8)) {
                 set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
                 set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC);
-                if (check_tsc_unstable())
-                        clear_sched_clock_stable();
-        } else {
-                clear_sched_clock_stable();
         }
 
         /* Bit 12 of 8000_0007 edx is accumulated power mechanism. */
diff --git a/arch/x86/kernel/cpu/centaur.c b/arch/x86/kernel/cpu/centaur.c
index adc0ebd8bed0..43955ee6715b 100644
--- a/arch/x86/kernel/cpu/centaur.c
+++ b/arch/x86/kernel/cpu/centaur.c
@@ -105,8 +105,6 @@ static void early_init_centaur(struct cpuinfo_x86 *c)
 #ifdef CONFIG_X86_64
         set_cpu_cap(c, X86_FEATURE_SYSENTER32);
 #endif
-
-        clear_sched_clock_stable();
 }
 
 static void init_centaur(struct cpuinfo_x86 *c)
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index b11b38c3b0bd..58094a1f9e9d 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -88,7 +88,6 @@ static void default_init(struct cpuinfo_x86 *c)
                         strcpy(c->x86_model_id, "386");
         }
 #endif
-        clear_sched_clock_stable();
 }
 
 static const struct cpu_dev default_cpu = {
@@ -1077,8 +1076,6 @@ static void identify_cpu(struct cpuinfo_x86 *c)
          */
         if (this_cpu->c_init)
                 this_cpu->c_init(c);
-        else
-                clear_sched_clock_stable();
 
         /* Disable the PN if appropriate */
         squash_the_stupid_serial_number(c);
diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
index 0a3bc19de017..a70fd61095f8 100644
--- a/arch/x86/kernel/cpu/cyrix.c
+++ b/arch/x86/kernel/cpu/cyrix.c
@@ -185,7 +185,6 @@ static void early_init_cyrix(struct cpuinfo_x86 *c)
                 set_cpu_cap(c, X86_FEATURE_CYRIX_ARR);
                 break;
         }
-        clear_sched_clock_stable();
 }
 
 static void init_cyrix(struct cpuinfo_x86 *c)
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index fe0a615a051b..063197771b8d 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -162,10 +162,6 @@ static void early_init_intel(struct cpuinfo_x86 *c)
         if (c->x86_power & (1 << 8)) {
                 set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
                 set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC);
-                if (check_tsc_unstable())
-                        clear_sched_clock_stable();
-        } else {
-                clear_sched_clock_stable();
         }
 
         /* Penwell and Cloverview have the TSC which doesn't sleep on S3 */
diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
index 0bbe0f3a039f..9ac2a5cdd9c2 100644
--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
@@ -28,7 +28,6 @@
 #include <linux/sched/signal.h>
 #include <linux/sched/task.h>
 #include <linux/slab.h>
-#include <linux/cpu.h>
 #include <linux/task_work.h>
 
 #include <uapi/linux/magic.h>
@@ -728,7 +727,7 @@ void rdtgroup_kn_unlock(struct kernfs_node *kn)
         if (atomic_dec_and_test(&rdtgrp->waitcount) &&
             (rdtgrp->flags & RDT_DELETED)) {
                 kernfs_unbreak_active_protection(kn);
-                kernfs_put(kn);
+                kernfs_put(rdtgrp->kn);
                 kfree(rdtgrp);
         } else {
                 kernfs_unbreak_active_protection(kn);
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index 524cc5780a77..6e4a047e4b68 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -60,7 +60,7 @@ static const char * const th_names[] = {
         "load_store",
         "insn_fetch",
         "combined_unit",
-        "",
+        "decode_unit",
         "northbridge",
         "execution_unit",
 };
diff --git a/arch/x86/kernel/cpu/transmeta.c b/arch/x86/kernel/cpu/transmeta.c
index 8457b4978668..d77d07ab310b 100644
--- a/arch/x86/kernel/cpu/transmeta.c
+++ b/arch/x86/kernel/cpu/transmeta.c
@@ -16,8 +16,6 @@ static void early_init_transmeta(struct cpuinfo_x86 *c)
                 if (xlvl >= 0x80860001)
                         c->x86_capability[CPUID_8086_0001_EDX] = cpuid_edx(0x80860001);
         }
-
-        clear_sched_clock_stable();
 }
 
 static void init_transmeta(struct cpuinfo_x86 *c)
diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
index 891f4dad7b2c..22403a28caf5 100644
--- a/arch/x86/kernel/cpu/vmware.c
+++ b/arch/x86/kernel/cpu/vmware.c
@@ -30,7 +30,6 @@
 #include <asm/hypervisor.h>
 #include <asm/timer.h>
 #include <asm/apic.h>
-#include <asm/timer.h>
 
 #undef pr_fmt
 #define pr_fmt(fmt)     "vmware: " fmt
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index 8639bb2ae058..cbd73eb42170 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -29,6 +29,12 @@
 #include <asm/ftrace.h>
 #include <asm/nops.h>
 
+#if defined(CONFIG_FUNCTION_GRAPH_TRACER) && \
+        !defined(CC_USING_FENTRY) && \
+        !defined(CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE)
+# error The following combination is not supported: ((compiler missing -mfentry) || (CONFIG_X86_32 and !CONFIG_DYNAMIC_FTRACE)) && CONFIG_FUNCTION_GRAPH_TRACER && CONFIG_CC_OPTIMIZE_FOR_SIZE
+#endif
+
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 int ftrace_arch_code_modify_prepare(void)
@@ -535,7 +541,7 @@ static void run_sync(void)
 {
         int enable_irqs = irqs_disabled();
 
-        /* We may be called with interrupts disbled (on bootup). */
+        /* We may be called with interrupts disabled (on bootup). */
         if (enable_irqs)
                 local_irq_enable();
         on_each_cpu(do_sync_core, NULL, 1);
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 54a2372f5dbb..b5785c197e53 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -4,6 +4,7 @@
  *  Copyright (C) 2000 Andrea Arcangeli <andrea@suse.de> SuSE
  */
 
+#define DISABLE_BRANCH_PROFILING
 #include <linux/init.h>
 #include <linux/linkage.h>
 #include <linux/types.h>
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index dc6ba5bda9fc..89ff7af2de50 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -354,7 +354,7 @@ static int hpet_resume(struct clock_event_device *evt, int timer)
 
                 irq_domain_deactivate_irq(irq_get_irq_data(hdev->irq));
                 irq_domain_activate_irq(irq_get_irq_data(hdev->irq));
-                disable_irq(hdev->irq);
+                disable_hardirq(hdev->irq);
                 irq_set_affinity(hdev->irq, cpumask_of(hdev->cpu));
                 enable_irq(hdev->irq);
         }
diff --git a/arch/x86/kernel/kdebugfs.c b/arch/x86/kernel/kdebugfs.c
index bdb83e431d89..38b64587b31b 100644
--- a/arch/x86/kernel/kdebugfs.c
+++ b/arch/x86/kernel/kdebugfs.c
@@ -167,7 +167,7 @@ static int __init boot_params_kdebugfs_init(void)
         struct dentry *dbp, *version, *data;
         int error = -ENOMEM;
 
-        dbp = debugfs_create_dir("boot_params", NULL);
+        dbp = debugfs_create_dir("boot_params", arch_debugfs_dir);
         if (!dbp)
                 return -ENOMEM;
 
diff --git a/arch/x86/kernel/kprobes/common.h b/arch/x86/kernel/kprobes/common.h
index c6ee63f927ab..d688826e5736 100644
--- a/arch/x86/kernel/kprobes/common.h
+++ b/arch/x86/kernel/kprobes/common.h
@@ -67,7 +67,7 @@
 #endif
 
 /* Ensure if the instruction can be boostable */
-extern int can_boost(kprobe_opcode_t *instruction);
+extern int can_boost(kprobe_opcode_t *instruction, void *addr);
 /* Recover instruction if given address is probed */
 extern unsigned long recover_probed_instruction(kprobe_opcode_t *buf,
                                          unsigned long addr);
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 6384eb754a58..993fa4fe4f68 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -167,12 +167,12 @@ NOKPROBE_SYMBOL(skip_prefixes);
  * Returns non-zero if opcode is boostable.
  * RIP relative instructions are adjusted at copying time in 64 bits mode
  */
-int can_boost(kprobe_opcode_t *opcodes)
+int can_boost(kprobe_opcode_t *opcodes, void *addr)
 {
         kprobe_opcode_t opcode;
         kprobe_opcode_t *orig_opcodes = opcodes;
 
-        if (search_exception_tables((unsigned long)opcodes))
+        if (search_exception_tables((unsigned long)addr))
                 return 0;       /* Page fault may occur on this address. */
 
 retry:
@@ -417,7 +417,7 @@ static int arch_copy_kprobe(struct kprobe *p)
          * __copy_instruction can modify the displacement of the instruction,
          * but it doesn't affect boostable check.
          */
-        if (can_boost(p->ainsn.insn))
+        if (can_boost(p->ainsn.insn, p->addr))
                 p->ainsn.boostable = 0;
         else
                 p->ainsn.boostable = -1;
diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
index 3d1bee9d6a72..3e7c6e5a08ff 100644
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -178,7 +178,7 @@ static int copy_optimized_instructions(u8 *dest, u8 *src)
 
         while (len < RELATIVEJUMP_SIZE) {
                 ret = __copy_instruction(dest + len, src + len);
-                if (!ret || !can_boost(dest + len))
+                if (!ret || !can_boost(dest + len, src + len))
                         return -EINVAL;
                 len += ret;
         }
diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
index 307b1f4543de..857cdbd02867 100644
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -194,19 +194,22 @@ static int arch_update_purgatory(struct kimage *image)
 
         /* Setup copying of backup region */
         if (image->type == KEXEC_TYPE_CRASH) {
-                ret = kexec_purgatory_get_set_symbol(image, "backup_dest",
+                ret = kexec_purgatory_get_set_symbol(image,
+                                "purgatory_backup_dest",
                                 &image->arch.backup_load_addr,
                                 sizeof(image->arch.backup_load_addr), 0);
                 if (ret)
                         return ret;
 
-                ret = kexec_purgatory_get_set_symbol(image, "backup_src",
+                ret = kexec_purgatory_get_set_symbol(image,
+                                "purgatory_backup_src",
                                 &image->arch.backup_src_start,
                                 sizeof(image->arch.backup_src_start), 0);
                 if (ret)
                         return ret;
 
-                ret = kexec_purgatory_get_set_symbol(image, "backup_sz",
+                ret = kexec_purgatory_get_set_symbol(image,
+                                "purgatory_backup_sz",
                                 &image->arch.backup_src_sz,
                                 sizeof(image->arch.backup_src_sz), 0);
                 if (ret)
diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
index f088ea4c66e7..a723ae9440ab 100644
--- a/arch/x86/kernel/nmi.c
+++ b/arch/x86/kernel/nmi.c
@@ -166,11 +166,9 @@ int __register_nmi_handler(unsigned int type, struct nmiaction *action)
         spin_lock_irqsave(&desc->lock, flags);
 
         /*
-         * most handlers of type NMI_UNKNOWN never return because
-         * they just assume the NMI is theirs.  Just a sanity check
-         * to manage expectations
+         * Indicate if there are multiple registrations on the
+         * internal NMI handler call chains (SERR and IO_CHECK).
          */
-        WARN_ON_ONCE(type == NMI_UNKNOWN && !list_empty(&desc->head));
         WARN_ON_ONCE(type == NMI_SERR && !list_empty(&desc->head));
         WARN_ON_ONCE(type == NMI_IO_CHECK && !list_empty(&desc->head));
 
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index e244c19a2451..067f9813fd2c 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -223,6 +223,22 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                         DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
                 },
         },
+        {       /* Handle problems with rebooting on ASUS EeeBook X205TA */
+                .callback = set_acpi_reboot,
+                .ident = "ASUS EeeBook X205TA",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X205TA"),
+                },
+        },
+        {       /* Handle problems with rebooting on ASUS EeeBook X205TAW */
+                .callback = set_acpi_reboot,
+                .ident = "ASUS EeeBook X205TAW",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X205TAW"),
+                },
+        },
 
         /* Certec */
         {       /* Handle problems with rebooting on Certec BPC600 */
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 46bcda4cb1c2..714dfba6a1e7 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -327,9 +327,16 @@ unsigned long long sched_clock(void)
 {
         return paravirt_sched_clock();
 }
+
+bool using_native_sched_clock(void)
+{
+        return pv_time_ops.sched_clock == native_sched_clock;
+}
 #else
 unsigned long long
 sched_clock(void) __attribute__((alias("native_sched_clock")));
+
+bool using_native_sched_clock(void) { return true; }
 #endif
 
 int check_tsc_unstable(void)
@@ -1112,8 +1119,10 @@ static void tsc_cs_mark_unstable(struct clocksource *cs)
 {
         if (tsc_unstable)
                 return;
+
         tsc_unstable = 1;
-        clear_sched_clock_stable();
+        if (using_native_sched_clock())
+                clear_sched_clock_stable();
         disable_sched_clock_irqtime();
         pr_info("Marking TSC unstable due to clocksource watchdog\n");
 }
@@ -1135,18 +1144,20 @@ static struct clocksource clocksource_tsc = {
 
 void mark_tsc_unstable(char *reason)
 {
-        if (!tsc_unstable) {
-                tsc_unstable = 1;
+        if (tsc_unstable)
+                return;
+
+        tsc_unstable = 1;
+        if (using_native_sched_clock())
                 clear_sched_clock_stable();
-                disable_sched_clock_irqtime();
-                pr_info("Marking TSC unstable due to %s\n", reason);
-                /* Change only the rating, when not registered */
-                if (clocksource_tsc.mult)
-                        clocksource_mark_unstable(&clocksource_tsc);
-                else {
-                        clocksource_tsc.flags |= CLOCK_SOURCE_UNSTABLE;
-                        clocksource_tsc.rating = 0;
-                }
+        disable_sched_clock_irqtime();
+        pr_info("Marking TSC unstable due to %s\n", reason);
+        /* Change only the rating, when not registered */
+        if (clocksource_tsc.mult) {
+                clocksource_mark_unstable(&clocksource_tsc);
+        } else {
+                clocksource_tsc.flags |= CLOCK_SOURCE_UNSTABLE;
+                clocksource_tsc.rating = 0;
         }
 }
 
@@ -1322,6 +1333,8 @@ static int __init init_tsc_clocksource(void)
          * the refined calibration and directly register it as a clocksource.
          */
         if (boot_cpu_has(X86_FEATURE_TSC_KNOWN_FREQ)) {
+                if (boot_cpu_has(X86_FEATURE_ART))
+                        art_related_clocksource = &clocksource_tsc;
                 clocksource_register_khz(&clocksource_tsc, tsc_khz);
                 return 0;
         }
diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c
index 478d15dbaee4..08339262b666 100644
--- a/arch/x86/kernel/unwind_frame.c
+++ b/arch/x86/kernel/unwind_frame.c
@@ -82,19 +82,43 @@ static size_t regs_size(struct pt_regs *regs)
         return sizeof(*regs);
 }
 
+#ifdef CONFIG_X86_32
+#define GCC_REALIGN_WORDS 3
+#else
+#define GCC_REALIGN_WORDS 1
+#endif
+
 static bool is_last_task_frame(struct unwind_state *state)
 {
-        unsigned long bp = (unsigned long)state->bp;
-        unsigned long regs = (unsigned long)task_pt_regs(state->task);
+        unsigned long *last_bp = (unsigned long *)task_pt_regs(state->task) - 2;
+        unsigned long *aligned_bp = last_bp - GCC_REALIGN_WORDS;
 
         /*
          * We have to check for the last task frame at two different locations
          * because gcc can occasionally decide to realign the stack pointer and
-         * change the offset of the stack frame by a word in the prologue of a
-         * function called by head/entry code.
+         * change the offset of the stack frame in the prologue of a function
+         * called by head/entry code.  Examples:
+         *
+         * <start_secondary>:
+         *      push   %edi
+         *      lea    0x8(%esp),%edi
+         *      and    $0xfffffff8,%esp
+         *      pushl  -0x4(%edi)
+         *      push   %ebp
+         *      mov    %esp,%ebp
+         *
+         * <x86_64_start_kernel>:
+         *      lea    0x8(%rsp),%r10
+         *      and    $0xfffffffffffffff0,%rsp
+         *      pushq  -0x8(%r10)
+         *      push   %rbp
+         *      mov    %rsp,%rbp
+         *
+         * Note that after aligning the stack, it pushes a duplicate copy of
+         * the return address before pushing the frame pointer.
          */
-        return bp == regs - FRAME_HEADER_SIZE ||
-               bp == regs - FRAME_HEADER_SIZE - sizeof(long);
+        return (state->bp == last_bp ||
+                (state->bp == aligned_bp && *(aligned_bp+1) == *(last_bp+1)));
 }
 
 /*
diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index 73ea24d4f119..047b17a26269 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -657,6 +657,9 @@ void kvm_pic_destroy(struct kvm *kvm)
 {
         struct kvm_pic *vpic = kvm->arch.vpic;
 
+        if (!vpic)
+                return;
+
         kvm_io_bus_unregister_dev(vpic->kvm, KVM_PIO_BUS, &vpic->dev_master);
         kvm_io_bus_unregister_dev(vpic->kvm, KVM_PIO_BUS, &vpic->dev_slave);
         kvm_io_bus_unregister_dev(vpic->kvm, KVM_PIO_BUS, &vpic->dev_eclr);
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index 6e219e5c07d2..289270a6aecb 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -635,6 +635,9 @@ void kvm_ioapic_destroy(struct kvm *kvm)
 {
         struct kvm_ioapic *ioapic = kvm->arch.vioapic;
 
+        if (!ioapic)
+                return;
+
         cancel_delayed_work_sync(&ioapic->eoi_inject);
         kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &ioapic->dev);
         kvm->arch.vioapic = NULL;
diff --git a/arch/x86/kvm/page_track.c b/arch/x86/kvm/page_track.c
index 37942e419c32..60168cdd0546 100644
--- a/arch/x86/kvm/page_track.c
+++ b/arch/x86/kvm/page_track.c
@@ -160,6 +160,14 @@ bool kvm_page_track_is_active(struct kvm_vcpu *vcpu, gfn_t gfn,
         return !!ACCESS_ONCE(slot->arch.gfn_track[mode][index]);
 }
 
+void kvm_page_track_cleanup(struct kvm *kvm)
+{
+        struct kvm_page_track_notifier_head *head;
+
+        head = &kvm->arch.track_notifier_head;
+        cleanup_srcu_struct(&head->track_srcu);
+}
+
 void kvm_page_track_init(struct kvm *kvm)
 {
         struct kvm_page_track_notifier_head *head;
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index d1efe2c62b3f..5fba70646c32 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1379,6 +1379,9 @@ static void avic_vm_destroy(struct kvm *kvm)
         unsigned long flags;
         struct kvm_arch *vm_data = &kvm->arch;
 
+        if (!avic)
+                return;
+
         avic_free_vm_id(vm_data->avic_vm_id);
 
         if (vm_data->avic_logical_id_table_page)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 283aa8601833..2ee00dbbbd51 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1239,6 +1239,11 @@ static inline bool cpu_has_vmx_invvpid_global(void)
         return vmx_capability.vpid & VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT;
 }
 
+static inline bool cpu_has_vmx_invvpid(void)
+{
+        return vmx_capability.vpid & VMX_VPID_INVVPID_BIT;
+}
+
 static inline bool cpu_has_vmx_ept(void)
 {
         return vmcs_config.cpu_based_2nd_exec_ctrl &
@@ -2753,7 +2758,6 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
                 SECONDARY_EXEC_RDTSCP |
                 SECONDARY_EXEC_DESC |
                 SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
-                SECONDARY_EXEC_ENABLE_VPID |
                 SECONDARY_EXEC_APIC_REGISTER_VIRT |
                 SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
                 SECONDARY_EXEC_WBINVD_EXITING |
@@ -2781,10 +2785,12 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
          * though it is treated as global context.  The alternative is
          * not failing the single-context invvpid, and it is worse.
          */
-        if (enable_vpid)
+        if (enable_vpid) {
+                vmx->nested.nested_vmx_secondary_ctls_high |=
+                        SECONDARY_EXEC_ENABLE_VPID;
                 vmx->nested.nested_vmx_vpid_caps = VMX_VPID_INVVPID_BIT |
                         VMX_VPID_EXTENT_SUPPORTED_MASK;
-        else
+        } else
                 vmx->nested.nested_vmx_vpid_caps = 0;
 
         if (enable_unrestricted_guest)
@@ -4024,6 +4030,12 @@ static void vmx_flush_tlb(struct kvm_vcpu *vcpu)
         __vmx_flush_tlb(vcpu, to_vmx(vcpu)->vpid);
 }
 
+static void vmx_flush_tlb_ept_only(struct kvm_vcpu *vcpu)
+{
+        if (enable_ept)
+                vmx_flush_tlb(vcpu);
+}
+
 static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
 {
         ulong cr0_guest_owned_bits = vcpu->arch.cr0_guest_owned_bits;
@@ -6517,8 +6529,10 @@ static __init int hardware_setup(void)
         if (boot_cpu_has(X86_FEATURE_NX))
                 kvm_enable_efer_bits(EFER_NX);
 
-        if (!cpu_has_vmx_vpid())
+        if (!cpu_has_vmx_vpid() || !cpu_has_vmx_invvpid() ||
+                !(cpu_has_vmx_invvpid_single() || cpu_has_vmx_invvpid_global()))
                 enable_vpid = 0;
+
         if (!cpu_has_vmx_shadow_vmcs())
                 enable_shadow_vmcs = 0;
         if (enable_shadow_vmcs)
@@ -7258,9 +7272,8 @@ static int handle_vmoff(struct kvm_vcpu *vcpu)
 static int handle_vmclear(struct kvm_vcpu *vcpu)
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
+        u32 zero = 0;
         gpa_t vmptr;
-        struct vmcs12 *vmcs12;
-        struct page *page;
 
         if (!nested_vmx_check_permission(vcpu))
                 return 1;
@@ -7271,22 +7284,9 @@ static int handle_vmclear(struct kvm_vcpu *vcpu)
         if (vmptr == vmx->nested.current_vmptr)
                 nested_release_vmcs12(vmx);
 
-        page = nested_get_page(vcpu, vmptr);
-        if (page == NULL) {
-                /*
-                 * For accurate processor emulation, VMCLEAR beyond available
-                 * physical memory should do nothing at all. However, it is
-                 * possible that a nested vmx bug, not a guest hypervisor bug,
-                 * resulted in this case, so let's shut down before doing any
-                 * more damage:
-                 */
-                kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
-                return 1;
-        }
-        vmcs12 = kmap(page);
-        vmcs12->launch_state = 0;
-        kunmap(page);
-        nested_release_page(page);
+        kvm_vcpu_write_guest(vcpu,
+                        vmptr + offsetof(struct vmcs12, launch_state),
+                        &zero, sizeof(zero));
 
         nested_free_vmcs02(vmx, vmptr);
 
@@ -8515,7 +8515,8 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
             && kvm_vmx_exit_handlers[exit_reason])
                 return kvm_vmx_exit_handlers[exit_reason](vcpu);
         else {
-                WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_reason);
+                vcpu_unimpl(vcpu, "vmx: unexpected exit reason 0x%x\n",
+                                exit_reason);
                 kvm_queue_exception(vcpu, UD_VECTOR);
                 return 1;
         }
@@ -8561,6 +8562,7 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set)
         } else {
                 sec_exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
                 sec_exec_control |= SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+                vmx_flush_tlb_ept_only(vcpu);
         }
         vmcs_write32(SECONDARY_VM_EXEC_CONTROL, sec_exec_control);
 
@@ -8586,8 +8588,10 @@ static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu, hpa_t hpa)
          */
         if (!is_guest_mode(vcpu) ||
             !nested_cpu_has2(get_vmcs12(&vmx->vcpu),
-                             SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES))
+                             SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
                 vmcs_write64(APIC_ACCESS_ADDR, hpa);
+                vmx_flush_tlb_ept_only(vcpu);
+        }
 }
 
 static void vmx_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr)
@@ -9694,10 +9698,8 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu,
                 return false;
 
         page = nested_get_page(vcpu, vmcs12->msr_bitmap);
-        if (!page) {
-                WARN_ON(1);
+        if (!page)
                 return false;
-        }
         msr_bitmap_l1 = (unsigned long *)kmap(page);
 
         memset(msr_bitmap_l0, 0xff, PAGE_SIZE);
@@ -9990,7 +9992,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
         u32 exec_control;
-        bool nested_ept_enabled = false;
 
         vmcs_write16(GUEST_ES_SELECTOR, vmcs12->guest_es_selector);
         vmcs_write16(GUEST_CS_SELECTOR, vmcs12->guest_cs_selector);
@@ -10137,8 +10138,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
                                 vmcs12->guest_intr_status);
                 }
 
-                nested_ept_enabled = (exec_control & SECONDARY_EXEC_ENABLE_EPT) != 0;
-
                 /*
                  * Write an illegal value to APIC_ACCESS_ADDR. Later,
                  * nested_get_vmcs12_pages will either fix it up or
@@ -10271,6 +10270,9 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
         if (nested_cpu_has_ept(vmcs12)) {
                 kvm_mmu_unload(vcpu);
                 nested_ept_init_mmu_context(vcpu);
+        } else if (nested_cpu_has2(vmcs12,
+                                   SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
+                vmx_flush_tlb_ept_only(vcpu);
         }
 
         /*
@@ -10298,12 +10300,10 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
         vmx_set_efer(vcpu, vcpu->arch.efer);
 
         /* Shadow page tables on either EPT or shadow page tables. */
-        if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_ept_enabled,
+        if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_cpu_has_ept(vmcs12),
                                 entry_failure_code))
                 return 1;
 
-        kvm_mmu_reset_context(vcpu);
-
         if (!enable_ept)
                 vcpu->arch.walk_mmu->inject_page_fault = vmx_inject_page_fault_nested;
 
@@ -11072,6 +11072,10 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
                 vmx->nested.change_vmcs01_virtual_x2apic_mode = false;
                 vmx_set_virtual_x2apic_mode(vcpu,
                                 vcpu->arch.apic_base & X2APIC_ENABLE);
+        } else if (!nested_cpu_has_ept(vmcs12) &&
+                   nested_cpu_has2(vmcs12,
+                                   SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
+                vmx_flush_tlb_ept_only(vcpu);
         }
 
         /* This is needed for same reason as it was needed in prepare_vmcs02 */
@@ -11121,8 +11125,10 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
  */
 static void vmx_leave_nested(struct kvm_vcpu *vcpu)
 {
-        if (is_guest_mode(vcpu))
+        if (is_guest_mode(vcpu)) {
+                to_vmx(vcpu)->nested.nested_run_pending = 0;
                 nested_vmx_vmexit(vcpu, -1, 0, 0);
+        }
         free_nested(to_vmx(vcpu));
 }
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 1faf620a6fdc..ccbd45ecd41a 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -8153,11 +8153,12 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
         if (kvm_x86_ops->vm_destroy)
                 kvm_x86_ops->vm_destroy(kvm);
         kvm_iommu_unmap_guest(kvm);
-        kfree(kvm->arch.vpic);
-        kfree(kvm->arch.vioapic);
+        kvm_pic_destroy(kvm);
+        kvm_ioapic_destroy(kvm);
         kvm_free_vcpus(kvm);
         kvfree(rcu_dereference_check(kvm->arch.apic_map, 1));
         kvm_mmu_uninit_vm(kvm);
+        kvm_page_track_cleanup(kvm);
 }
 
 void kvm_arch_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,
@@ -8566,11 +8567,11 @@ void kvm_arch_async_page_present(struct kvm_vcpu *vcpu,
 {
         struct x86_exception fault;
 
-        trace_kvm_async_pf_ready(work->arch.token, work->gva);
         if (work->wakeup_all)
                 work->arch.token = ~0; /* broadcast wakeup */
         else
                 kvm_del_async_pf_gfn(vcpu, work->arch.gfn);
+        trace_kvm_async_pf_ready(work->arch.token, work->gva);
 
         if ((vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED) &&
             !apf_put_user(vcpu, KVM_PV_REASON_PAGE_READY)) {
diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
index 779782f58324..9a53a06e5a3e 100644
--- a/arch/x86/lib/memcpy_64.S
+++ b/arch/x86/lib/memcpy_64.S
@@ -290,7 +290,7 @@ EXPORT_SYMBOL_GPL(memcpy_mcsafe_unrolled)
         _ASM_EXTABLE_FAULT(.L_copy_leading_bytes, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w0, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w1, .L_memcpy_mcsafe_fail)
-        _ASM_EXTABLE_FAULT(.L_cache_w3, .L_memcpy_mcsafe_fail)
+        _ASM_EXTABLE_FAULT(.L_cache_w2, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w3, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w4, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w5, .L_memcpy_mcsafe_fail)
diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
index 99c7805a9693..1f3b6ef105cd 100644
--- a/arch/x86/mm/gup.c
+++ b/arch/x86/mm/gup.c
@@ -106,32 +106,35 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
                 unsigned long end, int write, struct page **pages, int *nr)
 {
         struct dev_pagemap *pgmap = NULL;
-        int nr_start = *nr;
-        pte_t *ptep;
+        int nr_start = *nr, ret = 0;
+        pte_t *ptep, *ptem;
 
-        ptep = pte_offset_map(&pmd, addr);
+        /*
+         * Keep the original mapped PTE value (ptem) around since we
+         * might increment ptep off the end of the page when finishing
+         * our loop iteration.
+         */
+        ptem = ptep = pte_offset_map(&pmd, addr);
         do {
                 pte_t pte = gup_get_pte(ptep);
                 struct page *page;
 
                 /* Similar to the PMD case, NUMA hinting must take slow path */
-                if (pte_protnone(pte)) {
-                        pte_unmap(ptep);
-                        return 0;
-                }
+                if (pte_protnone(pte))
+                        break;
+
+                if (!pte_allows_gup(pte_val(pte), write))
+                        break;
 
                 if (pte_devmap(pte)) {
                         pgmap = get_dev_pagemap(pte_pfn(pte), pgmap);
                         if (unlikely(!pgmap)) {
                                 undo_dev_pagemap(nr, nr_start, pages);
-                                pte_unmap(ptep);
-                                return 0;
+                                break;
                         }
-                } else if (!pte_allows_gup(pte_val(pte), write) ||
-                           pte_special(pte)) {
-                        pte_unmap(ptep);
-                        return 0;
-                }
+                } else if (pte_special(pte))
+                        break;
+
                 VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
                 page = pte_page(pte);
                 get_page(page);
@@ -141,9 +144,11 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
                 (*nr)++;
 
         } while (ptep++, addr += PAGE_SIZE, addr != end);
-        pte_unmap(ptep - 1);
+        if (addr == end)
+                ret = 1;
+        pte_unmap(ptem);
 
-        return 1;
+        return ret;
 }
 
 static inline void get_head_page_multiple(struct page *page, int nr)
diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
index 8d63d7a104c3..4c90cfdc128b 100644
--- a/arch/x86/mm/kasan_init_64.c
+++ b/arch/x86/mm/kasan_init_64.c
@@ -1,3 +1,4 @@
+#define DISABLE_BRANCH_PROFILING
 #define pr_fmt(fmt) "kasan: " fmt
 #include <linux/bootmem.h>
 #include <linux/kasan.h>
diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c
index 887e57182716..aed206475aa7 100644
--- a/arch/x86/mm/kaslr.c
+++ b/arch/x86/mm/kaslr.c
@@ -48,7 +48,7 @@ static const unsigned long vaddr_start = __PAGE_OFFSET_BASE;
 #if defined(CONFIG_X86_ESPFIX64)
 static const unsigned long vaddr_end = ESPFIX_BASE_ADDR;
 #elif defined(CONFIG_EFI)
-static const unsigned long vaddr_end = EFI_VA_START;
+static const unsigned long vaddr_end = EFI_VA_END;
 #else
 static const unsigned long vaddr_end = __START_KERNEL_map;
 #endif
@@ -105,7 +105,7 @@ void __init kernel_randomize_memory(void)
          */
         BUILD_BUG_ON(vaddr_start >= vaddr_end);
         BUILD_BUG_ON(IS_ENABLED(CONFIG_X86_ESPFIX64) &&
-                     vaddr_end >= EFI_VA_START);
+                     vaddr_end >= EFI_VA_END);
         BUILD_BUG_ON((IS_ENABLED(CONFIG_X86_ESPFIX64) ||
                       IS_ENABLED(CONFIG_EFI)) &&
                      vaddr_end >= __START_KERNEL_map);
diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index 5126dfd52b18..cd44ae727df7 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -590,7 +590,7 @@ static unsigned long mpx_bd_entry_to_bt_addr(struct mm_struct *mm,
  * we might run off the end of the bounds table if we are on
  * a 64-bit kernel and try to get 8 bytes.
  */
-int get_user_bd_entry(struct mm_struct *mm, unsigned long *bd_entry_ret,
+static int get_user_bd_entry(struct mm_struct *mm, unsigned long *bd_entry_ret,
                 long __user *bd_entry_ptr)
 {
         u32 bd_entry_32;
diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
index 0cb52ae0a8f0..190e718694b1 100644
--- a/arch/x86/pci/common.c
+++ b/arch/x86/pci/common.c
@@ -735,6 +735,15 @@ void pcibios_disable_device (struct pci_dev *dev)
                 pcibios_disable_irq(dev);
 }
 
+#ifdef CONFIG_ACPI_HOTPLUG_IOAPIC
+void pcibios_release_device(struct pci_dev *dev)
+{
+        if (atomic_dec_return(&dev->enable_cnt) >= 0)
+                pcibios_disable_device(dev);
+
+}
+#endif
+
 int pci_ext_cfg_avail(void)
 {
         if (raw_pci_ext_ops)
diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
index e1fb269c87af..292ab0364a89 100644
--- a/arch/x86/pci/xen.c
+++ b/arch/x86/pci/xen.c
@@ -234,23 +234,14 @@ static int xen_hvm_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
                 return 1;
 
         for_each_pci_msi_entry(msidesc, dev) {
-                __pci_read_msi_msg(msidesc, &msg);
-                pirq = MSI_ADDR_EXT_DEST_ID(msg.address_hi) |
-                        ((msg.address_lo >> MSI_ADDR_DEST_ID_SHIFT) & 0xff);
-                if (msg.data != XEN_PIRQ_MSI_DATA ||
-                    xen_irq_from_pirq(pirq) < 0) {
-                        pirq = xen_allocate_pirq_msi(dev, msidesc);
-                        if (pirq < 0) {
-                                irq = -ENODEV;
-                                goto error;
-                        }
-                        xen_msi_compose_msg(dev, pirq, &msg);
-                        __pci_write_msi_msg(msidesc, &msg);
-                        dev_dbg(&dev->dev, "xen: msi bound to pirq=%d\n", pirq);
-                } else {
-                        dev_dbg(&dev->dev,
-                                "xen: msi already bound to pirq=%d\n", pirq);
+                pirq = xen_allocate_pirq_msi(dev, msidesc);
+                if (pirq < 0) {
+                        irq = -ENODEV;
+                        goto error;
                 }
+                xen_msi_compose_msg(dev, pirq, &msg);
+                __pci_write_msi_msg(msidesc, &msg);
+                dev_dbg(&dev->dev, "xen: msi bound to pirq=%d\n", pirq);
                 irq = xen_bind_pirq_msi_to_irq(dev, msidesc, pirq,
                                                (type == PCI_CAP_ID_MSI) ? nvec : 1,
                                                (type == PCI_CAP_ID_MSIX) ?
diff --git a/arch/x86/platform/intel-mid/device_libs/Makefile b/arch/x86/platform/intel-mid/device_libs/Makefile
index a7dbec4dce27..3dbde04febdc 100644
--- a/arch/x86/platform/intel-mid/device_libs/Makefile
+++ b/arch/x86/platform/intel-mid/device_libs/Makefile
@@ -26,5 +26,6 @@ obj-$(subst m,y,$(CONFIG_GPIO_PCA953X)) += platform_pcal9555a.o
 obj-$(subst m,y,$(CONFIG_GPIO_PCA953X)) += platform_tca6416.o
 # MISC Devices
 obj-$(subst m,y,$(CONFIG_KEYBOARD_GPIO)) += platform_gpio_keys.o
+obj-$(subst m,y,$(CONFIG_INTEL_MID_POWER_BUTTON)) += platform_mrfld_power_btn.o
 obj-$(subst m,y,$(CONFIG_RTC_DRV_CMOS)) += platform_mrfld_rtc.o
 obj-$(subst m,y,$(CONFIG_INTEL_MID_WATCHDOG)) += platform_mrfld_wdt.o
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_mrfld_power_btn.c b/arch/x86/platform/intel-mid/device_libs/platform_mrfld_power_btn.c
new file mode 100644
index 000000000000..a6c3705a28ad
--- /dev/null
+++ b/arch/x86/platform/intel-mid/device_libs/platform_mrfld_power_btn.c
@@ -0,0 +1,82 @@
+/*
+ * Intel Merrifield power button support
+ *
+ * (C) Copyright 2017 Intel Corporation
+ *
+ * Author: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2
+ * of the License.
+ */
+
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/platform_device.h>
+#include <linux/sfi.h>
+
+#include <asm/intel-mid.h>
+#include <asm/intel_scu_ipc.h>
+
+static struct resource mrfld_power_btn_resources[] = {
+        {
+                .flags          = IORESOURCE_IRQ,
+        },
+};
+
+static struct platform_device mrfld_power_btn_dev = {
+        .name           = "msic_power_btn",
+        .id             = PLATFORM_DEVID_NONE,
+        .num_resources  = ARRAY_SIZE(mrfld_power_btn_resources),
+        .resource       = mrfld_power_btn_resources,
+};
+
+static int mrfld_power_btn_scu_status_change(struct notifier_block *nb,
+                                             unsigned long code, void *data)
+{
+        if (code == SCU_DOWN) {
+                platform_device_unregister(&mrfld_power_btn_dev);
+                return 0;
+        }
+
+        return platform_device_register(&mrfld_power_btn_dev);
+}
+
+static struct notifier_block mrfld_power_btn_scu_notifier = {
+        .notifier_call  = mrfld_power_btn_scu_status_change,
+};
+
+static int __init register_mrfld_power_btn(void)
+{
+        if (intel_mid_identify_cpu() != INTEL_MID_CPU_CHIP_TANGIER)
+                return -ENODEV;
+
+        /*
+         * We need to be sure that the SCU IPC is ready before
+         * PMIC power button device can be registered:
+         */
+        intel_scu_notifier_add(&mrfld_power_btn_scu_notifier);
+
+        return 0;
+}
+arch_initcall(register_mrfld_power_btn);
+
+static void __init *mrfld_power_btn_platform_data(void *info)
+{
+        struct resource *res = mrfld_power_btn_resources;
+        struct sfi_device_table_entry *pentry = info;
+
+        res->start = res->end = pentry->irq;
+        return NULL;
+}
+
+static const struct devs_id mrfld_power_btn_dev_id __initconst = {
+        .name                   = "bcove_power_btn",
+        .type                   = SFI_DEV_TYPE_IPC,
+        .delay                  = 1,
+        .msic                   = 1,
+        .get_platform_data      = &mrfld_power_btn_platform_data,
+};
+
+sfi_device(mrfld_power_btn_dev_id);
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c b/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c
index 86edd1e941eb..9e304e2ea4f5 100644
--- a/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c
@@ -19,7 +19,7 @@
 #include <asm/intel_scu_ipc.h>
 #include <asm/io_apic.h>
 
-#define TANGIER_EXT_TIMER0_MSI 15
+#define TANGIER_EXT_TIMER0_MSI 12
 
 static struct platform_device wdt_dev = {
         .name = "intel_mid_wdt",
diff --git a/arch/x86/platform/intel-mid/mfld.c b/arch/x86/platform/intel-mid/mfld.c
index e793fe509971..e42978d4deaf 100644
--- a/arch/x86/platform/intel-mid/mfld.c
+++ b/arch/x86/platform/intel-mid/mfld.c
@@ -17,16 +17,6 @@
 
 #include "intel_mid_weak_decls.h"
 
-static void penwell_arch_setup(void);
-/* penwell arch ops */
-static struct intel_mid_ops penwell_ops = {
-        .arch_setup = penwell_arch_setup,
-};
-
-static void mfld_power_off(void)
-{
-}
-
 static unsigned long __init mfld_calibrate_tsc(void)
 {
         unsigned long fast_calibrate;
@@ -63,9 +53,12 @@ static unsigned long __init mfld_calibrate_tsc(void)
 static void __init penwell_arch_setup(void)
 {
         x86_platform.calibrate_tsc = mfld_calibrate_tsc;
-        pm_power_off = mfld_power_off;
 }
 
+static struct intel_mid_ops penwell_ops = {
+        .arch_setup = penwell_arch_setup,
+};
+
 void *get_penwell_ops(void)
 {
         return &penwell_ops;
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index 766d4d3529a1..f25982cdff90 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -1847,7 +1847,6 @@ static void pq_init(int node, int pnode)
 
         ops.write_payload_first(pnode, first);
         ops.write_payload_last(pnode, last);
-        ops.write_g_sw_ack(pnode, 0xffffUL);
 
         /* in effect, all msg_type's are set to MSG_NOOP */
         memset(pqp, 0, sizeof(struct bau_pq_entry) * DEST_Q_SIZE);
diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
index 555b9fa0ad43..7dbdb780264d 100644
--- a/arch/x86/purgatory/Makefile
+++ b/arch/x86/purgatory/Makefile
@@ -8,6 +8,7 @@ PURGATORY_OBJS = $(addprefix $(obj)/,$(purgatory-y))
 LDFLAGS_purgatory.ro := -e purgatory_start -r --no-undefined -nostdlib -z nodefaultlib
 targets += purgatory.ro
 
+KASAN_SANITIZE  := n
 KCOV_INSTRUMENT := n
 
 # Default KBUILD_CFLAGS can have -pg option set when FTRACE is enabled. That
diff --git a/arch/x86/purgatory/purgatory.c b/arch/x86/purgatory/purgatory.c
index 25e068ba3382..470edad96bb9 100644
--- a/arch/x86/purgatory/purgatory.c
+++ b/arch/x86/purgatory/purgatory.c
@@ -10,21 +10,19 @@
  * Version 2.  See the file COPYING for more details.
  */
 
+#include <linux/bug.h>
+#include <asm/purgatory.h>
+
 #include "sha256.h"
 #include "../boot/string.h"
 
-struct sha_region {
-        unsigned long start;
-        unsigned long len;
-};
-
-unsigned long backup_dest = 0;
-unsigned long backup_src = 0;
-unsigned long backup_sz = 0;
+unsigned long purgatory_backup_dest __section(.kexec-purgatory);
+unsigned long purgatory_backup_src __section(.kexec-purgatory);
+unsigned long purgatory_backup_sz __section(.kexec-purgatory);
 
-u8 sha256_digest[SHA256_DIGEST_SIZE] = { 0 };
+u8 purgatory_sha256_digest[SHA256_DIGEST_SIZE] __section(.kexec-purgatory);
 
-struct sha_region sha_regions[16] = {};
+struct kexec_sha_region purgatory_sha_regions[KEXEC_SEGMENT_MAX] __section(.kexec-purgatory);
 
 /*
  * On x86, second kernel requries first 640K of memory to boot. Copy
@@ -33,26 +31,28 @@ struct sha_region sha_regions[16] = {};
  */
 static int copy_backup_region(void)
 {
-        if (backup_dest)
-                memcpy((void *)backup_dest, (void *)backup_src, backup_sz);
-
+        if (purgatory_backup_dest) {
+                memcpy((void *)purgatory_backup_dest,
+                       (void *)purgatory_backup_src, purgatory_backup_sz);
+        }
         return 0;
 }
 
-int verify_sha256_digest(void)
+static int verify_sha256_digest(void)
 {
-        struct sha_region *ptr, *end;
+        struct kexec_sha_region *ptr, *end;
         u8 digest[SHA256_DIGEST_SIZE];
         struct sha256_state sctx;
 
         sha256_init(&sctx);
-        end = &sha_regions[sizeof(sha_regions)/sizeof(sha_regions[0])];
-        for (ptr = sha_regions; ptr < end; ptr++)
+        end = purgatory_sha_regions + ARRAY_SIZE(purgatory_sha_regions);
+
+        for (ptr = purgatory_sha_regions; ptr < end; ptr++)
                 sha256_update(&sctx, (uint8_t *)(ptr->start), ptr->len);
 
         sha256_final(&sctx, digest);
 
-        if (memcmp(digest, sha256_digest, sizeof(digest)))
+        if (memcmp(digest, purgatory_sha256_digest, sizeof(digest)))
                 return 1;
 
         return 0;
diff --git a/arch/x86/purgatory/setup-x86_64.S b/arch/x86/purgatory/setup-x86_64.S
index fe3c91ba1bd0..dfae9b9e60b5 100644
--- a/arch/x86/purgatory/setup-x86_64.S
+++ b/arch/x86/purgatory/setup-x86_64.S
@@ -9,6 +9,7 @@
  * This source code is licensed under the GNU General Public License,
  * Version 2.  See the file COPYING for more details.
  */
+#include <asm/purgatory.h>
 
         .text
         .globl purgatory_start
diff --git a/arch/x86/purgatory/sha256.h b/arch/x86/purgatory/sha256.h
index bd15a4127735..2867d9825a57 100644
--- a/arch/x86/purgatory/sha256.h
+++ b/arch/x86/purgatory/sha256.h
@@ -10,7 +10,6 @@
 #ifndef SHA256_H
 #define SHA256_H
 
-
 #include <linux/types.h>
 #include <crypto/sha.h>
 
diff --git a/arch/xtensa/include/asm/pgtable.h b/arch/xtensa/include/asm/pgtable.h
index 8aa0e0d9cbb2..30dd5b2e4ad5 100644
--- a/arch/xtensa/include/asm/pgtable.h
+++ b/arch/xtensa/include/asm/pgtable.h
@@ -11,6 +11,7 @@
 #ifndef _XTENSA_PGTABLE_H
 #define _XTENSA_PGTABLE_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 #include <asm/page.h>
 #include <asm/kmem_layout.h>
diff --git a/block/bio.c b/block/bio.c
index 5eec5e08417f..e75878f8b14a 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -376,10 +376,14 @@ static void punt_bios_to_rescuer(struct bio_set *bs)
         bio_list_init(&punt);
         bio_list_init(&nopunt);
 
-        while ((bio = bio_list_pop(current->bio_list)))
+        while ((bio = bio_list_pop(&current->bio_list[0])))
                 bio_list_add(bio->bi_pool == bs ? &punt : &nopunt, bio);
+        current->bio_list[0] = nopunt;
 
-        *current->bio_list = nopunt;
+        bio_list_init(&nopunt);
+        while ((bio = bio_list_pop(&current->bio_list[1])))
+                bio_list_add(bio->bi_pool == bs ? &punt : &nopunt, bio);
+        current->bio_list[1] = nopunt;
 
         spin_lock(&bs->rescue_lock);
         bio_list_merge(&bs->rescue_list, &punt);
@@ -466,7 +470,9 @@ struct bio *bio_alloc_bioset(gfp_t gfp_mask, int nr_iovecs, struct bio_set *bs)
                  * we retry with the original gfp_flags.
                  */
 
-                if (current->bio_list && !bio_list_empty(current->bio_list))
+                if (current->bio_list &&
+                    (!bio_list_empty(&current->bio_list[0]) ||
+                     !bio_list_empty(&current->bio_list[1])))
                         gfp_mask &= ~__GFP_DIRECT_RECLAIM;
 
                 p = mempool_alloc(bs->bio_pool, gfp_mask);
diff --git a/block/blk-core.c b/block/blk-core.c
index 1086dac8724c..d772c221cc17 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -578,8 +578,6 @@ void blk_cleanup_queue(struct request_queue *q)
                 q->queue_lock = &q->__queue_lock;
         spin_unlock_irq(lock);
 
-        put_disk_devt(q->disk_devt);
-
         /* @q is and will stay empty, shutdown and put */
         blk_put_queue(q);
 }
@@ -1975,7 +1973,14 @@ end_io:
  */
 blk_qc_t generic_make_request(struct bio *bio)
 {
-        struct bio_list bio_list_on_stack;
+        /*
+         * bio_list_on_stack[0] contains bios submitted by the current
+         * make_request_fn.
+         * bio_list_on_stack[1] contains bios that were submitted before
+         * the current make_request_fn, but that haven't been processed
+         * yet.
+         */
+        struct bio_list bio_list_on_stack[2];
         blk_qc_t ret = BLK_QC_T_NONE;
 
         if (!generic_make_request_checks(bio))
@@ -1992,7 +1997,7 @@ blk_qc_t generic_make_request(struct bio *bio)
          * should be added at the tail
          */
         if (current->bio_list) {
-                bio_list_add(current->bio_list, bio);
+                bio_list_add(&current->bio_list[0], bio);
                 goto out;
         }
 
@@ -2011,23 +2016,39 @@ blk_qc_t generic_make_request(struct bio *bio)
          * bio_list, and call into ->make_request() again.
          */
         BUG_ON(bio->bi_next);
-        bio_list_init(&bio_list_on_stack);
-        current->bio_list = &bio_list_on_stack;
+        bio_list_init(&bio_list_on_stack[0]);
+        current->bio_list = bio_list_on_stack;
         do {
                 struct request_queue *q = bdev_get_queue(bio->bi_bdev);
 
                 if (likely(blk_queue_enter(q, false) == 0)) {
+                        struct bio_list lower, same;
+
+                        /* Create a fresh bio_list for all subordinate requests */
+                        bio_list_on_stack[1] = bio_list_on_stack[0];
+                        bio_list_init(&bio_list_on_stack[0]);
                         ret = q->make_request_fn(q, bio);
 
                         blk_queue_exit(q);
 
-                        bio = bio_list_pop(current->bio_list);
+                        /* sort new bios into those for a lower level
+                         * and those for the same level
+                         */
+                        bio_list_init(&lower);
+                        bio_list_init(&same);
+                        while ((bio = bio_list_pop(&bio_list_on_stack[0])) != NULL)
+                                if (q == bdev_get_queue(bio->bi_bdev))
+                                        bio_list_add(&same, bio);
+                                else
+                                        bio_list_add(&lower, bio);
+                        /* now assemble so we handle the lowest level first */
+                        bio_list_merge(&bio_list_on_stack[0], &lower);
+                        bio_list_merge(&bio_list_on_stack[0], &same);
+                        bio_list_merge(&bio_list_on_stack[0], &bio_list_on_stack[1]);
                 } else {
-                        struct bio *bio_next = bio_list_pop(current->bio_list);
-
                         bio_io_error(bio);
-                        bio = bio_next;
                 }
+                bio = bio_list_pop(&bio_list_on_stack[0]);
         } while (bio);
         current->bio_list = NULL; /* deactivate */
 
diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index 295e69670c39..d745ab81033a 100644
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -17,6 +17,15 @@ static void blk_mq_sysfs_release(struct kobject *kobj)
 {
 }
 
+static void blk_mq_hw_sysfs_release(struct kobject *kobj)
+{
+        struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx,
+                                                  kobj);
+        free_cpumask_var(hctx->cpumask);
+        kfree(hctx->ctxs);
+        kfree(hctx);
+}
+
 struct blk_mq_ctx_sysfs_entry {
         struct attribute attr;
         ssize_t (*show)(struct blk_mq_ctx *, char *);
@@ -200,7 +209,7 @@ static struct kobj_type blk_mq_ctx_ktype = {
 static struct kobj_type blk_mq_hw_ktype = {
         .sysfs_ops      = &blk_mq_hw_sysfs_ops,
         .default_attrs  = default_hw_ctx_attrs,
-        .release        = blk_mq_sysfs_release,
+        .release        = blk_mq_hw_sysfs_release,
 };
 
 static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
@@ -242,24 +251,15 @@ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
 static void __blk_mq_unregister_dev(struct device *dev, struct request_queue *q)
 {
         struct blk_mq_hw_ctx *hctx;
-        struct blk_mq_ctx *ctx;
-        int i, j;
+        int i;
 
-        queue_for_each_hw_ctx(q, hctx, i) {
+        queue_for_each_hw_ctx(q, hctx, i)
                 blk_mq_unregister_hctx(hctx);
 
-                hctx_for_each_ctx(hctx, ctx, j)
-                        kobject_put(&ctx->kobj);
-
-                kobject_put(&hctx->kobj);
-        }
-
         blk_mq_debugfs_unregister_hctxs(q);
 
         kobject_uevent(&q->mq_kobj, KOBJ_REMOVE);
         kobject_del(&q->mq_kobj);
-        kobject_put(&q->mq_kobj);
-
         kobject_put(&dev->kobj);
 
         q->mq_sysfs_init_done = false;
@@ -277,7 +277,19 @@ void blk_mq_hctx_kobj_init(struct blk_mq_hw_ctx *hctx)
         kobject_init(&hctx->kobj, &blk_mq_hw_ktype);
 }
 
-static void blk_mq_sysfs_init(struct request_queue *q)
+void blk_mq_sysfs_deinit(struct request_queue *q)
+{
+        struct blk_mq_ctx *ctx;
+        int cpu;
+
+        for_each_possible_cpu(cpu) {
+                ctx = per_cpu_ptr(q->queue_ctx, cpu);
+                kobject_put(&ctx->kobj);
+        }
+        kobject_put(&q->mq_kobj);
+}
+
+void blk_mq_sysfs_init(struct request_queue *q)
 {
         struct blk_mq_ctx *ctx;
         int cpu;
@@ -297,8 +309,6 @@ int blk_mq_register_dev(struct device *dev, struct request_queue *q)
 
         blk_mq_disable_hotplug();
 
-        blk_mq_sysfs_init(q);
-
         ret = kobject_add(&q->mq_kobj, kobject_get(&dev->kobj), "%s", "mq");
         if (ret < 0)
                 goto out;
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index e48bc2c72615..9d97bfc4d465 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -295,6 +295,9 @@ int blk_mq_reinit_tagset(struct blk_mq_tag_set *set)
         for (i = 0; i < set->nr_hw_queues; i++) {
                 struct blk_mq_tags *tags = set->tags[i];
 
+                if (!tags)
+                        continue;
+
                 for (j = 0; j < tags->nr_tags; j++) {
                         if (!tags->static_rqs[j])
                                 continue;
diff --git a/block/blk-mq.c b/block/blk-mq.c
index b2fd175e84d7..6b6e7bc041db 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -697,17 +697,8 @@ static void blk_mq_check_expired(struct blk_mq_hw_ctx *hctx,
 {
         struct blk_mq_timeout_data *data = priv;
 
-        if (!test_bit(REQ_ATOM_STARTED, &rq->atomic_flags)) {
-                /*
-                 * If a request wasn't started before the queue was
-                 * marked dying, kill it here or it'll go unnoticed.
-                 */
-                if (unlikely(blk_queue_dying(rq->q))) {
-                        rq->errors = -EIO;
-                        blk_mq_end_request(rq, rq->errors);
-                }
+        if (!test_bit(REQ_ATOM_STARTED, &rq->atomic_flags))
                 return;
-        }
 
         if (time_after_eq(jiffies, rq->deadline)) {
                 if (!blk_mark_rq_complete(rq))
@@ -978,7 +969,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
         struct request *rq;
         LIST_HEAD(driver_list);
         struct list_head *dptr;
-        int queued, ret = BLK_MQ_RQ_QUEUE_OK;
+        int errors, queued, ret = BLK_MQ_RQ_QUEUE_OK;
 
         /*
          * Start off with dptr being NULL, so we start the first request
@@ -989,7 +980,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
         /*
          * Now process all the entries, sending them to the driver.
          */
-        queued = 0;
+        errors = queued = 0;
         while (!list_empty(list)) {
                 struct blk_mq_queue_data bd;
 
@@ -1046,6 +1037,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
                 default:
                         pr_err("blk-mq: bad return on queue: %d\n", ret);
                 case BLK_MQ_RQ_QUEUE_ERROR:
+                        errors++;
                         rq->errors = -EIO;
                         blk_mq_end_request(rq, rq->errors);
                         break;
@@ -1097,7 +1089,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
                         blk_mq_run_hw_queue(hctx, true);
         }
 
-        return queued != 0;
+        return (queued + errors) != 0;
 }
 
 static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx)
@@ -1434,7 +1426,8 @@ static blk_qc_t request_to_qc_t(struct blk_mq_hw_ctx *hctx, struct request *rq)
         return blk_tag_to_qc_t(rq->internal_tag, hctx->queue_num, true);
 }
 
-static void blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie)
+static void blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie,
+                                      bool may_sleep)
 {
         struct request_queue *q = rq->q;
         struct blk_mq_queue_data bd = {
@@ -1475,7 +1468,7 @@ static void blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie)
         }
 
 insert:
-        blk_mq_sched_insert_request(rq, false, true, true, false);
+        blk_mq_sched_insert_request(rq, false, true, false, may_sleep);
 }
 
 /*
@@ -1569,11 +1562,11 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
 
                 if (!(data.hctx->flags & BLK_MQ_F_BLOCKING)) {
                         rcu_read_lock();
-                        blk_mq_try_issue_directly(old_rq, &cookie);
+                        blk_mq_try_issue_directly(old_rq, &cookie, false);
                         rcu_read_unlock();
                 } else {
                         srcu_idx = srcu_read_lock(&data.hctx->queue_rq_srcu);
-                        blk_mq_try_issue_directly(old_rq, &cookie);
+                        blk_mq_try_issue_directly(old_rq, &cookie, true);
                         srcu_read_unlock(&data.hctx->queue_rq_srcu, srcu_idx);
                 }
                 goto done;
@@ -1955,16 +1948,6 @@ static void blk_mq_exit_hw_queues(struct request_queue *q,
         }
 }
 
-static void blk_mq_free_hw_queues(struct request_queue *q,
-                struct blk_mq_tag_set *set)
-{
-        struct blk_mq_hw_ctx *hctx;
-        unsigned int i;
-
-        queue_for_each_hw_ctx(q, hctx, i)
-                free_cpumask_var(hctx->cpumask);
-}
-
 static int blk_mq_init_hctx(struct request_queue *q,
                 struct blk_mq_tag_set *set,
                 struct blk_mq_hw_ctx *hctx, unsigned hctx_idx)
@@ -2045,7 +2028,6 @@ static void blk_mq_init_cpu_queues(struct request_queue *q,
                 struct blk_mq_ctx *__ctx = per_cpu_ptr(q->queue_ctx, i);
                 struct blk_mq_hw_ctx *hctx;
 
-                memset(__ctx, 0, sizeof(*__ctx));
                 __ctx->cpu = i;
                 spin_lock_init(&__ctx->lock);
                 INIT_LIST_HEAD(&__ctx->rq_list);
@@ -2257,15 +2239,19 @@ void blk_mq_release(struct request_queue *q)
         queue_for_each_hw_ctx(q, hctx, i) {
                 if (!hctx)
                         continue;
-                kfree(hctx->ctxs);
-                kfree(hctx);
+                kobject_put(&hctx->kobj);
         }
 
         q->mq_map = NULL;
 
         kfree(q->queue_hw_ctx);
 
-        /* ctx kobj stays in queue_ctx */
+        /*
+         * release .mq_kobj and sw queue's kobject now because
+         * both share lifetime with request queue.
+         */
+        blk_mq_sysfs_deinit(q);
+
         free_percpu(q->queue_ctx);
 }
 
@@ -2330,10 +2316,7 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
                         if (hctx->tags)
                                 blk_mq_free_map_and_requests(set, j);
                         blk_mq_exit_hctx(q, set, hctx, j);
-                        free_cpumask_var(hctx->cpumask);
                         kobject_put(&hctx->kobj);
-                        kfree(hctx->ctxs);
-                        kfree(hctx);
                         hctxs[j] = NULL;
 
                 }
@@ -2352,6 +2335,9 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
         if (!q->queue_ctx)
                 goto err_exit;
 
+        /* init q->mq_kobj and sw queues' kobjects */
+        blk_mq_sysfs_init(q);
+
         q->queue_hw_ctx = kzalloc_node(nr_cpu_ids * sizeof(*(q->queue_hw_ctx)),
                                                 GFP_KERNEL, set->numa_node);
         if (!q->queue_hw_ctx)
@@ -2442,7 +2428,6 @@ void blk_mq_free_queue(struct request_queue *q)
         blk_mq_del_queue_tag_set(q);
 
         blk_mq_exit_hw_queues(q, set, set->nr_hw_queues);
-        blk_mq_free_hw_queues(q, set);
 }
 
 /* Basically redo blk_mq_init_queue with queue frozen */
diff --git a/block/blk-mq.h b/block/blk-mq.h
index 088ced003c13..b79f9a7d8cf6 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -77,6 +77,8 @@ static inline struct blk_mq_hw_ctx *blk_mq_map_queue(struct request_queue *q,
 /*
  * sysfs helpers
  */
+extern void blk_mq_sysfs_init(struct request_queue *q);
+extern void blk_mq_sysfs_deinit(struct request_queue *q);
 extern int blk_mq_sysfs_register(struct request_queue *q);
 extern void blk_mq_sysfs_unregister(struct request_queue *q);
 extern void blk_mq_hctx_kobj_init(struct blk_mq_hw_ctx *hctx);
diff --git a/block/blk-stat.c b/block/blk-stat.c
index 9b43efb8933f..186fcb981e9b 100644
--- a/block/blk-stat.c
+++ b/block/blk-stat.c
@@ -30,11 +30,11 @@ static void blk_stat_flush_batch(struct blk_rq_stat *stat)
 
 static void blk_stat_sum(struct blk_rq_stat *dst, struct blk_rq_stat *src)
 {
+        blk_stat_flush_batch(src);
+
         if (!src->nr_samples)
                 return;
 
-        blk_stat_flush_batch(src);
-
         dst->min = min(dst->min, src->min);
         dst->max = max(dst->max, src->max);
 
diff --git a/block/genhd.c b/block/genhd.c
index b26a5ea115d0..a9c516a8b37d 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -572,20 +572,6 @@ exit:
         disk_part_iter_exit(&piter);
 }
 
-void put_disk_devt(struct disk_devt *disk_devt)
-{
-        if (disk_devt && atomic_dec_and_test(&disk_devt->count))
-                disk_devt->release(disk_devt);
-}
-EXPORT_SYMBOL(put_disk_devt);
-
-void get_disk_devt(struct disk_devt *disk_devt)
-{
-        if (disk_devt)
-                atomic_inc(&disk_devt->count);
-}
-EXPORT_SYMBOL(get_disk_devt);
-
 /**
  * device_add_disk - add partitioning information to kernel list
  * @parent: parent device for the disk
@@ -626,13 +612,6 @@ void device_add_disk(struct device *parent, struct gendisk *disk)
 
         disk_alloc_events(disk);
 
-        /*
-         * Take a reference on the devt and assign it to queue since it
-         * must not be reallocated while the bdi is registered
-         */
-        disk->queue->disk_devt = disk->disk_devt;
-        get_disk_devt(disk->disk_devt);
-
         /* Register BDI before referencing it from bdev */
         bdi = disk->queue->backing_dev_info;
         bdi_register_owner(bdi, disk_to_dev(disk));
@@ -681,12 +660,16 @@ void del_gendisk(struct gendisk *disk)
         disk->flags &= ~GENHD_FL_UP;
 
         sysfs_remove_link(&disk_to_dev(disk)->kobj, "bdi");
-        /*
-         * Unregister bdi before releasing device numbers (as they can get
-         * reused and we'd get clashes in sysfs).
-         */
-        bdi_unregister(disk->queue->backing_dev_info);
-        blk_unregister_queue(disk);
+        if (disk->queue) {
+                /*
+                 * Unregister bdi before releasing device numbers (as they can
+                 * get reused and we'd get clashes in sysfs).
+                 */
+                bdi_unregister(disk->queue->backing_dev_info);
+                blk_unregister_queue(disk);
+        } else {
+                WARN_ON(1);
+        }
         blk_unregister_region(disk_devt(disk), disk->minors);
 
         part_stat_set_all(&disk->part0, 0);
diff --git a/block/sed-opal.c b/block/sed-opal.c
index 1e18dca360fc..14035f826b5e 100644
--- a/block/sed-opal.c
+++ b/block/sed-opal.c
@@ -1023,7 +1023,6 @@ static int finalize_and_send(struct opal_dev *dev, cont_fn cont)
 
 static int gen_key(struct opal_dev *dev, void *data)
 {
-        const u8 *method;
         u8 uid[OPAL_UID_LENGTH];
         int err = 0;
 
@@ -1031,7 +1030,6 @@ static int gen_key(struct opal_dev *dev, void *data)
         set_comid(dev, dev->comid);
 
         memcpy(uid, dev->prev_data, min(sizeof(uid), dev->prev_d_len));
-        method = opalmethod[OPAL_GENKEY];
         kfree(dev->prev_data);
         dev->prev_data = NULL;
 
@@ -1669,7 +1667,6 @@ static int add_user_to_lr(struct opal_dev *dev, void *data)
 static int lock_unlock_locking_range(struct opal_dev *dev, void *data)
 {
         u8 lr_buffer[OPAL_UID_LENGTH];
-        const u8 *method;
         struct opal_lock_unlock *lkul = data;
         u8 read_locked = 1, write_locked = 1;
         int err = 0;
@@ -1677,7 +1674,6 @@ static int lock_unlock_locking_range(struct opal_dev *dev, void *data)
         clear_opal_cmd(dev);
         set_comid(dev, dev->comid);
 
-        method = opalmethod[OPAL_SET];
         if (build_locking_range(lr_buffer, sizeof(lr_buffer),
                                 lkul->session.opal_key.lr) < 0)
                 return -ERANGE;
@@ -1733,14 +1729,12 @@ static int lock_unlock_locking_range_sum(struct opal_dev *dev, void *data)
 {
         u8 lr_buffer[OPAL_UID_LENGTH];
         u8 read_locked = 1, write_locked = 1;
-        const u8 *method;
         struct opal_lock_unlock *lkul = data;
         int ret;
 
         clear_opal_cmd(dev);
         set_comid(dev, dev->comid);
 
-        method = opalmethod[OPAL_SET];
         if (build_locking_range(lr_buffer, sizeof(lr_buffer),
                                 lkul->session.opal_key.lr) < 0)
                 return -ERANGE;
@@ -2133,7 +2127,7 @@ static int opal_add_user_to_lr(struct opal_dev *dev,
                 pr_err("Locking state was not RO or RW\n");
                 return -EINVAL;
         }
-        if (lk_unlk->session.who < OPAL_USER1 &&
+        if (lk_unlk->session.who < OPAL_USER1 ||
             lk_unlk->session.who > OPAL_USER9) {
                 pr_err("Authority was not within the range of users: %d\n",
                        lk_unlk->session.who);
@@ -2316,7 +2310,7 @@ static int opal_activate_user(struct opal_dev *dev,
         int ret;
 
         /* We can't activate Admin1 it's active as manufactured */
-        if (opal_session->who < OPAL_USER1 &&
+        if (opal_session->who < OPAL_USER1 ||
             opal_session->who > OPAL_USER9) {
                 pr_err("Who was not a valid user: %d\n", opal_session->who);
                 return -EINVAL;
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index f5e18c2a4852..690deca17c35 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -266,7 +266,7 @@ unlock:
         return err;
 }
 
-int af_alg_accept(struct sock *sk, struct socket *newsock)
+int af_alg_accept(struct sock *sk, struct socket *newsock, bool kern)
 {
         struct alg_sock *ask = alg_sk(sk);
         const struct af_alg_type *type;
@@ -281,7 +281,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
         if (!type)
                 goto unlock;
 
-        sk2 = sk_alloc(sock_net(sk), PF_ALG, GFP_KERNEL, &alg_proto, 0);
+        sk2 = sk_alloc(sock_net(sk), PF_ALG, GFP_KERNEL, &alg_proto, kern);
         err = -ENOMEM;
         if (!sk2)
                 goto unlock;
@@ -323,9 +323,10 @@ unlock:
 }
 EXPORT_SYMBOL_GPL(af_alg_accept);
 
-static int alg_accept(struct socket *sock, struct socket *newsock, int flags)
+static int alg_accept(struct socket *sock, struct socket *newsock, int flags,
+                      bool kern)
 {
-        return af_alg_accept(sock->sk, newsock);
+        return af_alg_accept(sock->sk, newsock, kern);
 }
 
 static const struct proto_ops alg_proto_ops = {
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index 54fc90e8339c..5e92bd275ef3 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -239,7 +239,8 @@ unlock:
         return err ?: len;
 }
 
-static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
+static int hash_accept(struct socket *sock, struct socket *newsock, int flags,
+                       bool kern)
 {
         struct sock *sk = sock->sk;
         struct alg_sock *ask = alg_sk(sk);
@@ -260,7 +261,7 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
         if (err)
                 return err;
 
-        err = af_alg_accept(ask->parent, newsock);
+        err = af_alg_accept(ask->parent, newsock, kern);
         if (err)
                 return err;
 
@@ -378,7 +379,7 @@ static int hash_recvmsg_nokey(struct socket *sock, struct msghdr *msg,
 }
 
 static int hash_accept_nokey(struct socket *sock, struct socket *newsock,
-                             int flags)
+                             int flags, bool kern)
 {
         int err;
 
@@ -386,7 +387,7 @@ static int hash_accept_nokey(struct socket *sock, struct socket *newsock,
         if (err)
                 return err;
 
-        return hash_accept(sock, newsock, flags);
+        return hash_accept(sock, newsock, flags, kern);
 }
 
 static struct proto_ops algif_hash_ops_nokey = {
diff --git a/crypto/lrw.c b/crypto/lrw.c
index ecd8474018e3..3ea095adafd9 100644
--- a/crypto/lrw.c
+++ b/crypto/lrw.c
@@ -286,8 +286,11 @@ static int init_crypt(struct skcipher_request *req, crypto_completion_t done)
 
         subreq->cryptlen = LRW_BUFFER_SIZE;
         if (req->cryptlen > LRW_BUFFER_SIZE) {
-                subreq->cryptlen = min(req->cryptlen, (unsigned)PAGE_SIZE);
-                rctx->ext = kmalloc(subreq->cryptlen, gfp);
+                unsigned int n = min(req->cryptlen, (unsigned int)PAGE_SIZE);
+
+                rctx->ext = kmalloc(n, gfp);
+                if (rctx->ext)
+                        subreq->cryptlen = n;
         }
 
         rctx->src = req->src;
diff --git a/crypto/xts.c b/crypto/xts.c
index baeb34dd8582..c976bfac29da 100644
--- a/crypto/xts.c
+++ b/crypto/xts.c
@@ -230,8 +230,11 @@ static int init_crypt(struct skcipher_request *req, crypto_completion_t done)
 
         subreq->cryptlen = XTS_BUFFER_SIZE;
         if (req->cryptlen > XTS_BUFFER_SIZE) {
-                subreq->cryptlen = min(req->cryptlen, (unsigned)PAGE_SIZE);
-                rctx->ext = kmalloc(subreq->cryptlen, gfp);
+                unsigned int n = min(req->cryptlen, (unsigned int)PAGE_SIZE);
+
+                rctx->ext = kmalloc(n, gfp);
+                if (rctx->ext)
+                        subreq->cryptlen = n;
         }
 
         rctx->src = req->src;
diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
index a391bbc48105..d94f92f88ca1 100644
--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -2,7 +2,6 @@
 # Makefile for the Linux ACPI interpreter
 #
 
-ccflags-y                       := -Os
 ccflags-$(CONFIG_ACPI_DEBUG)    += -DACPI_DEBUG_OUTPUT
 
 #
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index b4c1a6a51da4..03250e1f1103 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -25,9 +25,11 @@
 ACPI_MODULE_NAME("platform");
 
 static const struct acpi_device_id forbidden_id_list[] = {
-        {"PNP0000", 0}, /* PIC */
-        {"PNP0100", 0}, /* Timer */
-        {"PNP0200", 0}, /* AT DMA Controller */
+        {"PNP0000",  0},        /* PIC */
+        {"PNP0100",  0},        /* Timer */
+        {"PNP0200",  0},        /* AT DMA Controller */
+        {"ACPI0009", 0},        /* IOxAPIC */
+        {"ACPI000A", 0},        /* IOAPIC */
         {"", 0},
 };
 
diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
index 4467a8089ab8..0143135b3abe 100644
--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@@ -182,11 +182,6 @@ int __weak arch_register_cpu(int cpu)
 
 void __weak arch_unregister_cpu(int cpu) {}
 
-int __weak acpi_map_cpu2node(acpi_handle handle, int cpu, int physid)
-{
-        return -ENODEV;
-}
-
 static int acpi_processor_hotadd_init(struct acpi_processor *pr)
 {
         unsigned long long sta;
@@ -285,6 +280,13 @@ static int acpi_processor_get_info(struct acpi_device *device)
                 pr->acpi_id = value;
         }
 
+        if (acpi_duplicate_processor_id(pr->acpi_id)) {
+                dev_err(&device->dev,
+                        "Failed to get unique processor _UID (0x%x)\n",
+                        pr->acpi_id);
+                return -ENODEV;
+        }
+
         pr->phys_id = acpi_get_phys_id(pr->handle, device_declaration,
                                         pr->acpi_id);
         if (invalid_phys_cpuid(pr->phys_id))
@@ -585,7 +587,7 @@ static struct acpi_scan_handler processor_container_handler = {
 static int nr_unique_ids __initdata;
 
 /* The number of the duplicate processor IDs */
-static int nr_duplicate_ids __initdata;
+static int nr_duplicate_ids;
 
 /* Used to store the unique processor IDs */
 static int unique_processor_ids[] __initdata = {
@@ -593,7 +595,7 @@ static int unique_processor_ids[] __initdata = {
 };
 
 /* Used to store the duplicate processor IDs */
-static int duplicate_processor_ids[] __initdata = {
+static int duplicate_processor_ids[] = {
         [0 ... NR_CPUS - 1] = -1,
 };
 
@@ -638,28 +640,53 @@ static acpi_status __init acpi_processor_ids_walk(acpi_handle handle,
                                                   void **rv)
 {
         acpi_status status;
+        acpi_object_type acpi_type;
+        unsigned long long uid;
         union acpi_object object = { 0 };
         struct acpi_buffer buffer = { sizeof(union acpi_object), &object };
 
-        status = acpi_evaluate_object(handle, NULL, NULL, &buffer);
+        status = acpi_get_type(handle, &acpi_type);
         if (ACPI_FAILURE(status))
-                acpi_handle_info(handle, "Not get the processor object\n");
-        else
-                processor_validated_ids_update(object.processor.proc_id);
+                return false;
+
+        switch (acpi_type) {
+        case ACPI_TYPE_PROCESSOR:
+                status = acpi_evaluate_object(handle, NULL, NULL, &buffer);
+                if (ACPI_FAILURE(status))
+                        goto err;
+                uid = object.processor.proc_id;
+                break;
+
+        case ACPI_TYPE_DEVICE:
+                status = acpi_evaluate_integer(handle, "_UID", NULL, &uid);
+                if (ACPI_FAILURE(status))
+                        goto err;
+                break;
+        default:
+                goto err;
+        }
+
+        processor_validated_ids_update(uid);
+        return true;
+
+err:
+        acpi_handle_info(handle, "Invalid processor object\n");
+        return false;
 
-        return AE_OK;
 }
 
-static void __init acpi_processor_check_duplicates(void)
+void __init acpi_processor_check_duplicates(void)
 {
-        /* Search all processor nodes in ACPI namespace */
+        /* check the correctness for all processors in ACPI namespace */
         acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
                                                 ACPI_UINT32_MAX,
                                                 acpi_processor_ids_walk,
                                                 NULL, NULL, NULL);
+        acpi_get_devices(ACPI_PROCESSOR_DEVICE_HID, acpi_processor_ids_walk,
+                                                NULL, NULL);
 }
 
-bool __init acpi_processor_validate_proc_id(int proc_id)
+bool acpi_duplicate_processor_id(int proc_id)
 {
         int i;
 
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index b192b42a8351..79b3c9c5a3bc 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -1073,6 +1073,7 @@ static int ghes_remove(struct platform_device *ghes_dev)
                 if (list_empty(&ghes_sci))
                         unregister_acpi_hed_notifier(&ghes_notifier_sci);
                 mutex_unlock(&ghes_list_mutex);
+                synchronize_rcu();
                 break;
         case ACPI_HEST_NOTIFY_NMI:
                 ghes_nmi_remove(ghes);
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 80cb5eb75b63..34fbe027e73a 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -1249,7 +1249,6 @@ static int __init acpi_init(void)
         acpi_wakeup_device_init();
         acpi_debugger_init();
         acpi_setup_sb_notify_handler();
-        acpi_set_processor_mapping();
         return 0;
 }
 
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 219b90bc0922..f15900132912 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -41,8 +41,10 @@ void acpi_gpe_apply_masked_gpes(void);
 void acpi_container_init(void);
 void acpi_memory_hotplug_init(void);
 #ifdef  CONFIG_ACPI_HOTPLUG_IOAPIC
+void pci_ioapic_remove(struct acpi_pci_root *root);
 int acpi_ioapic_remove(struct acpi_pci_root *root);
 #else
+static inline void pci_ioapic_remove(struct acpi_pci_root *root) { return; }
 static inline int acpi_ioapic_remove(struct acpi_pci_root *root) { return 0; }
 #endif
 #ifdef CONFIG_ACPI_DOCK
diff --git a/drivers/acpi/ioapic.c b/drivers/acpi/ioapic.c
index 6d7ce6e12aaa..7e4fbf9a53a3 100644
--- a/drivers/acpi/ioapic.c
+++ b/drivers/acpi/ioapic.c
@@ -45,6 +45,12 @@ static acpi_status setup_res(struct acpi_resource *acpi_res, void *data)
         struct resource *res = data;
         struct resource_win win;
 
+        /*
+         * We might assign this to 'res' later, make sure all pointers are
+         * cleared before the resource is added to the global list
+         */
+        memset(&win, 0, sizeof(win));
+
         res->flags = 0;
         if (acpi_dev_filter_resource_type(acpi_res, IORESOURCE_MEM))
                 return AE_OK;
@@ -206,24 +212,34 @@ int acpi_ioapic_add(acpi_handle root_handle)
         return ACPI_SUCCESS(status) && ACPI_SUCCESS(retval) ? 0 : -ENODEV;
 }
 
-int acpi_ioapic_remove(struct acpi_pci_root *root)
+void pci_ioapic_remove(struct acpi_pci_root *root)
 {
-        int retval = 0;
         struct acpi_pci_ioapic *ioapic, *tmp;
 
         mutex_lock(&ioapic_list_lock);
         list_for_each_entry_safe(ioapic, tmp, &ioapic_list, list) {
                 if (root->device->handle != ioapic->root_handle)
                         continue;
-
-                if (acpi_unregister_ioapic(ioapic->handle, ioapic->gsi_base))
-                        retval = -EBUSY;
-
                 if (ioapic->pdev) {
                         pci_release_region(ioapic->pdev, 0);
                         pci_disable_device(ioapic->pdev);
                         pci_dev_put(ioapic->pdev);
                 }
+        }
+        mutex_unlock(&ioapic_list_lock);
+}
+
+int acpi_ioapic_remove(struct acpi_pci_root *root)
+{
+        int retval = 0;
+        struct acpi_pci_ioapic *ioapic, *tmp;
+
+        mutex_lock(&ioapic_list_lock);
+        list_for_each_entry_safe(ioapic, tmp, &ioapic_list, list) {
+                if (root->device->handle != ioapic->root_handle)
+                        continue;
+                if (acpi_unregister_ioapic(ioapic->handle, ioapic->gsi_base))
+                        retval = -EBUSY;
                 if (ioapic->res.flags && ioapic->res.parent)
                         release_resource(&ioapic->res);
                 list_del(&ioapic->list);
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index bf601d4df8cf..919be0aa2578 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -648,12 +648,12 @@ static void acpi_pci_root_remove(struct acpi_device *device)
 
         pci_stop_root_bus(root->bus);
 
-        WARN_ON(acpi_ioapic_remove(root));
-
+        pci_ioapic_remove(root);
         device_set_run_wake(root->bus->bridge, false);
         pci_acpi_remove_bus_pm_notifier(device);
 
         pci_remove_root_bus(root->bus);
+        WARN_ON(acpi_ioapic_remove(root));
 
         dmar_device_remove(device->handle);
 
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 611a5585a902..b933061b6b60 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -32,12 +32,12 @@ static struct acpi_table_madt *get_madt_table(void)
 }
 
 static int map_lapic_id(struct acpi_subtable_header *entry,
-                 u32 acpi_id, phys_cpuid_t *apic_id, bool ignore_disabled)
+                 u32 acpi_id, phys_cpuid_t *apic_id)
 {
         struct acpi_madt_local_apic *lapic =
                 container_of(entry, struct acpi_madt_local_apic, header);
 
-        if (ignore_disabled && !(lapic->lapic_flags & ACPI_MADT_ENABLED))
+        if (!(lapic->lapic_flags & ACPI_MADT_ENABLED))
                 return -ENODEV;
 
         if (lapic->processor_id != acpi_id)
@@ -48,13 +48,12 @@ static int map_lapic_id(struct acpi_subtable_header *entry,
 }
 
 static int map_x2apic_id(struct acpi_subtable_header *entry,
-                int device_declaration, u32 acpi_id, phys_cpuid_t *apic_id,
-                bool ignore_disabled)
+                int device_declaration, u32 acpi_id, phys_cpuid_t *apic_id)
 {
         struct acpi_madt_local_x2apic *apic =
                 container_of(entry, struct acpi_madt_local_x2apic, header);
 
-        if (ignore_disabled && !(apic->lapic_flags & ACPI_MADT_ENABLED))
+        if (!(apic->lapic_flags & ACPI_MADT_ENABLED))
                 return -ENODEV;
 
         if (device_declaration && (apic->uid == acpi_id)) {
@@ -66,13 +65,12 @@ static int map_x2apic_id(struct acpi_subtable_header *entry,
 }
 
 static int map_lsapic_id(struct acpi_subtable_header *entry,
-                int device_declaration, u32 acpi_id, phys_cpuid_t *apic_id,
-                bool ignore_disabled)
+                int device_declaration, u32 acpi_id, phys_cpuid_t *apic_id)
 {
         struct acpi_madt_local_sapic *lsapic =
                 container_of(entry, struct acpi_madt_local_sapic, header);
 
-        if (ignore_disabled && !(lsapic->lapic_flags & ACPI_MADT_ENABLED))
+        if (!(lsapic->lapic_flags & ACPI_MADT_ENABLED))
                 return -ENODEV;
 
         if (device_declaration) {
@@ -89,13 +87,12 @@ static int map_lsapic_id(struct acpi_subtable_header *entry,
  * Retrieve the ARM CPU physical identifier (MPIDR)
  */
 static int map_gicc_mpidr(struct acpi_subtable_header *entry,
-                int device_declaration, u32 acpi_id, phys_cpuid_t *mpidr,
-                bool ignore_disabled)
+                int device_declaration, u32 acpi_id, phys_cpuid_t *mpidr)
 {
         struct acpi_madt_generic_interrupt *gicc =
             container_of(entry, struct acpi_madt_generic_interrupt, header);
 
-        if (ignore_disabled && !(gicc->flags & ACPI_MADT_ENABLED))
+        if (!(gicc->flags & ACPI_MADT_ENABLED))
                 return -ENODEV;
 
         /* device_declaration means Device object in DSDT, in the
@@ -112,7 +109,7 @@ static int map_gicc_mpidr(struct acpi_subtable_header *entry,
 }
 
 static phys_cpuid_t map_madt_entry(struct acpi_table_madt *madt,
-                                   int type, u32 acpi_id, bool ignore_disabled)
+                                   int type, u32 acpi_id)
 {
         unsigned long madt_end, entry;
         phys_cpuid_t phys_id = PHYS_CPUID_INVALID;      /* CPU hardware ID */
@@ -130,20 +127,16 @@ static phys_cpuid_t map_madt_entry(struct acpi_table_madt *madt,
                 struct acpi_subtable_header *header =
                         (struct acpi_subtable_header *)entry;
                 if (header->type == ACPI_MADT_TYPE_LOCAL_APIC) {
-                        if (!map_lapic_id(header, acpi_id, &phys_id,
-                                          ignore_disabled))
+                        if (!map_lapic_id(header, acpi_id, &phys_id))
                                 break;
                 } else if (header->type == ACPI_MADT_TYPE_LOCAL_X2APIC) {
-                        if (!map_x2apic_id(header, type, acpi_id, &phys_id,
-                                           ignore_disabled))
+                        if (!map_x2apic_id(header, type, acpi_id, &phys_id))
                                 break;
                 } else if (header->type == ACPI_MADT_TYPE_LOCAL_SAPIC) {
-                        if (!map_lsapic_id(header, type, acpi_id, &phys_id,
-                                           ignore_disabled))
+                        if (!map_lsapic_id(header, type, acpi_id, &phys_id))
                                 break;
                 } else if (header->type == ACPI_MADT_TYPE_GENERIC_INTERRUPT) {
-                        if (!map_gicc_mpidr(header, type, acpi_id, &phys_id,
-                                            ignore_disabled))
+                        if (!map_gicc_mpidr(header, type, acpi_id, &phys_id))
                                 break;
                 }
                 entry += header->length;
@@ -161,15 +154,14 @@ phys_cpuid_t __init acpi_map_madt_entry(u32 acpi_id)
         if (!madt)
                 return PHYS_CPUID_INVALID;
 
-        rv = map_madt_entry(madt, 1, acpi_id, true);
+        rv = map_madt_entry(madt, 1, acpi_id);
 
         acpi_put_table((struct acpi_table_header *)madt);
 
         return rv;
 }
 
-static phys_cpuid_t map_mat_entry(acpi_handle handle, int type, u32 acpi_id,
-                                  bool ignore_disabled)
+static phys_cpuid_t map_mat_entry(acpi_handle handle, int type, u32 acpi_id)
 {
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
         union acpi_object *obj;
@@ -190,38 +182,30 @@ static phys_cpuid_t map_mat_entry(acpi_handle handle, int type, u32 acpi_id,
 
         header = (struct acpi_subtable_header *)obj->buffer.pointer;
         if (header->type == ACPI_MADT_TYPE_LOCAL_APIC)
-                map_lapic_id(header, acpi_id, &phys_id, ignore_disabled);
+                map_lapic_id(header, acpi_id, &phys_id);
         else if (header->type == ACPI_MADT_TYPE_LOCAL_SAPIC)
-                map_lsapic_id(header, type, acpi_id, &phys_id, ignore_disabled);
+                map_lsapic_id(header, type, acpi_id, &phys_id);
         else if (header->type == ACPI_MADT_TYPE_LOCAL_X2APIC)
-                map_x2apic_id(header, type, acpi_id, &phys_id, ignore_disabled);
+                map_x2apic_id(header, type, acpi_id, &phys_id);
         else if (header->type == ACPI_MADT_TYPE_GENERIC_INTERRUPT)
-                map_gicc_mpidr(header, type, acpi_id, &phys_id,
-                               ignore_disabled);
+                map_gicc_mpidr(header, type, acpi_id, &phys_id);
 
 exit:
         kfree(buffer.pointer);
         return phys_id;
 }
 
-static phys_cpuid_t __acpi_get_phys_id(acpi_handle handle, int type,
-                                       u32 acpi_id, bool ignore_disabled)
+phys_cpuid_t acpi_get_phys_id(acpi_handle handle, int type, u32 acpi_id)
 {
         phys_cpuid_t phys_id;
 
-        phys_id = map_mat_entry(handle, type, acpi_id, ignore_disabled);
+        phys_id = map_mat_entry(handle, type, acpi_id);
         if (invalid_phys_cpuid(phys_id))
-                phys_id = map_madt_entry(get_madt_table(), type, acpi_id,
-                                           ignore_disabled);
+                phys_id = map_madt_entry(get_madt_table(), type, acpi_id);
 
         return phys_id;
 }
 
-phys_cpuid_t acpi_get_phys_id(acpi_handle handle, int type, u32 acpi_id)
-{
-        return __acpi_get_phys_id(handle, type, acpi_id, true);
-}
-
 int acpi_map_cpuid(phys_cpuid_t phys_id, u32 acpi_id)
 {
 #ifdef CONFIG_SMP
@@ -278,79 +262,6 @@ int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)
 }
 EXPORT_SYMBOL_GPL(acpi_get_cpuid);
 
-#ifdef CONFIG_ACPI_HOTPLUG_CPU
-static bool __init
-map_processor(acpi_handle handle, phys_cpuid_t *phys_id, int *cpuid)
-{
-        int type, id;
-        u32 acpi_id;
-        acpi_status status;
-        acpi_object_type acpi_type;
-        unsigned long long tmp;
-        union acpi_object object = { 0 };
-        struct acpi_buffer buffer = { sizeof(union acpi_object), &object };
-
-        status = acpi_get_type(handle, &acpi_type);
-        if (ACPI_FAILURE(status))
-                return false;
-
-        switch (acpi_type) {
-        case ACPI_TYPE_PROCESSOR:
-                status = acpi_evaluate_object(handle, NULL, NULL, &buffer);
-                if (ACPI_FAILURE(status))
-                        return false;
-                acpi_id = object.processor.proc_id;
-
-                /* validate the acpi_id */
-                if(acpi_processor_validate_proc_id(acpi_id))
-                        return false;
-                break;
-        case ACPI_TYPE_DEVICE:
-                status = acpi_evaluate_integer(handle, "_UID", NULL, &tmp);
-                if (ACPI_FAILURE(status))
-                        return false;
-                acpi_id = tmp;
-                break;
-        default:
-                return false;
-        }
-
-        type = (acpi_type == ACPI_TYPE_DEVICE) ? 1 : 0;
-
-        *phys_id = __acpi_get_phys_id(handle, type, acpi_id, false);
-        id = acpi_map_cpuid(*phys_id, acpi_id);
-
-        if (id < 0)
-                return false;
-        *cpuid = id;
-        return true;
-}
-
-static acpi_status __init
-set_processor_node_mapping(acpi_handle handle, u32 lvl, void *context,
-                           void **rv)
-{
-        phys_cpuid_t phys_id;
-        int cpu_id;
-
-        if (!map_processor(handle, &phys_id, &cpu_id))
-                return AE_ERROR;
-
-        acpi_map_cpu2node(handle, cpu_id, phys_id);
-        return AE_OK;
-}
-
-void __init acpi_set_processor_mapping(void)
-{
-        /* Set persistent cpu <-> node mapping for all processors. */
-        acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
-                            ACPI_UINT32_MAX, set_processor_node_mapping,
-                            NULL, NULL, NULL);
-}
-#else
-void __init acpi_set_processor_mapping(void) {}
-#endif /* CONFIG_ACPI_HOTPLUG_CPU */
-
 #ifdef CONFIG_ACPI_HOTPLUG_IOAPIC
 static int get_ioapic_id(struct acpi_subtable_header *entry, u32 gsi_base,
                          u64 *phys_addr, int *ioapic_id)
diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
index 01c94669a2b0..3afa8c1fa127 100644
--- a/drivers/acpi/spcr.c
+++ b/drivers/acpi/spcr.c
@@ -30,7 +30,7 @@ static bool qdf2400_erratum_44_present(struct acpi_table_header *h)
                 return true;
 
         if (!memcmp(h->oem_table_id, "QDF2400 ", ACPI_OEM_TABLE_ID_SIZE) &&
-                        h->oem_revision == 0)
+                        h->oem_revision == 1)
                 return true;
 
         return false;
diff --git a/drivers/ata/ahci_qoriq.c b/drivers/ata/ahci_qoriq.c
index 85d833289f28..4c96f3ac4976 100644
--- a/drivers/ata/ahci_qoriq.c
+++ b/drivers/ata/ahci_qoriq.c
@@ -177,7 +177,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
         case AHCI_LS1043A:
                 if (!qpriv->ecc_addr)
                         return -EINVAL;
-                writel(ECC_DIS_ARMV8_CH2, qpriv->ecc_addr);
+                writel(readl(qpriv->ecc_addr) | ECC_DIS_ARMV8_CH2,
+                                qpriv->ecc_addr);
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
@@ -194,7 +195,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
         case AHCI_LS1046A:
                 if (!qpriv->ecc_addr)
                         return -EINVAL;
-                writel(ECC_DIS_ARMV8_CH2, qpriv->ecc_addr);
+                writel(readl(qpriv->ecc_addr) | ECC_DIS_ARMV8_CH2,
+                                qpriv->ecc_addr);
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 2bd92dca3e62..274d6d7193d7 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -1482,7 +1482,6 @@ unsigned int ata_sff_qc_issue(struct ata_queued_cmd *qc)
                 break;
 
         default:
-                WARN_ON_ONCE(1);
                 return AC_ERR_SYSTEM;
         }
 
diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
index 46698232e6bf..19e6e539a061 100644
--- a/drivers/ata/libata-transport.c
+++ b/drivers/ata/libata-transport.c
@@ -224,7 +224,6 @@ static DECLARE_TRANSPORT_CLASS(ata_port_class,
 
 static void ata_tport_release(struct device *dev)
 {
-        put_device(dev->parent);
 }
 
 /**
@@ -284,7 +283,7 @@ int ata_tport_add(struct device *parent,
         device_initialize(dev);
         dev->type = &ata_port_type;
 
-        dev->parent = get_device(parent);
+        dev->parent = parent;
         dev->release = ata_tport_release;
         dev_set_name(dev, "ata%d", ap->print_id);
         transport_setup_device(dev);
@@ -348,7 +347,6 @@ static DECLARE_TRANSPORT_CLASS(ata_link_class,
 
 static void ata_tlink_release(struct device *dev)
 {
-        put_device(dev->parent);
 }
 
 /**
@@ -410,7 +408,7 @@ int ata_tlink_add(struct ata_link *link)
         int error;
 
         device_initialize(dev);
-        dev->parent = get_device(&ap->tdev);
+        dev->parent = &ap->tdev;
         dev->release = ata_tlink_release;
         if (ata_is_host_link(link))
                 dev_set_name(dev, "link%d", ap->print_id);
@@ -589,7 +587,6 @@ static DECLARE_TRANSPORT_CLASS(ata_dev_class,
 
 static void ata_tdev_release(struct device *dev)
 {
-        put_device(dev->parent);
 }
 
 /**
@@ -662,7 +659,7 @@ static int ata_tdev_add(struct ata_device *ata_dev)
         int error;
 
         device_initialize(dev);
-        dev->parent = get_device(&link->tdev);
+        dev->parent = &link->tdev;
         dev->release = ata_tdev_release;
         if (ata_is_host_link(link))
                 dev_set_name(dev, "dev%d.%d", ap->print_id,ata_dev->devno);
diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c
index bf43b5d2aafc..83f1439e57fd 100644
--- a/drivers/auxdisplay/img-ascii-lcd.c
+++ b/drivers/auxdisplay/img-ascii-lcd.c
@@ -218,6 +218,7 @@ static const struct of_device_id img_ascii_lcd_matches[] = {
         { .compatible = "img,boston-lcd", .data = &boston_config },
         { .compatible = "mti,malta-lcd", .data = &malta_config },
         { .compatible = "mti,sead3-lcd", .data = &sead3_config },
+        { /* sentinel */ }
 };
 
 /**
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 684bda4d14a1..6bb60fb6a30b 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -639,11 +639,6 @@ int lock_device_hotplug_sysfs(void)
         return restart_syscall();
 }
 
-void assert_held_device_hotplug(void)
-{
-        lockdep_assert_held(&device_hotplug_lock);
-}
-
 #ifdef CONFIG_BLOCK
 static inline int device_is_not_partition(struct device *dev)
 {
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 7e4287bc19e5..d8a23561b4cb 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -47,6 +47,8 @@ static DEFINE_MUTEX(nbd_index_mutex);
 struct nbd_sock {
         struct socket *sock;
         struct mutex tx_lock;
+        struct request *pending;
+        int sent;
 };
 
 #define NBD_TIMEDOUT                    0
@@ -124,7 +126,8 @@ static const char *nbdcmd_to_ascii(int cmd)
 
 static int nbd_size_clear(struct nbd_device *nbd, struct block_device *bdev)
 {
-        bd_set_size(bdev, 0);
+        if (bdev->bd_openers <= 1)
+                bd_set_size(bdev, 0);
         set_capacity(nbd->disk, 0);
         kobject_uevent(&nbd_to_dev(nbd)->kobj, KOBJ_CHANGE);
 
@@ -190,7 +193,7 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
 
         dev_err(nbd_to_dev(nbd), "Connection timed out, shutting down connection\n");
         set_bit(NBD_TIMEDOUT, &nbd->runtime_flags);
-        req->errors++;
+        req->errors = -EIO;
 
         mutex_lock(&nbd->config_lock);
         sock_shutdown(nbd);
@@ -202,7 +205,7 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
  *  Send or receive packet.
  */
 static int sock_xmit(struct nbd_device *nbd, int index, int send,
-                     struct iov_iter *iter, int msg_flags)
+                     struct iov_iter *iter, int msg_flags, int *sent)
 {
         struct socket *sock = nbd->socks[index]->sock;
         int result;
@@ -237,6 +240,8 @@ static int sock_xmit(struct nbd_device *nbd, int index, int send,
                                 result = -EPIPE; /* short read */
                         break;
                 }
+                if (sent)
+                        *sent += result;
         } while (msg_data_left(&msg));
 
         tsk_restore_flags(current, pflags, PF_MEMALLOC);
@@ -248,6 +253,7 @@ static int sock_xmit(struct nbd_device *nbd, int index, int send,
 static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
 {
         struct request *req = blk_mq_rq_from_pdu(cmd);
+        struct nbd_sock *nsock = nbd->socks[index];
         int result;
         struct nbd_request request = {.magic = htonl(NBD_REQUEST_MAGIC)};
         struct kvec iov = {.iov_base = &request, .iov_len = sizeof(request)};
@@ -256,6 +262,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
         struct bio *bio;
         u32 type;
         u32 tag = blk_mq_unique_tag(req);
+        int sent = nsock->sent, skip = 0;
 
         iov_iter_kvec(&from, WRITE | ITER_KVEC, &iov, 1, sizeof(request));
 
@@ -283,6 +290,17 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                 return -EIO;
         }
 
+        /* We did a partial send previously, and we at least sent the whole
+         * request struct, so just go and send the rest of the pages in the
+         * request.
+         */
+        if (sent) {
+                if (sent >= sizeof(request)) {
+                        skip = sent - sizeof(request);
+                        goto send_pages;
+                }
+                iov_iter_advance(&from, sent);
+        }
         request.type = htonl(type);
         if (type != NBD_CMD_FLUSH) {
                 request.from = cpu_to_be64((u64)blk_rq_pos(req) << 9);
@@ -294,15 +312,27 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                 cmd, nbdcmd_to_ascii(type),
                 (unsigned long long)blk_rq_pos(req) << 9, blk_rq_bytes(req));
         result = sock_xmit(nbd, index, 1, &from,
-                        (type == NBD_CMD_WRITE) ? MSG_MORE : 0);
+                        (type == NBD_CMD_WRITE) ? MSG_MORE : 0, &sent);
         if (result <= 0) {
+                if (result == -ERESTARTSYS) {
+                        /* If we havne't sent anything we can just return BUSY,
+                         * however if we have sent something we need to make
+                         * sure we only allow this req to be sent until we are
+                         * completely done.
+                         */
+                        if (sent) {
+                                nsock->pending = req;
+                                nsock->sent = sent;
+                        }
+                        return BLK_MQ_RQ_QUEUE_BUSY;
+                }
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                         "Send control failed (result %d)\n", result);
                 return -EIO;
         }
-
+send_pages:
         if (type != NBD_CMD_WRITE)
-                return 0;
+                goto out;
 
         bio = req->bio;
         while (bio) {
@@ -318,8 +348,25 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                                 cmd, bvec.bv_len);
                         iov_iter_bvec(&from, ITER_BVEC | WRITE,
                                       &bvec, 1, bvec.bv_len);
-                        result = sock_xmit(nbd, index, 1, &from, flags);
+                        if (skip) {
+                                if (skip >= iov_iter_count(&from)) {
+                                        skip -= iov_iter_count(&from);
+                                        continue;
+                                }
+                                iov_iter_advance(&from, skip);
+                                skip = 0;
+                        }
+                        result = sock_xmit(nbd, index, 1, &from, flags, &sent);
                         if (result <= 0) {
+                                if (result == -ERESTARTSYS) {
+                                        /* We've already sent the header, we
+                                         * have no choice but to set pending and
+                                         * return BUSY.
+                                         */
+                                        nsock->pending = req;
+                                        nsock->sent = sent;
+                                        return BLK_MQ_RQ_QUEUE_BUSY;
+                                }
                                 dev_err(disk_to_dev(nbd->disk),
                                         "Send data failed (result %d)\n",
                                         result);
@@ -336,6 +383,9 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                 }
                 bio = next;
         }
+out:
+        nsock->pending = NULL;
+        nsock->sent = 0;
         return 0;
 }
 
@@ -353,7 +403,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
 
         reply.magic = 0;
         iov_iter_kvec(&to, READ | ITER_KVEC, &iov, 1, sizeof(reply));
-        result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL);
+        result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL);
         if (result <= 0) {
                 if (!test_bit(NBD_DISCONNECTED, &nbd->runtime_flags) &&
                     !test_bit(NBD_DISCONNECT_REQUESTED, &nbd->runtime_flags))
@@ -383,7 +433,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
         if (ntohl(reply.error)) {
                 dev_err(disk_to_dev(nbd->disk), "Other side returned error (%d)\n",
                         ntohl(reply.error));
-                req->errors++;
+                req->errors = -EIO;
                 return cmd;
         }
 
@@ -395,11 +445,11 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
                 rq_for_each_segment(bvec, req, iter) {
                         iov_iter_bvec(&to, ITER_BVEC | READ,
                                       &bvec, 1, bvec.bv_len);
-                        result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL);
+                        result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL);
                         if (result <= 0) {
                                 dev_err(disk_to_dev(nbd->disk), "Receive data failed (result %d)\n",
                                         result);
-                                req->errors++;
+                                req->errors = -EIO;
                                 return cmd;
                         }
                         dev_dbg(nbd_to_dev(nbd), "request %p: got %d bytes data\n",
@@ -469,7 +519,7 @@ static void nbd_clear_req(struct request *req, void *data, bool reserved)
         if (!blk_mq_request_started(req))
                 return;
         cmd = blk_mq_rq_to_pdu(req);
-        req->errors++;
+        req->errors = -EIO;
         nbd_end_request(cmd);
 }
 
@@ -482,22 +532,23 @@ static void nbd_clear_que(struct nbd_device *nbd)
 }
 
 
-static void nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
 {
         struct request *req = blk_mq_rq_from_pdu(cmd);
         struct nbd_device *nbd = cmd->nbd;
         struct nbd_sock *nsock;
+        int ret;
 
         if (index >= nbd->num_connections) {
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                                     "Attempted send on invalid socket\n");
-                goto error_out;
+                return -EINVAL;
         }
 
         if (test_bit(NBD_DISCONNECTED, &nbd->runtime_flags)) {
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                                     "Attempted send on closed socket\n");
-                goto error_out;
+                return -EINVAL;
         }
 
         req->errors = 0;
@@ -508,29 +559,30 @@ static void nbd_handle_cmd(struct nbd_cmd *cmd, int index)
                 mutex_unlock(&nsock->tx_lock);
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                                     "Attempted send on closed socket\n");
-                goto error_out;
+                return -EINVAL;
         }
 
-        if (nbd_send_cmd(nbd, cmd, index) != 0) {
-                dev_err_ratelimited(disk_to_dev(nbd->disk),
-                                    "Request send failed\n");
-                req->errors++;
-                nbd_end_request(cmd);
+        /* Handle the case that we have a pending request that was partially
+         * transmitted that _has_ to be serviced first.  We need to call requeue
+         * here so that it gets put _after_ the request that is already on the
+         * dispatch list.
+         */
+        if (unlikely(nsock->pending && nsock->pending != req)) {
+                blk_mq_requeue_request(req, true);
+                ret = 0;
+                goto out;
         }
-
+        ret = nbd_send_cmd(nbd, cmd, index);
+out:
         mutex_unlock(&nsock->tx_lock);
-
-        return;
-
-error_out:
-        req->errors++;
-        nbd_end_request(cmd);
+        return ret;
 }
 
 static int nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
                         const struct blk_mq_queue_data *bd)
 {
         struct nbd_cmd *cmd = blk_mq_rq_to_pdu(bd->rq);
+        int ret;
 
         /*
          * Since we look at the bio's to send the request over the network we
@@ -543,10 +595,20 @@ static int nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
          */
         init_completion(&cmd->send_complete);
         blk_mq_start_request(bd->rq);
-        nbd_handle_cmd(cmd, hctx->queue_num);
+
+        /* We can be called directly from the user space process, which means we
+         * could possibly have signals pending so our sendmsg will fail.  In
+         * this case we need to return that we are busy, otherwise error out as
+         * appropriate.
+         */
+        ret = nbd_handle_cmd(cmd, hctx->queue_num);
+        if (ret < 0)
+                ret = BLK_MQ_RQ_QUEUE_ERROR;
+        if (!ret)
+                ret = BLK_MQ_RQ_QUEUE_OK;
         complete(&cmd->send_complete);
 
-        return BLK_MQ_RQ_QUEUE_OK;
+        return ret;
 }
 
 static int nbd_add_socket(struct nbd_device *nbd, struct block_device *bdev,
@@ -581,6 +643,8 @@ static int nbd_add_socket(struct nbd_device *nbd, struct block_device *bdev,
 
         mutex_init(&nsock->tx_lock);
         nsock->sock = sock;
+        nsock->pending = NULL;
+        nsock->sent = 0;
         socks[nbd->num_connections++] = nsock;
 
         if (max_part)
@@ -602,6 +666,8 @@ static void nbd_reset(struct nbd_device *nbd)
 
 static void nbd_bdev_reset(struct block_device *bdev)
 {
+        if (bdev->bd_openers > 1)
+                return;
         set_device_ro(bdev, false);
         bdev->bd_inode->i_size = 0;
         if (max_part > 0) {
@@ -634,7 +700,7 @@ static void send_disconnects(struct nbd_device *nbd)
 
         for (i = 0; i < nbd->num_connections; i++) {
                 iov_iter_kvec(&from, WRITE | ITER_KVEC, &iov, 1, sizeof(request));
-                ret = sock_xmit(nbd, i, 1, &from, 0);
+                ret = sock_xmit(nbd, i, 1, &from, 0, NULL);
                 if (ret <= 0)
                         dev_err(disk_to_dev(nbd->disk),
                                 "Send disconnect failed %d\n", ret);
@@ -665,7 +731,8 @@ static int nbd_clear_sock(struct nbd_device *nbd, struct block_device *bdev)
 {
         sock_shutdown(nbd);
         nbd_clear_que(nbd);
-        kill_bdev(bdev);
+
+        __invalidate_device(bdev, true);
         nbd_bdev_reset(bdev);
         /*
          * We want to give the run thread a chance to wait for everybody
@@ -781,7 +848,10 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                 nbd_size_set(nbd, bdev, nbd->blksize, arg);
                 return 0;
         case NBD_SET_TIMEOUT:
-                nbd->tag_set.timeout = arg * HZ;
+                if (arg) {
+                        nbd->tag_set.timeout = arg * HZ;
+                        blk_queue_rq_timeout(nbd->disk->queue, arg * HZ);
+                }
                 return 0;
 
         case NBD_SET_FLAGS:
diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c
index 10aed84244f5..939641d6e262 100644
--- a/drivers/block/paride/pcd.c
+++ b/drivers/block/paride/pcd.c
@@ -50,7 +50,7 @@
                         the slower the port i/o.  In some cases, setting
                         this to zero will speed up the device. (default -1)
                         
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (46) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c
index 644ba0888bd4..9cfd2e06a649 100644
--- a/drivers/block/paride/pd.c
+++ b/drivers/block/paride/pd.c
@@ -61,7 +61,7 @@
                         first drive found.
                         
 
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (45) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/paride/pf.c b/drivers/block/paride/pf.c
index ed93e8badf56..14c5d32f5d8b 100644
--- a/drivers/block/paride/pf.c
+++ b/drivers/block/paride/pf.c
@@ -59,7 +59,7 @@
                         the slower the port i/o.  In some cases, setting
                         this to zero will speed up the device. (default -1)
 
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (47) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/paride/pg.c b/drivers/block/paride/pg.c
index 5db955fe3a94..3b5882bfb736 100644
--- a/drivers/block/paride/pg.c
+++ b/drivers/block/paride/pg.c
@@ -84,7 +84,7 @@
                         the slower the port i/o.  In some cases, setting
                         this to zero will speed up the device. (default -1)
 
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (97) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/paride/pt.c b/drivers/block/paride/pt.c
index 61fc6824299a..e815312a00ad 100644
--- a/drivers/block/paride/pt.c
+++ b/drivers/block/paride/pt.c
@@ -61,7 +61,7 @@
                         the slower the port i/o.  In some cases, setting
                         this to zero will speed up the device. (default -1)
 
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (96) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 4d6807723798..517838b65964 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -120,10 +120,11 @@ static int atomic_dec_return_safe(atomic_t *v)
 
 /* Feature bits */
 
-#define RBD_FEATURE_LAYERING    (1<<0)
-#define RBD_FEATURE_STRIPINGV2  (1<<1)
-#define RBD_FEATURE_EXCLUSIVE_LOCK (1<<2)
-#define RBD_FEATURE_DATA_POOL (1<<7)
+#define RBD_FEATURE_LAYERING            (1ULL<<0)
+#define RBD_FEATURE_STRIPINGV2          (1ULL<<1)
+#define RBD_FEATURE_EXCLUSIVE_LOCK      (1ULL<<2)
+#define RBD_FEATURE_DATA_POOL           (1ULL<<7)
+
 #define RBD_FEATURES_ALL        (RBD_FEATURE_LAYERING |         \
                                  RBD_FEATURE_STRIPINGV2 |       \
                                  RBD_FEATURE_EXCLUSIVE_LOCK |   \
@@ -499,16 +500,23 @@ static bool rbd_is_lock_owner(struct rbd_device *rbd_dev)
         return is_lock_owner;
 }
 
+static ssize_t rbd_supported_features_show(struct bus_type *bus, char *buf)
+{
+        return sprintf(buf, "0x%llx\n", RBD_FEATURES_SUPPORTED);
+}
+
 static BUS_ATTR(add, S_IWUSR, NULL, rbd_add);
 static BUS_ATTR(remove, S_IWUSR, NULL, rbd_remove);
 static BUS_ATTR(add_single_major, S_IWUSR, NULL, rbd_add_single_major);
 static BUS_ATTR(remove_single_major, S_IWUSR, NULL, rbd_remove_single_major);
+static BUS_ATTR(supported_features, S_IRUGO, rbd_supported_features_show, NULL);
 
 static struct attribute *rbd_bus_attrs[] = {
         &bus_attr_add.attr,
         &bus_attr_remove.attr,
         &bus_attr_add_single_major.attr,
         &bus_attr_remove_single_major.attr,
+        &bus_attr_supported_features.attr,
         NULL,
 };
 
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index e27d89a36c34..dceb5edd1e54 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1189,6 +1189,8 @@ static int zram_add(void)
         blk_queue_io_min(zram->disk->queue, PAGE_SIZE);
         blk_queue_io_opt(zram->disk->queue, PAGE_SIZE);
         zram->disk->queue->limits.discard_granularity = PAGE_SIZE;
+        zram->disk->queue->limits.max_sectors = SECTORS_PER_PAGE;
+        zram->disk->queue->limits.chunk_sectors = 0;
         blk_queue_max_discard_sectors(zram->disk->queue, UINT_MAX);
         /*
          * zram_bio_discard() will clear all logical blocks if logical block
diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
index c2c14a12713b..08e054507d0b 100644
--- a/drivers/bluetooth/Kconfig
+++ b/drivers/bluetooth/Kconfig
@@ -344,7 +344,8 @@ config BT_WILINK
 
 config BT_QCOMSMD
         tristate "Qualcomm SMD based HCI support"
-        depends on (QCOM_SMD && QCOM_WCNSS_CTRL) || COMPILE_TEST
+        depends on QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n)
+        depends on QCOM_WCNSS_CTRL || (COMPILE_TEST && QCOM_WCNSS_CTRL=n)
         select BT_QCA
         help
           Qualcomm SMD based HCI driver.
diff --git a/drivers/char/hw_random/amd-rng.c b/drivers/char/hw_random/amd-rng.c
index 4a99ac756f08..9959c762da2f 100644
--- a/drivers/char/hw_random/amd-rng.c
+++ b/drivers/char/hw_random/amd-rng.c
@@ -55,6 +55,7 @@ MODULE_DEVICE_TABLE(pci, pci_tbl);
 struct amd768_priv {
         void __iomem *iobase;
         struct pci_dev *pcidev;
+        u32 pmbase;
 };
 
 static int amd_rng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
@@ -148,33 +149,58 @@ found:
         if (pmbase == 0)
                 return -EIO;
 
-        priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
 
-        if (!devm_request_region(&pdev->dev, pmbase + PMBASE_OFFSET,
-                                PMBASE_SIZE, DRV_NAME)) {
+        if (!request_region(pmbase + PMBASE_OFFSET, PMBASE_SIZE, DRV_NAME)) {
                 dev_err(&pdev->dev, DRV_NAME " region 0x%x already in use!\n",
                         pmbase + 0xF0);
-                return -EBUSY;
+                err = -EBUSY;
+                goto out;
         }
 
-        priv->iobase = devm_ioport_map(&pdev->dev, pmbase + PMBASE_OFFSET,
-                        PMBASE_SIZE);
+        priv->iobase = ioport_map(pmbase + PMBASE_OFFSET, PMBASE_SIZE);
         if (!priv->iobase) {
                 pr_err(DRV_NAME "Cannot map ioport\n");
-                return -ENOMEM;
+                err = -EINVAL;
+                goto err_iomap;
         }
 
         amd_rng.priv = (unsigned long)priv;
+        priv->pmbase = pmbase;
         priv->pcidev = pdev;
 
         pr_info(DRV_NAME " detected\n");
-        return devm_hwrng_register(&pdev->dev, &amd_rng);
+        err = hwrng_register(&amd_rng);
+        if (err) {
+                pr_err(DRV_NAME " registering failed (%d)\n", err);
+                goto err_hwrng;
+        }
+        return 0;
+
+err_hwrng:
+        ioport_unmap(priv->iobase);
+err_iomap:
+        release_region(pmbase + PMBASE_OFFSET, PMBASE_SIZE);
+out:
+        kfree(priv);
+        return err;
 }
 
 static void __exit mod_exit(void)
 {
+        struct amd768_priv *priv;
+
+        priv = (struct amd768_priv *)amd_rng.priv;
+
+        hwrng_unregister(&amd_rng);
+
+        ioport_unmap(priv->iobase);
+
+        release_region(priv->pmbase + PMBASE_OFFSET, PMBASE_SIZE);
+
+        kfree(priv);
 }
 
 module_init(mod_init);
diff --git a/drivers/char/hw_random/geode-rng.c b/drivers/char/hw_random/geode-rng.c
index e7a245942029..e1d421a36a13 100644
--- a/drivers/char/hw_random/geode-rng.c
+++ b/drivers/char/hw_random/geode-rng.c
@@ -31,6 +31,9 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 
+
+#define PFX     KBUILD_MODNAME ": "
+
 #define GEODE_RNG_DATA_REG   0x50
 #define GEODE_RNG_STATUS_REG 0x54
 
@@ -82,6 +85,7 @@ static struct hwrng geode_rng = {
 
 static int __init mod_init(void)
 {
+        int err = -ENODEV;
         struct pci_dev *pdev = NULL;
         const struct pci_device_id *ent;
         void __iomem *mem;
@@ -89,27 +93,43 @@ static int __init mod_init(void)
 
         for_each_pci_dev(pdev) {
                 ent = pci_match_id(pci_tbl, pdev);
-                if (ent) {
-                        rng_base = pci_resource_start(pdev, 0);
-                        if (rng_base == 0)
-                                return -ENODEV;
-
-                        mem = devm_ioremap(&pdev->dev, rng_base, 0x58);
-                        if (!mem)
-                                return -ENOMEM;
-                        geode_rng.priv = (unsigned long)mem;
-
-                        pr_info("AMD Geode RNG detected\n");
-                        return devm_hwrng_register(&pdev->dev, &geode_rng);
-                }
+                if (ent)
+                        goto found;
         }
-
         /* Device not found. */
-        return -ENODEV;
+        goto out;
+
+found:
+        rng_base = pci_resource_start(pdev, 0);
+        if (rng_base == 0)
+                goto out;
+        err = -ENOMEM;
+        mem = ioremap(rng_base, 0x58);
+        if (!mem)
+                goto out;
+        geode_rng.priv = (unsigned long)mem;
+
+        pr_info("AMD Geode RNG detected\n");
+        err = hwrng_register(&geode_rng);
+        if (err) {
+                pr_err(PFX "RNG registering failed (%d)\n",
+                       err);
+                goto err_unmap;
+        }
+out:
+        return err;
+
+err_unmap:
+        iounmap(mem);
+        goto out;
 }
 
 static void __exit mod_exit(void)
 {
+        void __iomem *mem = (void __iomem *)geode_rng.priv;
+
+        hwrng_unregister(&geode_rng);
+        iounmap(mem);
 }
 
 module_init(mod_init);
diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
index 3ad86fdf954e..b1ad12552b56 100644
--- a/drivers/char/hw_random/omap-rng.c
+++ b/drivers/char/hw_random/omap-rng.c
@@ -397,9 +397,8 @@ static int of_get_omap_rng_device_details(struct omap_rng_dev *priv,
                                 irq, err);
                         return err;
                 }
-                omap_rng_write(priv, RNG_INTMASK_REG, RNG_SHUTDOWN_OFLO_MASK);
 
-                priv->clk = of_clk_get(pdev->dev.of_node, 0);
+                priv->clk = devm_clk_get(&pdev->dev, NULL);
                 if (IS_ERR(priv->clk) && PTR_ERR(priv->clk) == -EPROBE_DEFER)
                         return -EPROBE_DEFER;
                 if (!IS_ERR(priv->clk)) {
@@ -408,6 +407,19 @@ static int of_get_omap_rng_device_details(struct omap_rng_dev *priv,
                                 dev_err(&pdev->dev, "unable to enable the clk, "
                                                     "err = %d\n", err);
                 }
+
+                /*
+                 * On OMAP4, enabling the shutdown_oflo interrupt is
+                 * done in the interrupt mask register. There is no
+                 * such register on EIP76, and it's enabled by the
+                 * same bit in the control register
+                 */
+                if (priv->pdata->regs[RNG_INTMASK_REG])
+                        omap_rng_write(priv, RNG_INTMASK_REG,
+                                       RNG_SHUTDOWN_OFLO_MASK);
+                else
+                        omap_rng_write(priv, RNG_CONTROL_REG,
+                                       RNG_SHUTDOWN_OFLO_MASK);
         }
         return 0;
 }
diff --git a/drivers/char/nwbutton.c b/drivers/char/nwbutton.c
index a5b1eb276c0b..e6d0d271c58c 100644
--- a/drivers/char/nwbutton.c
+++ b/drivers/char/nwbutton.c
@@ -6,7 +6,7 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
+#include <linux/sched/signal.h>
 #include <linux/interrupt.h>
 #include <linux/time.h>
 #include <linux/timer.h>
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index 2a558c706581..3e73bcdf9e65 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -84,11 +84,14 @@ struct pp_struct {
         struct ieee1284_info state;
         struct ieee1284_info saved_state;
         long default_inactivity;
+        int index;
 };
 
 /* should we use PARDEVICE_MAX here? */
 static struct device *devices[PARPORT_MAX];
 
+static DEFINE_IDA(ida_index);
+
 /* pp_struct.flags bitfields */
 #define PP_CLAIMED    (1<<0)
 #define PP_EXCL       (1<<1)
@@ -290,7 +293,7 @@ static int register_device(int minor, struct pp_struct *pp)
         struct pardevice *pdev = NULL;
         char *name;
         struct pardev_cb ppdev_cb;
-        int rc = 0;
+        int rc = 0, index;
 
         name = kasprintf(GFP_KERNEL, CHRDEV "%x", minor);
         if (name == NULL)
@@ -303,20 +306,23 @@ static int register_device(int minor, struct pp_struct *pp)
                 goto err;
         }
 
+        index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL);
         memset(&ppdev_cb, 0, sizeof(ppdev_cb));
         ppdev_cb.irq_func = pp_irq;
         ppdev_cb.flags = (pp->flags & PP_EXCL) ? PARPORT_FLAG_EXCL : 0;
         ppdev_cb.private = pp;
-        pdev = parport_register_dev_model(port, name, &ppdev_cb, minor);
+        pdev = parport_register_dev_model(port, name, &ppdev_cb, index);
         parport_put_port(port);
 
         if (!pdev) {
                 pr_warn("%s: failed to register device!\n", name);
                 rc = -ENXIO;
+                ida_simple_remove(&ida_index, index);
                 goto err;
         }
 
         pp->pdev = pdev;
+        pp->index = index;
         dev_dbg(&pdev->dev, "registered pardevice\n");
 err:
         kfree(name);
@@ -755,6 +761,7 @@ static int pp_release(struct inode *inode, struct file *file)
 
         if (pp->pdev) {
                 parport_unregister_device(pp->pdev);
+                ida_simple_remove(&ida_index, pp->index);
                 pp->pdev = NULL;
                 pr_debug(CHRDEV "%x: unregistered pardevice\n", minor);
         }
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 1ef26403bcc8..0ab024918907 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -313,13 +313,6 @@ static int random_read_wakeup_bits = 64;
 static int random_write_wakeup_bits = 28 * OUTPUT_POOL_WORDS;
 
 /*
- * The minimum number of seconds between urandom pool reseeding.  We
- * do this to limit the amount of entropy that can be drained from the
- * input pool even if there are heavy demands on /dev/urandom.
- */
-static int random_min_urandom_seed = 60;
-
-/*
  * Originally, we used a primitive polynomial of degree .poolwords
  * over GF(2).  The taps for various sizes are defined below.  They
  * were chosen to be evenly spaced except for the last tap, which is 1
@@ -409,7 +402,6 @@ static struct poolinfo {
  */
 static DECLARE_WAIT_QUEUE_HEAD(random_read_wait);
 static DECLARE_WAIT_QUEUE_HEAD(random_write_wait);
-static DECLARE_WAIT_QUEUE_HEAD(urandom_init_wait);
 static struct fasync_struct *fasync;
 
 static DEFINE_SPINLOCK(random_ready_list_lock);
@@ -467,7 +459,6 @@ struct entropy_store {
         int entropy_count;
         int entropy_total;
         unsigned int initialized:1;
-        unsigned int limit:1;
         unsigned int last_data_init:1;
         __u8 last_data[EXTRACT_SIZE];
 };
@@ -485,7 +476,6 @@ static __u32 blocking_pool_data[OUTPUT_POOL_WORDS] __latent_entropy;
 static struct entropy_store input_pool = {
         .poolinfo = &poolinfo_table[0],
         .name = "input",
-        .limit = 1,
         .lock = __SPIN_LOCK_UNLOCKED(input_pool.lock),
         .pool = input_pool_data
 };
@@ -493,7 +483,6 @@ static struct entropy_store input_pool = {
 static struct entropy_store blocking_pool = {
         .poolinfo = &poolinfo_table[1],
         .name = "blocking",
-        .limit = 1,
         .pull = &input_pool,
         .lock = __SPIN_LOCK_UNLOCKED(blocking_pool.lock),
         .pool = blocking_pool_data,
@@ -855,13 +844,6 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
         spin_unlock_irqrestore(&primary_crng.lock, flags);
 }
 
-static inline void maybe_reseed_primary_crng(void)
-{
-        if (crng_init > 2 &&
-            time_after(jiffies, primary_crng.init_time + CRNG_RESEED_INTERVAL))
-                crng_reseed(&primary_crng, &input_pool);
-}
-
 static inline void crng_wait_ready(void)
 {
         wait_event_interruptible(crng_init_wait, crng_ready());
@@ -1220,15 +1202,6 @@ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
             r->entropy_count > r->poolinfo->poolfracbits)
                 return;
 
-        if (r->limit == 0 && random_min_urandom_seed) {
-                unsigned long now = jiffies;
-
-                if (time_before(now,
-                                r->last_pulled + random_min_urandom_seed * HZ))
-                        return;
-                r->last_pulled = now;
-        }
-
         _xfer_secondary_pool(r, nbytes);
 }
 
@@ -1236,8 +1209,6 @@ static void _xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
 {
         __u32   tmp[OUTPUT_POOL_WORDS];
 
-        /* For /dev/random's pool, always leave two wakeups' worth */
-        int rsvd_bytes = r->limit ? 0 : random_read_wakeup_bits / 4;
         int bytes = nbytes;
 
         /* pull at least as much as a wakeup */
@@ -1248,7 +1219,7 @@ static void _xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
         trace_xfer_secondary_pool(r->name, bytes * 8, nbytes * 8,
                                   ENTROPY_BITS(r), ENTROPY_BITS(r->pull));
         bytes = extract_entropy(r->pull, tmp, bytes,
-                                random_read_wakeup_bits / 8, rsvd_bytes);
+                                random_read_wakeup_bits / 8, 0);
         mix_pool_bytes(r, tmp, bytes);
         credit_entropy_bits(r, bytes*8);
 }
@@ -1276,7 +1247,7 @@ static void push_to_pool(struct work_struct *work)
 static size_t account(struct entropy_store *r, size_t nbytes, int min,
                       int reserved)
 {
-        int entropy_count, orig;
+        int entropy_count, orig, have_bytes;
         size_t ibytes, nfrac;
 
         BUG_ON(r->entropy_count > r->poolinfo->poolfracbits);
@@ -1285,14 +1256,12 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
 retry:
         entropy_count = orig = ACCESS_ONCE(r->entropy_count);
         ibytes = nbytes;
-        /* If limited, never pull more than available */
-        if (r->limit) {
-                int have_bytes = entropy_count >> (ENTROPY_SHIFT + 3);
+        /* never pull more than available */
+        have_bytes = entropy_count >> (ENTROPY_SHIFT + 3);
 
-                if ((have_bytes -= reserved) < 0)
-                        have_bytes = 0;
-                ibytes = min_t(size_t, ibytes, have_bytes);
-        }
+        if ((have_bytes -= reserved) < 0)
+                have_bytes = 0;
+        ibytes = min_t(size_t, ibytes, have_bytes);
         if (ibytes < min)
                 ibytes = 0;
 
@@ -1912,6 +1881,7 @@ SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count,
 static int min_read_thresh = 8, min_write_thresh;
 static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
 static int max_write_thresh = INPUT_POOL_WORDS * 32;
+static int random_min_urandom_seed = 60;
 static char sysctl_bootid[16];
 
 /*
@@ -2042,63 +2012,64 @@ struct ctl_table random_table[] = {
 };
 #endif  /* CONFIG_SYSCTL */
 
-static u32 random_int_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
-
-int random_int_secret_init(void)
-{
-        get_random_bytes(random_int_secret, sizeof(random_int_secret));
-        return 0;
-}
-
-static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash)
-                __aligned(sizeof(unsigned long));
+struct batched_entropy {
+        union {
+                u64 entropy_u64[CHACHA20_BLOCK_SIZE / sizeof(u64)];
+                u32 entropy_u32[CHACHA20_BLOCK_SIZE / sizeof(u32)];
+        };
+        unsigned int position;
+};
 
 /*
- * Get a random word for internal kernel use only. Similar to urandom but
- * with the goal of minimal entropy pool depletion. As a result, the random
- * value is not cryptographically secure but for several uses the cost of
- * depleting entropy is too high
+ * Get a random word for internal kernel use only. The quality of the random
+ * number is either as good as RDRAND or as good as /dev/urandom, with the
+ * goal of being quite fast and not depleting entropy.
  */
-unsigned int get_random_int(void)
+static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64);
+u64 get_random_u64(void)
 {
-        __u32 *hash;
-        unsigned int ret;
+        u64 ret;
+        struct batched_entropy *batch;
 
-        if (arch_get_random_int(&ret))
+#if BITS_PER_LONG == 64
+        if (arch_get_random_long((unsigned long *)&ret))
                 return ret;
+#else
+        if (arch_get_random_long((unsigned long *)&ret) &&
+            arch_get_random_long((unsigned long *)&ret + 1))
+            return ret;
+#endif
 
-        hash = get_cpu_var(get_random_int_hash);
-
-        hash[0] += current->pid + jiffies + random_get_entropy();
-        md5_transform(hash, random_int_secret);
-        ret = hash[0];
-        put_cpu_var(get_random_int_hash);
-
+        batch = &get_cpu_var(batched_entropy_u64);
+        if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) {
+                extract_crng((u8 *)batch->entropy_u64);
+                batch->position = 0;
+        }
+        ret = batch->entropy_u64[batch->position++];
+        put_cpu_var(batched_entropy_u64);
         return ret;
 }
-EXPORT_SYMBOL(get_random_int);
+EXPORT_SYMBOL(get_random_u64);
 
-/*
- * Same as get_random_int(), but returns unsigned long.
- */
-unsigned long get_random_long(void)
+static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u32);
+u32 get_random_u32(void)
 {
-        __u32 *hash;
-        unsigned long ret;
+        u32 ret;
+        struct batched_entropy *batch;
 
-        if (arch_get_random_long(&ret))
+        if (arch_get_random_int(&ret))
                 return ret;
 
-        hash = get_cpu_var(get_random_int_hash);
-
-        hash[0] += current->pid + jiffies + random_get_entropy();
-        md5_transform(hash, random_int_secret);
-        ret = *(unsigned long *)hash;
-        put_cpu_var(get_random_int_hash);
-
+        batch = &get_cpu_var(batched_entropy_u32);
+        if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) {
+                extract_crng((u8 *)batch->entropy_u32);
+                batch->position = 0;
+        }
+        ret = batch->entropy_u32[batch->position++];
+        put_cpu_var(batched_entropy_u32);
         return ret;
 }
-EXPORT_SYMBOL(get_random_long);
+EXPORT_SYMBOL(get_random_u32);
 
 /**
  * randomize_page - Generate a random, page aligned address
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 0fb39fe217d1..67201f67a14a 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -2502,7 +2502,7 @@ struct clk *__clk_create_clk(struct clk_hw *hw, const char *dev_id,
 
         clk->core = hw->core;
         clk->dev_id = dev_id;
-        clk->con_id = con_id;
+        clk->con_id = kstrdup_const(con_id, GFP_KERNEL);
         clk->max_rate = ULONG_MAX;
 
         clk_prepare_lock();
@@ -2518,6 +2518,7 @@ void __clk_free_clk(struct clk *clk)
         hlist_del(&clk->clks_node);
         clk_prepare_unlock();
 
+        kfree_const(clk->con_id);
         kfree(clk);
 }
 
diff --git a/drivers/clk/rockchip/clk-rk3036.c b/drivers/clk/rockchip/clk-rk3036.c
index 924f560dcf80..00d4150e33c3 100644
--- a/drivers/clk/rockchip/clk-rk3036.c
+++ b/drivers/clk/rockchip/clk-rk3036.c
@@ -127,7 +127,7 @@ PNAME(mux_ddrphy_p)		= { "dpll_ddr", "gpll_ddr" };
 PNAME(mux_pll_src_3plls_p)      = { "apll", "dpll", "gpll" };
 PNAME(mux_timer_p)              = { "xin24m", "pclk_peri_src" };
 
-PNAME(mux_pll_src_apll_dpll_gpll_usb480m_p)     = { "apll", "dpll", "gpll" "usb480m" };
+PNAME(mux_pll_src_apll_dpll_gpll_usb480m_p)     = { "apll", "dpll", "gpll", "usb480m" };
 
 PNAME(mux_mmc_src_p)    = { "apll", "dpll", "gpll", "xin24m" };
 PNAME(mux_i2s_pre_p)    = { "i2s_src", "i2s_frac", "ext_i2s", "xin12m" };
@@ -450,6 +450,13 @@ static void __init rk3036_clk_init(struct device_node *np)
                 return;
         }
 
+        /*
+         * Make uart_pll_clk a child of the gpll, as all other sources are
+         * not that usable / stable.
+         */
+        writel_relaxed(HIWORD_UPDATE(0x2, 0x3, 10),
+                       reg_base + RK2928_CLKSEL_CON(13));
+
         ctx = rockchip_clk_init(np, reg_base, CLK_NR_CLKS);
         if (IS_ERR(ctx)) {
                 pr_err("%s: rockchip clk init failed\n", __func__);
diff --git a/drivers/clk/sunxi-ng/Kconfig b/drivers/clk/sunxi-ng/Kconfig
index 695bbf9ef428..72109d2cf41b 100644
--- a/drivers/clk/sunxi-ng/Kconfig
+++ b/drivers/clk/sunxi-ng/Kconfig
@@ -80,6 +80,7 @@ config SUN6I_A31_CCU
         select SUNXI_CCU_DIV
         select SUNXI_CCU_NK
         select SUNXI_CCU_NKM
+        select SUNXI_CCU_NKMP
         select SUNXI_CCU_NM
         select SUNXI_CCU_MP
         select SUNXI_CCU_PHASE
diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
index e3c084cc6da5..f54114c607df 100644
--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
@@ -566,7 +566,7 @@ static SUNXI_CCU_M_WITH_GATE(gpu_clk, "gpu", "pll-gpu",
                              0x1a0, 0, 3, BIT(31), CLK_SET_RATE_PARENT);
 
 /* Fixed Factor clocks */
-static CLK_FIXED_FACTOR(osc12M_clk, "osc12M", "osc24M", 1, 2, 0);
+static CLK_FIXED_FACTOR(osc12M_clk, "osc12M", "osc24M", 2, 1, 0);
 
 /* We hardcode the divider to 4 for now */
 static CLK_FIXED_FACTOR(pll_audio_clk, "pll-audio",
diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
index 4c9a920ff4ab..89e68d29bf45 100644
--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
@@ -608,7 +608,7 @@ static SUNXI_CCU_M_WITH_MUX_GATE(hdmi_clk, "hdmi", lcd_ch1_parents,
                                  0x150, 0, 4, 24, 2, BIT(31),
                                  CLK_SET_RATE_PARENT);
 
-static SUNXI_CCU_GATE(hdmi_ddc_clk, "hdmi-ddc", "osc24M", 0x150, BIT(31), 0);
+static SUNXI_CCU_GATE(hdmi_ddc_clk, "hdmi-ddc", "osc24M", 0x150, BIT(30), 0);
 
 static SUNXI_CCU_GATE(ps_clk, "ps", "lcd1-ch1", 0x140, BIT(31), 0);
 
diff --git a/drivers/clk/sunxi-ng/ccu_mp.c b/drivers/clk/sunxi-ng/ccu_mp.c
index 22c2ca7a2a22..b583f186a804 100644
--- a/drivers/clk/sunxi-ng/ccu_mp.c
+++ b/drivers/clk/sunxi-ng/ccu_mp.c
@@ -85,6 +85,10 @@ static unsigned long ccu_mp_recalc_rate(struct clk_hw *hw,
         unsigned int m, p;
         u32 reg;
 
+        /* Adjust parent_rate according to pre-dividers */
+        ccu_mux_helper_adjust_parent_for_prediv(&cmp->common, &cmp->mux,
+                                                -1, &parent_rate);
+
         reg = readl(cmp->common.base + cmp->common.reg);
 
         m = reg >> cmp->m.shift;
@@ -117,6 +121,10 @@ static int ccu_mp_set_rate(struct clk_hw *hw, unsigned long rate,
         unsigned int m, p;
         u32 reg;
 
+        /* Adjust parent_rate according to pre-dividers */
+        ccu_mux_helper_adjust_parent_for_prediv(&cmp->common, &cmp->mux,
+                                                -1, &parent_rate);
+
         max_m = cmp->m.max ?: 1 << cmp->m.width;
         max_p = cmp->p.max ?: 1 << ((1 << cmp->p.width) - 1);
 
diff --git a/drivers/clk/sunxi-ng/ccu_nkmp.c b/drivers/clk/sunxi-ng/ccu_nkmp.c
index a2b40a000157..488055ed944f 100644
--- a/drivers/clk/sunxi-ng/ccu_nkmp.c
+++ b/drivers/clk/sunxi-ng/ccu_nkmp.c
@@ -107,7 +107,7 @@ static unsigned long ccu_nkmp_recalc_rate(struct clk_hw *hw,
         p = reg >> nkmp->p.shift;
         p &= (1 << nkmp->p.width) - 1;
 
-        return parent_rate * n * k >> p / m;
+        return (parent_rate * n * k >> p) / m;
 }
 
 static long ccu_nkmp_round_rate(struct clk_hw *hw, unsigned long rate,
diff --git a/drivers/clocksource/clkevt-probe.c b/drivers/clocksource/clkevt-probe.c
index 8c30fec86094..eb89b502acbd 100644
--- a/drivers/clocksource/clkevt-probe.c
+++ b/drivers/clocksource/clkevt-probe.c
@@ -17,7 +17,7 @@
 
 #include <linux/init.h>
 #include <linux/of.h>
-#include <linux/clockchip.h>
+#include <linux/clockchips.h>
 
 extern struct of_device_id __clkevt_of_table[];
 
diff --git a/drivers/clocksource/tcb_clksrc.c b/drivers/clocksource/tcb_clksrc.c
index 745844ee973e..d4ca9962a759 100644
--- a/drivers/clocksource/tcb_clksrc.c
+++ b/drivers/clocksource/tcb_clksrc.c
@@ -10,7 +10,6 @@
 #include <linux/io.h>
 #include <linux/platform_device.h>
 #include <linux/atmel_tc.h>
-#include <linux/sched_clock.h>
 
 
 /*
@@ -57,14 +56,9 @@ static u64 tc_get_cycles(struct clocksource *cs)
         return (upper << 16) | lower;
 }
 
-static u32 tc_get_cv32(void)
-{
-        return __raw_readl(tcaddr + ATMEL_TC_REG(0, CV));
-}
-
 static u64 tc_get_cycles32(struct clocksource *cs)
 {
-        return tc_get_cv32();
+        return __raw_readl(tcaddr + ATMEL_TC_REG(0, CV));
 }
 
 static struct clocksource clksrc = {
@@ -75,11 +69,6 @@ static struct clocksource clksrc = {
         .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
-static u64 notrace tc_read_sched_clock(void)
-{
-        return tc_get_cv32();
-}
-
 #ifdef CONFIG_GENERIC_CLOCKEVENTS
 
 struct tc_clkevt_device {
@@ -350,9 +339,6 @@ static int __init tcb_clksrc_init(void)
                 clksrc.read = tc_get_cycles32;
                 /* setup ony channel 0 */
                 tcb_setup_single_chan(tc, best_divisor_idx);
-
-                /* register sched_clock on chips with single 32 bit counter */
-                sched_clock_register(tc_read_sched_clock, 32, divided_rate);
         } else {
                 /* tclib will give us three clocks no matter what the
                  * underlying platform supports.
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index a47543281864..bc96d423781a 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -680,9 +680,11 @@ static ssize_t show_cpuinfo_cur_freq(struct cpufreq_policy *policy,
                                         char *buf)
 {
         unsigned int cur_freq = __cpufreq_get(policy);
-        if (!cur_freq)
-                return sprintf(buf, "<unknown>");
-        return sprintf(buf, "%u\n", cur_freq);
+
+        if (cur_freq)
+                return sprintf(buf, "%u\n", cur_freq);
+
+        return sprintf(buf, "<unknown>\n");
 }
 
 /**
@@ -916,11 +918,19 @@ static struct kobj_type ktype_cpufreq = {
         .release        = cpufreq_sysfs_release,
 };
 
-static int add_cpu_dev_symlink(struct cpufreq_policy *policy,
-                               struct device *dev)
+static void add_cpu_dev_symlink(struct cpufreq_policy *policy, unsigned int cpu)
 {
+        struct device *dev = get_cpu_device(cpu);
+
+        if (!dev)
+                return;
+
+        if (cpumask_test_and_set_cpu(cpu, policy->real_cpus))
+                return;
+
         dev_dbg(dev, "%s: Adding symlink\n", __func__);
-        return sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq");
+        if (sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq"))
+                dev_err(dev, "cpufreq symlink creation failed\n");
 }
 
 static void remove_cpu_dev_symlink(struct cpufreq_policy *policy,
@@ -1178,10 +1188,13 @@ static int cpufreq_online(unsigned int cpu)
                 policy->user_policy.min = policy->min;
                 policy->user_policy.max = policy->max;
 
-                write_lock_irqsave(&cpufreq_driver_lock, flags);
-                for_each_cpu(j, policy->related_cpus)
+                for_each_cpu(j, policy->related_cpus) {
                         per_cpu(cpufreq_cpu_data, j) = policy;
-                write_unlock_irqrestore(&cpufreq_driver_lock, flags);
+                        add_cpu_dev_symlink(policy, j);
+                }
+        } else {
+                policy->min = policy->user_policy.min;
+                policy->max = policy->user_policy.max;
         }
 
         if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
@@ -1270,13 +1283,15 @@ out_exit_policy:
 
         if (cpufreq_driver->exit)
                 cpufreq_driver->exit(policy);
+
+        for_each_cpu(j, policy->real_cpus)
+                remove_cpu_dev_symlink(policy, get_cpu_device(j));
+
 out_free_policy:
         cpufreq_policy_free(policy);
         return ret;
 }
 
-static int cpufreq_offline(unsigned int cpu);
-
 /**
  * cpufreq_add_dev - the cpufreq interface for a CPU device.
  * @dev: CPU device.
@@ -1298,16 +1313,10 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
 
         /* Create sysfs link on CPU registration */
         policy = per_cpu(cpufreq_cpu_data, cpu);
-        if (!policy || cpumask_test_and_set_cpu(cpu, policy->real_cpus))
-                return 0;
-
-        ret = add_cpu_dev_symlink(policy, dev);
-        if (ret) {
-                cpumask_clear_cpu(cpu, policy->real_cpus);
-                cpufreq_offline(cpu);
-        }
+        if (policy)
+                add_cpu_dev_symlink(policy, cpu);
 
-        return ret;
+        return 0;
 }
 
 static int cpufreq_offline(unsigned int cpu)
@@ -2532,4 +2541,5 @@ static int __init cpufreq_core_init(void)
 
         return 0;
 }
+module_param(off, int, 0444);
 core_initcall(cpufreq_core_init);
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index b1fbaa30ae04..283491f742d3 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -84,6 +84,11 @@ static inline u64 div_ext_fp(u64 x, u64 y)
         return div64_u64(x << EXT_FRAC_BITS, y);
 }
 
+static inline int32_t percent_ext_fp(int percent)
+{
+        return div_ext_fp(percent, 100);
+}
+
 /**
  * struct sample -      Store performance sample
  * @core_avg_perf:      Ratio of APERF/MPERF which is the actual average
@@ -359,9 +364,7 @@ static bool driver_registered __read_mostly;
 static bool acpi_ppc;
 #endif
 
-static struct perf_limits performance_limits;
-static struct perf_limits powersave_limits;
-static struct perf_limits *limits;
+static struct perf_limits global;
 
 static void intel_pstate_init_limits(struct perf_limits *limits)
 {
@@ -372,13 +375,6 @@ static void intel_pstate_init_limits(struct perf_limits *limits)
         limits->max_sysfs_pct = 100;
 }
 
-static void intel_pstate_set_performance_limits(struct perf_limits *limits)
-{
-        intel_pstate_init_limits(limits);
-        limits->min_perf_pct = 100;
-        limits->min_perf = int_ext_tofp(1);
-}
-
 static DEFINE_MUTEX(intel_pstate_driver_lock);
 static DEFINE_MUTEX(intel_pstate_limits_lock);
 
@@ -501,7 +497,7 @@ static void intel_pstate_init_acpi_perf_limits(struct cpufreq_policy *policy)
          * correct max turbo frequency based on the turbo state.
          * Also need to convert to MHz as _PSS freq is in MHz.
          */
-        if (!limits->turbo_disabled)
+        if (!global.turbo_disabled)
                 cpu->acpi_perf_data.states[0].core_frequency =
                                         policy->cpuinfo.max_freq / 1000;
         cpu->valid_pss_table = true;
@@ -620,7 +616,7 @@ static inline void update_turbo_state(void)
 
         cpu = all_cpu_data[0];
         rdmsrl(MSR_IA32_MISC_ENABLE, misc_en);
-        limits->turbo_disabled =
+        global.turbo_disabled =
                 (misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE ||
                  cpu->pstate.max_pstate == cpu->pstate.turbo_pstate);
 }
@@ -844,12 +840,11 @@ static struct freq_attr *hwp_cpufreq_attrs[] = {
 
 static void intel_pstate_hwp_set(struct cpufreq_policy *policy)
 {
-        int min, hw_min, max, hw_max, cpu, range, adj_range;
-        struct perf_limits *perf_limits = limits;
+        int min, hw_min, max, hw_max, cpu;
+        struct perf_limits *perf_limits = &global;
         u64 value, cap;
 
         for_each_cpu(cpu, policy->cpus) {
-                int max_perf_pct, min_perf_pct;
                 struct cpudata *cpu_data = all_cpu_data[cpu];
                 s16 epp;
 
@@ -858,24 +853,22 @@ static void intel_pstate_hwp_set(struct cpufreq_policy *policy)
 
                 rdmsrl_on_cpu(cpu, MSR_HWP_CAPABILITIES, &cap);
                 hw_min = HWP_LOWEST_PERF(cap);
-                if (limits->no_turbo)
+                if (global.no_turbo)
                         hw_max = HWP_GUARANTEED_PERF(cap);
                 else
                         hw_max = HWP_HIGHEST_PERF(cap);
-                range = hw_max - hw_min;
 
-                max_perf_pct = perf_limits->max_perf_pct;
-                min_perf_pct = perf_limits->min_perf_pct;
+                max = fp_ext_toint(hw_max * perf_limits->max_perf);
+                if (cpu_data->policy == CPUFREQ_POLICY_PERFORMANCE)
+                        min = max;
+                else
+                        min = fp_ext_toint(hw_max * perf_limits->min_perf);
 
                 rdmsrl_on_cpu(cpu, MSR_HWP_REQUEST, &value);
-                adj_range = min_perf_pct * range / 100;
-                min = hw_min + adj_range;
+
                 value &= ~HWP_MIN_PERF(~0L);
                 value |= HWP_MIN_PERF(min);
 
-                adj_range = max_perf_pct * range / 100;
-                max = hw_min + adj_range;
-
                 value &= ~HWP_MAX_PERF(~0L);
                 value |= HWP_MAX_PERF(max);
 
@@ -979,6 +972,7 @@ static void intel_pstate_update_policies(void)
 static int pid_param_set(void *data, u64 val)
 {
         *(u32 *)data = val;
+        pid_params.sample_rate_ns = pid_params.sample_rate_ms * NSEC_PER_MSEC;
         intel_pstate_reset_all_pid();
         return 0;
 }
@@ -1050,7 +1044,7 @@ static void intel_pstate_debug_hide_params(void)
         static ssize_t show_##file_name                                 \
         (struct kobject *kobj, struct attribute *attr, char *buf)       \
         {                                                               \
-                return sprintf(buf, "%u\n", limits->object);            \
+                return sprintf(buf, "%u\n", global.object);             \
         }
 
 static ssize_t intel_pstate_show_status(char *buf);
@@ -1141,10 +1135,10 @@ static ssize_t show_no_turbo(struct kobject *kobj,
         }
 
         update_turbo_state();
-        if (limits->turbo_disabled)
-                ret = sprintf(buf, "%u\n", limits->turbo_disabled);
+        if (global.turbo_disabled)
+                ret = sprintf(buf, "%u\n", global.turbo_disabled);
         else
-                ret = sprintf(buf, "%u\n", limits->no_turbo);
+                ret = sprintf(buf, "%u\n", global.no_turbo);
 
         mutex_unlock(&intel_pstate_driver_lock);
 
@@ -1171,14 +1165,14 @@ static ssize_t store_no_turbo(struct kobject *a, struct attribute *b,
         mutex_lock(&intel_pstate_limits_lock);
 
         update_turbo_state();
-        if (limits->turbo_disabled) {
+        if (global.turbo_disabled) {
                 pr_warn("Turbo disabled by BIOS or unavailable on processor\n");
                 mutex_unlock(&intel_pstate_limits_lock);
                 mutex_unlock(&intel_pstate_driver_lock);
                 return -EPERM;
         }
 
-        limits->no_turbo = clamp_t(int, input, 0, 1);
+        global.no_turbo = clamp_t(int, input, 0, 1);
 
         mutex_unlock(&intel_pstate_limits_lock);
 
@@ -1208,14 +1202,11 @@ static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b,
 
         mutex_lock(&intel_pstate_limits_lock);
 
-        limits->max_sysfs_pct = clamp_t(int, input, 0 , 100);
-        limits->max_perf_pct = min(limits->max_policy_pct,
-                                   limits->max_sysfs_pct);
-        limits->max_perf_pct = max(limits->min_policy_pct,
-                                   limits->max_perf_pct);
-        limits->max_perf_pct = max(limits->min_perf_pct,
-                                   limits->max_perf_pct);
-        limits->max_perf = div_ext_fp(limits->max_perf_pct, 100);
+        global.max_sysfs_pct = clamp_t(int, input, 0 , 100);
+        global.max_perf_pct = min(global.max_policy_pct, global.max_sysfs_pct);
+        global.max_perf_pct = max(global.min_policy_pct, global.max_perf_pct);
+        global.max_perf_pct = max(global.min_perf_pct, global.max_perf_pct);
+        global.max_perf = percent_ext_fp(global.max_perf_pct);
 
         mutex_unlock(&intel_pstate_limits_lock);
 
@@ -1245,14 +1236,11 @@ static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b,
 
         mutex_lock(&intel_pstate_limits_lock);
 
-        limits->min_sysfs_pct = clamp_t(int, input, 0 , 100);
-        limits->min_perf_pct = max(limits->min_policy_pct,
-                                   limits->min_sysfs_pct);
-        limits->min_perf_pct = min(limits->max_policy_pct,
-                                   limits->min_perf_pct);
-        limits->min_perf_pct = min(limits->max_perf_pct,
-                                   limits->min_perf_pct);
-        limits->min_perf = div_ext_fp(limits->min_perf_pct, 100);
+        global.min_sysfs_pct = clamp_t(int, input, 0 , 100);
+        global.min_perf_pct = max(global.min_policy_pct, global.min_sysfs_pct);
+        global.min_perf_pct = min(global.max_policy_pct, global.min_perf_pct);
+        global.min_perf_pct = min(global.max_perf_pct, global.min_perf_pct);
+        global.min_perf = percent_ext_fp(global.min_perf_pct);
 
         mutex_unlock(&intel_pstate_limits_lock);
 
@@ -1377,7 +1365,7 @@ static u64 atom_get_val(struct cpudata *cpudata, int pstate)
         u32 vid;
 
         val = (u64)pstate << 8;
-        if (limits->no_turbo && !limits->turbo_disabled)
+        if (global.no_turbo && !global.turbo_disabled)
                 val |= (u64)1 << 32;
 
         vid_fp = cpudata->vid.min + mul_fp(
@@ -1547,7 +1535,7 @@ static u64 core_get_val(struct cpudata *cpudata, int pstate)
         u64 val;
 
         val = (u64)pstate << 8;
-        if (limits->no_turbo && !limits->turbo_disabled)
+        if (global.no_turbo && !global.turbo_disabled)
                 val |= (u64)1 << 32;
 
         return val;
@@ -1673,9 +1661,9 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
         int max_perf = cpu->pstate.turbo_pstate;
         int max_perf_adj;
         int min_perf;
-        struct perf_limits *perf_limits = limits;
+        struct perf_limits *perf_limits = &global;
 
-        if (limits->no_turbo || limits->turbo_disabled)
+        if (global.no_turbo || global.turbo_disabled)
                 max_perf = cpu->pstate.max_pstate;
 
         if (per_cpu_limits)
@@ -1810,7 +1798,7 @@ static inline int32_t get_target_pstate_use_cpu_load(struct cpudata *cpu)
 
         sample->busy_scaled = busy_frac * 100;
 
-        target = limits->no_turbo || limits->turbo_disabled ?
+        target = global.no_turbo || global.turbo_disabled ?
                         cpu->pstate.max_pstate : cpu->pstate.turbo_pstate;
         target += target >> 2;
         target = mul_fp(target, busy_frac);
@@ -1874,13 +1862,11 @@ static int intel_pstate_prepare_request(struct cpudata *cpu, int pstate)
 
         intel_pstate_get_min_max(cpu, &min_perf, &max_perf);
         pstate = clamp_t(int, pstate, min_perf, max_perf);
-        trace_cpu_frequency(pstate * cpu->pstate.scaling, cpu->cpu);
         return pstate;
 }
 
 static void intel_pstate_update_pstate(struct cpudata *cpu, int pstate)
 {
-        pstate = intel_pstate_prepare_request(cpu, pstate);
         if (pstate == cpu->pstate.current_pstate)
                 return;
 
@@ -1900,6 +1886,8 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
 
         update_turbo_state();
 
+        target_pstate = intel_pstate_prepare_request(cpu, target_pstate);
+        trace_cpu_frequency(target_pstate * cpu->pstate.scaling, cpu->cpu);
         intel_pstate_update_pstate(cpu, target_pstate);
 
         sample = &cpu->sample;
@@ -2070,36 +2058,34 @@ static void intel_pstate_clear_update_util_hook(unsigned int cpu)
 static void intel_pstate_update_perf_limits(struct cpufreq_policy *policy,
                                             struct perf_limits *limits)
 {
+        int32_t max_policy_perf, min_policy_perf;
 
-        limits->max_policy_pct = DIV_ROUND_UP(policy->max * 100,
-                                              policy->cpuinfo.max_freq);
-        limits->max_policy_pct = clamp_t(int, limits->max_policy_pct, 0, 100);
+        max_policy_perf = div_ext_fp(policy->max, policy->cpuinfo.max_freq);
+        max_policy_perf = clamp_t(int32_t, max_policy_perf, 0, int_ext_tofp(1));
         if (policy->max == policy->min) {
-                limits->min_policy_pct = limits->max_policy_pct;
+                min_policy_perf = max_policy_perf;
         } else {
-                limits->min_policy_pct = DIV_ROUND_UP(policy->min * 100,
-                                                      policy->cpuinfo.max_freq);
-                limits->min_policy_pct = clamp_t(int, limits->min_policy_pct,
-                                                 0, 100);
+                min_policy_perf = div_ext_fp(policy->min,
+                                             policy->cpuinfo.max_freq);
+                min_policy_perf = clamp_t(int32_t, min_policy_perf,
+                                          0, max_policy_perf);
         }
 
-        /* Normalize user input to [min_policy_pct, max_policy_pct] */
-        limits->min_perf_pct = max(limits->min_policy_pct,
-                                   limits->min_sysfs_pct);
-        limits->min_perf_pct = min(limits->max_policy_pct,
-                                   limits->min_perf_pct);
-        limits->max_perf_pct = min(limits->max_policy_pct,
-                                   limits->max_sysfs_pct);
-        limits->max_perf_pct = max(limits->min_policy_pct,
-                                   limits->max_perf_pct);
-
-        /* Make sure min_perf_pct <= max_perf_pct */
-        limits->min_perf_pct = min(limits->max_perf_pct, limits->min_perf_pct);
-
-        limits->min_perf = div_ext_fp(limits->min_perf_pct, 100);
-        limits->max_perf = div_ext_fp(limits->max_perf_pct, 100);
+        /* Normalize user input to [min_perf, max_perf] */
+        limits->min_perf = max(min_policy_perf,
+                               percent_ext_fp(limits->min_sysfs_pct));
+        limits->min_perf = min(limits->min_perf, max_policy_perf);
+        limits->max_perf = min(max_policy_perf,
+                               percent_ext_fp(limits->max_sysfs_pct));
+        limits->max_perf = max(min_policy_perf, limits->max_perf);
+
+        /* Make sure min_perf <= max_perf */
+        limits->min_perf = min(limits->min_perf, limits->max_perf);
+
         limits->max_perf = round_up(limits->max_perf, EXT_FRAC_BITS);
         limits->min_perf = round_up(limits->min_perf, EXT_FRAC_BITS);
+        limits->max_perf_pct = fp_ext_toint(limits->max_perf * 100);
+        limits->min_perf_pct = fp_ext_toint(limits->min_perf * 100);
 
         pr_debug("cpu:%d max_perf_pct:%d min_perf_pct:%d\n", policy->cpu,
                  limits->max_perf_pct, limits->min_perf_pct);
@@ -2108,7 +2094,7 @@ static void intel_pstate_update_perf_limits(struct cpufreq_policy *policy,
 static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 {
         struct cpudata *cpu;
-        struct perf_limits *perf_limits = NULL;
+        struct perf_limits *perf_limits = &global;
 
         if (!policy->cpuinfo.max_freq)
                 return -ENODEV;
@@ -2131,28 +2117,8 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 
         mutex_lock(&intel_pstate_limits_lock);
 
-        if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) {
-                if (!perf_limits) {
-                        limits = &performance_limits;
-                        perf_limits = limits;
-                }
-                if (policy->max >= policy->cpuinfo.max_freq &&
-                    !limits->no_turbo) {
-                        pr_debug("set performance\n");
-                        intel_pstate_set_performance_limits(perf_limits);
-                        goto out;
-                }
-        } else {
-                pr_debug("set powersave\n");
-                if (!perf_limits) {
-                        limits = &powersave_limits;
-                        perf_limits = limits;
-                }
-
-        }
-
         intel_pstate_update_perf_limits(policy, perf_limits);
- out:
+
         if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE) {
                 /*
                  * NOHZ_FULL CPUs need this as the governor callback may not
@@ -2174,16 +2140,9 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 static int intel_pstate_verify_policy(struct cpufreq_policy *policy)
 {
         struct cpudata *cpu = all_cpu_data[policy->cpu];
-        struct perf_limits *perf_limits;
-
-        if (policy->policy == CPUFREQ_POLICY_PERFORMANCE)
-                perf_limits = &performance_limits;
-        else
-                perf_limits = &powersave_limits;
 
         update_turbo_state();
-        policy->cpuinfo.max_freq = perf_limits->turbo_disabled ||
-                                        perf_limits->no_turbo ?
+        policy->cpuinfo.max_freq = global.turbo_disabled || global.no_turbo ?
                                         cpu->pstate.max_freq :
                                         cpu->pstate.turbo_freq;
 
@@ -2198,9 +2157,9 @@ static int intel_pstate_verify_policy(struct cpufreq_policy *policy)
                 unsigned int max_freq, min_freq;
 
                 max_freq = policy->cpuinfo.max_freq *
-                                                limits->max_sysfs_pct / 100;
+                                        global.max_sysfs_pct / 100;
                 min_freq = policy->cpuinfo.max_freq *
-                                                limits->min_sysfs_pct / 100;
+                                        global.min_sysfs_pct / 100;
                 cpufreq_verify_within_limits(policy, min_freq, max_freq);
         }
 
@@ -2243,13 +2202,8 @@ static int __intel_pstate_cpu_init(struct cpufreq_policy *policy)
 
         cpu = all_cpu_data[policy->cpu];
 
-        /*
-         * We need sane value in the cpu->perf_limits, so inherit from global
-         * perf_limits limits, which are seeded with values based on the
-         * CONFIG_CPU_FREQ_DEFAULT_GOV_*, during boot up.
-         */
         if (per_cpu_limits)
-                memcpy(cpu->perf_limits, limits, sizeof(struct perf_limits));
+                intel_pstate_init_limits(cpu->perf_limits);
 
         policy->min = cpu->pstate.min_pstate * cpu->pstate.scaling;
         policy->max = cpu->pstate.turbo_pstate * cpu->pstate.scaling;
@@ -2257,7 +2211,7 @@ static int __intel_pstate_cpu_init(struct cpufreq_policy *policy)
         /* cpuinfo and default policy values */
         policy->cpuinfo.min_freq = cpu->pstate.min_pstate * cpu->pstate.scaling;
         update_turbo_state();
-        policy->cpuinfo.max_freq = limits->turbo_disabled ?
+        policy->cpuinfo.max_freq = global.turbo_disabled ?
                         cpu->pstate.max_pstate : cpu->pstate.turbo_pstate;
         policy->cpuinfo.max_freq *= cpu->pstate.scaling;
 
@@ -2277,7 +2231,7 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
                 return ret;
 
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
-        if (limits->min_perf_pct == 100 && limits->max_perf_pct == 100)
+        if (IS_ENABLED(CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE))
                 policy->policy = CPUFREQ_POLICY_PERFORMANCE;
         else
                 policy->policy = CPUFREQ_POLICY_POWERSAVE;
@@ -2301,46 +2255,16 @@ static struct cpufreq_driver intel_pstate = {
 static int intel_cpufreq_verify_policy(struct cpufreq_policy *policy)
 {
         struct cpudata *cpu = all_cpu_data[policy->cpu];
-        struct perf_limits *perf_limits = limits;
 
         update_turbo_state();
-        policy->cpuinfo.max_freq = limits->turbo_disabled ?
+        policy->cpuinfo.max_freq = global.no_turbo || global.turbo_disabled ?
                         cpu->pstate.max_freq : cpu->pstate.turbo_freq;
 
         cpufreq_verify_within_cpu_limits(policy);
 
-        if (per_cpu_limits)
-                perf_limits = cpu->perf_limits;
-
-        mutex_lock(&intel_pstate_limits_lock);
-
-        intel_pstate_update_perf_limits(policy, perf_limits);
-
-        mutex_unlock(&intel_pstate_limits_lock);
-
         return 0;
 }
 
-static unsigned int intel_cpufreq_turbo_update(struct cpudata *cpu,
-                                               struct cpufreq_policy *policy,
-                                               unsigned int target_freq)
-{
-        unsigned int max_freq;
-
-        update_turbo_state();
-
-        max_freq = limits->no_turbo || limits->turbo_disabled ?
-                        cpu->pstate.max_freq : cpu->pstate.turbo_freq;
-        policy->cpuinfo.max_freq = max_freq;
-        if (policy->max > max_freq)
-                policy->max = max_freq;
-
-        if (target_freq > max_freq)
-                target_freq = max_freq;
-
-        return target_freq;
-}
-
 static int intel_cpufreq_target(struct cpufreq_policy *policy,
                                 unsigned int target_freq,
                                 unsigned int relation)
@@ -2349,8 +2273,10 @@ static int intel_cpufreq_target(struct cpufreq_policy *policy,
         struct cpufreq_freqs freqs;
         int target_pstate;
 
+        update_turbo_state();
+
         freqs.old = policy->cur;
-        freqs.new = intel_cpufreq_turbo_update(cpu, policy, target_freq);
+        freqs.new = target_freq;
 
         cpufreq_freq_transition_begin(policy, &freqs);
         switch (relation) {
@@ -2370,6 +2296,7 @@ static int intel_cpufreq_target(struct cpufreq_policy *policy,
                 wrmsrl_on_cpu(policy->cpu, MSR_IA32_PERF_CTL,
                               pstate_funcs.get_val(cpu, target_pstate));
         }
+        freqs.new = target_pstate * cpu->pstate.scaling;
         cpufreq_freq_transition_end(policy, &freqs, false);
 
         return 0;
@@ -2381,10 +2308,12 @@ static unsigned int intel_cpufreq_fast_switch(struct cpufreq_policy *policy,
         struct cpudata *cpu = all_cpu_data[policy->cpu];
         int target_pstate;
 
-        target_freq = intel_cpufreq_turbo_update(cpu, policy, target_freq);
+        update_turbo_state();
+
         target_pstate = DIV_ROUND_UP(target_freq, cpu->pstate.scaling);
+        target_pstate = intel_pstate_prepare_request(cpu, target_pstate);
         intel_pstate_update_pstate(cpu, target_pstate);
-        return target_freq;
+        return target_pstate * cpu->pstate.scaling;
 }
 
 static int intel_cpufreq_cpu_init(struct cpufreq_policy *policy)
@@ -2435,10 +2364,7 @@ static int intel_pstate_register_driver(void)
 {
         int ret;
 
-        intel_pstate_init_limits(&powersave_limits);
-        intel_pstate_set_performance_limits(&performance_limits);
-        limits = IS_ENABLED(CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE) ?
-                        &performance_limits : &powersave_limits;
+        intel_pstate_init_limits(&global);
 
         ret = cpufreq_register_driver(intel_pstate_driver);
         if (ret) {
diff --git a/drivers/cpuidle/cpuidle-powernv.c b/drivers/cpuidle/cpuidle-powernv.c
index 370593006f5f..cda8f62d555b 100644
--- a/drivers/cpuidle/cpuidle-powernv.c
+++ b/drivers/cpuidle/cpuidle-powernv.c
@@ -175,6 +175,24 @@ static int powernv_cpuidle_driver_init(void)
                 drv->state_count += 1;
         }
 
+        /*
+         * On the PowerNV platform cpu_present may be less than cpu_possible in
+         * cases when firmware detects the CPU, but it is not available to the
+         * OS.  If CONFIG_HOTPLUG_CPU=n, then such CPUs are not hotplugable at
+         * run time and hence cpu_devices are not created for those CPUs by the
+         * generic topology_init().
+         *
+         * drv->cpumask defaults to cpu_possible_mask in
+         * __cpuidle_driver_init().  This breaks cpuidle on PowerNV where
+         * cpu_devices are not created for CPUs in cpu_possible_mask that
+         * cannot be hot-added later at run time.
+         *
+         * Trying cpuidle_register_device() on a CPU without a cpu_device is
+         * incorrect, so pass a correct CPU mask to the generic cpuidle driver.
+         */
+
+        drv->cpumask = (struct cpumask *)cpu_present_mask;
+
         return 0;
 }
 
diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
index c5adc8c9ac43..ae948b1da93a 100644
--- a/drivers/cpuidle/sysfs.c
+++ b/drivers/cpuidle/sysfs.c
@@ -615,6 +615,18 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)
         struct device *cpu_dev = get_cpu_device((unsigned long)dev->cpu);
         int error;
 
+        /*
+         * Return if cpu_device is not setup for this CPU.
+         *
+         * This could happen if the arch did not set up cpu_device
+         * since this CPU is not in cpu_present mask and the
+         * driver did not send a correct CPU mask during registration.
+         * Without this check we would end up passing bogus
+         * value for &cpu_dev->kobj in kobject_init_and_add()
+         */
+        if (!cpu_dev)
+                return -ENODEV;
+
         kdev = kzalloc(sizeof(*kdev), GFP_KERNEL);
         if (!kdev)
                 return -ENOMEM;
diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
index 41cc853f8569..fc08b4ed69d9 100644
--- a/drivers/crypto/ccp/ccp-dev-v5.c
+++ b/drivers/crypto/ccp/ccp-dev-v5.c
@@ -1015,6 +1015,7 @@ const struct ccp_vdata ccpv5a = {
 
 const struct ccp_vdata ccpv5b = {
         .version = CCP_VERSION(5, 0),
+        .dma_chan_attr = DMA_PRIVATE,
         .setup = ccp5other_config,
         .perform = &ccp5_actions,
         .bar = 2,
diff --git a/drivers/crypto/ccp/ccp-dev.c b/drivers/crypto/ccp/ccp-dev.c
index 511ab042b5e7..92d1c6959f08 100644
--- a/drivers/crypto/ccp/ccp-dev.c
+++ b/drivers/crypto/ccp/ccp-dev.c
@@ -283,11 +283,14 @@ EXPORT_SYMBOL_GPL(ccp_version);
  */
 int ccp_enqueue_cmd(struct ccp_cmd *cmd)
 {
-        struct ccp_device *ccp = ccp_get_device();
+        struct ccp_device *ccp;
         unsigned long flags;
         unsigned int i;
         int ret;
 
+        /* Some commands might need to be sent to a specific device */
+        ccp = cmd->ccp ? cmd->ccp : ccp_get_device();
+
         if (!ccp)
                 return -ENODEV;
 
diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
index 2b5c01fade05..aa36f3f81860 100644
--- a/drivers/crypto/ccp/ccp-dev.h
+++ b/drivers/crypto/ccp/ccp-dev.h
@@ -179,6 +179,10 @@
 
 /* ------------------------ General CCP Defines ------------------------ */
 
+#define CCP_DMA_DFLT                    0x0
+#define CCP_DMA_PRIV                    0x1
+#define CCP_DMA_PUB                     0x2
+
 #define CCP_DMAPOOL_MAX_SIZE            64
 #define CCP_DMAPOOL_ALIGN               BIT(5)
 
@@ -636,6 +640,7 @@ struct ccp_actions {
 /* Structure to hold CCP version-specific values */
 struct ccp_vdata {
         const unsigned int version;
+        const unsigned int dma_chan_attr;
         void (*setup)(struct ccp_device *);
         const struct ccp_actions *perform;
         const unsigned int bar;
diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
index e5d9278f4019..e00be01fbf5a 100644
--- a/drivers/crypto/ccp/ccp-dmaengine.c
+++ b/drivers/crypto/ccp/ccp-dmaengine.c
@@ -10,6 +10,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/dmaengine.h>
 #include <linux/spinlock.h>
@@ -25,6 +26,37 @@
         (mask == 0) ? 64 : fls64(mask); \
 })
 
+/* The CCP as a DMA provider can be configured for public or private
+ * channels. Default is specified in the vdata for the device (PCI ID).
+ * This module parameter will override for all channels on all devices:
+ *   dma_chan_attr = 0x2 to force all channels public
+ *                 = 0x1 to force all channels private
+ *                 = 0x0 to defer to the vdata setting
+ *                 = any other value: warning, revert to 0x0
+ */
+static unsigned int dma_chan_attr = CCP_DMA_DFLT;
+module_param(dma_chan_attr, uint, 0444);
+MODULE_PARM_DESC(dma_chan_attr, "Set DMA channel visibility: 0 (default) = device defaults, 1 = make private, 2 = make public");
+
+unsigned int ccp_get_dma_chan_attr(struct ccp_device *ccp)
+{
+        switch (dma_chan_attr) {
+        case CCP_DMA_DFLT:
+                return ccp->vdata->dma_chan_attr;
+
+        case CCP_DMA_PRIV:
+                return DMA_PRIVATE;
+
+        case CCP_DMA_PUB:
+                return 0;
+
+        default:
+                dev_info_once(ccp->dev, "Invalid value for dma_chan_attr: %d\n",
+                              dma_chan_attr);
+                return ccp->vdata->dma_chan_attr;
+        }
+}
+
 static void ccp_free_cmd_resources(struct ccp_device *ccp,
                                    struct list_head *list)
 {
@@ -390,6 +422,7 @@ static struct ccp_dma_desc *ccp_create_desc(struct dma_chan *dma_chan,
                         goto err;
 
                 ccp_cmd = &cmd->ccp_cmd;
+                ccp_cmd->ccp = chan->ccp;
                 ccp_pt = &ccp_cmd->u.passthru_nomap;
                 ccp_cmd->flags = CCP_CMD_MAY_BACKLOG;
                 ccp_cmd->flags |= CCP_CMD_PASSTHRU_NO_DMA_MAP;
@@ -674,6 +707,15 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
         dma_cap_set(DMA_SG, dma_dev->cap_mask);
         dma_cap_set(DMA_INTERRUPT, dma_dev->cap_mask);
 
+        /* The DMA channels for this device can be set to public or private,
+         * and overridden by the module parameter dma_chan_attr.
+         * Default: according to the value in vdata (dma_chan_attr=0)
+         * dma_chan_attr=0x1: all channels private (override vdata)
+         * dma_chan_attr=0x2: all channels public (override vdata)
+         */
+        if (ccp_get_dma_chan_attr(ccp) == DMA_PRIVATE)
+                dma_cap_set(DMA_PRIVATE, dma_dev->cap_mask);
+
         INIT_LIST_HEAD(&dma_dev->channels);
         for (i = 0; i < ccp->cmd_q_count; i++) {
                 chan = ccp->ccp_dma_chan + i;
diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
index dce1af0ce85c..1b9da3dc799b 100644
--- a/drivers/crypto/s5p-sss.c
+++ b/drivers/crypto/s5p-sss.c
@@ -270,7 +270,7 @@ static void s5p_sg_copy_buf(void *buf, struct scatterlist *sg,
         scatterwalk_done(&walk, out, 0);
 }
 
-static void s5p_aes_complete(struct s5p_aes_dev *dev, int err)
+static void s5p_sg_done(struct s5p_aes_dev *dev)
 {
         if (dev->sg_dst_cpy) {
                 dev_dbg(dev->dev,
@@ -281,8 +281,11 @@ static void s5p_aes_complete(struct s5p_aes_dev *dev, int err)
         }
         s5p_free_sg_cpy(dev, &dev->sg_src_cpy);
         s5p_free_sg_cpy(dev, &dev->sg_dst_cpy);
+}
 
-        /* holding a lock outside */
+/* Calls the completion. Cannot be called with dev->lock hold. */
+static void s5p_aes_complete(struct s5p_aes_dev *dev, int err)
+{
         dev->req->base.complete(&dev->req->base, err);
         dev->busy = false;
 }
@@ -368,51 +371,44 @@ exit:
 }
 
 /*
- * Returns true if new transmitting (output) data is ready and its
- * address+length have to be written to device (by calling
- * s5p_set_dma_outdata()). False otherwise.
+ * Returns -ERRNO on error (mapping of new data failed).
+ * On success returns:
+ *  - 0 if there is no more data,
+ *  - 1 if new transmitting (output) data is ready and its address+length
+ *     have to be written to device (by calling s5p_set_dma_outdata()).
  */
-static bool s5p_aes_tx(struct s5p_aes_dev *dev)
+static int s5p_aes_tx(struct s5p_aes_dev *dev)
 {
-        int err = 0;
-        bool ret = false;
+        int ret = 0;
 
         s5p_unset_outdata(dev);
 
         if (!sg_is_last(dev->sg_dst)) {
-                err = s5p_set_outdata(dev, sg_next(dev->sg_dst));
-                if (err)
-                        s5p_aes_complete(dev, err);
-                else
-                        ret = true;
-        } else {
-                s5p_aes_complete(dev, err);
-
-                dev->busy = true;
-                tasklet_schedule(&dev->tasklet);
+                ret = s5p_set_outdata(dev, sg_next(dev->sg_dst));
+                if (!ret)
+                        ret = 1;
         }
 
         return ret;
 }
 
 /*
- * Returns true if new receiving (input) data is ready and its
- * address+length have to be written to device (by calling
- * s5p_set_dma_indata()). False otherwise.
+ * Returns -ERRNO on error (mapping of new data failed).
+ * On success returns:
+ *  - 0 if there is no more data,
+ *  - 1 if new receiving (input) data is ready and its address+length
+ *     have to be written to device (by calling s5p_set_dma_indata()).
  */
-static bool s5p_aes_rx(struct s5p_aes_dev *dev)
+static int s5p_aes_rx(struct s5p_aes_dev *dev/*, bool *set_dma*/)
 {
-        int err;
-        bool ret = false;
+        int ret = 0;
 
         s5p_unset_indata(dev);
 
         if (!sg_is_last(dev->sg_src)) {
-                err = s5p_set_indata(dev, sg_next(dev->sg_src));
-                if (err)
-                        s5p_aes_complete(dev, err);
-                else
-                        ret = true;
+                ret = s5p_set_indata(dev, sg_next(dev->sg_src));
+                if (!ret)
+                        ret = 1;
         }
 
         return ret;
@@ -422,33 +418,73 @@ static irqreturn_t s5p_aes_interrupt(int irq, void *dev_id)
 {
         struct platform_device *pdev = dev_id;
         struct s5p_aes_dev *dev = platform_get_drvdata(pdev);
-        bool set_dma_tx = false;
-        bool set_dma_rx = false;
+        int err_dma_tx = 0;
+        int err_dma_rx = 0;
+        bool tx_end = false;
         unsigned long flags;
         uint32_t status;
+        int err;
 
         spin_lock_irqsave(&dev->lock, flags);
 
+        /*
+         * Handle rx or tx interrupt. If there is still data (scatterlist did not
+         * reach end), then map next scatterlist entry.
+         * In case of such mapping error, s5p_aes_complete() should be called.
+         *
+         * If there is no more data in tx scatter list, call s5p_aes_complete()
+         * and schedule new tasklet.
+         */
         status = SSS_READ(dev, FCINTSTAT);
         if (status & SSS_FCINTSTAT_BRDMAINT)
-                set_dma_rx = s5p_aes_rx(dev);
-        if (status & SSS_FCINTSTAT_BTDMAINT)
-                set_dma_tx = s5p_aes_tx(dev);
+                err_dma_rx = s5p_aes_rx(dev);
+
+        if (status & SSS_FCINTSTAT_BTDMAINT) {
+                if (sg_is_last(dev->sg_dst))
+                        tx_end = true;
+                err_dma_tx = s5p_aes_tx(dev);
+        }
 
         SSS_WRITE(dev, FCINTPEND, status);
 
-        /*
-         * Writing length of DMA block (either receiving or transmitting)
-         * will start the operation immediately, so this should be done
-         * at the end (even after clearing pending interrupts to not miss the
-         * interrupt).
-         */
-        if (set_dma_tx)
-                s5p_set_dma_outdata(dev, dev->sg_dst);
-        if (set_dma_rx)
-                s5p_set_dma_indata(dev, dev->sg_src);
+        if (err_dma_rx < 0) {
+                err = err_dma_rx;
+                goto error;
+        }
+        if (err_dma_tx < 0) {
+                err = err_dma_tx;
+                goto error;
+        }
+
+        if (tx_end) {
+                s5p_sg_done(dev);
+
+                spin_unlock_irqrestore(&dev->lock, flags);
+
+                s5p_aes_complete(dev, 0);
+                dev->busy = true;
+                tasklet_schedule(&dev->tasklet);
+        } else {
+                /*
+                 * Writing length of DMA block (either receiving or
+                 * transmitting) will start the operation immediately, so this
+                 * should be done at the end (even after clearing pending
+                 * interrupts to not miss the interrupt).
+                 */
+                if (err_dma_tx == 1)
+                        s5p_set_dma_outdata(dev, dev->sg_dst);
+                if (err_dma_rx == 1)
+                        s5p_set_dma_indata(dev, dev->sg_src);
 
+                spin_unlock_irqrestore(&dev->lock, flags);
+        }
+
+        return IRQ_HANDLED;
+
+error:
+        s5p_sg_done(dev);
         spin_unlock_irqrestore(&dev->lock, flags);
+        s5p_aes_complete(dev, err);
 
         return IRQ_HANDLED;
 }
@@ -597,8 +633,9 @@ outdata_error:
         s5p_unset_indata(dev);
 
 indata_error:
-        s5p_aes_complete(dev, err);
+        s5p_sg_done(dev);
         spin_unlock_irqrestore(&dev->lock, flags);
+        s5p_aes_complete(dev, err);
 }
 
 static void s5p_tasklet_cb(unsigned long data)
@@ -805,8 +842,9 @@ static int s5p_aes_probe(struct platform_device *pdev)
                 dev_warn(dev, "feed control interrupt is not available.\n");
                 goto err_irq;
         }
-        err = devm_request_irq(dev, pdata->irq_fc, s5p_aes_interrupt,
-                               IRQF_SHARED, pdev->name, pdev);
+        err = devm_request_threaded_irq(dev, pdata->irq_fc, NULL,
+                                        s5p_aes_interrupt, IRQF_ONESHOT,
+                                        pdev->name, pdev);
         if (err < 0) {
                 dev_warn(dev, "feed control interrupt is not available.\n");
                 goto err_irq;
diff --git a/drivers/crypto/ux500/cryp/cryp.c b/drivers/crypto/ux500/cryp/cryp.c
index 43a0c8a26ab0..00a16ab601cb 100644
--- a/drivers/crypto/ux500/cryp/cryp.c
+++ b/drivers/crypto/ux500/cryp/cryp.c
@@ -82,7 +82,7 @@ void cryp_activity(struct cryp_device_data *device_data,
 void cryp_flush_inoutfifo(struct cryp_device_data *device_data)
 {
         /*
-         * We always need to disble the hardware before trying to flush the
+         * We always need to disable the hardware before trying to flush the
          * FIFO. This is something that isn't written in the design
          * specification, but we have been informed by the hardware designers
          * that this must be done.
diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
index 8d9829ff2a78..80c6db279ae1 100644
--- a/drivers/dax/dax.c
+++ b/drivers/dax/dax.c
@@ -427,6 +427,7 @@ static int __dax_dev_pte_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
         int rc = VM_FAULT_SIGBUS;
         phys_addr_t phys;
         pfn_t pfn;
+        unsigned int fault_size = PAGE_SIZE;
 
         if (check_vma(dax_dev, vmf->vma, __func__))
                 return VM_FAULT_SIGBUS;
@@ -437,9 +438,12 @@ static int __dax_dev_pte_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
                 return VM_FAULT_SIGBUS;
         }
 
+        if (fault_size != dax_region->align)
+                return VM_FAULT_SIGBUS;
+
         phys = pgoff_to_phys(dax_dev, vmf->pgoff, PAGE_SIZE);
         if (phys == -1) {
-                dev_dbg(dev, "%s: phys_to_pgoff(%#lx) failed\n", __func__,
+                dev_dbg(dev, "%s: pgoff_to_phys(%#lx) failed\n", __func__,
                                 vmf->pgoff);
                 return VM_FAULT_SIGBUS;
         }
@@ -464,6 +468,7 @@ static int __dax_dev_pmd_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
         phys_addr_t phys;
         pgoff_t pgoff;
         pfn_t pfn;
+        unsigned int fault_size = PMD_SIZE;
 
         if (check_vma(dax_dev, vmf->vma, __func__))
                 return VM_FAULT_SIGBUS;
@@ -480,10 +485,20 @@ static int __dax_dev_pmd_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
                 return VM_FAULT_SIGBUS;
         }
 
+        if (fault_size < dax_region->align)
+                return VM_FAULT_SIGBUS;
+        else if (fault_size > dax_region->align)
+                return VM_FAULT_FALLBACK;
+
+        /* if we are outside of the VMA */
+        if (pmd_addr < vmf->vma->vm_start ||
+                        (pmd_addr + PMD_SIZE) > vmf->vma->vm_end)
+                return VM_FAULT_SIGBUS;
+
         pgoff = linear_page_index(vmf->vma, pmd_addr);
         phys = pgoff_to_phys(dax_dev, pgoff, PMD_SIZE);
         if (phys == -1) {
-                dev_dbg(dev, "%s: phys_to_pgoff(%#lx) failed\n", __func__,
+                dev_dbg(dev, "%s: pgoff_to_phys(%#lx) failed\n", __func__,
                                 pgoff);
                 return VM_FAULT_SIGBUS;
         }
@@ -503,6 +518,8 @@ static int __dax_dev_pud_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
         phys_addr_t phys;
         pgoff_t pgoff;
         pfn_t pfn;
+        unsigned int fault_size = PUD_SIZE;
+
 
         if (check_vma(dax_dev, vmf->vma, __func__))
                 return VM_FAULT_SIGBUS;
@@ -519,10 +536,20 @@ static int __dax_dev_pud_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
                 return VM_FAULT_SIGBUS;
         }
 
+        if (fault_size < dax_region->align)
+                return VM_FAULT_SIGBUS;
+        else if (fault_size > dax_region->align)
+                return VM_FAULT_FALLBACK;
+
+        /* if we are outside of the VMA */
+        if (pud_addr < vmf->vma->vm_start ||
+                        (pud_addr + PUD_SIZE) > vmf->vma->vm_end)
+                return VM_FAULT_SIGBUS;
+
         pgoff = linear_page_index(vmf->vma, pud_addr);
         phys = pgoff_to_phys(dax_dev, pgoff, PUD_SIZE);
         if (phys == -1) {
-                dev_dbg(dev, "%s: phys_to_pgoff(%#lx) failed\n", __func__,
+                dev_dbg(dev, "%s: pgoff_to_phys(%#lx) failed\n", __func__,
                                 pgoff);
                 return VM_FAULT_SIGBUS;
         }
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index e18dc596cf24..6204cc32d09c 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -251,8 +251,11 @@ static void bcm2835_dma_create_cb_set_length(
          */
 
         /* have we filled in period_length yet? */
-        if (*total_len + control_block->length < period_len)
+        if (*total_len + control_block->length < period_len) {
+                /* update number of bytes in this period so far */
+                *total_len += control_block->length;
                 return;
+        }
 
         /* calculate the length that remains to reach period_length */
         control_block->length = period_len - *total_len;
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 24e0221fd66d..d9118ec23025 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1108,12 +1108,14 @@ static struct dmaengine_unmap_pool *__get_unmap_pool(int nr)
         switch (order) {
         case 0 ... 1:
                 return &unmap_pool[0];
+#if IS_ENABLED(CONFIG_DMA_ENGINE_RAID)
         case 2 ... 4:
                 return &unmap_pool[1];
         case 5 ... 7:
                 return &unmap_pool[2];
         case 8:
                 return &unmap_pool[3];
+#endif
         default:
                 BUG();
                 return NULL;
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index 82d85cce81f8..4773f2867234 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -43,6 +43,7 @@ config EDAC_LEGACY_SYSFS
 
 config EDAC_DEBUG
         bool "Debugging"
+        select DEBUG_FS
         help
           This turns on debugging information for the entire EDAC subsystem.
           You do so by inserting edac_module with "edac_debug_level=x." Valid
@@ -259,6 +260,15 @@ config EDAC_SKX
           Support for error detection and correction the Intel
           Skylake server Integrated Memory Controllers.
 
+config EDAC_PND2
+        tristate "Intel Pondicherry2"
+        depends on EDAC_MM_EDAC && PCI && X86_64 && X86_MCE_INTEL
+        help
+          Support for error detection and correction on the Intel
+          Pondicherry2 Integrated Memory Controller. This SoC IP is
+          first used on the Apollo Lake platform and Denverton
+          micro-server but may appear on others in the future.
+
 config EDAC_MPC85XX
         tristate "Freescale MPC83xx / MPC85xx"
         depends on EDAC_MM_EDAC && FSL_SOC
diff --git a/drivers/edac/Makefile b/drivers/edac/Makefile
index 88e472e8b9a9..587107e90996 100644
--- a/drivers/edac/Makefile
+++ b/drivers/edac/Makefile
@@ -32,6 +32,7 @@ obj-$(CONFIG_EDAC_I7300)		+= i7300_edac.o
 obj-$(CONFIG_EDAC_I7CORE)               += i7core_edac.o
 obj-$(CONFIG_EDAC_SBRIDGE)              += sb_edac.o
 obj-$(CONFIG_EDAC_SKX)                  += skx_edac.o
+obj-$(CONFIG_EDAC_PND2)                 += pnd2_edac.o
 obj-$(CONFIG_EDAC_E7XXX)                += e7xxx_edac.o
 obj-$(CONFIG_EDAC_E752X)                += e752x_edac.o
 obj-$(CONFIG_EDAC_I82443BXGX)           += i82443bxgx_edac.o
diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
index 1670d27bcac8..f683919981b0 100644
--- a/drivers/edac/i5000_edac.c
+++ b/drivers/edac/i5000_edac.c
@@ -1293,7 +1293,7 @@ static int i5000_init_csrows(struct mem_ctl_info *mci)
                         dimm->mtype = MEM_FB_DDR2;
 
                         /* ask what device type on this row */
-                        if (MTR_DRAM_WIDTH(mtr))
+                        if (MTR_DRAM_WIDTH(mtr) == 8)
                                 dimm->dtype = DEV_X8;
                         else
                                 dimm->dtype = DEV_X4;
diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c
index abf6ef22e220..37a9ba71da44 100644
--- a/drivers/edac/i5400_edac.c
+++ b/drivers/edac/i5400_edac.c
@@ -1207,13 +1207,14 @@ static int i5400_init_dimms(struct mem_ctl_info *mci)
 
                         dimm->nr_pages = size_mb << 8;
                         dimm->grain = 8;
-                        dimm->dtype = MTR_DRAM_WIDTH(mtr) ? DEV_X8 : DEV_X4;
+                        dimm->dtype = MTR_DRAM_WIDTH(mtr) == 8 ?
+                                      DEV_X8 : DEV_X4;
                         dimm->mtype = MEM_FB_DDR2;
                         /*
                          * The eccc mechanism is SDDC (aka SECC), with
                          * is similar to Chipkill.
                          */
-                        dimm->edac_mode = MTR_DRAM_WIDTH(mtr) ?
+                        dimm->edac_mode = MTR_DRAM_WIDTH(mtr) == 8 ?
                                           EDAC_S8ECD8ED : EDAC_S4ECD4ED;
                         ndimms++;
                 }
diff --git a/drivers/edac/pnd2_edac.c b/drivers/edac/pnd2_edac.c
new file mode 100644
index 000000000000..928e0dba41fc
--- /dev/null
+++ b/drivers/edac/pnd2_edac.c
@@ -0,0 +1,1546 @@
+/*
+ * Driver for Pondicherry2 memory controller.
+ *
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * [Derived from sb_edac.c]
+ *
+ * Translation of system physical addresses to DIMM addresses
+ * is a two stage process:
+ *
+ * First the Pondicherry 2 memory controller handles slice and channel interleaving
+ * in "sys2pmi()". This is (almost) completley common between platforms.
+ *
+ * Then a platform specific dunit (DIMM unit) completes the process to provide DIMM,
+ * rank, bank, row and column using the appropriate "dunit_ops" functions/parameters.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/pci_ids.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/edac.h>
+#include <linux/mmzone.h>
+#include <linux/smp.h>
+#include <linux/bitmap.h>
+#include <linux/math64.h>
+#include <linux/mod_devicetable.h>
+#include <asm/cpu_device_id.h>
+#include <asm/intel-family.h>
+#include <asm/processor.h>
+#include <asm/mce.h>
+
+#include "edac_mc.h"
+#include "edac_module.h"
+#include "pnd2_edac.h"
+
+#define APL_NUM_CHANNELS        4
+#define DNV_NUM_CHANNELS        2
+#define DNV_MAX_DIMMS           2 /* Max DIMMs per channel */
+
+enum type {
+        APL,
+        DNV, /* All requests go to PMI CH0 on each slice (CH1 disabled) */
+};
+
+struct dram_addr {
+        int chan;
+        int dimm;
+        int rank;
+        int bank;
+        int row;
+        int col;
+};
+
+struct pnd2_pvt {
+        int dimm_geom[APL_NUM_CHANNELS];
+        u64 tolm, tohm;
+};
+
+/*
+ * System address space is divided into multiple regions with
+ * different interleave rules in each. The as0/as1 regions
+ * have no interleaving at all. The as2 region is interleaved
+ * between two channels. The mot region is magic and may overlap
+ * other regions, with its interleave rules taking precedence.
+ * Addresses not in any of these regions are interleaved across
+ * all four channels.
+ */
+static struct region {
+        u64     base;
+        u64     limit;
+        u8      enabled;
+} mot, as0, as1, as2;
+
+static struct dunit_ops {
+        char *name;
+        enum type type;
+        int pmiaddr_shift;
+        int pmiidx_shift;
+        int channels;
+        int dimms_per_channel;
+        int (*rd_reg)(int port, int off, int op, void *data, size_t sz, char *name);
+        int (*get_registers)(void);
+        int (*check_ecc)(void);
+        void (*mk_region)(char *name, struct region *rp, void *asym);
+        void (*get_dimm_config)(struct mem_ctl_info *mci);
+        int (*pmi2mem)(struct mem_ctl_info *mci, u64 pmiaddr, u32 pmiidx,
+                                   struct dram_addr *daddr, char *msg);
+} *ops;
+
+static struct mem_ctl_info *pnd2_mci;
+
+#define PND2_MSG_SIZE   256
+
+/* Debug macros */
+#define pnd2_printk(level, fmt, arg...)                 \
+        edac_printk(level, "pnd2", fmt, ##arg)
+
+#define pnd2_mc_printk(mci, level, fmt, arg...) \
+        edac_mc_chipset_printk(mci, level, "pnd2", fmt, ##arg)
+
+#define MOT_CHAN_INTLV_BIT_1SLC_2CH 12
+#define MOT_CHAN_INTLV_BIT_2SLC_2CH 13
+#define SELECTOR_DISABLED (-1)
+#define _4GB (1ul << 32)
+
+#define PMI_ADDRESS_WIDTH       31
+#define PND_MAX_PHYS_BIT        39
+
+#define APL_ASYMSHIFT           28
+#define DNV_ASYMSHIFT           31
+#define CH_HASH_MASK_LSB        6
+#define SLICE_HASH_MASK_LSB     6
+#define MOT_SLC_INTLV_BIT       12
+#define LOG2_PMI_ADDR_GRANULARITY       5
+#define MOT_SHIFT       24
+
+#define GET_BITFIELD(v, lo, hi) (((v) & GENMASK_ULL(hi, lo)) >> (lo))
+#define U64_LSHIFT(val, s)      ((u64)(val) << (s))
+
+#ifdef CONFIG_X86_INTEL_SBI_APL
+#include "linux/platform_data/sbi_apl.h"
+int sbi_send(int port, int off, int op, u32 *data)
+{
+        struct sbi_apl_message sbi_arg;
+        int ret, read = 0;
+
+        memset(&sbi_arg, 0, sizeof(sbi_arg));
+
+        if (op == 0 || op == 4 || op == 6)
+                read = 1;
+        else
+                sbi_arg.data = *data;
+
+        sbi_arg.opcode = op;
+        sbi_arg.port_address = port;
+        sbi_arg.register_offset = off;
+        ret = sbi_apl_commit(&sbi_arg);
+        if (ret || sbi_arg.status)
+                edac_dbg(2, "sbi_send status=%d ret=%d data=%x\n",
+                                 sbi_arg.status, ret, sbi_arg.data);
+
+        if (ret == 0)
+                ret = sbi_arg.status;
+
+        if (ret == 0 && read)
+                *data = sbi_arg.data;
+
+        return ret;
+}
+#else
+int sbi_send(int port, int off, int op, u32 *data)
+{
+        return -EUNATCH;
+}
+#endif
+
+static int apl_rd_reg(int port, int off, int op, void *data, size_t sz, char *name)
+{
+        int     ret = 0;
+
+        edac_dbg(2, "Read %s port=%x off=%x op=%x\n", name, port, off, op);
+        switch (sz) {
+        case 8:
+                ret = sbi_send(port, off + 4, op, (u32 *)(data + 4));
+        case 4:
+                ret = sbi_send(port, off, op, (u32 *)data);
+                pnd2_printk(KERN_DEBUG, "%s=%x%08x ret=%d\n", name,
+                                        sz == 8 ? *((u32 *)(data + 4)) : 0, *((u32 *)data), ret);
+                break;
+        }
+
+        return ret;
+}
+
+static u64 get_mem_ctrl_hub_base_addr(void)
+{
+        struct b_cr_mchbar_lo_pci lo;
+        struct b_cr_mchbar_hi_pci hi;
+        struct pci_dev *pdev;
+
+        pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x1980, NULL);
+        if (pdev) {
+                pci_read_config_dword(pdev, 0x48, (u32 *)&lo);
+                pci_read_config_dword(pdev, 0x4c, (u32 *)&hi);
+                pci_dev_put(pdev);
+        } else {
+                return 0;
+        }
+
+        if (!lo.enable) {
+                edac_dbg(2, "MMIO via memory controller hub base address is disabled!\n");
+                return 0;
+        }
+
+        return U64_LSHIFT(hi.base, 32) | U64_LSHIFT(lo.base, 15);
+}
+
+static u64 get_sideband_reg_base_addr(void)
+{
+        struct pci_dev *pdev;
+        u32 hi, lo;
+
+        pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x19dd, NULL);
+        if (pdev) {
+                pci_read_config_dword(pdev, 0x10, &lo);
+                pci_read_config_dword(pdev, 0x14, &hi);
+                pci_dev_put(pdev);
+                return (U64_LSHIFT(hi, 32) | U64_LSHIFT(lo, 0));
+        } else {
+                return 0xfd000000;
+        }
+}
+
+static int dnv_rd_reg(int port, int off, int op, void *data, size_t sz, char *name)
+{
+        struct pci_dev *pdev;
+        char *base;
+        u64 addr;
+
+        if (op == 4) {
+                pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x1980, NULL);
+                if (!pdev)
+                        return -ENODEV;
+
+                pci_read_config_dword(pdev, off, data);
+                pci_dev_put(pdev);
+        } else {
+                /* MMIO via memory controller hub base address */
+                if (op == 0 && port == 0x4c) {
+                        addr = get_mem_ctrl_hub_base_addr();
+                        if (!addr)
+                                return -ENODEV;
+                } else {
+                        /* MMIO via sideband register base address */
+                        addr = get_sideband_reg_base_addr();
+                        if (!addr)
+                                return -ENODEV;
+                        addr += (port << 16);
+                }
+
+                base = ioremap((resource_size_t)addr, 0x10000);
+                if (!base)
+                        return -ENODEV;
+
+                if (sz == 8)
+                        *(u32 *)(data + 4) = *(u32 *)(base + off + 4);
+                *(u32 *)data = *(u32 *)(base + off);
+
+                iounmap(base);
+        }
+
+        edac_dbg(2, "Read %s=%.8x_%.8x\n", name,
+                        (sz == 8) ? *(u32 *)(data + 4) : 0, *(u32 *)data);
+
+        return 0;
+}
+
+#define RD_REGP(regp, regname, port)    \
+        ops->rd_reg(port,                                       \
+                regname##_offset,                               \
+                regname##_r_opcode,                             \
+                regp, sizeof(struct regname),   \
+                #regname)
+
+#define RD_REG(regp, regname)                   \
+        ops->rd_reg(regname ## _port,           \
+                regname##_offset,                               \
+                regname##_r_opcode,                             \
+                regp, sizeof(struct regname),   \
+                #regname)
+
+static u64 top_lm, top_hm;
+static bool two_slices;
+static bool two_channels; /* Both PMI channels in one slice enabled */
+
+static u8 sym_chan_mask;
+static u8 asym_chan_mask;
+static u8 chan_mask;
+
+static int slice_selector = -1;
+static int chan_selector = -1;
+static u64 slice_hash_mask;
+static u64 chan_hash_mask;
+
+static void mk_region(char *name, struct region *rp, u64 base, u64 limit)
+{
+        rp->enabled = 1;
+        rp->base = base;
+        rp->limit = limit;
+        edac_dbg(2, "Region:%s [%llx, %llx]\n", name, base, limit);
+}
+
+static void mk_region_mask(char *name, struct region *rp, u64 base, u64 mask)
+{
+        if (mask == 0) {
+                pr_info(FW_BUG "MOT mask cannot be zero\n");
+                return;
+        }
+        if (mask != GENMASK_ULL(PND_MAX_PHYS_BIT, __ffs(mask))) {
+                pr_info(FW_BUG "MOT mask not power of two\n");
+                return;
+        }
+        if (base & ~mask) {
+                pr_info(FW_BUG "MOT region base/mask alignment error\n");
+                return;
+        }
+        rp->base = base;
+        rp->limit = (base | ~mask) & GENMASK_ULL(PND_MAX_PHYS_BIT, 0);
+        rp->enabled = 1;
+        edac_dbg(2, "Region:%s [%llx, %llx]\n", name, base, rp->limit);
+}
+
+static bool in_region(struct region *rp, u64 addr)
+{
+        if (!rp->enabled)
+                return false;
+
+        return rp->base <= addr && addr <= rp->limit;
+}
+
+static int gen_sym_mask(struct b_cr_slice_channel_hash *p)
+{
+        int mask = 0;
+
+        if (!p->slice_0_mem_disabled)
+                mask |= p->sym_slice0_channel_enabled;
+
+        if (!p->slice_1_disabled)
+                mask |= p->sym_slice1_channel_enabled << 2;
+
+        if (p->ch_1_disabled || p->enable_pmi_dual_data_mode)
+                mask &= 0x5;
+
+        return mask;
+}
+
+static int gen_asym_mask(struct b_cr_slice_channel_hash *p,
+                         struct b_cr_asym_mem_region0_mchbar *as0,
+                         struct b_cr_asym_mem_region1_mchbar *as1,
+                         struct b_cr_asym_2way_mem_region_mchbar *as2way)
+{
+        const int intlv[] = { 0x5, 0xA, 0x3, 0xC };
+        int mask = 0;
+
+        if (as2way->asym_2way_interleave_enable)
+                mask = intlv[as2way->asym_2way_intlv_mode];
+        if (as0->slice0_asym_enable)
+                mask |= (1 << as0->slice0_asym_channel_select);
+        if (as1->slice1_asym_enable)
+                mask |= (4 << as1->slice1_asym_channel_select);
+        if (p->slice_0_mem_disabled)
+                mask &= 0xc;
+        if (p->slice_1_disabled)
+                mask &= 0x3;
+        if (p->ch_1_disabled || p->enable_pmi_dual_data_mode)
+                mask &= 0x5;
+
+        return mask;
+}
+
+static struct b_cr_tolud_pci tolud;
+static struct b_cr_touud_lo_pci touud_lo;
+static struct b_cr_touud_hi_pci touud_hi;
+static struct b_cr_asym_mem_region0_mchbar asym0;
+static struct b_cr_asym_mem_region1_mchbar asym1;
+static struct b_cr_asym_2way_mem_region_mchbar asym_2way;
+static struct b_cr_mot_out_base_mchbar mot_base;
+static struct b_cr_mot_out_mask_mchbar mot_mask;
+static struct b_cr_slice_channel_hash chash;
+
+/* Apollo Lake dunit */
+/*
+ * Validated on board with just two DIMMs in the [0] and [2] positions
+ * in this array. Other port number matches documentation, but caution
+ * advised.
+ */
+static const int apl_dports[APL_NUM_CHANNELS] = { 0x18, 0x10, 0x11, 0x19 };
+static struct d_cr_drp0 drp0[APL_NUM_CHANNELS];
+
+/* Denverton dunit */
+static const int dnv_dports[DNV_NUM_CHANNELS] = { 0x10, 0x12 };
+static struct d_cr_dsch dsch;
+static struct d_cr_ecc_ctrl ecc_ctrl[DNV_NUM_CHANNELS];
+static struct d_cr_drp drp[DNV_NUM_CHANNELS];
+static struct d_cr_dmap dmap[DNV_NUM_CHANNELS];
+static struct d_cr_dmap1 dmap1[DNV_NUM_CHANNELS];
+static struct d_cr_dmap2 dmap2[DNV_NUM_CHANNELS];
+static struct d_cr_dmap3 dmap3[DNV_NUM_CHANNELS];
+static struct d_cr_dmap4 dmap4[DNV_NUM_CHANNELS];
+static struct d_cr_dmap5 dmap5[DNV_NUM_CHANNELS];
+
+static void apl_mk_region(char *name, struct region *rp, void *asym)
+{
+        struct b_cr_asym_mem_region0_mchbar *a = asym;
+
+        mk_region(name, rp,
+                          U64_LSHIFT(a->slice0_asym_base, APL_ASYMSHIFT),
+                          U64_LSHIFT(a->slice0_asym_limit, APL_ASYMSHIFT) +
+                          GENMASK_ULL(APL_ASYMSHIFT - 1, 0));
+}
+
+static void dnv_mk_region(char *name, struct region *rp, void *asym)
+{
+        struct b_cr_asym_mem_region_denverton *a = asym;
+
+        mk_region(name, rp,
+                          U64_LSHIFT(a->slice_asym_base, DNV_ASYMSHIFT),
+                          U64_LSHIFT(a->slice_asym_limit, DNV_ASYMSHIFT) +
+                          GENMASK_ULL(DNV_ASYMSHIFT - 1, 0));
+}
+
+static int apl_get_registers(void)
+{
+        int i;
+
+        if (RD_REG(&asym_2way, b_cr_asym_2way_mem_region_mchbar))
+                return -ENODEV;
+
+        for (i = 0; i < APL_NUM_CHANNELS; i++)
+                if (RD_REGP(&drp0[i], d_cr_drp0, apl_dports[i]))
+                        return -ENODEV;
+
+        return 0;
+}
+
+static int dnv_get_registers(void)
+{
+        int i;
+
+        if (RD_REG(&dsch, d_cr_dsch))
+                return -ENODEV;
+
+        for (i = 0; i < DNV_NUM_CHANNELS; i++)
+                if (RD_REGP(&ecc_ctrl[i], d_cr_ecc_ctrl, dnv_dports[i]) ||
+                        RD_REGP(&drp[i], d_cr_drp, dnv_dports[i]) ||
+                        RD_REGP(&dmap[i], d_cr_dmap, dnv_dports[i]) ||
+                        RD_REGP(&dmap1[i], d_cr_dmap1, dnv_dports[i]) ||
+                        RD_REGP(&dmap2[i], d_cr_dmap2, dnv_dports[i]) ||
+                        RD_REGP(&dmap3[i], d_cr_dmap3, dnv_dports[i]) ||
+                        RD_REGP(&dmap4[i], d_cr_dmap4, dnv_dports[i]) ||
+                        RD_REGP(&dmap5[i], d_cr_dmap5, dnv_dports[i]))
+                        return -ENODEV;
+
+        return 0;
+}
+
+/*
+ * Read all the h/w config registers once here (they don't
+ * change at run time. Figure out which address ranges have
+ * which interleave characteristics.
+ */
+static int get_registers(void)
+{
+        const int intlv[] = { 10, 11, 12, 12 };
+
+        if (RD_REG(&tolud, b_cr_tolud_pci) ||
+                RD_REG(&touud_lo, b_cr_touud_lo_pci) ||
+                RD_REG(&touud_hi, b_cr_touud_hi_pci) ||
+                RD_REG(&asym0, b_cr_asym_mem_region0_mchbar) ||
+                RD_REG(&asym1, b_cr_asym_mem_region1_mchbar) ||
+                RD_REG(&mot_base, b_cr_mot_out_base_mchbar) ||
+                RD_REG(&mot_mask, b_cr_mot_out_mask_mchbar) ||
+                RD_REG(&chash, b_cr_slice_channel_hash))
+                return -ENODEV;
+
+        if (ops->get_registers())
+                return -ENODEV;
+
+        if (ops->type == DNV) {
+                /* PMI channel idx (always 0) for asymmetric region */
+                asym0.slice0_asym_channel_select = 0;
+                asym1.slice1_asym_channel_select = 0;
+                /* PMI channel bitmap (always 1) for symmetric region */
+                chash.sym_slice0_channel_enabled = 0x1;
+                chash.sym_slice1_channel_enabled = 0x1;
+        }
+
+        if (asym0.slice0_asym_enable)
+                ops->mk_region("as0", &as0, &asym0);
+
+        if (asym1.slice1_asym_enable)
+                ops->mk_region("as1", &as1, &asym1);
+
+        if (asym_2way.asym_2way_interleave_enable) {
+                mk_region("as2way", &as2,
+                                  U64_LSHIFT(asym_2way.asym_2way_base, APL_ASYMSHIFT),
+                                  U64_LSHIFT(asym_2way.asym_2way_limit, APL_ASYMSHIFT) +
+                                  GENMASK_ULL(APL_ASYMSHIFT - 1, 0));
+        }
+
+        if (mot_base.imr_en) {
+                mk_region_mask("mot", &mot,
+                                           U64_LSHIFT(mot_base.mot_out_base, MOT_SHIFT),
+                                           U64_LSHIFT(mot_mask.mot_out_mask, MOT_SHIFT));
+        }
+
+        top_lm = U64_LSHIFT(tolud.tolud, 20);
+        top_hm = U64_LSHIFT(touud_hi.touud, 32) | U64_LSHIFT(touud_lo.touud, 20);
+
+        two_slices = !chash.slice_1_disabled &&
+                                 !chash.slice_0_mem_disabled &&
+                                 (chash.sym_slice0_channel_enabled != 0) &&
+                                 (chash.sym_slice1_channel_enabled != 0);
+        two_channels = !chash.ch_1_disabled &&
+                                 !chash.enable_pmi_dual_data_mode &&
+                                 ((chash.sym_slice0_channel_enabled == 3) ||
+                                 (chash.sym_slice1_channel_enabled == 3));
+
+        sym_chan_mask = gen_sym_mask(&chash);
+        asym_chan_mask = gen_asym_mask(&chash, &asym0, &asym1, &asym_2way);
+        chan_mask = sym_chan_mask | asym_chan_mask;
+
+        if (two_slices && !two_channels) {
+                if (chash.hvm_mode)
+                        slice_selector = 29;
+                else
+                        slice_selector = intlv[chash.interleave_mode];
+        } else if (!two_slices && two_channels) {
+                if (chash.hvm_mode)
+                        chan_selector = 29;
+                else
+                        chan_selector = intlv[chash.interleave_mode];
+        } else if (two_slices && two_channels) {
+                if (chash.hvm_mode) {
+                        slice_selector = 29;
+                        chan_selector = 30;
+                } else {
+                        slice_selector = intlv[chash.interleave_mode];
+                        chan_selector = intlv[chash.interleave_mode] + 1;
+                }
+        }
+
+        if (two_slices) {
+                if (!chash.hvm_mode)
+                        slice_hash_mask = chash.slice_hash_mask << SLICE_HASH_MASK_LSB;
+                if (!two_channels)
+                        slice_hash_mask |= BIT_ULL(slice_selector);
+        }
+
+        if (two_channels) {
+                if (!chash.hvm_mode)
+                        chan_hash_mask = chash.ch_hash_mask << CH_HASH_MASK_LSB;
+                if (!two_slices)
+                        chan_hash_mask |= BIT_ULL(chan_selector);
+        }
+
+        return 0;
+}
+
+/* Get a contiguous memory address (remove the MMIO gap) */
+static u64 remove_mmio_gap(u64 sys)
+{
+        return (sys < _4GB) ? sys : sys - (_4GB - top_lm);
+}
+
+/* Squeeze out one address bit, shift upper part down to fill gap */
+static void remove_addr_bit(u64 *addr, int bitidx)
+{
+        u64     mask;
+
+        if (bitidx == -1)
+                return;
+
+        mask = (1ull << bitidx) - 1;
+        *addr = ((*addr >> 1) & ~mask) | (*addr & mask);
+}
+
+/* XOR all the bits from addr specified in mask */
+static int hash_by_mask(u64 addr, u64 mask)
+{
+        u64 result = addr & mask;
+
+        result = (result >> 32) ^ result;
+        result = (result >> 16) ^ result;
+        result = (result >> 8) ^ result;
+        result = (result >> 4) ^ result;
+        result = (result >> 2) ^ result;
+        result = (result >> 1) ^ result;
+
+        return (int)result & 1;
+}
+
+/*
+ * First stage decode. Take the system address and figure out which
+ * second stage will deal with it based on interleave modes.
+ */
+static int sys2pmi(const u64 addr, u32 *pmiidx, u64 *pmiaddr, char *msg)
+{
+        u64 contig_addr, contig_base, contig_offset, contig_base_adj;
+        int mot_intlv_bit = two_slices ? MOT_CHAN_INTLV_BIT_2SLC_2CH :
+                                                MOT_CHAN_INTLV_BIT_1SLC_2CH;
+        int slice_intlv_bit_rm = SELECTOR_DISABLED;
+        int chan_intlv_bit_rm = SELECTOR_DISABLED;
+        /* Determine if address is in the MOT region. */
+        bool mot_hit = in_region(&mot, addr);
+        /* Calculate the number of symmetric regions enabled. */
+        int sym_channels = hweight8(sym_chan_mask);
+
+        /*
+         * The amount we need to shift the asym base can be determined by the
+         * number of enabled symmetric channels.
+         * NOTE: This can only work because symmetric memory is not supposed
+         * to do a 3-way interleave.
+         */
+        int sym_chan_shift = sym_channels >> 1;
+
+        /* Give up if address is out of range, or in MMIO gap */
+        if (addr >= (1ul << PND_MAX_PHYS_BIT) ||
+           (addr >= top_lm && addr < _4GB) || addr >= top_hm) {
+                snprintf(msg, PND2_MSG_SIZE, "Error address 0x%llx is not DRAM", addr);
+                return -EINVAL;
+        }
+
+        /* Get a contiguous memory address (remove the MMIO gap) */
+        contig_addr = remove_mmio_gap(addr);
+
+        if (in_region(&as0, addr)) {
+                *pmiidx = asym0.slice0_asym_channel_select;
+
+                contig_base = remove_mmio_gap(as0.base);
+                contig_offset = contig_addr - contig_base;
+                contig_base_adj = (contig_base >> sym_chan_shift) *
+                                                  ((chash.sym_slice0_channel_enabled >> (*pmiidx & 1)) & 1);
+                contig_addr = contig_offset + ((sym_channels > 0) ? contig_base_adj : 0ull);
+        } else if (in_region(&as1, addr)) {
+                *pmiidx = 2u + asym1.slice1_asym_channel_select;
+
+                contig_base = remove_mmio_gap(as1.base);
+                contig_offset = contig_addr - contig_base;
+                contig_base_adj = (contig_base >> sym_chan_shift) *
+                                                  ((chash.sym_slice1_channel_enabled >> (*pmiidx & 1)) & 1);
+                contig_addr = contig_offset + ((sym_channels > 0) ? contig_base_adj : 0ull);
+        } else if (in_region(&as2, addr) && (asym_2way.asym_2way_intlv_mode == 0x3ul)) {
+                bool channel1;
+
+                mot_intlv_bit = MOT_CHAN_INTLV_BIT_1SLC_2CH;
+                *pmiidx = (asym_2way.asym_2way_intlv_mode & 1) << 1;
+                channel1 = mot_hit ? ((bool)((addr >> mot_intlv_bit) & 1)) :
+                        hash_by_mask(contig_addr, chan_hash_mask);
+                *pmiidx |= (u32)channel1;
+
+                contig_base = remove_mmio_gap(as2.base);
+                chan_intlv_bit_rm = mot_hit ? mot_intlv_bit : chan_selector;
+                contig_offset = contig_addr - contig_base;
+                remove_addr_bit(&contig_offset, chan_intlv_bit_rm);
+                contig_addr = (contig_base >> sym_chan_shift) + contig_offset;
+        } else {
+                /* Otherwise we're in normal, boring symmetric mode. */
+                *pmiidx = 0u;
+
+                if (two_slices) {
+                        bool slice1;
+
+                        if (mot_hit) {
+                                slice_intlv_bit_rm = MOT_SLC_INTLV_BIT;
+                                slice1 = (addr >> MOT_SLC_INTLV_BIT) & 1;
+                        } else {
+                                slice_intlv_bit_rm = slice_selector;
+                                slice1 = hash_by_mask(addr, slice_hash_mask);
+                        }
+
+                        *pmiidx = (u32)slice1 << 1;
+                }
+
+                if (two_channels) {
+                        bool channel1;
+
+                        mot_intlv_bit = two_slices ? MOT_CHAN_INTLV_BIT_2SLC_2CH :
+                                                        MOT_CHAN_INTLV_BIT_1SLC_2CH;
+
+                        if (mot_hit) {
+                                chan_intlv_bit_rm = mot_intlv_bit;
+                                channel1 = (addr >> mot_intlv_bit) & 1;
+                        } else {
+                                chan_intlv_bit_rm = chan_selector;
+                                channel1 = hash_by_mask(contig_addr, chan_hash_mask);
+                        }
+
+                        *pmiidx |= (u32)channel1;
+                }
+        }
+
+        /* Remove the chan_selector bit first */
+        remove_addr_bit(&contig_addr, chan_intlv_bit_rm);
+        /* Remove the slice bit (we remove it second because it must be lower */
+        remove_addr_bit(&contig_addr, slice_intlv_bit_rm);
+        *pmiaddr = contig_addr;
+
+        return 0;
+}
+
+/* Translate PMI address to memory (rank, row, bank, column) */
+#define C(n) (0x10 | (n))       /* column */
+#define B(n) (0x20 | (n))       /* bank */
+#define R(n) (0x40 | (n))       /* row */
+#define RS   (0x80)                     /* rank */
+
+/* addrdec values */
+#define AMAP_1KB        0
+#define AMAP_2KB        1
+#define AMAP_4KB        2
+#define AMAP_RSVD       3
+
+/* dden values */
+#define DEN_4Gb         0
+#define DEN_8Gb         2
+
+/* dwid values */
+#define X8              0
+#define X16             1
+
+static struct dimm_geometry {
+        u8      addrdec;
+        u8      dden;
+        u8      dwid;
+        u8      rowbits, colbits;
+        u16     bits[PMI_ADDRESS_WIDTH];
+} dimms[] = {
+        {
+                .addrdec = AMAP_1KB, .dden = DEN_4Gb, .dwid = X16,
+                .rowbits = 15, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  B(0),  B(1),  B(2),  R(0),
+                        R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),  R(9),
+                        R(10), C(7),  C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        0,     0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_1KB, .dden = DEN_4Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  B(0),  B(1),  B(2),  R(0),
+                        R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),  R(9),
+                        R(10), C(7),  C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_1KB, .dden = DEN_8Gb, .dwid = X16,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  B(0),  B(1),  B(2),  R(0),
+                        R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),  R(9),
+                        R(10), C(7),  C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_1KB, .dden = DEN_8Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 11,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  B(0),  B(1),  B(2),  R(0),
+                        R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),  R(9),
+                        R(10), C(7),  C(8),  C(9),  R(11), RS,    C(11), R(12), R(13),
+                        R(14), R(15), 0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_2KB, .dden = DEN_4Gb, .dwid = X16,
+                .rowbits = 15, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  B(0),  B(1),  B(2),
+                        R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),
+                        R(9),  R(10), C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        0,     0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_2KB, .dden = DEN_4Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  B(0),  B(1),  B(2),
+                        R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),
+                        R(9),  R(10), C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_2KB, .dden = DEN_8Gb, .dwid = X16,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  B(0),  B(1),  B(2),
+                        R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),
+                        R(9),  R(10), C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_2KB, .dden = DEN_8Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 11,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  B(0),  B(1),  B(2),
+                        R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),
+                        R(9),  R(10), C(8),  C(9),  R(11), RS,    C(11), R(12), R(13),
+                        R(14), R(15), 0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_4KB, .dden = DEN_4Gb, .dwid = X16,
+                .rowbits = 15, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  C(8),  B(0),  B(1),
+                        B(2),  R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),
+                        R(8),  R(9),  R(10), C(9),  R(11), RS,    R(12), R(13), R(14),
+                        0,     0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_4KB, .dden = DEN_4Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  C(8),  B(0),  B(1),
+                        B(2),  R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),
+                        R(8),  R(9),  R(10), C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_4KB, .dden = DEN_8Gb, .dwid = X16,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  C(8),  B(0),  B(1),
+                        B(2),  R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),
+                        R(8),  R(9),  R(10), C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_4KB, .dden = DEN_8Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 11,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  C(8),  B(0),  B(1),
+                        B(2),  R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),
+                        R(8),  R(9),  R(10), C(9),  R(11), RS,    C(11), R(12), R(13),
+                        R(14), R(15), 0,     0
+                }
+        }
+};
+
+static int bank_hash(u64 pmiaddr, int idx, int shft)
+{
+        int bhash = 0;
+
+        switch (idx) {
+        case 0:
+                bhash ^= ((pmiaddr >> (12 + shft)) ^ (pmiaddr >> (9 + shft))) & 1;
+                break;
+        case 1:
+                bhash ^= (((pmiaddr >> (10 + shft)) ^ (pmiaddr >> (8 + shft))) & 1) << 1;
+                bhash ^= ((pmiaddr >> 22) & 1) << 1;
+                break;
+        case 2:
+                bhash ^= (((pmiaddr >> (13 + shft)) ^ (pmiaddr >> (11 + shft))) & 1) << 2;
+                break;
+        }
+
+        return bhash;
+}
+
+static int rank_hash(u64 pmiaddr)
+{
+        return ((pmiaddr >> 16) ^ (pmiaddr >> 10)) & 1;
+}
+
+/* Second stage decode. Compute rank, bank, row & column. */
+static int apl_pmi2mem(struct mem_ctl_info *mci, u64 pmiaddr, u32 pmiidx,
+                       struct dram_addr *daddr, char *msg)
+{
+        struct d_cr_drp0 *cr_drp0 = &drp0[pmiidx];
+        struct pnd2_pvt *pvt = mci->pvt_info;
+        int g = pvt->dimm_geom[pmiidx];
+        struct dimm_geometry *d = &dimms[g];
+        int column = 0, bank = 0, row = 0, rank = 0;
+        int i, idx, type, skiprs = 0;
+
+        for (i = 0; i < PMI_ADDRESS_WIDTH; i++) {
+                int     bit = (pmiaddr >> i) & 1;
+
+                if (i + skiprs >= PMI_ADDRESS_WIDTH) {
+                        snprintf(msg, PND2_MSG_SIZE, "Bad dimm_geometry[] table\n");
+                        return -EINVAL;
+                }
+
+                type = d->bits[i + skiprs] & ~0xf;
+                idx = d->bits[i + skiprs] & 0xf;
+
+                /*
+                 * On single rank DIMMs ignore the rank select bit
+                 * and shift remainder of "bits[]" down one place.
+                 */
+                if (type == RS && (cr_drp0->rken0 + cr_drp0->rken1) == 1) {
+                        skiprs = 1;
+                        type = d->bits[i + skiprs] & ~0xf;
+                        idx = d->bits[i + skiprs] & 0xf;
+                }
+
+                switch (type) {
+                case C(0):
+                        column |= (bit << idx);
+                        break;
+                case B(0):
+                        bank |= (bit << idx);
+                        if (cr_drp0->bahen)
+                                bank ^= bank_hash(pmiaddr, idx, d->addrdec);
+                        break;
+                case R(0):
+                        row |= (bit << idx);
+                        break;
+                case RS:
+                        rank = bit;
+                        if (cr_drp0->rsien)
+                                rank ^= rank_hash(pmiaddr);
+                        break;
+                default:
+                        if (bit) {
+                                snprintf(msg, PND2_MSG_SIZE, "Bad translation\n");
+                                return -EINVAL;
+                        }
+                        goto done;
+                }
+        }
+
+done:
+        daddr->col = column;
+        daddr->bank = bank;
+        daddr->row = row;
+        daddr->rank = rank;
+        daddr->dimm = 0;
+
+        return 0;
+}
+
+/* Pluck bit "in" from pmiaddr and return value shifted to bit "out" */
+#define dnv_get_bit(pmi, in, out) ((int)(((pmi) >> (in)) & 1u) << (out))
+
+static int dnv_pmi2mem(struct mem_ctl_info *mci, u64 pmiaddr, u32 pmiidx,
+                                           struct dram_addr *daddr, char *msg)
+{
+        /* Rank 0 or 1 */
+        daddr->rank = dnv_get_bit(pmiaddr, dmap[pmiidx].rs0 + 13, 0);
+        /* Rank 2 or 3 */
+        daddr->rank |= dnv_get_bit(pmiaddr, dmap[pmiidx].rs1 + 13, 1);
+
+        /*
+         * Normally ranks 0,1 are DIMM0, and 2,3 are DIMM1, but we
+         * flip them if DIMM1 is larger than DIMM0.
+         */
+        daddr->dimm = (daddr->rank >= 2) ^ drp[pmiidx].dimmflip;
+
+        daddr->bank = dnv_get_bit(pmiaddr, dmap[pmiidx].ba0 + 6, 0);
+        daddr->bank |= dnv_get_bit(pmiaddr, dmap[pmiidx].ba1 + 6, 1);
+        daddr->bank |= dnv_get_bit(pmiaddr, dmap[pmiidx].bg0 + 6, 2);
+        if (dsch.ddr4en)
+                daddr->bank |= dnv_get_bit(pmiaddr, dmap[pmiidx].bg1 + 6, 3);
+        if (dmap1[pmiidx].bxor) {
+                if (dsch.ddr4en) {
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap3[pmiidx].row6 + 6, 0);
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap3[pmiidx].row7 + 6, 1);
+                        if (dsch.chan_width == 0)
+                                /* 64/72 bit dram channel width */
+                                daddr->bank ^= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca3 + 6, 2);
+                        else
+                                /* 32/40 bit dram channel width */
+                                daddr->bank ^= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca4 + 6, 2);
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap2[pmiidx].row2 + 6, 3);
+                } else {
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap2[pmiidx].row2 + 6, 0);
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap3[pmiidx].row6 + 6, 1);
+                        if (dsch.chan_width == 0)
+                                daddr->bank ^= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca3 + 6, 2);
+                        else
+                                daddr->bank ^= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca4 + 6, 2);
+                }
+        }
+
+        daddr->row = dnv_get_bit(pmiaddr, dmap2[pmiidx].row0 + 6, 0);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row1 + 6, 1);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row2 + 6, 2);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row3 + 6, 3);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row4 + 6, 4);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row5 + 6, 5);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row6 + 6, 6);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row7 + 6, 7);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row8 + 6, 8);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row9 + 6, 9);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row10 + 6, 10);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row11 + 6, 11);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row12 + 6, 12);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row13 + 6, 13);
+        if (dmap4[pmiidx].row14 != 31)
+                daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row14 + 6, 14);
+        if (dmap4[pmiidx].row15 != 31)
+                daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row15 + 6, 15);
+        if (dmap4[pmiidx].row16 != 31)
+                daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row16 + 6, 16);
+        if (dmap4[pmiidx].row17 != 31)
+                daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row17 + 6, 17);
+
+        daddr->col = dnv_get_bit(pmiaddr, dmap5[pmiidx].ca3 + 6, 3);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca4 + 6, 4);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca5 + 6, 5);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca6 + 6, 6);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca7 + 6, 7);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca8 + 6, 8);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca9 + 6, 9);
+        if (!dsch.ddr4en && dmap1[pmiidx].ca11 != 0x3f)
+                daddr->col |= dnv_get_bit(pmiaddr, dmap1[pmiidx].ca11 + 13, 11);
+
+        return 0;
+}
+
+static int check_channel(int ch)
+{
+        if (drp0[ch].dramtype != 0) {
+                pnd2_printk(KERN_INFO, "Unsupported DIMM in channel %d\n", ch);
+                return 1;
+        } else if (drp0[ch].eccen == 0) {
+                pnd2_printk(KERN_INFO, "ECC disabled on channel %d\n", ch);
+                return 1;
+        }
+        return 0;
+}
+
+static int apl_check_ecc_active(void)
+{
+        int     i, ret = 0;
+
+        /* Check dramtype and ECC mode for each present DIMM */
+        for (i = 0; i < APL_NUM_CHANNELS; i++)
+                if (chan_mask & BIT(i))
+                        ret += check_channel(i);
+        return ret ? -EINVAL : 0;
+}
+
+#define DIMMS_PRESENT(d) ((d)->rken0 + (d)->rken1 + (d)->rken2 + (d)->rken3)
+
+static int check_unit(int ch)
+{
+        struct d_cr_drp *d = &drp[ch];
+
+        if (DIMMS_PRESENT(d) && !ecc_ctrl[ch].eccen) {
+                pnd2_printk(KERN_INFO, "ECC disabled on channel %d\n", ch);
+                return 1;
+        }
+        return 0;
+}
+
+static int dnv_check_ecc_active(void)
+{
+        int     i, ret = 0;
+
+        for (i = 0; i < DNV_NUM_CHANNELS; i++)
+                ret += check_unit(i);
+        return ret ? -EINVAL : 0;
+}
+
+static int get_memory_error_data(struct mem_ctl_info *mci, u64 addr,
+                                                                 struct dram_addr *daddr, char *msg)
+{
+        u64     pmiaddr;
+        u32     pmiidx;
+        int     ret;
+
+        ret = sys2pmi(addr, &pmiidx, &pmiaddr, msg);
+        if (ret)
+                return ret;
+
+        pmiaddr >>= ops->pmiaddr_shift;
+        /* pmi channel idx to dimm channel idx */
+        pmiidx >>= ops->pmiidx_shift;
+        daddr->chan = pmiidx;
+
+        ret = ops->pmi2mem(mci, pmiaddr, pmiidx, daddr, msg);
+        if (ret)
+                return ret;
+
+        edac_dbg(0, "SysAddr=%llx PmiAddr=%llx Channel=%d DIMM=%d Rank=%d Bank=%d Row=%d Column=%d\n",
+                         addr, pmiaddr, daddr->chan, daddr->dimm, daddr->rank, daddr->bank, daddr->row, daddr->col);
+
+        return 0;
+}
+
+static void pnd2_mce_output_error(struct mem_ctl_info *mci, const struct mce *m,
+                                  struct dram_addr *daddr)
+{
+        enum hw_event_mc_err_type tp_event;
+        char *optype, msg[PND2_MSG_SIZE];
+        bool ripv = m->mcgstatus & MCG_STATUS_RIPV;
+        bool overflow = m->status & MCI_STATUS_OVER;
+        bool uc_err = m->status & MCI_STATUS_UC;
+        bool recov = m->status & MCI_STATUS_S;
+        u32 core_err_cnt = GET_BITFIELD(m->status, 38, 52);
+        u32 mscod = GET_BITFIELD(m->status, 16, 31);
+        u32 errcode = GET_BITFIELD(m->status, 0, 15);
+        u32 optypenum = GET_BITFIELD(m->status, 4, 6);
+        int rc;
+
+        tp_event = uc_err ? (ripv ? HW_EVENT_ERR_FATAL : HW_EVENT_ERR_UNCORRECTED) :
+                                                 HW_EVENT_ERR_CORRECTED;
+
+        /*
+         * According with Table 15-9 of the Intel Architecture spec vol 3A,
+         * memory errors should fit in this mask:
+         *      000f 0000 1mmm cccc (binary)
+         * where:
+         *      f = Correction Report Filtering Bit. If 1, subsequent errors
+         *          won't be shown
+         *      mmm = error type
+         *      cccc = channel
+         * If the mask doesn't match, report an error to the parsing logic
+         */
+        if (!((errcode & 0xef80) == 0x80)) {
+                optype = "Can't parse: it is not a mem";
+        } else {
+                switch (optypenum) {
+                case 0:
+                        optype = "generic undef request error";
+                        break;
+                case 1:
+                        optype = "memory read error";
+                        break;
+                case 2:
+                        optype = "memory write error";
+                        break;
+                case 3:
+                        optype = "addr/cmd error";
+                        break;
+                case 4:
+                        optype = "memory scrubbing error";
+                        break;
+                default:
+                        optype = "reserved";
+                        break;
+                }
+        }
+
+        /* Only decode errors with an valid address (ADDRV) */
+        if (!(m->status & MCI_STATUS_ADDRV))
+                return;
+
+        rc = get_memory_error_data(mci, m->addr, daddr, msg);
+        if (rc)
+                goto address_error;
+
+        snprintf(msg, sizeof(msg),
+                 "%s%s err_code:%04x:%04x channel:%d DIMM:%d rank:%d row:%d bank:%d col:%d",
+                 overflow ? " OVERFLOW" : "", (uc_err && recov) ? " recoverable" : "", mscod,
+                 errcode, daddr->chan, daddr->dimm, daddr->rank, daddr->row, daddr->bank, daddr->col);
+
+        edac_dbg(0, "%s\n", msg);
+
+        /* Call the helper to output message */
+        edac_mc_handle_error(tp_event, mci, core_err_cnt, m->addr >> PAGE_SHIFT,
+                                                 m->addr & ~PAGE_MASK, 0, daddr->chan, daddr->dimm, -1, optype, msg);
+
+        return;
+
+address_error:
+        edac_mc_handle_error(tp_event, mci, core_err_cnt, 0, 0, 0, -1, -1, -1, msg, "");
+}
+
+static void apl_get_dimm_config(struct mem_ctl_info *mci)
+{
+        struct pnd2_pvt *pvt = mci->pvt_info;
+        struct dimm_info *dimm;
+        struct d_cr_drp0 *d;
+        u64     capacity;
+        int     i, g;
+
+        for (i = 0; i < APL_NUM_CHANNELS; i++) {
+                if (!(chan_mask & BIT(i)))
+                        continue;
+
+                dimm = EDAC_DIMM_PTR(mci->layers, mci->dimms, mci->n_layers, i, 0, 0);
+                if (!dimm) {
+                        edac_dbg(0, "No allocated DIMM for channel %d\n", i);
+                        continue;
+                }
+
+                d = &drp0[i];
+                for (g = 0; g < ARRAY_SIZE(dimms); g++)
+                        if (dimms[g].addrdec == d->addrdec &&
+                            dimms[g].dden == d->dden &&
+                            dimms[g].dwid == d->dwid)
+                                break;
+
+                if (g == ARRAY_SIZE(dimms)) {
+                        edac_dbg(0, "Channel %d: unrecognized DIMM\n", i);
+                        continue;
+                }
+
+                pvt->dimm_geom[i] = g;
+                capacity = (d->rken0 + d->rken1) * 8 * (1ul << dimms[g].rowbits) *
+                                   (1ul << dimms[g].colbits);
+                edac_dbg(0, "Channel %d: %lld MByte DIMM\n", i, capacity >> (20 - 3));
+                dimm->nr_pages = MiB_TO_PAGES(capacity >> (20 - 3));
+                dimm->grain = 32;
+                dimm->dtype = (d->dwid == 0) ? DEV_X8 : DEV_X16;
+                dimm->mtype = MEM_DDR3;
+                dimm->edac_mode = EDAC_SECDED;
+                snprintf(dimm->label, sizeof(dimm->label), "Slice#%d_Chan#%d", i / 2, i % 2);
+        }
+}
+
+static const int dnv_dtypes[] = {
+        DEV_X8, DEV_X4, DEV_X16, DEV_UNKNOWN
+};
+
+static void dnv_get_dimm_config(struct mem_ctl_info *mci)
+{
+        int     i, j, ranks_of_dimm[DNV_MAX_DIMMS], banks, rowbits, colbits, memtype;
+        struct dimm_info *dimm;
+        struct d_cr_drp *d;
+        u64     capacity;
+
+        if (dsch.ddr4en) {
+                memtype = MEM_DDR4;
+                banks = 16;
+                colbits = 10;
+        } else {
+                memtype = MEM_DDR3;
+                banks = 8;
+        }
+
+        for (i = 0; i < DNV_NUM_CHANNELS; i++) {
+                if (dmap4[i].row14 == 31)
+                        rowbits = 14;
+                else if (dmap4[i].row15 == 31)
+                        rowbits = 15;
+                else if (dmap4[i].row16 == 31)
+                        rowbits = 16;
+                else if (dmap4[i].row17 == 31)
+                        rowbits = 17;
+                else
+                        rowbits = 18;
+
+                if (memtype == MEM_DDR3) {
+                        if (dmap1[i].ca11 != 0x3f)
+                                colbits = 12;
+                        else
+                                colbits = 10;
+                }
+
+                d = &drp[i];
+                /* DIMM0 is present if rank0 and/or rank1 is enabled */
+                ranks_of_dimm[0] = d->rken0 + d->rken1;
+                /* DIMM1 is present if rank2 and/or rank3 is enabled */
+                ranks_of_dimm[1] = d->rken2 + d->rken3;
+
+                for (j = 0; j < DNV_MAX_DIMMS; j++) {
+                        if (!ranks_of_dimm[j])
+                                continue;
+
+                        dimm = EDAC_DIMM_PTR(mci->layers, mci->dimms, mci->n_layers, i, j, 0);
+                        if (!dimm) {
+                                edac_dbg(0, "No allocated DIMM for channel %d DIMM %d\n", i, j);
+                                continue;
+                        }
+
+                        capacity = ranks_of_dimm[j] * banks * (1ul << rowbits) * (1ul << colbits);
+                        edac_dbg(0, "Channel %d DIMM %d: %lld MByte DIMM\n", i, j, capacity >> (20 - 3));
+                        dimm->nr_pages = MiB_TO_PAGES(capacity >> (20 - 3));
+                        dimm->grain = 32;
+                        dimm->dtype = dnv_dtypes[j ? d->dimmdwid0 : d->dimmdwid1];
+                        dimm->mtype = memtype;
+                        dimm->edac_mode = EDAC_SECDED;
+                        snprintf(dimm->label, sizeof(dimm->label), "Chan#%d_DIMM#%d", i, j);
+                }
+        }
+}
+
+static int pnd2_register_mci(struct mem_ctl_info **ppmci)
+{
+        struct edac_mc_layer layers[2];
+        struct mem_ctl_info *mci;
+        struct pnd2_pvt *pvt;
+        int rc;
+
+        rc = ops->check_ecc();
+        if (rc < 0)
+                return rc;
+
+        /* Allocate a new MC control structure */
+        layers[0].type = EDAC_MC_LAYER_CHANNEL;
+        layers[0].size = ops->channels;
+        layers[0].is_virt_csrow = false;
+        layers[1].type = EDAC_MC_LAYER_SLOT;
+        layers[1].size = ops->dimms_per_channel;
+        layers[1].is_virt_csrow = true;
+        mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, sizeof(*pvt));
+        if (!mci)
+                return -ENOMEM;
+
+        pvt = mci->pvt_info;
+        memset(pvt, 0, sizeof(*pvt));
+
+        mci->mod_name = "pnd2_edac.c";
+        mci->dev_name = ops->name;
+        mci->ctl_name = "Pondicherry2";
+
+        /* Get dimm basic config and the memory layout */
+        ops->get_dimm_config(mci);
+
+        if (edac_mc_add_mc(mci)) {
+                edac_dbg(0, "MC: failed edac_mc_add_mc()\n");
+                edac_mc_free(mci);
+                return -EINVAL;
+        }
+
+        *ppmci = mci;
+
+        return 0;
+}
+
+static void pnd2_unregister_mci(struct mem_ctl_info *mci)
+{
+        if (unlikely(!mci || !mci->pvt_info)) {
+                pnd2_printk(KERN_ERR, "Couldn't find mci handler\n");
+                return;
+        }
+
+        /* Remove MC sysfs nodes */
+        edac_mc_del_mc(NULL);
+        edac_dbg(1, "%s: free mci struct\n", mci->ctl_name);
+        edac_mc_free(mci);
+}
+
+/*
+ * Callback function registered with core kernel mce code.
+ * Called once for each logged error.
+ */
+static int pnd2_mce_check_error(struct notifier_block *nb, unsigned long val, void *data)
+{
+        struct mce *mce = (struct mce *)data;
+        struct mem_ctl_info *mci;
+        struct dram_addr daddr;
+        char *type;
+
+        if (get_edac_report_status() == EDAC_REPORTING_DISABLED)
+                return NOTIFY_DONE;
+
+        mci = pnd2_mci;
+        if (!mci)
+                return NOTIFY_DONE;
+
+        /*
+         * Just let mcelog handle it if the error is
+         * outside the memory controller. A memory error
+         * is indicated by bit 7 = 1 and bits = 8-11,13-15 = 0.
+         * bit 12 has an special meaning.
+         */
+        if ((mce->status & 0xefff) >> 7 != 1)
+                return NOTIFY_DONE;
+
+        if (mce->mcgstatus & MCG_STATUS_MCIP)
+                type = "Exception";
+        else
+                type = "Event";
+
+        pnd2_mc_printk(mci, KERN_INFO, "HANDLING MCE MEMORY ERROR\n");
+        pnd2_mc_printk(mci, KERN_INFO, "CPU %u: Machine Check %s: %llx Bank %u: %llx\n",
+                                   mce->extcpu, type, mce->mcgstatus, mce->bank, mce->status);
+        pnd2_mc_printk(mci, KERN_INFO, "TSC %llx ", mce->tsc);
+        pnd2_mc_printk(mci, KERN_INFO, "ADDR %llx ", mce->addr);
+        pnd2_mc_printk(mci, KERN_INFO, "MISC %llx ", mce->misc);
+        pnd2_mc_printk(mci, KERN_INFO, "PROCESSOR %u:%x TIME %llu SOCKET %u APIC %x\n",
+                                   mce->cpuvendor, mce->cpuid, mce->time, mce->socketid, mce->apicid);
+
+        pnd2_mce_output_error(mci, mce, &daddr);
+
+        /* Advice mcelog that the error were handled */
+        return NOTIFY_STOP;
+}
+
+static struct notifier_block pnd2_mce_dec = {
+        .notifier_call  = pnd2_mce_check_error,
+};
+
+#ifdef CONFIG_EDAC_DEBUG
+/*
+ * Write an address to this file to exercise the address decode
+ * logic in this driver.
+ */
+static u64 pnd2_fake_addr;
+#define PND2_BLOB_SIZE 1024
+static char pnd2_result[PND2_BLOB_SIZE];
+static struct dentry *pnd2_test;
+static struct debugfs_blob_wrapper pnd2_blob = {
+        .data = pnd2_result,
+        .size = 0
+};
+
+static int debugfs_u64_set(void *data, u64 val)
+{
+        struct dram_addr daddr;
+        struct mce m;
+
+        *(u64 *)data = val;
+        m.mcgstatus = 0;
+        /* ADDRV + MemRd + Unknown channel */
+        m.status = MCI_STATUS_ADDRV + 0x9f;
+        m.addr = val;
+        pnd2_mce_output_error(pnd2_mci, &m, &daddr);
+        snprintf(pnd2_blob.data, PND2_BLOB_SIZE,
+                         "SysAddr=%llx Channel=%d DIMM=%d Rank=%d Bank=%d Row=%d Column=%d\n",
+                         m.addr, daddr.chan, daddr.dimm, daddr.rank, daddr.bank, daddr.row, daddr.col);
+        pnd2_blob.size = strlen(pnd2_blob.data);
+
+        return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(fops_u64_wo, NULL, debugfs_u64_set, "%llu\n");
+
+static void setup_pnd2_debug(void)
+{
+        pnd2_test = edac_debugfs_create_dir("pnd2_test");
+        edac_debugfs_create_file("pnd2_debug_addr", 0200, pnd2_test,
+                                                         &pnd2_fake_addr, &fops_u64_wo);
+        debugfs_create_blob("pnd2_debug_results", 0400, pnd2_test, &pnd2_blob);
+}
+
+static void teardown_pnd2_debug(void)
+{
+        debugfs_remove_recursive(pnd2_test);
+}
+#else
+static void setup_pnd2_debug(void)      {}
+static void teardown_pnd2_debug(void)   {}
+#endif /* CONFIG_EDAC_DEBUG */
+
+
+static int pnd2_probe(void)
+{
+        int rc;
+
+        edac_dbg(2, "\n");
+        rc = get_registers();
+        if (rc)
+                return rc;
+
+        return pnd2_register_mci(&pnd2_mci);
+}
+
+static void pnd2_remove(void)
+{
+        edac_dbg(0, "\n");
+        pnd2_unregister_mci(pnd2_mci);
+}
+
+static struct dunit_ops apl_ops = {
+                .name                   = "pnd2/apl",
+                .type                   = APL,
+                .pmiaddr_shift          = LOG2_PMI_ADDR_GRANULARITY,
+                .pmiidx_shift           = 0,
+                .channels               = APL_NUM_CHANNELS,
+                .dimms_per_channel      = 1,
+                .rd_reg                 = apl_rd_reg,
+                .get_registers          = apl_get_registers,
+                .check_ecc              = apl_check_ecc_active,
+                .mk_region              = apl_mk_region,
+                .get_dimm_config        = apl_get_dimm_config,
+                .pmi2mem                = apl_pmi2mem,
+};
+
+static struct dunit_ops dnv_ops = {
+                .name                   = "pnd2/dnv",
+                .type                   = DNV,
+                .pmiaddr_shift          = 0,
+                .pmiidx_shift           = 1,
+                .channels               = DNV_NUM_CHANNELS,
+                .dimms_per_channel      = 2,
+                .rd_reg                 = dnv_rd_reg,
+                .get_registers          = dnv_get_registers,
+                .check_ecc              = dnv_check_ecc_active,
+                .mk_region              = dnv_mk_region,
+                .get_dimm_config        = dnv_get_dimm_config,
+                .pmi2mem                = dnv_pmi2mem,
+};
+
+static const struct x86_cpu_id pnd2_cpuids[] = {
+        { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT, 0, (kernel_ulong_t)&apl_ops },
+        { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_DENVERTON, 0, (kernel_ulong_t)&dnv_ops },
+        { }
+};
+MODULE_DEVICE_TABLE(x86cpu, pnd2_cpuids);
+
+static int __init pnd2_init(void)
+{
+        const struct x86_cpu_id *id;
+        int rc;
+
+        edac_dbg(2, "\n");
+
+        id = x86_match_cpu(pnd2_cpuids);
+        if (!id)
+                return -ENODEV;
+
+        ops = (struct dunit_ops *)id->driver_data;
+
+        /* Ensure that the OPSTATE is set correctly for POLL or NMI */
+        opstate_init();
+
+        rc = pnd2_probe();
+        if (rc < 0) {
+                pnd2_printk(KERN_ERR, "Failed to register device with error %d.\n", rc);
+                return rc;
+        }
+
+        if (!pnd2_mci)
+                return -ENODEV;
+
+        mce_register_decode_chain(&pnd2_mce_dec);
+        setup_pnd2_debug();
+
+        return 0;
+}
+
+static void __exit pnd2_exit(void)
+{
+        edac_dbg(2, "\n");
+        teardown_pnd2_debug();
+        mce_unregister_decode_chain(&pnd2_mce_dec);
+        pnd2_remove();
+}
+
+module_init(pnd2_init);
+module_exit(pnd2_exit);
+
+module_param(edac_op_state, int, 0444);
+MODULE_PARM_DESC(edac_op_state, "EDAC Error Reporting state: 0=Poll,1=NMI");
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Tony Luck");
+MODULE_DESCRIPTION("MC Driver for Intel SoC using Pondicherry memory controller");
diff --git a/drivers/edac/pnd2_edac.h b/drivers/edac/pnd2_edac.h
new file mode 100644
index 000000000000..61b6e79492bb
--- /dev/null
+++ b/drivers/edac/pnd2_edac.h
@@ -0,0 +1,301 @@
+/*
+ * Register bitfield descriptions for Pondicherry2 memory controller.
+ *
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#ifndef _PND2_REGS_H
+#define _PND2_REGS_H
+
+struct b_cr_touud_lo_pci {
+        u32     lock : 1;
+        u32     reserved_1 : 19;
+        u32     touud : 12;
+};
+
+#define b_cr_touud_lo_pci_port 0x4c
+#define b_cr_touud_lo_pci_offset 0xa8
+#define b_cr_touud_lo_pci_r_opcode 0x04
+
+struct b_cr_touud_hi_pci {
+        u32     touud : 7;
+        u32     reserved_0 : 25;
+};
+
+#define b_cr_touud_hi_pci_port 0x4c
+#define b_cr_touud_hi_pci_offset 0xac
+#define b_cr_touud_hi_pci_r_opcode 0x04
+
+struct b_cr_tolud_pci {
+        u32     lock : 1;
+        u32     reserved_0 : 19;
+        u32     tolud : 12;
+};
+
+#define b_cr_tolud_pci_port 0x4c
+#define b_cr_tolud_pci_offset 0xbc
+#define b_cr_tolud_pci_r_opcode 0x04
+
+struct b_cr_mchbar_lo_pci {
+        u32 enable : 1;
+        u32 pad_3_1 : 3;
+        u32 pad_14_4: 11;
+        u32 base: 17;
+};
+
+struct b_cr_mchbar_hi_pci {
+        u32 base : 7;
+        u32 pad_31_7 : 25;
+};
+
+/* Symmetric region */
+struct b_cr_slice_channel_hash {
+        u64     slice_1_disabled : 1;
+        u64     hvm_mode : 1;
+        u64     interleave_mode : 2;
+        u64     slice_0_mem_disabled : 1;
+        u64     reserved_0 : 1;
+        u64     slice_hash_mask : 14;
+        u64     reserved_1 : 11;
+        u64     enable_pmi_dual_data_mode : 1;
+        u64     ch_1_disabled : 1;
+        u64     reserved_2 : 1;
+        u64     sym_slice0_channel_enabled : 2;
+        u64     sym_slice1_channel_enabled : 2;
+        u64     ch_hash_mask : 14;
+        u64     reserved_3 : 11;
+        u64     lock : 1;
+};
+
+#define b_cr_slice_channel_hash_port 0x4c
+#define b_cr_slice_channel_hash_offset 0x4c58
+#define b_cr_slice_channel_hash_r_opcode 0x06
+
+struct b_cr_mot_out_base_mchbar {
+        u32     reserved_0 : 14;
+        u32     mot_out_base : 15;
+        u32     reserved_1 : 1;
+        u32     tr_en : 1;
+        u32     imr_en : 1;
+};
+
+#define b_cr_mot_out_base_mchbar_port 0x4c
+#define b_cr_mot_out_base_mchbar_offset 0x6af0
+#define b_cr_mot_out_base_mchbar_r_opcode 0x00
+
+struct b_cr_mot_out_mask_mchbar {
+        u32     reserved_0 : 14;
+        u32     mot_out_mask : 15;
+        u32     reserved_1 : 1;
+        u32     ia_iwb_en : 1;
+        u32     gt_iwb_en : 1;
+};
+
+#define b_cr_mot_out_mask_mchbar_port 0x4c
+#define b_cr_mot_out_mask_mchbar_offset 0x6af4
+#define b_cr_mot_out_mask_mchbar_r_opcode 0x00
+
+struct b_cr_asym_mem_region0_mchbar {
+        u32     pad : 4;
+        u32     slice0_asym_base : 11;
+        u32     pad_18_15 : 4;
+        u32     slice0_asym_limit : 11;
+        u32     slice0_asym_channel_select : 1;
+        u32     slice0_asym_enable : 1;
+};
+
+#define b_cr_asym_mem_region0_mchbar_port 0x4c
+#define b_cr_asym_mem_region0_mchbar_offset 0x6e40
+#define b_cr_asym_mem_region0_mchbar_r_opcode 0x00
+
+struct b_cr_asym_mem_region1_mchbar {
+        u32     pad : 4;
+        u32     slice1_asym_base : 11;
+        u32     pad_18_15 : 4;
+        u32     slice1_asym_limit : 11;
+        u32     slice1_asym_channel_select : 1;
+        u32     slice1_asym_enable : 1;
+};
+
+#define b_cr_asym_mem_region1_mchbar_port 0x4c
+#define b_cr_asym_mem_region1_mchbar_offset 0x6e44
+#define b_cr_asym_mem_region1_mchbar_r_opcode 0x00
+
+/* Some bit fields moved in above two structs on Denverton */
+struct b_cr_asym_mem_region_denverton {
+        u32     pad : 4;
+        u32     slice_asym_base : 8;
+        u32     pad_19_12 : 8;
+        u32     slice_asym_limit : 8;
+        u32     pad_28_30 : 3;
+        u32     slice_asym_enable : 1;
+};
+
+struct b_cr_asym_2way_mem_region_mchbar {
+        u32     pad : 2;
+        u32     asym_2way_intlv_mode : 2;
+        u32     asym_2way_base : 11;
+        u32     pad_16_15 : 2;
+        u32     asym_2way_limit : 11;
+        u32     pad_30_28 : 3;
+        u32     asym_2way_interleave_enable : 1;
+};
+
+#define b_cr_asym_2way_mem_region_mchbar_port 0x4c
+#define b_cr_asym_2way_mem_region_mchbar_offset 0x6e50
+#define b_cr_asym_2way_mem_region_mchbar_r_opcode 0x00
+
+/* Apollo Lake d-unit */
+
+struct d_cr_drp0 {
+        u32     rken0 : 1;
+        u32     rken1 : 1;
+        u32     ddmen : 1;
+        u32     rsvd3 : 1;
+        u32     dwid : 2;
+        u32     dden : 3;
+        u32     rsvd13_9 : 5;
+        u32     rsien : 1;
+        u32     bahen : 1;
+        u32     rsvd18_16 : 3;
+        u32     caswizzle : 2;
+        u32     eccen : 1;
+        u32     dramtype : 3;
+        u32     blmode : 3;
+        u32     addrdec : 2;
+        u32     dramdevice_pr : 2;
+};
+
+#define d_cr_drp0_offset 0x1400
+#define d_cr_drp0_r_opcode 0x00
+
+/* Denverton d-unit */
+
+struct d_cr_dsch {
+        u32     ch0en : 1;
+        u32     ch1en : 1;
+        u32     ddr4en : 1;
+        u32     coldwake : 1;
+        u32     newbypdis : 1;
+        u32     chan_width : 1;
+        u32     rsvd6_6 : 1;
+        u32     ooodis : 1;
+        u32     rsvd18_8 : 11;
+        u32     ic : 1;
+        u32     rsvd31_20 : 12;
+};
+
+#define d_cr_dsch_port 0x16
+#define d_cr_dsch_offset 0x0
+#define d_cr_dsch_r_opcode 0x0
+
+struct d_cr_ecc_ctrl {
+        u32     eccen : 1;
+        u32     rsvd31_1 : 31;
+};
+
+#define d_cr_ecc_ctrl_offset 0x180
+#define d_cr_ecc_ctrl_r_opcode 0x0
+
+struct d_cr_drp {
+        u32     rken0 : 1;
+        u32     rken1 : 1;
+        u32     rken2 : 1;
+        u32     rken3 : 1;
+        u32     dimmdwid0 : 2;
+        u32     dimmdden0 : 2;
+        u32     dimmdwid1 : 2;
+        u32     dimmdden1 : 2;
+        u32     rsvd15_12 : 4;
+        u32     dimmflip : 1;
+        u32     rsvd31_17 : 15;
+};
+
+#define d_cr_drp_offset 0x158
+#define d_cr_drp_r_opcode 0x0
+
+struct d_cr_dmap {
+        u32     ba0 : 5;
+        u32     ba1 : 5;
+        u32     bg0 : 5; /* if ddr3, ba2 = bg0 */
+        u32     bg1 : 5; /* if ddr3, ba3 = bg1 */
+        u32     rs0 : 5;
+        u32     rs1 : 5;
+        u32     rsvd : 2;
+};
+
+#define d_cr_dmap_offset 0x174
+#define d_cr_dmap_r_opcode 0x0
+
+struct d_cr_dmap1 {
+        u32     ca11 : 6;
+        u32     bxor : 1;
+        u32     rsvd : 25;
+};
+
+#define d_cr_dmap1_offset 0xb4
+#define d_cr_dmap1_r_opcode 0x0
+
+struct d_cr_dmap2 {
+        u32     row0 : 5;
+        u32     row1 : 5;
+        u32     row2 : 5;
+        u32     row3 : 5;
+        u32     row4 : 5;
+        u32     row5 : 5;
+        u32     rsvd : 2;
+};
+
+#define d_cr_dmap2_offset 0x148
+#define d_cr_dmap2_r_opcode 0x0
+
+struct d_cr_dmap3 {
+        u32     row6 : 5;
+        u32     row7 : 5;
+        u32     row8 : 5;
+        u32     row9 : 5;
+        u32     row10 : 5;
+        u32     row11 : 5;
+        u32     rsvd : 2;
+};
+
+#define d_cr_dmap3_offset 0x14c
+#define d_cr_dmap3_r_opcode 0x0
+
+struct d_cr_dmap4 {
+        u32     row12 : 5;
+        u32     row13 : 5;
+        u32     row14 : 5;
+        u32     row15 : 5;
+        u32     row16 : 5;
+        u32     row17 : 5;
+        u32     rsvd : 2;
+};
+
+#define d_cr_dmap4_offset 0x150
+#define d_cr_dmap4_r_opcode 0x0
+
+struct d_cr_dmap5 {
+        u32     ca3 : 4;
+        u32     ca4 : 4;
+        u32     ca5 : 4;
+        u32     ca6 : 4;
+        u32     ca7 : 4;
+        u32     ca8 : 4;
+        u32     ca9 : 4;
+        u32     rsvd : 4;
+};
+
+#define d_cr_dmap5_offset 0x154
+#define d_cr_dmap5_r_opcode 0x0
+
+#endif /* _PND2_REGS_H */
diff --git a/drivers/edac/xgene_edac.c b/drivers/edac/xgene_edac.c
index 6c270d9d304a..669246056812 100644
--- a/drivers/edac/xgene_edac.c
+++ b/drivers/edac/xgene_edac.c
@@ -1596,7 +1596,7 @@ static void xgene_edac_pa_report(struct edac_device_ctl_info *edac_dev)
         reg = readl(ctx->dev_csr + IOBPATRANSERRINTSTS);
         if (!reg)
                 goto chk_iob_axi0;
-        dev_err(edac_dev->dev, "IOB procesing agent (PA) transaction error\n");
+        dev_err(edac_dev->dev, "IOB processing agent (PA) transaction error\n");
         if (reg & IOBPA_RDATA_CORRUPT_MASK)
                 dev_err(edac_dev->dev, "IOB PA read data RAM error\n");
         if (reg & IOBPA_M_RDATA_CORRUPT_MASK)
diff --git a/drivers/extcon/Kconfig b/drivers/extcon/Kconfig
index 96bbae579c0b..fc09c76248b4 100644
--- a/drivers/extcon/Kconfig
+++ b/drivers/extcon/Kconfig
@@ -44,7 +44,7 @@ config EXTCON_GPIO
 
 config EXTCON_INTEL_INT3496
         tristate "Intel INT3496 ACPI device extcon driver"
-        depends on GPIOLIB && ACPI
+        depends on GPIOLIB && ACPI && (X86 || COMPILE_TEST)
         help
           Say Y here to enable extcon support for USB OTG ports controlled by
           an Intel INT3496 ACPI device.
diff --git a/drivers/extcon/extcon-intel-int3496.c b/drivers/extcon/extcon-intel-int3496.c
index a3131b036de6..9d17984bbbd4 100644
--- a/drivers/extcon/extcon-intel-int3496.c
+++ b/drivers/extcon/extcon-intel-int3496.c
@@ -45,6 +45,17 @@ static const unsigned int int3496_cable[] = {
         EXTCON_NONE,
 };
 
+static const struct acpi_gpio_params id_gpios = { INT3496_GPIO_USB_ID, 0, false };
+static const struct acpi_gpio_params vbus_gpios = { INT3496_GPIO_VBUS_EN, 0, false };
+static const struct acpi_gpio_params mux_gpios = { INT3496_GPIO_USB_MUX, 0, false };
+
+static const struct acpi_gpio_mapping acpi_int3496_default_gpios[] = {
+        { "id-gpios", &id_gpios, 1 },
+        { "vbus-gpios", &vbus_gpios, 1 },
+        { "mux-gpios", &mux_gpios, 1 },
+        { },
+};
+
 static void int3496_do_usb_id(struct work_struct *work)
 {
         struct int3496_data *data =
@@ -83,6 +94,13 @@ static int int3496_probe(struct platform_device *pdev)
         struct int3496_data *data;
         int ret;
 
+        ret = acpi_dev_add_driver_gpios(ACPI_COMPANION(dev),
+                                        acpi_int3496_default_gpios);
+        if (ret) {
+                dev_err(dev, "can't add GPIO ACPI mapping\n");
+                return ret;
+        }
+
         data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
@@ -90,30 +108,27 @@ static int int3496_probe(struct platform_device *pdev)
         data->dev = dev;
         INIT_DELAYED_WORK(&data->work, int3496_do_usb_id);
 
-        data->gpio_usb_id = devm_gpiod_get_index(dev, "id",
-                                                INT3496_GPIO_USB_ID,
-                                                GPIOD_IN);
+        data->gpio_usb_id = devm_gpiod_get(dev, "id", GPIOD_IN);
         if (IS_ERR(data->gpio_usb_id)) {
                 ret = PTR_ERR(data->gpio_usb_id);
                 dev_err(dev, "can't request USB ID GPIO: %d\n", ret);
                 return ret;
+        } else if (gpiod_get_direction(data->gpio_usb_id) != GPIOF_DIR_IN) {
+                dev_warn(dev, FW_BUG "USB ID GPIO not in input mode, fixing\n");
+                gpiod_direction_input(data->gpio_usb_id);
         }
 
         data->usb_id_irq = gpiod_to_irq(data->gpio_usb_id);
-        if (data->usb_id_irq <= 0) {
+        if (data->usb_id_irq < 0) {
                 dev_err(dev, "can't get USB ID IRQ: %d\n", data->usb_id_irq);
-                return -EINVAL;
+                return data->usb_id_irq;
         }
 
-        data->gpio_vbus_en = devm_gpiod_get_index(dev, "vbus en",
-                                                 INT3496_GPIO_VBUS_EN,
-                                                 GPIOD_ASIS);
+        data->gpio_vbus_en = devm_gpiod_get(dev, "vbus", GPIOD_ASIS);
         if (IS_ERR(data->gpio_vbus_en))
                 dev_info(dev, "can't request VBUS EN GPIO\n");
 
-        data->gpio_usb_mux = devm_gpiod_get_index(dev, "usb mux",
-                                                 INT3496_GPIO_USB_MUX,
-                                                 GPIOD_ASIS);
+        data->gpio_usb_mux = devm_gpiod_get(dev, "mux", GPIOD_ASIS);
         if (IS_ERR(data->gpio_usb_mux))
                 dev_info(dev, "can't request USB MUX GPIO\n");
 
@@ -154,6 +169,8 @@ static int int3496_remove(struct platform_device *pdev)
         devm_free_irq(&pdev->dev, data->usb_id_irq, data);
         cancel_delayed_work_sync(&data->work);
 
+        acpi_dev_remove_driver_gpios(ACPI_COMPANION(&pdev->dev));
+
         return 0;
 }
 
diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
index 349dc3e1e52e..974c5a31a005 100644
--- a/drivers/firmware/efi/arm-runtime.c
+++ b/drivers/firmware/efi/arm-runtime.c
@@ -65,6 +65,7 @@ static bool __init efi_virtmap_init(void)
         bool systab_found;
 
         efi_mm.pgd = pgd_alloc(&efi_mm);
+        mm_init_cpumask(&efi_mm);
         init_new_context(NULL, &efi_mm);
 
         systab_found = false;
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index e7d404059b73..b372aad3b449 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -389,7 +389,6 @@ int __init efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md)
                         return 0;
                 }
         }
-        pr_err_once("requested map not found.\n");
         return -ENOENT;
 }
 
diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
index 08b026864d4e..8554d7aec31c 100644
--- a/drivers/firmware/efi/esrt.c
+++ b/drivers/firmware/efi/esrt.c
@@ -254,7 +254,7 @@ void __init efi_esrt_init(void)
 
         rc = efi_mem_desc_lookup(efi.esrt, &md);
         if (rc < 0) {
-                pr_err("ESRT header is not in the memory map.\n");
+                pr_warn("ESRT header is not in the memory map.\n");
                 return;
         }
 
diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c
index 6def402bf569..5da36e56b36a 100644
--- a/drivers/firmware/efi/libstub/secureboot.c
+++ b/drivers/firmware/efi/libstub/secureboot.c
@@ -45,6 +45,8 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
         size = sizeof(secboot);
         status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid,
                              NULL, &size, &secboot);
+        if (status == EFI_NOT_FOUND)
+                return efi_secureboot_mode_disabled;
         if (status != EFI_SUCCESS)
                 goto out_efi_err;
 
@@ -78,7 +80,5 @@ secure_boot_enabled:
 
 out_efi_err:
         pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n");
-        if (status == EFI_NOT_FOUND)
-                return efi_secureboot_mode_disabled;
         return efi_secureboot_mode_unknown;
 }
diff --git a/drivers/gpio/gpio-altera-a10sr.c b/drivers/gpio/gpio-altera-a10sr.c
index 9e1a138fed53..16a8951b2bed 100644
--- a/drivers/gpio/gpio-altera-a10sr.c
+++ b/drivers/gpio/gpio-altera-a10sr.c
@@ -96,7 +96,7 @@ static int altr_a10sr_gpio_probe(struct platform_device *pdev)
         gpio->regmap = a10sr->regmap;
 
         gpio->gp = altr_a10sr_gc;
-
+        gpio->gp.parent = pdev->dev.parent;
         gpio->gp.of_node = pdev->dev.of_node;
 
         ret = devm_gpiochip_add_data(&pdev->dev, &gpio->gp, gpio);
diff --git a/drivers/gpio/gpio-altera.c b/drivers/gpio/gpio-altera.c
index 5bddbd507ca9..3fe6a21e05a5 100644
--- a/drivers/gpio/gpio-altera.c
+++ b/drivers/gpio/gpio-altera.c
@@ -90,21 +90,18 @@ static int altera_gpio_irq_set_type(struct irq_data *d,
 
         altera_gc = gpiochip_get_data(irq_data_get_irq_chip_data(d));
 
-        if (type == IRQ_TYPE_NONE)
+        if (type == IRQ_TYPE_NONE) {
+                irq_set_handler_locked(d, handle_bad_irq);
                 return 0;
-        if (type == IRQ_TYPE_LEVEL_HIGH &&
-                altera_gc->interrupt_trigger == IRQ_TYPE_LEVEL_HIGH)
-                return 0;
-        if (type == IRQ_TYPE_EDGE_RISING &&
-                altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_RISING)
-                return 0;
-        if (type == IRQ_TYPE_EDGE_FALLING &&
-                altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_FALLING)
-                return 0;
-        if (type == IRQ_TYPE_EDGE_BOTH &&
-                altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_BOTH)
+        }
+        if (type == altera_gc->interrupt_trigger) {
+                if (type == IRQ_TYPE_LEVEL_HIGH)
+                        irq_set_handler_locked(d, handle_level_irq);
+                else
+                        irq_set_handler_locked(d, handle_simple_irq);
                 return 0;
-
+        }
+        irq_set_handler_locked(d, handle_bad_irq);
         return -EINVAL;
 }
 
@@ -230,7 +227,6 @@ static void altera_gpio_irq_edge_handler(struct irq_desc *desc)
         chained_irq_exit(chip, desc);
 }
 
-
 static void altera_gpio_irq_leveL_high_handler(struct irq_desc *desc)
 {
         struct altera_gpio_chip *altera_gc;
@@ -310,7 +306,7 @@ static int altera_gpio_probe(struct platform_device *pdev)
         altera_gc->interrupt_trigger = reg;
 
         ret = gpiochip_irqchip_add(&altera_gc->mmchip.gc, &altera_irq_chip, 0,
-                handle_simple_irq, IRQ_TYPE_NONE);
+                handle_bad_irq, IRQ_TYPE_NONE);
 
         if (ret) {
                 dev_err(&pdev->dev, "could not add irqchip\n");
diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
index bdb692345428..2a57d024481d 100644
--- a/drivers/gpio/gpio-mcp23s08.c
+++ b/drivers/gpio/gpio-mcp23s08.c
@@ -270,8 +270,10 @@ mcp23s08_direction_output(struct gpio_chip *chip, unsigned offset, int value)
 static irqreturn_t mcp23s08_irq(int irq, void *data)
 {
         struct mcp23s08 *mcp = data;
-        int intcap, intf, i;
+        int intcap, intf, i, gpio, gpio_orig, intcap_mask;
         unsigned int child_irq;
+        bool intf_set, intcap_changed, gpio_bit_changed,
+                defval_changed, gpio_set;
 
         mutex_lock(&mcp->lock);
         if (mcp_read(mcp, MCP_INTF, &intf) < 0) {
@@ -287,14 +289,67 @@ static irqreturn_t mcp23s08_irq(int irq, void *data)
         }
 
         mcp->cache[MCP_INTCAP] = intcap;
+
+        /* This clears the interrupt(configurable on S18) */
+        if (mcp_read(mcp, MCP_GPIO, &gpio) < 0) {
+                mutex_unlock(&mcp->lock);
+                return IRQ_HANDLED;
+        }
+        gpio_orig = mcp->cache[MCP_GPIO];
+        mcp->cache[MCP_GPIO] = gpio;
         mutex_unlock(&mcp->lock);
 
+        if (mcp->cache[MCP_INTF] == 0) {
+                /* There is no interrupt pending */
+                return IRQ_HANDLED;
+        }
+
+        dev_dbg(mcp->chip.parent,
+                "intcap 0x%04X intf 0x%04X gpio_orig 0x%04X gpio 0x%04X\n",
+                intcap, intf, gpio_orig, gpio);
 
         for (i = 0; i < mcp->chip.ngpio; i++) {
-                if ((BIT(i) & mcp->cache[MCP_INTF]) &&
-                    ((BIT(i) & intcap & mcp->irq_rise) ||
-                     (mcp->irq_fall & ~intcap & BIT(i)) ||
-                     (BIT(i) & mcp->cache[MCP_INTCON]))) {
+                /* We must check all of the inputs on the chip,
+                 * otherwise we may not notice a change on >=2 pins.
+                 *
+                 * On at least the mcp23s17, INTCAP is only updated
+                 * one byte at a time(INTCAPA and INTCAPB are
+                 * not written to at the same time - only on a per-bank
+                 * basis).
+                 *
+                 * INTF only contains the single bit that caused the
+                 * interrupt per-bank.  On the mcp23s17, there is
+                 * INTFA and INTFB.  If two pins are changed on the A
+                 * side at the same time, INTF will only have one bit
+                 * set.  If one pin on the A side and one pin on the B
+                 * side are changed at the same time, INTF will have
+                 * two bits set.  Thus, INTF can't be the only check
+                 * to see if the input has changed.
+                 */
+
+                intf_set = BIT(i) & mcp->cache[MCP_INTF];
+                if (i < 8 && intf_set)
+                        intcap_mask = 0x00FF;
+                else if (i >= 8 && intf_set)
+                        intcap_mask = 0xFF00;
+                else
+                        intcap_mask = 0x00;
+
+                intcap_changed = (intcap_mask &
+                        (BIT(i) & mcp->cache[MCP_INTCAP])) !=
+                        (intcap_mask & (BIT(i) & gpio_orig));
+                gpio_set = BIT(i) & mcp->cache[MCP_GPIO];
+                gpio_bit_changed = (BIT(i) & gpio_orig) !=
+                        (BIT(i) & mcp->cache[MCP_GPIO]);
+                defval_changed = (BIT(i) & mcp->cache[MCP_INTCON]) &&
+                        ((BIT(i) & mcp->cache[MCP_GPIO]) !=
+                        (BIT(i) & mcp->cache[MCP_DEFVAL]));
+
+                if (((gpio_bit_changed || intcap_changed) &&
+                        (BIT(i) & mcp->irq_rise) && gpio_set) ||
+                    ((gpio_bit_changed || intcap_changed) &&
+                        (BIT(i) & mcp->irq_fall) && !gpio_set) ||
+                    defval_changed) {
                         child_irq = irq_find_mapping(mcp->chip.irqdomain, i);
                         handle_nested_irq(child_irq);
                 }
diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c
index 06dac72cb69c..d99338689213 100644
--- a/drivers/gpio/gpio-mockup.c
+++ b/drivers/gpio/gpio-mockup.c
@@ -197,7 +197,7 @@ static ssize_t gpio_mockup_event_write(struct file *file,
         struct seq_file *sfile;
         struct gpio_desc *desc;
         struct gpio_chip *gc;
-        int status, val;
+        int val;
         char buf;
 
         sfile = file->private_data;
@@ -206,9 +206,8 @@ static ssize_t gpio_mockup_event_write(struct file *file,
         chip = priv->chip;
         gc = &chip->gc;
 
-        status = copy_from_user(&buf, usr_buf, 1);
-        if (status)
-                return status;
+        if (copy_from_user(&buf, usr_buf, 1))
+                return -EFAULT;
 
         if (buf == '0')
                 val = 0;
diff --git a/drivers/gpio/gpio-xgene.c b/drivers/gpio/gpio-xgene.c
index 40a8881c2ce8..f1c6ec17b90a 100644
--- a/drivers/gpio/gpio-xgene.c
+++ b/drivers/gpio/gpio-xgene.c
@@ -42,9 +42,7 @@ struct xgene_gpio {
         struct gpio_chip        chip;
         void __iomem            *base;
         spinlock_t              lock;
-#ifdef CONFIG_PM
         u32                     set_dr_val[XGENE_MAX_GPIO_BANKS];
-#endif
 };
 
 static int xgene_gpio_get(struct gpio_chip *gc, unsigned int offset)
@@ -138,8 +136,7 @@ static int xgene_gpio_dir_out(struct gpio_chip *gc,
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int xgene_gpio_suspend(struct device *dev)
+static __maybe_unused int xgene_gpio_suspend(struct device *dev)
 {
         struct xgene_gpio *gpio = dev_get_drvdata(dev);
         unsigned long bank_offset;
@@ -152,7 +149,7 @@ static int xgene_gpio_suspend(struct device *dev)
         return 0;
 }
 
-static int xgene_gpio_resume(struct device *dev)
+static __maybe_unused int xgene_gpio_resume(struct device *dev)
 {
         struct xgene_gpio *gpio = dev_get_drvdata(dev);
         unsigned long bank_offset;
@@ -166,10 +163,6 @@ static int xgene_gpio_resume(struct device *dev)
 }
 
 static SIMPLE_DEV_PM_OPS(xgene_gpio_pm, xgene_gpio_suspend, xgene_gpio_resume);
-#define XGENE_GPIO_PM_OPS       (&xgene_gpio_pm)
-#else
-#define XGENE_GPIO_PM_OPS       NULL
-#endif
 
 static int xgene_gpio_probe(struct platform_device *pdev)
 {
@@ -241,7 +234,7 @@ static struct platform_driver xgene_gpio_driver = {
                 .name = "xgene-gpio",
                 .of_match_table = xgene_gpio_of_match,
                 .acpi_match_table = ACPI_PTR(xgene_gpio_acpi_match),
-                .pm     = XGENE_GPIO_PM_OPS,
+                .pm     = &xgene_gpio_pm,
         },
         .probe = xgene_gpio_probe,
 };
diff --git a/drivers/gpu/drm/amd/acp/Makefile b/drivers/gpu/drm/amd/acp/Makefile
index 8363cb57915b..8a08e81ee90d 100644
--- a/drivers/gpu/drm/amd/acp/Makefile
+++ b/drivers/gpu/drm/amd/acp/Makefile
@@ -3,6 +3,4 @@
 # of AMDSOC/AMDGPU drm driver.
 # It provides the HW control for ACP related functionalities.
 
-subdir-ccflags-y += -I$(AMDACPPATH)/ -I$(AMDACPPATH)/include
-
 AMD_ACP_FILES := $(AMDACPPATH)/acp_hw.o
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index d2d0f60ff36d..99424cb8020b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -240,6 +240,8 @@ free_partial_kdata:
         for (; i >= 0; i--)
                 drm_free_large(p->chunks[i].kdata);
         kfree(p->chunks);
+        p->chunks = NULL;
+        p->nchunks = 0;
 put_ctx:
         amdgpu_ctx_put(p->ctx);
 free_chunk:
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 6abb238b25c9..de0cf3315484 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -475,7 +475,7 @@ static int amdgpu_wb_init(struct amdgpu_device *adev)
         int r;
 
         if (adev->wb.wb_obj == NULL) {
-                r = amdgpu_bo_create_kernel(adev, AMDGPU_MAX_WB * 4,
+                r = amdgpu_bo_create_kernel(adev, AMDGPU_MAX_WB * sizeof(uint32_t),
                                             PAGE_SIZE, AMDGPU_GEM_DOMAIN_GTT,
                                             &adev->wb.wb_obj, &adev->wb.gpu_addr,
                                             (void **)&adev->wb.wb);
@@ -488,7 +488,7 @@ static int amdgpu_wb_init(struct amdgpu_device *adev)
                 memset(&adev->wb.used, 0, sizeof(adev->wb.used));
 
                 /* clear wb memory */
-                memset((char *)adev->wb.wb, 0, AMDGPU_GPU_PAGE_SIZE);
+                memset((char *)adev->wb.wb, 0, AMDGPU_MAX_WB * sizeof(uint32_t));
         }
 
         return 0;
@@ -2094,8 +2094,11 @@ int amdgpu_device_resume(struct drm_device *dev, bool resume, bool fbcon)
         }
 
         r = amdgpu_late_init(adev);
-        if (r)
+        if (r) {
+                if (fbcon)
+                        console_unlock();
                 return r;
+        }
 
         /* pin cursors */
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
@@ -2587,7 +2590,7 @@ static ssize_t amdgpu_debugfs_regs_read(struct file *f, char __user *buf,
                 use_bank = 0;
         }
 
-        *pos &= 0x3FFFF;
+        *pos &= (1UL << 22) - 1;
 
         if (use_bank) {
                 if ((sh_bank != 0xFFFFFFFF && sh_bank >= adev->gfx.config.max_sh_per_se) ||
@@ -2663,7 +2666,7 @@ static ssize_t amdgpu_debugfs_regs_write(struct file *f, const char __user *buf,
                 use_bank = 0;
         }
 
-        *pos &= 0x3FFFF;
+        *pos &= (1UL << 22) - 1;
 
         if (use_bank) {
                 if ((sh_bank != 0xFFFFFFFF && sh_bank >= adev->gfx.config.max_sh_per_se) ||
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 75fc376ba735..b76cd699eb0d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -59,9 +59,10 @@
  * - 3.7.0 - Add support for VCE clock list packet
  * - 3.8.0 - Add support raster config init in the kernel
  * - 3.9.0 - Add support for memory query info about VRAM and GTT.
+ * - 3.10.0 - Add support for new fences ioctl, new gem ioctl flags
  */
 #define KMS_DRIVER_MAJOR        3
-#define KMS_DRIVER_MINOR        9
+#define KMS_DRIVER_MINOR        10
 #define KMS_DRIVER_PATCHLEVEL   0
 
 int amdgpu_vram_limit = 0;
@@ -420,6 +421,7 @@ static const struct pci_device_id pciidlist[] = {
         {0x1002, 0x6985, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x6986, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x6987, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
+        {0x1002, 0x6995, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x699F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
 
         {0, 0, 0}
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 51d759463384..106cf83c2e6b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -202,6 +202,27 @@ int amdgpu_gem_create_ioctl(struct drm_device *dev, void *data,
         bool kernel = false;
         int r;
 
+        /* reject invalid gem flags */
+        if (args->in.domain_flags & ~(AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED |
+                                      AMDGPU_GEM_CREATE_NO_CPU_ACCESS |
+                                      AMDGPU_GEM_CREATE_CPU_GTT_USWC |
+                                      AMDGPU_GEM_CREATE_VRAM_CLEARED|
+                                      AMDGPU_GEM_CREATE_SHADOW |
+                                      AMDGPU_GEM_CREATE_VRAM_CONTIGUOUS)) {
+                r = -EINVAL;
+                goto error_unlock;
+        }
+        /* reject invalid gem domains */
+        if (args->in.domains & ~(AMDGPU_GEM_DOMAIN_CPU |
+                                 AMDGPU_GEM_DOMAIN_GTT |
+                                 AMDGPU_GEM_DOMAIN_VRAM |
+                                 AMDGPU_GEM_DOMAIN_GDS |
+                                 AMDGPU_GEM_DOMAIN_GWS |
+                                 AMDGPU_GEM_DOMAIN_OA)) {
+                r = -EINVAL;
+                goto error_unlock;
+        }
+
         /* create a gem object to contain this object in */
         if (args->in.domains & (AMDGPU_GEM_DOMAIN_GDS |
             AMDGPU_GEM_DOMAIN_GWS | AMDGPU_GEM_DOMAIN_OA)) {
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
index 31375bdde6f1..011800f621c6 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
@@ -788,7 +788,7 @@ static int sdma_v3_0_start(struct amdgpu_device *adev)
                 }
         }
 
-        /* disble sdma engine before programing it */
+        /* disable sdma engine before programing it */
         sdma_v3_0_ctx_switch_enable(adev, false);
         sdma_v3_0_enable(adev, false);
 
diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index f55e45b52fbc..c5dec210d529 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -3464,6 +3464,16 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
                     (adev->pdev->device == 0x6667)) {
                         max_sclk = 75000;
                 }
+        } else if (adev->asic_type == CHIP_OLAND) {
+                if ((adev->pdev->revision == 0xC7) ||
+                    (adev->pdev->revision == 0x80) ||
+                    (adev->pdev->revision == 0x81) ||
+                    (adev->pdev->revision == 0x83) ||
+                    (adev->pdev->revision == 0x87) ||
+                    (adev->pdev->device == 0x6604) ||
+                    (adev->pdev->device == 0x6605)) {
+                        max_sclk = 75000;
+                }
         }
 
         if (rps->vce_active) {
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index 50bdb24ef8d6..4a785d6acfb9 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -1051,7 +1051,7 @@ static int vi_common_early_init(void *handle)
                 /* rev0 hardware requires workarounds to support PG */
                 adev->pg_flags = 0;
                 if (adev->rev_id != 0x00) {
-                        adev->pg_flags |= AMD_PG_SUPPORT_GFX_PG |
+                        adev->pg_flags |=
                                 AMD_PG_SUPPORT_GFX_SMG |
                                 AMD_PG_SUPPORT_GFX_PIPELINE |
                                 AMD_PG_SUPPORT_CP |
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c
index 8cf71f3c6d0e..261b828ad590 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c
@@ -178,7 +178,7 @@ int smu7_powergate_vce(struct pp_hwmgr *hwmgr, bool bgate)
         if (bgate) {
                 cgs_set_powergating_state(hwmgr->device,
                                                 AMD_IP_BLOCK_TYPE_VCE,
-                                                AMD_PG_STATE_UNGATE);
+                                                AMD_PG_STATE_GATE);
                 cgs_set_clockgating_state(hwmgr->device,
                                 AMD_IP_BLOCK_TYPE_VCE,
                                 AMD_CG_STATE_GATE);
diff --git a/drivers/gpu/drm/arm/malidp_crtc.c b/drivers/gpu/drm/arm/malidp_crtc.c
index 08e6a71f5d05..294b53697334 100644
--- a/drivers/gpu/drm/arm/malidp_crtc.c
+++ b/drivers/gpu/drm/arm/malidp_crtc.c
@@ -63,8 +63,7 @@ static void malidp_crtc_enable(struct drm_crtc *crtc)
 
         clk_prepare_enable(hwdev->pxlclk);
 
-        /* mclk needs to be set to the same or higher rate than pxlclk */
-        clk_set_rate(hwdev->mclk, crtc->state->adjusted_mode.crtc_clock * 1000);
+        /* We rely on firmware to set mclk to a sensible level. */
         clk_set_rate(hwdev->pxlclk, crtc->state->adjusted_mode.crtc_clock * 1000);
 
         hwdev->modeset(hwdev, &vm);
diff --git a/drivers/gpu/drm/arm/malidp_hw.c b/drivers/gpu/drm/arm/malidp_hw.c
index 488aedf5b58d..9f5513006eee 100644
--- a/drivers/gpu/drm/arm/malidp_hw.c
+++ b/drivers/gpu/drm/arm/malidp_hw.c
@@ -83,7 +83,7 @@ static const struct malidp_layer malidp550_layers[] = {
         { DE_VIDEO1, MALIDP550_DE_LV1_BASE, MALIDP550_DE_LV1_PTR_BASE, MALIDP_DE_LV_STRIDE0 },
         { DE_GRAPHICS1, MALIDP550_DE_LG_BASE, MALIDP550_DE_LG_PTR_BASE, MALIDP_DE_LG_STRIDE },
         { DE_VIDEO2, MALIDP550_DE_LV2_BASE, MALIDP550_DE_LV2_PTR_BASE, MALIDP_DE_LV_STRIDE0 },
-        { DE_SMART, MALIDP550_DE_LS_BASE, MALIDP550_DE_LS_PTR_BASE, 0 },
+        { DE_SMART, MALIDP550_DE_LS_BASE, MALIDP550_DE_LS_PTR_BASE, MALIDP550_DE_LS_R1_STRIDE },
 };
 
 #define MALIDP_DE_DEFAULT_PREFETCH_START        5
diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
index 414aada10fe5..d5aec082294c 100644
--- a/drivers/gpu/drm/arm/malidp_planes.c
+++ b/drivers/gpu/drm/arm/malidp_planes.c
@@ -37,6 +37,8 @@
 #define   LAYER_V_VAL(x)                (((x) & 0x1fff) << 16)
 #define MALIDP_LAYER_COMP_SIZE          0x010
 #define MALIDP_LAYER_OFFSET             0x014
+#define MALIDP550_LS_ENABLE             0x01c
+#define MALIDP550_LS_R1_IN_SIZE         0x020
 
 /*
  * This 4-entry look-up-table is used to determine the full 8-bit alpha value
@@ -242,6 +244,11 @@ static void malidp_de_plane_update(struct drm_plane *plane,
                         LAYER_V_VAL(plane->state->crtc_y),
                         mp->layer->base + MALIDP_LAYER_OFFSET);
 
+        if (mp->layer->id == DE_SMART)
+                malidp_hw_write(mp->hwdev,
+                                LAYER_H_VAL(src_w) | LAYER_V_VAL(src_h),
+                                mp->layer->base + MALIDP550_LS_R1_IN_SIZE);
+
         /* first clear the rotation bits */
         val = malidp_hw_read(mp->hwdev, mp->layer->base + MALIDP_LAYER_CONTROL);
         val &= ~LAYER_ROT_MASK;
@@ -330,9 +337,16 @@ int malidp_de_planes_init(struct drm_device *drm)
                 plane->hwdev = malidp->dev;
                 plane->layer = &map->layers[i];
 
-                /* Skip the features which the SMART layer doesn't have */
-                if (id == DE_SMART)
+                if (id == DE_SMART) {
+                        /*
+                         * Enable the first rectangle in the SMART layer to be
+                         * able to use it as a drm plane.
+                         */
+                        malidp_hw_write(malidp->dev, 1,
+                                        plane->layer->base + MALIDP550_LS_ENABLE);
+                        /* Skip the features which the SMART layer doesn't have. */
                         continue;
+                }
 
                 drm_plane_create_rotation_property(&plane->base, DRM_ROTATE_0, flags);
                 malidp_hw_write(malidp->dev, MALIDP_ALPHA_LUT,
diff --git a/drivers/gpu/drm/arm/malidp_regs.h b/drivers/gpu/drm/arm/malidp_regs.h
index aff6d4a84e99..b816067a65c5 100644
--- a/drivers/gpu/drm/arm/malidp_regs.h
+++ b/drivers/gpu/drm/arm/malidp_regs.h
@@ -84,6 +84,7 @@
 /* Stride register offsets relative to Lx_BASE */
 #define MALIDP_DE_LG_STRIDE             0x18
 #define MALIDP_DE_LV_STRIDE0            0x18
+#define MALIDP550_DE_LS_R1_STRIDE       0x28
 
 /* macros to set values into registers */
 #define MALIDP_DE_H_FRONTPORCH(x)       (((x) & 0xfff) << 0)
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index c8baab9bee0d..ba58f1b11d1e 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -148,6 +148,9 @@ static const struct edid_quirk {
 
         /* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */
         { "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC },
+
+        /* Rotel RSX-1058 forwards sink's EDID but only does HDMI 1.1*/
+        { "ETR", 13896, EDID_QUIRK_FORCE_8BPC },
 };
 
 /*
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index f6d4d9700734..324a688b3f30 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1260,9 +1260,9 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
          * to KMS, hence fail if different settings are requested.
          */
         if (var->bits_per_pixel != fb->format->cpp[0] * 8 ||
-            var->xres != fb->width || var->yres != fb->height ||
-            var->xres_virtual != fb->width || var->yres_virtual != fb->height) {
-                DRM_DEBUG("fb userspace requested width/height/bpp different than current fb "
+            var->xres > fb->width || var->yres > fb->height ||
+            var->xres_virtual > fb->width || var->yres_virtual > fb->height) {
+                DRM_DEBUG("fb requested width/height/bpp can't fit in current fb "
                           "request %dx%d-%d (virtual %dx%d) > %dx%d-%d\n",
                           var->xres, var->yres, var->bits_per_pixel,
                           var->xres_virtual, var->yres_virtual,
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 130d7d517a19..da48819ff2e6 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -1311,6 +1311,8 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
                 goto out_pm_put;
         }
 
+        mutex_lock(&gpu->lock);
+
         fence = etnaviv_gpu_fence_alloc(gpu);
         if (!fence) {
                 event_free(gpu, event);
@@ -1318,8 +1320,6 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
                 goto out_pm_put;
         }
 
-        mutex_lock(&gpu->lock);
-
         gpu->event[event].fence = fence;
         submit->fence = fence->seqno;
         gpu->active_fence = submit->fence;
diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
index 0fd6f7a18364..c0e8d3302292 100644
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -68,6 +68,8 @@ struct decon_context {
         unsigned long                   flags;
         unsigned long                   out_type;
         int                             first_win;
+        spinlock_t                      vblank_lock;
+        u32                             frame_id;
 };
 
 static const uint32_t decon_formats[] = {
@@ -103,7 +105,7 @@ static int decon_enable_vblank(struct exynos_drm_crtc *crtc)
                 if (ctx->out_type & IFTYPE_I80)
                         val |= VIDINTCON0_FRAMEDONE;
                 else
-                        val |= VIDINTCON0_INTFRMEN;
+                        val |= VIDINTCON0_INTFRMEN | VIDINTCON0_FRAMESEL_FP;
 
                 writel(val, ctx->addr + DECON_VIDINTCON0);
         }
@@ -122,14 +124,56 @@ static void decon_disable_vblank(struct exynos_drm_crtc *crtc)
                 writel(0, ctx->addr + DECON_VIDINTCON0);
 }
 
+/* return number of starts/ends of frame transmissions since reset */
+static u32 decon_get_frame_count(struct decon_context *ctx, bool end)
+{
+        u32 frm, pfrm, status, cnt = 2;
+
+        /* To get consistent result repeat read until frame id is stable.
+         * Usually the loop will be executed once, in rare cases when the loop
+         * is executed at frame change time 2nd pass will be needed.
+         */
+        frm = readl(ctx->addr + DECON_CRFMID);
+        do {
+                status = readl(ctx->addr + DECON_VIDCON1);
+                pfrm = frm;
+                frm = readl(ctx->addr + DECON_CRFMID);
+        } while (frm != pfrm && --cnt);
+
+        /* CRFMID is incremented on BPORCH in case of I80 and on VSYNC in case
+         * of RGB, it should be taken into account.
+         */
+        if (!frm)
+                return 0;
+
+        switch (status & (VIDCON1_VSTATUS_MASK | VIDCON1_I80_ACTIVE)) {
+        case VIDCON1_VSTATUS_VS:
+                if (!(ctx->out_type & IFTYPE_I80))
+                        --frm;
+                break;
+        case VIDCON1_VSTATUS_BP:
+                --frm;
+                break;
+        case VIDCON1_I80_ACTIVE:
+        case VIDCON1_VSTATUS_AC:
+                if (end)
+                        --frm;
+                break;
+        default:
+                break;
+        }
+
+        return frm;
+}
+
 static void decon_setup_trigger(struct decon_context *ctx)
 {
         if (!(ctx->out_type & (IFTYPE_I80 | I80_HW_TRG)))
                 return;
 
         if (!(ctx->out_type & I80_HW_TRG)) {
-                writel(TRIGCON_TE_AUTO_MASK | TRIGCON_SWTRIGEN
-                       | TRIGCON_TE_AUTO_MASK | TRIGCON_SWTRIGEN,
+                writel(TRIGCON_TRIGEN_PER_F | TRIGCON_TRIGEN_F |
+                       TRIGCON_TE_AUTO_MASK | TRIGCON_SWTRIGEN,
                        ctx->addr + DECON_TRIGCON);
                 return;
         }
@@ -365,11 +409,14 @@ static void decon_disable_plane(struct exynos_drm_crtc *crtc,
 static void decon_atomic_flush(struct exynos_drm_crtc *crtc)
 {
         struct decon_context *ctx = crtc->ctx;
+        unsigned long flags;
         int i;
 
         if (test_bit(BIT_SUSPENDED, &ctx->flags))
                 return;
 
+        spin_lock_irqsave(&ctx->vblank_lock, flags);
+
         for (i = ctx->first_win; i < WINDOWS_NR; i++)
                 decon_shadow_protect_win(ctx, i, false);
 
@@ -378,11 +425,18 @@ static void decon_atomic_flush(struct exynos_drm_crtc *crtc)
 
         if (ctx->out_type & IFTYPE_I80)
                 set_bit(BIT_WIN_UPDATED, &ctx->flags);
+
+        ctx->frame_id = decon_get_frame_count(ctx, true);
+
+        exynos_crtc_handle_event(crtc);
+
+        spin_unlock_irqrestore(&ctx->vblank_lock, flags);
 }
 
 static void decon_swreset(struct decon_context *ctx)
 {
         unsigned int tries;
+        unsigned long flags;
 
         writel(0, ctx->addr + DECON_VIDCON0);
         for (tries = 2000; tries; --tries) {
@@ -400,6 +454,10 @@ static void decon_swreset(struct decon_context *ctx)
 
         WARN(tries == 0, "failed to software reset DECON\n");
 
+        spin_lock_irqsave(&ctx->vblank_lock, flags);
+        ctx->frame_id = 0;
+        spin_unlock_irqrestore(&ctx->vblank_lock, flags);
+
         if (!(ctx->out_type & IFTYPE_HDMI))
                 return;
 
@@ -578,6 +636,24 @@ static const struct component_ops decon_component_ops = {
         .unbind = decon_unbind,
 };
 
+static void decon_handle_vblank(struct decon_context *ctx)
+{
+        u32 frm;
+
+        spin_lock(&ctx->vblank_lock);
+
+        frm = decon_get_frame_count(ctx, true);
+
+        if (frm != ctx->frame_id) {
+                /* handle only if incremented, take care of wrap-around */
+                if ((s32)(frm - ctx->frame_id) > 0)
+                        drm_crtc_handle_vblank(&ctx->crtc->base);
+                ctx->frame_id = frm;
+        }
+
+        spin_unlock(&ctx->vblank_lock);
+}
+
 static irqreturn_t decon_irq_handler(int irq, void *dev_id)
 {
         struct decon_context *ctx = dev_id;
@@ -598,7 +674,7 @@ static irqreturn_t decon_irq_handler(int irq, void *dev_id)
                             (VIDOUT_INTERLACE_EN_F | VIDOUT_INTERLACE_FIELD_F))
                                 return IRQ_HANDLED;
                 }
-                drm_crtc_handle_vblank(&ctx->crtc->base);
+                decon_handle_vblank(ctx);
         }
 
 out:
@@ -671,6 +747,7 @@ static int exynos5433_decon_probe(struct platform_device *pdev)
         __set_bit(BIT_SUSPENDED, &ctx->flags);
         ctx->dev = dev;
         ctx->out_type = (unsigned long)of_device_get_match_data(dev);
+        spin_lock_init(&ctx->vblank_lock);
 
         if (ctx->out_type & IFTYPE_HDMI) {
                 ctx->first_win = 1;
@@ -678,7 +755,7 @@ static int exynos5433_decon_probe(struct platform_device *pdev)
                 ctx->out_type |= IFTYPE_I80;
         }
 
-        if (ctx->out_type | I80_HW_TRG) {
+        if (ctx->out_type & I80_HW_TRG) {
                 ctx->sysreg = syscon_regmap_lookup_by_phandle(dev->of_node,
                                                         "samsung,disp-sysreg");
                 if (IS_ERR(ctx->sysreg)) {
diff --git a/drivers/gpu/drm/exynos/exynos7_drm_decon.c b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
index f9ab19e205e2..48811806fa27 100644
--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
@@ -526,6 +526,7 @@ static void decon_atomic_flush(struct exynos_drm_crtc *crtc)
 
         for (i = 0; i < WINDOWS_NR; i++)
                 decon_shadow_protect_win(ctx, i, false);
+        exynos_crtc_handle_event(crtc);
 }
 
 static void decon_init(struct decon_context *ctx)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index 5367b6664fe3..c65f4509932c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -85,16 +85,28 @@ static void exynos_crtc_atomic_flush(struct drm_crtc *crtc,
                                      struct drm_crtc_state *old_crtc_state)
 {
         struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
-        struct drm_pending_vblank_event *event;
-        unsigned long flags;
 
         if (exynos_crtc->ops->atomic_flush)
                 exynos_crtc->ops->atomic_flush(exynos_crtc);
+}
+
+static const struct drm_crtc_helper_funcs exynos_crtc_helper_funcs = {
+        .enable         = exynos_drm_crtc_enable,
+        .disable        = exynos_drm_crtc_disable,
+        .mode_set_nofb  = exynos_drm_crtc_mode_set_nofb,
+        .atomic_check   = exynos_crtc_atomic_check,
+        .atomic_begin   = exynos_crtc_atomic_begin,
+        .atomic_flush   = exynos_crtc_atomic_flush,
+};
+
+void exynos_crtc_handle_event(struct exynos_drm_crtc *exynos_crtc)
+{
+        struct drm_crtc *crtc = &exynos_crtc->base;
+        struct drm_pending_vblank_event *event = crtc->state->event;
+        unsigned long flags;
 
-        event = crtc->state->event;
         if (event) {
                 crtc->state->event = NULL;
-
                 spin_lock_irqsave(&crtc->dev->event_lock, flags);
                 if (drm_crtc_vblank_get(crtc) == 0)
                         drm_crtc_arm_vblank_event(crtc, event);
@@ -105,15 +117,6 @@ static void exynos_crtc_atomic_flush(struct drm_crtc *crtc,
 
 }
 
-static const struct drm_crtc_helper_funcs exynos_crtc_helper_funcs = {
-        .enable         = exynos_drm_crtc_enable,
-        .disable        = exynos_drm_crtc_disable,
-        .mode_set_nofb  = exynos_drm_crtc_mode_set_nofb,
-        .atomic_check   = exynos_crtc_atomic_check,
-        .atomic_begin   = exynos_crtc_atomic_begin,
-        .atomic_flush   = exynos_crtc_atomic_flush,
-};
-
 static void exynos_drm_crtc_destroy(struct drm_crtc *crtc)
 {
         struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.h b/drivers/gpu/drm/exynos/exynos_drm_crtc.h
index 6a581a8af465..abd5d6ceac0c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.h
@@ -40,4 +40,6 @@ int exynos_drm_crtc_get_pipe_from_type(struct drm_device *drm_dev,
  */
 void exynos_drm_crtc_te_handler(struct drm_crtc *crtc);
 
+void exynos_crtc_handle_event(struct exynos_drm_crtc *exynos_crtc);
+
 #endif
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index 812e2ec0761d..d7ef26370e67 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -86,7 +86,7 @@
 #define DSIM_SYNC_INFORM                (1 << 27)
 #define DSIM_EOT_DISABLE                (1 << 28)
 #define DSIM_MFLUSH_VS                  (1 << 29)
-/* This flag is valid only for exynos3250/3472/4415/5260/5430 */
+/* This flag is valid only for exynos3250/3472/5260/5430 */
 #define DSIM_CLKLANE_STOP               (1 << 30)
 
 /* DSIM_ESCMODE */
@@ -473,17 +473,6 @@ static const struct exynos_dsi_driver_data exynos4_dsi_driver_data = {
         .reg_values = reg_values,
 };
 
-static const struct exynos_dsi_driver_data exynos4415_dsi_driver_data = {
-        .reg_ofs = exynos_reg_ofs,
-        .plltmr_reg = 0x58,
-        .has_clklane_stop = 1,
-        .num_clks = 2,
-        .max_freq = 1000,
-        .wait_for_reset = 1,
-        .num_bits_resol = 11,
-        .reg_values = reg_values,
-};
-
 static const struct exynos_dsi_driver_data exynos5_dsi_driver_data = {
         .reg_ofs = exynos_reg_ofs,
         .plltmr_reg = 0x58,
@@ -521,8 +510,6 @@ static const struct of_device_id exynos_dsi_of_match[] = {
           .data = &exynos3_dsi_driver_data },
         { .compatible = "samsung,exynos4210-mipi-dsi",
           .data = &exynos4_dsi_driver_data },
-        { .compatible = "samsung,exynos4415-mipi-dsi",
-          .data = &exynos4415_dsi_driver_data },
         { .compatible = "samsung,exynos5410-mipi-dsi",
           .data = &exynos5_dsi_driver_data },
         { .compatible = "samsung,exynos5422-mipi-dsi",
@@ -979,7 +966,7 @@ static void exynos_dsi_send_to_fifo(struct exynos_dsi *dsi,
         bool first = !xfer->tx_done;
         u32 reg;
 
-        dev_dbg(dev, "< xfer %p: tx len %u, done %u, rx len %u, done %u\n",
+        dev_dbg(dev, "< xfer %pK: tx len %u, done %u, rx len %u, done %u\n",
                 xfer, length, xfer->tx_done, xfer->rx_len, xfer->rx_done);
 
         if (length > DSI_TX_FIFO_SIZE)
@@ -1177,7 +1164,7 @@ static bool exynos_dsi_transfer_finish(struct exynos_dsi *dsi)
         spin_unlock_irqrestore(&dsi->transfer_lock, flags);
 
         dev_dbg(dsi->dev,
-                "> xfer %p, tx_len %zu, tx_done %u, rx_len %u, rx_done %u\n",
+                "> xfer %pK, tx_len %zu, tx_done %u, rx_len %u, rx_done %u\n",
                 xfer, xfer->packet.payload_length, xfer->tx_done, xfer->rx_len,
                 xfer->rx_done);
 
@@ -1348,9 +1335,12 @@ static int exynos_dsi_register_te_irq(struct exynos_dsi *dsi)
         int te_gpio_irq;
 
         dsi->te_gpio = of_get_named_gpio(dsi->panel_node, "te-gpios", 0);
+        if (dsi->te_gpio == -ENOENT)
+                return 0;
+
         if (!gpio_is_valid(dsi->te_gpio)) {
-                dev_err(dsi->dev, "no te-gpios specified\n");
                 ret = dsi->te_gpio;
+                dev_err(dsi->dev, "cannot get te-gpios, %d\n", ret);
                 goto out;
         }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
index 95871577015d..5b18b5c5fdf2 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
@@ -1695,7 +1695,7 @@ static int fimc_probe(struct platform_device *pdev)
                 goto err_put_clk;
         }
 
-        DRM_DEBUG_KMS("id[%d]ippdrv[%p]\n", ctx->id, ippdrv);
+        DRM_DEBUG_KMS("id[%d]ippdrv[%pK]\n", ctx->id, ippdrv);
 
         spin_lock_init(&ctx->lock);
         platform_set_drvdata(pdev, ctx);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index a9fa444c6053..3f04d72c448d 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -71,10 +71,10 @@
 #define TRIGCON                         0x1A4
 #define TRGMODE_ENABLE                  (1 << 0)
 #define SWTRGCMD_ENABLE                 (1 << 1)
-/* Exynos3250, 3472, 4415, 5260 5410, 5420 and 5422 only supported. */
+/* Exynos3250, 3472, 5260 5410, 5420 and 5422 only supported. */
 #define HWTRGEN_ENABLE                  (1 << 3)
 #define HWTRGMASK_ENABLE                (1 << 4)
-/* Exynos3250, 3472, 4415, 5260, 5420 and 5422 only supported. */
+/* Exynos3250, 3472, 5260, 5420 and 5422 only supported. */
 #define HWTRIGEN_PER_ENABLE             (1 << 31)
 
 /* display mode change control register except exynos4 */
@@ -138,18 +138,6 @@ static struct fimd_driver_data exynos4_fimd_driver_data = {
         .has_vtsel = 1,
 };
 
-static struct fimd_driver_data exynos4415_fimd_driver_data = {
-        .timing_base = 0x20000,
-        .lcdblk_offset = 0x210,
-        .lcdblk_vt_shift = 10,
-        .lcdblk_bypass_shift = 1,
-        .trg_type = I80_HW_TRG,
-        .has_shadowcon = 1,
-        .has_vidoutcon = 1,
-        .has_vtsel = 1,
-        .has_trigger_per_te = 1,
-};
-
 static struct fimd_driver_data exynos5_fimd_driver_data = {
         .timing_base = 0x20000,
         .lcdblk_offset = 0x214,
@@ -210,8 +198,6 @@ static const struct of_device_id fimd_driver_dt_match[] = {
           .data = &exynos3_fimd_driver_data },
         { .compatible = "samsung,exynos4210-fimd",
           .data = &exynos4_fimd_driver_data },
-        { .compatible = "samsung,exynos4415-fimd",
-          .data = &exynos4415_fimd_driver_data },
         { .compatible = "samsung,exynos5250-fimd",
           .data = &exynos5_fimd_driver_data },
         { .compatible = "samsung,exynos5420-fimd",
@@ -257,7 +243,7 @@ static int fimd_enable_vblank(struct exynos_drm_crtc *crtc)
                         val |= VIDINTCON0_INT_FRAME;
 
                         val &= ~VIDINTCON0_FRAMESEL0_MASK;
-                        val |= VIDINTCON0_FRAMESEL0_VSYNC;
+                        val |= VIDINTCON0_FRAMESEL0_FRONTPORCH;
                         val &= ~VIDINTCON0_FRAMESEL1_MASK;
                         val |= VIDINTCON0_FRAMESEL1_NONE;
                 }
@@ -723,6 +709,8 @@ static void fimd_atomic_flush(struct exynos_drm_crtc *crtc)
 
         for (i = 0; i < WINDOWS_NR; i++)
                 fimd_shadow_protect_win(ctx, i, false);
+
+        exynos_crtc_handle_event(crtc);
 }
 
 static void fimd_update_plane(struct exynos_drm_crtc *crtc,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index 4c28f7ffcc4d..55a1579d11b3 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -218,7 +218,7 @@ static struct exynos_drm_gem *exynos_drm_gem_init(struct drm_device *dev,
                 return ERR_PTR(ret);
         }
 
-        DRM_DEBUG_KMS("created file object = %p\n", obj->filp);
+        DRM_DEBUG_KMS("created file object = %pK\n", obj->filp);
 
         return exynos_gem;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
index bef57987759d..0506b2b17ac1 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -1723,7 +1723,7 @@ static int gsc_probe(struct platform_device *pdev)
                 return ret;
         }
 
-        DRM_DEBUG_KMS("id[%d]ippdrv[%p]\n", ctx->id, ippdrv);
+        DRM_DEBUG_KMS("id[%d]ippdrv[%pK]\n", ctx->id, ippdrv);
 
         mutex_init(&ctx->lock);
         platform_set_drvdata(pdev, ctx);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_ipp.c b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
index 9c84ee76f18a..3edda18cc2d2 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_ipp.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
@@ -208,7 +208,7 @@ static struct exynos_drm_ippdrv *ipp_find_drv_by_handle(u32 prop_id)
          * e.g PAUSE state, queue buf, command control.
          */
         list_for_each_entry(ippdrv, &exynos_drm_ippdrv_list, drv_list) {
-                DRM_DEBUG_KMS("count[%d]ippdrv[%p]\n", count++, ippdrv);
+                DRM_DEBUG_KMS("count[%d]ippdrv[%pK]\n", count++, ippdrv);
 
                 mutex_lock(&ippdrv->cmd_lock);
                 list_for_each_entry(c_node, &ippdrv->cmd_list, list) {
@@ -388,7 +388,7 @@ int exynos_drm_ipp_set_property(struct drm_device *drm_dev, void *data,
         }
         property->prop_id = ret;
 
-        DRM_DEBUG_KMS("created prop_id[%d]cmd[%d]ippdrv[%p]\n",
+        DRM_DEBUG_KMS("created prop_id[%d]cmd[%d]ippdrv[%pK]\n",
                 property->prop_id, property->cmd, ippdrv);
 
         /* stored property information and ippdrv in private data */
@@ -518,7 +518,7 @@ static int ipp_put_mem_node(struct drm_device *drm_dev,
 {
         int i;
 
-        DRM_DEBUG_KMS("node[%p]\n", m_node);
+        DRM_DEBUG_KMS("node[%pK]\n", m_node);
 
         if (!m_node) {
                 DRM_ERROR("invalid dequeue node.\n");
@@ -562,7 +562,7 @@ static struct drm_exynos_ipp_mem_node
         m_node->buf_id = qbuf->buf_id;
         INIT_LIST_HEAD(&m_node->list);
 
-        DRM_DEBUG_KMS("m_node[%p]ops_id[%d]\n", m_node, qbuf->ops_id);
+        DRM_DEBUG_KMS("m_node[%pK]ops_id[%d]\n", m_node, qbuf->ops_id);
         DRM_DEBUG_KMS("prop_id[%d]buf_id[%d]\n", qbuf->prop_id, m_node->buf_id);
 
         for_each_ipp_planar(i) {
@@ -659,7 +659,7 @@ static void ipp_put_event(struct drm_exynos_ipp_cmd_node *c_node,
 
         mutex_lock(&c_node->event_lock);
         list_for_each_entry_safe(e, te, &c_node->event_list, base.link) {
-                DRM_DEBUG_KMS("count[%d]e[%p]\n", count++, e);
+                DRM_DEBUG_KMS("count[%d]e[%pK]\n", count++, e);
 
                 /*
                  * qbuf == NULL condition means all event deletion.
@@ -750,7 +750,7 @@ static struct drm_exynos_ipp_mem_node
 
         /* find memory node from memory list */
         list_for_each_entry(m_node, head, list) {
-                DRM_DEBUG_KMS("count[%d]m_node[%p]\n", count++, m_node);
+                DRM_DEBUG_KMS("count[%d]m_node[%pK]\n", count++, m_node);
 
                 /* compare buffer id */
                 if (m_node->buf_id == qbuf->buf_id)
@@ -767,7 +767,7 @@ static int ipp_set_mem_node(struct exynos_drm_ippdrv *ippdrv,
         struct exynos_drm_ipp_ops *ops = NULL;
         int ret = 0;
 
-        DRM_DEBUG_KMS("node[%p]\n", m_node);
+        DRM_DEBUG_KMS("node[%pK]\n", m_node);
 
         if (!m_node) {
                 DRM_ERROR("invalid queue node.\n");
@@ -1232,7 +1232,7 @@ static int ipp_start_property(struct exynos_drm_ippdrv *ippdrv,
                         m_node = list_first_entry(head,
                                 struct drm_exynos_ipp_mem_node, list);
 
-                        DRM_DEBUG_KMS("m_node[%p]\n", m_node);
+                        DRM_DEBUG_KMS("m_node[%pK]\n", m_node);
 
                         ret = ipp_set_mem_node(ippdrv, c_node, m_node);
                         if (ret) {
@@ -1601,7 +1601,7 @@ static int ipp_subdrv_probe(struct drm_device *drm_dev, struct device *dev)
                 }
                 ippdrv->prop_list.ipp_id = ret;
 
-                DRM_DEBUG_KMS("count[%d]ippdrv[%p]ipp_id[%d]\n",
+                DRM_DEBUG_KMS("count[%d]ippdrv[%pK]ipp_id[%d]\n",
                         count++, ippdrv, ret);
 
                 /* store parent device for node */
@@ -1659,7 +1659,7 @@ static int ipp_subdrv_open(struct drm_device *drm_dev, struct device *dev,
 
         file_priv->ipp_dev = dev;
 
-        DRM_DEBUG_KMS("done priv[%p]\n", dev);
+        DRM_DEBUG_KMS("done priv[%pK]\n", dev);
 
         return 0;
 }
@@ -1676,7 +1676,7 @@ static void ipp_subdrv_close(struct drm_device *drm_dev, struct device *dev,
                 mutex_lock(&ippdrv->cmd_lock);
                 list_for_each_entry_safe(c_node, tc_node,
                         &ippdrv->cmd_list, list) {
-                        DRM_DEBUG_KMS("count[%d]ippdrv[%p]\n",
+                        DRM_DEBUG_KMS("count[%d]ippdrv[%pK]\n",
                                 count++, ippdrv);
 
                         if (c_node->filp == file) {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index 6591e406084c..79282a820ecc 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -748,7 +748,7 @@ static int rotator_probe(struct platform_device *pdev)
                 goto err_ippdrv_register;
         }
 
-        DRM_DEBUG_KMS("ippdrv[%p]\n", ippdrv);
+        DRM_DEBUG_KMS("ippdrv[%pK]\n", ippdrv);
 
         platform_set_drvdata(pdev, rot);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 57fe514d5c5b..5d9a62a87eec 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -170,6 +170,7 @@ static const struct exynos_drm_crtc_ops vidi_crtc_ops = {
         .enable_vblank = vidi_enable_vblank,
         .disable_vblank = vidi_disable_vblank,
         .update_plane = vidi_update_plane,
+        .atomic_flush = exynos_crtc_handle_event,
 };
 
 static void vidi_fake_vblank_timer(unsigned long arg)
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 72143ac10525..25edb635a197 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -1012,6 +1012,7 @@ static void mixer_atomic_flush(struct exynos_drm_crtc *crtc)
                 return;
 
         mixer_vsync_set_update(mixer_ctx, true);
+        exynos_crtc_handle_event(crtc);
 }
 
 static void mixer_enable(struct exynos_drm_crtc *crtc)
diff --git a/drivers/gpu/drm/i915/gvt/aperture_gm.c b/drivers/gpu/drm/i915/gvt/aperture_gm.c
index 3b6caaca9751..325618d969fe 100644
--- a/drivers/gpu/drm/i915/gvt/aperture_gm.c
+++ b/drivers/gpu/drm/i915/gvt/aperture_gm.c
@@ -242,7 +242,7 @@ static int alloc_resource(struct intel_vgpu *vgpu,
         const char *item;
 
         if (!param->low_gm_sz || !param->high_gm_sz || !param->fence_sz) {
-                gvt_err("Invalid vGPU creation params\n");
+                gvt_vgpu_err("Invalid vGPU creation params\n");
                 return -EINVAL;
         }
 
@@ -285,9 +285,9 @@ static int alloc_resource(struct intel_vgpu *vgpu,
         return 0;
 
 no_enough_resource:
-        gvt_err("vgpu%d: fail to allocate resource %s\n", vgpu->id, item);
-        gvt_err("vgpu%d: request %luMB avail %luMB max %luMB taken %luMB\n",
-                vgpu->id, BYTES_TO_MB(request), BYTES_TO_MB(avail),
+        gvt_vgpu_err("fail to allocate resource %s\n", item);
+        gvt_vgpu_err("request %luMB avail %luMB max %luMB taken %luMB\n",
+                BYTES_TO_MB(request), BYTES_TO_MB(avail),
                 BYTES_TO_MB(max), BYTES_TO_MB(taken));
         return -ENOSPC;
 }
diff --git a/drivers/gpu/drm/i915/gvt/cfg_space.c b/drivers/gpu/drm/i915/gvt/cfg_space.c
index 4a6a2ed65732..b7d7721e72fa 100644
--- a/drivers/gpu/drm/i915/gvt/cfg_space.c
+++ b/drivers/gpu/drm/i915/gvt/cfg_space.c
@@ -41,6 +41,54 @@ enum {
         INTEL_GVT_PCI_BAR_MAX,
 };
 
+/* bitmap for writable bits (RW or RW1C bits, but cannot co-exist in one
+ * byte) byte by byte in standard pci configuration space. (not the full
+ * 256 bytes.)
+ */
+static const u8 pci_cfg_space_rw_bmp[PCI_INTERRUPT_LINE + 4] = {
+        [PCI_COMMAND]           = 0xff, 0x07,
+        [PCI_STATUS]            = 0x00, 0xf9, /* the only one RW1C byte */
+        [PCI_CACHE_LINE_SIZE]   = 0xff,
+        [PCI_BASE_ADDRESS_0 ... PCI_CARDBUS_CIS - 1] = 0xff,
+        [PCI_ROM_ADDRESS]       = 0x01, 0xf8, 0xff, 0xff,
+        [PCI_INTERRUPT_LINE]    = 0xff,
+};
+
+/**
+ * vgpu_pci_cfg_mem_write - write virtual cfg space memory
+ *
+ * Use this function to write virtual cfg space memory.
+ * For standard cfg space, only RW bits can be changed,
+ * and we emulates the RW1C behavior of PCI_STATUS register.
+ */
+static void vgpu_pci_cfg_mem_write(struct intel_vgpu *vgpu, unsigned int off,
+                                   u8 *src, unsigned int bytes)
+{
+        u8 *cfg_base = vgpu_cfg_space(vgpu);
+        u8 mask, new, old;
+        int i = 0;
+
+        for (; i < bytes && (off + i < sizeof(pci_cfg_space_rw_bmp)); i++) {
+                mask = pci_cfg_space_rw_bmp[off + i];
+                old = cfg_base[off + i];
+                new = src[i] & mask;
+
+                /**
+                 * The PCI_STATUS high byte has RW1C bits, here
+                 * emulates clear by writing 1 for these bits.
+                 * Writing a 0b to RW1C bits has no effect.
+                 */
+                if (off + i == PCI_STATUS + 1)
+                        new = (~new & old) & mask;
+
+                cfg_base[off + i] = (old & ~mask) | new;
+        }
+
+        /* For other configuration space directly copy as it is. */
+        if (i < bytes)
+                memcpy(cfg_base + off + i, src + i, bytes - i);
+}
+
 /**
  * intel_vgpu_emulate_cfg_read - emulate vGPU configuration space read
  *
@@ -123,7 +171,7 @@ static int emulate_pci_command_write(struct intel_vgpu *vgpu,
         u8 changed = old ^ new;
         int ret;
 
-        memcpy(vgpu_cfg_space(vgpu) + offset, p_data, bytes);
+        vgpu_pci_cfg_mem_write(vgpu, offset, p_data, bytes);
         if (!(changed & PCI_COMMAND_MEMORY))
                 return 0;
 
@@ -237,6 +285,9 @@ int intel_vgpu_emulate_cfg_write(struct intel_vgpu *vgpu, unsigned int offset,
 {
         int ret;
 
+        if (vgpu->failsafe)
+                return 0;
+
         if (WARN_ON(bytes > 4))
                 return -EINVAL;
 
@@ -274,10 +325,10 @@ int intel_vgpu_emulate_cfg_write(struct intel_vgpu *vgpu, unsigned int offset,
                 if (ret)
                         return ret;
 
-                memcpy(vgpu_cfg_space(vgpu) + offset, p_data, bytes);
+                vgpu_pci_cfg_mem_write(vgpu, offset, p_data, bytes);
                 break;
         default:
-                memcpy(vgpu_cfg_space(vgpu) + offset, p_data, bytes);
+                vgpu_pci_cfg_mem_write(vgpu, offset, p_data, bytes);
                 break;
         }
         return 0;
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index b9c8e2407682..2b92cc8a7d1a 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -668,7 +668,7 @@ static inline void print_opcode(u32 cmd, int ring_id)
         if (d_info == NULL)
                 return;
 
-        gvt_err("opcode=0x%x %s sub_ops:",
+        gvt_dbg_cmd("opcode=0x%x %s sub_ops:",
                         cmd >> (32 - d_info->op_len), d_info->name);
 
         for (i = 0; i < d_info->nr_sub_op; i++)
@@ -693,23 +693,23 @@ static void parser_exec_state_dump(struct parser_exec_state *s)
         int cnt = 0;
         int i;
 
-        gvt_err("  vgpu%d RING%d: ring_start(%08lx) ring_end(%08lx)"
+        gvt_dbg_cmd("  vgpu%d RING%d: ring_start(%08lx) ring_end(%08lx)"
                         " ring_head(%08lx) ring_tail(%08lx)\n", s->vgpu->id,
                         s->ring_id, s->ring_start, s->ring_start + s->ring_size,
                         s->ring_head, s->ring_tail);
 
-        gvt_err("  %s %s ip_gma(%08lx) ",
+        gvt_dbg_cmd("  %s %s ip_gma(%08lx) ",
                         s->buf_type == RING_BUFFER_INSTRUCTION ?
                         "RING_BUFFER" : "BATCH_BUFFER",
                         s->buf_addr_type == GTT_BUFFER ?
                         "GTT" : "PPGTT", s->ip_gma);
 
         if (s->ip_va == NULL) {
-                gvt_err(" ip_va(NULL)");
+                gvt_dbg_cmd(" ip_va(NULL)");
                 return;
         }
 
-        gvt_err("  ip_va=%p: %08x %08x %08x %08x\n",
+        gvt_dbg_cmd("  ip_va=%p: %08x %08x %08x %08x\n",
                         s->ip_va, cmd_val(s, 0), cmd_val(s, 1),
                         cmd_val(s, 2), cmd_val(s, 3));
 
@@ -817,6 +817,25 @@ static bool is_shadowed_mmio(unsigned int offset)
         return ret;
 }
 
+static inline bool is_force_nonpriv_mmio(unsigned int offset)
+{
+        return (offset >= 0x24d0 && offset < 0x2500);
+}
+
+static int force_nonpriv_reg_handler(struct parser_exec_state *s,
+                                     unsigned int offset, unsigned int index)
+{
+        struct intel_gvt *gvt = s->vgpu->gvt;
+        unsigned int data = cmd_val(s, index + 1);
+
+        if (!intel_gvt_in_force_nonpriv_whitelist(gvt, data)) {
+                gvt_err("Unexpected forcenonpriv 0x%x LRI write, value=0x%x\n",
+                        offset, data);
+                return -EINVAL;
+        }
+        return 0;
+}
+
 static int cmd_reg_handler(struct parser_exec_state *s,
         unsigned int offset, unsigned int index, char *cmd)
 {
@@ -824,23 +843,26 @@ static int cmd_reg_handler(struct parser_exec_state *s,
         struct intel_gvt *gvt = vgpu->gvt;
 
         if (offset + 4 > gvt->device_info.mmio_size) {
-                gvt_err("%s access to (%x) outside of MMIO range\n",
+                gvt_vgpu_err("%s access to (%x) outside of MMIO range\n",
                                 cmd, offset);
                 return -EINVAL;
         }
 
         if (!intel_gvt_mmio_is_cmd_access(gvt, offset)) {
-                gvt_err("vgpu%d: %s access to non-render register (%x)\n",
-                                s->vgpu->id, cmd, offset);
+                gvt_vgpu_err("%s access to non-render register (%x)\n",
+                                cmd, offset);
                 return 0;
         }
 
         if (is_shadowed_mmio(offset)) {
-                gvt_err("vgpu%d: found access of shadowed MMIO %x\n",
-                                s->vgpu->id, offset);
+                gvt_vgpu_err("found access of shadowed MMIO %x\n", offset);
                 return 0;
         }
 
+        if (is_force_nonpriv_mmio(offset) &&
+            force_nonpriv_reg_handler(s, offset, index))
+                return -EINVAL;
+
         if (offset == i915_mmio_reg_offset(DERRMR) ||
                 offset == i915_mmio_reg_offset(FORCEWAKE_MT)) {
                 /* Writing to HW VGT_PVINFO_PAGE offset will be discarded */
@@ -1008,7 +1030,7 @@ static int cmd_handler_pipe_control(struct parser_exec_state *s)
                         ret = cmd_reg_handler(s, 0x2358, 1, "pipe_ctrl");
                 else if (post_sync == 1) {
                         /* check ggtt*/
-                        if ((cmd_val(s, 2) & (1 << 2))) {
+                        if ((cmd_val(s, 1) & PIPE_CONTROL_GLOBAL_GTT_IVB)) {
                                 gma = cmd_val(s, 2) & GENMASK(31, 3);
                                 if (gmadr_bytes == 8)
                                         gma |= (cmd_gma_hi(s, 3)) << 32;
@@ -1129,6 +1151,7 @@ static int skl_decode_mi_display_flip(struct parser_exec_state *s,
                 struct mi_display_flip_command_info *info)
 {
         struct drm_i915_private *dev_priv = s->vgpu->gvt->dev_priv;
+        struct intel_vgpu *vgpu = s->vgpu;
         u32 dword0 = cmd_val(s, 0);
         u32 dword1 = cmd_val(s, 1);
         u32 dword2 = cmd_val(s, 2);
@@ -1167,7 +1190,7 @@ static int skl_decode_mi_display_flip(struct parser_exec_state *s,
                 break;
 
         default:
-                gvt_err("unknown plane code %d\n", plane);
+                gvt_vgpu_err("unknown plane code %d\n", plane);
                 return -EINVAL;
         }
 
@@ -1274,25 +1297,26 @@ static int update_plane_mmio_from_mi_display_flip(
 static int cmd_handler_mi_display_flip(struct parser_exec_state *s)
 {
         struct mi_display_flip_command_info info;
+        struct intel_vgpu *vgpu = s->vgpu;
         int ret;
         int i;
         int len = cmd_length(s);
 
         ret = decode_mi_display_flip(s, &info);
         if (ret) {
-                gvt_err("fail to decode MI display flip command\n");
+                gvt_vgpu_err("fail to decode MI display flip command\n");
                 return ret;
         }
 
         ret = check_mi_display_flip(s, &info);
         if (ret) {
-                gvt_err("invalid MI display flip command\n");
+                gvt_vgpu_err("invalid MI display flip command\n");
                 return ret;
         }
 
         ret = update_plane_mmio_from_mi_display_flip(s, &info);
         if (ret) {
-                gvt_err("fail to update plane mmio\n");
+                gvt_vgpu_err("fail to update plane mmio\n");
                 return ret;
         }
 
@@ -1350,7 +1374,8 @@ static inline int cmd_address_audit(struct parser_exec_state *s,
         int ret;
 
         if (op_size > max_surface_size) {
-                gvt_err("command address audit fail name %s\n", s->info->name);
+                gvt_vgpu_err("command address audit fail name %s\n",
+                        s->info->name);
                 return -EINVAL;
         }
 
@@ -1367,7 +1392,7 @@ static inline int cmd_address_audit(struct parser_exec_state *s,
         }
         return 0;
 err:
-        gvt_err("cmd_parser: Malicious %s detected, addr=0x%lx, len=%d!\n",
+        gvt_vgpu_err("cmd_parser: Malicious %s detected, addr=0x%lx, len=%d!\n",
                         s->info->name, guest_gma, op_size);
 
         pr_err("cmd dump: ");
@@ -1412,8 +1437,10 @@ static int cmd_handler_mi_store_data_imm(struct parser_exec_state *s)
 
 static inline int unexpected_cmd(struct parser_exec_state *s)
 {
-        gvt_err("vgpu%d: Unexpected %s in command buffer!\n",
-                        s->vgpu->id, s->info->name);
+        struct intel_vgpu *vgpu = s->vgpu;
+
+        gvt_vgpu_err("Unexpected %s in command buffer!\n", s->info->name);
+
         return -EINVAL;
 }
 
@@ -1516,7 +1543,7 @@ static int copy_gma_to_hva(struct intel_vgpu *vgpu, struct intel_vgpu_mm *mm,
         while (gma != end_gma) {
                 gpa = intel_vgpu_gma_to_gpa(mm, gma);
                 if (gpa == INTEL_GVT_INVALID_ADDR) {
-                        gvt_err("invalid gma address: %lx\n", gma);
+                        gvt_vgpu_err("invalid gma address: %lx\n", gma);
                         return -EFAULT;
                 }
 
@@ -1557,6 +1584,7 @@ static uint32_t find_bb_size(struct parser_exec_state *s)
         uint32_t bb_size = 0;
         uint32_t cmd_len = 0;
         bool met_bb_end = false;
+        struct intel_vgpu *vgpu = s->vgpu;
         u32 cmd;
 
         /* get the start gm address of the batch buffer */
@@ -1565,7 +1593,7 @@ static uint32_t find_bb_size(struct parser_exec_state *s)
 
         info = get_cmd_info(s->vgpu->gvt, cmd, s->ring_id);
         if (info == NULL) {
-                gvt_err("unknown cmd 0x%x, opcode=0x%x\n",
+                gvt_vgpu_err("unknown cmd 0x%x, opcode=0x%x\n",
                                 cmd, get_opcode(cmd, s->ring_id));
                 return -EINVAL;
         }
@@ -1574,7 +1602,7 @@ static uint32_t find_bb_size(struct parser_exec_state *s)
                                 gma, gma + 4, &cmd);
                 info = get_cmd_info(s->vgpu->gvt, cmd, s->ring_id);
                 if (info == NULL) {
-                        gvt_err("unknown cmd 0x%x, opcode=0x%x\n",
+                        gvt_vgpu_err("unknown cmd 0x%x, opcode=0x%x\n",
                                 cmd, get_opcode(cmd, s->ring_id));
                         return -EINVAL;
                 }
@@ -1599,6 +1627,7 @@ static uint32_t find_bb_size(struct parser_exec_state *s)
 static int perform_bb_shadow(struct parser_exec_state *s)
 {
         struct intel_shadow_bb_entry *entry_obj;
+        struct intel_vgpu *vgpu = s->vgpu;
         unsigned long gma = 0;
         uint32_t bb_size;
         void *dst = NULL;
@@ -1633,7 +1662,7 @@ static int perform_bb_shadow(struct parser_exec_state *s)
 
         ret = i915_gem_object_set_to_cpu_domain(entry_obj->obj, false);
         if (ret) {
-                gvt_err("failed to set shadow batch to CPU\n");
+                gvt_vgpu_err("failed to set shadow batch to CPU\n");
                 goto unmap_src;
         }
 
@@ -1645,7 +1674,7 @@ static int perform_bb_shadow(struct parser_exec_state *s)
                               gma, gma + bb_size,
                               dst);
         if (ret) {
-                gvt_err("fail to copy guest ring buffer\n");
+                gvt_vgpu_err("fail to copy guest ring buffer\n");
                 goto unmap_src;
         }
 
@@ -1676,15 +1705,16 @@ static int cmd_handler_mi_batch_buffer_start(struct parser_exec_state *s)
 {
         bool second_level;
         int ret = 0;
+        struct intel_vgpu *vgpu = s->vgpu;
 
         if (s->buf_type == BATCH_BUFFER_2ND_LEVEL) {
-                gvt_err("Found MI_BATCH_BUFFER_START in 2nd level BB\n");
+                gvt_vgpu_err("Found MI_BATCH_BUFFER_START in 2nd level BB\n");
                 return -EINVAL;
         }
 
         second_level = BATCH_BUFFER_2ND_LEVEL_BIT(cmd_val(s, 0)) == 1;
         if (second_level && (s->buf_type != BATCH_BUFFER_INSTRUCTION)) {
-                gvt_err("Jumping to 2nd level BB from RB is not allowed\n");
+                gvt_vgpu_err("Jumping to 2nd level BB from RB is not allowed\n");
                 return -EINVAL;
         }
 
@@ -1702,7 +1732,7 @@ static int cmd_handler_mi_batch_buffer_start(struct parser_exec_state *s)
         if (batch_buffer_needs_scan(s)) {
                 ret = perform_bb_shadow(s);
                 if (ret < 0)
-                        gvt_err("invalid shadow batch buffer\n");
+                        gvt_vgpu_err("invalid shadow batch buffer\n");
         } else {
                 /* emulate a batch buffer end to do return right */
                 ret = cmd_handler_mi_batch_buffer_end(s);
@@ -2429,6 +2459,7 @@ static int cmd_parser_exec(struct parser_exec_state *s)
         int ret = 0;
         cycles_t t0, t1, t2;
         struct parser_exec_state s_before_advance_custom;
+        struct intel_vgpu *vgpu = s->vgpu;
 
         t0 = get_cycles();
 
@@ -2436,7 +2467,7 @@ static int cmd_parser_exec(struct parser_exec_state *s)
 
         info = get_cmd_info(s->vgpu->gvt, cmd, s->ring_id);
         if (info == NULL) {
-                gvt_err("unknown cmd 0x%x, opcode=0x%x\n",
+                gvt_vgpu_err("unknown cmd 0x%x, opcode=0x%x\n",
                                 cmd, get_opcode(cmd, s->ring_id));
                 return -EINVAL;
         }
@@ -2452,7 +2483,7 @@ static int cmd_parser_exec(struct parser_exec_state *s)
         if (info->handler) {
                 ret = info->handler(s);
                 if (ret < 0) {
-                        gvt_err("%s handler error\n", info->name);
+                        gvt_vgpu_err("%s handler error\n", info->name);
                         return ret;
                 }
         }
@@ -2463,7 +2494,7 @@ static int cmd_parser_exec(struct parser_exec_state *s)
         if (!(info->flag & F_IP_ADVANCE_CUSTOM)) {
                 ret = cmd_advance_default(s);
                 if (ret) {
-                        gvt_err("%s IP advance error\n", info->name);
+                        gvt_vgpu_err("%s IP advance error\n", info->name);
                         return ret;
                 }
         }
@@ -2486,6 +2517,7 @@ static int command_scan(struct parser_exec_state *s,
 
         unsigned long gma_head, gma_tail, gma_bottom;
         int ret = 0;
+        struct intel_vgpu *vgpu = s->vgpu;
 
         gma_head = rb_start + rb_head;
         gma_tail = rb_start + rb_tail;
@@ -2497,7 +2529,7 @@ static int command_scan(struct parser_exec_state *s,
                 if (s->buf_type == RING_BUFFER_INSTRUCTION) {
                         if (!(s->ip_gma >= rb_start) ||
                                 !(s->ip_gma < gma_bottom)) {
-                                gvt_err("ip_gma %lx out of ring scope."
+                                gvt_vgpu_err("ip_gma %lx out of ring scope."
                                         "(base:0x%lx, bottom: 0x%lx)\n",
                                         s->ip_gma, rb_start,
                                         gma_bottom);
@@ -2505,7 +2537,7 @@ static int command_scan(struct parser_exec_state *s,
                                 return -EINVAL;
                         }
                         if (gma_out_of_range(s->ip_gma, gma_head, gma_tail)) {
-                                gvt_err("ip_gma %lx out of range."
+                                gvt_vgpu_err("ip_gma %lx out of range."
                                         "base 0x%lx head 0x%lx tail 0x%lx\n",
                                         s->ip_gma, rb_start,
                                         rb_head, rb_tail);
@@ -2515,7 +2547,7 @@ static int command_scan(struct parser_exec_state *s,
                 }
                 ret = cmd_parser_exec(s);
                 if (ret) {
-                        gvt_err("cmd parser error\n");
+                        gvt_vgpu_err("cmd parser error\n");
                         parser_exec_state_dump(s);
                         break;
                 }
@@ -2639,7 +2671,7 @@ static int shadow_workload_ring_buffer(struct intel_vgpu_workload *workload)
                                 gma_head, gma_top,
                                 workload->shadow_ring_buffer_va);
                 if (ret) {
-                        gvt_err("fail to copy guest ring buffer\n");
+                        gvt_vgpu_err("fail to copy guest ring buffer\n");
                         return ret;
                 }
                 copy_len = gma_top - gma_head;
@@ -2651,7 +2683,7 @@ static int shadow_workload_ring_buffer(struct intel_vgpu_workload *workload)
                         gma_head, gma_tail,
                         workload->shadow_ring_buffer_va + copy_len);
         if (ret) {
-                gvt_err("fail to copy guest ring buffer\n");
+                gvt_vgpu_err("fail to copy guest ring buffer\n");
                 return ret;
         }
         ring->tail += workload->rb_len;
@@ -2662,16 +2694,17 @@ static int shadow_workload_ring_buffer(struct intel_vgpu_workload *workload)
 int intel_gvt_scan_and_shadow_workload(struct intel_vgpu_workload *workload)
 {
         int ret;
+        struct intel_vgpu *vgpu = workload->vgpu;
 
         ret = shadow_workload_ring_buffer(workload);
         if (ret) {
-                gvt_err("fail to shadow workload ring_buffer\n");
+                gvt_vgpu_err("fail to shadow workload ring_buffer\n");
                 return ret;
         }
 
         ret = scan_workload(workload);
         if (ret) {
-                gvt_err("scan workload error\n");
+                gvt_vgpu_err("scan workload error\n");
                 return ret;
         }
         return 0;
@@ -2681,6 +2714,7 @@ static int shadow_indirect_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 {
         int ctx_size = wa_ctx->indirect_ctx.size;
         unsigned long guest_gma = wa_ctx->indirect_ctx.guest_gma;
+        struct intel_vgpu *vgpu = wa_ctx->workload->vgpu;
         struct drm_i915_gem_object *obj;
         int ret = 0;
         void *map;
@@ -2694,14 +2728,14 @@ static int shadow_indirect_ctx(struct intel_shadow_wa_ctx *wa_ctx)
         /* get the va of the shadow batch buffer */
         map = i915_gem_object_pin_map(obj, I915_MAP_WB);
         if (IS_ERR(map)) {
-                gvt_err("failed to vmap shadow indirect ctx\n");
+                gvt_vgpu_err("failed to vmap shadow indirect ctx\n");
                 ret = PTR_ERR(map);
                 goto put_obj;
         }
 
         ret = i915_gem_object_set_to_cpu_domain(obj, false);
         if (ret) {
-                gvt_err("failed to set shadow indirect ctx to CPU\n");
+                gvt_vgpu_err("failed to set shadow indirect ctx to CPU\n");
                 goto unmap_src;
         }
 
@@ -2710,7 +2744,7 @@ static int shadow_indirect_ctx(struct intel_shadow_wa_ctx *wa_ctx)
                                 guest_gma, guest_gma + ctx_size,
                                 map);
         if (ret) {
-                gvt_err("fail to copy guest indirect ctx\n");
+                gvt_vgpu_err("fail to copy guest indirect ctx\n");
                 goto unmap_src;
         }
 
@@ -2744,13 +2778,14 @@ static int combine_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 int intel_gvt_scan_and_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 {
         int ret;
+        struct intel_vgpu *vgpu = wa_ctx->workload->vgpu;
 
         if (wa_ctx->indirect_ctx.size == 0)
                 return 0;
 
         ret = shadow_indirect_ctx(wa_ctx);
         if (ret) {
-                gvt_err("fail to shadow indirect ctx\n");
+                gvt_vgpu_err("fail to shadow indirect ctx\n");
                 return ret;
         }
 
@@ -2758,7 +2793,7 @@ int intel_gvt_scan_and_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 
         ret = scan_wa_ctx(wa_ctx);
         if (ret) {
-                gvt_err("scan wa ctx error\n");
+                gvt_vgpu_err("scan wa ctx error\n");
                 return ret;
         }
 
diff --git a/drivers/gpu/drm/i915/gvt/debug.h b/drivers/gpu/drm/i915/gvt/debug.h
index 68cba7bd980a..b0cff4dc2684 100644
--- a/drivers/gpu/drm/i915/gvt/debug.h
+++ b/drivers/gpu/drm/i915/gvt/debug.h
@@ -27,6 +27,14 @@
 #define gvt_err(fmt, args...) \
         DRM_ERROR("gvt: "fmt, ##args)
 
+#define gvt_vgpu_err(fmt, args...)                                      \
+do {                                                                    \
+        if (IS_ERR_OR_NULL(vgpu))                                       \
+                DRM_DEBUG_DRIVER("gvt: "fmt, ##args);                   \
+        else                                                            \
+                DRM_DEBUG_DRIVER("gvt: vgpu %d: "fmt, vgpu->id, ##args);\
+} while (0)
+
 #define gvt_dbg_core(fmt, args...) \
         DRM_DEBUG_DRIVER("gvt: core: "fmt, ##args)
 
diff --git a/drivers/gpu/drm/i915/gvt/display.c b/drivers/gpu/drm/i915/gvt/display.c
index 6d8fde880c39..5419ae6ec633 100644
--- a/drivers/gpu/drm/i915/gvt/display.c
+++ b/drivers/gpu/drm/i915/gvt/display.c
@@ -83,44 +83,80 @@ static int pipe_is_enabled(struct intel_vgpu *vgpu, int pipe)
         return 0;
 }
 
+static unsigned char virtual_dp_monitor_edid[GVT_EDID_NUM][EDID_SIZE] = {
+        {
+/* EDID with 1024x768 as its resolution */
+                /*Header*/
+                0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
+                /* Vendor & Product Identification */
+                0x22, 0xf0, 0x54, 0x29, 0x00, 0x00, 0x00, 0x00, 0x04, 0x17,
+                /* Version & Revision */
+                0x01, 0x04,
+                /* Basic Display Parameters & Features */
+                0xa5, 0x34, 0x20, 0x78, 0x23,
+                /* Color Characteristics */
+                0xfc, 0x81, 0xa4, 0x55, 0x4d, 0x9d, 0x25, 0x12, 0x50, 0x54,
+                /* Established Timings: maximum resolution is 1024x768 */
+                0x21, 0x08, 0x00,
+                /* Standard Timings. All invalid */
+                0x00, 0xc0, 0x00, 0xc0, 0x00, 0x40, 0x00, 0x80, 0x00, 0x00,
+                0x00, 0x40, 0x00, 0x00, 0x00, 0x01,
+                /* 18 Byte Data Blocks 1: invalid */
+                0x00, 0x00, 0x80, 0xa0, 0x70, 0xb0,
+                0x23, 0x40, 0x30, 0x20, 0x36, 0x00, 0x06, 0x44, 0x21, 0x00, 0x00, 0x1a,
+                /* 18 Byte Data Blocks 2: invalid */
+                0x00, 0x00, 0x00, 0xfd, 0x00, 0x18, 0x3c, 0x18, 0x50, 0x11, 0x00, 0x0a,
+                0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+                /* 18 Byte Data Blocks 3: invalid */
+                0x00, 0x00, 0x00, 0xfc, 0x00, 0x48,
+                0x50, 0x20, 0x5a, 0x52, 0x32, 0x34, 0x34, 0x30, 0x77, 0x0a, 0x20, 0x20,
+                /* 18 Byte Data Blocks 4: invalid */
+                0x00, 0x00, 0x00, 0xff, 0x00, 0x43, 0x4e, 0x34, 0x33, 0x30, 0x34, 0x30,
+                0x44, 0x58, 0x51, 0x0a, 0x20, 0x20,
+                /* Extension Block Count */
+                0x00,
+                /* Checksum */
+                0xef,
+        },
+        {
 /* EDID with 1920x1200 as its resolution */
-static unsigned char virtual_dp_monitor_edid[] = {
-        /*Header*/
-        0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
-        /* Vendor & Product Identification */
-        0x22, 0xf0, 0x54, 0x29, 0x00, 0x00, 0x00, 0x00, 0x04, 0x17,
-        /* Version & Revision */
-        0x01, 0x04,
-        /* Basic Display Parameters & Features */
-        0xa5, 0x34, 0x20, 0x78, 0x23,
-        /* Color Characteristics */
-        0xfc, 0x81, 0xa4, 0x55, 0x4d, 0x9d, 0x25, 0x12, 0x50, 0x54,
-        /* Established Timings: maximum resolution is 1024x768 */
-        0x21, 0x08, 0x00,
-        /*
-         * Standard Timings.
-         * below new resolutions can be supported:
-         * 1920x1080, 1280x720, 1280x960, 1280x1024,
-         * 1440x900, 1600x1200, 1680x1050
-         */
-        0xd1, 0xc0, 0x81, 0xc0, 0x81, 0x40, 0x81, 0x80, 0x95, 0x00,
-        0xa9, 0x40, 0xb3, 0x00, 0x01, 0x01,
-        /* 18 Byte Data Blocks 1: max resolution is 1920x1200 */
-        0x28, 0x3c, 0x80, 0xa0, 0x70, 0xb0,
-        0x23, 0x40, 0x30, 0x20, 0x36, 0x00, 0x06, 0x44, 0x21, 0x00, 0x00, 0x1a,
-        /* 18 Byte Data Blocks 2: invalid */
-        0x00, 0x00, 0x00, 0xfd, 0x00, 0x18, 0x3c, 0x18, 0x50, 0x11, 0x00, 0x0a,
-        0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
-        /* 18 Byte Data Blocks 3: invalid */
-        0x00, 0x00, 0x00, 0xfc, 0x00, 0x48,
-        0x50, 0x20, 0x5a, 0x52, 0x32, 0x34, 0x34, 0x30, 0x77, 0x0a, 0x20, 0x20,
-        /* 18 Byte Data Blocks 4: invalid */
-        0x00, 0x00, 0x00, 0xff, 0x00, 0x43, 0x4e, 0x34, 0x33, 0x30, 0x34, 0x30,
-        0x44, 0x58, 0x51, 0x0a, 0x20, 0x20,
-        /* Extension Block Count */
-        0x00,
-        /* Checksum */
-        0x45,
+                /*Header*/
+                0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
+                /* Vendor & Product Identification */
+                0x22, 0xf0, 0x54, 0x29, 0x00, 0x00, 0x00, 0x00, 0x04, 0x17,
+                /* Version & Revision */
+                0x01, 0x04,
+                /* Basic Display Parameters & Features */
+                0xa5, 0x34, 0x20, 0x78, 0x23,
+                /* Color Characteristics */
+                0xfc, 0x81, 0xa4, 0x55, 0x4d, 0x9d, 0x25, 0x12, 0x50, 0x54,
+                /* Established Timings: maximum resolution is 1024x768 */
+                0x21, 0x08, 0x00,
+                /*
+                 * Standard Timings.
+                 * below new resolutions can be supported:
+                 * 1920x1080, 1280x720, 1280x960, 1280x1024,
+                 * 1440x900, 1600x1200, 1680x1050
+                 */
+                0xd1, 0xc0, 0x81, 0xc0, 0x81, 0x40, 0x81, 0x80, 0x95, 0x00,
+                0xa9, 0x40, 0xb3, 0x00, 0x01, 0x01,
+                /* 18 Byte Data Blocks 1: max resolution is 1920x1200 */
+                0x28, 0x3c, 0x80, 0xa0, 0x70, 0xb0,
+                0x23, 0x40, 0x30, 0x20, 0x36, 0x00, 0x06, 0x44, 0x21, 0x00, 0x00, 0x1a,
+                /* 18 Byte Data Blocks 2: invalid */
+                0x00, 0x00, 0x00, 0xfd, 0x00, 0x18, 0x3c, 0x18, 0x50, 0x11, 0x00, 0x0a,
+                0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+                /* 18 Byte Data Blocks 3: invalid */
+                0x00, 0x00, 0x00, 0xfc, 0x00, 0x48,
+                0x50, 0x20, 0x5a, 0x52, 0x32, 0x34, 0x34, 0x30, 0x77, 0x0a, 0x20, 0x20,
+                /* 18 Byte Data Blocks 4: invalid */
+                0x00, 0x00, 0x00, 0xff, 0x00, 0x43, 0x4e, 0x34, 0x33, 0x30, 0x34, 0x30,
+                0x44, 0x58, 0x51, 0x0a, 0x20, 0x20,
+                /* Extension Block Count */
+                0x00,
+                /* Checksum */
+                0x45,
+        },
 };
 
 #define DPCD_HEADER_SIZE        0xb
@@ -140,14 +176,20 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
                 vgpu_vreg(vgpu, SDEISR) &= ~(SDE_PORTA_HOTPLUG_SPT |
                                 SDE_PORTE_HOTPLUG_SPT);
 
-        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_B))
+        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_B)) {
                 vgpu_vreg(vgpu, SDEISR) |= SDE_PORTB_HOTPLUG_CPT;
+                vgpu_vreg(vgpu, SFUSE_STRAP) |= SFUSE_STRAP_DDIB_DETECTED;
+        }
 
-        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_C))
+        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_C)) {
                 vgpu_vreg(vgpu, SDEISR) |= SDE_PORTC_HOTPLUG_CPT;
+                vgpu_vreg(vgpu, SFUSE_STRAP) |= SFUSE_STRAP_DDIC_DETECTED;
+        }
 
-        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_D))
+        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_D)) {
                 vgpu_vreg(vgpu, SDEISR) |= SDE_PORTD_HOTPLUG_CPT;
+                vgpu_vreg(vgpu, SFUSE_STRAP) |= SFUSE_STRAP_DDID_DETECTED;
+        }
 
         if (IS_SKYLAKE(dev_priv) &&
                         intel_vgpu_has_monitor_on_port(vgpu, PORT_E)) {
@@ -160,6 +202,8 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
                                 GEN8_PORT_DP_A_HOTPLUG;
                 else
                         vgpu_vreg(vgpu, SDEISR) |= SDE_PORTA_HOTPLUG_SPT;
+
+                vgpu_vreg(vgpu, DDI_BUF_CTL(PORT_A)) |= DDI_INIT_DISPLAY_DETECTED;
         }
 }
 
@@ -175,10 +219,13 @@ static void clean_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num)
 }
 
 static int setup_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num,
-                int type)
+                                    int type, unsigned int resolution)
 {
         struct intel_vgpu_port *port = intel_vgpu_port(vgpu, port_num);
 
+        if (WARN_ON(resolution >= GVT_EDID_NUM))
+                return -EINVAL;
+
         port->edid = kzalloc(sizeof(*(port->edid)), GFP_KERNEL);
         if (!port->edid)
                 return -ENOMEM;
@@ -189,7 +236,7 @@ static int setup_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num,
                 return -ENOMEM;
         }
 
-        memcpy(port->edid->edid_block, virtual_dp_monitor_edid,
+        memcpy(port->edid->edid_block, virtual_dp_monitor_edid[resolution],
                         EDID_SIZE);
         port->edid->data_valid = true;
 
@@ -322,16 +369,18 @@ void intel_vgpu_clean_display(struct intel_vgpu *vgpu)
  * Zero on success, negative error code if failed.
  *
  */
-int intel_vgpu_init_display(struct intel_vgpu *vgpu)
+int intel_vgpu_init_display(struct intel_vgpu *vgpu, u64 resolution)
 {
         struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
 
         intel_vgpu_init_i2c_edid(vgpu);
 
         if (IS_SKYLAKE(dev_priv))
-                return setup_virtual_dp_monitor(vgpu, PORT_D, GVT_DP_D);
+                return setup_virtual_dp_monitor(vgpu, PORT_D, GVT_DP_D,
+                                                resolution);
         else
-                return setup_virtual_dp_monitor(vgpu, PORT_B, GVT_DP_B);
+                return setup_virtual_dp_monitor(vgpu, PORT_B, GVT_DP_B,
+                                                resolution);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/display.h b/drivers/gpu/drm/i915/gvt/display.h
index 8b234ea961f6..d73de22102e2 100644
--- a/drivers/gpu/drm/i915/gvt/display.h
+++ b/drivers/gpu/drm/i915/gvt/display.h
@@ -154,10 +154,28 @@ struct intel_vgpu_port {
         int type;
 };
 
+enum intel_vgpu_edid {
+        GVT_EDID_1024_768,
+        GVT_EDID_1920_1200,
+        GVT_EDID_NUM,
+};
+
+static inline char *vgpu_edid_str(enum intel_vgpu_edid id)
+{
+        switch (id) {
+        case GVT_EDID_1024_768:
+                return "1024x768";
+        case GVT_EDID_1920_1200:
+                return "1920x1200";
+        default:
+                return "";
+        }
+}
+
 void intel_gvt_emulate_vblank(struct intel_gvt *gvt);
 void intel_gvt_check_vblank_emulation(struct intel_gvt *gvt);
 
-int intel_vgpu_init_display(struct intel_vgpu *vgpu);
+int intel_vgpu_init_display(struct intel_vgpu *vgpu, u64 resolution);
 void intel_vgpu_reset_display(struct intel_vgpu *vgpu);
 void intel_vgpu_clean_display(struct intel_vgpu *vgpu);
 
diff --git a/drivers/gpu/drm/i915/gvt/edid.c b/drivers/gpu/drm/i915/gvt/edid.c
index bda85dff7b2a..42cd09ec63fa 100644
--- a/drivers/gpu/drm/i915/gvt/edid.c
+++ b/drivers/gpu/drm/i915/gvt/edid.c
@@ -52,16 +52,16 @@ static unsigned char edid_get_byte(struct intel_vgpu *vgpu)
         unsigned char chr = 0;
 
         if (edid->state == I2C_NOT_SPECIFIED || !edid->slave_selected) {
-                gvt_err("Driver tries to read EDID without proper sequence!\n");
+                gvt_vgpu_err("Driver tries to read EDID without proper sequence!\n");
                 return 0;
         }
         if (edid->current_edid_read >= EDID_SIZE) {
-                gvt_err("edid_get_byte() exceeds the size of EDID!\n");
+                gvt_vgpu_err("edid_get_byte() exceeds the size of EDID!\n");
                 return 0;
         }
 
         if (!edid->edid_available) {
-                gvt_err("Reading EDID but EDID is not available!\n");
+                gvt_vgpu_err("Reading EDID but EDID is not available!\n");
                 return 0;
         }
 
@@ -72,7 +72,7 @@ static unsigned char edid_get_byte(struct intel_vgpu *vgpu)
                 chr = edid_data->edid_block[edid->current_edid_read];
                 edid->current_edid_read++;
         } else {
-                gvt_err("No EDID available during the reading?\n");
+                gvt_vgpu_err("No EDID available during the reading?\n");
         }
         return chr;
 }
@@ -223,7 +223,7 @@ static int gmbus1_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                         vgpu_vreg(vgpu, PCH_GMBUS2) |= GMBUS_ACTIVE;
                         break;
                 default:
-                        gvt_err("Unknown/reserved GMBUS cycle detected!\n");
+                        gvt_vgpu_err("Unknown/reserved GMBUS cycle detected!\n");
                         break;
                 }
                 /*
@@ -292,8 +292,7 @@ static int gmbus3_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
                  */
         } else {
                 memcpy(p_data, &vgpu_vreg(vgpu, offset), bytes);
-                gvt_err("vgpu%d: warning: gmbus3 read with nothing returned\n",
-                                vgpu->id);
+                gvt_vgpu_err("warning: gmbus3 read with nothing returned\n");
         }
         return 0;
 }
@@ -496,7 +495,8 @@ void intel_gvt_i2c_handle_aux_ch_write(struct intel_vgpu *vgpu,
                         unsigned char val = edid_get_byte(vgpu);
 
                         aux_data_for_write = (val << 16);
-                }
+                } else
+                        aux_data_for_write = (0xff << 16);
         }
         /* write the return value in AUX_CH_DATA reg which includes:
          * ACK of I2C_WRITE
diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c
index 46eb9fd3c03f..f1f426a97aa9 100644
--- a/drivers/gpu/drm/i915/gvt/execlist.c
+++ b/drivers/gpu/drm/i915/gvt/execlist.c
@@ -172,6 +172,7 @@ static int emulate_execlist_ctx_schedule_out(
                 struct intel_vgpu_execlist *execlist,
                 struct execlist_ctx_descriptor_format *ctx)
 {
+        struct intel_vgpu *vgpu = execlist->vgpu;
         struct intel_vgpu_execlist_slot *running = execlist->running_slot;
         struct intel_vgpu_execlist_slot *pending = execlist->pending_slot;
         struct execlist_ctx_descriptor_format *ctx0 = &running->ctx[0];
@@ -183,7 +184,7 @@ static int emulate_execlist_ctx_schedule_out(
         gvt_dbg_el("schedule out context id %x\n", ctx->context_id);
 
         if (WARN_ON(!same_context(ctx, execlist->running_context))) {
-                gvt_err("schedule out context is not running context,"
+                gvt_vgpu_err("schedule out context is not running context,"
                                 "ctx id %x running ctx id %x\n",
                                 ctx->context_id,
                                 execlist->running_context->context_id);
@@ -254,7 +255,7 @@ static struct intel_vgpu_execlist_slot *get_next_execlist_slot(
         status.udw = vgpu_vreg(vgpu, status_reg + 4);
 
         if (status.execlist_queue_full) {
-                gvt_err("virtual execlist slots are full\n");
+                gvt_vgpu_err("virtual execlist slots are full\n");
                 return NULL;
         }
 
@@ -270,11 +271,12 @@ static int emulate_execlist_schedule_in(struct intel_vgpu_execlist *execlist,
 
         struct execlist_ctx_descriptor_format *ctx0, *ctx1;
         struct execlist_context_status_format status;
+        struct intel_vgpu *vgpu = execlist->vgpu;
 
         gvt_dbg_el("emulate schedule-in\n");
 
         if (!slot) {
-                gvt_err("no available execlist slot\n");
+                gvt_vgpu_err("no available execlist slot\n");
                 return -EINVAL;
         }
 
@@ -375,7 +377,6 @@ static void prepare_shadow_batch_buffer(struct intel_vgpu_workload *workload)
 
                 vma = i915_gem_object_ggtt_pin(entry_obj->obj, NULL, 0, 4, 0);
                 if (IS_ERR(vma)) {
-                        gvt_err("Cannot pin\n");
                         return;
                 }
 
@@ -428,7 +429,6 @@ static void prepare_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
         vma = i915_gem_object_ggtt_pin(wa_ctx->indirect_ctx.obj, NULL,
                                        0, CACHELINE_BYTES, 0);
         if (IS_ERR(vma)) {
-                gvt_err("Cannot pin indirect ctx obj\n");
                 return;
         }
 
@@ -561,6 +561,7 @@ static int prepare_mm(struct intel_vgpu_workload *workload)
 {
         struct execlist_ctx_descriptor_format *desc = &workload->ctx_desc;
         struct intel_vgpu_mm *mm;
+        struct intel_vgpu *vgpu = workload->vgpu;
         int page_table_level;
         u32 pdp[8];
 
@@ -569,7 +570,7 @@ static int prepare_mm(struct intel_vgpu_workload *workload)
         } else if (desc->addressing_mode == 3) { /* legacy 64 bit */
                 page_table_level = 4;
         } else {
-                gvt_err("Advanced Context mode(SVM) is not supported!\n");
+                gvt_vgpu_err("Advanced Context mode(SVM) is not supported!\n");
                 return -EINVAL;
         }
 
@@ -583,7 +584,7 @@ static int prepare_mm(struct intel_vgpu_workload *workload)
                 mm = intel_vgpu_create_mm(workload->vgpu, INTEL_GVT_MM_PPGTT,
                                 pdp, page_table_level, 0);
                 if (IS_ERR(mm)) {
-                        gvt_err("fail to create mm object.\n");
+                        gvt_vgpu_err("fail to create mm object.\n");
                         return PTR_ERR(mm);
                 }
         }
@@ -609,7 +610,7 @@ static int submit_context(struct intel_vgpu *vgpu, int ring_id,
         ring_context_gpa = intel_vgpu_gma_to_gpa(vgpu->gtt.ggtt_mm,
                         (u32)((desc->lrca + 1) << GTT_PAGE_SHIFT));
         if (ring_context_gpa == INTEL_GVT_INVALID_ADDR) {
-                gvt_err("invalid guest context LRCA: %x\n", desc->lrca);
+                gvt_vgpu_err("invalid guest context LRCA: %x\n", desc->lrca);
                 return -EINVAL;
         }
 
@@ -724,8 +725,7 @@ int intel_vgpu_submit_execlist(struct intel_vgpu *vgpu, int ring_id)
                         continue;
 
                 if (!desc[i]->privilege_access) {
-                        gvt_err("vgpu%d: unexpected GGTT elsp submission\n",
-                                        vgpu->id);
+                        gvt_vgpu_err("unexpected GGTT elsp submission\n");
                         return -EINVAL;
                 }
 
@@ -735,15 +735,13 @@ int intel_vgpu_submit_execlist(struct intel_vgpu *vgpu, int ring_id)
         }
 
         if (!valid_desc_bitmap) {
-                gvt_err("vgpu%d: no valid desc in a elsp submission\n",
-                                vgpu->id);
+                gvt_vgpu_err("no valid desc in a elsp submission\n");
                 return -EINVAL;
         }
 
         if (!test_bit(0, (void *)&valid_desc_bitmap) &&
                         test_bit(1, (void *)&valid_desc_bitmap)) {
-                gvt_err("vgpu%d: weird elsp submission, desc 0 is not valid\n",
-                                vgpu->id);
+                gvt_vgpu_err("weird elsp submission, desc 0 is not valid\n");
                 return -EINVAL;
         }
 
@@ -752,8 +750,7 @@ int intel_vgpu_submit_execlist(struct intel_vgpu *vgpu, int ring_id)
                 ret = submit_context(vgpu, ring_id, &valid_desc[i],
                                 emulate_schedule_in);
                 if (ret) {
-                        gvt_err("vgpu%d: fail to schedule workload\n",
-                                        vgpu->id);
+                        gvt_vgpu_err("fail to schedule workload\n");
                         return ret;
                 }
                 emulate_schedule_in = false;
diff --git a/drivers/gpu/drm/i915/gvt/firmware.c b/drivers/gpu/drm/i915/gvt/firmware.c
index 1cb29b2d7dc6..933a7c211a1c 100644
--- a/drivers/gpu/drm/i915/gvt/firmware.c
+++ b/drivers/gpu/drm/i915/gvt/firmware.c
@@ -80,7 +80,7 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
         int ret;
 
         size = sizeof(*h) + info->mmio_size + info->cfg_space_size - 1;
-        firmware = vmalloc(size);
+        firmware = vzalloc(size);
         if (!firmware)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 28c92346db0e..b832bea64e03 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -49,8 +49,8 @@ bool intel_gvt_ggtt_validate_range(struct intel_vgpu *vgpu, u64 addr, u32 size)
 {
         if ((!vgpu_gmadr_is_valid(vgpu, addr)) || (size
                         && !vgpu_gmadr_is_valid(vgpu, addr + size - 1))) {
-                gvt_err("vgpu%d: invalid range gmadr 0x%llx size 0x%x\n",
-                                vgpu->id, addr, size);
+                gvt_vgpu_err("invalid range gmadr 0x%llx size 0x%x\n",
+                                addr, size);
                 return false;
         }
         return true;
@@ -430,7 +430,7 @@ static int gtt_entry_p2m(struct intel_vgpu *vgpu, struct intel_gvt_gtt_entry *p,
 
         mfn = intel_gvt_hypervisor_gfn_to_mfn(vgpu, gfn);
         if (mfn == INTEL_GVT_INVALID_ADDR) {
-                gvt_err("fail to translate gfn: 0x%lx\n", gfn);
+                gvt_vgpu_err("fail to translate gfn: 0x%lx\n", gfn);
                 return -ENXIO;
         }
 
@@ -611,7 +611,7 @@ static inline int init_shadow_page(struct intel_vgpu *vgpu,
 
         daddr = dma_map_page(kdev, p->page, 0, 4096, PCI_DMA_BIDIRECTIONAL);
         if (dma_mapping_error(kdev, daddr)) {
-                gvt_err("fail to map dma addr\n");
+                gvt_vgpu_err("fail to map dma addr\n");
                 return -EINVAL;
         }
 
@@ -735,7 +735,7 @@ retry:
                 if (reclaim_one_mm(vgpu->gvt))
                         goto retry;
 
-                gvt_err("fail to allocate ppgtt shadow page\n");
+                gvt_vgpu_err("fail to allocate ppgtt shadow page\n");
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -750,14 +750,14 @@ retry:
          */
         ret = init_shadow_page(vgpu, &spt->shadow_page, type);
         if (ret) {
-                gvt_err("fail to initialize shadow page for spt\n");
+                gvt_vgpu_err("fail to initialize shadow page for spt\n");
                 goto err;
         }
 
         ret = intel_vgpu_init_guest_page(vgpu, &spt->guest_page,
                         gfn, ppgtt_write_protection_handler, NULL);
         if (ret) {
-                gvt_err("fail to initialize guest page for spt\n");
+                gvt_vgpu_err("fail to initialize guest page for spt\n");
                 goto err;
         }
 
@@ -776,8 +776,7 @@ static struct intel_vgpu_ppgtt_spt *ppgtt_find_shadow_page(
         if (p)
                 return shadow_page_to_ppgtt_spt(p);
 
-        gvt_err("vgpu%d: fail to find ppgtt shadow page: 0x%lx\n",
-                        vgpu->id, mfn);
+        gvt_vgpu_err("fail to find ppgtt shadow page: 0x%lx\n", mfn);
         return NULL;
 }
 
@@ -827,8 +826,8 @@ static int ppgtt_invalidate_shadow_page_by_shadow_entry(struct intel_vgpu *vgpu,
         }
         s = ppgtt_find_shadow_page(vgpu, ops->get_pfn(e));
         if (!s) {
-                gvt_err("vgpu%d: fail to find shadow page: mfn: 0x%lx\n",
-                                vgpu->id, ops->get_pfn(e));
+                gvt_vgpu_err("fail to find shadow page: mfn: 0x%lx\n",
+                                ops->get_pfn(e));
                 return -ENXIO;
         }
         return ppgtt_invalidate_shadow_page(s);
@@ -836,6 +835,7 @@ static int ppgtt_invalidate_shadow_page_by_shadow_entry(struct intel_vgpu *vgpu,
 
 static int ppgtt_invalidate_shadow_page(struct intel_vgpu_ppgtt_spt *spt)
 {
+        struct intel_vgpu *vgpu = spt->vgpu;
         struct intel_gvt_gtt_entry e;
         unsigned long index;
         int ret;
@@ -854,7 +854,7 @@ static int ppgtt_invalidate_shadow_page(struct intel_vgpu_ppgtt_spt *spt)
 
         for_each_present_shadow_entry(spt, &e, index) {
                 if (!gtt_type_is_pt(get_next_pt_type(e.type))) {
-                        gvt_err("GVT doesn't support pse bit for now\n");
+                        gvt_vgpu_err("GVT doesn't support pse bit for now\n");
                         return -EINVAL;
                 }
                 ret = ppgtt_invalidate_shadow_page_by_shadow_entry(
@@ -868,8 +868,8 @@ release:
         ppgtt_free_shadow_page(spt);
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p shadow entry 0x%llx type %d\n",
-                        spt->vgpu->id, spt, e.val64, e.type);
+        gvt_vgpu_err("fail: shadow page %p shadow entry 0x%llx type %d\n",
+                        spt, e.val64, e.type);
         return ret;
 }
 
@@ -914,8 +914,8 @@ static struct intel_vgpu_ppgtt_spt *ppgtt_populate_shadow_page_by_guest_entry(
         }
         return s;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p guest entry 0x%llx type %d\n",
-                        vgpu->id, s, we->val64, we->type);
+        gvt_vgpu_err("fail: shadow page %p guest entry 0x%llx type %d\n",
+                        s, we->val64, we->type);
         return ERR_PTR(ret);
 }
 
@@ -953,7 +953,7 @@ static int ppgtt_populate_shadow_page(struct intel_vgpu_ppgtt_spt *spt)
 
         for_each_present_guest_entry(spt, &ge, i) {
                 if (!gtt_type_is_pt(get_next_pt_type(ge.type))) {
-                        gvt_err("GVT doesn't support pse bit now\n");
+                        gvt_vgpu_err("GVT doesn't support pse bit now\n");
                         ret = -EINVAL;
                         goto fail;
                 }
@@ -969,8 +969,8 @@ static int ppgtt_populate_shadow_page(struct intel_vgpu_ppgtt_spt *spt)
         }
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p guest entry 0x%llx type %d\n",
-                        vgpu->id, spt, ge.val64, ge.type);
+        gvt_vgpu_err("fail: shadow page %p guest entry 0x%llx type %d\n",
+                        spt, ge.val64, ge.type);
         return ret;
 }
 
@@ -999,7 +999,7 @@ static int ppgtt_handle_guest_entry_removal(struct intel_vgpu_guest_page *gpt,
                 struct intel_vgpu_ppgtt_spt *s =
                         ppgtt_find_shadow_page(vgpu, ops->get_pfn(&e));
                 if (!s) {
-                        gvt_err("fail to find guest page\n");
+                        gvt_vgpu_err("fail to find guest page\n");
                         ret = -ENXIO;
                         goto fail;
                 }
@@ -1011,8 +1011,8 @@ static int ppgtt_handle_guest_entry_removal(struct intel_vgpu_guest_page *gpt,
         ppgtt_set_shadow_entry(spt, &e, index);
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p guest entry 0x%llx type %d\n",
-                        vgpu->id, spt, e.val64, e.type);
+        gvt_vgpu_err("fail: shadow page %p guest entry 0x%llx type %d\n",
+                        spt, e.val64, e.type);
         return ret;
 }
 
@@ -1046,8 +1046,8 @@ static int ppgtt_handle_guest_entry_add(struct intel_vgpu_guest_page *gpt,
         }
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: spt %p guest entry 0x%llx type %d\n", vgpu->id,
-                        spt, we->val64, we->type);
+        gvt_vgpu_err("fail: spt %p guest entry 0x%llx type %d\n",
+                spt, we->val64, we->type);
         return ret;
 }
 
@@ -1250,8 +1250,8 @@ static int ppgtt_handle_guest_write_page_table(
         }
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p guest entry 0x%llx type %d.\n",
-                        vgpu->id, spt, we->val64, we->type);
+        gvt_vgpu_err("fail: shadow page %p guest entry 0x%llx type %d.\n",
+                        spt, we->val64, we->type);
         return ret;
 }
 
@@ -1493,7 +1493,7 @@ static int shadow_mm(struct intel_vgpu_mm *mm)
 
                 spt = ppgtt_populate_shadow_page_by_guest_entry(vgpu, &ge);
                 if (IS_ERR(spt)) {
-                        gvt_err("fail to populate guest root pointer\n");
+                        gvt_vgpu_err("fail to populate guest root pointer\n");
                         ret = PTR_ERR(spt);
                         goto fail;
                 }
@@ -1566,7 +1566,7 @@ struct intel_vgpu_mm *intel_vgpu_create_mm(struct intel_vgpu *vgpu,
 
         ret = gtt->mm_alloc_page_table(mm);
         if (ret) {
-                gvt_err("fail to allocate page table for mm\n");
+                gvt_vgpu_err("fail to allocate page table for mm\n");
                 goto fail;
         }
 
@@ -1584,7 +1584,7 @@ struct intel_vgpu_mm *intel_vgpu_create_mm(struct intel_vgpu *vgpu,
         }
         return mm;
 fail:
-        gvt_err("fail to create mm\n");
+        gvt_vgpu_err("fail to create mm\n");
         if (mm)
                 intel_gvt_mm_unreference(mm);
         return ERR_PTR(ret);
@@ -1760,7 +1760,7 @@ unsigned long intel_vgpu_gma_to_gpa(struct intel_vgpu_mm *mm, unsigned long gma)
                         mm->page_table_level, gma, gpa);
         return gpa;
 err:
-        gvt_err("invalid mm type: %d gma %lx\n", mm->type, gma);
+        gvt_vgpu_err("invalid mm type: %d gma %lx\n", mm->type, gma);
         return INTEL_GVT_INVALID_ADDR;
 }
 
@@ -1825,11 +1825,8 @@ static int emulate_gtt_mmio_write(struct intel_vgpu *vgpu, unsigned int off,
         gma = g_gtt_index << GTT_PAGE_SHIFT;
 
         /* the VM may configure the whole GM space when ballooning is used */
-        if (WARN_ONCE(!vgpu_gmadr_is_valid(vgpu, gma),
-                                "vgpu%d: found oob ggtt write, offset %x\n",
-                                vgpu->id, off)) {
+        if (!vgpu_gmadr_is_valid(vgpu, gma))
                 return 0;
-        }
 
         ggtt_get_guest_entry(ggtt_mm, &e, g_gtt_index);
 
@@ -1839,13 +1836,16 @@ static int emulate_gtt_mmio_write(struct intel_vgpu *vgpu, unsigned int off,
         if (ops->test_present(&e)) {
                 ret = gtt_entry_p2m(vgpu, &e, &m);
                 if (ret) {
-                        gvt_err("vgpu%d: fail to translate guest gtt entry\n",
-                                        vgpu->id);
-                        return ret;
+                        gvt_vgpu_err("fail to translate guest gtt entry\n");
+                        /* guest driver may read/write the entry when partial
+                         * update the entry in this situation p2m will fail
+                         * settting the shadow entry to point to a scratch page
+                         */
+                        ops->set_pfn(&m, gvt->gtt.scratch_ggtt_mfn);
                 }
         } else {
                 m = e;
-                m.val64 = 0;
+                ops->set_pfn(&m, gvt->gtt.scratch_ggtt_mfn);
         }
 
         ggtt_set_shadow_entry(ggtt_mm, &m, g_gtt_index);
@@ -1896,14 +1896,14 @@ static int alloc_scratch_pages(struct intel_vgpu *vgpu,
 
         scratch_pt = (void *)get_zeroed_page(GFP_KERNEL);
         if (!scratch_pt) {
-                gvt_err("fail to allocate scratch page\n");
+                gvt_vgpu_err("fail to allocate scratch page\n");
                 return -ENOMEM;
         }
 
         daddr = dma_map_page(dev, virt_to_page(scratch_pt), 0,
                         4096, PCI_DMA_BIDIRECTIONAL);
         if (dma_mapping_error(dev, daddr)) {
-                gvt_err("fail to dmamap scratch_pt\n");
+                gvt_vgpu_err("fail to dmamap scratch_pt\n");
                 __free_page(virt_to_page(scratch_pt));
                 return -ENOMEM;
         }
@@ -2006,7 +2006,7 @@ int intel_vgpu_init_gtt(struct intel_vgpu *vgpu)
         ggtt_mm = intel_vgpu_create_mm(vgpu, INTEL_GVT_MM_GGTT,
                         NULL, 1, 0);
         if (IS_ERR(ggtt_mm)) {
-                gvt_err("fail to create mm for ggtt.\n");
+                gvt_vgpu_err("fail to create mm for ggtt.\n");
                 return PTR_ERR(ggtt_mm);
         }
 
@@ -2015,6 +2015,22 @@ int intel_vgpu_init_gtt(struct intel_vgpu *vgpu)
         return create_scratch_page_tree(vgpu);
 }
 
+static void intel_vgpu_free_mm(struct intel_vgpu *vgpu, int type)
+{
+        struct list_head *pos, *n;
+        struct intel_vgpu_mm *mm;
+
+        list_for_each_safe(pos, n, &vgpu->gtt.mm_list_head) {
+                mm = container_of(pos, struct intel_vgpu_mm, list);
+                if (mm->type == type) {
+                        vgpu->gvt->gtt.mm_free_page_table(mm);
+                        list_del(&mm->list);
+                        list_del(&mm->lru_list);
+                        kfree(mm);
+                }
+        }
+}
+
 /**
  * intel_vgpu_clean_gtt - clean up per-vGPU graphics memory virulization
  * @vgpu: a vGPU
@@ -2027,19 +2043,11 @@ int intel_vgpu_init_gtt(struct intel_vgpu *vgpu)
  */
 void intel_vgpu_clean_gtt(struct intel_vgpu *vgpu)
 {
-        struct list_head *pos, *n;
-        struct intel_vgpu_mm *mm;
-
         ppgtt_free_all_shadow_page(vgpu);
         release_scratch_page_tree(vgpu);
 
-        list_for_each_safe(pos, n, &vgpu->gtt.mm_list_head) {
-                mm = container_of(pos, struct intel_vgpu_mm, list);
-                vgpu->gvt->gtt.mm_free_page_table(mm);
-                list_del(&mm->list);
-                list_del(&mm->lru_list);
-                kfree(mm);
-        }
+        intel_vgpu_free_mm(vgpu, INTEL_GVT_MM_PPGTT);
+        intel_vgpu_free_mm(vgpu, INTEL_GVT_MM_GGTT);
 }
 
 static void clean_spt_oos(struct intel_gvt *gvt)
@@ -2071,7 +2079,6 @@ static int setup_spt_oos(struct intel_gvt *gvt)
         for (i = 0; i < preallocated_oos_pages; i++) {
                 oos_page = kzalloc(sizeof(*oos_page), GFP_KERNEL);
                 if (!oos_page) {
-                        gvt_err("fail to pre-allocate oos page\n");
                         ret = -ENOMEM;
                         goto fail;
                 }
@@ -2161,7 +2168,7 @@ int intel_vgpu_g2v_create_ppgtt_mm(struct intel_vgpu *vgpu,
                 mm = intel_vgpu_create_mm(vgpu, INTEL_GVT_MM_PPGTT,
                                 pdp, page_table_level, 0);
                 if (IS_ERR(mm)) {
-                        gvt_err("fail to create mm\n");
+                        gvt_vgpu_err("fail to create mm\n");
                         return PTR_ERR(mm);
                 }
         }
@@ -2191,7 +2198,7 @@ int intel_vgpu_g2v_destroy_ppgtt_mm(struct intel_vgpu *vgpu,
 
         mm = intel_vgpu_find_ppgtt_mm(vgpu, page_table_level, pdp);
         if (!mm) {
-                gvt_err("fail to find ppgtt instance.\n");
+                gvt_vgpu_err("fail to find ppgtt instance.\n");
                 return -EINVAL;
         }
         intel_gvt_mm_unreference(mm);
@@ -2322,6 +2329,13 @@ void intel_vgpu_reset_gtt(struct intel_vgpu *vgpu, bool dmlr)
         int i;
 
         ppgtt_free_all_shadow_page(vgpu);
+
+        /* Shadow pages are only created when there is no page
+         * table tracking data, so remove page tracking data after
+         * removing the shadow pages.
+         */
+        intel_vgpu_free_mm(vgpu, INTEL_GVT_MM_PPGTT);
+
         if (!dmlr)
                 return;
 
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index e227caf5859e..6dfc48b63b71 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -143,6 +143,8 @@ struct intel_vgpu {
         int id;
         unsigned long handle; /* vGPU handle used by hypervisor MPT modules */
         bool active;
+        bool pv_notified;
+        bool failsafe;
         bool resetting;
         void *sched_data;
 
@@ -160,7 +162,6 @@ struct intel_vgpu {
         atomic_t running_workload_num;
         DECLARE_BITMAP(tlb_handle_pending, I915_NUM_ENGINES);
         struct i915_gem_context *shadow_ctx;
-        struct notifier_block shadow_ctx_notifier_block;
 
 #if IS_ENABLED(CONFIG_DRM_I915_GVT_KVMGT)
         struct {
@@ -203,18 +204,18 @@ struct intel_gvt_firmware {
 };
 
 struct intel_gvt_opregion {
-        void __iomem *opregion_va;
+        void *opregion_va;
         u32 opregion_pa;
 };
 
 #define NR_MAX_INTEL_VGPU_TYPES 20
 struct intel_vgpu_type {
         char name[16];
-        unsigned int max_instance;
         unsigned int avail_instance;
         unsigned int low_gm_size;
         unsigned int high_gm_size;
         unsigned int fence;
+        enum intel_vgpu_edid resolution;
 };
 
 struct intel_gvt {
@@ -231,6 +232,7 @@ struct intel_gvt {
         struct intel_gvt_gtt gtt;
         struct intel_gvt_opregion opregion;
         struct intel_gvt_workload_scheduler scheduler;
+        struct notifier_block shadow_ctx_notifier_block[I915_NUM_ENGINES];
         DECLARE_HASHTABLE(cmd_table, GVT_CMD_HASH_BITS);
         struct intel_vgpu_type *types;
         unsigned int num_types;
@@ -317,6 +319,7 @@ struct intel_vgpu_creation_params {
         __u64 low_gm_sz;  /* in MB */
         __u64 high_gm_sz; /* in MB */
         __u64 fence_sz;
+        __u64 resolution;
         __s32 primary;
         __u64 vgpu_id;
 };
@@ -449,6 +452,11 @@ struct intel_gvt_ops {
 };
 
 
+enum {
+        GVT_FAILSAFE_UNSUPPORTED_GUEST,
+        GVT_FAILSAFE_INSUFFICIENT_RESOURCE,
+};
+
 #include "mpt.h"
 
 #endif
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 1d450627ff65..6da9ae1618e3 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -121,6 +121,7 @@ static int new_mmio_info(struct intel_gvt *gvt,
                 info->size = size;
                 info->length = (i + 4) < end ? 4 : (end - i);
                 info->addr_mask = addr_mask;
+                info->ro_mask = ro_mask;
                 info->device = device;
                 info->read = read ? read : intel_vgpu_default_mmio_read;
                 info->write = write ? write : intel_vgpu_default_mmio_write;
@@ -150,15 +151,42 @@ static int render_mmio_to_ring_id(struct intel_gvt *gvt, unsigned int reg)
 #define fence_num_to_offset(num) \
         (num * 8 + i915_mmio_reg_offset(FENCE_REG_GEN6_LO(0)))
 
+
+static void enter_failsafe_mode(struct intel_vgpu *vgpu, int reason)
+{
+        switch (reason) {
+        case GVT_FAILSAFE_UNSUPPORTED_GUEST:
+                pr_err("Detected your guest driver doesn't support GVT-g.\n");
+                break;
+        case GVT_FAILSAFE_INSUFFICIENT_RESOURCE:
+                pr_err("Graphics resource is not enough for the guest\n");
+        default:
+                break;
+        }
+        pr_err("Now vgpu %d will enter failsafe mode.\n", vgpu->id);
+        vgpu->failsafe = true;
+}
+
 static int sanitize_fence_mmio_access(struct intel_vgpu *vgpu,
                 unsigned int fence_num, void *p_data, unsigned int bytes)
 {
         if (fence_num >= vgpu_fence_sz(vgpu)) {
-                gvt_err("vgpu%d: found oob fence register access\n",
-                                vgpu->id);
-                gvt_err("vgpu%d: total fence num %d access fence num %d\n",
-                                vgpu->id, vgpu_fence_sz(vgpu), fence_num);
+
+                /* When guest access oob fence regs without access
+                 * pv_info first, we treat guest not supporting GVT,
+                 * and we will let vgpu enter failsafe mode.
+                 */
+                if (!vgpu->pv_notified)
+                        enter_failsafe_mode(vgpu,
+                                        GVT_FAILSAFE_UNSUPPORTED_GUEST);
+
+                if (!vgpu->mmio.disable_warn_untrack) {
+                        gvt_vgpu_err("found oob fence register access\n");
+                        gvt_vgpu_err("total fence %d, access fence %d\n",
+                                        vgpu_fence_sz(vgpu), fence_num);
+                }
                 memset(p_data, 0, bytes);
+                return -EINVAL;
         }
         return 0;
 }
@@ -219,7 +247,7 @@ static int mul_force_wake_write(struct intel_vgpu *vgpu,
                         break;
                 default:
                         /*should not hit here*/
-                        gvt_err("invalid forcewake offset 0x%x\n", offset);
+                        gvt_vgpu_err("invalid forcewake offset 0x%x\n", offset);
                         return -EINVAL;
                 }
         } else {
@@ -369,6 +397,74 @@ static int pipeconf_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         return 0;
 }
 
+/* ascendingly sorted */
+static i915_reg_t force_nonpriv_white_list[] = {
+        GEN9_CS_DEBUG_MODE1, //_MMIO(0x20ec)
+        GEN9_CTX_PREEMPT_REG,//_MMIO(0x2248)
+        GEN8_CS_CHICKEN1,//_MMIO(0x2580)
+        _MMIO(0x2690),
+        _MMIO(0x2694),
+        _MMIO(0x2698),
+        _MMIO(0x4de0),
+        _MMIO(0x4de4),
+        _MMIO(0x4dfc),
+        GEN7_COMMON_SLICE_CHICKEN1,//_MMIO(0x7010)
+        _MMIO(0x7014),
+        HDC_CHICKEN0,//_MMIO(0x7300)
+        GEN8_HDC_CHICKEN1,//_MMIO(0x7304)
+        _MMIO(0x7700),
+        _MMIO(0x7704),
+        _MMIO(0x7708),
+        _MMIO(0x770c),
+        _MMIO(0xb110),
+        GEN8_L3SQCREG4,//_MMIO(0xb118)
+        _MMIO(0xe100),
+        _MMIO(0xe18c),
+        _MMIO(0xe48c),
+        _MMIO(0xe5f4),
+};
+
+/* a simple bsearch */
+static inline bool in_whitelist(unsigned int reg)
+{
+        int left = 0, right = ARRAY_SIZE(force_nonpriv_white_list);
+        i915_reg_t *array = force_nonpriv_white_list;
+
+        while (left < right) {
+                int mid = (left + right)/2;
+
+                if (reg > array[mid].reg)
+                        left = mid + 1;
+                else if (reg < array[mid].reg)
+                        right = mid;
+                else
+                        return true;
+        }
+        return false;
+}
+
+static int force_nonpriv_write(struct intel_vgpu *vgpu,
+        unsigned int offset, void *p_data, unsigned int bytes)
+{
+        u32 reg_nonpriv = *(u32 *)p_data;
+        int ret = -EINVAL;
+
+        if ((bytes != 4) || ((offset & (bytes - 1)) != 0)) {
+                gvt_err("vgpu(%d) Invalid FORCE_NONPRIV offset %x(%dB)\n",
+                        vgpu->id, offset, bytes);
+                return ret;
+        }
+
+        if (in_whitelist(reg_nonpriv)) {
+                ret = intel_vgpu_default_mmio_write(vgpu, offset, p_data,
+                        bytes);
+        } else {
+                gvt_err("vgpu(%d) Invalid FORCE_NONPRIV write %x\n",
+                        vgpu->id, reg_nonpriv);
+        }
+        return ret;
+}
+
 static int ddi_buf_ctl_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes)
 {
@@ -432,7 +528,7 @@ static int check_fdi_rx_train_status(struct intel_vgpu *vgpu,
                 fdi_tx_train_bits = FDI_LINK_TRAIN_PATTERN_2;
                 fdi_iir_check_bits = FDI_RX_SYMBOL_LOCK;
         } else {
-                gvt_err("Invalid train pattern %d\n", train_pattern);
+                gvt_vgpu_err("Invalid train pattern %d\n", train_pattern);
                 return -EINVAL;
         }
 
@@ -490,7 +586,7 @@ static int update_fdi_rx_iir_status(struct intel_vgpu *vgpu,
         else if (FDI_RX_IMR_TO_PIPE(offset) != INVALID_INDEX)
                 index = FDI_RX_IMR_TO_PIPE(offset);
         else {
-                gvt_err("Unsupport registers %x\n", offset);
+                gvt_vgpu_err("Unsupport registers %x\n", offset);
                 return -EINVAL;
         }
 
@@ -720,7 +816,7 @@ static int dp_aux_ch_ctl_mmio_write(struct intel_vgpu *vgpu,
         u32 data;
 
         if (!dpy_is_valid_port(port_index)) {
-                gvt_err("GVT(%d): Unsupported DP port access!\n", vgpu->id);
+                gvt_vgpu_err("Unsupported DP port access!\n");
                 return 0;
         }
 
@@ -874,6 +970,14 @@ static int dp_aux_ch_ctl_mmio_write(struct intel_vgpu *vgpu,
         return 0;
 }
 
+static int mbctl_write(struct intel_vgpu *vgpu, unsigned int offset,
+                void *p_data, unsigned int bytes)
+{
+        *(u32 *)p_data &= (~GEN6_MBCTL_ENABLE_BOOT_FETCH);
+        write_vreg(vgpu, offset, p_data, bytes);
+        return 0;
+}
+
 static int vga_control_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes)
 {
@@ -918,8 +1022,7 @@ static void write_virtual_sbi_register(struct intel_vgpu *vgpu,
 
         if (i == num) {
                 if (num == SBI_REG_MAX) {
-                        gvt_err("vgpu%d: SBI caching meets maximum limits\n",
-                                        vgpu->id);
+                        gvt_vgpu_err("SBI caching meets maximum limits\n");
                         return;
                 }
                 display->sbi.number++;
@@ -999,8 +1102,9 @@ static int pvinfo_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
                 break;
         }
         if (invalid_read)
-                gvt_err("invalid pvinfo read: [%x:%x] = %x\n",
+                gvt_vgpu_err("invalid pvinfo read: [%x:%x] = %x\n",
                                 offset, bytes, *(u32 *)p_data);
+        vgpu->pv_notified = true;
         return 0;
 }
 
@@ -1026,7 +1130,7 @@ static int handle_g2v_notification(struct intel_vgpu *vgpu, int notification)
         case 1: /* Remove this in guest driver. */
                 break;
         default:
-                gvt_err("Invalid PV notification %d\n", notification);
+                gvt_vgpu_err("Invalid PV notification %d\n", notification);
         }
         return ret;
 }
@@ -1039,7 +1143,7 @@ static int send_display_ready_uevent(struct intel_vgpu *vgpu, int ready)
         char vmid_str[20];
         char display_ready_str[20];
 
-        snprintf(display_ready_str, 20, "GVT_DISPLAY_READY=%d\n", ready);
+        snprintf(display_ready_str, 20, "GVT_DISPLAY_READY=%d", ready);
         env[0] = display_ready_str;
 
         snprintf(vmid_str, 20, "VMID=%d", vgpu->id);
@@ -1078,8 +1182,11 @@ static int pvinfo_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         case _vgtif_reg(execlist_context_descriptor_lo):
         case _vgtif_reg(execlist_context_descriptor_hi):
                 break;
+        case _vgtif_reg(rsv5[0])..._vgtif_reg(rsv5[3]):
+                enter_failsafe_mode(vgpu, GVT_FAILSAFE_INSUFFICIENT_RESOURCE);
+                break;
         default:
-                gvt_err("invalid pvinfo write offset %x bytes %x data %x\n",
+                gvt_vgpu_err("invalid pvinfo write offset %x bytes %x data %x\n",
                                 offset, bytes, data);
                 break;
         }
@@ -1203,26 +1310,37 @@ static int mailbox_write(struct intel_vgpu *vgpu, unsigned int offset,
         u32 *data0 = &vgpu_vreg(vgpu, GEN6_PCODE_DATA);
 
         switch (cmd) {
-        case 0x6:
-                /**
-                 * "Read memory latency" command on gen9.
-                 * Below memory latency values are read
-                 * from skylake platform.
-                 */
-                if (!*data0)
-                        *data0 = 0x1e1a1100;
-                else
-                        *data0 = 0x61514b3d;
+        case GEN9_PCODE_READ_MEM_LATENCY:
+                if (IS_SKYLAKE(vgpu->gvt->dev_priv)) {
+                        /**
+                         * "Read memory latency" command on gen9.
+                         * Below memory latency values are read
+                         * from skylake platform.
+                         */
+                        if (!*data0)
+                                *data0 = 0x1e1a1100;
+                        else
+                                *data0 = 0x61514b3d;
+                }
                 break;
-        case 0x5:
+        case SKL_PCODE_CDCLK_CONTROL:
+                if (IS_SKYLAKE(vgpu->gvt->dev_priv))
+                        *data0 = SKL_CDCLK_READY_FOR_CHANGE;
+                break;
+        case GEN6_PCODE_READ_RC6VIDS:
                 *data0 |= 0x1;
                 break;
         }
 
         gvt_dbg_core("VM(%d) write %x to mailbox, return data0 %x\n",
                      vgpu->id, value, *data0);
-
-        value &= ~(1 << 31);
+        /**
+         * PCODE_READY clear means ready for pcode read/write,
+         * PCODE_ERROR_MASK clear means no error happened. In GVT-g we
+         * always emulate as pcode read/write success and ready for access
+         * anytime, since we don't touch real physical registers here.
+         */
+        value &= ~(GEN6_PCODE_READY | GEN6_PCODE_ERROR_MASK);
         return intel_vgpu_default_mmio_write(vgpu, offset, &value, bytes);
 }
 
@@ -1302,7 +1420,8 @@ static int elsp_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         if (execlist->elsp_dwords.index == 3) {
                 ret = intel_vgpu_submit_execlist(vgpu, ring_id);
                 if(ret)
-                        gvt_err("fail submit workload on ring %d\n", ring_id);
+                        gvt_vgpu_err("fail submit workload on ring %d\n",
+                                ring_id);
         }
 
         ++execlist->elsp_dwords.index;
@@ -1318,6 +1437,17 @@ static int ring_mode_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         bool enable_execlist;
 
         write_vreg(vgpu, offset, p_data, bytes);
+
+        /* when PPGTT mode enabled, we will check if guest has called
+         * pvinfo, if not, we will treat this guest as non-gvtg-aware
+         * guest, and stop emulating its cfg space, mmio, gtt, etc.
+         */
+        if (((data & _MASKED_BIT_ENABLE(GFX_PPGTT_ENABLE)) ||
+                        (data & _MASKED_BIT_ENABLE(GFX_RUN_LIST_ENABLE)))
+                        && !vgpu->pv_notified) {
+                enter_failsafe_mode(vgpu, GVT_FAILSAFE_UNSUPPORTED_GUEST);
+                return 0;
+        }
         if ((data & _MASKED_BIT_ENABLE(GFX_RUN_LIST_ENABLE))
                         || (data & _MASKED_BIT_DISABLE(GFX_RUN_LIST_ENABLE))) {
                 enable_execlist = !!(data & GFX_RUN_LIST_ENABLE);
@@ -1400,6 +1530,9 @@ static int ring_reset_ctl_write(struct intel_vgpu *vgpu,
 #define MMIO_GM(reg, d, r, w) \
         MMIO_F(reg, 4, F_GMADR, 0xFFFFF000, 0, d, r, w)
 
+#define MMIO_GM_RDR(reg, d, r, w) \
+        MMIO_F(reg, 4, F_GMADR | F_CMD_ACCESS, 0xFFFFF000, 0, d, r, w)
+
 #define MMIO_RO(reg, d, f, rm, r, w) \
         MMIO_F(reg, 4, F_RO | f, 0, rm, d, r, w)
 
@@ -1419,6 +1552,9 @@ static int ring_reset_ctl_write(struct intel_vgpu *vgpu,
 #define MMIO_RING_GM(prefix, d, r, w) \
         MMIO_RING_F(prefix, 4, F_GMADR, 0xFFFF0000, 0, d, r, w)
 
+#define MMIO_RING_GM_RDR(prefix, d, r, w) \
+        MMIO_RING_F(prefix, 4, F_GMADR | F_CMD_ACCESS, 0xFFFF0000, 0, d, r, w)
+
 #define MMIO_RING_RO(prefix, d, f, rm, r, w) \
         MMIO_RING_F(prefix, 4, F_RO | f, 0, rm, d, r, w)
 
@@ -1427,73 +1563,81 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         struct drm_i915_private *dev_priv = gvt->dev_priv;
         int ret;
 
-        MMIO_RING_DFH(RING_IMR, D_ALL, 0, NULL, intel_vgpu_reg_imr_handler);
+        MMIO_RING_DFH(RING_IMR, D_ALL, F_CMD_ACCESS, NULL,
+                intel_vgpu_reg_imr_handler);
 
         MMIO_DFH(SDEIMR, D_ALL, 0, NULL, intel_vgpu_reg_imr_handler);
         MMIO_DFH(SDEIER, D_ALL, 0, NULL, intel_vgpu_reg_ier_handler);
         MMIO_DFH(SDEIIR, D_ALL, 0, NULL, intel_vgpu_reg_iir_handler);
         MMIO_D(SDEISR, D_ALL);
 
-        MMIO_RING_D(RING_HWSTAM, D_ALL);
+        MMIO_RING_DFH(RING_HWSTAM, D_ALL, F_CMD_ACCESS, NULL, NULL);
 
-        MMIO_GM(RENDER_HWS_PGA_GEN7, D_ALL, NULL, NULL);
-        MMIO_GM(BSD_HWS_PGA_GEN7, D_ALL, NULL, NULL);
-        MMIO_GM(BLT_HWS_PGA_GEN7, D_ALL, NULL, NULL);
-        MMIO_GM(VEBOX_HWS_PGA_GEN7, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(RENDER_HWS_PGA_GEN7, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(BSD_HWS_PGA_GEN7, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(BLT_HWS_PGA_GEN7, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(VEBOX_HWS_PGA_GEN7, D_ALL, NULL, NULL);
 
 #define RING_REG(base) (base + 0x28)
-        MMIO_RING_D(RING_REG, D_ALL);
+        MMIO_RING_DFH(RING_REG, D_ALL, F_CMD_ACCESS, NULL, NULL);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x134)
-        MMIO_RING_D(RING_REG, D_ALL);
+        MMIO_RING_DFH(RING_REG, D_ALL, F_CMD_ACCESS, NULL, NULL);
 #undef RING_REG
 
-        MMIO_GM(0x2148, D_ALL, NULL, NULL);
-        MMIO_GM(CCID, D_ALL, NULL, NULL);
-        MMIO_GM(0x12198, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(0x2148, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(CCID, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(0x12198, D_ALL, NULL, NULL);
         MMIO_D(GEN7_CXT_SIZE, D_ALL);
 
-        MMIO_RING_D(RING_TAIL, D_ALL);
-        MMIO_RING_D(RING_HEAD, D_ALL);
-        MMIO_RING_D(RING_CTL, D_ALL);
-        MMIO_RING_D(RING_ACTHD, D_ALL);
-        MMIO_RING_GM(RING_START, D_ALL, NULL, NULL);
+        MMIO_RING_DFH(RING_TAIL, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_HEAD, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_CTL, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_ACTHD, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_GM_RDR(RING_START, D_ALL, NULL, NULL);
 
         /* RING MODE */
 #define RING_REG(base) (base + 0x29c)
-        MMIO_RING_DFH(RING_REG, D_ALL, F_MODE_MASK, NULL, ring_mode_mmio_write);
+        MMIO_RING_DFH(RING_REG, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL,
+                ring_mode_mmio_write);
 #undef RING_REG
 
-        MMIO_RING_DFH(RING_MI_MODE, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_RING_DFH(RING_INSTPM, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_RING_DFH(RING_MI_MODE, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_RING_DFH(RING_INSTPM, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
+                        NULL, NULL);
         MMIO_RING_DFH(RING_TIMESTAMP, D_ALL, F_CMD_ACCESS,
                         ring_timestamp_mmio_read, NULL);
         MMIO_RING_DFH(RING_TIMESTAMP_UDW, D_ALL, F_CMD_ACCESS,
                         ring_timestamp_mmio_read, NULL);
 
-        MMIO_DFH(GEN7_GT_MODE, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(CACHE_MODE_0_GEN7, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(GEN7_GT_MODE, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(CACHE_MODE_0_GEN7, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
         MMIO_DFH(CACHE_MODE_1, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-
-        MMIO_DFH(0x20dc, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(_3D_CHICKEN3, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(0x2088, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(0x20e4, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(0x2470, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_D(GAM_ECOCHK, D_ALL);
-        MMIO_DFH(GEN7_COMMON_SLICE_CHICKEN1, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(CACHE_MODE_0, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2124, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_DFH(0x20dc, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(_3D_CHICKEN3, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2088, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x20e4, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2470, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(GAM_ECOCHK, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(GEN7_COMMON_SLICE_CHICKEN1, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
         MMIO_DFH(COMMON_SLICE_CHICKEN2, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-        MMIO_D(0x9030, D_ALL);
-        MMIO_D(0x20a0, D_ALL);
-        MMIO_D(0x2420, D_ALL);
-        MMIO_D(0x2430, D_ALL);
-        MMIO_D(0x2434, D_ALL);
-        MMIO_D(0x2438, D_ALL);
-        MMIO_D(0x243c, D_ALL);
-        MMIO_DFH(0x7018, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(0x9030, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x20a0, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2420, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2430, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2434, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2438, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x243c, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x7018, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(HALF_SLICE_CHICKEN3, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0xe100, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(GEN7_HALF_SLICE_CHICKEN1, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
 
         /* display */
         MMIO_F(0x60220, 0x20, 0, 0, 0, D_ALL, NULL, NULL);
@@ -2022,8 +2166,8 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_D(FORCEWAKE_ACK, D_ALL);
         MMIO_D(GEN6_GT_CORE_STATUS, D_ALL);
         MMIO_D(GEN6_GT_THREAD_STATUS_REG, D_ALL);
-        MMIO_D(GTFIFODBG, D_ALL);
-        MMIO_D(GTFIFOCTL, D_ALL);
+        MMIO_DFH(GTFIFODBG, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(GTFIFOCTL, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DH(FORCEWAKE_MT, D_PRE_SKL, NULL, mul_force_wake_write);
         MMIO_DH(FORCEWAKE_ACK_HSW, D_HSW | D_BDW, NULL, NULL);
         MMIO_D(ECOBUS, D_ALL);
@@ -2080,7 +2224,7 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
 
         MMIO_F(0x4f000, 0x90, 0, 0, 0, D_ALL, NULL, NULL);
 
-        MMIO_D(GEN6_PCODE_MAILBOX, D_PRE_SKL);
+        MMIO_D(GEN6_PCODE_MAILBOX, D_PRE_BDW);
         MMIO_D(GEN6_PCODE_DATA, D_ALL);
         MMIO_D(0x13812c, D_ALL);
         MMIO_DH(GEN7_ERR_INT, D_ALL, NULL, NULL);
@@ -2102,7 +2246,7 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_D(0x7180, D_ALL);
         MMIO_D(0x7408, D_ALL);
         MMIO_D(0x7c00, D_ALL);
-        MMIO_D(GEN6_MBCTL, D_ALL);
+        MMIO_DH(GEN6_MBCTL, D_ALL, NULL, mbctl_write);
         MMIO_D(0x911c, D_ALL);
         MMIO_D(0x9120, D_ALL);
         MMIO_DFH(GEN7_UCGCTL4, D_ALL, F_CMD_ACCESS, NULL, NULL);
@@ -2159,36 +2303,35 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_D(0x1a054, D_ALL);
 
         MMIO_D(0x44070, D_ALL);
-
-        MMIO_D(0x215c, D_HSW_PLUS);
+        MMIO_DFH(0x215c, D_HSW_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x2178, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x217c, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x12178, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x1217c, D_ALL, F_CMD_ACCESS, NULL, NULL);
 
-        MMIO_F(0x2290, 8, 0, 0, 0, D_HSW_PLUS, NULL, NULL);
-        MMIO_D(GEN7_OACONTROL, D_HSW);
+        MMIO_F(0x2290, 8, F_CMD_ACCESS, 0, 0, D_HSW_PLUS, NULL, NULL);
+        MMIO_DFH(GEN7_OACONTROL, D_HSW, F_CMD_ACCESS, NULL, NULL);
         MMIO_D(0x2b00, D_BDW_PLUS);
         MMIO_D(0x2360, D_BDW_PLUS);
-        MMIO_F(0x5200, 32, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(0x5240, 32, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(0x5280, 16, 0, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(0x5200, 32, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(0x5240, 32, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(0x5280, 16, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
 
         MMIO_DFH(0x1c17c, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x1c178, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_D(BCS_SWCTRL, D_ALL);
-
-        MMIO_F(HS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(DS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(IA_VERTICES_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(IA_PRIMITIVES_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(VS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(GS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(GS_PRIMITIVES_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(CL_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(CL_PRIMITIVES_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(PS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(PS_DEPTH_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
+        MMIO_DFH(BCS_SWCTRL, D_ALL, F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_F(HS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(DS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(IA_VERTICES_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(IA_PRIMITIVES_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(VS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(GS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(GS_PRIMITIVES_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(CL_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(CL_PRIMITIVES_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(PS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(PS_DEPTH_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
         MMIO_DH(0x4260, D_BDW_PLUS, NULL, gvt_reg_tlb_control_handler);
         MMIO_DH(0x4264, D_BDW_PLUS, NULL, gvt_reg_tlb_control_handler);
         MMIO_DH(0x4268, D_BDW_PLUS, NULL, gvt_reg_tlb_control_handler);
@@ -2196,6 +2339,17 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_DH(0x4270, D_BDW_PLUS, NULL, gvt_reg_tlb_control_handler);
         MMIO_DFH(0x4094, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
 
+        MMIO_DFH(ARB_MODE, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_GM_RDR(RING_BBADDR, D_ALL, NULL, NULL);
+        MMIO_DFH(0x2220, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x12220, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x22220, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_SYNC_1, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_SYNC_0, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x22178, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x1a178, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x1a17c, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2217c, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         return 0;
 }
 
@@ -2204,7 +2358,7 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         struct drm_i915_private *dev_priv = gvt->dev_priv;
         int ret;
 
-        MMIO_DH(RING_IMR(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL,
+        MMIO_DFH(RING_IMR(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS, NULL,
                         intel_vgpu_reg_imr_handler);
 
         MMIO_DH(GEN8_GT_IMR(0), D_BDW_PLUS, NULL, intel_vgpu_reg_imr_handler);
@@ -2269,24 +2423,31 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_DH(GEN8_MASTER_IRQ, D_BDW_PLUS, NULL,
                 intel_vgpu_reg_master_irq_handler);
 
-        MMIO_D(RING_HWSTAM(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_D(0x1c134, D_BDW_PLUS);
-
-        MMIO_D(RING_TAIL(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_D(RING_HEAD(GEN8_BSD2_RING_BASE),  D_BDW_PLUS);
-        MMIO_GM(RING_START(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL, NULL);
-        MMIO_D(RING_CTL(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_D(RING_ACTHD(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_D(RING_ACTHD_UDW(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_DFH(0x1c29c, D_BDW_PLUS, F_MODE_MASK, NULL, ring_mode_mmio_write);
-        MMIO_DFH(RING_MI_MODE(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_MODE_MASK,
-                        NULL, NULL);
-        MMIO_DFH(RING_INSTPM(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_MODE_MASK,
-                        NULL, NULL);
+        MMIO_DFH(RING_HWSTAM(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x1c134, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_DFH(RING_TAIL(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_DFH(RING_HEAD(GEN8_BSD2_RING_BASE),  D_BDW_PLUS,
+                F_CMD_ACCESS, NULL, NULL);
+        MMIO_GM_RDR(RING_START(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL, NULL);
+        MMIO_DFH(RING_CTL(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_DFH(RING_ACTHD(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(RING_ACTHD_UDW(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x1c29c, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL,
+                ring_mode_mmio_write);
+        MMIO_DFH(RING_MI_MODE(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(RING_INSTPM(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(RING_TIMESTAMP(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
                         ring_timestamp_mmio_read, NULL);
 
-        MMIO_RING_D(RING_ACTHD_UDW, D_BDW_PLUS);
+        MMIO_RING_DFH(RING_ACTHD_UDW, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
 
 #define RING_REG(base) (base + 0xd0)
         MMIO_RING_F(RING_REG, 4, F_RO, 0,
@@ -2303,13 +2464,16 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x234)
-        MMIO_RING_F(RING_REG, 8, F_RO, 0, ~0, D_BDW_PLUS, NULL, NULL);
-        MMIO_F(RING_REG(GEN8_BSD2_RING_BASE), 4, F_RO, 0, ~0LL, D_BDW_PLUS, NULL, NULL);
+        MMIO_RING_F(RING_REG, 8, F_RO | F_CMD_ACCESS, 0, ~0, D_BDW_PLUS,
+                NULL, NULL);
+        MMIO_F(RING_REG(GEN8_BSD2_RING_BASE), 4, F_RO | F_CMD_ACCESS, 0,
+                ~0LL, D_BDW_PLUS, NULL, NULL);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x244)
-        MMIO_RING_D(RING_REG, D_BDW_PLUS);
-        MMIO_D(RING_REG(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
+        MMIO_RING_DFH(RING_REG, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(RING_REG(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
+                NULL, NULL);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x370)
@@ -2331,6 +2495,8 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_D(GEN7_MISCCPCTL, D_BDW_PLUS);
         MMIO_D(0x1c054, D_BDW_PLUS);
 
+        MMIO_DH(GEN6_PCODE_MAILBOX, D_BDW_PLUS, NULL, mailbox_write);
+
         MMIO_D(GEN8_PRIVATE_PAT_LO, D_BDW_PLUS);
         MMIO_D(GEN8_PRIVATE_PAT_HI, D_BDW_PLUS);
 
@@ -2341,14 +2507,14 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_F(RING_REG(GEN8_BSD2_RING_BASE), 32, 0, 0, 0, D_BDW_PLUS, NULL, NULL);
 #undef RING_REG
 
-        MMIO_RING_GM(RING_HWS_PGA, D_BDW_PLUS, NULL, NULL);
-        MMIO_GM(0x1c080, D_BDW_PLUS, NULL, NULL);
+        MMIO_RING_GM_RDR(RING_HWS_PGA, D_BDW_PLUS, NULL, NULL);
+        MMIO_GM_RDR(RING_HWS_PGA(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL, NULL);
 
         MMIO_DFH(HDC_CHICKEN0, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
 
-        MMIO_D(CHICKEN_PIPESL_1(PIPE_A), D_BDW);
-        MMIO_D(CHICKEN_PIPESL_1(PIPE_B), D_BDW);
-        MMIO_D(CHICKEN_PIPESL_1(PIPE_C), D_BDW);
+        MMIO_D(CHICKEN_PIPESL_1(PIPE_A), D_BDW_PLUS);
+        MMIO_D(CHICKEN_PIPESL_1(PIPE_B), D_BDW_PLUS);
+        MMIO_D(CHICKEN_PIPESL_1(PIPE_C), D_BDW_PLUS);
 
         MMIO_D(WM_MISC, D_BDW);
         MMIO_D(BDW_EDP_PSR_BASE, D_BDW);
@@ -2362,27 +2528,31 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_D(GEN8_EU_DISABLE1, D_BDW_PLUS);
         MMIO_D(GEN8_EU_DISABLE2, D_BDW_PLUS);
 
-        MMIO_D(0xfdc, D_BDW);
-        MMIO_DFH(GEN8_ROW_CHICKEN, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_D(GEN7_ROW_CHICKEN2, D_BDW_PLUS);
-        MMIO_D(GEN8_UCGCTL6, D_BDW_PLUS);
+        MMIO_D(0xfdc, D_BDW_PLUS);
+        MMIO_DFH(GEN8_ROW_CHICKEN, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_DFH(GEN7_ROW_CHICKEN2, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_DFH(GEN8_UCGCTL6, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
 
-        MMIO_D(0xb1f0, D_BDW);
-        MMIO_D(0xb1c0, D_BDW);
+        MMIO_DFH(0xb1f0, D_BDW, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xb1c0, D_BDW, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(GEN8_L3SQCREG4, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_D(0xb100, D_BDW);
-        MMIO_D(0xb10c, D_BDW);
+        MMIO_DFH(0xb100, D_BDW, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xb10c, D_BDW, F_CMD_ACCESS, NULL, NULL);
         MMIO_D(0xb110, D_BDW);
 
-        MMIO_DFH(0x24d0, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x24d4, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x24d8, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x24dc, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_F(0x24d0, 48, F_CMD_ACCESS, 0, 0, D_BDW_PLUS,
+                NULL, force_nonpriv_write);
 
-        MMIO_D(0x83a4, D_BDW);
+        MMIO_D(0x22040, D_BDW_PLUS);
+        MMIO_D(0x44484, D_BDW_PLUS);
+        MMIO_D(0x4448c, D_BDW_PLUS);
+
+        MMIO_DFH(0x83a4, D_BDW, F_CMD_ACCESS, NULL, NULL);
         MMIO_D(GEN8_L3_LRA_1_GPGPU, D_BDW_PLUS);
 
-        MMIO_D(0x8430, D_BDW);
+        MMIO_DFH(0x8430, D_BDW, F_CMD_ACCESS, NULL, NULL);
 
         MMIO_D(0x110000, D_BDW_PLUS);
 
@@ -2394,10 +2564,19 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_DFH(0xe194, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0xe188, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(HALF_SLICE_CHICKEN2, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x2580, D_BDW_PLUS, F_MODE_MASK, NULL, NULL);
-
-        MMIO_D(0x2248, D_BDW);
-
+        MMIO_DFH(0x2580, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_DFH(0x2248, D_BDW, F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_DFH(0xe220, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe230, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe240, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe260, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe270, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe280, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe2a0, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe2b0, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe2c0, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         return 0;
 }
 
@@ -2420,7 +2599,6 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_D(HSW_PWR_WELL_BIOS, D_SKL);
         MMIO_DH(HSW_PWR_WELL_DRIVER, D_SKL, NULL, skl_power_well_ctl_write);
 
-        MMIO_DH(GEN6_PCODE_MAILBOX, D_SKL, NULL, mailbox_write);
         MMIO_D(0xa210, D_SKL_PLUS);
         MMIO_D(GEN9_MEDIA_PG_IDLE_HYSTERESIS, D_SKL_PLUS);
         MMIO_D(GEN9_RENDER_PG_IDLE_HYSTERESIS, D_SKL_PLUS);
@@ -2578,16 +2756,16 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_F(0xb020, 0x80, F_CMD_ACCESS, 0, 0, D_SKL, NULL, NULL);
 
         MMIO_D(0xd08, D_SKL);
-        MMIO_D(0x20e0, D_SKL);
-        MMIO_D(0x20ec, D_SKL);
+        MMIO_DFH(0x20e0, D_SKL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(0x20ec, D_SKL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
 
         /* TRTT */
-        MMIO_D(0x4de0, D_SKL);
-        MMIO_D(0x4de4, D_SKL);
-        MMIO_D(0x4de8, D_SKL);
-        MMIO_D(0x4dec, D_SKL);
-        MMIO_D(0x4df0, D_SKL);
-        MMIO_DH(0x4df4, D_SKL, NULL, gen9_trtte_write);
+        MMIO_DFH(0x4de0, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4de4, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4de8, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4dec, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4df0, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4df4, D_SKL, F_CMD_ACCESS, NULL, gen9_trtte_write);
         MMIO_DH(0x4dfc, D_SKL, NULL, gen9_trtt_chicken_write);
 
         MMIO_D(0x45008, D_SKL);
@@ -2611,7 +2789,7 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_D(0x65f08, D_SKL);
         MMIO_D(0x320f0, D_SKL);
 
-        MMIO_D(_REG_VCS2_EXCC, D_SKL);
+        MMIO_DFH(_REG_VCS2_EXCC, D_SKL, F_CMD_ACCESS, NULL, NULL);
         MMIO_D(0x70034, D_SKL);
         MMIO_D(0x71034, D_SKL);
         MMIO_D(0x72034, D_SKL);
@@ -2624,6 +2802,9 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_D(_PLANE_KEYMSK_1(PIPE_C), D_SKL);
 
         MMIO_D(0x44500, D_SKL);
+        MMIO_DFH(GEN9_CSFE_CHICKEN1_RCS, D_SKL_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(GEN8_HDC_CHICKEN1, D_SKL, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
         return 0;
 }
 
@@ -2813,3 +2994,20 @@ int intel_vgpu_default_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         write_vreg(vgpu, offset, p_data, bytes);
         return 0;
 }
+
+/**
+ * intel_gvt_in_force_nonpriv_whitelist - if a mmio is in whitelist to be
+ * force-nopriv register
+ *
+ * @gvt: a GVT device
+ * @offset: register offset
+ *
+ * Returns:
+ * True if the register is in force-nonpriv whitelist;
+ * False if outside;
+ */
+bool intel_gvt_in_force_nonpriv_whitelist(struct intel_gvt *gvt,
+                                          unsigned int offset)
+{
+        return in_whitelist(offset);
+}
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 0f7f5d97f582..d641214578a7 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -96,10 +96,10 @@ static int gvt_dma_map_iova(struct intel_vgpu *vgpu, kvm_pfn_t pfn,
         struct device *dev = &vgpu->gvt->dev_priv->drm.pdev->dev;
         dma_addr_t daddr;
 
-        page = pfn_to_page(pfn);
-        if (is_error_page(page))
+        if (unlikely(!pfn_valid(pfn)))
                 return -EFAULT;
 
+        page = pfn_to_page(pfn);
         daddr = dma_map_page(dev, page, 0, PAGE_SIZE,
                         PCI_DMA_BIDIRECTIONAL);
         if (dma_mapping_error(dev, daddr))
@@ -295,10 +295,10 @@ static ssize_t description_show(struct kobject *kobj, struct device *dev,
                 return 0;
 
         return sprintf(buf, "low_gm_size: %dMB\nhigh_gm_size: %dMB\n"
-                                "fence: %d\n",
-                                BYTES_TO_MB(type->low_gm_size),
-                                BYTES_TO_MB(type->high_gm_size),
-                                type->fence);
+                       "fence: %d\nresolution: %s\n",
+                       BYTES_TO_MB(type->low_gm_size),
+                       BYTES_TO_MB(type->high_gm_size),
+                       type->fence, vgpu_edid_str(type->resolution));
 }
 
 static MDEV_TYPE_ATTR_RO(available_instances);
@@ -426,7 +426,7 @@ static void kvmgt_protect_table_del(struct kvmgt_guest_info *info,
 
 static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
 {
-        struct intel_vgpu *vgpu;
+        struct intel_vgpu *vgpu = NULL;
         struct intel_vgpu_type *type;
         struct device *pdev;
         void *gvt;
@@ -437,7 +437,7 @@ static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
 
         type = intel_gvt_find_vgpu_type(gvt, kobject_name(kobj));
         if (!type) {
-                gvt_err("failed to find type %s to create\n",
+                gvt_vgpu_err("failed to find type %s to create\n",
                                                 kobject_name(kobj));
                 ret = -EINVAL;
                 goto out;
@@ -446,7 +446,7 @@ static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
         vgpu = intel_gvt_ops->vgpu_create(gvt, type);
         if (IS_ERR_OR_NULL(vgpu)) {
                 ret = vgpu == NULL ? -EFAULT : PTR_ERR(vgpu);
-                gvt_err("failed to create intel vgpu: %d\n", ret);
+                gvt_vgpu_err("failed to create intel vgpu: %d\n", ret);
                 goto out;
         }
 
@@ -526,7 +526,8 @@ static int intel_vgpu_open(struct mdev_device *mdev)
         ret = vfio_register_notifier(mdev_dev(mdev), VFIO_IOMMU_NOTIFY, &events,
                                 &vgpu->vdev.iommu_notifier);
         if (ret != 0) {
-                gvt_err("vfio_register_notifier for iommu failed: %d\n", ret);
+                gvt_vgpu_err("vfio_register_notifier for iommu failed: %d\n",
+                        ret);
                 goto out;
         }
 
@@ -534,7 +535,8 @@ static int intel_vgpu_open(struct mdev_device *mdev)
         ret = vfio_register_notifier(mdev_dev(mdev), VFIO_GROUP_NOTIFY, &events,
                                 &vgpu->vdev.group_notifier);
         if (ret != 0) {
-                gvt_err("vfio_register_notifier for group failed: %d\n", ret);
+                gvt_vgpu_err("vfio_register_notifier for group failed: %d\n",
+                        ret);
                 goto undo_iommu;
         }
 
@@ -635,7 +637,7 @@ static ssize_t intel_vgpu_rw(struct mdev_device *mdev, char *buf,
 
 
         if (index >= VFIO_PCI_NUM_REGIONS) {
-                gvt_err("invalid index: %u\n", index);
+                gvt_vgpu_err("invalid index: %u\n", index);
                 return -EINVAL;
         }
 
@@ -669,7 +671,7 @@ static ssize_t intel_vgpu_rw(struct mdev_device *mdev, char *buf,
         case VFIO_PCI_VGA_REGION_INDEX:
         case VFIO_PCI_ROM_REGION_INDEX:
         default:
-                gvt_err("unsupported region: %u\n", index);
+                gvt_vgpu_err("unsupported region: %u\n", index);
         }
 
         return ret == 0 ? count : ret;
@@ -861,7 +863,7 @@ static int intel_vgpu_set_msi_trigger(struct intel_vgpu *vgpu,
 
                 trigger = eventfd_ctx_fdget(fd);
                 if (IS_ERR(trigger)) {
-                        gvt_err("eventfd_ctx_fdget failed\n");
+                        gvt_vgpu_err("eventfd_ctx_fdget failed\n");
                         return PTR_ERR(trigger);
                 }
                 vgpu->vdev.msi_trigger = trigger;
@@ -1120,7 +1122,7 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd,
                         ret = vfio_set_irqs_validate_and_prepare(&hdr, max,
                                                 VFIO_PCI_NUM_IRQS, &data_size);
                         if (ret) {
-                                gvt_err("intel:vfio_set_irqs_validate_and_prepare failed\n");
+                                gvt_vgpu_err("intel:vfio_set_irqs_validate_and_prepare failed\n");
                                 return -EINVAL;
                         }
                         if (data_size) {
@@ -1310,7 +1312,7 @@ static int kvmgt_guest_init(struct mdev_device *mdev)
 
         kvm = vgpu->vdev.kvm;
         if (!kvm || kvm->mm != current->mm) {
-                gvt_err("KVM is required to use Intel vGPU\n");
+                gvt_vgpu_err("KVM is required to use Intel vGPU\n");
                 return -ESRCH;
         }
 
@@ -1324,6 +1326,7 @@ static int kvmgt_guest_init(struct mdev_device *mdev)
         vgpu->handle = (unsigned long)info;
         info->vgpu = vgpu;
         info->kvm = kvm;
+        kvm_get_kvm(info->kvm);
 
         kvmgt_protect_table_init(info);
         gvt_cache_init(vgpu);
@@ -1337,12 +1340,15 @@ static int kvmgt_guest_init(struct mdev_device *mdev)
 
 static bool kvmgt_guest_exit(struct kvmgt_guest_info *info)
 {
+        struct intel_vgpu *vgpu = info->vgpu;
+
         if (!info) {
-                gvt_err("kvmgt_guest_info invalid\n");
+                gvt_vgpu_err("kvmgt_guest_info invalid\n");
                 return false;
         }
 
         kvm_page_track_unregister_notifier(info->kvm, &info->track_node);
+        kvm_put_kvm(info->kvm);
         kvmgt_protect_table_destroy(info);
         gvt_cache_destroy(info->vgpu);
         vfree(info);
@@ -1383,12 +1389,14 @@ static unsigned long kvmgt_gfn_to_pfn(unsigned long handle, unsigned long gfn)
         unsigned long iova, pfn;
         struct kvmgt_guest_info *info;
         struct device *dev;
+        struct intel_vgpu *vgpu;
         int rc;
 
         if (!handle_valid(handle))
                 return INTEL_GVT_INVALID_ADDR;
 
         info = (struct kvmgt_guest_info *)handle;
+        vgpu = info->vgpu;
         iova = gvt_cache_find(info->vgpu, gfn);
         if (iova != INTEL_GVT_INVALID_ADDR)
                 return iova;
@@ -1397,13 +1405,14 @@ static unsigned long kvmgt_gfn_to_pfn(unsigned long handle, unsigned long gfn)
         dev = mdev_dev(info->vgpu->vdev.mdev);
         rc = vfio_pin_pages(dev, &gfn, 1, IOMMU_READ | IOMMU_WRITE, &pfn);
         if (rc != 1) {
-                gvt_err("vfio_pin_pages failed for gfn 0x%lx: %d\n", gfn, rc);
+                gvt_vgpu_err("vfio_pin_pages failed for gfn 0x%lx: %d\n",
+                        gfn, rc);
                 return INTEL_GVT_INVALID_ADDR;
         }
         /* transfer to host iova for GFX to use DMA */
         rc = gvt_dma_map_iova(info->vgpu, pfn, &iova);
         if (rc) {
-                gvt_err("gvt_dma_map_iova failed for gfn: 0x%lx\n", gfn);
+                gvt_vgpu_err("gvt_dma_map_iova failed for gfn: 0x%lx\n", gfn);
                 vfio_unpin_pages(dev, &gfn, 1);
                 return INTEL_GVT_INVALID_ADDR;
         }
@@ -1417,7 +1426,7 @@ static int kvmgt_rw_gpa(unsigned long handle, unsigned long gpa,
 {
         struct kvmgt_guest_info *info;
         struct kvm *kvm;
-        int ret;
+        int idx, ret;
         bool kthread = current->mm == NULL;
 
         if (!handle_valid(handle))
@@ -1429,8 +1438,10 @@ static int kvmgt_rw_gpa(unsigned long handle, unsigned long gpa,
         if (kthread)
                 use_mm(kvm->mm);
 
+        idx = srcu_read_lock(&kvm->srcu);
         ret = write ? kvm_write_guest(kvm, gpa, buf, len) :
                       kvm_read_guest(kvm, gpa, buf, len);
+        srcu_read_unlock(&kvm->srcu, idx);
 
         if (kthread)
                 unuse_mm(kvm->mm);
diff --git a/drivers/gpu/drm/i915/gvt/mmio.c b/drivers/gpu/drm/i915/gvt/mmio.c
index 4df078bc5d04..1ba3bdb09341 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.c
+++ b/drivers/gpu/drm/i915/gvt/mmio.c
@@ -57,6 +57,58 @@ int intel_vgpu_gpa_to_mmio_offset(struct intel_vgpu *vgpu, u64 gpa)
         (reg >= gvt->device_info.gtt_start_offset \
          && reg < gvt->device_info.gtt_start_offset + gvt_ggtt_sz(gvt))
 
+static void failsafe_emulate_mmio_rw(struct intel_vgpu *vgpu, uint64_t pa,
+                void *p_data, unsigned int bytes, bool read)
+{
+        struct intel_gvt *gvt = NULL;
+        void *pt = NULL;
+        unsigned int offset = 0;
+
+        if (!vgpu || !p_data)
+                return;
+
+        gvt = vgpu->gvt;
+        mutex_lock(&gvt->lock);
+        offset = intel_vgpu_gpa_to_mmio_offset(vgpu, pa);
+        if (reg_is_mmio(gvt, offset)) {
+                if (read)
+                        intel_vgpu_default_mmio_read(vgpu, offset, p_data,
+                                        bytes);
+                else
+                        intel_vgpu_default_mmio_write(vgpu, offset, p_data,
+                                        bytes);
+        } else if (reg_is_gtt(gvt, offset) &&
+                        vgpu->gtt.ggtt_mm->virtual_page_table) {
+                offset -= gvt->device_info.gtt_start_offset;
+                pt = vgpu->gtt.ggtt_mm->virtual_page_table + offset;
+                if (read)
+                        memcpy(p_data, pt, bytes);
+                else
+                        memcpy(pt, p_data, bytes);
+
+        } else if (atomic_read(&vgpu->gtt.n_write_protected_guest_page)) {
+                struct intel_vgpu_guest_page *gp;
+
+                /* Since we enter the failsafe mode early during guest boot,
+                 * guest may not have chance to set up its ppgtt table, so
+                 * there should not be any wp pages for guest. Keep the wp
+                 * related code here in case we need to handle it in furture.
+                 */
+                gp = intel_vgpu_find_guest_page(vgpu, pa >> PAGE_SHIFT);
+                if (gp) {
+                        /* remove write protection to prevent furture traps */
+                        intel_vgpu_clean_guest_page(vgpu, gp);
+                        if (read)
+                                intel_gvt_hypervisor_read_gpa(vgpu, pa,
+                                                p_data, bytes);
+                        else
+                                intel_gvt_hypervisor_write_gpa(vgpu, pa,
+                                                p_data, bytes);
+                }
+        }
+        mutex_unlock(&gvt->lock);
+}
+
 /**
  * intel_vgpu_emulate_mmio_read - emulate MMIO read
  * @vgpu: a vGPU
@@ -75,6 +127,11 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
         unsigned int offset = 0;
         int ret = -EINVAL;
 
+
+        if (vgpu->failsafe) {
+                failsafe_emulate_mmio_rw(vgpu, pa, p_data, bytes, true);
+                return 0;
+        }
         mutex_lock(&gvt->lock);
 
         if (atomic_read(&vgpu->gtt.n_write_protected_guest_page)) {
@@ -85,10 +142,10 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
                         ret = intel_gvt_hypervisor_read_gpa(vgpu, pa,
                                         p_data, bytes);
                         if (ret) {
-                                gvt_err("vgpu%d: guest page read error %d, "
+                                gvt_vgpu_err("guest page read error %d, "
                                         "gfn 0x%lx, pa 0x%llx, var 0x%x, len %d\n",
-                                        vgpu->id, ret,
-                                        gp->gfn, pa, *(u32 *)p_data, bytes);
+                                        ret, gp->gfn, pa, *(u32 *)p_data,
+                                        bytes);
                         }
                         mutex_unlock(&gvt->lock);
                         return ret;
@@ -143,14 +200,13 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
                 ret = intel_vgpu_default_mmio_read(vgpu, offset, p_data, bytes);
 
                 if (!vgpu->mmio.disable_warn_untrack) {
-                        gvt_err("vgpu%d: read untracked MMIO %x(%dB) val %x\n",
-                                vgpu->id, offset, bytes, *(u32 *)p_data);
+                        gvt_vgpu_err("read untracked MMIO %x(%dB) val %x\n",
+                                offset, bytes, *(u32 *)p_data);
 
                         if (offset == 0x206c) {
-                                gvt_err("------------------------------------------\n");
-                                gvt_err("vgpu%d: likely triggers a gfx reset\n",
-                                        vgpu->id);
-                                gvt_err("------------------------------------------\n");
+                                gvt_vgpu_err("------------------------------------------\n");
+                                gvt_vgpu_err("likely triggers a gfx reset\n");
+                                gvt_vgpu_err("------------------------------------------\n");
                                 vgpu->mmio.disable_warn_untrack = true;
                         }
                 }
@@ -163,8 +219,8 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
         mutex_unlock(&gvt->lock);
         return 0;
 err:
-        gvt_err("vgpu%d: fail to emulate MMIO read %08x len %d\n",
-                        vgpu->id, offset, bytes);
+        gvt_vgpu_err("fail to emulate MMIO read %08x len %d\n",
+                        offset, bytes);
         mutex_unlock(&gvt->lock);
         return ret;
 }
@@ -188,6 +244,11 @@ int intel_vgpu_emulate_mmio_write(struct intel_vgpu *vgpu, uint64_t pa,
         u32 old_vreg = 0, old_sreg = 0;
         int ret = -EINVAL;
 
+        if (vgpu->failsafe) {
+                failsafe_emulate_mmio_rw(vgpu, pa, p_data, bytes, false);
+                return 0;
+        }
+
         mutex_lock(&gvt->lock);
 
         if (atomic_read(&vgpu->gtt.n_write_protected_guest_page)) {
@@ -197,10 +258,11 @@ int intel_vgpu_emulate_mmio_write(struct intel_vgpu *vgpu, uint64_t pa,
                 if (gp) {
                         ret = gp->handler(gp, pa, p_data, bytes);
                         if (ret) {
-                                gvt_err("vgpu%d: guest page write error %d, "
-                                        "gfn 0x%lx, pa 0x%llx, var 0x%x, len %d\n",
-                                        vgpu->id, ret,
-                                        gp->gfn, pa, *(u32 *)p_data, bytes);
+                                gvt_err("guest page write error %d, "
+                                        "gfn 0x%lx, pa 0x%llx, "
+                                        "var 0x%x, len %d\n",
+                                        ret, gp->gfn, pa,
+                                        *(u32 *)p_data, bytes);
                         }
                         mutex_unlock(&gvt->lock);
                         return ret;
@@ -236,7 +298,7 @@ int intel_vgpu_emulate_mmio_write(struct intel_vgpu *vgpu, uint64_t pa,
 
         mmio = intel_gvt_find_mmio_info(gvt, rounddown(offset, 4));
         if (!mmio && !vgpu->mmio.disable_warn_untrack)
-                gvt_err("vgpu%d: write untracked MMIO %x len %d val %x\n",
+                gvt_dbg_mmio("vgpu%d: write untracked MMIO %x len %d val %x\n",
                                 vgpu->id, offset, bytes, *(u32 *)p_data);
 
         if (!intel_gvt_mmio_is_unalign(gvt, offset)) {
@@ -267,8 +329,8 @@ int intel_vgpu_emulate_mmio_write(struct intel_vgpu *vgpu, uint64_t pa,
 
                         /* all register bits are RO. */
                         if (ro_mask == ~(u64)0) {
-                                gvt_err("vgpu%d: try to write RO reg %x\n",
-                                                vgpu->id, offset);
+                                gvt_vgpu_err("try to write RO reg %x\n",
+                                        offset);
                                 ret = 0;
                                 goto out;
                         }
@@ -298,8 +360,8 @@ out:
         mutex_unlock(&gvt->lock);
         return 0;
 err:
-        gvt_err("vgpu%d: fail to emulate MMIO write %08x len %d\n",
-                        vgpu->id, offset, bytes);
+        gvt_vgpu_err("fail to emulate MMIO write %08x len %d\n", offset,
+                     bytes);
         mutex_unlock(&gvt->lock);
         return ret;
 }
@@ -322,6 +384,8 @@ void intel_vgpu_reset_mmio(struct intel_vgpu *vgpu)
 
         /* set the bit 0:2(Core C-State ) to C0 */
         vgpu_vreg(vgpu, GEN6_GT_CORE_STATUS) = 0;
+
+        vgpu->mmio.disable_warn_untrack = false;
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/mmio.h b/drivers/gpu/drm/i915/gvt/mmio.h
index 3bc620f56f35..a3a027025cd0 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.h
+++ b/drivers/gpu/drm/i915/gvt/mmio.h
@@ -107,4 +107,7 @@ int intel_vgpu_default_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
                                  void *p_data, unsigned int bytes);
 int intel_vgpu_default_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                                   void *p_data, unsigned int bytes);
+
+bool intel_gvt_in_force_nonpriv_whitelist(struct intel_gvt *gvt,
+                                          unsigned int offset);
 #endif
diff --git a/drivers/gpu/drm/i915/gvt/opregion.c b/drivers/gpu/drm/i915/gvt/opregion.c
index d9fb41ab7119..311799136d7f 100644
--- a/drivers/gpu/drm/i915/gvt/opregion.c
+++ b/drivers/gpu/drm/i915/gvt/opregion.c
@@ -27,7 +27,6 @@
 
 static int init_vgpu_opregion(struct intel_vgpu *vgpu, u32 gpa)
 {
-        void __iomem *host_va = vgpu->gvt->opregion.opregion_va;
         u8 *buf;
         int i;
 
@@ -43,8 +42,8 @@ static int init_vgpu_opregion(struct intel_vgpu *vgpu, u32 gpa)
         if (!vgpu_opregion(vgpu)->va)
                 return -ENOMEM;
 
-        memcpy_fromio(vgpu_opregion(vgpu)->va, host_va,
-                        INTEL_GVT_OPREGION_SIZE);
+        memcpy(vgpu_opregion(vgpu)->va, vgpu->gvt->opregion.opregion_va,
+               INTEL_GVT_OPREGION_SIZE);
 
         for (i = 0; i < INTEL_GVT_OPREGION_PAGES; i++)
                 vgpu_opregion(vgpu)->gfn[i] = (gpa >> PAGE_SHIFT) + i;
@@ -68,14 +67,15 @@ static int map_vgpu_opregion(struct intel_vgpu *vgpu, bool map)
                 mfn = intel_gvt_hypervisor_virt_to_mfn(vgpu_opregion(vgpu)->va
                         + i * PAGE_SIZE);
                 if (mfn == INTEL_GVT_INVALID_ADDR) {
-                        gvt_err("fail to get MFN from VA\n");
+                        gvt_vgpu_err("fail to get MFN from VA\n");
                         return -EINVAL;
                 }
                 ret = intel_gvt_hypervisor_map_gfn_to_mfn(vgpu,
                                 vgpu_opregion(vgpu)->gfn[i],
                                 mfn, 1, map);
                 if (ret) {
-                        gvt_err("fail to map GFN to MFN, errno: %d\n", ret);
+                        gvt_vgpu_err("fail to map GFN to MFN, errno: %d\n",
+                                ret);
                         return ret;
                 }
         }
@@ -288,7 +288,7 @@ int intel_vgpu_emulate_opregion_request(struct intel_vgpu *vgpu, u32 swsci)
         parm = vgpu_opregion(vgpu)->va + INTEL_GVT_OPREGION_PARM;
 
         if (!(swsci & SWSCI_SCI_SELECT)) {
-                gvt_err("vgpu%d: requesting SMI service\n", vgpu->id);
+                gvt_vgpu_err("requesting SMI service\n");
                 return 0;
         }
         /* ignore non 0->1 trasitions */
@@ -301,9 +301,8 @@ int intel_vgpu_emulate_opregion_request(struct intel_vgpu *vgpu, u32 swsci)
         func = GVT_OPREGION_FUNC(*scic);
         subfunc = GVT_OPREGION_SUBFUNC(*scic);
         if (!querying_capabilities(*scic)) {
-                gvt_err("vgpu%d: requesting runtime service: func \"%s\","
+                gvt_vgpu_err("requesting runtime service: func \"%s\","
                                 " subfunc \"%s\"\n",
-                                vgpu->id,
                                 opregion_func_name(func),
                                 opregion_subfunc_name(subfunc));
                 /*
diff --git a/drivers/gpu/drm/i915/gvt/render.c b/drivers/gpu/drm/i915/gvt/render.c
index 2b3a642284b6..0beb83563b08 100644
--- a/drivers/gpu/drm/i915/gvt/render.c
+++ b/drivers/gpu/drm/i915/gvt/render.c
@@ -53,6 +53,14 @@ static struct render_mmio gen8_render_mmio_list[] = {
         {RCS, _MMIO(0x24d4), 0, false},
         {RCS, _MMIO(0x24d8), 0, false},
         {RCS, _MMIO(0x24dc), 0, false},
+        {RCS, _MMIO(0x24e0), 0, false},
+        {RCS, _MMIO(0x24e4), 0, false},
+        {RCS, _MMIO(0x24e8), 0, false},
+        {RCS, _MMIO(0x24ec), 0, false},
+        {RCS, _MMIO(0x24f0), 0, false},
+        {RCS, _MMIO(0x24f4), 0, false},
+        {RCS, _MMIO(0x24f8), 0, false},
+        {RCS, _MMIO(0x24fc), 0, false},
         {RCS, _MMIO(0x7004), 0xffff, true},
         {RCS, _MMIO(0x7008), 0xffff, true},
         {RCS, _MMIO(0x7000), 0xffff, true},
@@ -76,6 +84,14 @@ static struct render_mmio gen9_render_mmio_list[] = {
         {RCS, _MMIO(0x24d4), 0, false},
         {RCS, _MMIO(0x24d8), 0, false},
         {RCS, _MMIO(0x24dc), 0, false},
+        {RCS, _MMIO(0x24e0), 0, false},
+        {RCS, _MMIO(0x24e4), 0, false},
+        {RCS, _MMIO(0x24e8), 0, false},
+        {RCS, _MMIO(0x24ec), 0, false},
+        {RCS, _MMIO(0x24f0), 0, false},
+        {RCS, _MMIO(0x24f4), 0, false},
+        {RCS, _MMIO(0x24f8), 0, false},
+        {RCS, _MMIO(0x24fc), 0, false},
         {RCS, _MMIO(0x7004), 0xffff, true},
         {RCS, _MMIO(0x7008), 0xffff, true},
         {RCS, _MMIO(0x7000), 0xffff, true},
@@ -151,7 +167,7 @@ static void handle_tlb_pending_event(struct intel_vgpu *vgpu, int ring_id)
         I915_WRITE_FW(reg, 0x1);
 
         if (wait_for_atomic((I915_READ_FW(reg) == 0), 50))
-                gvt_err("timeout in invalidate ring (%d) tlb\n", ring_id);
+                gvt_vgpu_err("timeout in invalidate ring (%d) tlb\n", ring_id);
         else
                 vgpu_vreg(vgpu, regs[ring_id]) = 0;
 
@@ -191,7 +207,7 @@ static void load_mocs(struct intel_vgpu *vgpu, int ring_id)
                 l3_offset.reg = 0xb020;
                 for (i = 0; i < 32; i++) {
                         gen9_render_mocs_L3[i] = I915_READ(l3_offset);
-                        I915_WRITE(l3_offset, vgpu_vreg(vgpu, offset));
+                        I915_WRITE(l3_offset, vgpu_vreg(vgpu, l3_offset));
                         POSTING_READ(l3_offset);
                         l3_offset.reg += 4;
                 }
diff --git a/drivers/gpu/drm/i915/gvt/sched_policy.c b/drivers/gpu/drm/i915/gvt/sched_policy.c
index 06c9584ac5f0..34b9acdf3479 100644
--- a/drivers/gpu/drm/i915/gvt/sched_policy.c
+++ b/drivers/gpu/drm/i915/gvt/sched_policy.c
@@ -101,7 +101,7 @@ struct tbs_sched_data {
         struct list_head runq_head;
 };
 
-#define GVT_DEFAULT_TIME_SLICE (1 * HZ / 1000)
+#define GVT_DEFAULT_TIME_SLICE (msecs_to_jiffies(1))
 
 static void tbs_sched_func(struct work_struct *work)
 {
@@ -223,7 +223,7 @@ static void tbs_sched_start_schedule(struct intel_vgpu *vgpu)
                 return;
 
         list_add_tail(&vgpu_data->list, &sched_data->runq_head);
-        schedule_delayed_work(&sched_data->work, sched_data->period);
+        schedule_delayed_work(&sched_data->work, 0);
 }
 
 static void tbs_sched_stop_schedule(struct intel_vgpu *vgpu)
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index d6b6d0efdd1a..a44782412f2c 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -84,7 +84,7 @@ static int populate_shadow_context(struct intel_vgpu_workload *workload)
                                 (u32)((workload->ctx_desc.lrca + i) <<
                                 GTT_PAGE_SHIFT));
                 if (context_gpa == INTEL_GVT_INVALID_ADDR) {
-                        gvt_err("Invalid guest context descriptor\n");
+                        gvt_vgpu_err("Invalid guest context descriptor\n");
                         return -EINVAL;
                 }
 
@@ -127,18 +127,24 @@ static int populate_shadow_context(struct intel_vgpu_workload *workload)
         return 0;
 }
 
+static inline bool is_gvt_request(struct drm_i915_gem_request *req)
+{
+        return i915_gem_context_force_single_submission(req->ctx);
+}
+
 static int shadow_context_status_change(struct notifier_block *nb,
                 unsigned long action, void *data)
 {
-        struct intel_vgpu *vgpu = container_of(nb,
-                        struct intel_vgpu, shadow_ctx_notifier_block);
-        struct drm_i915_gem_request *req =
-                (struct drm_i915_gem_request *)data;
-        struct intel_gvt_workload_scheduler *scheduler =
-                &vgpu->gvt->scheduler;
+        struct drm_i915_gem_request *req = (struct drm_i915_gem_request *)data;
+        struct intel_gvt *gvt = container_of(nb, struct intel_gvt,
+                                shadow_ctx_notifier_block[req->engine->id]);
+        struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct intel_vgpu_workload *workload =
                 scheduler->current_workload[req->engine->id];
 
+        if (!is_gvt_request(req) || unlikely(!workload))
+                return NOTIFY_OK;
+
         switch (action) {
         case INTEL_CONTEXT_SCHEDULE_IN:
                 intel_gvt_load_render_mmio(workload->vgpu,
@@ -148,6 +154,15 @@ static int shadow_context_status_change(struct notifier_block *nb,
         case INTEL_CONTEXT_SCHEDULE_OUT:
                 intel_gvt_restore_render_mmio(workload->vgpu,
                                               workload->ring_id);
+                /* If the status is -EINPROGRESS means this workload
+                 * doesn't meet any issue during dispatching so when
+                 * get the SCHEDULE_OUT set the status to be zero for
+                 * good. If the status is NOT -EINPROGRESS means there
+                 * is something wrong happened during dispatching and
+                 * the status should not be set to zero
+                 */
+                if (workload->status == -EINPROGRESS)
+                        workload->status = 0;
                 atomic_set(&workload->shadow_ctx_active, 0);
                 break;
         default:
@@ -163,7 +178,9 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
         int ring_id = workload->ring_id;
         struct i915_gem_context *shadow_ctx = workload->vgpu->shadow_ctx;
         struct drm_i915_private *dev_priv = workload->vgpu->gvt->dev_priv;
+        struct intel_engine_cs *engine = dev_priv->engine[ring_id];
         struct drm_i915_gem_request *rq;
+        struct intel_vgpu *vgpu = workload->vgpu;
         int ret;
 
         gvt_dbg_sched("ring id %d prepare to dispatch workload %p\n",
@@ -175,9 +192,24 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
 
         mutex_lock(&dev_priv->drm.struct_mutex);
 
+        /* pin shadow context by gvt even the shadow context will be pinned
+         * when i915 alloc request. That is because gvt will update the guest
+         * context from shadow context when workload is completed, and at that
+         * moment, i915 may already unpined the shadow context to make the
+         * shadow_ctx pages invalid. So gvt need to pin itself. After update
+         * the guest context, gvt can unpin the shadow_ctx safely.
+         */
+        ret = engine->context_pin(engine, shadow_ctx);
+        if (ret) {
+                gvt_vgpu_err("fail to pin shadow context\n");
+                workload->status = ret;
+                mutex_unlock(&dev_priv->drm.struct_mutex);
+                return ret;
+        }
+
         rq = i915_gem_request_alloc(dev_priv->engine[ring_id], shadow_ctx);
         if (IS_ERR(rq)) {
-                gvt_err("fail to allocate gem request\n");
+                gvt_vgpu_err("fail to allocate gem request\n");
                 ret = PTR_ERR(rq);
                 goto out;
         }
@@ -190,9 +222,12 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
         if (ret)
                 goto out;
 
-        ret = intel_gvt_scan_and_shadow_wa_ctx(&workload->wa_ctx);
-        if (ret)
-                goto out;
+        if ((workload->ring_id == RCS) &&
+            (workload->wa_ctx.indirect_ctx.size != 0)) {
+                ret = intel_gvt_scan_and_shadow_wa_ctx(&workload->wa_ctx);
+                if (ret)
+                        goto out;
+        }
 
         ret = populate_shadow_context(workload);
         if (ret)
@@ -215,6 +250,9 @@ out:
 
         if (!IS_ERR_OR_NULL(rq))
                 i915_add_request_no_flush(rq);
+        else
+                engine->context_unpin(engine, shadow_ctx);
+
         mutex_unlock(&dev_priv->drm.struct_mutex);
         return ret;
 }
@@ -310,7 +348,7 @@ static void update_guest_context(struct intel_vgpu_workload *workload)
                                 (u32)((workload->ctx_desc.lrca + i) <<
                                         GTT_PAGE_SHIFT));
                 if (context_gpa == INTEL_GVT_INVALID_ADDR) {
-                        gvt_err("invalid guest context descriptor\n");
+                        gvt_vgpu_err("invalid guest context descriptor\n");
                         return;
                 }
 
@@ -359,15 +397,31 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
         workload = scheduler->current_workload[ring_id];
         vgpu = workload->vgpu;
 
-        if (!workload->status && !vgpu->resetting) {
+        /* For the workload w/ request, needs to wait for the context
+         * switch to make sure request is completed.
+         * For the workload w/o request, directly complete the workload.
+         */
+        if (workload->req) {
+                struct drm_i915_private *dev_priv =
+                        workload->vgpu->gvt->dev_priv;
+                struct intel_engine_cs *engine =
+                        dev_priv->engine[workload->ring_id];
                 wait_event(workload->shadow_ctx_status_wq,
                            !atomic_read(&workload->shadow_ctx_active));
 
-                update_guest_context(workload);
+                i915_gem_request_put(fetch_and_zero(&workload->req));
+
+                if (!workload->status && !vgpu->resetting) {
+                        update_guest_context(workload);
 
-                for_each_set_bit(event, workload->pending_events,
-                                 INTEL_GVT_EVENT_MAX)
-                        intel_vgpu_trigger_virtual_event(vgpu, event);
+                        for_each_set_bit(event, workload->pending_events,
+                                         INTEL_GVT_EVENT_MAX)
+                                intel_vgpu_trigger_virtual_event(vgpu, event);
+                }
+                mutex_lock(&dev_priv->drm.struct_mutex);
+                /* unpin shadow ctx as the shadow_ctx update is done */
+                engine->context_unpin(engine, workload->vgpu->shadow_ctx);
+                mutex_unlock(&dev_priv->drm.struct_mutex);
         }
 
         gvt_dbg_sched("ring id %d complete workload %p status %d\n",
@@ -397,7 +451,7 @@ static int workload_thread(void *priv)
         int ring_id = p->ring_id;
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct intel_vgpu_workload *workload = NULL;
-        long lret;
+        struct intel_vgpu *vgpu = NULL;
         int ret;
         bool need_force_wake = IS_SKYLAKE(gvt->dev_priv);
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
@@ -440,29 +494,19 @@ static int workload_thread(void *priv)
                 mutex_unlock(&gvt->lock);
 
                 if (ret) {
-                        gvt_err("fail to dispatch workload, skip\n");
+                        vgpu = workload->vgpu;
+                        gvt_vgpu_err("fail to dispatch workload, skip\n");
                         goto complete;
                 }
 
                 gvt_dbg_sched("ring id %d wait workload %p\n",
                                 workload->ring_id, workload);
-
-                lret = i915_wait_request(workload->req,
-                                         0, MAX_SCHEDULE_TIMEOUT);
-                if (lret < 0) {
-                        workload->status = lret;
-                        gvt_err("fail to wait workload, skip\n");
-                } else {
-                        workload->status = 0;
-                }
+                i915_wait_request(workload->req, 0, MAX_SCHEDULE_TIMEOUT);
 
 complete:
                 gvt_dbg_sched("will complete workload %p, status: %d\n",
                                 workload, workload->status);
 
-                if (workload->req)
-                        i915_gem_request_put(fetch_and_zero(&workload->req));
-
                 complete_current_workload(gvt, ring_id);
 
                 if (need_force_wake)
@@ -493,15 +537,16 @@ void intel_gvt_wait_vgpu_idle(struct intel_vgpu *vgpu)
 void intel_gvt_clean_workload_scheduler(struct intel_gvt *gvt)
 {
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
-        int i;
+        struct intel_engine_cs *engine;
+        enum intel_engine_id i;
 
         gvt_dbg_core("clean workload scheduler\n");
 
-        for (i = 0; i < I915_NUM_ENGINES; i++) {
-                if (scheduler->thread[i]) {
-                        kthread_stop(scheduler->thread[i]);
-                        scheduler->thread[i] = NULL;
-                }
+        for_each_engine(engine, gvt->dev_priv, i) {
+                atomic_notifier_chain_unregister(
+                                        &engine->context_status_notifier,
+                                        &gvt->shadow_ctx_notifier_block[i]);
+                kthread_stop(scheduler->thread[i]);
         }
 }
 
@@ -509,18 +554,15 @@ int intel_gvt_init_workload_scheduler(struct intel_gvt *gvt)
 {
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct workload_thread_param *param = NULL;
+        struct intel_engine_cs *engine;
+        enum intel_engine_id i;
         int ret;
-        int i;
 
         gvt_dbg_core("init workload scheduler\n");
 
         init_waitqueue_head(&scheduler->workload_complete_wq);
 
-        for (i = 0; i < I915_NUM_ENGINES; i++) {
-                /* check ring mask at init time */
-                if (!HAS_ENGINE(gvt->dev_priv, i))
-                        continue;
-
+        for_each_engine(engine, gvt->dev_priv, i) {
                 init_waitqueue_head(&scheduler->waitq[i]);
 
                 param = kzalloc(sizeof(*param), GFP_KERNEL);
@@ -539,6 +581,11 @@ int intel_gvt_init_workload_scheduler(struct intel_gvt *gvt)
                         ret = PTR_ERR(scheduler->thread[i]);
                         goto err;
                 }
+
+                gvt->shadow_ctx_notifier_block[i].notifier_call =
+                                        shadow_context_status_change;
+                atomic_notifier_chain_register(&engine->context_status_notifier,
+                                        &gvt->shadow_ctx_notifier_block[i]);
         }
         return 0;
 err:
@@ -550,9 +597,6 @@ err:
 
 void intel_vgpu_clean_gvt_context(struct intel_vgpu *vgpu)
 {
-        atomic_notifier_chain_unregister(&vgpu->shadow_ctx->status_notifier,
-                        &vgpu->shadow_ctx_notifier_block);
-
         i915_gem_context_put_unlocked(vgpu->shadow_ctx);
 }
 
@@ -567,10 +611,5 @@ int intel_vgpu_init_gvt_context(struct intel_vgpu *vgpu)
 
         vgpu->shadow_ctx->engine[RCS].initialised = true;
 
-        vgpu->shadow_ctx_notifier_block.notifier_call =
-                shadow_context_status_change;
-
-        atomic_notifier_chain_register(&vgpu->shadow_ctx->status_notifier,
-                                       &vgpu->shadow_ctx_notifier_block);
         return 0;
 }
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index 95a97aa0051e..41cfa5ccae84 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -64,6 +64,20 @@ void populate_pvinfo_page(struct intel_vgpu *vgpu)
         WARN_ON(sizeof(struct vgt_if) != VGT_PVINFO_SIZE);
 }
 
+static struct {
+        unsigned int low_mm;
+        unsigned int high_mm;
+        unsigned int fence;
+        enum intel_vgpu_edid edid;
+        char *name;
+} vgpu_types[] = {
+/* Fixed vGPU type table */
+        { MB_TO_BYTES(64), MB_TO_BYTES(512), 4, GVT_EDID_1024_768, "8" },
+        { MB_TO_BYTES(128), MB_TO_BYTES(512), 4, GVT_EDID_1920_1200, "4" },
+        { MB_TO_BYTES(256), MB_TO_BYTES(1024), 4, GVT_EDID_1920_1200, "2" },
+        { MB_TO_BYTES(512), MB_TO_BYTES(2048), 4, GVT_EDID_1920_1200, "1" },
+};
+
 /**
  * intel_gvt_init_vgpu_types - initialize vGPU type list
  * @gvt : GVT device
@@ -78,9 +92,8 @@ int intel_gvt_init_vgpu_types(struct intel_gvt *gvt)
         unsigned int min_low;
 
         /* vGPU type name is defined as GVTg_Vx_y which contains
-         * physical GPU generation type and 'y' means maximum vGPU
-         * instances user can create on one physical GPU for this
-         * type.
+         * physical GPU generation type (e.g V4 as BDW server, V5 as
+         * SKL server).
          *
          * Depend on physical SKU resource, might see vGPU types like
          * GVTg_V4_8, GVTg_V4_4, GVTg_V4_2, etc. We can create
@@ -92,7 +105,7 @@ int intel_gvt_init_vgpu_types(struct intel_gvt *gvt)
          */
         low_avail = gvt_aperture_sz(gvt) - HOST_LOW_GM_SIZE;
         high_avail = gvt_hidden_sz(gvt) - HOST_HIGH_GM_SIZE;
-        num_types = 4;
+        num_types = sizeof(vgpu_types) / sizeof(vgpu_types[0]);
 
         gvt->types = kzalloc(num_types * sizeof(struct intel_vgpu_type),
                              GFP_KERNEL);
@@ -101,28 +114,29 @@ int intel_gvt_init_vgpu_types(struct intel_gvt *gvt)
 
         min_low = MB_TO_BYTES(32);
         for (i = 0; i < num_types; ++i) {
-                if (low_avail / min_low == 0)
+                if (low_avail / vgpu_types[i].low_mm == 0)
                         break;
-                gvt->types[i].low_gm_size = min_low;
-                gvt->types[i].high_gm_size = max((min_low<<3), MB_TO_BYTES(384U));
-                gvt->types[i].fence = 4;
-                gvt->types[i].max_instance = min(low_avail / min_low,
-                                                 high_avail / gvt->types[i].high_gm_size);
-                gvt->types[i].avail_instance = gvt->types[i].max_instance;
+
+                gvt->types[i].low_gm_size = vgpu_types[i].low_mm;
+                gvt->types[i].high_gm_size = vgpu_types[i].high_mm;
+                gvt->types[i].fence = vgpu_types[i].fence;
+                gvt->types[i].resolution = vgpu_types[i].edid;
+                gvt->types[i].avail_instance = min(low_avail / vgpu_types[i].low_mm,
+                                                   high_avail / vgpu_types[i].high_mm);
 
                 if (IS_GEN8(gvt->dev_priv))
-                        sprintf(gvt->types[i].name, "GVTg_V4_%u",
-                                                gvt->types[i].max_instance);
+                        sprintf(gvt->types[i].name, "GVTg_V4_%s",
+                                                vgpu_types[i].name);
                 else if (IS_GEN9(gvt->dev_priv))
-                        sprintf(gvt->types[i].name, "GVTg_V5_%u",
-                                                gvt->types[i].max_instance);
+                        sprintf(gvt->types[i].name, "GVTg_V5_%s",
+                                                vgpu_types[i].name);
 
-                min_low <<= 1;
-                gvt_dbg_core("type[%d]: %s max %u avail %u low %u high %u fence %u\n",
-                             i, gvt->types[i].name, gvt->types[i].max_instance,
+                gvt_dbg_core("type[%d]: %s avail %u low %u high %u fence %u res %s\n",
+                             i, gvt->types[i].name,
                              gvt->types[i].avail_instance,
                              gvt->types[i].low_gm_size,
-                             gvt->types[i].high_gm_size, gvt->types[i].fence);
+                             gvt->types[i].high_gm_size, gvt->types[i].fence,
+                             vgpu_edid_str(gvt->types[i].resolution));
         }
 
         gvt->num_types = i;
@@ -138,7 +152,7 @@ static void intel_gvt_update_vgpu_types(struct intel_gvt *gvt)
 {
         int i;
         unsigned int low_gm_avail, high_gm_avail, fence_avail;
-        unsigned int low_gm_min, high_gm_min, fence_min, total_min;
+        unsigned int low_gm_min, high_gm_min, fence_min;
 
         /* Need to depend on maxium hw resource size but keep on
          * static config for now.
@@ -154,12 +168,11 @@ static void intel_gvt_update_vgpu_types(struct intel_gvt *gvt)
                 low_gm_min = low_gm_avail / gvt->types[i].low_gm_size;
                 high_gm_min = high_gm_avail / gvt->types[i].high_gm_size;
                 fence_min = fence_avail / gvt->types[i].fence;
-                total_min = min(min(low_gm_min, high_gm_min), fence_min);
-                gvt->types[i].avail_instance = min(gvt->types[i].max_instance,
-                                                   total_min);
+                gvt->types[i].avail_instance = min(min(low_gm_min, high_gm_min),
+                                                   fence_min);
 
-                gvt_dbg_core("update type[%d]: %s max %u avail %u low %u high %u fence %u\n",
-                       i, gvt->types[i].name, gvt->types[i].max_instance,
+                gvt_dbg_core("update type[%d]: %s avail %u low %u high %u fence %u\n",
+                       i, gvt->types[i].name,
                        gvt->types[i].avail_instance, gvt->types[i].low_gm_size,
                        gvt->types[i].high_gm_size, gvt->types[i].fence);
         }
@@ -248,7 +261,7 @@ static struct intel_vgpu *__intel_gvt_create_vgpu(struct intel_gvt *gvt,
         if (ret)
                 goto out_detach_hypervisor_vgpu;
 
-        ret = intel_vgpu_init_display(vgpu);
+        ret = intel_vgpu_init_display(vgpu, param->resolution);
         if (ret)
                 goto out_clean_gtt;
 
@@ -312,6 +325,7 @@ struct intel_vgpu *intel_gvt_create_vgpu(struct intel_gvt *gvt,
         param.low_gm_sz = type->low_gm_size;
         param.high_gm_sz = type->high_gm_size;
         param.fence_sz = type->fence;
+        param.resolution = type->resolution;
 
         /* XXX current param based on MB */
         param.low_gm_sz = BYTES_TO_MB(param.low_gm_sz);
@@ -387,8 +401,12 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
                 populate_pvinfo_page(vgpu);
                 intel_vgpu_reset_display(vgpu);
 
-                if (dmlr)
+                if (dmlr) {
                         intel_vgpu_reset_cfg_space(vgpu);
+                        /* only reset the failsafe mode when dmlr reset */
+                        vgpu->failsafe = false;
+                        vgpu->pv_notified = false;
+                }
         }
 
         vgpu->resetting = false;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index e703556eba99..1c75402a59c1 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -248,6 +248,7 @@ static int i915_getparam(struct drm_device *dev, void *data,
         case I915_PARAM_IRQ_ACTIVE:
         case I915_PARAM_ALLOW_BATCHBUFFER:
         case I915_PARAM_LAST_DISPATCH:
+        case I915_PARAM_HAS_EXEC_CONSTANTS:
                 /* Reject all old ums/dri params. */
                 return -ENODEV;
         case I915_PARAM_CHIPSET_ID:
@@ -274,9 +275,6 @@ static int i915_getparam(struct drm_device *dev, void *data,
         case I915_PARAM_HAS_BSD2:
                 value = !!dev_priv->engine[VCS2];
                 break;
-        case I915_PARAM_HAS_EXEC_CONSTANTS:
-                value = INTEL_GEN(dev_priv) >= 4;
-                break;
         case I915_PARAM_HAS_LLC:
                 value = HAS_LLC(dev_priv);
                 break;
@@ -1788,7 +1786,7 @@ void i915_reset(struct drm_i915_private *dev_priv)
                 goto error;
         }
 
-        i915_gem_reset_finish(dev_priv);
+        i915_gem_reset(dev_priv);
         intel_overlay_reset(dev_priv);
 
         /* Ok, now get things going again... */
@@ -1814,6 +1812,7 @@ void i915_reset(struct drm_i915_private *dev_priv)
         i915_queue_hangcheck(dev_priv);
 
 wakeup:
+        i915_gem_reset_finish(dev_priv);
         enable_irq(dev_priv->drm.irq);
         wake_up_bit(&error->flags, I915_RESET_IN_PROGRESS);
         return;
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 0a4b42d31391..1e53c31b6826 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -293,6 +293,7 @@ enum plane_id {
         PLANE_PRIMARY,
         PLANE_SPRITE0,
         PLANE_SPRITE1,
+        PLANE_SPRITE2,
         PLANE_CURSOR,
         I915_MAX_PLANES,
 };
@@ -1324,7 +1325,7 @@ struct intel_gen6_power_mgmt {
         unsigned boosts;
 
         /* manual wa residency calculations */
-        struct intel_rps_ei up_ei, down_ei;
+        struct intel_rps_ei ei;
 
         /*
          * Protects RPS/RC6 register access and PCU communication.
@@ -2063,8 +2064,6 @@ struct drm_i915_private {
 
         const struct intel_device_info info;
 
-        int relative_constants_mode;
-
         void __iomem *regs;
 
         struct intel_uncore uncore;
@@ -3341,6 +3340,7 @@ static inline u32 i915_reset_count(struct i915_gpu_error *error)
 }
 
 int i915_gem_reset_prepare(struct drm_i915_private *dev_priv);
+void i915_gem_reset(struct drm_i915_private *dev_priv);
 void i915_gem_reset_finish(struct drm_i915_private *dev_priv);
 void i915_gem_set_wedged(struct drm_i915_private *dev_priv);
 void i915_gem_clflush_object(struct drm_i915_gem_object *obj, bool force);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 6908123162d1..67b1fc5a0331 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1434,6 +1434,12 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
 
         trace_i915_gem_object_pwrite(obj, args->offset, args->size);
 
+        ret = -ENODEV;
+        if (obj->ops->pwrite)
+                ret = obj->ops->pwrite(obj, args);
+        if (ret != -ENODEV)
+                goto err;
+
         ret = i915_gem_object_wait(obj,
                                    I915_WAIT_INTERRUPTIBLE |
                                    I915_WAIT_ALL,
@@ -2119,6 +2125,7 @@ i915_gem_object_truncate(struct drm_i915_gem_object *obj)
          */
         shmem_truncate_range(file_inode(obj->base.filp), 0, (loff_t)-1);
         obj->mm.madv = __I915_MADV_PURGED;
+        obj->mm.pages = ERR_PTR(-EFAULT);
 }
 
 /* Try to discard unwanted pages */
@@ -2218,7 +2225,9 @@ void __i915_gem_object_put_pages(struct drm_i915_gem_object *obj,
 
         __i915_gem_object_reset_page_iter(obj);
 
-        obj->ops->put_pages(obj, pages);
+        if (!IS_ERR(pages))
+                obj->ops->put_pages(obj, pages);
+
 unlock:
         mutex_unlock(&obj->mm.lock);
 }
@@ -2437,7 +2446,7 @@ int __i915_gem_object_get_pages(struct drm_i915_gem_object *obj)
         if (err)
                 return err;
 
-        if (unlikely(!obj->mm.pages)) {
+        if (unlikely(IS_ERR_OR_NULL(obj->mm.pages))) {
                 err = ____i915_gem_object_get_pages(obj);
                 if (err)
                         goto unlock;
@@ -2515,7 +2524,7 @@ void *i915_gem_object_pin_map(struct drm_i915_gem_object *obj,
 
         pinned = true;
         if (!atomic_inc_not_zero(&obj->mm.pages_pin_count)) {
-                if (unlikely(!obj->mm.pages)) {
+                if (unlikely(IS_ERR_OR_NULL(obj->mm.pages))) {
                         ret = ____i915_gem_object_get_pages(obj);
                         if (ret)
                                 goto err_unlock;
@@ -2563,6 +2572,75 @@ err_unlock:
         goto out_unlock;
 }
 
+static int
+i915_gem_object_pwrite_gtt(struct drm_i915_gem_object *obj,
+                           const struct drm_i915_gem_pwrite *arg)
+{
+        struct address_space *mapping = obj->base.filp->f_mapping;
+        char __user *user_data = u64_to_user_ptr(arg->data_ptr);
+        u64 remain, offset;
+        unsigned int pg;
+
+        /* Before we instantiate/pin the backing store for our use, we
+         * can prepopulate the shmemfs filp efficiently using a write into
+         * the pagecache. We avoid the penalty of instantiating all the
+         * pages, important if the user is just writing to a few and never
+         * uses the object on the GPU, and using a direct write into shmemfs
+         * allows it to avoid the cost of retrieving a page (either swapin
+         * or clearing-before-use) before it is overwritten.
+         */
+        if (READ_ONCE(obj->mm.pages))
+                return -ENODEV;
+
+        /* Before the pages are instantiated the object is treated as being
+         * in the CPU domain. The pages will be clflushed as required before
+         * use, and we can freely write into the pages directly. If userspace
+         * races pwrite with any other operation; corruption will ensue -
+         * that is userspace's prerogative!
+         */
+
+        remain = arg->size;
+        offset = arg->offset;
+        pg = offset_in_page(offset);
+
+        do {
+                unsigned int len, unwritten;
+                struct page *page;
+                void *data, *vaddr;
+                int err;
+
+                len = PAGE_SIZE - pg;
+                if (len > remain)
+                        len = remain;
+
+                err = pagecache_write_begin(obj->base.filp, mapping,
+                                            offset, len, 0,
+                                            &page, &data);
+                if (err < 0)
+                        return err;
+
+                vaddr = kmap(page);
+                unwritten = copy_from_user(vaddr + pg, user_data, len);
+                kunmap(page);
+
+                err = pagecache_write_end(obj->base.filp, mapping,
+                                          offset, len, len - unwritten,
+                                          page, data);
+                if (err < 0)
+                        return err;
+
+                if (unwritten)
+                        return -EFAULT;
+
+                remain -= len;
+                user_data += len;
+                offset += len;
+                pg = 0;
+        } while (remain);
+
+        return 0;
+}
+
 static bool ban_context(const struct i915_gem_context *ctx)
 {
         return (i915_gem_context_is_bannable(ctx) &&
@@ -2641,7 +2719,16 @@ int i915_gem_reset_prepare(struct drm_i915_private *dev_priv)
         for_each_engine(engine, dev_priv, id) {
                 struct drm_i915_gem_request *request;
 
+                /* Prevent request submission to the hardware until we have
+                 * completed the reset in i915_gem_reset_finish(). If a request
+                 * is completed by one engine, it may then queue a request
+                 * to a second via its engine->irq_tasklet *just* as we are
+                 * calling engine->init_hw() and also writing the ELSP.
+                 * Turning off the engine->irq_tasklet until the reset is over
+                 * prevents the race.
+                 */
                 tasklet_kill(&engine->irq_tasklet);
+                tasklet_disable(&engine->irq_tasklet);
 
                 if (engine_stalled(engine)) {
                         request = i915_gem_find_active_request(engine);
@@ -2756,7 +2843,7 @@ static void i915_gem_reset_engine(struct intel_engine_cs *engine)
         engine->reset_hw(engine, request);
 }
 
-void i915_gem_reset_finish(struct drm_i915_private *dev_priv)
+void i915_gem_reset(struct drm_i915_private *dev_priv)
 {
         struct intel_engine_cs *engine;
         enum intel_engine_id id;
@@ -2778,6 +2865,17 @@ void i915_gem_reset_finish(struct drm_i915_private *dev_priv)
         }
 }
 
+void i915_gem_reset_finish(struct drm_i915_private *dev_priv)
+{
+        struct intel_engine_cs *engine;
+        enum intel_engine_id id;
+
+        lockdep_assert_held(&dev_priv->drm.struct_mutex);
+
+        for_each_engine(engine, dev_priv, id)
+                tasklet_enable(&engine->irq_tasklet);
+}
+
 static void nop_submit_request(struct drm_i915_gem_request *request)
 {
         dma_fence_set_error(&request->fence, -EIO);
@@ -3029,6 +3127,16 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
                 args->timeout_ns -= ktime_to_ns(ktime_sub(ktime_get(), start));
                 if (args->timeout_ns < 0)
                         args->timeout_ns = 0;
+
+                /*
+                 * Apparently ktime isn't accurate enough and occasionally has a
+                 * bit of mismatch in the jiffies<->nsecs<->ktime loop. So patch
+                 * things up to make the test happy. We allow up to 1 jiffy.
+                 *
+                 * This is a regression from the timespec->ktime conversion.
+                 */
+                if (ret == -ETIME && !nsecs_to_jiffies(args->timeout_ns))
+                        args->timeout_ns = 0;
         }
 
         i915_gem_object_put(obj);
@@ -3974,8 +4082,11 @@ void i915_gem_object_init(struct drm_i915_gem_object *obj,
 static const struct drm_i915_gem_object_ops i915_gem_object_ops = {
         .flags = I915_GEM_OBJECT_HAS_STRUCT_PAGE |
                  I915_GEM_OBJECT_IS_SHRINKABLE,
+
         .get_pages = i915_gem_object_get_pages_gtt,
         .put_pages = i915_gem_object_put_pages_gtt,
+
+        .pwrite = i915_gem_object_pwrite_gtt,
 };
 
 struct drm_i915_gem_object *
@@ -4583,8 +4694,6 @@ i915_gem_load_init(struct drm_i915_private *dev_priv)
         init_waitqueue_head(&dev_priv->gpu_error.wait_queue);
         init_waitqueue_head(&dev_priv->gpu_error.reset_queue);
 
-        dev_priv->relative_constants_mode = I915_EXEC_CONSTANTS_REL_GENERAL;
-
         init_waitqueue_head(&dev_priv->pending_flip_queue);
 
         dev_priv->mm.interruptible = true;
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 17f90c618208..e2d83b6d376b 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -311,7 +311,6 @@ __create_hw_context(struct drm_i915_private *dev_priv,
         ctx->ring_size = 4 * PAGE_SIZE;
         ctx->desc_template = GEN8_CTX_ADDRESSING_MODE(dev_priv) <<
                              GEN8_CTX_ADDRESSING_MODE_SHIFT;
-        ATOMIC_INIT_NOTIFIER_HEAD(&ctx->status_notifier);
 
         /* GuC requires the ring to be placed above GUC_WOPCM_TOP. If GuC is not
          * present or not in use we still need a small bias as ring wraparound
diff --git a/drivers/gpu/drm/i915/i915_gem_context.h b/drivers/gpu/drm/i915/i915_gem_context.h
index 0ac750b90f3d..e9c008fe14b1 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.h
+++ b/drivers/gpu/drm/i915/i915_gem_context.h
@@ -160,9 +160,6 @@ struct i915_gem_context {
         /** desc_template: invariant fields for the HW context descriptor */
         u32 desc_template;
 
-        /** status_notifier: list of callbacks for context-switch changes */
-        struct atomic_notifier_head status_notifier;
-
         /** guilty_count: How many times this context has caused a GPU hang. */
         unsigned int guilty_count;
         /**
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index c181b1bb3d2c..3be2503aa042 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -293,12 +293,12 @@ int i915_gem_evict_for_node(struct i915_address_space *vm,
                  * those as well to make room for our guard pages.
                  */
                 if (check_color) {
-                        if (vma->node.start + vma->node.size == node->start) {
-                                if (vma->node.color == node->color)
+                        if (node->start + node->size == target->start) {
+                                if (node->color == target->color)
                                         continue;
                         }
-                        if (vma->node.start == node->start + node->size) {
-                                if (vma->node.color == node->color)
+                        if (node->start == target->start + target->size) {
+                                if (node->color == target->color)
                                         continue;
                         }
                 }
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index d02cfaefe1c8..30e0675fd7da 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1408,10 +1408,7 @@ execbuf_submit(struct i915_execbuffer_params *params,
                struct drm_i915_gem_execbuffer2 *args,
                struct list_head *vmas)
 {
-        struct drm_i915_private *dev_priv = params->request->i915;
         u64 exec_start, exec_len;
-        int instp_mode;
-        u32 instp_mask;
         int ret;
 
         ret = i915_gem_execbuffer_move_to_gpu(params->request, vmas);
@@ -1422,56 +1419,11 @@ execbuf_submit(struct i915_execbuffer_params *params,
         if (ret)
                 return ret;
 
-        instp_mode = args->flags & I915_EXEC_CONSTANTS_MASK;
-        instp_mask = I915_EXEC_CONSTANTS_MASK;
-        switch (instp_mode) {
-        case I915_EXEC_CONSTANTS_REL_GENERAL:
-        case I915_EXEC_CONSTANTS_ABSOLUTE:
-        case I915_EXEC_CONSTANTS_REL_SURFACE:
-                if (instp_mode != 0 && params->engine->id != RCS) {
-                        DRM_DEBUG("non-0 rel constants mode on non-RCS\n");
-                        return -EINVAL;
-                }
-
-                if (instp_mode != dev_priv->relative_constants_mode) {
-                        if (INTEL_INFO(dev_priv)->gen < 4) {
-                                DRM_DEBUG("no rel constants on pre-gen4\n");
-                                return -EINVAL;
-                        }
-
-                        if (INTEL_INFO(dev_priv)->gen > 5 &&
-                            instp_mode == I915_EXEC_CONSTANTS_REL_SURFACE) {
-                                DRM_DEBUG("rel surface constants mode invalid on gen5+\n");
-                                return -EINVAL;
-                        }
-
-                        /* The HW changed the meaning on this bit on gen6 */
-                        if (INTEL_INFO(dev_priv)->gen >= 6)
-                                instp_mask &= ~I915_EXEC_CONSTANTS_REL_SURFACE;
-                }
-                break;
-        default:
-                DRM_DEBUG("execbuf with unknown constants: %d\n", instp_mode);
+        if (args->flags & I915_EXEC_CONSTANTS_MASK) {
+                DRM_DEBUG("I915_EXEC_CONSTANTS_* unsupported\n");
                 return -EINVAL;
         }
 
-        if (params->engine->id == RCS &&
-            instp_mode != dev_priv->relative_constants_mode) {
-                struct intel_ring *ring = params->request->ring;
-
-                ret = intel_ring_begin(params->request, 4);
-                if (ret)
-                        return ret;
-
-                intel_ring_emit(ring, MI_NOOP);
-                intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1));
-                intel_ring_emit_reg(ring, INSTPM);
-                intel_ring_emit(ring, instp_mask << 16 | instp_mode);
-                intel_ring_advance(ring);
-
-                dev_priv->relative_constants_mode = instp_mode;
-        }
-
         if (args->flags & I915_EXEC_GEN7_SOL_RESET) {
                 ret = i915_reset_gen7_sol_offsets(params->request);
                 if (ret)
diff --git a/drivers/gpu/drm/i915/i915_gem_object.h b/drivers/gpu/drm/i915/i915_gem_object.h
index bf90b07163d1..76b80a0be797 100644
--- a/drivers/gpu/drm/i915/i915_gem_object.h
+++ b/drivers/gpu/drm/i915/i915_gem_object.h
@@ -54,6 +54,9 @@ struct drm_i915_gem_object_ops {
         struct sg_table *(*get_pages)(struct drm_i915_gem_object *);
         void (*put_pages)(struct drm_i915_gem_object *, struct sg_table *);
 
+        int (*pwrite)(struct drm_i915_gem_object *,
+                      const struct drm_i915_gem_pwrite *);
+
         int (*dmabuf_export)(struct drm_i915_gem_object *);
         void (*release)(struct drm_i915_gem_object *);
 };
diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
index 401006b4c6a3..d5d2b4c6ed38 100644
--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -263,7 +263,7 @@ unsigned long i915_gem_shrink_all(struct drm_i915_private *dev_priv)
                                 I915_SHRINK_BOUND |
                                 I915_SHRINK_UNBOUND |
                                 I915_SHRINK_ACTIVE);
-        rcu_barrier(); /* wait until our RCU delayed slab frees are completed */
+        synchronize_rcu(); /* wait for our earlier RCU delayed slab frees */
 
         return freed;
 }
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index e6ffef2f707a..b6c886ac901b 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1046,68 +1046,51 @@ static void vlv_c0_read(struct drm_i915_private *dev_priv,
         ei->media_c0 = I915_READ(VLV_MEDIA_C0_COUNT);
 }
 
-static bool vlv_c0_above(struct drm_i915_private *dev_priv,
-                         const struct intel_rps_ei *old,
-                         const struct intel_rps_ei *now,
-                         int threshold)
-{
-        u64 time, c0;
-        unsigned int mul = 100;
-
-        if (old->cz_clock == 0)
-                return false;
-
-        if (I915_READ(VLV_COUNTER_CONTROL) & VLV_COUNT_RANGE_HIGH)
-                mul <<= 8;
-
-        time = now->cz_clock - old->cz_clock;
-        time *= threshold * dev_priv->czclk_freq;
-
-        /* Workload can be split between render + media, e.g. SwapBuffers
-         * being blitted in X after being rendered in mesa. To account for
-         * this we need to combine both engines into our activity counter.
-         */
-        c0 = now->render_c0 - old->render_c0;
-        c0 += now->media_c0 - old->media_c0;
-        c0 *= mul * VLV_CZ_CLOCK_TO_MILLI_SEC;
-
-        return c0 >= time;
-}
-
 void gen6_rps_reset_ei(struct drm_i915_private *dev_priv)
 {
-        vlv_c0_read(dev_priv, &dev_priv->rps.down_ei);
-        dev_priv->rps.up_ei = dev_priv->rps.down_ei;
+        memset(&dev_priv->rps.ei, 0, sizeof(dev_priv->rps.ei));
 }
 
 static u32 vlv_wa_c0_ei(struct drm_i915_private *dev_priv, u32 pm_iir)
 {
+        const struct intel_rps_ei *prev = &dev_priv->rps.ei;
         struct intel_rps_ei now;
         u32 events = 0;
 
-        if ((pm_iir & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED)) == 0)
+        if ((pm_iir & GEN6_PM_RP_UP_EI_EXPIRED) == 0)
                 return 0;
 
         vlv_c0_read(dev_priv, &now);
         if (now.cz_clock == 0)
                 return 0;
 
-        if (pm_iir & GEN6_PM_RP_DOWN_EI_EXPIRED) {
-                if (!vlv_c0_above(dev_priv,
-                                  &dev_priv->rps.down_ei, &now,
-                                  dev_priv->rps.down_threshold))
-                        events |= GEN6_PM_RP_DOWN_THRESHOLD;
-                dev_priv->rps.down_ei = now;
-        }
+        if (prev->cz_clock) {
+                u64 time, c0;
+                unsigned int mul;
+
+                mul = VLV_CZ_CLOCK_TO_MILLI_SEC * 100; /* scale to threshold% */
+                if (I915_READ(VLV_COUNTER_CONTROL) & VLV_COUNT_RANGE_HIGH)
+                        mul <<= 8;
 
-        if (pm_iir & GEN6_PM_RP_UP_EI_EXPIRED) {
-                if (vlv_c0_above(dev_priv,
-                                 &dev_priv->rps.up_ei, &now,
-                                 dev_priv->rps.up_threshold))
-                        events |= GEN6_PM_RP_UP_THRESHOLD;
-                dev_priv->rps.up_ei = now;
+                time = now.cz_clock - prev->cz_clock;
+                time *= dev_priv->czclk_freq;
+
+                /* Workload can be split between render + media,
+                 * e.g. SwapBuffers being blitted in X after being rendered in
+                 * mesa. To account for this we need to combine both engines
+                 * into our activity counter.
+                 */
+                c0 = now.render_c0 - prev->render_c0;
+                c0 += now.media_c0 - prev->media_c0;
+                c0 *= mul;
+
+                if (c0 > time * dev_priv->rps.up_threshold)
+                        events = GEN6_PM_RP_UP_THRESHOLD;
+                else if (c0 < time * dev_priv->rps.down_threshold)
+                        events = GEN6_PM_RP_DOWN_THRESHOLD;
         }
 
+        dev_priv->rps.ei = now;
         return events;
 }
 
@@ -4228,7 +4211,7 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
         /* Let's track the enabled rps events */
         if (IS_VALLEYVIEW(dev_priv))
                 /* WaGsvRC0ResidencyMethod:vlv */
-                dev_priv->pm_rps_events = GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED;
+                dev_priv->pm_rps_events = GEN6_PM_RP_UP_EI_EXPIRED;
         else
                 dev_priv->pm_rps_events = GEN6_PM_RPS_EVENTS;
 
@@ -4266,6 +4249,16 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
         if (!IS_GEN2(dev_priv))
                 dev->vblank_disable_immediate = true;
 
+        /* Most platforms treat the display irq block as an always-on
+         * power domain. vlv/chv can disable it at runtime and need
+         * special care to avoid writing any of the display block registers
+         * outside of the power domain. We defer setting up the display irqs
+         * in this case to the runtime pm.
+         */
+        dev_priv->display_irqs_enabled = true;
+        if (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv))
+                dev_priv->display_irqs_enabled = false;
+
         dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
         dev->driver->get_scanout_position = i915_get_crtc_scanoutpos;
 
diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
index 155906e84812..df20e9bc1c0f 100644
--- a/drivers/gpu/drm/i915/i915_vma.c
+++ b/drivers/gpu/drm/i915/i915_vma.c
@@ -512,10 +512,36 @@ err_unpin:
         return ret;
 }
 
+static void
+i915_vma_remove(struct i915_vma *vma)
+{
+        struct drm_i915_gem_object *obj = vma->obj;
+
+        GEM_BUG_ON(!drm_mm_node_allocated(&vma->node));
+        GEM_BUG_ON(vma->flags & (I915_VMA_GLOBAL_BIND | I915_VMA_LOCAL_BIND));
+
+        drm_mm_remove_node(&vma->node);
+        list_move_tail(&vma->vm_link, &vma->vm->unbound_list);
+
+        /* Since the unbound list is global, only move to that list if
+         * no more VMAs exist.
+         */
+        if (--obj->bind_count == 0)
+                list_move_tail(&obj->global_link,
+                               &to_i915(obj->base.dev)->mm.unbound_list);
+
+        /* And finally now the object is completely decoupled from this vma,
+         * we can drop its hold on the backing storage and allow it to be
+         * reaped by the shrinker.
+         */
+        i915_gem_object_unpin_pages(obj);
+        GEM_BUG_ON(atomic_read(&obj->mm.pages_pin_count) < obj->bind_count);
+}
+
 int __i915_vma_do_pin(struct i915_vma *vma,
                       u64 size, u64 alignment, u64 flags)
 {
-        unsigned int bound = vma->flags;
+        const unsigned int bound = vma->flags;
         int ret;
 
         lockdep_assert_held(&vma->vm->i915->drm.struct_mutex);
@@ -524,18 +550,18 @@ int __i915_vma_do_pin(struct i915_vma *vma,
 
         if (WARN_ON(bound & I915_VMA_PIN_OVERFLOW)) {
                 ret = -EBUSY;
-                goto err;
+                goto err_unpin;
         }
 
         if ((bound & I915_VMA_BIND_MASK) == 0) {
                 ret = i915_vma_insert(vma, size, alignment, flags);
                 if (ret)
-                        goto err;
+                        goto err_unpin;
         }
 
         ret = i915_vma_bind(vma, vma->obj->cache_level, flags);
         if (ret)
-                goto err;
+                goto err_remove;
 
         if ((bound ^ vma->flags) & I915_VMA_GLOBAL_BIND)
                 __i915_vma_set_map_and_fenceable(vma);
@@ -544,7 +570,12 @@ int __i915_vma_do_pin(struct i915_vma *vma,
         GEM_BUG_ON(i915_vma_misplaced(vma, size, alignment, flags));
         return 0;
 
-err:
+err_remove:
+        if ((bound & I915_VMA_BIND_MASK) == 0) {
+                GEM_BUG_ON(vma->pages);
+                i915_vma_remove(vma);
+        }
+err_unpin:
         __i915_vma_unpin(vma);
         return ret;
 }
@@ -657,9 +688,6 @@ int i915_vma_unbind(struct i915_vma *vma)
         }
         vma->flags &= ~(I915_VMA_GLOBAL_BIND | I915_VMA_LOCAL_BIND);
 
-        drm_mm_remove_node(&vma->node);
-        list_move_tail(&vma->vm_link, &vma->vm->unbound_list);
-
         if (vma->pages != obj->mm.pages) {
                 GEM_BUG_ON(!vma->pages);
                 sg_free_table(vma->pages);
@@ -667,18 +695,7 @@ int i915_vma_unbind(struct i915_vma *vma)
         }
         vma->pages = NULL;
 
-        /* Since the unbound list is global, only move to that list if
-         * no more VMAs exist. */
-        if (--obj->bind_count == 0)
-                list_move_tail(&obj->global_link,
-                               &to_i915(obj->base.dev)->mm.unbound_list);
-
-        /* And finally now the object is completely decoupled from this vma,
-         * we can drop its hold on the backing storage and allow it to be
-         * reaped by the shrinker.
-         */
-        i915_gem_object_unpin_pages(obj);
-        GEM_BUG_ON(atomic_read(&obj->mm.pages_pin_count) < obj->bind_count);
+        i915_vma_remove(vma);
 
 destroy:
         if (unlikely(i915_vma_is_closed(vma)))
diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
index 0085bc745f6a..de219b71fb76 100644
--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -35,7 +35,6 @@
  */
 
 #define I915_CSR_GLK "i915/glk_dmc_ver1_01.bin"
-MODULE_FIRMWARE(I915_CSR_GLK);
 #define GLK_CSR_VERSION_REQUIRED        CSR_VERSION(1, 1)
 
 #define I915_CSR_KBL "i915/kbl_dmc_ver1_01.bin"
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 01341670738f..ed1f4f272b4f 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3669,10 +3669,6 @@ static void intel_update_pipe_config(struct intel_crtc *crtc,
         /* drm_atomic_helper_update_legacy_modeset_state might not be called. */
         crtc->base.mode = crtc->base.state->mode;
 
-        DRM_DEBUG_KMS("Updating pipe size %ix%i -> %ix%i\n",
-                      old_crtc_state->pipe_src_w, old_crtc_state->pipe_src_h,
-                      pipe_config->pipe_src_w, pipe_config->pipe_src_h);
-
         /*
          * Update pipe size and adjust fitter if needed: the reason for this is
          * that in compute_mode_changes we check the native mode (not the pfit
@@ -4796,23 +4792,17 @@ static void skylake_pfit_enable(struct intel_crtc *crtc)
         struct intel_crtc_scaler_state *scaler_state =
                 &crtc->config->scaler_state;
 
-        DRM_DEBUG_KMS("for crtc_state = %p\n", crtc->config);
-
         if (crtc->config->pch_pfit.enabled) {
                 int id;
 
-                if (WARN_ON(crtc->config->scaler_state.scaler_id < 0)) {
-                        DRM_ERROR("Requesting pfit without getting a scaler first\n");
+                if (WARN_ON(crtc->config->scaler_state.scaler_id < 0))
                         return;
-                }
 
                 id = scaler_state->scaler_id;
                 I915_WRITE(SKL_PS_CTRL(pipe, id), PS_SCALER_EN |
                         PS_FILTER_MEDIUM | scaler_state->scalers[id].mode);
                 I915_WRITE(SKL_PS_WIN_POS(pipe, id), crtc->config->pch_pfit.pos);
                 I915_WRITE(SKL_PS_WIN_SZ(pipe, id), crtc->config->pch_pfit.size);
-
-                DRM_DEBUG_KMS("for crtc_state = %p scaler_id = %d\n", crtc->config, id);
         }
 }
 
@@ -14379,6 +14369,24 @@ static void skl_update_crtcs(struct drm_atomic_state *state,
         } while (progress);
 }
 
+static void intel_atomic_helper_free_state(struct drm_i915_private *dev_priv)
+{
+        struct intel_atomic_state *state, *next;
+        struct llist_node *freed;
+
+        freed = llist_del_all(&dev_priv->atomic_helper.free_list);
+        llist_for_each_entry_safe(state, next, freed, freed)
+                drm_atomic_state_put(&state->base);
+}
+
+static void intel_atomic_helper_free_state_worker(struct work_struct *work)
+{
+        struct drm_i915_private *dev_priv =
+                container_of(work, typeof(*dev_priv), atomic_helper.free_work);
+
+        intel_atomic_helper_free_state(dev_priv);
+}
+
 static void intel_atomic_commit_tail(struct drm_atomic_state *state)
 {
         struct drm_device *dev = state->dev;
@@ -14545,6 +14553,8 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
          * can happen also when the device is completely off.
          */
         intel_uncore_arm_unclaimed_mmio_detection(dev_priv);
+
+        intel_atomic_helper_free_state(dev_priv);
 }
 
 static void intel_atomic_commit_work(struct work_struct *work)
@@ -14946,17 +14956,19 @@ static void intel_begin_crtc_commit(struct drm_crtc *crtc,
                 to_intel_atomic_state(old_crtc_state->state);
         bool modeset = needs_modeset(crtc->state);
 
+        if (!modeset &&
+            (intel_cstate->base.color_mgmt_changed ||
+             intel_cstate->update_pipe)) {
+                intel_color_set_csc(crtc->state);
+                intel_color_load_luts(crtc->state);
+        }
+
         /* Perform vblank evasion around commit operation */
         intel_pipe_update_start(intel_crtc);
 
         if (modeset)
                 goto out;
 
-        if (crtc->state->color_mgmt_changed || to_intel_crtc_state(crtc->state)->update_pipe) {
-                intel_color_set_csc(crtc->state);
-                intel_color_load_luts(crtc->state);
-        }
-
         if (intel_cstate->update_pipe)
                 intel_update_pipe_config(intel_crtc, old_intel_cstate);
         else if (INTEL_GEN(dev_priv) >= 9)
@@ -16599,18 +16611,6 @@ fail:
         drm_modeset_acquire_fini(&ctx);
 }
 
-static void intel_atomic_helper_free_state(struct work_struct *work)
-{
-        struct drm_i915_private *dev_priv =
-                container_of(work, typeof(*dev_priv), atomic_helper.free_work);
-        struct intel_atomic_state *state, *next;
-        struct llist_node *freed;
-
-        freed = llist_del_all(&dev_priv->atomic_helper.free_list);
-        llist_for_each_entry_safe(state, next, freed, freed)
-                drm_atomic_state_put(&state->base);
-}
-
 int intel_modeset_init(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
@@ -16631,7 +16631,7 @@ int intel_modeset_init(struct drm_device *dev)
         dev->mode_config.funcs = &intel_mode_funcs;
 
         INIT_WORK(&dev_priv->atomic_helper.free_work,
-                  intel_atomic_helper_free_state);
+                  intel_atomic_helper_free_state_worker);
 
         intel_init_quirks(dev);
 
@@ -16696,12 +16696,11 @@ int intel_modeset_init(struct drm_device *dev)
                 }
         }
 
-        intel_update_czclk(dev_priv);
-        intel_update_cdclk(dev_priv);
-        dev_priv->atomic_cdclk_freq = dev_priv->cdclk_freq;
-
         intel_shared_dpll_init(dev);
 
+        intel_update_czclk(dev_priv);
+        intel_modeset_init_hw(dev);
+
         if (dev_priv->max_cdclk_freq == 0)
                 intel_update_max_cdclk(dev_priv);
 
@@ -17258,8 +17257,6 @@ void intel_modeset_gem_init(struct drm_device *dev)
 
         intel_init_gt_powersave(dev_priv);
 
-        intel_modeset_init_hw(dev);
-
         intel_setup_overlay(dev_priv);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index 371acf109e34..ab1be5c80ea5 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -105,6 +105,8 @@ intel_engine_setup(struct drm_i915_private *dev_priv,
         /* Nothing to do here, execute in order of dependencies */
         engine->schedule = NULL;
 
+        ATOMIC_INIT_NOTIFIER_HEAD(&engine->context_status_notifier);
+
         dev_priv->engine[id] = engine;
         return 0;
 }
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 1b8ba2e77539..2d449fb5d1d2 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -357,14 +357,13 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
                                     bool *enabled, int width, int height)
 {
         struct drm_i915_private *dev_priv = to_i915(fb_helper->dev);
-        unsigned long conn_configured, mask;
+        unsigned long conn_configured, conn_seq, mask;
         unsigned int count = min(fb_helper->connector_count, BITS_PER_LONG);
         int i, j;
         bool *save_enabled;
         bool fallback = true;
         int num_connectors_enabled = 0;
         int num_connectors_detected = 0;
-        int pass = 0;
 
         save_enabled = kcalloc(count, sizeof(bool), GFP_KERNEL);
         if (!save_enabled)
@@ -374,6 +373,7 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
         mask = BIT(count) - 1;
         conn_configured = 0;
 retry:
+        conn_seq = conn_configured;
         for (i = 0; i < count; i++) {
                 struct drm_fb_helper_connector *fb_conn;
                 struct drm_connector *connector;
@@ -387,7 +387,7 @@ retry:
                 if (conn_configured & BIT(i))
                         continue;
 
-                if (pass == 0 && !connector->has_tile)
+                if (conn_seq == 0 && !connector->has_tile)
                         continue;
 
                 if (connector->status == connector_status_connected)
@@ -498,10 +498,8 @@ retry:
                 conn_configured |= BIT(i);
         }
 
-        if ((conn_configured & mask) != mask) {
-                pass++;
+        if ((conn_configured & mask) != mask && conn_configured != conn_seq)
                 goto retry;
-        }
 
         /*
          * If the BIOS didn't enable everything it could, fall back to have the
diff --git a/drivers/gpu/drm/i915/intel_gvt.c b/drivers/gpu/drm/i915/intel_gvt.c
index d23c0fcff751..8c04eca84351 100644
--- a/drivers/gpu/drm/i915/intel_gvt.c
+++ b/drivers/gpu/drm/i915/intel_gvt.c
@@ -77,6 +77,11 @@ int intel_gvt_init(struct drm_i915_private *dev_priv)
                 goto bail;
         }
 
+        if (!i915.enable_execlists) {
+                DRM_INFO("GPU guest virtualisation [GVT-g] disabled due to disabled execlist submission [i915.enable_execlists module parameter]\n");
+                goto bail;
+        }
+
         /*
          * We're not in host or fail to find a MPT module, disable GVT-g
          */
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index ebae2bd83918..24b2fa5b6282 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -1298,16 +1298,34 @@ intel_hdmi_mode_valid(struct drm_connector *connector,
 
 static bool hdmi_12bpc_possible(struct intel_crtc_state *crtc_state)
 {
-        struct drm_device *dev = crtc_state->base.crtc->dev;
+        struct drm_i915_private *dev_priv =
+                to_i915(crtc_state->base.crtc->dev);
+        struct drm_atomic_state *state = crtc_state->base.state;
+        struct drm_connector_state *connector_state;
+        struct drm_connector *connector;
+        int i;
 
-        if (HAS_GMCH_DISPLAY(to_i915(dev)))
+        if (HAS_GMCH_DISPLAY(dev_priv))
                 return false;
 
         /*
          * HDMI 12bpc affects the clocks, so it's only possible
          * when not cloning with other encoder types.
          */
-        return crtc_state->output_types == 1 << INTEL_OUTPUT_HDMI;
+        if (crtc_state->output_types != 1 << INTEL_OUTPUT_HDMI)
+                return false;
+
+        for_each_connector_in_state(state, connector, connector_state, i) {
+                const struct drm_display_info *info = &connector->display_info;
+
+                if (connector_state->crtc != crtc_state->base.crtc)
+                        continue;
+
+                if ((info->edid_hdmi_dc_modes & DRM_EDID_HDMI_DC_36) == 0)
+                        return false;
+        }
+
+        return true;
 }
 
 bool intel_hdmi_compute_config(struct intel_encoder *encoder,
diff --git a/drivers/gpu/drm/i915/intel_hotplug.c b/drivers/gpu/drm/i915/intel_hotplug.c
index b62e3f8ad415..54208bef7a83 100644
--- a/drivers/gpu/drm/i915/intel_hotplug.c
+++ b/drivers/gpu/drm/i915/intel_hotplug.c
@@ -219,7 +219,7 @@ static void intel_hpd_irq_storm_reenable_work(struct work_struct *work)
                         }
                 }
         }
-        if (dev_priv->display.hpd_irq_setup)
+        if (dev_priv->display_irqs_enabled && dev_priv->display.hpd_irq_setup)
                 dev_priv->display.hpd_irq_setup(dev_priv);
         spin_unlock_irq(&dev_priv->irq_lock);
 
@@ -425,7 +425,7 @@ void intel_hpd_irq_handler(struct drm_i915_private *dev_priv,
                 }
         }
 
-        if (storm_detected)
+        if (storm_detected && dev_priv->display_irqs_enabled)
                 dev_priv->display.hpd_irq_setup(dev_priv);
         spin_unlock(&dev_priv->irq_lock);
 
@@ -471,10 +471,12 @@ void intel_hpd_init(struct drm_i915_private *dev_priv)
          * Interrupt setup is already guaranteed to be single-threaded, this is
          * just to make the assert_spin_locked checks happy.
          */
-        spin_lock_irq(&dev_priv->irq_lock);
-        if (dev_priv->display.hpd_irq_setup)
-                dev_priv->display.hpd_irq_setup(dev_priv);
-        spin_unlock_irq(&dev_priv->irq_lock);
+        if (dev_priv->display_irqs_enabled && dev_priv->display.hpd_irq_setup) {
+                spin_lock_irq(&dev_priv->irq_lock);
+                if (dev_priv->display_irqs_enabled)
+                        dev_priv->display.hpd_irq_setup(dev_priv);
+                spin_unlock_irq(&dev_priv->irq_lock);
+        }
 }
 
 static void i915_hpd_poll_init_work(struct work_struct *work)
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index ebf8023d21e6..471af3b480ad 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -345,7 +345,8 @@ execlists_context_status_change(struct drm_i915_gem_request *rq,
         if (!IS_ENABLED(CONFIG_DRM_I915_GVT))
                 return;
 
-        atomic_notifier_call_chain(&rq->ctx->status_notifier, status, rq);
+        atomic_notifier_call_chain(&rq->engine->context_status_notifier,
+                                   status, rq);
 }
 
 static void
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 249623d45be0..6a29784d2b41 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4891,6 +4891,12 @@ static void gen6_set_rps_thresholds(struct drm_i915_private *dev_priv, u8 val)
                 break;
         }
 
+        /* When byt can survive without system hang with dynamic
+         * sw freq adjustments, this restriction can be lifted.
+         */
+        if (IS_VALLEYVIEW(dev_priv))
+                goto skip_hw_write;
+
         I915_WRITE(GEN6_RP_UP_EI,
                    GT_INTERVAL_FROM_US(dev_priv, ei_up));
         I915_WRITE(GEN6_RP_UP_THRESHOLD,
@@ -4911,6 +4917,7 @@ static void gen6_set_rps_thresholds(struct drm_i915_private *dev_priv, u8 val)
                    GEN6_RP_UP_BUSY_AVG |
                    GEN6_RP_DOWN_IDLE_AVG);
 
+skip_hw_write:
         dev_priv->rps.power = new_power;
         dev_priv->rps.up_threshold = threshold_up;
         dev_priv->rps.down_threshold = threshold_down;
@@ -4921,8 +4928,9 @@ static u32 gen6_rps_pm_mask(struct drm_i915_private *dev_priv, u8 val)
 {
         u32 mask = 0;
 
+        /* We use UP_EI_EXPIRED interupts for both up/down in manual mode */
         if (val > dev_priv->rps.min_freq_softlimit)
-                mask |= GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT;
+                mask |= GEN6_PM_RP_UP_EI_EXPIRED | GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT;
         if (val < dev_priv->rps.max_freq_softlimit)
                 mask |= GEN6_PM_RP_UP_EI_EXPIRED | GEN6_PM_RP_UP_THRESHOLD;
 
@@ -5032,7 +5040,7 @@ void gen6_rps_busy(struct drm_i915_private *dev_priv)
 {
         mutex_lock(&dev_priv->rps.hw_lock);
         if (dev_priv->rps.enabled) {
-                if (dev_priv->pm_rps_events & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED))
+                if (dev_priv->pm_rps_events & GEN6_PM_RP_UP_EI_EXPIRED)
                         gen6_rps_reset_ei(dev_priv);
                 I915_WRITE(GEN6_PMINTRMSK,
                            gen6_rps_pm_mask(dev_priv, dev_priv->rps.cur_freq));
@@ -7916,10 +7924,10 @@ static bool skl_pcode_try_request(struct drm_i915_private *dev_priv, u32 mbox,
  * @timeout_base_ms: timeout for polling with preemption enabled
  *
  * Keep resending the @request to @mbox until PCODE acknowledges it, PCODE
- * reports an error or an overall timeout of @timeout_base_ms+10 ms expires.
+ * reports an error or an overall timeout of @timeout_base_ms+50 ms expires.
  * The request is acknowledged once the PCODE reply dword equals @reply after
  * applying @reply_mask. Polling is first attempted with preemption enabled
- * for @timeout_base_ms and if this times out for another 10 ms with
+ * for @timeout_base_ms and if this times out for another 50 ms with
  * preemption disabled.
  *
  * Returns 0 on success, %-ETIMEDOUT in case of a timeout, <0 in case of some
@@ -7955,14 +7963,15 @@ int skl_pcode_request(struct drm_i915_private *dev_priv, u32 mbox, u32 request,
          * worst case) _and_ PCODE was busy for some reason even after a
          * (queued) request and @timeout_base_ms delay. As a workaround retry
          * the poll with preemption disabled to maximize the number of
-         * requests. Increase the timeout from @timeout_base_ms to 10ms to
+         * requests. Increase the timeout from @timeout_base_ms to 50ms to
          * account for interrupts that could reduce the number of these
-         * requests.
+         * requests, and for any quirks of the PCODE firmware that delays
+         * the request completion.
          */
         DRM_DEBUG_KMS("PCODE timeout, retrying with preemption disabled\n");
         WARN_ON_ONCE(timeout_base_ms > 3);
         preempt_disable();
-        ret = wait_for_atomic(COND, 10);
+        ret = wait_for_atomic(COND, 50);
         preempt_enable();
 
 out:
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 91bc4abf5d3e..6c5f9958197d 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -2024,6 +2024,8 @@ static int intel_ring_context_pin(struct intel_engine_cs *engine,
                 ret = context_pin(ctx, flags);
                 if (ret)
                         goto error;
+
+                ce->state->obj->mm.dirty = true;
         }
 
         /* The kernel context is only used as a placeholder for flushing the
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 79c2b8d72322..13dccb18cd43 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -403,6 +403,9 @@ struct intel_engine_cs {
          */
         struct i915_gem_context *legacy_active_context;
 
+        /* status_notifier: list of callbacks for context-switch changes */
+        struct atomic_notifier_head context_status_notifier;
+
         struct intel_engine_hangcheck hangcheck;
 
         bool needs_cmd_parser;
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 9ef54688872a..9481ca9a3ae7 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -254,9 +254,6 @@ skl_update_plane(struct drm_plane *drm_plane,
                 int scaler_id = plane_state->scaler_id;
                 const struct intel_scaler *scaler;
 
-                DRM_DEBUG_KMS("plane = %d PS_PLANE_SEL(plane) = 0x%x\n",
-                              plane_id, PS_PLANE_SEL(plane_id));
-
                 scaler = &crtc_state->scaler_state.scalers[scaler_id];
 
                 I915_WRITE(SKL_PS_CTRL(pipe, scaler_id),
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index abe08885a5ba..b7ff592b14f5 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -119,6 +119,8 @@ fw_domains_get(struct drm_i915_private *dev_priv, enum forcewake_domains fw_doma
 
         for_each_fw_domain_masked(d, fw_domains, dev_priv)
                 fw_domain_wait_ack(d);
+
+        dev_priv->uncore.fw_domains_active |= fw_domains;
 }
 
 static void
@@ -130,6 +132,8 @@ fw_domains_put(struct drm_i915_private *dev_priv, enum forcewake_domains fw_doma
                 fw_domain_put(d);
                 fw_domain_posting_read(d);
         }
+
+        dev_priv->uncore.fw_domains_active &= ~fw_domains;
 }
 
 static void
@@ -240,10 +244,8 @@ intel_uncore_fw_release_timer(struct hrtimer *timer)
         if (WARN_ON(domain->wake_count == 0))
                 domain->wake_count++;
 
-        if (--domain->wake_count == 0) {
+        if (--domain->wake_count == 0)
                 dev_priv->uncore.funcs.force_wake_put(dev_priv, domain->mask);
-                dev_priv->uncore.fw_domains_active &= ~domain->mask;
-        }
 
         spin_unlock_irqrestore(&dev_priv->uncore.lock, irqflags);
 
@@ -454,10 +456,8 @@ static void __intel_uncore_forcewake_get(struct drm_i915_private *dev_priv,
                         fw_domains &= ~domain->mask;
         }
 
-        if (fw_domains) {
+        if (fw_domains)
                 dev_priv->uncore.funcs.force_wake_get(dev_priv, fw_domains);
-                dev_priv->uncore.fw_domains_active |= fw_domains;
-        }
 }
 
 /**
@@ -968,7 +968,6 @@ static noinline void ___force_wake_auto(struct drm_i915_private *dev_priv,
                 fw_domain_arm_timer(domain);
 
         dev_priv->uncore.funcs.force_wake_get(dev_priv, fw_domains);
-        dev_priv->uncore.fw_domains_active |= fw_domains;
 }
 
 static inline void __force_wake_auto(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
index e10a4eda4078..1144e0c9e894 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
@@ -65,13 +65,11 @@ static int mxsfb_set_pixel_fmt(struct mxsfb_drm_private *mxsfb)
         switch (format) {
         case DRM_FORMAT_RGB565:
                 dev_dbg(drm->dev, "Setting up RGB565 mode\n");
-                ctrl |= CTRL_SET_BUS_WIDTH(STMLCDIF_16BIT);
                 ctrl |= CTRL_SET_WORD_LENGTH(0);
                 ctrl1 |= CTRL1_SET_BYTE_PACKAGING(0xf);
                 break;
         case DRM_FORMAT_XRGB8888:
                 dev_dbg(drm->dev, "Setting up XRGB8888 mode\n");
-                ctrl |= CTRL_SET_BUS_WIDTH(STMLCDIF_24BIT);
                 ctrl |= CTRL_SET_WORD_LENGTH(3);
                 /* Do not use packed pixels = one pixel per word instead. */
                 ctrl1 |= CTRL1_SET_BYTE_PACKAGING(0x7);
@@ -87,6 +85,36 @@ static int mxsfb_set_pixel_fmt(struct mxsfb_drm_private *mxsfb)
         return 0;
 }
 
+static void mxsfb_set_bus_fmt(struct mxsfb_drm_private *mxsfb)
+{
+        struct drm_crtc *crtc = &mxsfb->pipe.crtc;
+        struct drm_device *drm = crtc->dev;
+        u32 bus_format = MEDIA_BUS_FMT_RGB888_1X24;
+        u32 reg;
+
+        reg = readl(mxsfb->base + LCDC_CTRL);
+
+        if (mxsfb->connector.display_info.num_bus_formats)
+                bus_format = mxsfb->connector.display_info.bus_formats[0];
+
+        reg &= ~CTRL_BUS_WIDTH_MASK;
+        switch (bus_format) {
+        case MEDIA_BUS_FMT_RGB565_1X16:
+                reg |= CTRL_SET_BUS_WIDTH(STMLCDIF_16BIT);
+                break;
+        case MEDIA_BUS_FMT_RGB666_1X18:
+                reg |= CTRL_SET_BUS_WIDTH(STMLCDIF_18BIT);
+                break;
+        case MEDIA_BUS_FMT_RGB888_1X24:
+                reg |= CTRL_SET_BUS_WIDTH(STMLCDIF_24BIT);
+                break;
+        default:
+                dev_err(drm->dev, "Unknown media bus format %d\n", bus_format);
+                break;
+        }
+        writel(reg, mxsfb->base + LCDC_CTRL);
+}
+
 static void mxsfb_enable_controller(struct mxsfb_drm_private *mxsfb)
 {
         u32 reg;
@@ -168,13 +196,22 @@ static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
                 vdctrl0 |= VDCTRL0_HSYNC_ACT_HIGH;
         if (m->flags & DRM_MODE_FLAG_PVSYNC)
                 vdctrl0 |= VDCTRL0_VSYNC_ACT_HIGH;
-        if (bus_flags & DRM_BUS_FLAG_DE_HIGH)
+        /* Make sure Data Enable is high active by default */
+        if (!(bus_flags & DRM_BUS_FLAG_DE_LOW))
                 vdctrl0 |= VDCTRL0_ENABLE_ACT_HIGH;
-        if (bus_flags & DRM_BUS_FLAG_PIXDATA_NEGEDGE)
+        /*
+         * DRM_BUS_FLAG_PIXDATA_ defines are controller centric,
+         * controllers VDCTRL0_DOTCLK is display centric.
+         * Drive on positive edge       -> display samples on falling edge
+         * DRM_BUS_FLAG_PIXDATA_POSEDGE -> VDCTRL0_DOTCLK_ACT_FALLING
+         */
+        if (bus_flags & DRM_BUS_FLAG_PIXDATA_POSEDGE)
                 vdctrl0 |= VDCTRL0_DOTCLK_ACT_FALLING;
 
         writel(vdctrl0, mxsfb->base + LCDC_VDCTRL0);
 
+        mxsfb_set_bus_fmt(mxsfb);
+
         /* Frame length in lines. */
         writel(m->crtc_vtotal, mxsfb->base + LCDC_VDCTRL1);
 
@@ -184,8 +221,8 @@ static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
                VDCTRL2_SET_HSYNC_PERIOD(m->crtc_htotal),
                mxsfb->base + LCDC_VDCTRL2);
 
-        writel(SET_HOR_WAIT_CNT(m->crtc_hblank_end - m->crtc_hsync_end) |
-               SET_VERT_WAIT_CNT(m->crtc_vblank_end - m->crtc_vsync_end),
+        writel(SET_HOR_WAIT_CNT(m->crtc_htotal - m->crtc_hsync_start) |
+               SET_VERT_WAIT_CNT(m->crtc_vtotal - m->crtc_vsync_start),
                mxsfb->base + LCDC_VDCTRL3);
 
         writel(SET_DOTCLK_H_VALID_DATA_CNT(m->hdisplay),
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
index cdfbe0284635..ff6d6a6f842e 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
@@ -102,14 +102,18 @@ static void mxsfb_pipe_enable(struct drm_simple_display_pipe *pipe,
 {
         struct mxsfb_drm_private *mxsfb = drm_pipe_to_mxsfb_drm_private(pipe);
 
+        drm_panel_prepare(mxsfb->panel);
         mxsfb_crtc_enable(mxsfb);
+        drm_panel_enable(mxsfb->panel);
 }
 
 static void mxsfb_pipe_disable(struct drm_simple_display_pipe *pipe)
 {
         struct mxsfb_drm_private *mxsfb = drm_pipe_to_mxsfb_drm_private(pipe);
 
+        drm_panel_disable(mxsfb->panel);
         mxsfb_crtc_disable(mxsfb);
+        drm_panel_unprepare(mxsfb->panel);
 }
 
 static void mxsfb_pipe_update(struct drm_simple_display_pipe *pipe,
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_out.c b/drivers/gpu/drm/mxsfb/mxsfb_out.c
index fa8d17399407..b8e81422d4e2 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_out.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_out.c
@@ -112,6 +112,7 @@ static int mxsfb_attach_endpoint(struct drm_device *drm,
 
 int mxsfb_create_output(struct drm_device *drm)
 {
+        struct mxsfb_drm_private *mxsfb = drm->dev_private;
         struct device_node *ep_np = NULL;
         struct of_endpoint ep;
         int ret;
@@ -127,5 +128,8 @@ int mxsfb_create_output(struct drm_device *drm)
                 }
         }
 
+        if (!mxsfb->panel)
+                return -EPROBE_DEFER;
+
         return 0;
 }
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_regs.h b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
index 31d62cd0d3d7..66a6ba9ec533 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_regs.h
+++ b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
@@ -44,6 +44,7 @@
 #define CTRL_DATA_SELECT                (1 << 16)
 #define CTRL_SET_BUS_WIDTH(x)           (((x) & 0x3) << 10)
 #define CTRL_GET_BUS_WIDTH(x)           (((x) >> 10) & 0x3)
+#define CTRL_BUS_WIDTH_MASK             (0x3 << 10)
 #define CTRL_SET_WORD_LENGTH(x)         (((x) & 0x3) << 8)
 #define CTRL_GET_WORD_LENGTH(x)         (((x) >> 8) & 0x3)
 #define CTRL_MASTER                     (1 << 5)
diff --git a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
index af267c35d813..ee5883f59be5 100644
--- a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
+++ b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
@@ -147,9 +147,6 @@ static int omap_gem_dmabuf_mmap(struct dma_buf *buffer,
         struct drm_gem_object *obj = buffer->priv;
         int ret = 0;
 
-        if (WARN_ON(!obj->filp))
-                return -EINVAL;
-
         ret = drm_gem_mmap_obj(obj, omap_gem_mmap_size(obj), vma);
         if (ret < 0)
                 return ret;
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 684f1703aa5c..aaa3e80fecb4 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -213,8 +213,8 @@ static void radeon_evict_flags(struct ttm_buffer_object *bo,
                         rbo->placement.num_busy_placement = 0;
                         for (i = 0; i < rbo->placement.num_placement; i++) {
                                 if (rbo->placements[i].flags & TTM_PL_FLAG_VRAM) {
-                                        if (rbo->placements[0].fpfn < fpfn)
-                                                rbo->placements[0].fpfn = fpfn;
+                                        if (rbo->placements[i].fpfn < fpfn)
+                                                rbo->placements[i].fpfn = fpfn;
                                 } else {
                                         rbo->placement.busy_placement =
                                                 &rbo->placements[i];
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index d12b8978142f..c7af9fdd20c7 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2984,6 +2984,16 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                     (rdev->pdev->device == 0x6667)) {
                         max_sclk = 75000;
                 }
+        } else if (rdev->family == CHIP_OLAND) {
+                if ((rdev->pdev->revision == 0xC7) ||
+                    (rdev->pdev->revision == 0x80) ||
+                    (rdev->pdev->revision == 0x81) ||
+                    (rdev->pdev->revision == 0x83) ||
+                    (rdev->pdev->revision == 0x87) ||
+                    (rdev->pdev->device == 0x6604) ||
+                    (rdev->pdev->device == 0x6605)) {
+                        max_sclk = 75000;
+                }
         }
 
         if (rps->vce_active) {
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
index b5bfbe50bd87..b0ff304ce3dc 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
@@ -32,6 +32,10 @@ void rcar_du_vsp_enable(struct rcar_du_crtc *crtc)
 {
         const struct drm_display_mode *mode = &crtc->crtc.state->adjusted_mode;
         struct rcar_du_device *rcdu = crtc->group->dev;
+        struct vsp1_du_lif_config cfg = {
+                .width = mode->hdisplay,
+                .height = mode->vdisplay,
+        };
         struct rcar_du_plane_state state = {
                 .state = {
                         .crtc = &crtc->crtc,
@@ -66,12 +70,12 @@ void rcar_du_vsp_enable(struct rcar_du_crtc *crtc)
          */
         crtc->group->need_restart = true;
 
-        vsp1_du_setup_lif(crtc->vsp->vsp, mode->hdisplay, mode->vdisplay);
+        vsp1_du_setup_lif(crtc->vsp->vsp, &cfg);
 }
 
 void rcar_du_vsp_disable(struct rcar_du_crtc *crtc)
 {
-        vsp1_du_setup_lif(crtc->vsp->vsp, 0, 0);
+        vsp1_du_setup_lif(crtc->vsp->vsp, NULL);
 }
 
 void rcar_du_vsp_atomic_begin(struct rcar_du_crtc *crtc)
diff --git a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
index f80bf9385e41..d745e8b50fb8 100644
--- a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
+++ b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
@@ -464,6 +464,7 @@ static void tilcdc_crtc_enable(struct drm_crtc *crtc)
 {
         struct drm_device *dev = crtc->dev;
         struct tilcdc_crtc *tilcdc_crtc = to_tilcdc_crtc(crtc);
+        unsigned long flags;
 
         WARN_ON(!drm_modeset_is_locked(&crtc->mutex));
         mutex_lock(&tilcdc_crtc->enable_lock);
@@ -484,7 +485,17 @@ static void tilcdc_crtc_enable(struct drm_crtc *crtc)
         tilcdc_write_mask(dev, LCDC_RASTER_CTRL_REG,
                           LCDC_PALETTE_LOAD_MODE(DATA_ONLY),
                           LCDC_PALETTE_LOAD_MODE_MASK);
+
+        /* There is no real chance for a race here as the time stamp
+         * is taken before the raster DMA is started. The spin-lock is
+         * taken to have a memory barrier after taking the time-stamp
+         * and to avoid a context switch between taking the stamp and
+         * enabling the raster.
+         */
+        spin_lock_irqsave(&tilcdc_crtc->irq_lock, flags);
+        tilcdc_crtc->last_vblank = ktime_get();
         tilcdc_set(dev, LCDC_RASTER_CTRL_REG, LCDC_RASTER_ENABLE);
+        spin_unlock_irqrestore(&tilcdc_crtc->irq_lock, flags);
 
         drm_crtc_vblank_on(crtc);
 
@@ -539,7 +550,6 @@ static void tilcdc_crtc_off(struct drm_crtc *crtc, bool shutdown)
         }
 
         drm_flip_work_commit(&tilcdc_crtc->unref_work, priv->wq);
-        tilcdc_crtc->last_vblank = 0;
 
         tilcdc_crtc->enabled = false;
         mutex_unlock(&tilcdc_crtc->enable_lock);
@@ -602,7 +612,6 @@ int tilcdc_crtc_update_fb(struct drm_crtc *crtc,
 {
         struct tilcdc_crtc *tilcdc_crtc = to_tilcdc_crtc(crtc);
         struct drm_device *dev = crtc->dev;
-        unsigned long flags;
 
         WARN_ON(!drm_modeset_is_locked(&crtc->mutex));
 
@@ -614,28 +623,30 @@ int tilcdc_crtc_update_fb(struct drm_crtc *crtc,
         drm_framebuffer_reference(fb);
 
         crtc->primary->fb = fb;
+        tilcdc_crtc->event = event;
 
-        spin_lock_irqsave(&tilcdc_crtc->irq_lock, flags);
+        mutex_lock(&tilcdc_crtc->enable_lock);
 
-        if (crtc->hwmode.vrefresh && ktime_to_ns(tilcdc_crtc->last_vblank)) {
+        if (tilcdc_crtc->enabled) {
+                unsigned long flags;
                 ktime_t next_vblank;
                 s64 tdiff;
 
-                next_vblank = ktime_add_us(tilcdc_crtc->last_vblank,
-                        1000000 / crtc->hwmode.vrefresh);
+                spin_lock_irqsave(&tilcdc_crtc->irq_lock, flags);
 
+                next_vblank = ktime_add_us(tilcdc_crtc->last_vblank,
+                                           1000000 / crtc->hwmode.vrefresh);
                 tdiff = ktime_to_us(ktime_sub(next_vblank, ktime_get()));
 
                 if (tdiff < TILCDC_VBLANK_SAFETY_THRESHOLD_US)
                         tilcdc_crtc->next_fb = fb;
-        }
-
-        if (tilcdc_crtc->next_fb != fb)
-                set_scanout(crtc, fb);
+                else
+                        set_scanout(crtc, fb);
 
-        tilcdc_crtc->event = event;
+                spin_unlock_irqrestore(&tilcdc_crtc->irq_lock, flags);
+        }
 
-        spin_unlock_irqrestore(&tilcdc_crtc->irq_lock, flags);
+        mutex_unlock(&tilcdc_crtc->enable_lock);
 
         return 0;
 }
@@ -1036,5 +1047,5 @@ int tilcdc_crtc_create(struct drm_device *dev)
 
 fail:
         tilcdc_crtc_destroy(crtc);
-        return -ENOMEM;
+        return ret;
 }
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 0c06844af445..9fcf05ca492b 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -846,6 +846,17 @@ static void vc4_crtc_destroy_state(struct drm_crtc *crtc,
         drm_atomic_helper_crtc_destroy_state(crtc, state);
 }
 
+static void
+vc4_crtc_reset(struct drm_crtc *crtc)
+{
+        if (crtc->state)
+                __drm_atomic_helper_crtc_destroy_state(crtc->state);
+
+        crtc->state = kzalloc(sizeof(struct vc4_crtc_state), GFP_KERNEL);
+        if (crtc->state)
+                crtc->state->crtc = crtc;
+}
+
 static const struct drm_crtc_funcs vc4_crtc_funcs = {
         .set_config = drm_atomic_helper_set_config,
         .destroy = vc4_crtc_destroy,
@@ -853,7 +864,7 @@ static const struct drm_crtc_funcs vc4_crtc_funcs = {
         .set_property = NULL,
         .cursor_set = NULL, /* handled by drm_mode_cursor_universal */
         .cursor_move = NULL, /* handled by drm_mode_cursor_universal */
-        .reset = drm_atomic_helper_crtc_reset,
+        .reset = vc4_crtc_reset,
         .atomic_duplicate_state = vc4_crtc_duplicate_state,
         .atomic_destroy_state = vc4_crtc_destroy_state,
         .gamma_set = vc4_crtc_gamma_set,
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 1aeb80e52424..8c54cb8f5d6d 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -175,11 +175,11 @@ config HID_CHERRY
         Support for Cherry Cymotion keyboard.
 
 config HID_CHICONY
-        tristate "Chicony Tactical pad"
+        tristate "Chicony devices"
         depends on HID
         default !EXPERT
         ---help---
-        Support for Chicony Tactical pad.
+        Support for Chicony Tactical pad and special keys on Chicony keyboards.
 
 config HID_CORSAIR
         tristate "Corsair devices"
@@ -190,6 +190,7 @@ config HID_CORSAIR
 
         Supported devices:
         - Vengeance K90
+        - Scimitar PRO RGB
 
 config HID_PRODIKEYS
         tristate "Prodikeys PC-MIDI Keyboard support"
diff --git a/drivers/hid/hid-chicony.c b/drivers/hid/hid-chicony.c
index bc3cec199fee..f04ed9aabc3f 100644
--- a/drivers/hid/hid-chicony.c
+++ b/drivers/hid/hid-chicony.c
@@ -86,6 +86,7 @@ static const struct hid_device_id ch_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, ch_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index e9e87d337446..63ec1993eaaa 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1870,6 +1870,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K90) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_CP2112) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
@@ -1910,6 +1911,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
@@ -2110,6 +2112,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET) },
         { HID_USB_DEVICE(USB_VENDOR_ID_X_TENSIONS, USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_THT_2P_ARCADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZYDACRON, USB_DEVICE_ID_ZYDACRON_REMOTE_CONTROL) },
diff --git a/drivers/hid/hid-corsair.c b/drivers/hid/hid-corsair.c
index c0303f61c26a..9ba5d98a1180 100644
--- a/drivers/hid/hid-corsair.c
+++ b/drivers/hid/hid-corsair.c
@@ -3,8 +3,10 @@
  *
  * Supported devices:
  *  - Vengeance K90 Keyboard
+ *  - Scimitar PRO RGB Gaming Mouse
  *
  * Copyright (c) 2015 Clement Vuchener
+ * Copyright (c) 2017 Oscar Campos
  */
 
 /*
@@ -670,10 +672,51 @@ static int corsair_input_mapping(struct hid_device *dev,
         return 0;
 }
 
+/*
+ * The report descriptor of Corsair Scimitar RGB Pro gaming mouse is
+ * non parseable as they define two consecutive Logical Minimum for
+ * the Usage Page (Consumer) in rdescs bytes 75 and 77 being 77 0x16
+ * that should be obviousy 0x26 for Logical Magimum of 16 bits. This
+ * prevents poper parsing of the report descriptor due Logical
+ * Minimum being larger than Logical Maximum.
+ *
+ * This driver fixes the report descriptor for:
+ * - USB ID b1c:1b3e, sold as Scimitar RGB Pro Gaming mouse
+ */
+
+static __u8 *corsair_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+        unsigned int *rsize)
+{
+        struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+
+        if (intf->cur_altsetting->desc.bInterfaceNumber == 1) {
+                /*
+                 * Corsair Scimitar RGB Pro report descriptor is broken and
+                 * defines two different Logical Minimum for the Consumer
+                 * Application. The byte 77 should be a 0x26 defining a 16
+                 * bits integer for the Logical Maximum but it is a 0x16
+                 * instead (Logical Minimum)
+                 */
+                switch (hdev->product) {
+                case USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB:
+                        if (*rsize >= 172 && rdesc[75] == 0x15 && rdesc[77] == 0x16
+                        && rdesc[78] == 0xff && rdesc[79] == 0x0f) {
+                                hid_info(hdev, "Fixing up report descriptor\n");
+                                rdesc[77] = 0x26;
+                        }
+                        break;
+                }
+
+        }
+        return rdesc;
+}
+
 static const struct hid_device_id corsair_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K90),
                 .driver_data = CORSAIR_USE_K90_MACRO |
                                CORSAIR_USE_K90_BACKLIGHT },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR,
+            USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB) },
         {}
 };
 
@@ -686,10 +729,14 @@ static struct hid_driver corsair_driver = {
         .event = corsair_event,
         .remove = corsair_remove,
         .input_mapping = corsair_input_mapping,
+        .report_fixup = corsair_mouse_report_fixup,
 };
 
 module_hid_driver(corsair_driver);
 
 MODULE_LICENSE("GPL");
+/* Original K90 driver author */
 MODULE_AUTHOR("Clement Vuchener");
+/* Scimitar PRO RGB driver author */
+MODULE_AUTHOR("Oscar Campos");
 MODULE_DESCRIPTION("HID driver for Corsair devices");
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 86c95d30ac80..4e2648c86c8c 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -278,6 +278,9 @@
 #define USB_DEVICE_ID_CORSAIR_K70RGB    0x1b13
 #define USB_DEVICE_ID_CORSAIR_STRAFE    0x1b15
 #define USB_DEVICE_ID_CORSAIR_K65RGB    0x1b17
+#define USB_DEVICE_ID_CORSAIR_K70RGB_RAPIDFIRE  0x1b38
+#define USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE  0x1b39
+#define USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB  0x1b3e
 
 #define USB_VENDOR_ID_CREATIVELABS      0x041e
 #define USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51      0x322c
@@ -557,6 +560,7 @@
 
 #define USB_VENDOR_ID_JESS              0x0c45
 #define USB_DEVICE_ID_JESS_YUREX        0x1010
+#define USB_DEVICE_ID_JESS_ZEN_AIO_KBD  0x5112
 
 #define USB_VENDOR_ID_JESS2             0x0f30
 #define USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD 0x0111
@@ -1078,6 +1082,7 @@
 
 #define USB_VENDOR_ID_XIN_MO                    0x16c0
 #define USB_DEVICE_ID_XIN_MO_DUAL_ARCADE        0x05e1
+#define USB_DEVICE_ID_THT_2P_ARCADE             0x75e1
 
 #define USB_VENDOR_ID_XIROKU            0x1477
 #define USB_DEVICE_ID_XIROKU_SPX        0x1006
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index f405b07d0381..740996f9bdd4 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -2632,6 +2632,8 @@ err_stop:
                 sony_leds_remove(sc);
         if (sc->quirks & SONY_BATTERY_SUPPORT)
                 sony_battery_remove(sc);
+        if (sc->touchpad)
+                sony_unregister_touchpad(sc);
         sony_cancel_work_sync(sc);
         kfree(sc->output_report_dmabuf);
         sony_remove_dev_list(sc);
diff --git a/drivers/hid/hid-xinmo.c b/drivers/hid/hid-xinmo.c
index 7df5227a7e61..9ad7731d2e10 100644
--- a/drivers/hid/hid-xinmo.c
+++ b/drivers/hid/hid-xinmo.c
@@ -46,6 +46,7 @@ static int xinmo_event(struct hid_device *hdev, struct hid_field *field,
 
 static const struct hid_device_id xinmo_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_THT_2P_ARCADE) },
         { }
 };
 
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index d6847a664446..a69a3c88ab29 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -80,6 +80,9 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_STRAFE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB_RAPIDFIRE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index be8f7e2a026f..e2666ef84dc1 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -2165,6 +2165,14 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
 
         wacom_update_name(wacom, wireless ? " (WL)" : "");
 
+        /* pen only Bamboo neither support touch nor pad */
+        if ((features->type == BAMBOO_PEN) &&
+            ((features->device_type & WACOM_DEVICETYPE_TOUCH) ||
+            (features->device_type & WACOM_DEVICETYPE_PAD))) {
+                error = -ENODEV;
+                goto fail;
+        }
+
         error = wacom_add_shared_data(hdev);
         if (error)
                 goto fail;
@@ -2208,14 +2216,8 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
         /* touch only Bamboo doesn't support pen */
         if ((features->type == BAMBOO_TOUCH) &&
             (features->device_type & WACOM_DEVICETYPE_PEN)) {
-                error = -ENODEV;
-                goto fail_quirks;
-        }
-
-        /* pen only Bamboo neither support touch nor pad */
-        if ((features->type == BAMBOO_PEN) &&
-            ((features->device_type & WACOM_DEVICETYPE_TOUCH) ||
-            (features->device_type & WACOM_DEVICETYPE_PAD))) {
+                cancel_delayed_work_sync(&wacom->init_work);
+                _wacom_query_tablet_data(wacom);
                 error = -ENODEV;
                 goto fail_quirks;
         }
@@ -2579,7 +2581,9 @@ static void wacom_remove(struct hid_device *hdev)
 
         /* make sure we don't trigger the LEDs */
         wacom_led_groups_release(wacom);
-        wacom_release_resources(wacom);
+
+        if (wacom->wacom_wac.features.type != REMOTE)
+                wacom_release_resources(wacom);
 
         hid_set_drvdata(hdev, NULL);
 }
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 4aa3de9f1163..94250c293be2 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -1959,8 +1959,10 @@ static void wacom_wac_pen_usage_mapping(struct hid_device *hdev,
                 input_set_capability(input, EV_KEY, BTN_TOOL_BRUSH);
                 input_set_capability(input, EV_KEY, BTN_TOOL_PENCIL);
                 input_set_capability(input, EV_KEY, BTN_TOOL_AIRBRUSH);
-                input_set_capability(input, EV_KEY, BTN_TOOL_MOUSE);
-                input_set_capability(input, EV_KEY, BTN_TOOL_LENS);
+                if (!(features->device_type & WACOM_DEVICETYPE_DIRECT)) {
+                        input_set_capability(input, EV_KEY, BTN_TOOL_MOUSE);
+                        input_set_capability(input, EV_KEY, BTN_TOOL_LENS);
+                }
                 break;
         case WACOM_HID_WD_FINGERWHEEL:
                 wacom_map_usage(input, usage, field, EV_ABS, ABS_WHEEL, 0);
@@ -4197,10 +4199,10 @@ static const struct wacom_features wacom_features_0x343 =
           WACOM_DTU_OFFSET, WACOM_DTU_OFFSET };
 static const struct wacom_features wacom_features_0x360 =
         { "Wacom Intuos Pro M", 44800, 29600, 8191, 63,
-          INTUOSP2_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 9, .touch_max = 10 };
+          INTUOSP2_BT, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 9, .touch_max = 10 };
 static const struct wacom_features wacom_features_0x361 =
         { "Wacom Intuos Pro L", 62200, 43200, 8191, 63,
-          INTUOSP2_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 9, .touch_max = 10 };
+          INTUOSP2_BT, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 9, .touch_max = 10 };
 
 static const struct wacom_features wacom_features_HID_ANY_ID =
         { "Wacom HID", .type = HID_GENERIC, .oVid = HID_ANY_ID, .oPid = HID_ANY_ID };
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 81a80c82f1bd..321b8833fa6f 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -502,12 +502,15 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle)
 
         wait_for_completion(&info->waitevent);
 
-        if (channel->rescind) {
-                ret = -ENODEV;
-                goto post_msg_err;
-        }
-
 post_msg_err:
+        /*
+         * If the channel has been rescinded;
+         * we will be awakened by the rescind
+         * handler; set the error code to zero so we don't leak memory.
+         */
+        if (channel->rescind)
+                ret = 0;
+
         spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
         list_del(&info->msglistentry);
         spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
@@ -530,20 +533,18 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
         int ret;
 
         /*
-         * vmbus_on_event(), running in the tasklet, can race
+         * vmbus_on_event(), running in the per-channel tasklet, can race
          * with vmbus_close_internal() in the case of SMP guest, e.g., when
          * the former is accessing channel->inbound.ring_buffer, the latter
-         * could be freeing the ring_buffer pages.
-         *
-         * To resolve the race, we can serialize them by disabling the
-         * tasklet when the latter is running here.
+         * could be freeing the ring_buffer pages, so here we must stop it
+         * first.
          */
-        hv_event_tasklet_disable(channel);
+        tasklet_disable(&channel->callback_event);
 
         /*
          * In case a device driver's probe() fails (e.g.,
          * util_probe() -> vmbus_open() returns -ENOMEM) and the device is
-         * rescinded later (e.g., we dynamically disble an Integrated Service
+         * rescinded later (e.g., we dynamically disable an Integrated Service
          * in Hyper-V Manager), the driver's remove() invokes vmbus_close():
          * here we should skip most of the below cleanup work.
          */
@@ -605,8 +606,6 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
                 get_order(channel->ringbuffer_pagecount * PAGE_SIZE));
 
 out:
-        hv_event_tasklet_enable(channel);
-
         return ret;
 }
 
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index f33465d78a02..fbcb06352308 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -350,7 +350,8 @@ static struct vmbus_channel *alloc_channel(void)
 static void free_channel(struct vmbus_channel *channel)
 {
         tasklet_kill(&channel->callback_event);
-        kfree(channel);
+
+        kfree_rcu(channel, rcu);
 }
 
 static void percpu_channel_enq(void *arg)
@@ -359,14 +360,14 @@ static void percpu_channel_enq(void *arg)
         struct hv_per_cpu_context *hv_cpu
                 = this_cpu_ptr(hv_context.cpu_context);
 
-        list_add_tail(&channel->percpu_list, &hv_cpu->chan_list);
+        list_add_tail_rcu(&channel->percpu_list, &hv_cpu->chan_list);
 }
 
 static void percpu_channel_deq(void *arg)
 {
         struct vmbus_channel *channel = arg;
 
-        list_del(&channel->percpu_list);
+        list_del_rcu(&channel->percpu_list);
 }
 
 
@@ -381,19 +382,6 @@ static void vmbus_release_relid(u32 relid)
                        true);
 }
 
-void hv_event_tasklet_disable(struct vmbus_channel *channel)
-{
-        tasklet_disable(&channel->callback_event);
-}
-
-void hv_event_tasklet_enable(struct vmbus_channel *channel)
-{
-        tasklet_enable(&channel->callback_event);
-
-        /* In case there is any pending event */
-        tasklet_schedule(&channel->callback_event);
-}
-
 void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid)
 {
         unsigned long flags;
@@ -402,7 +390,6 @@ void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid)
         BUG_ON(!channel->rescind);
         BUG_ON(!mutex_is_locked(&vmbus_connection.channel_mutex));
 
-        hv_event_tasklet_disable(channel);
         if (channel->target_cpu != get_cpu()) {
                 put_cpu();
                 smp_call_function_single(channel->target_cpu,
@@ -411,7 +398,6 @@ void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid)
                 percpu_channel_deq(channel);
                 put_cpu();
         }
-        hv_event_tasklet_enable(channel);
 
         if (channel->primary_channel == NULL) {
                 list_del(&channel->listentry);
@@ -505,7 +491,6 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
 
         init_vp_index(newchannel, dev_type);
 
-        hv_event_tasklet_disable(newchannel);
         if (newchannel->target_cpu != get_cpu()) {
                 put_cpu();
                 smp_call_function_single(newchannel->target_cpu,
@@ -515,7 +500,6 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
                 percpu_channel_enq(newchannel);
                 put_cpu();
         }
-        hv_event_tasklet_enable(newchannel);
 
         /*
          * This state is used to indicate a successful open
@@ -565,7 +549,6 @@ err_deq_chan:
         list_del(&newchannel->listentry);
         mutex_unlock(&vmbus_connection.channel_mutex);
 
-        hv_event_tasklet_disable(newchannel);
         if (newchannel->target_cpu != get_cpu()) {
                 put_cpu();
                 smp_call_function_single(newchannel->target_cpu,
@@ -574,7 +557,6 @@ err_deq_chan:
                 percpu_channel_deq(newchannel);
                 put_cpu();
         }
-        hv_event_tasklet_enable(newchannel);
 
         vmbus_release_relid(newchannel->offermsg.child_relid);
 
@@ -814,6 +796,7 @@ static void vmbus_onoffer(struct vmbus_channel_message_header *hdr)
         /* Allocate the channel object and save this offer. */
         newchannel = alloc_channel();
         if (!newchannel) {
+                vmbus_release_relid(offer->child_relid);
                 pr_err("Unable to allocate channel object\n");
                 return;
         }
diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c
index 9aee6014339d..a5596a642ed0 100644
--- a/drivers/hv/hv_fcopy.c
+++ b/drivers/hv/hv_fcopy.c
@@ -71,7 +71,6 @@ static DECLARE_WORK(fcopy_send_work, fcopy_send_data);
 static const char fcopy_devname[] = "vmbus/hv_fcopy";
 static u8 *recv_buffer;
 static struct hvutil_transport *hvt;
-static struct completion release_event;
 /*
  * This state maintains the version number registered by the daemon.
  */
@@ -331,7 +330,6 @@ static void fcopy_on_reset(void)
 
         if (cancel_delayed_work_sync(&fcopy_timeout_work))
                 fcopy_respond_to_host(HV_E_FAIL);
-        complete(&release_event);
 }
 
 int hv_fcopy_init(struct hv_util_service *srv)
@@ -339,7 +337,6 @@ int hv_fcopy_init(struct hv_util_service *srv)
         recv_buffer = srv->recv_buffer;
         fcopy_transaction.recv_channel = srv->channel;
 
-        init_completion(&release_event);
         /*
          * When this driver loads, the user level daemon that
          * processes the host requests may not yet be running.
@@ -361,5 +358,4 @@ void hv_fcopy_deinit(void)
         fcopy_transaction.state = HVUTIL_DEVICE_DYING;
         cancel_delayed_work_sync(&fcopy_timeout_work);
         hvutil_transport_destroy(hvt);
-        wait_for_completion(&release_event);
 }
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index de263712e247..a1adfe2cfb34 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -101,7 +101,6 @@ static DECLARE_WORK(kvp_sendkey_work, kvp_send_key);
 static const char kvp_devname[] = "vmbus/hv_kvp";
 static u8 *recv_buffer;
 static struct hvutil_transport *hvt;
-static struct completion release_event;
 /*
  * Register the kernel component with the user-level daemon.
  * As part of this registration, pass the LIC version number.
@@ -714,7 +713,6 @@ static void kvp_on_reset(void)
         if (cancel_delayed_work_sync(&kvp_timeout_work))
                 kvp_respond_to_host(NULL, HV_E_FAIL);
         kvp_transaction.state = HVUTIL_DEVICE_INIT;
-        complete(&release_event);
 }
 
 int
@@ -723,7 +721,6 @@ hv_kvp_init(struct hv_util_service *srv)
         recv_buffer = srv->recv_buffer;
         kvp_transaction.recv_channel = srv->channel;
 
-        init_completion(&release_event);
         /*
          * When this driver loads, the user level daemon that
          * processes the host requests may not yet be running.
@@ -747,5 +744,4 @@ void hv_kvp_deinit(void)
         cancel_delayed_work_sync(&kvp_timeout_work);
         cancel_work_sync(&kvp_sendkey_work);
         hvutil_transport_destroy(hvt);
-        wait_for_completion(&release_event);
 }
diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c
index bcc03f0748d6..e659d1b94a57 100644
--- a/drivers/hv/hv_snapshot.c
+++ b/drivers/hv/hv_snapshot.c
@@ -79,7 +79,6 @@ static int dm_reg_value;
 static const char vss_devname[] = "vmbus/hv_vss";
 static __u8 *recv_buffer;
 static struct hvutil_transport *hvt;
-static struct completion release_event;
 
 static void vss_timeout_func(struct work_struct *dummy);
 static void vss_handle_request(struct work_struct *dummy);
@@ -361,13 +360,11 @@ static void vss_on_reset(void)
         if (cancel_delayed_work_sync(&vss_timeout_work))
                 vss_respond_to_host(HV_E_FAIL);
         vss_transaction.state = HVUTIL_DEVICE_INIT;
-        complete(&release_event);
 }
 
 int
 hv_vss_init(struct hv_util_service *srv)
 {
-        init_completion(&release_event);
         if (vmbus_proto_version < VERSION_WIN8_1) {
                 pr_warn("Integration service 'Backup (volume snapshot)'"
                         " not supported on this host version.\n");
@@ -400,5 +397,4 @@ void hv_vss_deinit(void)
         cancel_delayed_work_sync(&vss_timeout_work);
         cancel_work_sync(&vss_handle_request_work);
         hvutil_transport_destroy(hvt);
-        wait_for_completion(&release_event);
 }
diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
index 3042eaa13062..186b10083c55 100644
--- a/drivers/hv/hv_util.c
+++ b/drivers/hv/hv_util.c
@@ -590,6 +590,8 @@ static int hv_timesync_init(struct hv_util_service *srv)
         if (!hyperv_cs)
                 return -ENODEV;
 
+        spin_lock_init(&host_ts.lock);
+
         INIT_WORK(&wrk.work, hv_set_host_time);
 
         /*
diff --git a/drivers/hv/hv_utils_transport.c b/drivers/hv/hv_utils_transport.c
index c235a9515267..4402a71e23f7 100644
--- a/drivers/hv/hv_utils_transport.c
+++ b/drivers/hv/hv_utils_transport.c
@@ -182,10 +182,11 @@ static int hvt_op_release(struct inode *inode, struct file *file)
          * connects back.
          */
         hvt_reset(hvt);
-        mutex_unlock(&hvt->lock);
 
         if (mode_old == HVUTIL_TRANSPORT_DESTROY)
-                hvt_transport_free(hvt);
+                complete(&hvt->release);
+
+        mutex_unlock(&hvt->lock);
 
         return 0;
 }
@@ -304,6 +305,7 @@ struct hvutil_transport *hvutil_transport_init(const char *name,
 
         init_waitqueue_head(&hvt->outmsg_q);
         mutex_init(&hvt->lock);
+        init_completion(&hvt->release);
 
         spin_lock(&hvt_list_lock);
         list_add(&hvt->list, &hvt_list);
@@ -351,6 +353,8 @@ void hvutil_transport_destroy(struct hvutil_transport *hvt)
         if (hvt->cn_id.idx > 0 && hvt->cn_id.val > 0)
                 cn_del_callback(&hvt->cn_id);
 
-        if (mode_old != HVUTIL_TRANSPORT_CHARDEV)
-                hvt_transport_free(hvt);
+        if (mode_old == HVUTIL_TRANSPORT_CHARDEV)
+                wait_for_completion(&hvt->release);
+
+        hvt_transport_free(hvt);
 }
diff --git a/drivers/hv/hv_utils_transport.h b/drivers/hv/hv_utils_transport.h
index d98f5225c3e6..79afb626e166 100644
--- a/drivers/hv/hv_utils_transport.h
+++ b/drivers/hv/hv_utils_transport.h
@@ -41,6 +41,7 @@ struct hvutil_transport {
         int outmsg_len;                     /* its length */
         wait_queue_head_t outmsg_q;         /* poll/read wait queue */
         struct mutex lock;                  /* protects struct members */
+        struct completion release;          /* synchronize with fd release */
 };
 
 struct hvutil_transport *hvutil_transport_init(const char *name,
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index da6b59ba5940..8370b9dc6037 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -939,8 +939,10 @@ static void vmbus_chan_sched(struct hv_per_cpu_context *hv_cpu)
                 if (relid == 0)
                         continue;
 
+                rcu_read_lock();
+
                 /* Find channel based on relid */
-                list_for_each_entry(channel, &hv_cpu->chan_list, percpu_list) {
+                list_for_each_entry_rcu(channel, &hv_cpu->chan_list, percpu_list) {
                         if (channel->offermsg.child_relid != relid)
                                 continue;
 
@@ -956,6 +958,8 @@ static void vmbus_chan_sched(struct hv_per_cpu_context *hv_cpu)
                                 tasklet_schedule(&channel->callback_event);
                         }
                 }
+
+                rcu_read_unlock();
         }
 }
 
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index cccef87963e0..975c43d446f8 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -646,6 +646,9 @@ static int atk_read_value(struct atk_sensor_data *sensor, u64 *value)
                 else
                         err = atk_read_value_new(sensor, value);
 
+                if (err)
+                        return err;
+
                 sensor->is_valid = true;
                 sensor->last_updated = jiffies;
                 sensor->cached_value = *value;
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index efb01c247e2d..4dfc7238313e 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -3198,7 +3198,7 @@ static int __init sm_it87_init(void)
 {
         int sioaddr[2] = { REG_2E, REG_4E };
         struct it87_sio_data sio_data;
-        unsigned short isa_address;
+        unsigned short isa_address[2];
         bool found = false;
         int i, err;
 
@@ -3208,15 +3208,29 @@ static int __init sm_it87_init(void)
 
         for (i = 0; i < ARRAY_SIZE(sioaddr); i++) {
                 memset(&sio_data, 0, sizeof(struct it87_sio_data));
-                isa_address = 0;
-                err = it87_find(sioaddr[i], &isa_address, &sio_data);
-                if (err || isa_address == 0)
+                isa_address[i] = 0;
+                err = it87_find(sioaddr[i], &isa_address[i], &sio_data);
+                if (err || isa_address[i] == 0)
                         continue;
+                /*
+                 * Don't register second chip if its ISA address matches
+                 * the first chip's ISA address.
+                 */
+                if (i && isa_address[i] == isa_address[0])
+                        break;
 
-                err = it87_device_add(i, isa_address, &sio_data);
+                err = it87_device_add(i, isa_address[i], &sio_data);
                 if (err)
                         goto exit_dev_unregister;
+
                 found = true;
+
+                /*
+                 * IT8705F may respond on both SIO addresses.
+                 * Stop probing after finding one.
+                 */
+                if (sio_data.type == it87)
+                        break;
         }
 
         if (!found) {
diff --git a/drivers/hwmon/max31790.c b/drivers/hwmon/max31790.c
index c1b9275978f9..281491cca510 100644
--- a/drivers/hwmon/max31790.c
+++ b/drivers/hwmon/max31790.c
@@ -311,7 +311,7 @@ static int max31790_write_pwm(struct device *dev, u32 attr, int channel,
                 data->pwm[channel] = val << 8;
                 err = i2c_smbus_write_word_swapped(client,
                                                    MAX31790_REG_PWMOUT(channel),
-                                                   val);
+                                                   data->pwm[channel]);
                 break;
         case hwmon_pwm_enable:
                 fan_config = data->fan_config[channel];
diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index cdd9b3b26195..7563eceeaaea 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -221,8 +221,10 @@ static int intel_th_output_activate(struct intel_th_device *thdev)
         else
                 intel_th_trace_enable(thdev);
 
-        if (ret)
+        if (ret) {
                 pm_runtime_put(&thdev->dev);
+                module_put(thdrv->driver.owner);
+        }
 
         return ret;
 }
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index 0bba3842336e..590cf90dd21a 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -85,6 +85,16 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa2a6),
                 .driver_data = (kernel_ulong_t)0,
         },
+        {
+                /* Denverton */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x19e1),
+                .driver_data = (kernel_ulong_t)0,
+        },
+        {
+                /* Gemini Lake */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
+                .driver_data = (kernel_ulong_t)0,
+        },
         { 0 },
 };
 
diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
index 0652281662a8..78792b4d6437 100644
--- a/drivers/i2c/busses/i2c-brcmstb.c
+++ b/drivers/i2c/busses/i2c-brcmstb.c
@@ -465,6 +465,7 @@ static int brcmstb_i2c_xfer(struct i2c_adapter *adapter,
         u8 *tmp_buf;
         int len = 0;
         int xfersz = brcmstb_i2c_get_xfersz(dev);
+        u32 cond, cond_per_msg;
 
         if (dev->is_suspended)
                 return -EBUSY;
@@ -481,10 +482,11 @@ static int brcmstb_i2c_xfer(struct i2c_adapter *adapter,
                         pmsg->buf ? pmsg->buf[0] : '0', pmsg->len);
 
                 if (i < (num - 1) && (msgs[i + 1].flags & I2C_M_NOSTART))
-                        brcmstb_set_i2c_start_stop(dev, ~(COND_START_STOP));
+                        cond = ~COND_START_STOP;
                 else
-                        brcmstb_set_i2c_start_stop(dev,
-                                                   COND_RESTART | COND_NOSTOP);
+                        cond = COND_RESTART | COND_NOSTOP;
+
+                brcmstb_set_i2c_start_stop(dev, cond);
 
                 /* Send slave address */
                 if (!(pmsg->flags & I2C_M_NOSTART)) {
@@ -497,13 +499,24 @@ static int brcmstb_i2c_xfer(struct i2c_adapter *adapter,
                         }
                 }
 
+                cond_per_msg = cond;
+
                 /* Perform data transfer */
                 while (len) {
                         bytes_to_xfer = min(len, xfersz);
 
-                        if (len <= xfersz && i == (num - 1))
-                                brcmstb_set_i2c_start_stop(dev,
-                                                           ~(COND_START_STOP));
+                        if (len <= xfersz) {
+                                if (i == (num - 1))
+                                        cond_per_msg = cond_per_msg &
+                                                ~(COND_RESTART | COND_NOSTOP);
+                                else
+                                        cond_per_msg = cond;
+                        } else {
+                                cond_per_msg = (cond_per_msg & ~COND_RESTART) |
+                                        COND_NOSTOP;
+                        }
+
+                        brcmstb_set_i2c_start_stop(dev, cond_per_msg);
 
                         rc = brcmstb_i2c_xfer_bsc_data(dev, tmp_buf,
                                                        bytes_to_xfer, pmsg);
@@ -512,6 +525,8 @@ static int brcmstb_i2c_xfer(struct i2c_adapter *adapter,
 
                         len -=  bytes_to_xfer;
                         tmp_buf += bytes_to_xfer;
+
+                        cond_per_msg = COND_NOSTART | COND_NOSTOP;
                 }
         }
 
diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
index c1db3a5a340f..d9aaf1790e0e 100644
--- a/drivers/i2c/busses/i2c-designware-core.h
+++ b/drivers/i2c/busses/i2c-designware-core.h
@@ -88,6 +88,7 @@ struct dw_i2c_dev {
         void __iomem            *base;
         struct completion       cmd_complete;
         struct clk              *clk;
+        struct reset_control    *rst;
         u32                     (*get_clk_rate_khz) (struct dw_i2c_dev *dev);
         struct dw_pci_controller *controller;
         int                     cmd_err;
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 6ce431323125..79c4b4ea0539 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -38,6 +38,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/property.h>
 #include <linux/io.h>
+#include <linux/reset.h>
 #include <linux/slab.h>
 #include <linux/acpi.h>
 #include <linux/platform_data/i2c-designware.h>
@@ -199,6 +200,14 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
         dev->irq = irq;
         platform_set_drvdata(pdev, dev);
 
+        dev->rst = devm_reset_control_get_optional_exclusive(&pdev->dev, NULL);
+        if (IS_ERR(dev->rst)) {
+                if (PTR_ERR(dev->rst) == -EPROBE_DEFER)
+                        return -EPROBE_DEFER;
+        } else {
+                reset_control_deassert(dev->rst);
+        }
+
         if (pdata) {
                 dev->clk_freq = pdata->i2c_scl_freq;
         } else {
@@ -235,12 +244,13 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
             && dev->clk_freq != 1000000 && dev->clk_freq != 3400000) {
                 dev_err(&pdev->dev,
                         "Only 100kHz, 400kHz, 1MHz and 3.4MHz supported");
-                return -EINVAL;
+                r = -EINVAL;
+                goto exit_reset;
         }
 
         r = i2c_dw_eval_lock_support(dev);
         if (r)
-                return r;
+                goto exit_reset;
 
         dev->functionality = I2C_FUNC_10BIT_ADDR | DW_IC_DEFAULT_FUNCTIONALITY;
 
@@ -286,10 +296,18 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
         }
 
         r = i2c_dw_probe(dev);
-        if (r && !dev->pm_runtime_disabled)
-                pm_runtime_disable(&pdev->dev);
+        if (r)
+                goto exit_probe;
 
         return r;
+
+exit_probe:
+        if (!dev->pm_runtime_disabled)
+                pm_runtime_disable(&pdev->dev);
+exit_reset:
+        if (!IS_ERR_OR_NULL(dev->rst))
+                reset_control_assert(dev->rst);
+        return r;
 }
 
 static int dw_i2c_plat_remove(struct platform_device *pdev)
@@ -306,6 +324,8 @@ static int dw_i2c_plat_remove(struct platform_device *pdev)
         pm_runtime_put_sync(&pdev->dev);
         if (!dev->pm_runtime_disabled)
                 pm_runtime_disable(&pdev->dev);
+        if (!IS_ERR_OR_NULL(dev->rst))
+                reset_control_assert(dev->rst);
 
         return 0;
 }
diff --git a/drivers/i2c/busses/i2c-exynos5.c b/drivers/i2c/busses/i2c-exynos5.c
index cbd93ce0661f..736a82472101 100644
--- a/drivers/i2c/busses/i2c-exynos5.c
+++ b/drivers/i2c/busses/i2c-exynos5.c
@@ -457,7 +457,6 @@ static irqreturn_t exynos5_i2c_irq(int irqno, void *dev_id)
 
         int_status = readl(i2c->regs + HSI2C_INT_STATUS);
         writel(int_status, i2c->regs + HSI2C_INT_STATUS);
-        trans_status = readl(i2c->regs + HSI2C_TRANS_STATUS);
 
         /* handle interrupt related to the transfer status */
         if (i2c->variant->hw == HSI2C_EXYNOS7) {
@@ -482,11 +481,13 @@ static irqreturn_t exynos5_i2c_irq(int irqno, void *dev_id)
                         goto stop;
                 }
 
+                trans_status = readl(i2c->regs + HSI2C_TRANS_STATUS);
                 if ((trans_status & HSI2C_MASTER_ST_MASK) == HSI2C_MASTER_ST_LOSE) {
                         i2c->state = -EAGAIN;
                         goto stop;
                 }
         } else if (int_status & HSI2C_INT_I2C) {
+                trans_status = readl(i2c->regs + HSI2C_TRANS_STATUS);
                 if (trans_status & HSI2C_NO_DEV_ACK) {
                         dev_dbg(i2c->dev, "No ACK from device\n");
                         i2c->state = -ENXIO;
diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c
index 2aa61bbbd307..73b97c71a484 100644
--- a/drivers/i2c/busses/i2c-meson.c
+++ b/drivers/i2c/busses/i2c-meson.c
@@ -175,7 +175,7 @@ static void meson_i2c_put_data(struct meson_i2c *i2c, char *buf, int len)
                 wdata1 |= *buf++ << ((i - 4) * 8);
 
         writel(wdata0, i2c->regs + REG_TOK_WDATA0);
-        writel(wdata0, i2c->regs + REG_TOK_WDATA1);
+        writel(wdata1, i2c->regs + REG_TOK_WDATA1);
 
         dev_dbg(i2c->dev, "%s: data %08x %08x len %d\n", __func__,
                 wdata0, wdata1, len);
diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
index 4a7d9bc2142b..45d61714c81b 100644
--- a/drivers/i2c/busses/i2c-mt65xx.c
+++ b/drivers/i2c/busses/i2c-mt65xx.c
@@ -172,14 +172,6 @@ static const struct i2c_adapter_quirks mt6577_i2c_quirks = {
         .max_comb_2nd_msg_len = 31,
 };
 
-static const struct i2c_adapter_quirks mt8173_i2c_quirks = {
-        .max_num_msgs = 65535,
-        .max_write_len = 65535,
-        .max_read_len = 65535,
-        .max_comb_1st_msg_len = 65535,
-        .max_comb_2nd_msg_len = 65535,
-};
-
 static const struct mtk_i2c_compatible mt6577_compat = {
         .quirks = &mt6577_i2c_quirks,
         .pmic_i2c = 0,
@@ -199,7 +191,6 @@ static const struct mtk_i2c_compatible mt6589_compat = {
 };
 
 static const struct mtk_i2c_compatible mt8173_compat = {
-        .quirks = &mt8173_i2c_quirks,
         .pmic_i2c = 0,
         .dcm = 1,
         .auto_restart = 1,
diff --git a/drivers/i2c/busses/i2c-riic.c b/drivers/i2c/busses/i2c-riic.c
index 8f11d347b3ec..c811af4c8d81 100644
--- a/drivers/i2c/busses/i2c-riic.c
+++ b/drivers/i2c/busses/i2c-riic.c
@@ -218,8 +218,12 @@ static irqreturn_t riic_tend_isr(int irq, void *data)
         }
 
         if (riic->is_last || riic->err) {
-                riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER);
+                riic_clear_set_bit(riic, ICIER_TEIE, ICIER_SPIE, RIIC_ICIER);
                 writeb(ICCR2_SP, riic->base + RIIC_ICCR2);
+        } else {
+                /* Transfer is complete, but do not send STOP */
+                riic_clear_set_bit(riic, ICIER_TEIE, 0, RIIC_ICIER);
+                complete(&riic->msg_done);
         }
 
         return IRQ_HANDLED;
diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
index 83768e85a919..2178266bca79 100644
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -429,6 +429,7 @@ void i2c_mux_del_adapters(struct i2c_mux_core *muxc)
         while (muxc->num_adapters) {
                 struct i2c_adapter *adap = muxc->adapter[--muxc->num_adapters];
                 struct i2c_mux_priv *priv = adap->algo_data;
+                struct device_node *np = adap->dev.of_node;
 
                 muxc->adapter[muxc->num_adapters] = NULL;
 
@@ -438,6 +439,7 @@ void i2c_mux_del_adapters(struct i2c_mux_core *muxc)
 
                 sysfs_remove_link(&priv->adap.dev.kobj, "mux_device");
                 i2c_del_adapter(adap);
+                of_node_put(np);
                 kfree(priv);
         }
 }
diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c
index dfc1c0e37c40..ad31d21da316 100644
--- a/drivers/i2c/muxes/i2c-mux-pca954x.c
+++ b/drivers/i2c/muxes/i2c-mux-pca954x.c
@@ -35,7 +35,6 @@
  * warranty of any kind, whether express or implied.
  */
 
-#include <linux/acpi.h>
 #include <linux/device.h>
 #include <linux/gpio/consumer.h>
 #include <linux/i2c.h>
@@ -117,6 +116,10 @@ static const struct chip_desc chips[] = {
                 .has_irq = 1,
                 .muxtype = pca954x_isswi,
         },
+        [pca_9546] = {
+                .nchans = 4,
+                .muxtype = pca954x_isswi,
+        },
         [pca_9547] = {
                 .nchans = 8,
                 .enable = 0x8,
@@ -134,28 +137,13 @@ static const struct i2c_device_id pca954x_id[] = {
         { "pca9543", pca_9543 },
         { "pca9544", pca_9544 },
         { "pca9545", pca_9545 },
-        { "pca9546", pca_9545 },
+        { "pca9546", pca_9546 },
         { "pca9547", pca_9547 },
         { "pca9548", pca_9548 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, pca954x_id);
 
-#ifdef CONFIG_ACPI
-static const struct acpi_device_id pca954x_acpi_ids[] = {
-        { .id = "PCA9540", .driver_data = pca_9540 },
-        { .id = "PCA9542", .driver_data = pca_9542 },
-        { .id = "PCA9543", .driver_data = pca_9543 },
-        { .id = "PCA9544", .driver_data = pca_9544 },
-        { .id = "PCA9545", .driver_data = pca_9545 },
-        { .id = "PCA9546", .driver_data = pca_9545 },
-        { .id = "PCA9547", .driver_data = pca_9547 },
-        { .id = "PCA9548", .driver_data = pca_9548 },
-        { }
-};
-MODULE_DEVICE_TABLE(acpi, pca954x_acpi_ids);
-#endif
-
 #ifdef CONFIG_OF
 static const struct of_device_id pca954x_of_match[] = {
         { .compatible = "nxp,pca9540", .data = &chips[pca_9540] },
@@ -393,17 +381,8 @@ static int pca954x_probe(struct i2c_client *client,
         match = of_match_device(of_match_ptr(pca954x_of_match), &client->dev);
         if (match)
                 data->chip = of_device_get_match_data(&client->dev);
-        else if (id)
+        else
                 data->chip = &chips[id->driver_data];
-        else {
-                const struct acpi_device_id *acpi_id;
-
-                acpi_id = acpi_match_device(ACPI_PTR(pca954x_acpi_ids),
-                                                &client->dev);
-                if (!acpi_id)
-                        return -ENODEV;
-                data->chip = &chips[acpi_id->driver_data];
-        }
 
         data->last_chan = 0;               /* force the first selection */
 
@@ -492,7 +471,6 @@ static struct i2c_driver pca954x_driver = {
                 .name   = "pca954x",
                 .pm     = &pca954x_pm,
                 .of_match_table = of_match_ptr(pca954x_of_match),
-                .acpi_match_table = ACPI_PTR(pca954x_acpi_ids),
         },
         .probe          = pca954x_probe,
         .remove         = pca954x_remove,
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index ad9dec30bb30..4282ceca3d8f 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -169,7 +169,9 @@ static irqreturn_t tiadc_irq_h(int irq, void *private)
 {
         struct iio_dev *indio_dev = private;
         struct tiadc_device *adc_dev = iio_priv(indio_dev);
-        unsigned int status, config;
+        unsigned int status, config, adc_fsm;
+        unsigned short count = 0;
+
         status = tiadc_readl(adc_dev, REG_IRQSTATUS);
 
         /*
@@ -183,6 +185,15 @@ static irqreturn_t tiadc_irq_h(int irq, void *private)
                 tiadc_writel(adc_dev, REG_CTRL, config);
                 tiadc_writel(adc_dev, REG_IRQSTATUS, IRQENB_FIFO1OVRRUN
                                 | IRQENB_FIFO1UNDRFLW | IRQENB_FIFO1THRES);
+
+                /* wait for idle state.
+                 * ADC needs to finish the current conversion
+                 * before disabling the module
+                 */
+                do {
+                        adc_fsm = tiadc_readl(adc_dev, REG_ADCFSM);
+                } while (adc_fsm != 0x10 && count++ < 100);
+
                 tiadc_writel(adc_dev, REG_CTRL, (config | CNTRLREG_TSCSSENB));
                 return IRQ_HANDLED;
         } else if (status & IRQENB_FIFO1THRES) {
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index a3cce3a38300..ecf592d69043 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -51,8 +51,6 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
                         st->report_state.report_id,
                         st->report_state.index,
                         HID_USAGE_SENSOR_PROP_REPORTING_STATE_ALL_EVENTS_ENUM);
-
-                poll_value = hid_sensor_read_poll_value(st);
         } else {
                 int val;
 
@@ -89,7 +87,9 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
         sensor_hub_get_feature(st->hsdev, st->power_state.report_id,
                                st->power_state.index,
                                sizeof(state_val), &state_val);
-        if (state && poll_value)
+        if (state)
+                poll_value = hid_sensor_read_poll_value(st);
+        if (poll_value > 0)
                 msleep_interruptible(poll_value * 2);
 
         return 0;
diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
index 78532ce07449..81b572d7699a 100644
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
@@ -193,8 +193,8 @@ int st_lsm6dsx_update_watermark(struct st_lsm6dsx_sensor *sensor, u16 watermark)
         if (err < 0)
                 goto out;
 
-        fifo_watermark = ((data & ~ST_LSM6DSX_FIFO_TH_MASK) << 8) |
-                          (fifo_watermark & ST_LSM6DSX_FIFO_TH_MASK);
+        fifo_watermark = ((data << 8) & ~ST_LSM6DSX_FIFO_TH_MASK) |
+                         (fifo_watermark & ST_LSM6DSX_FIFO_TH_MASK);
 
         wdata = cpu_to_le16(fifo_watermark);
         err = hw->tf->write(hw->dev, ST_LSM6DSX_REG_FIFO_THL_ADDR,
diff --git a/drivers/iio/magnetometer/ak8974.c b/drivers/iio/magnetometer/ak8974.c
index 6dd8cbd7ce95..e13370dc9b1c 100644
--- a/drivers/iio/magnetometer/ak8974.c
+++ b/drivers/iio/magnetometer/ak8974.c
@@ -763,7 +763,7 @@ power_off:
         return ret;
 }
 
-static int __exit ak8974_remove(struct i2c_client *i2c)
+static int ak8974_remove(struct i2c_client *i2c)
 {
         struct iio_dev *indio_dev = i2c_get_clientdata(i2c);
         struct ak8974 *ak8974 = iio_priv(indio_dev);
@@ -845,7 +845,7 @@ static struct i2c_driver ak8974_driver = {
                 .of_match_table = of_match_ptr(ak8974_of_match),
         },
         .probe    = ak8974_probe,
-        .remove   = __exit_p(ak8974_remove),
+        .remove   = ak8974_remove,
         .id_table = ak8974_id,
 };
 module_i2c_driver(ak8974_driver);
diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c
index e95510117a6d..f2ae75fa3128 100644
--- a/drivers/infiniband/core/cq.c
+++ b/drivers/infiniband/core/cq.c
@@ -29,7 +29,13 @@ static int __ib_process_cq(struct ib_cq *cq, int budget)
 {
         int i, n, completed = 0;
 
-        while ((n = ib_poll_cq(cq, IB_POLL_BATCH, cq->wc)) > 0) {
+        /*
+         * budget might be (-1) if the caller does not
+         * want to bound this call, thus we need unsigned
+         * minimum here.
+         */
+        while ((n = ib_poll_cq(cq, min_t(u32, IB_POLL_BATCH,
+                        budget - completed), cq->wc)) > 0) {
                 for (i = 0; i < n; i++) {
                         struct ib_wc *wc = &cq->wc[i];
 
@@ -196,7 +202,7 @@ void ib_free_cq(struct ib_cq *cq)
                 irq_poll_disable(&cq->iop);
                 break;
         case IB_POLL_WORKQUEUE:
-                flush_work(&cq->work);
+                cancel_work_sync(&cq->work);
                 break;
         default:
                 WARN_ON_ONCE(1);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 593d2ce6ec7c..7c9e34d679d3 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -336,12 +336,26 @@ int ib_register_device(struct ib_device *device,
         struct device *parent = device->dev.parent;
 
         WARN_ON_ONCE(!parent);
-        if (!device->dev.dma_ops)
-                device->dev.dma_ops = parent->dma_ops;
-        if (!device->dev.dma_mask)
-                device->dev.dma_mask = parent->dma_mask;
-        if (!device->dev.coherent_dma_mask)
-                device->dev.coherent_dma_mask = parent->coherent_dma_mask;
+        WARN_ON_ONCE(device->dma_device);
+        if (device->dev.dma_ops) {
+                /*
+                 * The caller provided custom DMA operations. Copy the
+                 * DMA-related fields that are used by e.g. dma_alloc_coherent()
+                 * into device->dev.
+                 */
+                device->dma_device = &device->dev;
+                if (!device->dev.dma_mask)
+                        device->dev.dma_mask = parent->dma_mask;
+                if (!device->dev.coherent_dma_mask)
+                        device->dev.coherent_dma_mask =
+                                parent->coherent_dma_mask;
+        } else {
+                /*
+                 * The caller did not provide custom DMA operations. Use the
+                 * DMA mapping operations of the parent device.
+                 */
+                device->dma_device = parent;
+        }
 
         mutex_lock(&device_mutex);
 
@@ -1015,8 +1029,7 @@ static int __init ib_core_init(void)
                 return -ENOMEM;
 
         ib_comp_wq = alloc_workqueue("ib-comp-wq",
-                        WQ_UNBOUND | WQ_HIGHPRI | WQ_MEM_RECLAIM,
-                        WQ_UNBOUND_MAX_ACTIVE);
+                        WQ_HIGHPRI | WQ_MEM_RECLAIM | WQ_SYSFS, 0);
         if (!ib_comp_wq) {
                 ret = -ENOMEM;
                 goto err;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index 0f5d43d1f5fc..70c3e9e79508 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -160,6 +160,9 @@ int i40iw_inetaddr_event(struct notifier_block *notifier,
                 return NOTIFY_DONE;
 
         iwdev = &hdl->device;
+        if (iwdev->init_state < INET_NOTIFIER)
+                return NOTIFY_DONE;
+
         netdev = iwdev->ldev->netdev;
         upper_dev = netdev_master_upper_dev_get(netdev);
         if (netdev != event_netdev)
@@ -214,6 +217,9 @@ int i40iw_inet6addr_event(struct notifier_block *notifier,
                 return NOTIFY_DONE;
 
         iwdev = &hdl->device;
+        if (iwdev->init_state < INET_NOTIFIER)
+                return NOTIFY_DONE;
+
         netdev = iwdev->ldev->netdev;
         if (netdev != event_netdev)
                 return NOTIFY_DONE;
@@ -260,6 +266,8 @@ int i40iw_net_event(struct notifier_block *notifier, unsigned long event, void *
                 if (!iwhdl)
                         return NOTIFY_DONE;
                 iwdev = &iwhdl->device;
+                if (iwdev->init_state < INET_NOTIFIER)
+                        return NOTIFY_DONE;
                 p = (__be32 *)neigh->primary_key;
                 i40iw_copy_ip_ntohl(local_ipaddr, p);
                 if (neigh->nud_state & NUD_VALID) {
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index bc9fb144e57b..c52edeafd616 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -372,7 +372,7 @@ static int _ocrdma_pd_mgr_put_bitmap(struct ocrdma_dev *dev, u16 pd_id,
         return 0;
 }
 
-static u8 ocrdma_put_pd_num(struct ocrdma_dev *dev, u16 pd_id,
+static int ocrdma_put_pd_num(struct ocrdma_dev *dev, u16 pd_id,
                                    bool dpp_pool)
 {
         int status;
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 12c4208fd701..af9f596bb68b 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -7068,7 +7068,7 @@ static void qib_7322_txchk_change(struct qib_devdata *dd, u32 start,
         unsigned long flags;
 
         while (wait) {
-                unsigned long shadow;
+                unsigned long shadow = 0;
                 int cstart, previ = -1;
 
                 /*
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
index 3cd96c1b9502..9fbe22d3467b 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
@@ -69,6 +69,9 @@
  */
 #define PCI_DEVICE_ID_VMWARE_PVRDMA     0x0820
 
+#define PVRDMA_NUM_RING_PAGES           4
+#define PVRDMA_QP_NUM_HEADER_PAGES      1
+
 struct pvrdma_dev;
 
 struct pvrdma_page_dir {
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h
index e69d6f3cae32..09078ccfaec7 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h
@@ -132,7 +132,7 @@ enum pvrdma_pci_resource {
 
 enum pvrdma_device_ctl {
         PVRDMA_DEVICE_CTL_ACTIVATE,     /* Activate device. */
-        PVRDMA_DEVICE_CTL_QUIESCE,      /* Quiesce device. */
+        PVRDMA_DEVICE_CTL_UNQUIESCE,    /* Unquiesce device. */
         PVRDMA_DEVICE_CTL_RESET,        /* Reset device. */
 };
 
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
index 100bea5c42ff..34ebc7615411 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
@@ -56,7 +56,7 @@
 #include "pvrdma.h"
 
 #define DRV_NAME        "vmw_pvrdma"
-#define DRV_VERSION     "1.0.0.0-k"
+#define DRV_VERSION     "1.0.1.0-k"
 
 static DEFINE_MUTEX(pvrdma_device_list_lock);
 static LIST_HEAD(pvrdma_device_list);
@@ -660,7 +660,16 @@ static void pvrdma_netdevice_event_handle(struct pvrdma_dev *dev,
                 pvrdma_dispatch_event(dev, 1, IB_EVENT_PORT_ERR);
                 break;
         case NETDEV_UP:
-                pvrdma_dispatch_event(dev, 1, IB_EVENT_PORT_ACTIVE);
+                pvrdma_write_reg(dev, PVRDMA_REG_CTL,
+                                 PVRDMA_DEVICE_CTL_UNQUIESCE);
+
+                mb();
+
+                if (pvrdma_read_reg(dev, PVRDMA_REG_ERR))
+                        dev_err(&dev->pdev->dev,
+                                "failed to activate device during link up\n");
+                else
+                        pvrdma_dispatch_event(dev, 1, IB_EVENT_PORT_ACTIVE);
                 break;
         default:
                 dev_dbg(&dev->pdev->dev, "ignore netdevice event %ld on %s\n",
@@ -858,7 +867,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev,
         dev->dsr->resp_slot_dma = (u64)slot_dma;
 
         /* Async event ring */
-        dev->dsr->async_ring_pages.num_pages = 4;
+        dev->dsr->async_ring_pages.num_pages = PVRDMA_NUM_RING_PAGES;
         ret = pvrdma_page_dir_init(dev, &dev->async_pdir,
                                    dev->dsr->async_ring_pages.num_pages, true);
         if (ret)
@@ -867,7 +876,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev,
         dev->dsr->async_ring_pages.pdir_dma = dev->async_pdir.dir_dma;
 
         /* CQ notification ring */
-        dev->dsr->cq_ring_pages.num_pages = 4;
+        dev->dsr->cq_ring_pages.num_pages = PVRDMA_NUM_RING_PAGES;
         ret = pvrdma_page_dir_init(dev, &dev->cq_pdir,
                                    dev->dsr->cq_ring_pages.num_pages, true);
         if (ret)
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
index dbbfd35e7da7..30062aad3af1 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
@@ -170,8 +170,9 @@ static int pvrdma_set_sq_size(struct pvrdma_dev *dev, struct ib_qp_cap *req_cap,
                                              sizeof(struct pvrdma_sge) *
                                              qp->sq.max_sg);
         /* Note: one extra page for the header. */
-        qp->npages_send = 1 + (qp->sq.wqe_cnt * qp->sq.wqe_size +
-                               PAGE_SIZE - 1) / PAGE_SIZE;
+        qp->npages_send = PVRDMA_QP_NUM_HEADER_PAGES +
+                          (qp->sq.wqe_cnt * qp->sq.wqe_size + PAGE_SIZE - 1) /
+                                                                PAGE_SIZE;
 
         return 0;
 }
@@ -288,7 +289,7 @@ struct ib_qp *pvrdma_create_qp(struct ib_pd *pd,
                         qp->npages = qp->npages_send + qp->npages_recv;
 
                         /* Skip header page. */
-                        qp->sq.offset = PAGE_SIZE;
+                        qp->sq.offset = PVRDMA_QP_NUM_HEADER_PAGES * PAGE_SIZE;
 
                         /* Recv queue pages are after send pages. */
                         qp->rq.offset = qp->npages_send * PAGE_SIZE;
@@ -341,7 +342,7 @@ struct ib_qp *pvrdma_create_qp(struct ib_pd *pd,
         cmd->qp_type = ib_qp_type_to_pvrdma(init_attr->qp_type);
         cmd->access_flags = IB_ACCESS_LOCAL_WRITE;
         cmd->total_chunks = qp->npages;
-        cmd->send_chunks = qp->npages_send - 1;
+        cmd->send_chunks = qp->npages_send - PVRDMA_QP_NUM_HEADER_PAGES;
         cmd->pdir_dma = qp->pdir.dir_dma;
 
         dev_dbg(&dev->pdev->dev, "create queuepair with %d, %d, %d, %d\n",
@@ -554,13 +555,13 @@ out:
         return ret;
 }
 
-static inline void *get_sq_wqe(struct pvrdma_qp *qp, int n)
+static inline void *get_sq_wqe(struct pvrdma_qp *qp, unsigned int n)
 {
         return pvrdma_page_dir_get_ptr(&qp->pdir,
                                        qp->sq.offset + n * qp->sq.wqe_size);
 }
 
-static inline void *get_rq_wqe(struct pvrdma_qp *qp, int n)
+static inline void *get_rq_wqe(struct pvrdma_qp *qp, unsigned int n)
 {
         return pvrdma_page_dir_get_ptr(&qp->pdir,
                                        qp->rq.offset + n * qp->rq.wqe_size);
@@ -598,9 +599,7 @@ int pvrdma_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
         unsigned long flags;
         struct pvrdma_sq_wqe_hdr *wqe_hdr;
         struct pvrdma_sge *sge;
-        int i, index;
-        int nreq;
-        int ret;
+        int i, ret;
 
         /*
          * In states lower than RTS, we can fail immediately. In other states,
@@ -613,9 +612,8 @@ int pvrdma_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
         spin_lock_irqsave(&qp->sq.lock, flags);
 
-        index = pvrdma_idx(&qp->sq.ring->prod_tail, qp->sq.wqe_cnt);
-        for (nreq = 0; wr; nreq++, wr = wr->next) {
-                unsigned int tail;
+        while (wr) {
+                unsigned int tail = 0;
 
                 if (unlikely(!pvrdma_idx_ring_has_space(
                                 qp->sq.ring, qp->sq.wqe_cnt, &tail))) {
@@ -680,7 +678,7 @@ int pvrdma_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         }
                 }
 
-                wqe_hdr = (struct pvrdma_sq_wqe_hdr *)get_sq_wqe(qp, index);
+                wqe_hdr = (struct pvrdma_sq_wqe_hdr *)get_sq_wqe(qp, tail);
                 memset(wqe_hdr, 0, sizeof(*wqe_hdr));
                 wqe_hdr->wr_id = wr->wr_id;
                 wqe_hdr->num_sge = wr->num_sge;
@@ -771,12 +769,11 @@ int pvrdma_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 /* Make sure wqe is written before index update */
                 smp_wmb();
 
-                index++;
-                if (unlikely(index >= qp->sq.wqe_cnt))
-                        index = 0;
                 /* Update shared sq ring */
                 pvrdma_idx_ring_inc(&qp->sq.ring->prod_tail,
                                     qp->sq.wqe_cnt);
+
+                wr = wr->next;
         }
 
         ret = 0;
@@ -806,7 +803,6 @@ int pvrdma_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
         struct pvrdma_qp *qp = to_vqp(ibqp);
         struct pvrdma_rq_wqe_hdr *wqe_hdr;
         struct pvrdma_sge *sge;
-        int index, nreq;
         int ret = 0;
         int i;
 
@@ -821,9 +817,8 @@ int pvrdma_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 
         spin_lock_irqsave(&qp->rq.lock, flags);
 
-        index = pvrdma_idx(&qp->rq.ring->prod_tail, qp->rq.wqe_cnt);
-        for (nreq = 0; wr; nreq++, wr = wr->next) {
-                unsigned int tail;
+        while (wr) {
+                unsigned int tail = 0;
 
                 if (unlikely(wr->num_sge > qp->rq.max_sg ||
                              wr->num_sge < 0)) {
@@ -843,7 +838,7 @@ int pvrdma_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                         goto out;
                 }
 
-                wqe_hdr = (struct pvrdma_rq_wqe_hdr *)get_rq_wqe(qp, index);
+                wqe_hdr = (struct pvrdma_rq_wqe_hdr *)get_rq_wqe(qp, tail);
                 wqe_hdr->wr_id = wr->wr_id;
                 wqe_hdr->num_sge = wr->num_sge;
                 wqe_hdr->total_len = 0;
@@ -859,12 +854,11 @@ int pvrdma_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                 /* Make sure wqe is written before index update */
                 smp_wmb();
 
-                index++;
-                if (unlikely(index >= qp->rq.wqe_cnt))
-                        index = 0;
                 /* Update shared rq ring */
                 pvrdma_idx_ring_inc(&qp->rq.ring->prod_tail,
                                     qp->rq.wqe_cnt);
+
+                wr = wr->next;
         }
 
         spin_unlock_irqrestore(&qp->rq.lock, flags);
diff --git a/drivers/infiniband/sw/rdmavt/mmap.c b/drivers/infiniband/sw/rdmavt/mmap.c
index e202b8142759..6b712eecbd37 100644
--- a/drivers/infiniband/sw/rdmavt/mmap.c
+++ b/drivers/infiniband/sw/rdmavt/mmap.c
@@ -170,9 +170,9 @@ struct rvt_mmap_info *rvt_create_mmap_info(struct rvt_dev_info *rdi,
 
         spin_lock_irq(&rdi->mmap_offset_lock);
         if (rdi->mmap_offset == 0)
-                rdi->mmap_offset = PAGE_SIZE;
+                rdi->mmap_offset = ALIGN(PAGE_SIZE, SHMLBA);
         ip->offset = rdi->mmap_offset;
-        rdi->mmap_offset += size;
+        rdi->mmap_offset += ALIGN(size, SHMLBA);
         spin_unlock_irq(&rdi->mmap_offset_lock);
 
         INIT_LIST_HEAD(&ip->pending_mmaps);
diff --git a/drivers/infiniband/sw/rxe/Kconfig b/drivers/infiniband/sw/rxe/Kconfig
index 7d1ac27ed251..6332dedc11e8 100644
--- a/drivers/infiniband/sw/rxe/Kconfig
+++ b/drivers/infiniband/sw/rxe/Kconfig
@@ -22,4 +22,4 @@ config RDMA_RXE
         To configure and work with soft-RoCE driver please use the
         following wiki page under "configure Soft-RoCE (RXE)" section:
 
-        https://github.com/SoftRoCE/rxe-dev/wiki/rxe-dev:-Home
+        https://github.com/linux-rdma/rdma-core/blob/master/Documentation/rxe.md
diff --git a/drivers/infiniband/sw/rxe/rxe_mmap.c b/drivers/infiniband/sw/rxe/rxe_mmap.c
index c572a4c09359..bd812e00988e 100644
--- a/drivers/infiniband/sw/rxe/rxe_mmap.c
+++ b/drivers/infiniband/sw/rxe/rxe_mmap.c
@@ -156,10 +156,10 @@ struct rxe_mmap_info *rxe_create_mmap_info(struct rxe_dev *rxe,
         spin_lock_bh(&rxe->mmap_offset_lock);
 
         if (rxe->mmap_offset == 0)
-                rxe->mmap_offset = PAGE_SIZE;
+                rxe->mmap_offset = ALIGN(PAGE_SIZE, SHMLBA);
 
         ip->info.offset = rxe->mmap_offset;
-        rxe->mmap_offset += size;
+        rxe->mmap_offset += ALIGN(size, SHMLBA);
 
         spin_unlock_bh(&rxe->mmap_offset_lock);
 
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index dbfde0dc6ff7..9f95f50b2909 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -729,11 +729,11 @@ next_wqe:
         ret = rxe_xmit_packet(to_rdev(qp->ibqp.device), qp, &pkt, skb);
         if (ret) {
                 qp->need_req_skb = 1;
-                kfree_skb(skb);
 
                 rollback_state(wqe, qp, &rollback_wqe, rollback_psn);
 
                 if (ret == -EAGAIN) {
+                        kfree_skb(skb);
                         rxe_run_task(&qp->req.task, 1);
                         goto exit;
                 }
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index d404a8aba7af..c9dd385ce62e 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -813,18 +813,17 @@ static enum resp_states execute(struct rxe_qp *qp, struct rxe_pkt_info *pkt)
                 WARN_ON_ONCE(1);
         }
 
-        /* We successfully processed this new request. */
-        qp->resp.msn++;
-
         /* next expected psn, read handles this separately */
         qp->resp.psn = (pkt->psn + 1) & BTH_PSN_MASK;
 
         qp->resp.opcode = pkt->opcode;
         qp->resp.status = IB_WC_SUCCESS;
 
-        if (pkt->mask & RXE_COMP_MASK)
+        if (pkt->mask & RXE_COMP_MASK) {
+                /* We successfully processed this new request. */
+                qp->resp.msn++;
                 return RESPST_COMPLETE;
-        else if (qp_type(qp) == IB_QPT_RC)
+        } else if (qp_type(qp) == IB_QPT_RC)
                 return RESPST_ACKNOWLEDGE;
         else
                 return RESPST_CLEANUP;
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index 9d0b22ad58c1..c1ae4aeae2f9 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -430,6 +430,7 @@ struct iser_fr_desc {
         struct list_head                  list;
         struct iser_reg_resources         rsc;
         struct iser_pi_context           *pi_ctx;
+        struct list_head                  all_list;
 };
 
 /**
@@ -443,6 +444,7 @@ struct iser_fr_pool {
         struct list_head        list;
         spinlock_t              lock;
         int                     size;
+        struct list_head        all_list;
 };
 
 /**
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 30b622f2ab73..c538a38c91ce 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -362,6 +362,7 @@ int iser_alloc_fastreg_pool(struct ib_conn *ib_conn,
         int i, ret;
 
         INIT_LIST_HEAD(&fr_pool->list);
+        INIT_LIST_HEAD(&fr_pool->all_list);
         spin_lock_init(&fr_pool->lock);
         fr_pool->size = 0;
         for (i = 0; i < cmds_max; i++) {
@@ -373,6 +374,7 @@ int iser_alloc_fastreg_pool(struct ib_conn *ib_conn,
                 }
 
                 list_add_tail(&desc->list, &fr_pool->list);
+                list_add_tail(&desc->all_list, &fr_pool->all_list);
                 fr_pool->size++;
         }
 
@@ -392,13 +394,13 @@ void iser_free_fastreg_pool(struct ib_conn *ib_conn)
         struct iser_fr_desc *desc, *tmp;
         int i = 0;
 
-        if (list_empty(&fr_pool->list))
+        if (list_empty(&fr_pool->all_list))
                 return;
 
         iser_info("freeing conn %p fr pool\n", ib_conn);
 
-        list_for_each_entry_safe(desc, tmp, &fr_pool->list, list) {
-                list_del(&desc->list);
+        list_for_each_entry_safe(desc, tmp, &fr_pool->all_list, all_list) {
+                list_del(&desc->all_list);
                 iser_free_reg_res(&desc->rsc);
                 if (desc->pi_ctx)
                         iser_free_pi_ctx(desc->pi_ctx);
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index d96aa27dfcdc..db64adfbe1af 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -141,6 +141,9 @@ static int iforce_usb_probe(struct usb_interface *intf,
 
         interface = intf->cur_altsetting;
 
+        if (interface->desc.bNumEndpoints < 2)
+                return -ENODEV;
+
         epirq = &interface->endpoint[0].desc;
         epout = &interface->endpoint[1].desc;
 
diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index 9cc6d057c302..23c191a2a071 100644
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -700,6 +700,10 @@ static int cm109_usb_probe(struct usb_interface *intf,
         int error = -ENOMEM;
 
         interface = intf->cur_altsetting;
+
+        if (interface->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         endpoint = &interface->endpoint[0].desc;
 
         if (!usb_endpoint_is_int_in(endpoint))
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index 9c0ea36913b4..f4e8fbec6a94 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1667,6 +1667,10 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
                 return -EINVAL;
 
         alt = pcu->ctrl_intf->cur_altsetting;
+
+        if (alt->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         pcu->ep_ctrl = &alt->endpoint[0].desc;
         pcu->max_ctrl_size = usb_endpoint_maxp(pcu->ep_ctrl);
 
diff --git a/drivers/input/misc/yealink.c b/drivers/input/misc/yealink.c
index 79c964c075f1..6e7ff9561d92 100644
--- a/drivers/input/misc/yealink.c
+++ b/drivers/input/misc/yealink.c
@@ -875,6 +875,10 @@ static int usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
         int ret, pipe, i;
 
         interface = intf->cur_altsetting;
+
+        if (interface->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         endpoint = &interface->endpoint[0].desc;
         if (!usb_endpoint_is_int_in(endpoint))
                 return -ENODEV;
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 72b28ebfe360..f210e19ddba6 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1282,10 +1282,8 @@ static int alps_decode_ss4_v2(struct alps_fields *f,
         /* handle buttons */
         if (pkt_id == SS4_PACKET_ID_STICK) {
                 f->ts_left = !!(SS4_BTN_V2(p) & 0x01);
-                if (!(priv->flags & ALPS_BUTTONPAD)) {
-                        f->ts_right = !!(SS4_BTN_V2(p) & 0x02);
-                        f->ts_middle = !!(SS4_BTN_V2(p) & 0x04);
-                }
+                f->ts_right = !!(SS4_BTN_V2(p) & 0x02);
+                f->ts_middle = !!(SS4_BTN_V2(p) & 0x04);
         } else {
                 f->left = !!(SS4_BTN_V2(p) & 0x01);
                 if (!(priv->flags & ALPS_BUTTONPAD)) {
@@ -2462,14 +2460,34 @@ static int alps_update_device_area_ss4_v2(unsigned char otp[][4],
         int num_y_electrode;
         int x_pitch, y_pitch, x_phys, y_phys;
 
-        num_x_electrode = SS4_NUMSENSOR_XOFFSET + (otp[1][0] & 0x0F);
-        num_y_electrode = SS4_NUMSENSOR_YOFFSET + ((otp[1][0] >> 4) & 0x0F);
+        if (IS_SS4PLUS_DEV(priv->dev_id)) {
+                num_x_electrode =
+                        SS4PLUS_NUMSENSOR_XOFFSET + (otp[0][2] & 0x0F);
+                num_y_electrode =
+                        SS4PLUS_NUMSENSOR_YOFFSET + ((otp[0][2] >> 4) & 0x0F);
+
+                priv->x_max =
+                        (num_x_electrode - 1) * SS4PLUS_COUNT_PER_ELECTRODE;
+                priv->y_max =
+                        (num_y_electrode - 1) * SS4PLUS_COUNT_PER_ELECTRODE;
 
-        priv->x_max = (num_x_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
-        priv->y_max = (num_y_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
+                x_pitch = (otp[0][1] & 0x0F) + SS4PLUS_MIN_PITCH_MM;
+                y_pitch = ((otp[0][1] >> 4) & 0x0F) + SS4PLUS_MIN_PITCH_MM;
 
-        x_pitch = ((otp[1][2] >> 2) & 0x07) + SS4_MIN_PITCH_MM;
-        y_pitch = ((otp[1][2] >> 5) & 0x07) + SS4_MIN_PITCH_MM;
+        } else {
+                num_x_electrode =
+                        SS4_NUMSENSOR_XOFFSET + (otp[1][0] & 0x0F);
+                num_y_electrode =
+                        SS4_NUMSENSOR_YOFFSET + ((otp[1][0] >> 4) & 0x0F);
+
+                priv->x_max =
+                        (num_x_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
+                priv->y_max =
+                        (num_y_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
+
+                x_pitch = ((otp[1][2] >> 2) & 0x07) + SS4_MIN_PITCH_MM;
+                y_pitch = ((otp[1][2] >> 5) & 0x07) + SS4_MIN_PITCH_MM;
+        }
 
         x_phys = x_pitch * (num_x_electrode - 1); /* In 0.1 mm units */
         y_phys = y_pitch * (num_y_electrode - 1); /* In 0.1 mm units */
@@ -2485,7 +2503,10 @@ static int alps_update_btn_info_ss4_v2(unsigned char otp[][4],
 {
         unsigned char is_btnless;
 
-        is_btnless = (otp[1][1] >> 3) & 0x01;
+        if (IS_SS4PLUS_DEV(priv->dev_id))
+                is_btnless = (otp[1][0] >> 1) & 0x01;
+        else
+                is_btnless = (otp[1][1] >> 3) & 0x01;
 
         if (is_btnless)
                 priv->flags |= ALPS_BUTTONPAD;
@@ -2493,6 +2514,21 @@ static int alps_update_btn_info_ss4_v2(unsigned char otp[][4],
         return 0;
 }
 
+static int alps_update_dual_info_ss4_v2(unsigned char otp[][4],
+                                       struct alps_data *priv)
+{
+        bool is_dual = false;
+
+        if (IS_SS4PLUS_DEV(priv->dev_id))
+                is_dual = (otp[0][0] >> 4) & 0x01;
+
+        if (is_dual)
+                priv->flags |= ALPS_DUALPOINT |
+                                        ALPS_DUALPOINT_WITH_PRESSURE;
+
+        return 0;
+}
+
 static int alps_set_defaults_ss4_v2(struct psmouse *psmouse,
                                     struct alps_data *priv)
 {
@@ -2508,6 +2544,8 @@ static int alps_set_defaults_ss4_v2(struct psmouse *psmouse,
 
         alps_update_btn_info_ss4_v2(otp, priv);
 
+        alps_update_dual_info_ss4_v2(otp, priv);
+
         return 0;
 }
 
@@ -2753,10 +2791,6 @@ static int alps_set_protocol(struct psmouse *psmouse,
                 if (alps_set_defaults_ss4_v2(psmouse, priv))
                         return -EIO;
 
-                if (priv->fw_ver[1] == 0x1)
-                        priv->flags |= ALPS_DUALPOINT |
-                                        ALPS_DUALPOINT_WITH_PRESSURE;
-
                 break;
         }
 
@@ -2827,10 +2861,7 @@ static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
                            ec[2] >= 0x90 && ec[2] <= 0x9d) {
                         protocol = &alps_v3_protocol_data;
                 } else if (e7[0] == 0x73 && e7[1] == 0x03 &&
-                           e7[2] == 0x14 && ec[1] == 0x02) {
-                        protocol = &alps_v8_protocol_data;
-                } else if (e7[0] == 0x73 && e7[1] == 0x03 &&
-                           e7[2] == 0x28 && ec[1] == 0x01) {
+                           (e7[2] == 0x14 || e7[2] == 0x28)) {
                         protocol = &alps_v8_protocol_data;
                 } else {
                         psmouse_dbg(psmouse,
@@ -2840,7 +2871,8 @@ static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
         }
 
         if (priv) {
-                /* Save the Firmware version */
+                /* Save Device ID and Firmware version */
+                memcpy(priv->dev_id, e7, 3);
                 memcpy(priv->fw_ver, ec, 3);
                 error = alps_set_protocol(psmouse, priv, protocol);
                 if (error)
diff --git a/drivers/input/mouse/alps.h b/drivers/input/mouse/alps.h
index 6d279aa27cb9..4334f2805d93 100644
--- a/drivers/input/mouse/alps.h
+++ b/drivers/input/mouse/alps.h
@@ -54,6 +54,16 @@ enum SS4_PACKET_ID {
 
 #define SS4_MASK_NORMAL_BUTTONS         0x07
 
+#define SS4PLUS_COUNT_PER_ELECTRODE     128
+#define SS4PLUS_NUMSENSOR_XOFFSET       16
+#define SS4PLUS_NUMSENSOR_YOFFSET       5
+#define SS4PLUS_MIN_PITCH_MM            37
+
+#define IS_SS4PLUS_DEV(_b)      (((_b[0]) == 0x73) &&   \
+                                 ((_b[1]) == 0x03) &&   \
+                                 ((_b[2]) == 0x28)              \
+                                )
+
 #define SS4_IS_IDLE_V2(_b)      (((_b[0]) == 0x18) &&           \
                                  ((_b[1]) == 0x10) &&           \
                                  ((_b[2]) == 0x00) &&           \
@@ -283,6 +293,7 @@ struct alps_data {
         int addr_command;
         u16 proto_version;
         u8 byte0, mask0;
+        u8 dev_id[3];
         u8 fw_ver[3];
         int flags;
         int x_max;
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 352050e9031d..d5ab9ddef3e3 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -218,17 +218,19 @@ static int elan_query_product(struct elan_tp_data *data)
 
 static int elan_check_ASUS_special_fw(struct elan_tp_data *data)
 {
-        if (data->ic_type != 0x0E)
-                return false;
-
-        switch (data->product_id) {
-        case 0x05 ... 0x07:
-        case 0x09:
-        case 0x13:
+        if (data->ic_type == 0x0E) {
+                switch (data->product_id) {
+                case 0x05 ... 0x07:
+                case 0x09:
+                case 0x13:
+                        return true;
+                }
+        } else if (data->ic_type == 0x08 && data->product_id == 0x26) {
+                /* ASUS EeeBook X205TA */
                 return true;
-        default:
-                return false;
         }
+
+        return false;
 }
 
 static int __elan_initialize(struct elan_tp_data *data)
diff --git a/drivers/input/rmi4/rmi_f30.c b/drivers/input/rmi4/rmi_f30.c
index 198678613382..34dfee555b20 100644
--- a/drivers/input/rmi4/rmi_f30.c
+++ b/drivers/input/rmi4/rmi_f30.c
@@ -170,6 +170,10 @@ static int rmi_f30_config(struct rmi_function *fn)
                                 rmi_get_platform_data(fn->rmi_dev);
         int error;
 
+        /* can happen if f30_data.disable is set */
+        if (!f30)
+                return 0;
+
         if (pdata->f30_data.trackstick_buttons) {
                 /* Try [re-]establish link to F03. */
                 f30->f03 = rmi_find_function(fn->rmi_dev, 0x03);
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 05afd16ea9c9..312bd6ca9198 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -120,6 +120,13 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
                 },
         },
         {
+                /* Dell Embedded Box PC 3000 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Embedded Box PC 3000"),
+                },
+        },
+        {
                 /* OQO Model 01 */
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "OQO"),
@@ -513,6 +520,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
                 },
         },
+        {
+                /* TUXEDO BU1406 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"),
+                },
+        },
         { }
 };
 
diff --git a/drivers/input/tablet/hanwang.c b/drivers/input/tablet/hanwang.c
index cd852059b99e..df4bea96d7ed 100644
--- a/drivers/input/tablet/hanwang.c
+++ b/drivers/input/tablet/hanwang.c
@@ -340,6 +340,9 @@ static int hanwang_probe(struct usb_interface *intf, const struct usb_device_id
         int error;
         int i;
 
+        if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         hanwang = kzalloc(sizeof(struct hanwang), GFP_KERNEL);
         input_dev = input_allocate_device();
         if (!hanwang || !input_dev) {
diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c
index e850d7e8afbc..4d9d64908b59 100644
--- a/drivers/input/tablet/kbtab.c
+++ b/drivers/input/tablet/kbtab.c
@@ -122,6 +122,9 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
         struct input_dev *input_dev;
         int error = -ENOMEM;
 
+        if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL);
         input_dev = input_allocate_device();
         if (!kbtab || !input_dev)
diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index aefb6e11f88a..4c0eecae065c 100644
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -527,6 +527,9 @@ static int sur40_probe(struct usb_interface *interface,
         if (iface_desc->desc.bInterfaceClass != 0xFF)
                 return -ENODEV;
 
+        if (iface_desc->desc.bNumEndpoints < 5)
+                return -ENODEV;
+
         /* Use endpoint #4 (0x86). */
         endpoint = &iface_desc->endpoint[4].desc;
         if (endpoint->bEndpointAddress != TOUCH_ENDPOINT)
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 98940d1392cb..b17536d6e69b 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3202,7 +3202,7 @@ static void amd_iommu_get_resv_regions(struct device *dev,
 
         region = iommu_alloc_resv_region(MSI_RANGE_START,
                                          MSI_RANGE_END - MSI_RANGE_START + 1,
-                                         0, IOMMU_RESV_RESERVED);
+                                         0, IOMMU_RESV_MSI);
         if (!region)
                 return;
         list_add_tail(&region->list, head);
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index 5806a6acc94e..591bb96047c9 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -1888,7 +1888,7 @@ static void arm_smmu_get_resv_regions(struct device *dev,
         int prot = IOMMU_WRITE | IOMMU_NOEXEC | IOMMU_MMIO;
 
         region = iommu_alloc_resv_region(MSI_IOVA_BASE, MSI_IOVA_LENGTH,
-                                         prot, IOMMU_RESV_MSI);
+                                         prot, IOMMU_RESV_SW_MSI);
         if (!region)
                 return;
 
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index abf6496843a6..b493c99e17f7 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -1608,7 +1608,7 @@ static void arm_smmu_get_resv_regions(struct device *dev,
         int prot = IOMMU_WRITE | IOMMU_NOEXEC | IOMMU_MMIO;
 
         region = iommu_alloc_resv_region(MSI_IOVA_BASE, MSI_IOVA_LENGTH,
-                                         prot, IOMMU_RESV_MSI);
+                                         prot, IOMMU_RESV_SW_MSI);
         if (!region)
                 return;
 
diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
index a7e0821c9967..c01bfcdb2383 100644
--- a/drivers/iommu/exynos-iommu.c
+++ b/drivers/iommu/exynos-iommu.c
@@ -512,7 +512,13 @@ static void sysmmu_tlb_invalidate_flpdcache(struct sysmmu_drvdata *data,
         spin_lock_irqsave(&data->lock, flags);
         if (data->active && data->version >= MAKE_MMU_VER(3, 3)) {
                 clk_enable(data->clk_master);
-                __sysmmu_tlb_invalidate_entry(data, iova, 1);
+                if (sysmmu_block(data)) {
+                        if (data->version >= MAKE_MMU_VER(5, 0))
+                                __sysmmu_tlb_invalidate(data);
+                        else
+                                __sysmmu_tlb_invalidate_entry(data, iova, 1);
+                        sysmmu_unblock(data);
+                }
                 clk_disable(data->clk_master);
         }
         spin_unlock_irqrestore(&data->lock, flags);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 238ad3447712..d412a313a372 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -916,7 +916,7 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
                                  * which we used for the IOMMU lookup. Strictly speaking
                                  * we could do this for all PCI devices; we only need to
                                  * get the BDF# from the scope table for ACPI matches. */
-                                if (pdev->is_virtfn)
+                                if (pdev && pdev->is_virtfn)
                                         goto got_pdev;
 
                                 *bus = drhd->devices[i].bus;
@@ -5249,7 +5249,7 @@ static void intel_iommu_get_resv_regions(struct device *device,
 
         reg = iommu_alloc_resv_region(IOAPIC_RANGE_START,
                                       IOAPIC_RANGE_END - IOAPIC_RANGE_START + 1,
-                                      0, IOMMU_RESV_RESERVED);
+                                      0, IOMMU_RESV_MSI);
         if (!reg)
                 return;
         list_add_tail(&reg->list, head);
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
index 1c049e2e12bf..8d6ca28c3e1f 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -422,8 +422,12 @@ static int __arm_v7s_map(struct arm_v7s_io_pgtable *data, unsigned long iova,
                         pte |= ARM_V7S_ATTR_NS_TABLE;
 
                 __arm_v7s_set_pte(ptep, pte, 1, cfg);
-        } else {
+        } else if (ARM_V7S_PTE_IS_TABLE(pte, lvl)) {
                 cptep = iopte_deref(pte, lvl);
+        } else {
+                /* We require an unmap first */
+                WARN_ON(!selftest_running);
+                return -EEXIST;
         }
 
         /* Rinse, repeat */
diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
index feacc54bec68..f9bc6ebb8140 100644
--- a/drivers/iommu/io-pgtable-arm.c
+++ b/drivers/iommu/io-pgtable-arm.c
@@ -335,8 +335,12 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova,
                 if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS)
                         pte |= ARM_LPAE_PTE_NSTABLE;
                 __arm_lpae_set_pte(ptep, pte, cfg);
-        } else {
+        } else if (!iopte_leaf(pte, lvl)) {
                 cptep = iopte_deref(pte, data);
+        } else {
+                /* We require an unmap first */
+                WARN_ON(!selftest_running);
+                return -EEXIST;
         }
 
         /* Rinse, repeat */
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 8ea14f41a979..3b67144dead2 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -72,6 +72,7 @@ static const char * const iommu_group_resv_type_string[] = {
         [IOMMU_RESV_DIRECT]     = "direct",
         [IOMMU_RESV_RESERVED]   = "reserved",
         [IOMMU_RESV_MSI]        = "msi",
+        [IOMMU_RESV_SW_MSI]     = "msi",
 };
 
 #define IOMMU_GROUP_ATTR(_name, _mode, _show, _store)           \
@@ -1743,8 +1744,8 @@ void iommu_put_resv_regions(struct device *dev, struct list_head *list)
 }
 
 struct iommu_resv_region *iommu_alloc_resv_region(phys_addr_t start,
-                                                  size_t length,
-                                                  int prot, int type)
+                                                  size_t length, int prot,
+                                                  enum iommu_resv_type type)
 {
         struct iommu_resv_region *region;
 
diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig
index 125528f39e92..8162121bb1bc 100644
--- a/drivers/irqchip/Kconfig
+++ b/drivers/irqchip/Kconfig
@@ -262,6 +262,7 @@ config IRQ_MXS
 
 config MVEBU_ODMI
         bool
+        select GENERIC_MSI_IRQ_DOMAIN
 
 config MVEBU_PIC
         bool
diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c
index 1eef56a89b1f..f96601268f71 100644
--- a/drivers/irqchip/irq-crossbar.c
+++ b/drivers/irqchip/irq-crossbar.c
@@ -198,7 +198,8 @@ static const struct irq_domain_ops crossbar_domain_ops = {
 
 static int __init crossbar_of_init(struct device_node *node)
 {
-        int i, size, max = 0, reserved = 0, entry;
+        u32 max = 0, entry, reg_size;
+        int i, size, reserved = 0;
         const __be32 *irqsr;
         int ret = -ENOMEM;
 
@@ -275,9 +276,9 @@ static int __init crossbar_of_init(struct device_node *node)
         if (!cb->register_offsets)
                 goto err_irq_map;
 
-        of_property_read_u32(node, "ti,reg-size", &size);
+        of_property_read_u32(node, "ti,reg-size", &reg_size);
 
-        switch (size) {
+        switch (reg_size) {
         case 1:
                 cb->write = crossbar_writeb;
                 break;
@@ -303,7 +304,7 @@ static int __init crossbar_of_init(struct device_node *node)
                         continue;
 
                 cb->register_offsets[i] = reserved;
-                reserved += size;
+                reserved += reg_size;
         }
 
         of_property_read_u32(node, "ti,irqs-safe-map", &cb->safe_map);
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 23201004fd7a..f77f840d2b5f 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1601,6 +1601,14 @@ static void __maybe_unused its_enable_quirk_cavium_23144(void *data)
         its->flags |= ITS_FLAGS_WORKAROUND_CAVIUM_23144;
 }
 
+static void __maybe_unused its_enable_quirk_qdf2400_e0065(void *data)
+{
+        struct its_node *its = data;
+
+        /* On QDF2400, the size of the ITE is 16Bytes */
+        its->ite_size = 16;
+}
+
 static const struct gic_quirk its_quirks[] = {
 #ifdef CONFIG_CAVIUM_ERRATUM_22375
         {
@@ -1618,6 +1626,14 @@ static const struct gic_quirk its_quirks[] = {
                 .init   = its_enable_quirk_cavium_23144,
         },
 #endif
+#ifdef CONFIG_QCOM_QDF2400_ERRATUM_0065
+        {
+                .desc   = "ITS: QDF2400 erratum 0065",
+                .iidr   = 0x00001070, /* QDF2400 ITS rev 1.x */
+                .mask   = 0xffffffff,
+                .init   = its_enable_quirk_qdf2400_e0065,
+        },
+#endif
         {
         }
 };
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index 11d12bccc4e7..cd20df12d63d 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -991,8 +991,12 @@ static void __init gic_map_single_int(struct device_node *node,
 
 static void __init gic_map_interrupts(struct device_node *node)
 {
+        gic_map_single_int(node, GIC_LOCAL_INT_WD);
+        gic_map_single_int(node, GIC_LOCAL_INT_COMPARE);
         gic_map_single_int(node, GIC_LOCAL_INT_TIMER);
         gic_map_single_int(node, GIC_LOCAL_INT_PERFCTR);
+        gic_map_single_int(node, GIC_LOCAL_INT_SWINT0);
+        gic_map_single_int(node, GIC_LOCAL_INT_SWINT1);
         gic_map_single_int(node, GIC_LOCAL_INT_FDC);
 }
 
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 11e13c56126f..2da3ff650e1d 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -2317,6 +2317,9 @@ static int gigaset_probe(struct usb_interface *interface,
                 return -ENODEV;
         }
 
+        if (hostif->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         dev_info(&udev->dev,
                  "%s: Device matched (Vendor: 0x%x, Product: 0x%x)\n",
                  __func__, le16_to_cpu(udev->descriptor.idVendor),
diff --git a/drivers/isdn/hisax/st5481_b.c b/drivers/isdn/hisax/st5481_b.c
index 409849165838..f64a36007800 100644
--- a/drivers/isdn/hisax/st5481_b.c
+++ b/drivers/isdn/hisax/st5481_b.c
@@ -239,7 +239,7 @@ static void st5481B_mode(struct st5481_bcs *bcs, int mode)
                         }
                 }
         } else {
-                // Disble B channel interrupts
+                // Disable B channel interrupts
                 st5481_usb_device_ctrl_msg(adapter, FFMSK_B1+(bcs->channel * 2), 0, NULL, NULL);
 
                 // Disable B channel FIFOs
diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
index 3f041b187033..f757cef293f8 100644
--- a/drivers/macintosh/macio_asic.c
+++ b/drivers/macintosh/macio_asic.c
@@ -392,6 +392,7 @@ static struct macio_dev * macio_add_one_device(struct macio_chip *chip,
          * To get all the fields, copy all archdata
          */
         dev->ofdev.dev.archdata = chip->lbus.pdev->dev.archdata;
+        dev->ofdev.dev.dma_ops = chip->lbus.pdev->dev.dma_ops;
 #endif /* CONFIG_PCI */
 
 #ifdef DEBUG
diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
index a126919ed102..5d13930f0f22 100644
--- a/drivers/md/bcache/util.h
+++ b/drivers/md/bcache/util.h
@@ -4,7 +4,6 @@
 
 #include <linux/blkdev.h>
 #include <linux/errno.h>
-#include <linux/blkdev.h>
 #include <linux/kernel.h>
 #include <linux/sched/clock.h>
 #include <linux/llist.h>
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index f4ffd1eb8f44..dfb75979e455 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -989,26 +989,29 @@ static void flush_current_bio_list(struct blk_plug_cb *cb, bool from_schedule)
         struct dm_offload *o = container_of(cb, struct dm_offload, cb);
         struct bio_list list;
         struct bio *bio;
+        int i;
 
         INIT_LIST_HEAD(&o->cb.list);
 
         if (unlikely(!current->bio_list))
                 return;
 
-        list = *current->bio_list;
-        bio_list_init(current->bio_list);
-
-        while ((bio = bio_list_pop(&list))) {
-                struct bio_set *bs = bio->bi_pool;
-                if (unlikely(!bs) || bs == fs_bio_set) {
-                        bio_list_add(current->bio_list, bio);
-                        continue;
+        for (i = 0; i < 2; i++) {
+                list = current->bio_list[i];
+                bio_list_init(&current->bio_list[i]);
+
+                while ((bio = bio_list_pop(&list))) {
+                        struct bio_set *bs = bio->bi_pool;
+                        if (unlikely(!bs) || bs == fs_bio_set) {
+                                bio_list_add(&current->bio_list[i], bio);
+                                continue;
+                        }
+
+                        spin_lock(&bs->rescue_lock);
+                        bio_list_add(&bs->rescue_list, bio);
+                        queue_work(bs->rescue_workqueue, &bs->rescue_work);
+                        spin_unlock(&bs->rescue_lock);
                 }
-
-                spin_lock(&bs->rescue_lock);
-                bio_list_add(&bs->rescue_list, bio);
-                queue_work(bs->rescue_workqueue, &bs->rescue_work);
-                spin_unlock(&bs->rescue_lock);
         }
 }
 
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 2b13117fb918..321ecac23027 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -777,7 +777,6 @@ static int gather_all_resync_info(struct mddev *mddev, int total_slots)
                 bm_lockres->flags |= DLM_LKF_NOQUEUE;
                 ret = dlm_lock_sync(bm_lockres, DLM_LOCK_PW);
                 if (ret == -EAGAIN) {
-                        memset(bm_lockres->lksb.sb_lvbptr, '\0', LVB_SIZE);
                         s = read_resync_info(mddev, bm_lockres);
                         if (s) {
                                 pr_info("%s:%d Resync[%llu..%llu] in progress on %d\n",
@@ -974,6 +973,7 @@ static int leave(struct mddev *mddev)
         lockres_free(cinfo->bitmap_lockres);
         unlock_all_bitmaps(mddev);
         dlm_release_lockspace(cinfo->lockspace, 2);
+        kfree(cinfo);
         return 0;
 }
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 548d1b8014f8..f6ae1d67bcd0 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -440,14 +440,6 @@ void md_flush_request(struct mddev *mddev, struct bio *bio)
 }
 EXPORT_SYMBOL(md_flush_request);
 
-void md_unplug(struct blk_plug_cb *cb, bool from_schedule)
-{
-        struct mddev *mddev = cb->data;
-        md_wakeup_thread(mddev->thread);
-        kfree(cb);
-}
-EXPORT_SYMBOL(md_unplug);
-
 static inline struct mddev *mddev_get(struct mddev *mddev)
 {
         atomic_inc(&mddev->active);
@@ -1887,7 +1879,7 @@ super_1_rdev_size_change(struct md_rdev *rdev, sector_t num_sectors)
         }
         sb = page_address(rdev->sb_page);
         sb->data_size = cpu_to_le64(num_sectors);
-        sb->super_offset = rdev->sb_start;
+        sb->super_offset = cpu_to_le64(rdev->sb_start);
         sb->sb_csum = calc_sb_1_csum(sb);
         do {
                 md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
@@ -2295,7 +2287,7 @@ static bool does_sb_need_changing(struct mddev *mddev)
         /* Check if any mddev parameters have changed */
         if ((mddev->dev_sectors != le64_to_cpu(sb->size)) ||
             (mddev->reshape_position != le64_to_cpu(sb->reshape_position)) ||
-            (mddev->layout != le64_to_cpu(sb->layout)) ||
+            (mddev->layout != le32_to_cpu(sb->layout)) ||
             (mddev->raid_disks != le32_to_cpu(sb->raid_disks)) ||
             (mddev->chunk_sectors != le32_to_cpu(sb->chunksize)))
                 return true;
@@ -6458,11 +6450,10 @@ static int set_array_info(struct mddev *mddev, mdu_array_info_t *info)
         mddev->layout        = info->layout;
         mddev->chunk_sectors = info->chunk_size >> 9;
 
-        mddev->max_disks     = MD_SB_DISKS;
-
         if (mddev->persistent) {
-                mddev->flags         = 0;
-                mddev->sb_flags         = 0;
+                mddev->max_disks = MD_SB_DISKS;
+                mddev->flags = 0;
+                mddev->sb_flags = 0;
         }
         set_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags);
 
@@ -6533,8 +6524,12 @@ static int update_size(struct mddev *mddev, sector_t num_sectors)
                         return -ENOSPC;
         }
         rv = mddev->pers->resize(mddev, num_sectors);
-        if (!rv)
-                revalidate_disk(mddev->gendisk);
+        if (!rv) {
+                if (mddev->queue) {
+                        set_capacity(mddev->gendisk, mddev->array_sectors);
+                        revalidate_disk(mddev->gendisk);
+                }
+        }
         return rv;
 }
 
diff --git a/drivers/md/md.h b/drivers/md/md.h
index b8859cbf84b6..dde8ecb760c8 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -676,16 +676,10 @@ extern void mddev_resume(struct mddev *mddev);
 extern struct bio *bio_alloc_mddev(gfp_t gfp_mask, int nr_iovecs,
                                    struct mddev *mddev);
 
-extern void md_unplug(struct blk_plug_cb *cb, bool from_schedule);
 extern void md_reload_sb(struct mddev *mddev, int raid_disk);
 extern void md_update_sb(struct mddev *mddev, int force);
 extern void md_kick_rdev_from_array(struct md_rdev * rdev);
 struct md_rdev *md_find_rdev_nr_rcu(struct mddev *mddev, int nr);
-static inline int mddev_check_plugged(struct mddev *mddev)
-{
-        return !!blk_check_plugged(md_unplug, mddev,
-                                   sizeof(struct blk_plug_cb));
-}
 
 static inline void rdev_dec_pending(struct md_rdev *rdev, struct mddev *mddev)
 {
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index fbc2d7851b49..a34f58772022 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1027,7 +1027,7 @@ static int get_unqueued_pending(struct r1conf *conf)
 static void freeze_array(struct r1conf *conf, int extra)
 {
         /* Stop sync I/O and normal I/O and wait for everything to
-         * go quite.
+         * go quiet.
          * This is called in two situations:
          * 1) management command handlers (reshape, remove disk, quiesce).
          * 2) one normal I/O request failed.
@@ -1587,9 +1587,30 @@ static void raid1_make_request(struct mddev *mddev, struct bio *bio)
                         split = bio;
                 }
 
-                if (bio_data_dir(split) == READ)
+                if (bio_data_dir(split) == READ) {
                         raid1_read_request(mddev, split);
-                else
+
+                        /*
+                         * If a bio is splitted, the first part of bio will
+                         * pass barrier but the bio is queued in
+                         * current->bio_list (see generic_make_request). If
+                         * there is a raise_barrier() called here, the second
+                         * part of bio can't pass barrier. But since the first
+                         * part bio isn't dispatched to underlaying disks yet,
+                         * the barrier is never released, hence raise_barrier
+                         * will alays wait. We have a deadlock.
+                         * Note, this only happens in read path. For write
+                         * path, the first part of bio is dispatched in a
+                         * schedule() call (because of blk plug) or offloaded
+                         * to raid10d.
+                         * Quitting from the function immediately can change
+                         * the bio order queued in bio_list and avoid the deadlock.
+                         */
+                        if (split != bio) {
+                                generic_make_request(bio);
+                                break;
+                        }
+                } else
                         raid1_write_request(mddev, split);
         } while (split != bio);
 }
@@ -3246,8 +3267,6 @@ static int raid1_resize(struct mddev *mddev, sector_t sectors)
                         return ret;
         }
         md_set_array_sectors(mddev, newsize);
-        set_capacity(mddev->gendisk, mddev->array_sectors);
-        revalidate_disk(mddev->gendisk);
         if (sectors > mddev->dev_sectors &&
             mddev->recovery_cp > mddev->dev_sectors) {
                 mddev->recovery_cp = mddev->dev_sectors;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 063c43d83b72..e89a8d78a9ed 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -974,7 +974,8 @@ static void wait_barrier(struct r10conf *conf)
                                     !conf->barrier ||
                                     (atomic_read(&conf->nr_pending) &&
                                      current->bio_list &&
-                                     !bio_list_empty(current->bio_list)),
+                                     (!bio_list_empty(&current->bio_list[0]) ||
+                                      !bio_list_empty(&current->bio_list[1]))),
                                     conf->resync_lock);
                 conf->nr_waiting--;
                 if (!conf->nr_waiting)
@@ -1477,11 +1478,24 @@ retry_write:
                         mbio->bi_bdev = (void*)rdev;
 
                         atomic_inc(&r10_bio->remaining);
+
+                        cb = blk_check_plugged(raid10_unplug, mddev,
+                                               sizeof(*plug));
+                        if (cb)
+                                plug = container_of(cb, struct raid10_plug_cb,
+                                                    cb);
+                        else
+                                plug = NULL;
                         spin_lock_irqsave(&conf->device_lock, flags);
-                        bio_list_add(&conf->pending_bio_list, mbio);
-                        conf->pending_count++;
+                        if (plug) {
+                                bio_list_add(&plug->pending, mbio);
+                                plug->pending_cnt++;
+                        } else {
+                                bio_list_add(&conf->pending_bio_list, mbio);
+                                conf->pending_count++;
+                        }
                         spin_unlock_irqrestore(&conf->device_lock, flags);
-                        if (!mddev_check_plugged(mddev))
+                        if (!plug)
                                 md_wakeup_thread(mddev->thread);
                 }
         }
@@ -1571,7 +1585,25 @@ static void raid10_make_request(struct mddev *mddev, struct bio *bio)
                         split = bio;
                 }
 
+                /*
+                 * If a bio is splitted, the first part of bio will pass
+                 * barrier but the bio is queued in current->bio_list (see
+                 * generic_make_request). If there is a raise_barrier() called
+                 * here, the second part of bio can't pass barrier. But since
+                 * the first part bio isn't dispatched to underlaying disks
+                 * yet, the barrier is never released, hence raise_barrier will
+                 * alays wait. We have a deadlock.
+                 * Note, this only happens in read path. For write path, the
+                 * first part of bio is dispatched in a schedule() call
+                 * (because of blk plug) or offloaded to raid10d.
+                 * Quitting from the function immediately can change the bio
+                 * order queued in bio_list and avoid the deadlock.
+                 */
                 __make_request(mddev, split);
+                if (split != bio && bio_data_dir(bio) == READ) {
+                        generic_make_request(bio);
+                        break;
+                }
         } while (split != bio);
 
         /* In case raid10d snuck in to freeze_array */
@@ -3943,10 +3975,6 @@ static int raid10_resize(struct mddev *mddev, sector_t sectors)
                         return ret;
         }
         md_set_array_sectors(mddev, size);
-        if (mddev->queue) {
-                set_capacity(mddev->gendisk, mddev->array_sectors);
-                revalidate_disk(mddev->gendisk);
-        }
         if (sectors > mddev->dev_sectors &&
             mddev->recovery_cp > oldsize) {
                 mddev->recovery_cp = oldsize;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 4fb09b3fcb41..ed5cd705b985 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1401,7 +1401,8 @@ static int set_syndrome_sources(struct page **srcs,
                      (test_bit(R5_Wantdrain, &dev->flags) ||
                       test_bit(R5_InJournal, &dev->flags))) ||
                     (srctype == SYNDROME_SRC_WRITTEN &&
-                     dev->written)) {
+                     (dev->written ||
+                      test_bit(R5_InJournal, &dev->flags)))) {
                         if (test_bit(R5_InJournal, &dev->flags))
                                 srcs[slot] = sh->dev[i].orig_page;
                         else
@@ -7605,8 +7606,6 @@ static int raid5_resize(struct mddev *mddev, sector_t sectors)
                         return ret;
         }
         md_set_array_sectors(mddev, newsize);
-        set_capacity(mddev->gendisk, mddev->array_sectors);
-        revalidate_disk(mddev->gendisk);
         if (sectors > mddev->dev_sectors &&
             mddev->recovery_cp > mddev->dev_sectors) {
                 mddev->recovery_cp = mddev->dev_sectors;
diff --git a/drivers/media/dvb-frontends/drx39xyj/drx_driver.h b/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
index 7a681d8202c7..4442e478db72 100644
--- a/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
+++ b/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
@@ -256,8 +256,7 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 *
 * The actual DAP implementation may be restricted to only one of the modes.
 * A compiler warning or error will be generated if the DAP implementation
-* overides or cannot handle the mode defined below.
-*
+* overrides or cannot handle the mode defined below.
 */
 #ifndef DRXDAP_SINGLE_MASTER
 #define DRXDAP_SINGLE_MASTER 1
@@ -272,7 +271,7 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 *
 * This maximum size may be restricted by the actual DAP implementation.
 * A compiler warning or error will be generated if the DAP implementation
-* overides or cannot handle the chunksize defined below.
+* overrides or cannot handle the chunksize defined below.
 *
 * Beware that the DAP uses  DRXDAP_MAX_WCHUNKSIZE to create a temporary data
 * buffer. Do not undefine or choose too large, unless your system is able to
@@ -292,8 +291,7 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 *
 * This maximum size may be restricted by the actual DAP implementation.
 * A compiler warning or error will be generated if the DAP implementation
-* overides or cannot handle the chunksize defined below.
-*
+* overrides or cannot handle the chunksize defined below.
 */
 #ifndef DRXDAP_MAX_RCHUNKSIZE
 #define  DRXDAP_MAX_RCHUNKSIZE 60
diff --git a/drivers/media/platform/coda/imx-vdoa.c b/drivers/media/platform/coda/imx-vdoa.c
index 67fd8ffa60a4..669a4c82f1ff 100644
--- a/drivers/media/platform/coda/imx-vdoa.c
+++ b/drivers/media/platform/coda/imx-vdoa.c
@@ -321,7 +321,7 @@ static const struct of_device_id vdoa_dt_ids[] = {
 };
 MODULE_DEVICE_TABLE(of, vdoa_dt_ids);
 
-static const struct platform_driver vdoa_driver = {
+static struct platform_driver vdoa_driver = {
         .probe          = vdoa_probe,
         .remove         = vdoa_remove,
         .driver         = {
diff --git a/drivers/media/platform/exynos-gsc/gsc-core.c b/drivers/media/platform/exynos-gsc/gsc-core.c
index cbb03768f5d7..0f0c389f8897 100644
--- a/drivers/media/platform/exynos-gsc/gsc-core.c
+++ b/drivers/media/platform/exynos-gsc/gsc-core.c
@@ -861,9 +861,7 @@ int gsc_prepare_addr(struct gsc_ctx *ctx, struct vb2_buffer *vb,
 
         if ((frame->fmt->pixelformat == V4L2_PIX_FMT_VYUY) ||
                 (frame->fmt->pixelformat == V4L2_PIX_FMT_YVYU) ||
-                (frame->fmt->pixelformat == V4L2_PIX_FMT_NV61) ||
                 (frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420) ||
-                (frame->fmt->pixelformat == V4L2_PIX_FMT_NV21) ||
                 (frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420M))
                 swap(addr->cb, addr->cr);
 
diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
index 823608112d89..7918b928f058 100644
--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
@@ -632,8 +632,8 @@ static int bdisp_open(struct file *file)
 
 error_ctrls:
         bdisp_ctrls_delete(ctx);
-error_fh:
         v4l2_fh_del(&ctx->fh);
+error_fh:
         v4l2_fh_exit(&ctx->fh);
         bdisp_hw_free_nodes(ctx);
 mem_ctx:
diff --git a/drivers/media/platform/vsp1/vsp1_drm.c b/drivers/media/platform/vsp1/vsp1_drm.c
index b4b583f7137a..b4c0f10fc3b0 100644
--- a/drivers/media/platform/vsp1/vsp1_drm.c
+++ b/drivers/media/platform/vsp1/vsp1_drm.c
@@ -54,12 +54,11 @@ EXPORT_SYMBOL_GPL(vsp1_du_init);
 /**
  * vsp1_du_setup_lif - Setup the output part of the VSP pipeline
  * @dev: the VSP device
- * @width: output frame width in pixels
- * @height: output frame height in pixels
+ * @cfg: the LIF configuration
  *
- * Configure the output part of VSP DRM pipeline for the given frame @width and
- * @height. This sets up formats on the BRU source pad, the WPF0 sink and source
- * pads, and the LIF sink pad.
+ * Configure the output part of VSP DRM pipeline for the given frame @cfg.width
+ * and @cfg.height. This sets up formats on the BRU source pad, the WPF0 sink
+ * and source pads, and the LIF sink pad.
  *
  * As the media bus code on the BRU source pad is conditioned by the
  * configuration of the BRU sink 0 pad, we also set up the formats on all BRU
@@ -69,8 +68,7 @@ EXPORT_SYMBOL_GPL(vsp1_du_init);
  *
  * Return 0 on success or a negative error code on failure.
  */
-int vsp1_du_setup_lif(struct device *dev, unsigned int width,
-                      unsigned int height)
+int vsp1_du_setup_lif(struct device *dev, const struct vsp1_du_lif_config *cfg)
 {
         struct vsp1_device *vsp1 = dev_get_drvdata(dev);
         struct vsp1_pipeline *pipe = &vsp1->drm->pipe;
@@ -79,11 +77,8 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
         unsigned int i;
         int ret;
 
-        dev_dbg(vsp1->dev, "%s: configuring LIF with format %ux%u\n",
-                __func__, width, height);
-
-        if (width == 0 || height == 0) {
-                /* Zero width or height means the CRTC is being disabled, stop
+        if (!cfg) {
+                /* NULL configuration means the CRTC is being disabled, stop
                  * the pipeline and turn the light off.
                  */
                 ret = vsp1_pipeline_stop(pipe);
@@ -108,6 +103,9 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
                 return 0;
         }
 
+        dev_dbg(vsp1->dev, "%s: configuring LIF with format %ux%u\n",
+                __func__, cfg->width, cfg->height);
+
         /* Configure the format at the BRU sinks and propagate it through the
          * pipeline.
          */
@@ -117,8 +115,8 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
         for (i = 0; i < bru->entity.source_pad; ++i) {
                 format.pad = i;
 
-                format.format.width = width;
-                format.format.height = height;
+                format.format.width = cfg->width;
+                format.format.height = cfg->height;
                 format.format.code = MEDIA_BUS_FMT_ARGB8888_1X32;
                 format.format.field = V4L2_FIELD_NONE;
 
@@ -133,8 +131,8 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
         }
 
         format.pad = bru->entity.source_pad;
-        format.format.width = width;
-        format.format.height = height;
+        format.format.width = cfg->width;
+        format.format.height = cfg->height;
         format.format.code = MEDIA_BUS_FMT_ARGB8888_1X32;
         format.format.field = V4L2_FIELD_NONE;
 
@@ -180,7 +178,8 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
         /* Verify that the format at the output of the pipeline matches the
          * requested frame size and media bus code.
          */
-        if (format.format.width != width || format.format.height != height ||
+        if (format.format.width != cfg->width ||
+            format.format.height != cfg->height ||
             format.format.code != MEDIA_BUS_FMT_ARGB8888_1X32) {
                 dev_dbg(vsp1->dev, "%s: format mismatch\n", __func__);
                 return -EPIPE;
diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
index 393dccaabdd0..1688893a65bb 100644
--- a/drivers/media/rc/lirc_dev.c
+++ b/drivers/media/rc/lirc_dev.c
@@ -436,6 +436,8 @@ int lirc_dev_fop_open(struct inode *inode, struct file *file)
                 return -ERESTARTSYS;
 
         ir = irctls[iminor(inode)];
+        mutex_unlock(&lirc_dev_lock);
+
         if (!ir) {
                 retval = -ENODEV;
                 goto error;
@@ -476,8 +478,6 @@ int lirc_dev_fop_open(struct inode *inode, struct file *file)
         }
 
 error:
-        mutex_unlock(&lirc_dev_lock);
-
         nonseekable_open(inode, file);
 
         return retval;
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index b109f8246b96..ec4b25bd2ec2 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -176,12 +176,13 @@ static void nvt_write_wakeup_codes(struct rc_dev *dev,
 {
         u8 tolerance, config;
         struct nvt_dev *nvt = dev->priv;
+        unsigned long flags;
         int i;
 
         /* hardcode the tolerance to 10% */
         tolerance = DIV_ROUND_UP(count, 10);
 
-        spin_lock(&nvt->lock);
+        spin_lock_irqsave(&nvt->lock, flags);
 
         nvt_clear_cir_wake_fifo(nvt);
         nvt_cir_wake_reg_write(nvt, count, CIR_WAKE_FIFO_CMP_DEEP);
@@ -203,7 +204,7 @@ static void nvt_write_wakeup_codes(struct rc_dev *dev,
 
         nvt_cir_wake_reg_write(nvt, config, CIR_WAKE_IRCON);
 
-        spin_unlock(&nvt->lock);
+        spin_unlock_irqrestore(&nvt->lock, flags);
 }
 
 static ssize_t wakeup_data_show(struct device *dev,
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 2424946740e6..d84533699668 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1663,6 +1663,7 @@ static int rc_setup_rx_device(struct rc_dev *dev)
 {
         int rc;
         struct rc_map *rc_map;
+        u64 rc_type;
 
         if (!dev->map_name)
                 return -EINVAL;
@@ -1677,15 +1678,18 @@ static int rc_setup_rx_device(struct rc_dev *dev)
         if (rc)
                 return rc;
 
-        if (dev->change_protocol) {
-                u64 rc_type = (1ll << rc_map->rc_type);
+        rc_type = BIT_ULL(rc_map->rc_type);
 
+        if (dev->change_protocol) {
                 rc = dev->change_protocol(dev, &rc_type);
                 if (rc < 0)
                         goto out_table;
                 dev->enabled_protocols = rc_type;
         }
 
+        if (dev->driver_type == RC_DRIVER_IR_RAW)
+                ir_raw_load_modules(&rc_type);
+
         set_bit(EV_KEY, dev->input_dev->evbit);
         set_bit(EV_REP, dev->input_dev->evbit);
         set_bit(EV_MSC, dev->input_dev->evbit);
@@ -1777,12 +1781,6 @@ int rc_register_device(struct rc_dev *dev)
                 dev->input_name ?: "Unspecified device", path ?: "N/A");
         kfree(path);
 
-        if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
-                rc = rc_setup_rx_device(dev);
-                if (rc)
-                        goto out_dev;
-        }
-
         if (dev->driver_type == RC_DRIVER_IR_RAW ||
             dev->driver_type == RC_DRIVER_IR_RAW_TX) {
                 if (!raw_init) {
@@ -1791,7 +1789,13 @@ int rc_register_device(struct rc_dev *dev)
                 }
                 rc = ir_raw_event_register(dev);
                 if (rc < 0)
-                        goto out_rx;
+                        goto out_dev;
+        }
+
+        if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
+                rc = rc_setup_rx_device(dev);
+                if (rc)
+                        goto out_raw;
         }
 
         /* Allow the RC sysfs nodes to be accessible */
@@ -1803,8 +1807,8 @@ int rc_register_device(struct rc_dev *dev)
 
         return 0;
 
-out_rx:
-        rc_free_rx_device(dev);
+out_raw:
+        ir_raw_event_unregister(dev);
 out_dev:
         device_del(&dev->dev);
 out_unlock:
diff --git a/drivers/media/rc/serial_ir.c b/drivers/media/rc/serial_ir.c
index 923fb2299553..41b54e40176c 100644
--- a/drivers/media/rc/serial_ir.c
+++ b/drivers/media/rc/serial_ir.c
@@ -487,10 +487,69 @@ static void serial_ir_timeout(unsigned long arg)
         ir_raw_event_handle(serial_ir.rcdev);
 }
 
+/* Needed by serial_ir_probe() */
+static int serial_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
+                        unsigned int count);
+static int serial_ir_tx_duty_cycle(struct rc_dev *dev, u32 cycle);
+static int serial_ir_tx_carrier(struct rc_dev *dev, u32 carrier);
+static int serial_ir_open(struct rc_dev *rcdev);
+static void serial_ir_close(struct rc_dev *rcdev);
+
 static int serial_ir_probe(struct platform_device *dev)
 {
+        struct rc_dev *rcdev;
         int i, nlow, nhigh, result;
 
+        rcdev = devm_rc_allocate_device(&dev->dev, RC_DRIVER_IR_RAW);
+        if (!rcdev)
+                return -ENOMEM;
+
+        if (hardware[type].send_pulse && hardware[type].send_space)
+                rcdev->tx_ir = serial_ir_tx;
+        if (hardware[type].set_send_carrier)
+                rcdev->s_tx_carrier = serial_ir_tx_carrier;
+        if (hardware[type].set_duty_cycle)
+                rcdev->s_tx_duty_cycle = serial_ir_tx_duty_cycle;
+
+        switch (type) {
+        case IR_HOMEBREW:
+                rcdev->input_name = "Serial IR type home-brew";
+                break;
+        case IR_IRDEO:
+                rcdev->input_name = "Serial IR type IRdeo";
+                break;
+        case IR_IRDEO_REMOTE:
+                rcdev->input_name = "Serial IR type IRdeo remote";
+                break;
+        case IR_ANIMAX:
+                rcdev->input_name = "Serial IR type AnimaX";
+                break;
+        case IR_IGOR:
+                rcdev->input_name = "Serial IR type IgorPlug";
+                break;
+        }
+
+        rcdev->input_phys = KBUILD_MODNAME "/input0";
+        rcdev->input_id.bustype = BUS_HOST;
+        rcdev->input_id.vendor = 0x0001;
+        rcdev->input_id.product = 0x0001;
+        rcdev->input_id.version = 0x0100;
+        rcdev->open = serial_ir_open;
+        rcdev->close = serial_ir_close;
+        rcdev->dev.parent = &serial_ir.pdev->dev;
+        rcdev->allowed_protocols = RC_BIT_ALL_IR_DECODER;
+        rcdev->driver_name = KBUILD_MODNAME;
+        rcdev->map_name = RC_MAP_RC6_MCE;
+        rcdev->min_timeout = 1;
+        rcdev->timeout = IR_DEFAULT_TIMEOUT;
+        rcdev->max_timeout = 10 * IR_DEFAULT_TIMEOUT;
+        rcdev->rx_resolution = 250000;
+
+        serial_ir.rcdev = rcdev;
+
+        setup_timer(&serial_ir.timeout_timer, serial_ir_timeout,
+                    (unsigned long)&serial_ir);
+
         result = devm_request_irq(&dev->dev, irq, serial_ir_irq_handler,
                                   share_irq ? IRQF_SHARED : 0,
                                   KBUILD_MODNAME, &hardware);
@@ -516,9 +575,6 @@ static int serial_ir_probe(struct platform_device *dev)
                 return -EBUSY;
         }
 
-        setup_timer(&serial_ir.timeout_timer, serial_ir_timeout,
-                    (unsigned long)&serial_ir);
-
         result = hardware_init_port();
         if (result < 0)
                 return result;
@@ -552,7 +608,8 @@ static int serial_ir_probe(struct platform_device *dev)
                          sense ? "low" : "high");
 
         dev_dbg(&dev->dev, "Interrupt %d, port %04x obtained\n", irq, io);
-        return 0;
+
+        return devm_rc_register_device(&dev->dev, rcdev);
 }
 
 static int serial_ir_open(struct rc_dev *rcdev)
@@ -723,7 +780,6 @@ static void serial_ir_exit(void)
 
 static int __init serial_ir_init_module(void)
 {
-        struct rc_dev *rcdev;
         int result;
 
         switch (type) {
@@ -754,63 +810,9 @@ static int __init serial_ir_init_module(void)
                 sense = !!sense;
 
         result = serial_ir_init();
-        if (result)
-                return result;
-
-        rcdev = devm_rc_allocate_device(&serial_ir.pdev->dev, RC_DRIVER_IR_RAW);
-        if (!rcdev) {
-                result = -ENOMEM;
-                goto serial_cleanup;
-        }
-
-        if (hardware[type].send_pulse && hardware[type].send_space)
-                rcdev->tx_ir = serial_ir_tx;
-        if (hardware[type].set_send_carrier)
-                rcdev->s_tx_carrier = serial_ir_tx_carrier;
-        if (hardware[type].set_duty_cycle)
-                rcdev->s_tx_duty_cycle = serial_ir_tx_duty_cycle;
-
-        switch (type) {
-        case IR_HOMEBREW:
-                rcdev->input_name = "Serial IR type home-brew";
-                break;
-        case IR_IRDEO:
-                rcdev->input_name = "Serial IR type IRdeo";
-                break;
-        case IR_IRDEO_REMOTE:
-                rcdev->input_name = "Serial IR type IRdeo remote";
-                break;
-        case IR_ANIMAX:
-                rcdev->input_name = "Serial IR type AnimaX";
-                break;
-        case IR_IGOR:
-                rcdev->input_name = "Serial IR type IgorPlug";
-                break;
-        }
-
-        rcdev->input_phys = KBUILD_MODNAME "/input0";
-        rcdev->input_id.bustype = BUS_HOST;
-        rcdev->input_id.vendor = 0x0001;
-        rcdev->input_id.product = 0x0001;
-        rcdev->input_id.version = 0x0100;
-        rcdev->open = serial_ir_open;
-        rcdev->close = serial_ir_close;
-        rcdev->dev.parent = &serial_ir.pdev->dev;
-        rcdev->allowed_protocols = RC_BIT_ALL_IR_DECODER;
-        rcdev->driver_name = KBUILD_MODNAME;
-        rcdev->map_name = RC_MAP_RC6_MCE;
-        rcdev->min_timeout = 1;
-        rcdev->timeout = IR_DEFAULT_TIMEOUT;
-        rcdev->max_timeout = 10 * IR_DEFAULT_TIMEOUT;
-        rcdev->rx_resolution = 250000;
-
-        serial_ir.rcdev = rcdev;
-
-        result = rc_register_device(rcdev);
-
         if (!result)
                 return 0;
-serial_cleanup:
+
         serial_ir_exit();
         return result;
 }
@@ -818,7 +820,6 @@ serial_cleanup:
 static void __exit serial_ir_exit_module(void)
 {
         del_timer_sync(&serial_ir.timeout_timer);
-        rc_unregister_device(serial_ir.rcdev);
         serial_ir_exit();
 }
 
diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
index ab9866024ec7..04033efe7ad5 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
@@ -36,16 +36,18 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le
 int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
 {
         struct hexline *hx;
-        u8 reset;
-        int ret,pos=0;
+        u8 *buf;
+        int ret, pos = 0;
+        u16 cpu_cs_register = cypress[type].cpu_cs_register;
 
-        hx = kmalloc(sizeof(*hx), GFP_KERNEL);
-        if (!hx)
+        buf = kmalloc(sizeof(*hx), GFP_KERNEL);
+        if (!buf)
                 return -ENOMEM;
+        hx = (struct hexline *)buf;
 
         /* stop the CPU */
-        reset = 1;
-        if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
+        buf[0] = 1;
+        if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1)
                 err("could not stop the USB controller CPU.");
 
         while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) {
@@ -61,21 +63,21 @@ int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw
         }
         if (ret < 0) {
                 err("firmware download failed at %d with %d",pos,ret);
-                kfree(hx);
+                kfree(buf);
                 return ret;
         }
 
         if (ret == 0) {
                 /* restart the CPU */
-                reset = 0;
-                if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {
+                buf[0] = 0;
+                if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) {
                         err("could not restart the USB controller CPU.");
                         ret = -EINVAL;
                 }
         } else
                 ret = -EIO;
 
-        kfree(hx);
+        kfree(buf);
 
         return ret;
 }
diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 6ca502d834b4..4f42d57f81d9 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -68,6 +68,7 @@
 struct dw2102_state {
         u8 initialized;
         u8 last_lock;
+        u8 data[MAX_XFER_SIZE + 4];
         struct i2c_client *i2c_client_demod;
         struct i2c_client *i2c_client_tuner;
 
@@ -661,62 +662,72 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
                                                                 int num)
 {
         struct dvb_usb_device *d = i2c_get_adapdata(adap);
-        u8 obuf[0x40], ibuf[0x40];
+        struct dw2102_state *state;
 
         if (!d)
                 return -ENODEV;
+
+        state = d->priv;
+
         if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
                 return -EAGAIN;
+        if (mutex_lock_interruptible(&d->data_mutex) < 0) {
+                mutex_unlock(&d->i2c_mutex);
+                return -EAGAIN;
+        }
 
         switch (num) {
         case 1:
                 switch (msg[0].addr) {
                 case SU3000_STREAM_CTRL:
-                        obuf[0] = msg[0].buf[0] + 0x36;
-                        obuf[1] = 3;
-                        obuf[2] = 0;
-                        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 0, 0) < 0)
+                        state->data[0] = msg[0].buf[0] + 0x36;
+                        state->data[1] = 3;
+                        state->data[2] = 0;
+                        if (dvb_usb_generic_rw(d, state->data, 3,
+                                        state->data, 0, 0) < 0)
                                 err("i2c transfer failed.");
                         break;
                 case DW2102_RC_QUERY:
-                        obuf[0] = 0x10;
-                        if (dvb_usb_generic_rw(d, obuf, 1, ibuf, 2, 0) < 0)
+                        state->data[0] = 0x10;
+                        if (dvb_usb_generic_rw(d, state->data, 1,
+                                        state->data, 2, 0) < 0)
                                 err("i2c transfer failed.");
-                        msg[0].buf[1] = ibuf[0];
-                        msg[0].buf[0] = ibuf[1];
+                        msg[0].buf[1] = state->data[0];
+                        msg[0].buf[0] = state->data[1];
                         break;
                 default:
                         /* always i2c write*/
-                        obuf[0] = 0x08;
-                        obuf[1] = msg[0].addr;
-                        obuf[2] = msg[0].len;
+                        state->data[0] = 0x08;
+                        state->data[1] = msg[0].addr;
+                        state->data[2] = msg[0].len;
 
-                        memcpy(&obuf[3], msg[0].buf, msg[0].len);
+                        memcpy(&state->data[3], msg[0].buf, msg[0].len);
 
-                        if (dvb_usb_generic_rw(d, obuf, msg[0].len + 3,
-                                                ibuf, 1, 0) < 0)
+                        if (dvb_usb_generic_rw(d, state->data, msg[0].len + 3,
+                                                state->data, 1, 0) < 0)
                                 err("i2c transfer failed.");
 
                 }
                 break;
         case 2:
                 /* always i2c read */
-                obuf[0] = 0x09;
-                obuf[1] = msg[0].len;
-                obuf[2] = msg[1].len;
-                obuf[3] = msg[0].addr;
-                memcpy(&obuf[4], msg[0].buf, msg[0].len);
-
-                if (dvb_usb_generic_rw(d, obuf, msg[0].len + 4,
-                                        ibuf, msg[1].len + 1, 0) < 0)
+                state->data[0] = 0x09;
+                state->data[1] = msg[0].len;
+                state->data[2] = msg[1].len;
+                state->data[3] = msg[0].addr;
+                memcpy(&state->data[4], msg[0].buf, msg[0].len);
+
+                if (dvb_usb_generic_rw(d, state->data, msg[0].len + 4,
+                                        state->data, msg[1].len + 1, 0) < 0)
                         err("i2c transfer failed.");
 
-                memcpy(msg[1].buf, &ibuf[1], msg[1].len);
+                memcpy(msg[1].buf, &state->data[1], msg[1].len);
                 break;
         default:
                 warn("more than 2 i2c messages at a time is not handled yet.");
                 break;
         }
+        mutex_unlock(&d->data_mutex);
         mutex_unlock(&d->i2c_mutex);
         return num;
 }
@@ -844,17 +855,23 @@ static int su3000_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff)
 static int su3000_power_ctrl(struct dvb_usb_device *d, int i)
 {
         struct dw2102_state *state = (struct dw2102_state *)d->priv;
-        u8 obuf[] = {0xde, 0};
+        int ret = 0;
 
         info("%s: %d, initialized %d", __func__, i, state->initialized);
 
         if (i && !state->initialized) {
+                mutex_lock(&d->data_mutex);
+
+                state->data[0] = 0xde;
+                state->data[1] = 0;
+
                 state->initialized = 1;
                 /* reset board */
-                return dvb_usb_generic_rw(d, obuf, 2, NULL, 0, 0);
+                ret = dvb_usb_generic_rw(d, state->data, 2, NULL, 0, 0);
+                mutex_unlock(&d->data_mutex);
         }
 
-        return 0;
+        return ret;
 }
 
 static int su3000_read_mac_address(struct dvb_usb_device *d, u8 mac[6])
@@ -1309,49 +1326,57 @@ static int prof_7500_frontend_attach(struct dvb_usb_adapter *d)
         return 0;
 }
 
-static int su3000_frontend_attach(struct dvb_usb_adapter *d)
+static int su3000_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        u8 obuf[3] = { 0xe, 0x80, 0 };
-        u8 ibuf[] = { 0 };
+        struct dvb_usb_device *d = adap->dev;
+        struct dw2102_state *state = d->priv;
+
+        mutex_lock(&d->data_mutex);
+
+        state->data[0] = 0xe;
+        state->data[1] = 0x80;
+        state->data[2] = 0;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x02;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x02;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
         msleep(300);
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x83;
-        obuf[2] = 0;
+        state->data[0] = 0xe;
+        state->data[1] = 0x83;
+        state->data[2] = 0;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x83;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x83;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0x51;
+        state->data[0] = 0x51;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 1, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0)
                 err("command 0x51 transfer failed.");
 
-        d->fe_adap[0].fe = dvb_attach(ds3000_attach, &su3000_ds3000_config,
-                                        &d->dev->i2c_adap);
-        if (d->fe_adap[0].fe == NULL)
+        mutex_unlock(&d->data_mutex);
+
+        adap->fe_adap[0].fe = dvb_attach(ds3000_attach, &su3000_ds3000_config,
+                                        &d->i2c_adap);
+        if (adap->fe_adap[0].fe == NULL)
                 return -EIO;
 
-        if (dvb_attach(ts2020_attach, d->fe_adap[0].fe,
+        if (dvb_attach(ts2020_attach, adap->fe_adap[0].fe,
                                 &dw2104_ts2020_config,
-                                &d->dev->i2c_adap)) {
+                                &d->i2c_adap)) {
                 info("Attached DS3000/TS2020!");
                 return 0;
         }
@@ -1360,47 +1385,55 @@ static int su3000_frontend_attach(struct dvb_usb_adapter *d)
         return -EIO;
 }
 
-static int t220_frontend_attach(struct dvb_usb_adapter *d)
+static int t220_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        u8 obuf[3] = { 0xe, 0x87, 0 };
-        u8 ibuf[] = { 0 };
+        struct dvb_usb_device *d = adap->dev;
+        struct dw2102_state *state = d->priv;
+
+        mutex_lock(&d->data_mutex);
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        state->data[0] = 0xe;
+        state->data[1] = 0x87;
+        state->data[2] = 0x0;
+
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x86;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x86;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x80;
-        obuf[2] = 0;
+        state->data[0] = 0xe;
+        state->data[1] = 0x80;
+        state->data[2] = 0;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
         msleep(50);
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x80;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x80;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0x51;
+        state->data[0] = 0x51;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 1, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0)
                 err("command 0x51 transfer failed.");
 
-        d->fe_adap[0].fe = dvb_attach(cxd2820r_attach, &cxd2820r_config,
-                                        &d->dev->i2c_adap, NULL);
-        if (d->fe_adap[0].fe != NULL) {
-                if (dvb_attach(tda18271_attach, d->fe_adap[0].fe, 0x60,
-                                        &d->dev->i2c_adap, &tda18271_config)) {
+        mutex_unlock(&d->data_mutex);
+
+        adap->fe_adap[0].fe = dvb_attach(cxd2820r_attach, &cxd2820r_config,
+                                        &d->i2c_adap, NULL);
+        if (adap->fe_adap[0].fe != NULL) {
+                if (dvb_attach(tda18271_attach, adap->fe_adap[0].fe, 0x60,
+                                        &d->i2c_adap, &tda18271_config)) {
                         info("Attached TDA18271HD/CXD2820R!");
                         return 0;
                 }
@@ -1410,23 +1443,30 @@ static int t220_frontend_attach(struct dvb_usb_adapter *d)
         return -EIO;
 }
 
-static int m88rs2000_frontend_attach(struct dvb_usb_adapter *d)
+static int m88rs2000_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        u8 obuf[] = { 0x51 };
-        u8 ibuf[] = { 0 };
+        struct dvb_usb_device *d = adap->dev;
+        struct dw2102_state *state = d->priv;
+
+        mutex_lock(&d->data_mutex);
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 1, ibuf, 1, 0) < 0)
+        state->data[0] = 0x51;
+
+        if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0)
                 err("command 0x51 transfer failed.");
 
-        d->fe_adap[0].fe = dvb_attach(m88rs2000_attach, &s421_m88rs2000_config,
-                                        &d->dev->i2c_adap);
+        mutex_unlock(&d->data_mutex);
 
-        if (d->fe_adap[0].fe == NULL)
+        adap->fe_adap[0].fe = dvb_attach(m88rs2000_attach,
+                                        &s421_m88rs2000_config,
+                                        &d->i2c_adap);
+
+        if (adap->fe_adap[0].fe == NULL)
                 return -EIO;
 
-        if (dvb_attach(ts2020_attach, d->fe_adap[0].fe,
+        if (dvb_attach(ts2020_attach, adap->fe_adap[0].fe,
                                 &dw2104_ts2020_config,
-                                &d->dev->i2c_adap)) {
+                                &d->i2c_adap)) {
                 info("Attached RS2000/TS2020!");
                 return 0;
         }
@@ -1439,44 +1479,50 @@ static int tt_s2_4600_frontend_attach(struct dvb_usb_adapter *adap)
 {
         struct dvb_usb_device *d = adap->dev;
         struct dw2102_state *state = d->priv;
-        u8 obuf[3] = { 0xe, 0x80, 0 };
-        u8 ibuf[] = { 0 };
         struct i2c_adapter *i2c_adapter;
         struct i2c_client *client;
         struct i2c_board_info board_info;
         struct m88ds3103_platform_data m88ds3103_pdata = {};
         struct ts2020_config ts2020_config = {};
 
-        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0)
+        mutex_lock(&d->data_mutex);
+
+        state->data[0] = 0xe;
+        state->data[1] = 0x80;
+        state->data[2] = 0x0;
+
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x02;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x02;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
         msleep(300);
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x83;
-        obuf[2] = 0;
+        state->data[0] = 0xe;
+        state->data[1] = 0x83;
+        state->data[2] = 0;
 
-        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x83;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x83;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0x51;
+        state->data[0] = 0x51;
 
-        if (dvb_usb_generic_rw(d, obuf, 1, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0)
                 err("command 0x51 transfer failed.");
 
+        mutex_unlock(&d->data_mutex);
+
         /* attach demod */
         m88ds3103_pdata.clk = 27000000;
         m88ds3103_pdata.i2c_wr_max = 33;
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index 5457c361ad58..bf0fe0137dfe 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -1947,9 +1947,7 @@ static int gpmc_probe_onenand_child(struct platform_device *pdev,
         if (!of_property_read_u32(child, "dma-channel", &val))
                 gpmc_onenand_data->dma_channel = val;
 
-        gpmc_onenand_init(gpmc_onenand_data);
-
-        return 0;
+        return gpmc_onenand_init(gpmc_onenand_data);
 }
 #else
 static int gpmc_probe_onenand_child(struct platform_device *pdev,
diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index 91f645992c94..b27ea98b781f 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -1792,15 +1792,14 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev,
 
         /* If we're permanently dead, give up. */
         if (state == pci_channel_io_perm_failure) {
-                /* Tell the AFU drivers; but we don't care what they
-                 * say, we're going away.
-                 */
                 for (i = 0; i < adapter->slices; i++) {
                         afu = adapter->afu[i];
-                        /* Only participate in EEH if we are on a virtual PHB */
-                        if (afu->phb == NULL)
-                                return PCI_ERS_RESULT_NONE;
-                        cxl_vphb_error_detected(afu, state);
+                        /*
+                         * Tell the AFU drivers; but we don't care what they
+                         * say, we're going away.
+                         */
+                        if (afu->phb != NULL)
+                                cxl_vphb_error_detected(afu, state);
                 }
                 return PCI_ERS_RESULT_DISCONNECT;
         }
diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c
index 3600c9993a98..29f2daed37e0 100644
--- a/drivers/misc/mei/bus-fixup.c
+++ b/drivers/misc/mei/bus-fixup.c
@@ -112,11 +112,9 @@ struct mkhi_msg {
 
 static int mei_osver(struct mei_cl_device *cldev)
 {
-        int ret;
         const size_t size = sizeof(struct mkhi_msg_hdr) +
                             sizeof(struct mkhi_fwcaps) +
                             sizeof(struct mei_os_ver);
-        size_t length = 8;
         char buf[size];
         struct mkhi_msg *req;
         struct mkhi_fwcaps *fwcaps;
@@ -137,15 +135,7 @@ static int mei_osver(struct mei_cl_device *cldev)
         os_ver = (struct mei_os_ver *)fwcaps->data;
         os_ver->os_type = OSTYPE_LINUX;
 
-        ret = __mei_cl_send(cldev->cl, buf, size, mode);
-        if (ret < 0)
-                return ret;
-
-        ret = __mei_cl_recv(cldev->cl, buf, length, 0);
-        if (ret < 0)
-                return ret;
-
-        return 0;
+        return __mei_cl_send(cldev->cl, buf, size, mode);
 }
 
 static void mei_mkhi_fix(struct mei_cl_device *cldev)
@@ -160,7 +150,7 @@ static void mei_mkhi_fix(struct mei_cl_device *cldev)
                 return;
 
         ret = mei_osver(cldev);
-        if (ret)
+        if (ret < 0)
                 dev_err(&cldev->dev, "OS version command failed %d\n", ret);
 
         mei_cldev_disable(cldev);
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index cfb1cdf176fa..13c55b8f9261 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -124,8 +124,6 @@ int mei_reset(struct mei_device *dev)
 
         mei_clear_interrupts(dev);
 
-        mei_synchronize_irq(dev);
-
         /* we're already in reset, cancel the init timer
          * if the reset was called due the hbm protocol error
          * we need to call it before hw start
@@ -304,6 +302,9 @@ static void mei_reset_work(struct work_struct *work)
                 container_of(work, struct mei_device,  reset_work);
         int ret;
 
+        mei_clear_interrupts(dev);
+        mei_synchronize_irq(dev);
+
         mutex_lock(&dev->device_lock);
 
         ret = mei_reset(dev);
@@ -328,6 +329,9 @@ void mei_stop(struct mei_device *dev)
 
         mei_cancel_work(dev);
 
+        mei_clear_interrupts(dev);
+        mei_synchronize_irq(dev);
+
         mutex_lock(&dev->device_lock);
 
         dev->dev_state = MEI_DEV_POWER_DOWN;
diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
index 6fb773dbcd0c..93be82fc338a 100644
--- a/drivers/misc/sgi-gru/grufault.c
+++ b/drivers/misc/sgi-gru/grufault.c
@@ -219,15 +219,20 @@ static int atomic_pte_lookup(struct vm_area_struct *vma, unsigned long vaddr,
         int write, unsigned long *paddr, int *pageshift)
 {
         pgd_t *pgdp;
-        pmd_t *pmdp;
+        p4d_t *p4dp;
         pud_t *pudp;
+        pmd_t *pmdp;
         pte_t pte;
 
         pgdp = pgd_offset(vma->vm_mm, vaddr);
         if (unlikely(pgd_none(*pgdp)))
                 goto err;
 
-        pudp = pud_offset(pgdp, vaddr);
+        p4dp = p4d_offset(pgdp, vaddr);
+        if (unlikely(p4d_none(*p4dp)))
+                goto err;
+
+        pudp = pud_offset(p4dp, vaddr);
         if (unlikely(pud_none(*pudp)))
                 goto err;
 
diff --git a/drivers/misc/vmw_vmci/vmci_guest.c b/drivers/misc/vmw_vmci/vmci_guest.c
index 9d659542a335..dad5abee656e 100644
--- a/drivers/misc/vmw_vmci/vmci_guest.c
+++ b/drivers/misc/vmw_vmci/vmci_guest.c
@@ -566,10 +566,10 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
          */
         error = pci_alloc_irq_vectors(pdev, VMCI_MAX_INTRS, VMCI_MAX_INTRS,
                         PCI_IRQ_MSIX);
-        if (error) {
+        if (error < 0) {
                 error = pci_alloc_irq_vectors(pdev, 1, 1,
                                 PCI_IRQ_MSIX | PCI_IRQ_MSI | PCI_IRQ_LEGACY);
-                if (error)
+                if (error < 0)
                         goto err_remove_bitmap;
         } else {
                 vmci_dev->exclusive_vectors = true;
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 1621fa08e206..ff3da960c473 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1560,11 +1560,8 @@ static bool mmc_blk_rw_cmd_err(struct mmc_blk_data *md, struct mmc_card *card,
                                struct mmc_blk_request *brq, struct request *req,
                                bool old_req_pending)
 {
-        struct mmc_queue_req *mq_rq;
         bool req_pending;
 
-        mq_rq = container_of(brq, struct mmc_queue_req, brq);
-
         /*
          * If this is an SD card and we're writing, we can first
          * mark the known good sectors as ok.
@@ -1701,7 +1698,8 @@ static void mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *new_req)
                 case MMC_BLK_CMD_ERR:
                         req_pending = mmc_blk_rw_cmd_err(md, card, brq, old_req, req_pending);
                         if (mmc_blk_reset(md, card->host, type)) {
-                                mmc_blk_rw_cmd_abort(card, old_req);
+                                if (req_pending)
+                                        mmc_blk_rw_cmd_abort(card, old_req);
                                 mmc_blk_rw_try_restart(mq, new_req);
                                 return;
                         }
@@ -1817,6 +1815,7 @@ void mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
                 mmc_blk_issue_flush(mq, req);
         } else {
                 mmc_blk_issue_rw_rq(mq, req);
+                card->host->context_info.is_waiting_last_req = false;
         }
 
 out:
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 7fd722868875..b502601df228 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1730,7 +1730,7 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
                 err = mmc_select_hs400(card);
                 if (err)
                         goto free_card;
-        } else {
+        } else if (!mmc_card_hs400es(card)) {
                 /* Select the desired bus width optionally */
                 err = mmc_select_bus_width(card);
                 if (err > 0 && mmc_card_hs(card)) {
diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 8e32580c12b5..b235d8da0602 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -580,7 +580,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
                 }
         }
         sdr_set_field(host->base + MSDC_CFG, MSDC_CFG_CKMOD | MSDC_CFG_CKDIV,
-                        (mode << 8) | (div % 0xff));
+                      (mode << 8) | div);
         sdr_set_bits(host->base + MSDC_CFG, MSDC_CFG_CKPDN);
         while (!(readl(host->base + MSDC_CFG) & MSDC_CFG_CKSTB))
                 cpu_relax();
@@ -1559,7 +1559,7 @@ static int msdc_drv_probe(struct platform_device *pdev)
         host->src_clk_freq = clk_get_rate(host->src_clk);
         /* Set host parameters to mmc */
         mmc->ops = &mt_msdc_ops;
-        mmc->f_min = host->src_clk_freq / (4 * 255);
+        mmc->f_min = DIV_ROUND_UP(host->src_clk_freq, 4 * 255);
 
         mmc->caps |= MMC_CAP_ERASE | MMC_CAP_CMD23;
         /* MMC core transfer sizes tunable parameters */
diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c
index 410a55b1c25f..1cfd7f900339 100644
--- a/drivers/mmc/host/sdhci-of-arasan.c
+++ b/drivers/mmc/host/sdhci-of-arasan.c
@@ -28,13 +28,9 @@
 #include "sdhci-pltfm.h"
 #include <linux/of.h>
 
-#define SDHCI_ARASAN_CLK_CTRL_OFFSET    0x2c
 #define SDHCI_ARASAN_VENDOR_REGISTER    0x78
 
 #define VENDOR_ENHANCED_STROBE          BIT(0)
-#define CLK_CTRL_TIMEOUT_SHIFT          16
-#define CLK_CTRL_TIMEOUT_MASK           (0xf << CLK_CTRL_TIMEOUT_SHIFT)
-#define CLK_CTRL_TIMEOUT_MIN_EXP        13
 
 #define PHY_CLK_TOO_SLOW_HZ             400000
 
@@ -163,15 +159,15 @@ static int sdhci_arasan_syscon_write(struct sdhci_host *host,
 
 static unsigned int sdhci_arasan_get_timeout_clock(struct sdhci_host *host)
 {
-        u32 div;
         unsigned long freq;
         struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 
-        div = readl(host->ioaddr + SDHCI_ARASAN_CLK_CTRL_OFFSET);
-        div = (div & CLK_CTRL_TIMEOUT_MASK) >> CLK_CTRL_TIMEOUT_SHIFT;
+        /* SDHCI timeout clock is in kHz */
+        freq = DIV_ROUND_UP(clk_get_rate(pltfm_host->clk), 1000);
 
-        freq = clk_get_rate(pltfm_host->clk);
-        freq /= 1 << (CLK_CTRL_TIMEOUT_MIN_EXP + div);
+        /* or in MHz */
+        if (host->caps & SDHCI_TIMEOUT_CLK_UNIT)
+                freq = DIV_ROUND_UP(freq, 1000);
 
         return freq;
 }
diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
index 2f9ad213377a..d5430ed02a67 100644
--- a/drivers/mmc/host/sdhci-of-at91.c
+++ b/drivers/mmc/host/sdhci-of-at91.c
@@ -29,6 +29,8 @@
 
 #include "sdhci-pltfm.h"
 
+#define SDMMC_MC1R      0x204
+#define         SDMMC_MC1R_DDR          BIT(3)
 #define SDMMC_CACR      0x230
 #define         SDMMC_CACR_CAPWREN      BIT(0)
 #define         SDMMC_CACR_KEY          (0x46 << 8)
@@ -85,11 +87,37 @@ static void sdhci_at91_set_clock(struct sdhci_host *host, unsigned int clock)
         sdhci_writew(host, clk, SDHCI_CLOCK_CONTROL);
 }
 
+/*
+ * In this specific implementation of the SDHCI controller, the power register
+ * needs to have a valid voltage set even when the power supply is managed by
+ * an external regulator.
+ */
+static void sdhci_at91_set_power(struct sdhci_host *host, unsigned char mode,
+                     unsigned short vdd)
+{
+        if (!IS_ERR(host->mmc->supply.vmmc)) {
+                struct mmc_host *mmc = host->mmc;
+
+                spin_unlock_irq(&host->lock);
+                mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+                spin_lock_irq(&host->lock);
+        }
+        sdhci_set_power_noreg(host, mode, vdd);
+}
+
+void sdhci_at91_set_uhs_signaling(struct sdhci_host *host, unsigned int timing)
+{
+        if (timing == MMC_TIMING_MMC_DDR52)
+                sdhci_writeb(host, SDMMC_MC1R_DDR, SDMMC_MC1R);
+        sdhci_set_uhs_signaling(host, timing);
+}
+
 static const struct sdhci_ops sdhci_at91_sama5d2_ops = {
         .set_clock              = sdhci_at91_set_clock,
         .set_bus_width          = sdhci_set_bus_width,
         .reset                  = sdhci_reset,
-        .set_uhs_signaling      = sdhci_set_uhs_signaling,
+        .set_uhs_signaling      = sdhci_at91_set_uhs_signaling,
+        .set_power              = sdhci_at91_set_power,
 };
 
 static const struct sdhci_pltfm_data soc_data_sama5d2 = {
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index 982b3e349426..86560d590786 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -451,6 +451,8 @@ static void sdhci_intel_set_power(struct sdhci_host *host, unsigned char mode,
         if (mode == MMC_POWER_OFF)
                 return;
 
+        spin_unlock_irq(&host->lock);
+
         /*
          * Bus power might not enable after D3 -> D0 transition due to the
          * present state not yet having propagated. Retry for up to 2ms.
@@ -463,6 +465,8 @@ static void sdhci_intel_set_power(struct sdhci_host *host, unsigned char mode,
                 reg |= SDHCI_POWER_ON;
                 sdhci_writeb(host, reg, SDHCI_POWER_CONTROL);
         }
+
+        spin_lock_irq(&host->lock);
 }
 
 static const struct sdhci_ops sdhci_intel_byt_ops = {
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 6fdd7a70f229..63bc33a54d0d 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1362,7 +1362,9 @@ void sdhci_enable_clk(struct sdhci_host *host, u16 clk)
                         return;
                 }
                 timeout--;
-                mdelay(1);
+                spin_unlock_irq(&host->lock);
+                usleep_range(900, 1100);
+                spin_lock_irq(&host->lock);
         }
 
         clk |= SDHCI_CLOCK_CARD_EN;
@@ -1828,6 +1830,9 @@ static void sdhci_enable_sdio_irq(struct mmc_host *mmc, int enable)
         struct sdhci_host *host = mmc_priv(mmc);
         unsigned long flags;
 
+        if (enable)
+                pm_runtime_get_noresume(host->mmc->parent);
+
         spin_lock_irqsave(&host->lock, flags);
         if (enable)
                 host->flags |= SDHCI_SDIO_IRQ_ENABLED;
@@ -1836,6 +1841,9 @@ static void sdhci_enable_sdio_irq(struct mmc_host *mmc, int enable)
 
         sdhci_enable_sdio_irq_nolock(host, enable);
         spin_unlock_irqrestore(&host->lock, flags);
+
+        if (!enable)
+                pm_runtime_put_noidle(host->mmc->parent);
 }
 
 static int sdhci_start_signal_voltage_switch(struct mmc_host *mmc,
diff --git a/drivers/mmc/host/ushc.c b/drivers/mmc/host/ushc.c
index d2c386f09d69..1d843357422e 100644
--- a/drivers/mmc/host/ushc.c
+++ b/drivers/mmc/host/ushc.c
@@ -426,6 +426,9 @@ static int ushc_probe(struct usb_interface *intf, const struct usb_device_id *id
         struct ushc_data *ushc;
         int ret;
 
+        if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         mmc = mmc_alloc_host(sizeof(struct ushc_data), &intf->dev);
         if (mmc == NULL)
                 return -ENOMEM;
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index 1ae872bfc3ba..747645c74134 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -186,7 +186,7 @@ static inline int write_enable(struct spi_nor *nor)
 }
 
 /*
- * Send write disble instruction to the chip.
+ * Send write disable instruction to the chip.
  */
 static inline int write_disable(struct spi_nor *nor)
 {
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index 8a280e7d66bd..127adbeefb10 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -984,29 +984,29 @@
 #define XP_ECC_CNT1_DESC_DED_WIDTH              8
 #define XP_ECC_CNT1_DESC_SEC_INDEX              0
 #define XP_ECC_CNT1_DESC_SEC_WIDTH              8
-#define XP_ECC_IER_DESC_DED_INDEX               0
+#define XP_ECC_IER_DESC_DED_INDEX               5
 #define XP_ECC_IER_DESC_DED_WIDTH               1
-#define XP_ECC_IER_DESC_SEC_INDEX               1
+#define XP_ECC_IER_DESC_SEC_INDEX               4
 #define XP_ECC_IER_DESC_SEC_WIDTH               1
-#define XP_ECC_IER_RX_DED_INDEX                 2
+#define XP_ECC_IER_RX_DED_INDEX                 3
 #define XP_ECC_IER_RX_DED_WIDTH                 1
-#define XP_ECC_IER_RX_SEC_INDEX                 3
+#define XP_ECC_IER_RX_SEC_INDEX                 2
 #define XP_ECC_IER_RX_SEC_WIDTH                 1
-#define XP_ECC_IER_TX_DED_INDEX                 4
+#define XP_ECC_IER_TX_DED_INDEX                 1
 #define XP_ECC_IER_TX_DED_WIDTH                 1
-#define XP_ECC_IER_TX_SEC_INDEX                 5
+#define XP_ECC_IER_TX_SEC_INDEX                 0
 #define XP_ECC_IER_TX_SEC_WIDTH                 1
-#define XP_ECC_ISR_DESC_DED_INDEX               0
+#define XP_ECC_ISR_DESC_DED_INDEX               5
 #define XP_ECC_ISR_DESC_DED_WIDTH               1
-#define XP_ECC_ISR_DESC_SEC_INDEX               1
+#define XP_ECC_ISR_DESC_SEC_INDEX               4
 #define XP_ECC_ISR_DESC_SEC_WIDTH               1
-#define XP_ECC_ISR_RX_DED_INDEX                 2
+#define XP_ECC_ISR_RX_DED_INDEX                 3
 #define XP_ECC_ISR_RX_DED_WIDTH                 1
-#define XP_ECC_ISR_RX_SEC_INDEX                 3
+#define XP_ECC_ISR_RX_SEC_INDEX                 2
 #define XP_ECC_ISR_RX_SEC_WIDTH                 1
-#define XP_ECC_ISR_TX_DED_INDEX                 4
+#define XP_ECC_ISR_TX_DED_INDEX                 1
 #define XP_ECC_ISR_TX_DED_WIDTH                 1
-#define XP_ECC_ISR_TX_SEC_INDEX                 5
+#define XP_ECC_ISR_TX_SEC_INDEX                 0
 #define XP_ECC_ISR_TX_SEC_WIDTH                 1
 #define XP_I2C_MUTEX_BUSY_INDEX                 31
 #define XP_I2C_MUTEX_BUSY_WIDTH                 1
@@ -1148,8 +1148,8 @@
 #define RX_PACKET_ATTRIBUTES_CSUM_DONE_WIDTH    1
 #define RX_PACKET_ATTRIBUTES_VLAN_CTAG_INDEX    1
 #define RX_PACKET_ATTRIBUTES_VLAN_CTAG_WIDTH    1
-#define RX_PACKET_ATTRIBUTES_INCOMPLETE_INDEX   2
-#define RX_PACKET_ATTRIBUTES_INCOMPLETE_WIDTH   1
+#define RX_PACKET_ATTRIBUTES_LAST_INDEX         2
+#define RX_PACKET_ATTRIBUTES_LAST_WIDTH         1
 #define RX_PACKET_ATTRIBUTES_CONTEXT_NEXT_INDEX 3
 #define RX_PACKET_ATTRIBUTES_CONTEXT_NEXT_WIDTH 1
 #define RX_PACKET_ATTRIBUTES_CONTEXT_INDEX      4
@@ -1158,6 +1158,8 @@
 #define RX_PACKET_ATTRIBUTES_RX_TSTAMP_WIDTH    1
 #define RX_PACKET_ATTRIBUTES_RSS_HASH_INDEX     6
 #define RX_PACKET_ATTRIBUTES_RSS_HASH_WIDTH     1
+#define RX_PACKET_ATTRIBUTES_FIRST_INDEX        7
+#define RX_PACKET_ATTRIBUTES_FIRST_WIDTH        1
 
 #define RX_NORMAL_DESC0_OVT_INDEX               0
 #define RX_NORMAL_DESC0_OVT_WIDTH               16
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 937f37a5dcb2..24a687ce4388 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -1896,10 +1896,15 @@ static int xgbe_dev_read(struct xgbe_channel *channel)
 
         /* Get the header length */
         if (XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, FD)) {
+                XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
+                               FIRST, 1);
                 rdata->rx.hdr_len = XGMAC_GET_BITS_LE(rdesc->desc2,
                                                       RX_NORMAL_DESC2, HL);
                 if (rdata->rx.hdr_len)
                         pdata->ext_stats.rx_split_header_packets++;
+        } else {
+                XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
+                               FIRST, 0);
         }
 
         /* Get the RSS hash */
@@ -1922,19 +1927,16 @@ static int xgbe_dev_read(struct xgbe_channel *channel)
                 }
         }
 
-        /* Get the packet length */
-        rdata->rx.len = XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, PL);
-
-        if (!XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, LD)) {
-                /* Not all the data has been transferred for this packet */
-                XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
-                               INCOMPLETE, 1);
+        /* Not all the data has been transferred for this packet */
+        if (!XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, LD))
                 return 0;
-        }
 
         /* This is the last of the data for this packet */
         XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
-                       INCOMPLETE, 0);
+                       LAST, 1);
+
+        /* Get the packet length */
+        rdata->rx.len = XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, PL);
 
         /* Set checksum done indicator as appropriate */
         if (netdev->features & NETIF_F_RXCSUM)
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 248f60d171a5..a713abd9d03e 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -1971,13 +1971,12 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata,
 {
         struct sk_buff *skb;
         u8 *packet;
-        unsigned int copy_len;
 
         skb = napi_alloc_skb(napi, rdata->rx.hdr.dma_len);
         if (!skb)
                 return NULL;
 
-        /* Start with the header buffer which may contain just the header
+        /* Pull in the header buffer which may contain just the header
          * or the header plus data
          */
         dma_sync_single_range_for_cpu(pdata->dev, rdata->rx.hdr.dma_base,
@@ -1986,30 +1985,49 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata,
 
         packet = page_address(rdata->rx.hdr.pa.pages) +
                  rdata->rx.hdr.pa.pages_offset;
-        copy_len = (rdata->rx.hdr_len) ? rdata->rx.hdr_len : len;
-        copy_len = min(rdata->rx.hdr.dma_len, copy_len);
-        skb_copy_to_linear_data(skb, packet, copy_len);
-        skb_put(skb, copy_len);
-
-        len -= copy_len;
-        if (len) {
-                /* Add the remaining data as a frag */
-                dma_sync_single_range_for_cpu(pdata->dev,
-                                              rdata->rx.buf.dma_base,
-                                              rdata->rx.buf.dma_off,
-                                              rdata->rx.buf.dma_len,
-                                              DMA_FROM_DEVICE);
-
-                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
-                                rdata->rx.buf.pa.pages,
-                                rdata->rx.buf.pa.pages_offset,
-                                len, rdata->rx.buf.dma_len);
-                rdata->rx.buf.pa.pages = NULL;
-        }
+        skb_copy_to_linear_data(skb, packet, len);
+        skb_put(skb, len);
 
         return skb;
 }
 
+static unsigned int xgbe_rx_buf1_len(struct xgbe_ring_data *rdata,
+                                     struct xgbe_packet_data *packet)
+{
+        /* Always zero if not the first descriptor */
+        if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, FIRST))
+                return 0;
+
+        /* First descriptor with split header, return header length */
+        if (rdata->rx.hdr_len)
+                return rdata->rx.hdr_len;
+
+        /* First descriptor but not the last descriptor and no split header,
+         * so the full buffer was used
+         */
+        if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, LAST))
+                return rdata->rx.hdr.dma_len;
+
+        /* First descriptor and last descriptor and no split header, so
+         * calculate how much of the buffer was used
+         */
+        return min_t(unsigned int, rdata->rx.hdr.dma_len, rdata->rx.len);
+}
+
+static unsigned int xgbe_rx_buf2_len(struct xgbe_ring_data *rdata,
+                                     struct xgbe_packet_data *packet,
+                                     unsigned int len)
+{
+        /* Always the full buffer if not the last descriptor */
+        if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, LAST))
+                return rdata->rx.buf.dma_len;
+
+        /* Last descriptor so calculate how much of the buffer was used
+         * for the last bit of data
+         */
+        return rdata->rx.len - len;
+}
+
 static int xgbe_tx_poll(struct xgbe_channel *channel)
 {
         struct xgbe_prv_data *pdata = channel->pdata;
@@ -2092,8 +2110,8 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
         struct napi_struct *napi;
         struct sk_buff *skb;
         struct skb_shared_hwtstamps *hwtstamps;
-        unsigned int incomplete, error, context_next, context;
-        unsigned int len, rdesc_len, max_len;
+        unsigned int last, error, context_next, context;
+        unsigned int len, buf1_len, buf2_len, max_len;
         unsigned int received = 0;
         int packet_count = 0;
 
@@ -2103,7 +2121,7 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
         if (!ring)
                 return 0;
 
-        incomplete = 0;
+        last = 0;
         context_next = 0;
 
         napi = (pdata->per_channel_irq) ? &channel->napi : &pdata->napi;
@@ -2137,9 +2155,8 @@ read_again:
                 received++;
                 ring->cur++;
 
-                incomplete = XGMAC_GET_BITS(packet->attributes,
-                                            RX_PACKET_ATTRIBUTES,
-                                            INCOMPLETE);
+                last = XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
+                                      LAST);
                 context_next = XGMAC_GET_BITS(packet->attributes,
                                               RX_PACKET_ATTRIBUTES,
                                               CONTEXT_NEXT);
@@ -2148,7 +2165,7 @@ read_again:
                                          CONTEXT);
 
                 /* Earlier error, just drain the remaining data */
-                if ((incomplete || context_next) && error)
+                if ((!last || context_next) && error)
                         goto read_again;
 
                 if (error || packet->errors) {
@@ -2160,16 +2177,22 @@ read_again:
                 }
 
                 if (!context) {
-                        /* Length is cumulative, get this descriptor's length */
-                        rdesc_len = rdata->rx.len - len;
-                        len += rdesc_len;
+                        /* Get the data length in the descriptor buffers */
+                        buf1_len = xgbe_rx_buf1_len(rdata, packet);
+                        len += buf1_len;
+                        buf2_len = xgbe_rx_buf2_len(rdata, packet, len);
+                        len += buf2_len;
 
-                        if (rdesc_len && !skb) {
+                        if (!skb) {
                                 skb = xgbe_create_skb(pdata, napi, rdata,
-                                                      rdesc_len);
-                                if (!skb)
+                                                      buf1_len);
+                                if (!skb) {
                                         error = 1;
-                        } else if (rdesc_len) {
+                                        goto skip_data;
+                                }
+                        }
+
+                        if (buf2_len) {
                                 dma_sync_single_range_for_cpu(pdata->dev,
                                                         rdata->rx.buf.dma_base,
                                                         rdata->rx.buf.dma_off,
@@ -2179,13 +2202,14 @@ read_again:
                                 skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
                                                 rdata->rx.buf.pa.pages,
                                                 rdata->rx.buf.pa.pages_offset,
-                                                rdesc_len,
+                                                buf2_len,
                                                 rdata->rx.buf.dma_len);
                                 rdata->rx.buf.pa.pages = NULL;
                         }
                 }
 
-                if (incomplete || context_next)
+skip_data:
+                if (!last || context_next)
                         goto read_again;
 
                 if (!skb)
@@ -2243,7 +2267,7 @@ next_packet:
         }
 
         /* Check if we need to save state before leaving */
-        if (received && (incomplete || context_next)) {
+        if (received && (!last || context_next)) {
                 rdata = XGBE_GET_DESC_DATA(ring, ring->cur);
                 rdata->state_saved = 1;
                 rdata->state.skb = skb;
@@ -2272,10 +2296,7 @@ static int xgbe_one_poll(struct napi_struct *napi, int budget)
         processed = xgbe_rx_poll(channel, budget);
 
         /* If we processed everything, we are done */
-        if (processed < budget) {
-                /* Turn off polling */
-                napi_complete_done(napi, processed);
-
+        if ((processed < budget) && napi_complete_done(napi, processed)) {
                 /* Enable Tx and Rx interrupts */
                 if (pdata->channel_irq_mode)
                         xgbe_enable_rx_tx_int(pdata, channel);
@@ -2317,10 +2338,7 @@ static int xgbe_all_poll(struct napi_struct *napi, int budget)
         } while ((processed < budget) && (processed != last_processed));
 
         /* If we processed everything, we are done */
-        if (processed < budget) {
-                /* Turn off polling */
-                napi_complete_done(napi, processed);
-
+        if ((processed < budget) && napi_complete_done(napi, processed)) {
                 /* Enable Tx and Rx interrupts */
                 xgbe_enable_rx_tx_ints(pdata);
         }
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
index dad63623be6a..d05fbfdce5e5 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
@@ -98,6 +98,7 @@ static int aq_ndev_change_mtu(struct net_device *ndev, int new_mtu)
 
         if (err < 0)
                 goto err_exit;
+        ndev->mtu = new_mtu;
 
         if (netif_running(ndev)) {
                 aq_ndev_close(ndev);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
index 581de71a958a..4c6c882c6a1c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
@@ -213,9 +213,9 @@ void aq_pci_func_free_irqs(struct aq_pci_func_s *self)
                 if (!((1U << i) & self->msix_entry_mask))
                         continue;
 
-                free_irq(pci_irq_vector(pdev, i), self->aq_vec[i]);
                 if (pdev->msix_enabled)
                         irq_set_affinity_hint(pci_irq_vector(pdev, i), NULL);
+                free_irq(pci_irq_vector(pdev, i), self->aq_vec[i]);
                 self->msix_entry_mask &= ~(1U << i);
         }
 }
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0_internal.h
index 1093ea18823a..0592a0330cf0 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0_internal.h
@@ -137,6 +137,7 @@ static struct aq_hw_caps_s hw_atl_a0_hw_caps_ = {
         .tx_rings = HW_ATL_A0_TX_RINGS,
         .rx_rings = HW_ATL_A0_RX_RINGS,
         .hw_features = NETIF_F_HW_CSUM |
+                        NETIF_F_RXCSUM |
                         NETIF_F_RXHASH |
                         NETIF_F_SG |
                         NETIF_F_TSO,
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
index 8bdee3ddd5a0..f3957e930340 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
@@ -188,6 +188,7 @@ static struct aq_hw_caps_s hw_atl_b0_hw_caps_ = {
         .tx_rings = HW_ATL_B0_TX_RINGS,
         .rx_rings = HW_ATL_B0_RX_RINGS,
         .hw_features = NETIF_F_HW_CSUM |
+                        NETIF_F_RXCSUM |
                         NETIF_F_RXHASH |
                         NETIF_F_SG |
                         NETIF_F_TSO |
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index d8d06fdfc42b..ac76fc251d26 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -13292,17 +13292,15 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
         dev->vlan_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                 NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_HIGHDMA;
 
-        /* VF with OLD Hypervisor or old PF do not support filtering */
         if (IS_PF(bp)) {
                 if (chip_is_e1x)
                         bp->accept_any_vlan = true;
                 else
                         dev->hw_features |= NETIF_F_HW_VLAN_CTAG_FILTER;
-#ifdef CONFIG_BNX2X_SRIOV
-        } else if (bp->acquire_resp.pfdev_info.pf_cap & PFVF_CAP_VLAN_FILTER) {
-                dev->hw_features |= NETIF_F_HW_VLAN_CTAG_FILTER;
-#endif
         }
+        /* For VF we'll know whether to enable VLAN filtering after
+         * getting a response to CHANNEL_TLV_ACQUIRE from PF.
+         */
 
         dev->features |= dev->hw_features | NETIF_F_HW_VLAN_CTAG_RX;
         dev->features |= NETIF_F_HIGHDMA;
@@ -13738,7 +13736,7 @@ static int bnx2x_ptp_adjfreq(struct ptp_clock_info *ptp, s32 ppb)
         if (!netif_running(bp->dev)) {
                 DP(BNX2X_MSG_PTP,
                    "PTP adjfreq called while the interface is down\n");
-                return -EFAULT;
+                return -ENETDOWN;
         }
 
         if (ppb < 0) {
@@ -13797,6 +13795,12 @@ static int bnx2x_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
 {
         struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info);
 
+        if (!netif_running(bp->dev)) {
+                DP(BNX2X_MSG_PTP,
+                   "PTP adjtime called while the interface is down\n");
+                return -ENETDOWN;
+        }
+
         DP(BNX2X_MSG_PTP, "PTP adjtime called, delta = %llx\n", delta);
 
         timecounter_adjtime(&bp->timecounter, delta);
@@ -13809,6 +13813,12 @@ static int bnx2x_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)
         struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info);
         u64 ns;
 
+        if (!netif_running(bp->dev)) {
+                DP(BNX2X_MSG_PTP,
+                   "PTP gettime called while the interface is down\n");
+                return -ENETDOWN;
+        }
+
         ns = timecounter_read(&bp->timecounter);
 
         DP(BNX2X_MSG_PTP, "PTP gettime called, ns = %llu\n", ns);
@@ -13824,6 +13834,12 @@ static int bnx2x_ptp_settime(struct ptp_clock_info *ptp,
         struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info);
         u64 ns;
 
+        if (!netif_running(bp->dev)) {
+                DP(BNX2X_MSG_PTP,
+                   "PTP settime called while the interface is down\n");
+                return -ENETDOWN;
+        }
+
         ns = timespec64_to_ns(ts);
 
         DP(BNX2X_MSG_PTP, "PTP settime called, ns = %llu\n", ns);
@@ -13991,6 +14007,14 @@ static int bnx2x_init_one(struct pci_dev *pdev,
                 rc = bnx2x_vfpf_acquire(bp, tx_count, rx_count);
                 if (rc)
                         goto init_one_freemem;
+
+#ifdef CONFIG_BNX2X_SRIOV
+                /* VF with OLD Hypervisor or old PF do not support filtering */
+                if (bp->acquire_resp.pfdev_info.pf_cap & PFVF_CAP_VLAN_FILTER) {
+                        dev->hw_features |= NETIF_F_HW_VLAN_CTAG_FILTER;
+                        dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
+                }
+#endif
         }
 
         /* Enable SRIOV if capability found in configuration space */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 6fad22adbbb9..bdfd53b46bc5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -434,7 +434,9 @@ static int bnx2x_vf_mac_vlan_config(struct bnx2x *bp,
 
         /* Add/Remove the filter */
         rc = bnx2x_config_vlan_mac(bp, &ramrod);
-        if (rc && rc != -EEXIST) {
+        if (rc == -EEXIST)
+                return 0;
+        if (rc) {
                 BNX2X_ERR("Failed to %s %s\n",
                           filter->add ? "add" : "delete",
                           (filter->type == BNX2X_VF_FILTER_VLAN_MAC) ?
@@ -444,6 +446,8 @@ static int bnx2x_vf_mac_vlan_config(struct bnx2x *bp,
                 return rc;
         }
 
+        filter->applied = true;
+
         return 0;
 }
 
@@ -469,8 +473,10 @@ int bnx2x_vf_mac_vlan_config_list(struct bnx2x *bp, struct bnx2x_virtf *vf,
         /* Rollback if needed */
         if (i != filters->count) {
                 BNX2X_ERR("Managed only %d/%d filters - rolling back\n",
-                          i, filters->count + 1);
+                          i, filters->count);
                 while (--i >= 0) {
+                        if (!filters->filters[i].applied)
+                                continue;
                         filters->filters[i].add = !filters->filters[i].add;
                         bnx2x_vf_mac_vlan_config(bp, vf, qid,
                                                  &filters->filters[i],
@@ -1899,7 +1905,8 @@ void bnx2x_iov_adjust_stats_req(struct bnx2x *bp)
                         continue;
                 }
 
-                DP(BNX2X_MSG_IOV, "add addresses for vf %d\n", vf->abs_vfid);
+                DP_AND((BNX2X_MSG_IOV | BNX2X_MSG_STATS),
+                       "add addresses for vf %d\n", vf->abs_vfid);
                 for_each_vfq(vf, j) {
                         struct bnx2x_vf_queue *rxq = vfq_get(vf, j);
 
@@ -1920,11 +1927,12 @@ void bnx2x_iov_adjust_stats_req(struct bnx2x *bp)
                                 cpu_to_le32(U64_HI(q_stats_addr));
                         cur_query_entry->address.lo =
                                 cpu_to_le32(U64_LO(q_stats_addr));
-                        DP(BNX2X_MSG_IOV,
-                           "added address %x %x for vf %d queue %d client %d\n",
-                           cur_query_entry->address.hi,
-                           cur_query_entry->address.lo, cur_query_entry->funcID,
-                           j, cur_query_entry->index);
+                        DP_AND((BNX2X_MSG_IOV | BNX2X_MSG_STATS),
+                               "added address %x %x for vf %d queue %d client %d\n",
+                               cur_query_entry->address.hi,
+                               cur_query_entry->address.lo,
+                               cur_query_entry->funcID,
+                               j, cur_query_entry->index);
                         cur_query_entry++;
                         cur_data_offset += sizeof(struct per_queue_stats);
                         stats_count++;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
index 7a6d406f4c11..888d0b6632e8 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
@@ -114,6 +114,7 @@ struct bnx2x_vf_mac_vlan_filter {
         (BNX2X_VF_FILTER_MAC | BNX2X_VF_FILTER_VLAN) /*shortcut*/
 
         bool add;
+        bool applied;
         u8 *mac;
         u16 vid;
 };
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index bfae300cf25f..76a4668c50fe 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -868,7 +868,7 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev)
         struct bnx2x *bp = netdev_priv(dev);
         struct vfpf_set_q_filters_tlv *req = &bp->vf2pf_mbox->req.set_q_filters;
         struct pfvf_general_resp_tlv *resp = &bp->vf2pf_mbox->resp.general_resp;
-        int rc, i = 0;
+        int rc = 0, i = 0;
         struct netdev_hw_addr *ha;
 
         if (bp->state != BNX2X_STATE_OPEN) {
@@ -883,6 +883,15 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev)
         /* Get Rx mode requested */
         DP(NETIF_MSG_IFUP, "dev->flags = %x\n", dev->flags);
 
+        /* We support PFVF_MAX_MULTICAST_PER_VF mcast addresses tops */
+        if (netdev_mc_count(dev) > PFVF_MAX_MULTICAST_PER_VF) {
+                DP(NETIF_MSG_IFUP,
+                   "VF supports not more than %d multicast MAC addresses\n",
+                   PFVF_MAX_MULTICAST_PER_VF);
+                rc = -EINVAL;
+                goto out;
+        }
+
         netdev_for_each_mc_addr(ha, dev) {
                 DP(NETIF_MSG_IFUP, "Adding mcast MAC: %pM\n",
                    bnx2x_mc_addr(ha));
@@ -890,16 +899,6 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev)
                 i++;
         }
 
-        /* We support four PFVF_MAX_MULTICAST_PER_VF mcast
-          * addresses tops
-          */
-        if (i >= PFVF_MAX_MULTICAST_PER_VF) {
-                DP(NETIF_MSG_IFUP,
-                   "VF supports not more than %d multicast MAC addresses\n",
-                   PFVF_MAX_MULTICAST_PER_VF);
-                return -EINVAL;
-        }
-
         req->n_multicast = i;
         req->flags |= VFPF_SET_Q_FILTERS_MULTICAST_CHANGED;
         req->vf_qid = 0;
@@ -924,7 +923,7 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev)
 out:
         bnx2x_vfpf_finalize(bp, &req->first_tlv);
 
-        return 0;
+        return rc;
 }
 
 /* request pf to add a vlan for the vf */
@@ -1778,6 +1777,23 @@ static int bnx2x_vf_mbx_qfilters(struct bnx2x *bp, struct bnx2x_virtf *vf)
                                 goto op_err;
                 }
 
+                /* build vlan list */
+                fl = NULL;
+
+                rc = bnx2x_vf_mbx_macvlan_list(bp, vf, msg, &fl,
+                                               VFPF_VLAN_FILTER);
+                if (rc)
+                        goto op_err;
+
+                if (fl) {
+                        /* set vlan list */
+                        rc = bnx2x_vf_mac_vlan_config_list(bp, vf, fl,
+                                                           msg->vf_qid,
+                                                           false);
+                        if (rc)
+                                goto op_err;
+                }
+
         }
 
         if (msg->flags & VFPF_SET_Q_FILTERS_RX_MASK_CHANGED) {
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 235733e91c79..32de4589d16a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4465,6 +4465,10 @@ static int bnxt_hwrm_func_qcfg(struct bnxt *bp)
                 vf->vlan = le16_to_cpu(resp->vlan) & VLAN_VID_MASK;
         }
 #endif
+        if (BNXT_PF(bp) && (le16_to_cpu(resp->flags) &
+                            FUNC_QCFG_RESP_FLAGS_FW_DCBX_AGENT_ENABLED))
+                bp->flags |= BNXT_FLAG_FW_LLDP_AGENT;
+
         switch (resp->port_partition_type) {
         case FUNC_QCFG_RESP_PORT_PARTITION_TYPE_NPAR1_0:
         case FUNC_QCFG_RESP_PORT_PARTITION_TYPE_NPAR1_5:
@@ -5507,8 +5511,9 @@ static int bnxt_hwrm_phy_qcaps(struct bnxt *bp)
                 bp->lpi_tmr_hi = le32_to_cpu(resp->valid_tx_lpi_timer_high) &
                                  PORT_PHY_QCAPS_RESP_TX_LPI_TIMER_HIGH_MASK;
         }
-        link_info->support_auto_speeds =
-                le16_to_cpu(resp->supported_speeds_auto_mode);
+        if (resp->supported_speeds_auto_mode)
+                link_info->support_auto_speeds =
+                        le16_to_cpu(resp->supported_speeds_auto_mode);
 
 hwrm_phy_qcaps_exit:
         mutex_unlock(&bp->hwrm_cmd_lock);
@@ -6495,8 +6500,14 @@ static void bnxt_reset_task(struct bnxt *bp, bool silent)
         if (!silent)
                 bnxt_dbg_dump_states(bp);
         if (netif_running(bp->dev)) {
+                int rc;
+
+                if (!silent)
+                        bnxt_ulp_stop(bp);
                 bnxt_close_nic(bp, false, false);
-                bnxt_open_nic(bp, false, false);
+                rc = bnxt_open_nic(bp, false, false);
+                if (!silent && !rc)
+                        bnxt_ulp_start(bp);
         }
 }
 
@@ -7444,6 +7455,10 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc)
                 goto init_err_pci_clean;
 
+        rc = bnxt_hwrm_func_reset(bp);
+        if (rc)
+                goto init_err_pci_clean;
+
         bnxt_hwrm_fw_set_time(bp);
 
         dev->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | NETIF_F_SG |
@@ -7554,10 +7569,6 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc)
                 goto init_err_pci_clean;
 
-        rc = bnxt_hwrm_func_reset(bp);
-        if (rc)
-                goto init_err_pci_clean;
-
         rc = bnxt_init_int_mode(bp);
         if (rc)
                 goto init_err_pci_clean;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index faf26a2f726b..c7a5b84a5cb2 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -993,6 +993,7 @@ struct bnxt {
                                          BNXT_FLAG_ROCEV2_CAP)
         #define BNXT_FLAG_NO_AGG_RINGS  0x20000
         #define BNXT_FLAG_RX_PAGE_MODE  0x40000
+        #define BNXT_FLAG_FW_LLDP_AGENT 0x80000
         #define BNXT_FLAG_CHIP_NITRO_A0 0x1000000
 
         #define BNXT_FLAG_ALL_CONFIG_FEATS (BNXT_FLAG_TPA |             \
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
index fdf2d8caf7bf..03532061d211 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
@@ -474,7 +474,7 @@ void bnxt_dcb_init(struct bnxt *bp)
                 return;
 
         bp->dcbx_cap = DCB_CAP_DCBX_VER_IEEE;
-        if (BNXT_PF(bp))
+        if (BNXT_PF(bp) && !(bp->flags & BNXT_FLAG_FW_LLDP_AGENT))
                 bp->dcbx_cap |= DCB_CAP_DCBX_HOST;
         else
                 bp->dcbx_cap |= DCB_CAP_DCBX_LLD_MANAGED;
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index f92896835d2a..365895ed3c3e 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1,7 +1,7 @@
 /*
  * Broadcom GENET (Gigabit Ethernet) controller driver
  *
- * Copyright (c) 2014 Broadcom Corporation
+ * Copyright (c) 2014-2017 Broadcom
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -450,6 +450,22 @@ static inline void bcmgenet_rdma_ring_writel(struct bcmgenet_priv *priv,
                         genet_dma_ring_regs[r]);
 }
 
+static int bcmgenet_begin(struct net_device *dev)
+{
+        struct bcmgenet_priv *priv = netdev_priv(dev);
+
+        /* Turn on the clock */
+        return clk_prepare_enable(priv->clk);
+}
+
+static void bcmgenet_complete(struct net_device *dev)
+{
+        struct bcmgenet_priv *priv = netdev_priv(dev);
+
+        /* Turn off the clock */
+        clk_disable_unprepare(priv->clk);
+}
+
 static int bcmgenet_get_link_ksettings(struct net_device *dev,
                                        struct ethtool_link_ksettings *cmd)
 {
@@ -778,8 +794,9 @@ static const struct bcmgenet_stats bcmgenet_gstrings_stats[] = {
         STAT_GENET_RUNT("rx_runt_bytes", mib.rx_runt_bytes),
         /* Misc UniMAC counters */
         STAT_GENET_MISC("rbuf_ovflow_cnt", mib.rbuf_ovflow_cnt,
-                        UMAC_RBUF_OVFL_CNT),
-        STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt, UMAC_RBUF_ERR_CNT),
+                        UMAC_RBUF_OVFL_CNT_V1),
+        STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt,
+                        UMAC_RBUF_ERR_CNT_V1),
         STAT_GENET_MISC("mdf_err_cnt", mib.mdf_err_cnt, UMAC_MDF_ERR_CNT),
         STAT_GENET_SOFT_MIB("alloc_rx_buff_failed", mib.alloc_rx_buff_failed),
         STAT_GENET_SOFT_MIB("rx_dma_failed", mib.rx_dma_failed),
@@ -821,6 +838,45 @@ static void bcmgenet_get_strings(struct net_device *dev, u32 stringset,
         }
 }
 
+static u32 bcmgenet_update_stat_misc(struct bcmgenet_priv *priv, u16 offset)
+{
+        u16 new_offset;
+        u32 val;
+
+        switch (offset) {
+        case UMAC_RBUF_OVFL_CNT_V1:
+                if (GENET_IS_V2(priv))
+                        new_offset = RBUF_OVFL_CNT_V2;
+                else
+                        new_offset = RBUF_OVFL_CNT_V3PLUS;
+
+                val = bcmgenet_rbuf_readl(priv, new_offset);
+                /* clear if overflowed */
+                if (val == ~0)
+                        bcmgenet_rbuf_writel(priv, 0, new_offset);
+                break;
+        case UMAC_RBUF_ERR_CNT_V1:
+                if (GENET_IS_V2(priv))
+                        new_offset = RBUF_ERR_CNT_V2;
+                else
+                        new_offset = RBUF_ERR_CNT_V3PLUS;
+
+                val = bcmgenet_rbuf_readl(priv, new_offset);
+                /* clear if overflowed */
+                if (val == ~0)
+                        bcmgenet_rbuf_writel(priv, 0, new_offset);
+                break;
+        default:
+                val = bcmgenet_umac_readl(priv, offset);
+                /* clear if overflowed */
+                if (val == ~0)
+                        bcmgenet_umac_writel(priv, 0, offset);
+                break;
+        }
+
+        return val;
+}
+
 static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv)
 {
         int i, j = 0;
@@ -836,19 +892,28 @@ static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv)
                 case BCMGENET_STAT_NETDEV:
                 case BCMGENET_STAT_SOFT:
                         continue;
-                case BCMGENET_STAT_MIB_RX:
-                case BCMGENET_STAT_MIB_TX:
                 case BCMGENET_STAT_RUNT:
-                        if (s->type != BCMGENET_STAT_MIB_RX)
-                                offset = BCMGENET_STAT_OFFSET;
+                        offset += BCMGENET_STAT_OFFSET;
+                        /* fall through */
+                case BCMGENET_STAT_MIB_TX:
+                        offset += BCMGENET_STAT_OFFSET;
+                        /* fall through */
+                case BCMGENET_STAT_MIB_RX:
                         val = bcmgenet_umac_readl(priv,
                                                   UMAC_MIB_START + j + offset);
+                        offset = 0;     /* Reset Offset */
                         break;
                 case BCMGENET_STAT_MISC:
-                        val = bcmgenet_umac_readl(priv, s->reg_offset);
-                        /* clear if overflowed */
-                        if (val == ~0)
-                                bcmgenet_umac_writel(priv, 0, s->reg_offset);
+                        if (GENET_IS_V1(priv)) {
+                                val = bcmgenet_umac_readl(priv, s->reg_offset);
+                                /* clear if overflowed */
+                                if (val == ~0)
+                                        bcmgenet_umac_writel(priv, 0,
+                                                             s->reg_offset);
+                        } else {
+                                val = bcmgenet_update_stat_misc(priv,
+                                                                s->reg_offset);
+                        }
                         break;
                 }
 
@@ -973,6 +1038,8 @@ static int bcmgenet_set_eee(struct net_device *dev, struct ethtool_eee *e)
 
 /* standard ethtool support functions. */
 static const struct ethtool_ops bcmgenet_ethtool_ops = {
+        .begin                  = bcmgenet_begin,
+        .complete               = bcmgenet_complete,
         .get_strings            = bcmgenet_get_strings,
         .get_sset_count         = bcmgenet_get_sset_count,
         .get_ethtool_stats      = bcmgenet_get_ethtool_stats,
@@ -1167,7 +1234,6 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
         struct bcmgenet_priv *priv = netdev_priv(dev);
         struct device *kdev = &priv->pdev->dev;
         struct enet_cb *tx_cb_ptr;
-        struct netdev_queue *txq;
         unsigned int pkts_compl = 0;
         unsigned int bytes_compl = 0;
         unsigned int c_index;
@@ -1219,13 +1285,8 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
         dev->stats.tx_packets += pkts_compl;
         dev->stats.tx_bytes += bytes_compl;
 
-        txq = netdev_get_tx_queue(dev, ring->queue);
-        netdev_tx_completed_queue(txq, pkts_compl, bytes_compl);
-
-        if (ring->free_bds > (MAX_SKB_FRAGS + 1)) {
-                if (netif_tx_queue_stopped(txq))
-                        netif_tx_wake_queue(txq);
-        }
+        netdev_tx_completed_queue(netdev_get_tx_queue(dev, ring->queue),
+                                  pkts_compl, bytes_compl);
 
         return pkts_compl;
 }
@@ -1248,8 +1309,16 @@ static int bcmgenet_tx_poll(struct napi_struct *napi, int budget)
         struct bcmgenet_tx_ring *ring =
                 container_of(napi, struct bcmgenet_tx_ring, napi);
         unsigned int work_done = 0;
+        struct netdev_queue *txq;
+        unsigned long flags;
 
-        work_done = bcmgenet_tx_reclaim(ring->priv->dev, ring);
+        spin_lock_irqsave(&ring->lock, flags);
+        work_done = __bcmgenet_tx_reclaim(ring->priv->dev, ring);
+        if (ring->free_bds > (MAX_SKB_FRAGS + 1)) {
+                txq = netdev_get_tx_queue(ring->priv->dev, ring->queue);
+                netif_tx_wake_queue(txq);
+        }
+        spin_unlock_irqrestore(&ring->lock, flags);
 
         if (work_done == 0) {
                 napi_complete(napi);
@@ -2457,24 +2526,28 @@ static int bcmgenet_init_dma(struct bcmgenet_priv *priv)
 /* Interrupt bottom half */
 static void bcmgenet_irq_task(struct work_struct *work)
 {
+        unsigned long flags;
+        unsigned int status;
         struct bcmgenet_priv *priv = container_of(
                         work, struct bcmgenet_priv, bcmgenet_irq_work);
 
         netif_dbg(priv, intr, priv->dev, "%s\n", __func__);
 
-        if (priv->irq0_stat & UMAC_IRQ_MPD_R) {
-                priv->irq0_stat &= ~UMAC_IRQ_MPD_R;
+        spin_lock_irqsave(&priv->lock, flags);
+        status = priv->irq0_stat;
+        priv->irq0_stat = 0;
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        if (status & UMAC_IRQ_MPD_R) {
                 netif_dbg(priv, wol, priv->dev,
                           "magic packet detected, waking up\n");
                 bcmgenet_power_up(priv, GENET_POWER_WOL_MAGIC);
         }
 
         /* Link UP/DOWN event */
-        if (priv->irq0_stat & UMAC_IRQ_LINK_EVENT) {
+        if (status & UMAC_IRQ_LINK_EVENT)
                 phy_mac_interrupt(priv->phydev,
-                                  !!(priv->irq0_stat & UMAC_IRQ_LINK_UP));
-                priv->irq0_stat &= ~UMAC_IRQ_LINK_EVENT;
-        }
+                                  !!(status & UMAC_IRQ_LINK_UP));
 }
 
 /* bcmgenet_isr1: handle Rx and Tx priority queues */
@@ -2483,22 +2556,21 @@ static irqreturn_t bcmgenet_isr1(int irq, void *dev_id)
         struct bcmgenet_priv *priv = dev_id;
         struct bcmgenet_rx_ring *rx_ring;
         struct bcmgenet_tx_ring *tx_ring;
-        unsigned int index;
+        unsigned int index, status;
 
-        /* Save irq status for bottom-half processing. */
-        priv->irq1_stat =
-                bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_STAT) &
+        /* Read irq status */
+        status = bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_STAT) &
                 ~bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_MASK_STATUS);
 
         /* clear interrupts */
-        bcmgenet_intrl2_1_writel(priv, priv->irq1_stat, INTRL2_CPU_CLEAR);
+        bcmgenet_intrl2_1_writel(priv, status, INTRL2_CPU_CLEAR);
 
         netif_dbg(priv, intr, priv->dev,
-                  "%s: IRQ=0x%x\n", __func__, priv->irq1_stat);
+                  "%s: IRQ=0x%x\n", __func__, status);
 
         /* Check Rx priority queue interrupts */
         for (index = 0; index < priv->hw_params->rx_queues; index++) {
-                if (!(priv->irq1_stat & BIT(UMAC_IRQ1_RX_INTR_SHIFT + index)))
+                if (!(status & BIT(UMAC_IRQ1_RX_INTR_SHIFT + index)))
                         continue;
 
                 rx_ring = &priv->rx_rings[index];
@@ -2511,7 +2583,7 @@ static irqreturn_t bcmgenet_isr1(int irq, void *dev_id)
 
         /* Check Tx priority queue interrupts */
         for (index = 0; index < priv->hw_params->tx_queues; index++) {
-                if (!(priv->irq1_stat & BIT(index)))
+                if (!(status & BIT(index)))
                         continue;
 
                 tx_ring = &priv->tx_rings[index];
@@ -2531,19 +2603,20 @@ static irqreturn_t bcmgenet_isr0(int irq, void *dev_id)
         struct bcmgenet_priv *priv = dev_id;
         struct bcmgenet_rx_ring *rx_ring;
         struct bcmgenet_tx_ring *tx_ring;
+        unsigned int status;
+        unsigned long flags;
 
-        /* Save irq status for bottom-half processing. */
-        priv->irq0_stat =
-                bcmgenet_intrl2_0_readl(priv, INTRL2_CPU_STAT) &
+        /* Read irq status */
+        status = bcmgenet_intrl2_0_readl(priv, INTRL2_CPU_STAT) &
                 ~bcmgenet_intrl2_0_readl(priv, INTRL2_CPU_MASK_STATUS);
 
         /* clear interrupts */
-        bcmgenet_intrl2_0_writel(priv, priv->irq0_stat, INTRL2_CPU_CLEAR);
+        bcmgenet_intrl2_0_writel(priv, status, INTRL2_CPU_CLEAR);
 
         netif_dbg(priv, intr, priv->dev,
-                  "IRQ=0x%x\n", priv->irq0_stat);
+                  "IRQ=0x%x\n", status);
 
-        if (priv->irq0_stat & UMAC_IRQ_RXDMA_DONE) {
+        if (status & UMAC_IRQ_RXDMA_DONE) {
                 rx_ring = &priv->rx_rings[DESC_INDEX];
 
                 if (likely(napi_schedule_prep(&rx_ring->napi))) {
@@ -2552,7 +2625,7 @@ static irqreturn_t bcmgenet_isr0(int irq, void *dev_id)
                 }
         }
 
-        if (priv->irq0_stat & UMAC_IRQ_TXDMA_DONE) {
+        if (status & UMAC_IRQ_TXDMA_DONE) {
                 tx_ring = &priv->tx_rings[DESC_INDEX];
 
                 if (likely(napi_schedule_prep(&tx_ring->napi))) {
@@ -2561,22 +2634,23 @@ static irqreturn_t bcmgenet_isr0(int irq, void *dev_id)
                 }
         }
 
-        if (priv->irq0_stat & (UMAC_IRQ_PHY_DET_R |
-                                UMAC_IRQ_PHY_DET_F |
-                                UMAC_IRQ_LINK_EVENT |
-                                UMAC_IRQ_HFB_SM |
-                                UMAC_IRQ_HFB_MM |
-                                UMAC_IRQ_MPD_R)) {
-                /* all other interested interrupts handled in bottom half */
-                schedule_work(&priv->bcmgenet_irq_work);
-        }
-
         if ((priv->hw_params->flags & GENET_HAS_MDIO_INTR) &&
-            priv->irq0_stat & (UMAC_IRQ_MDIO_DONE | UMAC_IRQ_MDIO_ERROR)) {
-                priv->irq0_stat &= ~(UMAC_IRQ_MDIO_DONE | UMAC_IRQ_MDIO_ERROR);
+                status & (UMAC_IRQ_MDIO_DONE | UMAC_IRQ_MDIO_ERROR)) {
                 wake_up(&priv->wq);
         }
 
+        /* all other interested interrupts handled in bottom half */
+        status &= (UMAC_IRQ_LINK_EVENT |
+                   UMAC_IRQ_MPD_R);
+        if (status) {
+                /* Save irq status for bottom-half processing. */
+                spin_lock_irqsave(&priv->lock, flags);
+                priv->irq0_stat |= status;
+                spin_unlock_irqrestore(&priv->lock, flags);
+
+                schedule_work(&priv->bcmgenet_irq_work);
+        }
+
         return IRQ_HANDLED;
 }
 
@@ -2801,6 +2875,8 @@ err_irq0:
 err_fini_dma:
         bcmgenet_fini_dma(priv);
 err_clk_disable:
+        if (priv->internal_phy)
+                bcmgenet_power_down(priv, GENET_POWER_PASSIVE);
         clk_disable_unprepare(priv->clk);
         return ret;
 }
@@ -3177,6 +3253,12 @@ static void bcmgenet_set_hw_params(struct bcmgenet_priv *priv)
          */
         gphy_rev = reg & 0xffff;
 
+        /* This is reserved so should require special treatment */
+        if (gphy_rev == 0 || gphy_rev == 0x01ff) {
+                pr_warn("Invalid GPHY revision detected: 0x%04x\n", gphy_rev);
+                return;
+        }
+
         /* This is the good old scheme, just GPHY major, no minor nor patch */
         if ((gphy_rev & 0xf0) != 0)
                 priv->gphy_rev = gphy_rev << 8;
@@ -3185,12 +3267,6 @@ static void bcmgenet_set_hw_params(struct bcmgenet_priv *priv)
         else if ((gphy_rev & 0xff00) != 0)
                 priv->gphy_rev = gphy_rev;
 
-        /* This is reserved so should require special treatment */
-        else if (gphy_rev == 0 || gphy_rev == 0x01ff) {
-                pr_warn("Invalid GPHY revision detected: 0x%04x\n", gphy_rev);
-                return;
-        }
-
 #ifdef CONFIG_PHYS_ADDR_T_64BIT
         if (!(params->flags & GENET_HAS_40BITS))
                 pr_warn("GENET does not support 40-bits PA\n");
@@ -3233,6 +3309,7 @@ static int bcmgenet_probe(struct platform_device *pdev)
         const void *macaddr;
         struct resource *r;
         int err = -EIO;
+        const char *phy_mode_str;
 
         /* Up to GENET_MAX_MQ_CNT + 1 TX queues and RX queues */
         dev = alloc_etherdev_mqs(sizeof(*priv), GENET_MAX_MQ_CNT + 1,
@@ -3276,6 +3353,8 @@ static int bcmgenet_probe(struct platform_device *pdev)
                 goto err;
         }
 
+        spin_lock_init(&priv->lock);
+
         SET_NETDEV_DEV(dev, &pdev->dev);
         dev_set_drvdata(&pdev->dev, dev);
         ether_addr_copy(dev->dev_addr, macaddr);
@@ -3338,6 +3417,13 @@ static int bcmgenet_probe(struct platform_device *pdev)
                 priv->clk_eee = NULL;
         }
 
+        /* If this is an internal GPHY, power it on now, before UniMAC is
+         * brought out of reset as absolutely no UniMAC activity is allowed
+         */
+        if (dn && !of_property_read_string(dn, "phy-mode", &phy_mode_str) &&
+            !strcasecmp(phy_mode_str, "internal"))
+                bcmgenet_power_up(priv, GENET_POWER_PASSIVE);
+
         err = reset_umac(priv);
         if (err)
                 goto err_clk_disable;
@@ -3395,7 +3481,8 @@ static int bcmgenet_suspend(struct device *d)
 
         bcmgenet_netif_stop(dev);
 
-        phy_suspend(priv->phydev);
+        if (!device_may_wakeup(d))
+                phy_suspend(priv->phydev);
 
         netif_device_detach(dev);
 
@@ -3492,7 +3579,8 @@ static int bcmgenet_resume(struct device *d)
 
         netif_device_attach(dev);
 
-        phy_resume(priv->phydev);
+        if (!device_may_wakeup(d))
+                phy_resume(priv->phydev);
 
         if (priv->eee.eee_enabled)
                 bcmgenet_eee_enable_set(dev, true);
@@ -3502,6 +3590,8 @@ static int bcmgenet_resume(struct device *d)
         return 0;
 
 out_clk_disable:
+        if (priv->internal_phy)
+                bcmgenet_power_down(priv, GENET_POWER_PASSIVE);
         clk_disable_unprepare(priv->clk);
         return ret;
 }
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index 1e2dc34d331a..db7f289d65ae 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014 Broadcom Corporation
+ * Copyright (c) 2014-2017 Broadcom
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -214,7 +214,9 @@ struct bcmgenet_mib_counters {
 #define  MDIO_REG_SHIFT                 16
 #define  MDIO_REG_MASK                  0x1F
 
-#define UMAC_RBUF_OVFL_CNT              0x61C
+#define UMAC_RBUF_OVFL_CNT_V1           0x61C
+#define RBUF_OVFL_CNT_V2                0x80
+#define RBUF_OVFL_CNT_V3PLUS            0x94
 
 #define UMAC_MPD_CTRL                   0x620
 #define  MPD_EN                         (1 << 0)
@@ -224,7 +226,9 @@ struct bcmgenet_mib_counters {
 
 #define UMAC_MPD_PW_MS                  0x624
 #define UMAC_MPD_PW_LS                  0x628
-#define UMAC_RBUF_ERR_CNT               0x634
+#define UMAC_RBUF_ERR_CNT_V1            0x634
+#define RBUF_ERR_CNT_V2                 0x84
+#define RBUF_ERR_CNT_V3PLUS             0x98
 #define UMAC_MDF_ERR_CNT                0x638
 #define UMAC_MDF_CTRL                   0x650
 #define UMAC_MDF_ADDR                   0x654
@@ -619,11 +623,13 @@ struct bcmgenet_priv {
         struct work_struct bcmgenet_irq_work;
         int irq0;
         int irq1;
-        unsigned int irq0_stat;
-        unsigned int irq1_stat;
         int wol_irq;
         bool wol_irq_disabled;
 
+        /* shared status */
+        spinlock_t lock;
+        unsigned int irq0_stat;
+
         /* HW descriptors/checksum variables */
         bool desc_64b_en;
         bool desc_rxchk_en;
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index e87607621e62..2f9281936f0e 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -220,20 +220,6 @@ void bcmgenet_phy_power_set(struct net_device *dev, bool enable)
         udelay(60);
 }
 
-static void bcmgenet_internal_phy_setup(struct net_device *dev)
-{
-        struct bcmgenet_priv *priv = netdev_priv(dev);
-        u32 reg;
-
-        /* Power up PHY */
-        bcmgenet_phy_power_set(dev, true);
-        /* enable APD */
-        reg = bcmgenet_ext_readl(priv, EXT_EXT_PWR_MGMT);
-        reg |= EXT_PWR_DN_EN_LD;
-        bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT);
-        bcmgenet_mii_reset(dev);
-}
-
 static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv)
 {
         u32 reg;
@@ -281,7 +267,6 @@ int bcmgenet_mii_config(struct net_device *dev)
 
                 if (priv->internal_phy) {
                         phy_name = "internal PHY";
-                        bcmgenet_internal_phy_setup(dev);
                 } else if (priv->phy_interface == PHY_INTERFACE_MODE_MOCA) {
                         phy_name = "MoCA";
                         bcmgenet_moca_phy_setup(priv);
diff --git a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
index 05c1c1dd7751..cebfe3bd086e 100644
--- a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
+++ b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
@@ -325,7 +325,7 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf,
                 return PTR_ERR(kern_buf);
 
         rc = sscanf(kern_buf, "%x:%x", &addr, &len);
-        if (rc < 2) {
+        if (rc < 2 || len > UINT_MAX >> 2) {
                 netdev_warn(bnad->netdev, "failed to read user buffer\n");
                 kfree(kern_buf);
                 return -EINVAL;
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
index be9c0e3f5ade..92f46b1375c3 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
@@ -152,7 +152,7 @@ struct octnic_gather {
          */
         struct octeon_sg_entry *sg;
 
-        u64 sg_dma_ptr;
+        dma_addr_t sg_dma_ptr;
 };
 
 struct handshake {
@@ -734,6 +734,9 @@ static void delete_glists(struct lio *lio)
         struct octnic_gather *g;
         int i;
 
+        kfree(lio->glist_lock);
+        lio->glist_lock = NULL;
+
         if (!lio->glist)
                 return;
 
@@ -741,23 +744,26 @@ static void delete_glists(struct lio *lio)
                 do {
                         g = (struct octnic_gather *)
                                 list_delete_head(&lio->glist[i]);
-                        if (g) {
-                                if (g->sg) {
-                                        dma_unmap_single(&lio->oct_dev->
-                                                         pci_dev->dev,
-                                                         g->sg_dma_ptr,
-                                                         g->sg_size,
-                                                         DMA_TO_DEVICE);
-                                        kfree((void *)((unsigned long)g->sg -
-                                                       g->adjust));
-                                }
+                        if (g)
                                 kfree(g);
-                        }
                 } while (g);
+
+                if (lio->glists_virt_base && lio->glists_virt_base[i]) {
+                        lio_dma_free(lio->oct_dev,
+                                     lio->glist_entry_size * lio->tx_qsize,
+                                     lio->glists_virt_base[i],
+                                     lio->glists_dma_base[i]);
+                }
         }
 
-        kfree((void *)lio->glist);
-        kfree((void *)lio->glist_lock);
+        kfree(lio->glists_virt_base);
+        lio->glists_virt_base = NULL;
+
+        kfree(lio->glists_dma_base);
+        lio->glists_dma_base = NULL;
+
+        kfree(lio->glist);
+        lio->glist = NULL;
 }
 
 /**
@@ -772,13 +778,30 @@ static int setup_glists(struct octeon_device *oct, struct lio *lio, int num_iqs)
         lio->glist_lock = kcalloc(num_iqs, sizeof(*lio->glist_lock),
                                   GFP_KERNEL);
         if (!lio->glist_lock)
-                return 1;
+                return -ENOMEM;
 
         lio->glist = kcalloc(num_iqs, sizeof(*lio->glist),
                              GFP_KERNEL);
         if (!lio->glist) {
-                kfree((void *)lio->glist_lock);
-                return 1;
+                kfree(lio->glist_lock);
+                lio->glist_lock = NULL;
+                return -ENOMEM;
+        }
+
+        lio->glist_entry_size =
+                ROUNDUP8((ROUNDUP4(OCTNIC_MAX_SG) >> 2) * OCT_SG_ENTRY_SIZE);
+
+        /* allocate memory to store virtual and dma base address of
+         * per glist consistent memory
+         */
+        lio->glists_virt_base = kcalloc(num_iqs, sizeof(*lio->glists_virt_base),
+                                        GFP_KERNEL);
+        lio->glists_dma_base = kcalloc(num_iqs, sizeof(*lio->glists_dma_base),
+                                       GFP_KERNEL);
+
+        if (!lio->glists_virt_base || !lio->glists_dma_base) {
+                delete_glists(lio);
+                return -ENOMEM;
         }
 
         for (i = 0; i < num_iqs; i++) {
@@ -788,6 +811,16 @@ static int setup_glists(struct octeon_device *oct, struct lio *lio, int num_iqs)
 
                 INIT_LIST_HEAD(&lio->glist[i]);
 
+                lio->glists_virt_base[i] =
+                        lio_dma_alloc(oct,
+                                      lio->glist_entry_size * lio->tx_qsize,
+                                      &lio->glists_dma_base[i]);
+
+                if (!lio->glists_virt_base[i]) {
+                        delete_glists(lio);
+                        return -ENOMEM;
+                }
+
                 for (j = 0; j < lio->tx_qsize; j++) {
                         g = kzalloc_node(sizeof(*g), GFP_KERNEL,
                                          numa_node);
@@ -796,43 +829,18 @@ static int setup_glists(struct octeon_device *oct, struct lio *lio, int num_iqs)
                         if (!g)
                                 break;
 
-                        g->sg_size = ((ROUNDUP4(OCTNIC_MAX_SG) >> 2) *
-                                      OCT_SG_ENTRY_SIZE);
+                        g->sg = lio->glists_virt_base[i] +
+                                (j * lio->glist_entry_size);
 
-                        g->sg = kmalloc_node(g->sg_size + 8,
-                                             GFP_KERNEL, numa_node);
-                        if (!g->sg)
-                                g->sg = kmalloc(g->sg_size + 8, GFP_KERNEL);
-                        if (!g->sg) {
-                                kfree(g);
-                                break;
-                        }
-
-                        /* The gather component should be aligned on 64-bit
-                         * boundary
-                         */
-                        if (((unsigned long)g->sg) & 7) {
-                                g->adjust = 8 - (((unsigned long)g->sg) & 7);
-                                g->sg = (struct octeon_sg_entry *)
-                                        ((unsigned long)g->sg + g->adjust);
-                        }
-                        g->sg_dma_ptr = dma_map_single(&oct->pci_dev->dev,
-                                                       g->sg, g->sg_size,
-                                                       DMA_TO_DEVICE);
-                        if (dma_mapping_error(&oct->pci_dev->dev,
-                                              g->sg_dma_ptr)) {
-                                kfree((void *)((unsigned long)g->sg -
-                                               g->adjust));
-                                kfree(g);
-                                break;
-                        }
+                        g->sg_dma_ptr = lio->glists_dma_base[i] +
+                                        (j * lio->glist_entry_size);
 
                         list_add_tail(&g->list, &lio->glist[i]);
                 }
 
                 if (j != lio->tx_qsize) {
                         delete_glists(lio);
-                        return 1;
+                        return -ENOMEM;
                 }
         }
 
@@ -1885,9 +1893,6 @@ static void free_netsgbuf(void *buf)
                 i++;
         }
 
-        dma_sync_single_for_cpu(&lio->oct_dev->pci_dev->dev,
-                                g->sg_dma_ptr, g->sg_size, DMA_TO_DEVICE);
-
         iq = skb_iq(lio, skb);
         spin_lock(&lio->glist_lock[iq]);
         list_add_tail(&g->list, &lio->glist[iq]);
@@ -1933,9 +1938,6 @@ static void free_netsgbuf_with_resp(void *buf)
                 i++;
         }
 
-        dma_sync_single_for_cpu(&lio->oct_dev->pci_dev->dev,
-                                g->sg_dma_ptr, g->sg_size, DMA_TO_DEVICE);
-
         iq = skb_iq(lio, skb);
 
         spin_lock(&lio->glist_lock[iq]);
@@ -3273,8 +3275,6 @@ static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
                         i++;
                 }
 
-                dma_sync_single_for_device(&oct->pci_dev->dev, g->sg_dma_ptr,
-                                           g->sg_size, DMA_TO_DEVICE);
                 dptr = g->sg_dma_ptr;
 
                 if (OCTEON_CN23XX_PF(oct))
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
index 9d5e03502c76..7b83be4ce1fe 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
@@ -108,6 +108,8 @@ struct octnic_gather {
          * received from the IP layer.
          */
         struct octeon_sg_entry *sg;
+
+        dma_addr_t sg_dma_ptr;
 };
 
 struct octeon_device_priv {
@@ -490,6 +492,9 @@ static void delete_glists(struct lio *lio)
         struct octnic_gather *g;
         int i;
 
+        kfree(lio->glist_lock);
+        lio->glist_lock = NULL;
+
         if (!lio->glist)
                 return;
 
@@ -497,17 +502,26 @@ static void delete_glists(struct lio *lio)
                 do {
                         g = (struct octnic_gather *)
                             list_delete_head(&lio->glist[i]);
-                        if (g) {
-                                if (g->sg)
-                                        kfree((void *)((unsigned long)g->sg -
-                                                        g->adjust));
+                        if (g)
                                 kfree(g);
-                        }
                 } while (g);
+
+                if (lio->glists_virt_base && lio->glists_virt_base[i]) {
+                        lio_dma_free(lio->oct_dev,
+                                     lio->glist_entry_size * lio->tx_qsize,
+                                     lio->glists_virt_base[i],
+                                     lio->glists_dma_base[i]);
+                }
         }
 
+        kfree(lio->glists_virt_base);
+        lio->glists_virt_base = NULL;
+
+        kfree(lio->glists_dma_base);
+        lio->glists_dma_base = NULL;
+
         kfree(lio->glist);
-        kfree(lio->glist_lock);
+        lio->glist = NULL;
 }
 
 /**
@@ -522,13 +536,30 @@ static int setup_glists(struct lio *lio, int num_iqs)
         lio->glist_lock =
             kzalloc(sizeof(*lio->glist_lock) * num_iqs, GFP_KERNEL);
         if (!lio->glist_lock)
-                return 1;
+                return -ENOMEM;
 
         lio->glist =
             kzalloc(sizeof(*lio->glist) * num_iqs, GFP_KERNEL);
         if (!lio->glist) {
                 kfree(lio->glist_lock);
-                return 1;
+                lio->glist_lock = NULL;
+                return -ENOMEM;
+        }
+
+        lio->glist_entry_size =
+                ROUNDUP8((ROUNDUP4(OCTNIC_MAX_SG) >> 2) * OCT_SG_ENTRY_SIZE);
+
+        /* allocate memory to store virtual and dma base address of
+         * per glist consistent memory
+         */
+        lio->glists_virt_base = kcalloc(num_iqs, sizeof(*lio->glists_virt_base),
+                                        GFP_KERNEL);
+        lio->glists_dma_base = kcalloc(num_iqs, sizeof(*lio->glists_dma_base),
+                                       GFP_KERNEL);
+
+        if (!lio->glists_virt_base || !lio->glists_dma_base) {
+                delete_glists(lio);
+                return -ENOMEM;
         }
 
         for (i = 0; i < num_iqs; i++) {
@@ -536,34 +567,33 @@ static int setup_glists(struct lio *lio, int num_iqs)
 
                 INIT_LIST_HEAD(&lio->glist[i]);
 
+                lio->glists_virt_base[i] =
+                        lio_dma_alloc(lio->oct_dev,
+                                      lio->glist_entry_size * lio->tx_qsize,
+                                      &lio->glists_dma_base[i]);
+
+                if (!lio->glists_virt_base[i]) {
+                        delete_glists(lio);
+                        return -ENOMEM;
+                }
+
                 for (j = 0; j < lio->tx_qsize; j++) {
                         g = kzalloc(sizeof(*g), GFP_KERNEL);
                         if (!g)
                                 break;
 
-                        g->sg_size = ((ROUNDUP4(OCTNIC_MAX_SG) >> 2) *
-                                      OCT_SG_ENTRY_SIZE);
+                        g->sg = lio->glists_virt_base[i] +
+                                (j * lio->glist_entry_size);
 
-                        g->sg = kmalloc(g->sg_size + 8, GFP_KERNEL);
-                        if (!g->sg) {
-                                kfree(g);
-                                break;
-                        }
+                        g->sg_dma_ptr = lio->glists_dma_base[i] +
+                                        (j * lio->glist_entry_size);
 
-                        /* The gather component should be aligned on 64-bit
-                         * boundary
-                         */
-                        if (((unsigned long)g->sg) & 7) {
-                                g->adjust = 8 - (((unsigned long)g->sg) & 7);
-                                g->sg = (struct octeon_sg_entry *)
-                                        ((unsigned long)g->sg + g->adjust);
-                        }
                         list_add_tail(&g->list, &lio->glist[i]);
                 }
 
                 if (j != lio->tx_qsize) {
                         delete_glists(lio);
-                        return 1;
+                        return -ENOMEM;
                 }
         }
 
@@ -1324,10 +1354,6 @@ static void free_netsgbuf(void *buf)
                 i++;
         }
 
-        dma_unmap_single(&lio->oct_dev->pci_dev->dev,
-                         finfo->dptr, g->sg_size,
-                         DMA_TO_DEVICE);
-
         iq = skb_iq(lio, skb);
 
         spin_lock(&lio->glist_lock[iq]);
@@ -1374,10 +1400,6 @@ static void free_netsgbuf_with_resp(void *buf)
                 i++;
         }
 
-        dma_unmap_single(&lio->oct_dev->pci_dev->dev,
-                         finfo->dptr, g->sg_size,
-                         DMA_TO_DEVICE);
-
         iq = skb_iq(lio, skb);
 
         spin_lock(&lio->glist_lock[iq]);
@@ -2382,23 +2404,7 @@ static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
                         i++;
                 }
 
-                dptr = dma_map_single(&oct->pci_dev->dev,
-                                      g->sg, g->sg_size,
-                                      DMA_TO_DEVICE);
-                if (dma_mapping_error(&oct->pci_dev->dev, dptr)) {
-                        dev_err(&oct->pci_dev->dev, "%s DMA mapping error 4\n",
-                                __func__);
-                        dma_unmap_single(&oct->pci_dev->dev, g->sg[0].ptr[0],
-                                         skb->len - skb->data_len,
-                                         DMA_TO_DEVICE);
-                        for (j = 1; j <= frags; j++) {
-                                frag = &skb_shinfo(skb)->frags[j - 1];
-                                dma_unmap_page(&oct->pci_dev->dev,
-                                               g->sg[j >> 2].ptr[j & 3],
-                                               frag->size, DMA_TO_DEVICE);
-                        }
-                        return NETDEV_TX_BUSY;
-                }
+                dptr = g->sg_dma_ptr;
 
                 ndata.cmd.cmd3.dptr = dptr;
                 finfo->dptr = dptr;
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_config.h b/drivers/net/ethernet/cavium/liquidio/octeon_config.h
index b3dc2e9651a8..d29ebc531151 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_config.h
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_config.h
@@ -71,17 +71,17 @@
 #define   CN23XX_MAX_RINGS_PER_VF          8
 
 #define   CN23XX_MAX_INPUT_QUEUES       CN23XX_MAX_RINGS_PER_PF
-#define   CN23XX_MAX_IQ_DESCRIPTORS     2048
+#define   CN23XX_MAX_IQ_DESCRIPTORS     512
 #define   CN23XX_DB_MIN                 1
 #define   CN23XX_DB_MAX                 8
 #define   CN23XX_DB_TIMEOUT             1
 
 #define   CN23XX_MAX_OUTPUT_QUEUES      CN23XX_MAX_RINGS_PER_PF
-#define   CN23XX_MAX_OQ_DESCRIPTORS     2048
+#define   CN23XX_MAX_OQ_DESCRIPTORS     512
 #define   CN23XX_OQ_BUF_SIZE            1536
 #define   CN23XX_OQ_PKTSPER_INTR        128
 /*#define CAVIUM_ONLY_CN23XX_RX_PERF*/
-#define   CN23XX_OQ_REFIL_THRESHOLD     128
+#define   CN23XX_OQ_REFIL_THRESHOLD     16
 
 #define   CN23XX_OQ_INTR_PKT            64
 #define   CN23XX_OQ_INTR_TIME           100
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_droq.c b/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
index 0be87d119a97..79f809479af6 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
@@ -155,11 +155,6 @@ octeon_droq_destroy_ring_buffers(struct octeon_device *oct,
                         recv_buffer_destroy(droq->recv_buf_list[i].buffer,
                                             pg_info);
 
-                if (droq->desc_ring && droq->desc_ring[i].info_ptr)
-                        lio_unmap_ring_info(oct->pci_dev,
-                                            (u64)droq->
-                                            desc_ring[i].info_ptr,
-                                            OCT_DROQ_INFO_SIZE);
                 droq->recv_buf_list[i].buffer = NULL;
         }
 
@@ -211,10 +206,7 @@ int octeon_delete_droq(struct octeon_device *oct, u32 q_no)
         vfree(droq->recv_buf_list);
 
         if (droq->info_base_addr)
-                cnnic_free_aligned_dma(oct->pci_dev, droq->info_list,
-                                       droq->info_alloc_size,
-                                       droq->info_base_addr,
-                                       droq->info_list_dma);
+                lio_free_info_buffer(oct, droq);
 
         if (droq->desc_ring)
                 lio_dma_free(oct, (droq->max_count * OCT_DROQ_DESC_SIZE),
@@ -294,12 +286,7 @@ int octeon_init_droq(struct octeon_device *oct,
         dev_dbg(&oct->pci_dev->dev, "droq[%d]: num_desc: %d\n", q_no,
                 droq->max_count);
 
-        droq->info_list =
-                cnnic_numa_alloc_aligned_dma((droq->max_count *
-                                              OCT_DROQ_INFO_SIZE),
-                                             &droq->info_alloc_size,
-                                             &droq->info_base_addr,
-                                             numa_node);
+        droq->info_list = lio_alloc_info_buffer(oct, droq);
         if (!droq->info_list) {
                 dev_err(&oct->pci_dev->dev, "Cannot allocate memory for info list.\n");
                 lio_dma_free(oct, (droq->max_count * OCT_DROQ_DESC_SIZE),
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_droq.h b/drivers/net/ethernet/cavium/liquidio/octeon_droq.h
index e62074090681..6982c0af5ecc 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_droq.h
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_droq.h
@@ -325,10 +325,10 @@ struct octeon_droq {
         size_t desc_ring_dma;
 
         /** Info ptr list are allocated at this virtual address. */
-        size_t info_base_addr;
+        void *info_base_addr;
 
         /** DMA mapped address of the info list */
-        size_t info_list_dma;
+        dma_addr_t info_list_dma;
 
         /** Allocated size of info list. */
         u32 info_alloc_size;
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_main.h b/drivers/net/ethernet/cavium/liquidio/octeon_main.h
index aa36e9ae7676..bed9ef17bc26 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_main.h
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_main.h
@@ -140,48 +140,6 @@ err_release_region:
         return 1;
 }
 
-static inline void *
-cnnic_numa_alloc_aligned_dma(u32 size,
-                             u32 *alloc_size,
-                             size_t *orig_ptr,
-                             int numa_node)
-{
-        int retries = 0;
-        void *ptr = NULL;
-
-#define OCTEON_MAX_ALLOC_RETRIES     1
-        do {
-                struct page *page = NULL;
-
-                page = alloc_pages_node(numa_node,
-                                        GFP_KERNEL,
-                                        get_order(size));
-                if (!page)
-                        page = alloc_pages(GFP_KERNEL,
-                                           get_order(size));
-                ptr = (void *)page_address(page);
-                if ((unsigned long)ptr & 0x07) {
-                        __free_pages(page, get_order(size));
-                        ptr = NULL;
-                        /* Increment the size required if the first
-                         * attempt failed.
-                         */
-                        if (!retries)
-                                size += 7;
-                }
-                retries++;
-        } while ((retries <= OCTEON_MAX_ALLOC_RETRIES) && !ptr);
-
-        *alloc_size = size;
-        *orig_ptr = (unsigned long)ptr;
-        if ((unsigned long)ptr & 0x07)
-                ptr = (void *)(((unsigned long)ptr + 7) & ~(7UL));
-        return ptr;
-}
-
-#define cnnic_free_aligned_dma(pci_dev, ptr, size, orig_ptr, dma_addr) \
-                free_pages(orig_ptr, get_order(size))
-
 static inline int
 sleep_cond(wait_queue_head_t *wait_queue, int *condition)
 {
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_network.h b/drivers/net/ethernet/cavium/liquidio/octeon_network.h
index 6bb89419006e..eef2a1e8a7e3 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_network.h
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_network.h
@@ -62,6 +62,9 @@ struct lio {
 
         /** Array of gather component linked lists */
         struct list_head *glist;
+        void **glists_virt_base;
+        dma_addr_t *glists_dma_base;
+        u32 glist_entry_size;
 
         /** Pointer to the NIC properties for the Octeon device this network
          *  interface is associated with.
@@ -344,6 +347,29 @@ static inline void tx_buffer_free(void *buffer)
 #define lio_dma_free(oct, size, virt_addr, dma_addr) \
         dma_free_coherent(&(oct)->pci_dev->dev, size, virt_addr, dma_addr)
 
+static inline void *
+lio_alloc_info_buffer(struct octeon_device *oct,
+                      struct octeon_droq *droq)
+{
+        void *virt_ptr;
+
+        virt_ptr = lio_dma_alloc(oct, (droq->max_count * OCT_DROQ_INFO_SIZE),
+                                 &droq->info_list_dma);
+        if (virt_ptr) {
+                droq->info_alloc_size = droq->max_count * OCT_DROQ_INFO_SIZE;
+                droq->info_base_addr = virt_ptr;
+        }
+
+        return virt_ptr;
+}
+
+static inline void lio_free_info_buffer(struct octeon_device *oct,
+                                        struct octeon_droq *droq)
+{
+        lio_dma_free(oct, droq->info_alloc_size, droq->info_base_addr,
+                     droq->info_list_dma);
+}
+
 static inline
 void *get_rbd(struct sk_buff *skb)
 {
@@ -359,22 +385,7 @@ void *get_rbd(struct sk_buff *skb)
 static inline u64
 lio_map_ring_info(struct octeon_droq *droq, u32 i)
 {
-        dma_addr_t dma_addr;
-        struct octeon_device *oct = droq->oct_dev;
-
-        dma_addr = dma_map_single(&oct->pci_dev->dev, &droq->info_list[i],
-                                  OCT_DROQ_INFO_SIZE, DMA_FROM_DEVICE);
-
-        WARN_ON(dma_mapping_error(&oct->pci_dev->dev, dma_addr));
-
-        return (u64)dma_addr;
-}
-
-static inline void
-lio_unmap_ring_info(struct pci_dev *pci_dev,
-                    u64 info_ptr, u32 size)
-{
-        dma_unmap_single(&pci_dev->dev, info_ptr, size, DMA_FROM_DEVICE);
+        return droq->info_list_dma + (i * sizeof(struct octeon_droq_info));
 }
 
 static inline u64
diff --git a/drivers/net/ethernet/cavium/thunder/nic.h b/drivers/net/ethernet/cavium/thunder/nic.h
index e739c7153562..2269ff562d95 100644
--- a/drivers/net/ethernet/cavium/thunder/nic.h
+++ b/drivers/net/ethernet/cavium/thunder/nic.h
@@ -269,6 +269,7 @@ struct nicvf {
 #define MAX_QUEUES_PER_QSET                     8
         struct queue_set        *qs;
         struct nicvf_cq_poll    *napi[8];
+        void                    *iommu_domain;
         u8                      vf_id;
         u8                      sqs_id;
         bool                    sqs_mode;
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 6feaa24bcfd4..24017588f531 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -16,6 +16,7 @@
 #include <linux/log2.h>
 #include <linux/prefetch.h>
 #include <linux/irq.h>
+#include <linux/iommu.h>
 
 #include "nic_reg.h"
 #include "nic.h"
@@ -525,7 +526,12 @@ static void nicvf_snd_pkt_handler(struct net_device *netdev,
                         /* Get actual TSO descriptors and free them */
                         tso_sqe =
                          (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, hdr->rsvd2);
+                        nicvf_unmap_sndq_buffers(nic, sq, hdr->rsvd2,
+                                                 tso_sqe->subdesc_cnt);
                         nicvf_put_sq_desc(sq, tso_sqe->subdesc_cnt + 1);
+                } else {
+                        nicvf_unmap_sndq_buffers(nic, sq, cqe_tx->sqe_ptr,
+                                                 hdr->subdesc_cnt);
                 }
                 nicvf_put_sq_desc(sq, hdr->subdesc_cnt + 1);
                 prefetch(skb);
@@ -576,6 +582,7 @@ static void nicvf_rcv_pkt_handler(struct net_device *netdev,
 {
         struct sk_buff *skb;
         struct nicvf *nic = netdev_priv(netdev);
+        struct nicvf *snic = nic;
         int err = 0;
         int rq_idx;
 
@@ -592,7 +599,7 @@ static void nicvf_rcv_pkt_handler(struct net_device *netdev,
         if (err && !cqe_rx->rb_cnt)
                 return;
 
-        skb = nicvf_get_rcv_skb(nic, cqe_rx);
+        skb = nicvf_get_rcv_skb(snic, cqe_rx);
         if (!skb) {
                 netdev_dbg(nic->netdev, "Packet not received\n");
                 return;
@@ -1643,6 +1650,9 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!pass1_silicon(nic->pdev))
                 nic->hw_tso = true;
 
+        /* Get iommu domain for iova to physical addr conversion */
+        nic->iommu_domain = iommu_get_domain_for_dev(dev);
+
         pci_read_config_word(nic->pdev, PCI_SUBSYSTEM_ID, &sdevid);
         if (sdevid == 0xA134)
                 nic->t88 = true;
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index ac0390be3b12..f13289f0d238 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -10,6 +10,7 @@
 #include <linux/netdevice.h>
 #include <linux/ip.h>
 #include <linux/etherdevice.h>
+#include <linux/iommu.h>
 #include <net/ip.h>
 #include <net/tso.h>
 
@@ -18,6 +19,16 @@
 #include "q_struct.h"
 #include "nicvf_queues.h"
 
+#define NICVF_PAGE_ORDER ((PAGE_SIZE <= 4096) ?  PAGE_ALLOC_COSTLY_ORDER : 0)
+
+static inline u64 nicvf_iova_to_phys(struct nicvf *nic, dma_addr_t dma_addr)
+{
+        /* Translation is installed only when IOMMU is present */
+        if (nic->iommu_domain)
+                return iommu_iova_to_phys(nic->iommu_domain, dma_addr);
+        return dma_addr;
+}
+
 static void nicvf_get_page(struct nicvf *nic)
 {
         if (!nic->rb_pageref || !nic->rb_page)
@@ -87,7 +98,7 @@ static void nicvf_free_q_desc_mem(struct nicvf *nic, struct q_desc_mem *dmem)
 static inline int nicvf_alloc_rcv_buffer(struct nicvf *nic, gfp_t gfp,
                                          u32 buf_len, u64 **rbuf)
 {
-        int order = (PAGE_SIZE <= 4096) ?  PAGE_ALLOC_COSTLY_ORDER : 0;
+        int order = NICVF_PAGE_ORDER;
 
         /* Check if request can be accomodated in previous allocated page */
         if (nic->rb_page &&
@@ -97,22 +108,27 @@ static inline int nicvf_alloc_rcv_buffer(struct nicvf *nic, gfp_t gfp,
         }
 
         nicvf_get_page(nic);
-        nic->rb_page = NULL;
 
         /* Allocate a new page */
+        nic->rb_page = alloc_pages(gfp | __GFP_COMP | __GFP_NOWARN,
+                                   order);
         if (!nic->rb_page) {
-                nic->rb_page = alloc_pages(gfp | __GFP_COMP | __GFP_NOWARN,
-                                           order);
-                if (!nic->rb_page) {
-                        this_cpu_inc(nic->pnicvf->drv_stats->
-                                     rcv_buffer_alloc_failures);
-                        return -ENOMEM;
-                }
-                nic->rb_page_offset = 0;
+                this_cpu_inc(nic->pnicvf->drv_stats->rcv_buffer_alloc_failures);
+                return -ENOMEM;
         }
-
+        nic->rb_page_offset = 0;
 ret:
-        *rbuf = (u64 *)((u64)page_address(nic->rb_page) + nic->rb_page_offset);
+        /* HW will ensure data coherency, CPU sync not required */
+        *rbuf = (u64 *)((u64)dma_map_page_attrs(&nic->pdev->dev, nic->rb_page,
+                                                nic->rb_page_offset, buf_len,
+                                                DMA_FROM_DEVICE,
+                                                DMA_ATTR_SKIP_CPU_SYNC));
+        if (dma_mapping_error(&nic->pdev->dev, (dma_addr_t)*rbuf)) {
+                if (!nic->rb_page_offset)
+                        __free_pages(nic->rb_page, order);
+                nic->rb_page = NULL;
+                return -ENOMEM;
+        }
         nic->rb_page_offset += buf_len;
 
         return 0;
@@ -158,16 +174,21 @@ static int  nicvf_init_rbdr(struct nicvf *nic, struct rbdr *rbdr,
         rbdr->dma_size = buf_size;
         rbdr->enable = true;
         rbdr->thresh = RBDR_THRESH;
+        rbdr->head = 0;
+        rbdr->tail = 0;
 
         nic->rb_page = NULL;
         for (idx = 0; idx < ring_len; idx++) {
                 err = nicvf_alloc_rcv_buffer(nic, GFP_KERNEL, RCV_FRAG_LEN,
                                              &rbuf);
-                if (err)
+                if (err) {
+                        /* To free already allocated and mapped ones */
+                        rbdr->tail = idx - 1;
                         return err;
+                }
 
                 desc = GET_RBDR_DESC(rbdr, idx);
-                desc->buf_addr = virt_to_phys(rbuf) >> NICVF_RCV_BUF_ALIGN;
+                desc->buf_addr = (u64)rbuf >> NICVF_RCV_BUF_ALIGN;
         }
 
         nicvf_get_page(nic);
@@ -179,7 +200,7 @@ static int  nicvf_init_rbdr(struct nicvf *nic, struct rbdr *rbdr,
 static void nicvf_free_rbdr(struct nicvf *nic, struct rbdr *rbdr)
 {
         int head, tail;
-        u64 buf_addr;
+        u64 buf_addr, phys_addr;
         struct rbdr_entry_t *desc;
 
         if (!rbdr)
@@ -192,18 +213,26 @@ static void nicvf_free_rbdr(struct nicvf *nic, struct rbdr *rbdr)
         head = rbdr->head;
         tail = rbdr->tail;
 
-        /* Free SKBs */
+        /* Release page references */
         while (head != tail) {
                 desc = GET_RBDR_DESC(rbdr, head);
-                buf_addr = desc->buf_addr << NICVF_RCV_BUF_ALIGN;
-                put_page(virt_to_page(phys_to_virt(buf_addr)));
+                buf_addr = ((u64)desc->buf_addr) << NICVF_RCV_BUF_ALIGN;
+                phys_addr = nicvf_iova_to_phys(nic, buf_addr);
+                dma_unmap_page_attrs(&nic->pdev->dev, buf_addr, RCV_FRAG_LEN,
+                                     DMA_FROM_DEVICE, DMA_ATTR_SKIP_CPU_SYNC);
+                if (phys_addr)
+                        put_page(virt_to_page(phys_to_virt(phys_addr)));
                 head++;
                 head &= (rbdr->dmem.q_len - 1);
         }
-        /* Free SKB of tail desc */
+        /* Release buffer of tail desc */
         desc = GET_RBDR_DESC(rbdr, tail);
-        buf_addr = desc->buf_addr << NICVF_RCV_BUF_ALIGN;
-        put_page(virt_to_page(phys_to_virt(buf_addr)));
+        buf_addr = ((u64)desc->buf_addr) << NICVF_RCV_BUF_ALIGN;
+        phys_addr = nicvf_iova_to_phys(nic, buf_addr);
+        dma_unmap_page_attrs(&nic->pdev->dev, buf_addr, RCV_FRAG_LEN,
+                             DMA_FROM_DEVICE, DMA_ATTR_SKIP_CPU_SYNC);
+        if (phys_addr)
+                put_page(virt_to_page(phys_to_virt(phys_addr)));
 
         /* Free RBDR ring */
         nicvf_free_q_desc_mem(nic, &rbdr->dmem);
@@ -250,7 +279,7 @@ refill:
                         break;
 
                 desc = GET_RBDR_DESC(rbdr, tail);
-                desc->buf_addr = virt_to_phys(rbuf) >> NICVF_RCV_BUF_ALIGN;
+                desc->buf_addr = (u64)rbuf >> NICVF_RCV_BUF_ALIGN;
                 refill_rb_cnt--;
                 new_rb++;
         }
@@ -361,9 +390,29 @@ static int nicvf_init_snd_queue(struct nicvf *nic,
         return 0;
 }
 
+void nicvf_unmap_sndq_buffers(struct nicvf *nic, struct snd_queue *sq,
+                              int hdr_sqe, u8 subdesc_cnt)
+{
+        u8 idx;
+        struct sq_gather_subdesc *gather;
+
+        /* Unmap DMA mapped skb data buffers */
+        for (idx = 0; idx < subdesc_cnt; idx++) {
+                hdr_sqe++;
+                hdr_sqe &= (sq->dmem.q_len - 1);
+                gather = (struct sq_gather_subdesc *)GET_SQ_DESC(sq, hdr_sqe);
+                /* HW will ensure data coherency, CPU sync not required */
+                dma_unmap_page_attrs(&nic->pdev->dev, gather->addr,
+                                     gather->size, DMA_TO_DEVICE,
+                                     DMA_ATTR_SKIP_CPU_SYNC);
+        }
+}
+
 static void nicvf_free_snd_queue(struct nicvf *nic, struct snd_queue *sq)
 {
         struct sk_buff *skb;
+        struct sq_hdr_subdesc *hdr;
+        struct sq_hdr_subdesc *tso_sqe;
 
         if (!sq)
                 return;
@@ -379,8 +428,22 @@ static void nicvf_free_snd_queue(struct nicvf *nic, struct snd_queue *sq)
         smp_rmb();
         while (sq->head != sq->tail) {
                 skb = (struct sk_buff *)sq->skbuff[sq->head];
-                if (skb)
-                        dev_kfree_skb_any(skb);
+                if (!skb)
+                        goto next;
+                hdr = (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, sq->head);
+                /* Check for dummy descriptor used for HW TSO offload on 88xx */
+                if (hdr->dont_send) {
+                        /* Get actual TSO descriptors and unmap them */
+                        tso_sqe =
+                         (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, hdr->rsvd2);
+                        nicvf_unmap_sndq_buffers(nic, sq, hdr->rsvd2,
+                                                 tso_sqe->subdesc_cnt);
+                } else {
+                        nicvf_unmap_sndq_buffers(nic, sq, sq->head,
+                                                 hdr->subdesc_cnt);
+                }
+                dev_kfree_skb_any(skb);
+next:
                 sq->head++;
                 sq->head &= (sq->dmem.q_len - 1);
         }
@@ -559,9 +622,11 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs,
         nicvf_send_msg_to_pf(nic, &mbx);
 
         if (!nic->sqs_mode && (qidx == 0)) {
-                /* Enable checking L3/L4 length and TCP/UDP checksums */
+                /* Enable checking L3/L4 length and TCP/UDP checksums
+                 * Also allow IPv6 pkts with zero UDP checksum.
+                 */
                 nicvf_queue_reg_write(nic, NIC_QSET_RQ_GEN_CFG, 0,
-                                      (BIT(24) | BIT(23) | BIT(21)));
+                                      (BIT(24) | BIT(23) | BIT(21) | BIT(20)));
                 nicvf_config_vlan_stripping(nic, nic->netdev->features);
         }
 
@@ -882,6 +947,14 @@ static inline int nicvf_get_sq_desc(struct snd_queue *sq, int desc_cnt)
         return qentry;
 }
 
+/* Rollback to previous tail pointer when descriptors not used */
+static inline void nicvf_rollback_sq_desc(struct snd_queue *sq,
+                                          int qentry, int desc_cnt)
+{
+        sq->tail = qentry;
+        atomic_add(desc_cnt, &sq->free_cnt);
+}
+
 /* Free descriptor back to SQ for future use */
 void nicvf_put_sq_desc(struct snd_queue *sq, int desc_cnt)
 {
@@ -1207,8 +1280,9 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct snd_queue *sq,
                         struct sk_buff *skb, u8 sq_num)
 {
         int i, size;
-        int subdesc_cnt, tso_sqe = 0;
+        int subdesc_cnt, hdr_sqe = 0;
         int qentry;
+        u64 dma_addr;
 
         subdesc_cnt = nicvf_sq_subdesc_required(nic, skb);
         if (subdesc_cnt > atomic_read(&sq->free_cnt))
@@ -1223,12 +1297,21 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct snd_queue *sq,
         /* Add SQ header subdesc */
         nicvf_sq_add_hdr_subdesc(nic, sq, qentry, subdesc_cnt - 1,
                                  skb, skb->len);
-        tso_sqe = qentry;
+        hdr_sqe = qentry;
 
         /* Add SQ gather subdescs */
         qentry = nicvf_get_nxt_sqentry(sq, qentry);
         size = skb_is_nonlinear(skb) ? skb_headlen(skb) : skb->len;
-        nicvf_sq_add_gather_subdesc(sq, qentry, size, virt_to_phys(skb->data));
+        /* HW will ensure data coherency, CPU sync not required */
+        dma_addr = dma_map_page_attrs(&nic->pdev->dev, virt_to_page(skb->data),
+                                      offset_in_page(skb->data), size,
+                                      DMA_TO_DEVICE, DMA_ATTR_SKIP_CPU_SYNC);
+        if (dma_mapping_error(&nic->pdev->dev, dma_addr)) {
+                nicvf_rollback_sq_desc(sq, qentry, subdesc_cnt);
+                return 0;
+        }
+
+        nicvf_sq_add_gather_subdesc(sq, qentry, size, dma_addr);
 
         /* Check for scattered buffer */
         if (!skb_is_nonlinear(skb))
@@ -1241,15 +1324,26 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct snd_queue *sq,
 
                 qentry = nicvf_get_nxt_sqentry(sq, qentry);
                 size = skb_frag_size(frag);
-                nicvf_sq_add_gather_subdesc(sq, qentry, size,
-                                            virt_to_phys(
-                                            skb_frag_address(frag)));
+                dma_addr = dma_map_page_attrs(&nic->pdev->dev,
+                                              skb_frag_page(frag),
+                                              frag->page_offset, size,
+                                              DMA_TO_DEVICE,
+                                              DMA_ATTR_SKIP_CPU_SYNC);
+                if (dma_mapping_error(&nic->pdev->dev, dma_addr)) {
+                        /* Free entire chain of mapped buffers
+                         * here 'i' = frags mapped + above mapped skb->data
+                         */
+                        nicvf_unmap_sndq_buffers(nic, sq, hdr_sqe, i);
+                        nicvf_rollback_sq_desc(sq, qentry, subdesc_cnt);
+                        return 0;
+                }
+                nicvf_sq_add_gather_subdesc(sq, qentry, size, dma_addr);
         }
 
 doorbell:
         if (nic->t88 && skb_shinfo(skb)->gso_size) {
                 qentry = nicvf_get_nxt_sqentry(sq, qentry);
-                nicvf_sq_add_cqe_subdesc(sq, qentry, tso_sqe, skb);
+                nicvf_sq_add_cqe_subdesc(sq, qentry, hdr_sqe, skb);
         }
 
         nicvf_sq_doorbell(nic, skb, sq_num, subdesc_cnt);
@@ -1282,6 +1376,7 @@ struct sk_buff *nicvf_get_rcv_skb(struct nicvf *nic, struct cqe_rx_t *cqe_rx)
         int offset;
         u16 *rb_lens = NULL;
         u64 *rb_ptrs = NULL;
+        u64 phys_addr;
 
         rb_lens = (void *)cqe_rx + (3 * sizeof(u64));
         /* Except 88xx pass1 on all other chips CQE_RX2_S is added to
@@ -1296,15 +1391,23 @@ struct sk_buff *nicvf_get_rcv_skb(struct nicvf *nic, struct cqe_rx_t *cqe_rx)
         else
                 rb_ptrs = (void *)cqe_rx + (7 * sizeof(u64));
 
-        netdev_dbg(nic->netdev, "%s rb_cnt %d rb0_ptr %llx rb0_sz %d\n",
-                   __func__, cqe_rx->rb_cnt, cqe_rx->rb0_ptr, cqe_rx->rb0_sz);
-
         for (frag = 0; frag < cqe_rx->rb_cnt; frag++) {
                 payload_len = rb_lens[frag_num(frag)];
+                phys_addr = nicvf_iova_to_phys(nic, *rb_ptrs);
+                if (!phys_addr) {
+                        if (skb)
+                                dev_kfree_skb_any(skb);
+                        return NULL;
+                }
+
                 if (!frag) {
                         /* First fragment */
+                        dma_unmap_page_attrs(&nic->pdev->dev,
+                                             *rb_ptrs - cqe_rx->align_pad,
+                                             RCV_FRAG_LEN, DMA_FROM_DEVICE,
+                                             DMA_ATTR_SKIP_CPU_SYNC);
                         skb = nicvf_rb_ptr_to_skb(nic,
-                                                  *rb_ptrs - cqe_rx->align_pad,
+                                                  phys_addr - cqe_rx->align_pad,
                                                   payload_len);
                         if (!skb)
                                 return NULL;
@@ -1312,8 +1415,11 @@ struct sk_buff *nicvf_get_rcv_skb(struct nicvf *nic, struct cqe_rx_t *cqe_rx)
                         skb_put(skb, payload_len);
                 } else {
                         /* Add fragments */
-                        page = virt_to_page(phys_to_virt(*rb_ptrs));
-                        offset = phys_to_virt(*rb_ptrs) - page_address(page);
+                        dma_unmap_page_attrs(&nic->pdev->dev, *rb_ptrs,
+                                             RCV_FRAG_LEN, DMA_FROM_DEVICE,
+                                             DMA_ATTR_SKIP_CPU_SYNC);
+                        page = virt_to_page(phys_to_virt(phys_addr));
+                        offset = phys_to_virt(phys_addr) - page_address(page);
                         skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
                                         offset, payload_len, RCV_FRAG_LEN);
                 }
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
index 5cb84da99a2d..10cb4b84625b 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
@@ -87,7 +87,7 @@
 #define RCV_BUF_COUNT           (1ULL << (RBDR_SIZE + 13))
 #define MAX_RCV_BUF_COUNT       (1ULL << (RBDR_SIZE6 + 13))
 #define RBDR_THRESH             (RCV_BUF_COUNT / 2)
-#define DMA_BUFFER_LEN          2048 /* In multiples of 128bytes */
+#define DMA_BUFFER_LEN          1536 /* In multiples of 128bytes */
 #define RCV_FRAG_LEN     (SKB_DATA_ALIGN(DMA_BUFFER_LEN + NET_SKB_PAD) + \
                          SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 
@@ -301,6 +301,8 @@ struct queue_set {
 
 #define CQ_ERR_MASK     (CQ_WR_FULL | CQ_WR_DISABLE | CQ_WR_FAULT)
 
+void nicvf_unmap_sndq_buffers(struct nicvf *nic, struct snd_queue *sq,
+                              int hdr_sqe, u8 subdesc_cnt);
 void nicvf_config_vlan_stripping(struct nicvf *nic,
                                  netdev_features_t features);
 int nicvf_set_qset_resources(struct nicvf *nic);
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index 4c8e8cf730bb..64a1095e4d14 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -123,14 +123,44 @@ static int bgx_poll_reg(struct bgx *bgx, u8 lmac, u64 reg, u64 mask, bool zero)
         return 1;
 }
 
+static int max_bgx_per_node;
+static void set_max_bgx_per_node(struct pci_dev *pdev)
+{
+        u16 sdevid;
+
+        if (max_bgx_per_node)
+                return;
+
+        pci_read_config_word(pdev, PCI_SUBSYSTEM_ID, &sdevid);
+        switch (sdevid) {
+        case PCI_SUBSYS_DEVID_81XX_BGX:
+                max_bgx_per_node = MAX_BGX_PER_CN81XX;
+                break;
+        case PCI_SUBSYS_DEVID_83XX_BGX:
+                max_bgx_per_node = MAX_BGX_PER_CN83XX;
+                break;
+        case PCI_SUBSYS_DEVID_88XX_BGX:
+        default:
+                max_bgx_per_node = MAX_BGX_PER_CN88XX;
+                break;
+        }
+}
+
+static struct bgx *get_bgx(int node, int bgx_idx)
+{
+        int idx = (node * max_bgx_per_node) + bgx_idx;
+
+        return bgx_vnic[idx];
+}
+
 /* Return number of BGX present in HW */
 unsigned bgx_get_map(int node)
 {
         int i;
         unsigned map = 0;
 
-        for (i = 0; i < MAX_BGX_PER_NODE; i++) {
-                if (bgx_vnic[(node * MAX_BGX_PER_NODE) + i])
+        for (i = 0; i < max_bgx_per_node; i++) {
+                if (bgx_vnic[(node * max_bgx_per_node) + i])
                         map |= (1 << i);
         }
 
@@ -143,7 +173,7 @@ int bgx_get_lmac_count(int node, int bgx_idx)
 {
         struct bgx *bgx;
 
-        bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        bgx = get_bgx(node, bgx_idx);
         if (bgx)
                 return bgx->lmac_count;
 
@@ -158,7 +188,7 @@ void bgx_get_lmac_link_state(int node, int bgx_idx, int lmacid, void *status)
         struct bgx *bgx;
         struct lmac *lmac;
 
-        bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        bgx = get_bgx(node, bgx_idx);
         if (!bgx)
                 return;
 
@@ -172,7 +202,7 @@ EXPORT_SYMBOL(bgx_get_lmac_link_state);
 
 const u8 *bgx_get_lmac_mac(int node, int bgx_idx, int lmacid)
 {
-        struct bgx *bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        struct bgx *bgx = get_bgx(node, bgx_idx);
 
         if (bgx)
                 return bgx->lmac[lmacid].mac;
@@ -183,7 +213,7 @@ EXPORT_SYMBOL(bgx_get_lmac_mac);
 
 void bgx_set_lmac_mac(int node, int bgx_idx, int lmacid, const u8 *mac)
 {
-        struct bgx *bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        struct bgx *bgx = get_bgx(node, bgx_idx);
 
         if (!bgx)
                 return;
@@ -194,7 +224,7 @@ EXPORT_SYMBOL(bgx_set_lmac_mac);
 
 void bgx_lmac_rx_tx_enable(int node, int bgx_idx, int lmacid, bool enable)
 {
-        struct bgx *bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        struct bgx *bgx = get_bgx(node, bgx_idx);
         struct lmac *lmac;
         u64 cfg;
 
@@ -217,7 +247,7 @@ EXPORT_SYMBOL(bgx_lmac_rx_tx_enable);
 void bgx_lmac_get_pfc(int node, int bgx_idx, int lmacid, void *pause)
 {
         struct pfc *pfc = (struct pfc *)pause;
-        struct bgx *bgx = bgx_vnic[(node * MAX_BGX_PER_CN88XX) + bgx_idx];
+        struct bgx *bgx = get_bgx(node, bgx_idx);
         struct lmac *lmac;
         u64 cfg;
 
@@ -237,7 +267,7 @@ EXPORT_SYMBOL(bgx_lmac_get_pfc);
 void bgx_lmac_set_pfc(int node, int bgx_idx, int lmacid, void *pause)
 {
         struct pfc *pfc = (struct pfc *)pause;
-        struct bgx *bgx = bgx_vnic[(node * MAX_BGX_PER_CN88XX) + bgx_idx];
+        struct bgx *bgx = get_bgx(node, bgx_idx);
         struct lmac *lmac;
         u64 cfg;
 
@@ -369,7 +399,7 @@ u64 bgx_get_rx_stats(int node, int bgx_idx, int lmac, int idx)
 {
         struct bgx *bgx;
 
-        bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        bgx = get_bgx(node, bgx_idx);
         if (!bgx)
                 return 0;
 
@@ -383,7 +413,7 @@ u64 bgx_get_tx_stats(int node, int bgx_idx, int lmac, int idx)
 {
         struct bgx *bgx;
 
-        bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        bgx = get_bgx(node, bgx_idx);
         if (!bgx)
                 return 0;
 
@@ -411,7 +441,7 @@ void bgx_lmac_internal_loopback(int node, int bgx_idx,
         struct lmac *lmac;
         u64    cfg;
 
-        bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        bgx = get_bgx(node, bgx_idx);
         if (!bgx)
                 return;
 
@@ -1011,12 +1041,6 @@ static void bgx_print_qlm_mode(struct bgx *bgx, u8 lmacid)
                         dev_info(dev, "%s: 40G_KR4\n", (char *)str);
                 break;
         case BGX_MODE_QSGMII:
-                if ((lmacid == 0) &&
-                    (bgx_get_lane2sds_cfg(bgx, lmac) != lmacid))
-                        return;
-                if ((lmacid == 2) &&
-                    (bgx_get_lane2sds_cfg(bgx, lmac) == lmacid))
-                        return;
                 dev_info(dev, "%s: QSGMII\n", (char *)str);
                 break;
         case BGX_MODE_RGMII:
@@ -1334,11 +1358,13 @@ static int bgx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_release_regions;
         }
 
+        set_max_bgx_per_node(pdev);
+
         pci_read_config_word(pdev, PCI_DEVICE_ID, &sdevid);
         if (sdevid != PCI_DEVICE_ID_THUNDER_RGX) {
                 bgx->bgx_id = (pci_resource_start(pdev,
                         PCI_CFG_REG_BAR_NUM) >> 24) & BGX_ID_MASK;
-                bgx->bgx_id += nic_get_node_id(pdev) * MAX_BGX_PER_NODE;
+                bgx->bgx_id += nic_get_node_id(pdev) * max_bgx_per_node;
                 bgx->max_lmac = MAX_LMAC_PER_BGX;
                 bgx_vnic[bgx->bgx_id] = bgx;
         } else {
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
index a60f189429bb..c5080f2cead5 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
@@ -22,7 +22,6 @@
 #define    MAX_BGX_PER_CN88XX                   2
 #define    MAX_BGX_PER_CN81XX                   3 /* 2 BGXs + 1 RGX */
 #define    MAX_BGX_PER_CN83XX                   4
-#define    MAX_BGX_PER_NODE                     4
 #define    MAX_LMAC_PER_BGX                     4
 #define    MAX_BGX_CHANS_PER_LMAC               16
 #define    MAX_DMAC_PER_LMAC                    8
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 275c2e2349ad..c44036d5761a 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -2589,8 +2589,6 @@ static int emac_dt_mdio_probe(struct emac_instance *dev)
 static int emac_dt_phy_connect(struct emac_instance *dev,
                                struct device_node *phy_handle)
 {
-        int res;
-
         dev->phy.def = devm_kzalloc(&dev->ofdev->dev, sizeof(*dev->phy.def),
                                     GFP_KERNEL);
         if (!dev->phy.def)
@@ -2617,7 +2615,7 @@ static int emac_dt_phy_probe(struct emac_instance *dev)
 {
         struct device_node *np = dev->ofdev->dev.of_node;
         struct device_node *phy_handle;
-        int res = 0;
+        int res = 1;
 
         phy_handle = of_parse_phandle(np, "phy-handle", 0);
 
@@ -2714,13 +2712,24 @@ static int emac_init_phy(struct emac_instance *dev)
         if (emac_has_feature(dev, EMAC_FTR_HAS_RGMII)) {
                 int res = emac_dt_phy_probe(dev);
 
-                mutex_unlock(&emac_phy_map_lock);
-                if (!res)
+                switch (res) {
+                case 1:
+                        /* No phy-handle property configured.
+                         * Continue with the existing phy probe
+                         * and setup code.
+                         */
+                        break;
+
+                case 0:
+                        mutex_unlock(&emac_phy_map_lock);
                         goto init_phy;
 
-                dev_err(&dev->ofdev->dev, "failed to attach dt phy (%d).\n",
-                        res);
-                return res;
+                default:
+                        mutex_unlock(&emac_phy_map_lock);
+                        dev_err(&dev->ofdev->dev, "failed to attach dt phy (%d).\n",
+                                res);
+                        return res;
+                }
         }
 
         if (dev->phy_address != 0xffffffff)
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 9198e6bd5160..b23d6545f835 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -404,7 +404,7 @@ static int ibmvnic_open(struct net_device *netdev)
         send_map_query(adapter);
         for (i = 0; i < rxadd_subcrqs; i++) {
                 init_rx_pool(adapter, &adapter->rx_pool[i],
-                             IBMVNIC_BUFFS_PER_POOL, i,
+                             adapter->req_rx_add_entries_per_subcrq, i,
                              be64_to_cpu(size_array[i]), 1);
                 if (alloc_rx_pool(adapter, &adapter->rx_pool[i])) {
                         dev_err(dev, "Couldn't alloc rx pool\n");
@@ -419,23 +419,23 @@ static int ibmvnic_open(struct net_device *netdev)
         for (i = 0; i < tx_subcrqs; i++) {
                 tx_pool = &adapter->tx_pool[i];
                 tx_pool->tx_buff =
-                    kcalloc(adapter->max_tx_entries_per_subcrq,
+                    kcalloc(adapter->req_tx_entries_per_subcrq,
                             sizeof(struct ibmvnic_tx_buff), GFP_KERNEL);
                 if (!tx_pool->tx_buff)
                         goto tx_pool_alloc_failed;
 
                 if (alloc_long_term_buff(adapter, &tx_pool->long_term_buff,
-                                         adapter->max_tx_entries_per_subcrq *
+                                         adapter->req_tx_entries_per_subcrq *
                                          adapter->req_mtu))
                         goto tx_ltb_alloc_failed;
 
                 tx_pool->free_map =
-                    kcalloc(adapter->max_tx_entries_per_subcrq,
+                    kcalloc(adapter->req_tx_entries_per_subcrq,
                             sizeof(int), GFP_KERNEL);
                 if (!tx_pool->free_map)
                         goto tx_fm_alloc_failed;
 
-                for (j = 0; j < adapter->max_tx_entries_per_subcrq; j++)
+                for (j = 0; j < adapter->req_tx_entries_per_subcrq; j++)
                         tx_pool->free_map[j] = j;
 
                 tx_pool->consumer_index = 0;
@@ -705,6 +705,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
         u8 *hdrs = (u8 *)&adapter->tx_rx_desc_req;
         struct device *dev = &adapter->vdev->dev;
         struct ibmvnic_tx_buff *tx_buff = NULL;
+        struct ibmvnic_sub_crq_queue *tx_scrq;
         struct ibmvnic_tx_pool *tx_pool;
         unsigned int tx_send_failed = 0;
         unsigned int tx_map_failed = 0;
@@ -724,6 +725,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
         int ret = 0;
 
         tx_pool = &adapter->tx_pool[queue_num];
+        tx_scrq = adapter->tx_scrq[queue_num];
         txq = netdev_get_tx_queue(netdev, skb_get_queue_mapping(skb));
         handle_array = (u64 *)((u8 *)(adapter->login_rsp_buf) +
                                    be32_to_cpu(adapter->login_rsp_buf->
@@ -744,7 +746,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
 
         tx_pool->consumer_index =
             (tx_pool->consumer_index + 1) %
-                adapter->max_tx_entries_per_subcrq;
+                adapter->req_tx_entries_per_subcrq;
 
         tx_buff = &tx_pool->tx_buff[index];
         tx_buff->skb = skb;
@@ -817,7 +819,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
 
                 if (tx_pool->consumer_index == 0)
                         tx_pool->consumer_index =
-                                adapter->max_tx_entries_per_subcrq - 1;
+                                adapter->req_tx_entries_per_subcrq - 1;
                 else
                         tx_pool->consumer_index--;
 
@@ -826,6 +828,14 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
                 ret = NETDEV_TX_BUSY;
                 goto out;
         }
+
+        atomic_inc(&tx_scrq->used);
+
+        if (atomic_read(&tx_scrq->used) >= adapter->req_tx_entries_per_subcrq) {
+                netdev_info(netdev, "Stopping queue %d\n", queue_num);
+                netif_stop_subqueue(netdev, queue_num);
+        }
+
         tx_packets++;
         tx_bytes += skb->len;
         txq->trans_start = jiffies;
@@ -1213,6 +1223,7 @@ static struct ibmvnic_sub_crq_queue *init_sub_crq_queue(struct ibmvnic_adapter
         scrq->adapter = adapter;
         scrq->size = 4 * PAGE_SIZE / sizeof(*scrq->msgs);
         scrq->cur = 0;
+        atomic_set(&scrq->used, 0);
         scrq->rx_skb_top = NULL;
         spin_lock_init(&scrq->lock);
 
@@ -1246,6 +1257,7 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter)
                                 release_sub_crq_queue(adapter,
                                                       adapter->tx_scrq[i]);
                         }
+                kfree(adapter->tx_scrq);
                 adapter->tx_scrq = NULL;
         }
 
@@ -1258,6 +1270,7 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter)
                                 release_sub_crq_queue(adapter,
                                                       adapter->rx_scrq[i]);
                         }
+                kfree(adapter->rx_scrq);
                 adapter->rx_scrq = NULL;
         }
 }
@@ -1355,14 +1368,28 @@ restart_loop:
                                                  DMA_TO_DEVICE);
                         }
 
-                        if (txbuff->last_frag)
+                        if (txbuff->last_frag) {
+                                atomic_dec(&scrq->used);
+
+                                if (atomic_read(&scrq->used) <=
+                                    (adapter->req_tx_entries_per_subcrq / 2) &&
+                                    netif_subqueue_stopped(adapter->netdev,
+                                                           txbuff->skb)) {
+                                        netif_wake_subqueue(adapter->netdev,
+                                                            scrq->pool_index);
+                                        netdev_dbg(adapter->netdev,
+                                                   "Started queue %d\n",
+                                                   scrq->pool_index);
+                                }
+
                                 dev_kfree_skb_any(txbuff->skb);
+                        }
 
                         adapter->tx_pool[pool].free_map[adapter->tx_pool[pool].
                                                      producer_index] = index;
                         adapter->tx_pool[pool].producer_index =
                             (adapter->tx_pool[pool].producer_index + 1) %
-                            adapter->max_tx_entries_per_subcrq;
+                            adapter->req_tx_entries_per_subcrq;
                 }
                 /* remove tx_comp scrq*/
                 next->tx_comp.first = 0;
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index 422824f1f42a..1993b42666f7 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -863,6 +863,7 @@ struct ibmvnic_sub_crq_queue {
         spinlock_t lock;
         struct sk_buff *rx_skb_top;
         struct ibmvnic_adapter *adapter;
+        atomic_t used;
 };
 
 struct ibmvnic_long_term_buff {
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index e8c105164931..0e0fa7030565 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2305,6 +2305,17 @@ static int sync_toggles(struct mlx4_dev *dev)
                 rd_toggle = swab32(readl(&priv->mfunc.comm->slave_read));
                 if (wr_toggle == 0xffffffff || rd_toggle == 0xffffffff) {
                         /* PCI might be offline */
+
+                        /* If device removal has been requested,
+                         * do not continue retrying.
+                         */
+                        if (dev->persist->interface_state &
+                            MLX4_INTERFACE_STATE_NOWAIT) {
+                                mlx4_warn(dev,
+                                          "communication channel is offline\n");
+                                return -EIO;
+                        }
+
                         msleep(100);
                         wr_toggle = swab32(readl(&priv->mfunc.comm->
                                            slave_write));
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 21377c315083..703205475524 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1940,6 +1940,14 @@ static int mlx4_comm_check_offline(struct mlx4_dev *dev)
                                (u32)(1 << COMM_CHAN_OFFLINE_OFFSET));
                 if (!offline_bit)
                         return 0;
+
+                /* If device removal has been requested,
+                 * do not continue retrying.
+                 */
+                if (dev->persist->interface_state &
+                    MLX4_INTERFACE_STATE_NOWAIT)
+                        break;
+
                 /* There are cases as part of AER/Reset flow that PF needs
                  * around 100 msec to load. We therefore sleep for 100 msec
                  * to allow other tasks to make use of that CPU during this
@@ -3955,6 +3963,9 @@ static void mlx4_remove_one(struct pci_dev *pdev)
         struct devlink *devlink = priv_to_devlink(priv);
         int active_vfs = 0;
 
+        if (mlx4_is_slave(dev))
+                persist->interface_state |= MLX4_INTERFACE_STATE_NOWAIT;
+
         mutex_lock(&persist->interface_state_mutex);
         persist->interface_state |= MLX4_INTERFACE_STATE_DELETION;
         mutex_unlock(&persist->interface_state_mutex);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
index ddb4ca4ff930..117170014e88 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
@@ -14,6 +14,7 @@ config MLX5_CORE
 config MLX5_CORE_EN
         bool "Mellanox Technologies ConnectX-4 Ethernet support"
         depends on NETDEVICES && ETHERNET && PCI && MLX5_CORE
+        depends on IPV6=y || IPV6=n || MLX5_CORE=m
         imply PTP_1588_CLOCK
         default n
         ---help---
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index caa837e5e2b9..a380353a78c2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -361,6 +361,8 @@ static int mlx5_internal_err_ret_value(struct mlx5_core_dev *dev, u16 op,
         case MLX5_CMD_OP_QUERY_VPORT_COUNTER:
         case MLX5_CMD_OP_ALLOC_Q_COUNTER:
         case MLX5_CMD_OP_QUERY_Q_COUNTER:
+        case MLX5_CMD_OP_SET_RATE_LIMIT:
+        case MLX5_CMD_OP_QUERY_RATE_LIMIT:
         case MLX5_CMD_OP_ALLOC_PD:
         case MLX5_CMD_OP_ALLOC_UAR:
         case MLX5_CMD_OP_CONFIG_INT_MODERATION:
@@ -497,6 +499,8 @@ const char *mlx5_command_str(int command)
         MLX5_COMMAND_STR_CASE(ALLOC_Q_COUNTER);
         MLX5_COMMAND_STR_CASE(DEALLOC_Q_COUNTER);
         MLX5_COMMAND_STR_CASE(QUERY_Q_COUNTER);
+        MLX5_COMMAND_STR_CASE(SET_RATE_LIMIT);
+        MLX5_COMMAND_STR_CASE(QUERY_RATE_LIMIT);
         MLX5_COMMAND_STR_CASE(ALLOC_PD);
         MLX5_COMMAND_STR_CASE(DEALLOC_PD);
         MLX5_COMMAND_STR_CASE(ALLOC_UAR);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index f6a6ded204f6..dc52053128bc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -928,10 +928,6 @@ void mlx5e_destroy_netdev(struct mlx5_core_dev *mdev, struct mlx5e_priv *priv);
 int mlx5e_attach_netdev(struct mlx5_core_dev *mdev, struct net_device *netdev);
 void mlx5e_detach_netdev(struct mlx5_core_dev *mdev, struct net_device *netdev);
 u32 mlx5e_choose_lro_timeout(struct mlx5_core_dev *mdev, u32 wanted_timeout);
-void mlx5e_add_vxlan_port(struct net_device *netdev,
-                          struct udp_tunnel_info *ti);
-void mlx5e_del_vxlan_port(struct net_device *netdev,
-                          struct udp_tunnel_info *ti);
 
 int mlx5e_get_offload_stats(int attr_id, const struct net_device *dev,
                             void *sp);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 0523ed47f597..8fa23f6a1f67 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -302,6 +302,9 @@ static u8 mlx5e_dcbnl_setdcbx(struct net_device *dev, u8 mode)
         struct mlx5e_priv *priv = netdev_priv(dev);
         struct mlx5e_dcbx *dcbx = &priv->dcbx;
 
+        if (mode & DCB_CAP_DCBX_LLD_MANAGED)
+                return 1;
+
         if ((!mode) && MLX5_CAP_GEN(priv->mdev, dcbx)) {
                 if (dcbx->mode == MLX5E_DCBX_PARAM_VER_OPER_AUTO)
                         return 0;
@@ -315,13 +318,10 @@ static u8 mlx5e_dcbnl_setdcbx(struct net_device *dev, u8 mode)
                 return 1;
         }
 
-        if (mlx5e_dcbnl_switch_to_host_mode(netdev_priv(dev)))
+        if (!(mode & DCB_CAP_DCBX_HOST))
                 return 1;
 
-        if ((mode & DCB_CAP_DCBX_LLD_MANAGED) ||
-            !(mode & DCB_CAP_DCBX_VER_CEE) ||
-            !(mode & DCB_CAP_DCBX_VER_IEEE) ||
-            !(mode & DCB_CAP_DCBX_HOST))
+        if (mlx5e_dcbnl_switch_to_host_mode(netdev_priv(dev)))
                 return 1;
 
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 8ef64c4db2c2..66c133757a5e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -3100,8 +3100,8 @@ static int mlx5e_get_vf_stats(struct net_device *dev,
                                             vf_stats);
 }
 
-void mlx5e_add_vxlan_port(struct net_device *netdev,
-                          struct udp_tunnel_info *ti)
+static void mlx5e_add_vxlan_port(struct net_device *netdev,
+                                 struct udp_tunnel_info *ti)
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
 
@@ -3114,8 +3114,8 @@ void mlx5e_add_vxlan_port(struct net_device *netdev,
         mlx5e_vxlan_queue_work(priv, ti->sa_family, be16_to_cpu(ti->port), 1);
 }
 
-void mlx5e_del_vxlan_port(struct net_device *netdev,
-                          struct udp_tunnel_info *ti)
+static void mlx5e_del_vxlan_port(struct net_device *netdev,
+                                 struct udp_tunnel_info *ti)
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 2c864574a9d5..f621373bd7a5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -393,8 +393,6 @@ static const struct net_device_ops mlx5e_netdev_ops_rep = {
         .ndo_get_phys_port_name  = mlx5e_rep_get_phys_port_name,
         .ndo_setup_tc            = mlx5e_rep_ndo_setup_tc,
         .ndo_get_stats64         = mlx5e_rep_get_stats,
-        .ndo_udp_tunnel_add      = mlx5e_add_vxlan_port,
-        .ndo_udp_tunnel_del      = mlx5e_del_vxlan_port,
         .ndo_has_offload_stats   = mlx5e_has_offload_stats,
         .ndo_get_offload_stats   = mlx5e_get_offload_stats,
 };
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 3d371688fbbb..bafcb349a50c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -601,6 +601,10 @@ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe,
         if (lro_num_seg > 1) {
                 mlx5e_lro_update_hdr(skb, cqe, cqe_bcnt);
                 skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt, lro_num_seg);
+                /* Subtract one since we already counted this as one
+                 * "regular" packet in mlx5e_complete_rx_cqe()
+                 */
+                rq->stats.packets += lro_num_seg - 1;
                 rq->stats.lro_packets++;
                 rq->stats.lro_bytes += cqe_bcnt;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 31e3cb7ee5fe..5621dcfda4f1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -204,9 +204,6 @@ mlx5e_test_loopback_validate(struct sk_buff *skb,
         struct iphdr *iph;
 
         /* We are only going to peek, no need to clone the SKB */
-        if (skb->protocol != htons(ETH_P_IP))
-                goto out;
-
         if (MLX5E_TEST_PKT_SIZE - ETH_HLEN > skb_headlen(skb))
                 goto out;
 
@@ -249,7 +246,7 @@ static int mlx5e_test_loopback_setup(struct mlx5e_priv *priv,
         lbtp->loopback_ok = false;
         init_completion(&lbtp->comp);
 
-        lbtp->pt.type = htons(ETH_P_ALL);
+        lbtp->pt.type = htons(ETH_P_IP);
         lbtp->pt.func = mlx5e_test_loopback_validate;
         lbtp->pt.dev = priv->netdev;
         lbtp->pt.af_packet_priv = lbtp;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 44406a5ec15d..fade7233dac5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -48,9 +48,14 @@
 #include "eswitch.h"
 #include "vxlan.h"
 
+enum {
+        MLX5E_TC_FLOW_ESWITCH   = BIT(0),
+};
+
 struct mlx5e_tc_flow {
         struct rhash_head       node;
         u64                     cookie;
+        u8                      flags;
         struct mlx5_flow_handle *rule;
         struct list_head        encap; /* flows sharing the same encap */
         struct mlx5_esw_flow_attr *attr;
@@ -128,6 +133,23 @@ err_create_ft:
         return rule;
 }
 
+static void mlx5e_tc_del_nic_flow(struct mlx5e_priv *priv,
+                                  struct mlx5e_tc_flow *flow)
+{
+        struct mlx5_fc *counter = NULL;
+
+        if (!IS_ERR(flow->rule)) {
+                counter = mlx5_flow_rule_counter(flow->rule);
+                mlx5_del_flow_rules(flow->rule);
+                mlx5_fc_destroy(priv->mdev, counter);
+        }
+
+        if (!mlx5e_tc_num_filters(priv) && (priv->fs.tc.t)) {
+                mlx5_destroy_flow_table(priv->fs.tc.t);
+                priv->fs.tc.t = NULL;
+        }
+}
+
 static struct mlx5_flow_handle *
 mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
                       struct mlx5_flow_spec *spec,
@@ -144,7 +166,24 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
 }
 
 static void mlx5e_detach_encap(struct mlx5e_priv *priv,
-                               struct mlx5e_tc_flow *flow) {
+                               struct mlx5e_tc_flow *flow);
+
+static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
+                                  struct mlx5e_tc_flow *flow)
+{
+        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+
+        mlx5_eswitch_del_offloaded_rule(esw, flow->rule, flow->attr);
+
+        mlx5_eswitch_del_vlan_action(esw, flow->attr);
+
+        if (flow->attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP)
+                mlx5e_detach_encap(priv, flow);
+}
+
+static void mlx5e_detach_encap(struct mlx5e_priv *priv,
+                               struct mlx5e_tc_flow *flow)
+{
         struct list_head *next = flow->encap.next;
 
         list_del(&flow->encap);
@@ -168,25 +207,10 @@ static void mlx5e_detach_encap(struct mlx5e_priv *priv,
 static void mlx5e_tc_del_flow(struct mlx5e_priv *priv,
                               struct mlx5e_tc_flow *flow)
 {
-        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
-        struct mlx5_fc *counter = NULL;
-
-        if (!IS_ERR(flow->rule)) {
-                counter = mlx5_flow_rule_counter(flow->rule);
-                mlx5_del_flow_rules(flow->rule);
-                mlx5_fc_destroy(priv->mdev, counter);
-        }
-
-        if (esw && esw->mode == SRIOV_OFFLOADS) {
-                mlx5_eswitch_del_vlan_action(esw, flow->attr);
-                if (flow->attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP)
-                        mlx5e_detach_encap(priv, flow);
-        }
-
-        if (!mlx5e_tc_num_filters(priv) && (priv->fs.tc.t)) {
-                mlx5_destroy_flow_table(priv->fs.tc.t);
-                priv->fs.tc.t = NULL;
-        }
+        if (flow->flags & MLX5E_TC_FLOW_ESWITCH)
+                mlx5e_tc_del_fdb_flow(priv, flow);
+        else
+                mlx5e_tc_del_nic_flow(priv, flow);
 }
 
 static void parse_vxlan_attr(struct mlx5_flow_spec *spec,
@@ -243,12 +267,15 @@ static int parse_tunnel_attr(struct mlx5e_priv *priv,
                         skb_flow_dissector_target(f->dissector,
                                                   FLOW_DISSECTOR_KEY_ENC_PORTS,
                                                   f->mask);
+                struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+                struct net_device *up_dev = mlx5_eswitch_get_uplink_netdev(esw);
+                struct mlx5e_priv *up_priv = netdev_priv(up_dev);
 
                 /* Full udp dst port must be given */
                 if (memchr_inv(&mask->dst, 0xff, sizeof(mask->dst)))
                         goto vxlan_match_offload_err;
 
-                if (mlx5e_vxlan_lookup_port(priv, be16_to_cpu(key->dst)) &&
+                if (mlx5e_vxlan_lookup_port(up_priv, be16_to_cpu(key->dst)) &&
                     MLX5_CAP_ESW(priv->mdev, vxlan_encap_decap))
                         parse_vxlan_attr(spec, f);
                 else {
@@ -598,6 +625,7 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
 }
 
 static int parse_cls_flower(struct mlx5e_priv *priv,
+                            struct mlx5e_tc_flow *flow,
                             struct mlx5_flow_spec *spec,
                             struct tc_cls_flower_offload *f)
 {
@@ -609,7 +637,7 @@ static int parse_cls_flower(struct mlx5e_priv *priv,
 
         err = __parse_cls_flower(priv, spec, f, &min_inline);
 
-        if (!err && esw->mode == SRIOV_OFFLOADS &&
+        if (!err && (flow->flags & MLX5E_TC_FLOW_ESWITCH) &&
             rep->vport != FDB_UPLINK_VPORT) {
                 if (min_inline > esw->offloads.inline_mode) {
                         netdev_warn(priv->netdev,
@@ -970,6 +998,8 @@ static int mlx5e_attach_encap(struct mlx5e_priv *priv,
                               struct mlx5_esw_flow_attr *attr)
 {
         struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+        struct net_device *up_dev = mlx5_eswitch_get_uplink_netdev(esw);
+        struct mlx5e_priv *up_priv = netdev_priv(up_dev);
         unsigned short family = ip_tunnel_info_af(tun_info);
         struct ip_tunnel_key *key = &tun_info->key;
         struct mlx5_encap_entry *e;
@@ -990,7 +1020,7 @@ vxlan_encap_offload_err:
                 return -EOPNOTSUPP;
         }
 
-        if (mlx5e_vxlan_lookup_port(priv, be16_to_cpu(key->tp_dst)) &&
+        if (mlx5e_vxlan_lookup_port(up_priv, be16_to_cpu(key->tp_dst)) &&
             MLX5_CAP_ESW(priv->mdev, vxlan_encap_decap)) {
                 tunnel_type = MLX5_HEADER_TYPE_VXLAN;
         } else {
@@ -1106,14 +1136,16 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                 }
 
                 if (is_tcf_vlan(a)) {
-                        if (tcf_vlan_action(a) == VLAN_F_POP) {
+                        if (tcf_vlan_action(a) == TCA_VLAN_ACT_POP) {
                                 attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_POP;
-                        } else if (tcf_vlan_action(a) == VLAN_F_PUSH) {
+                        } else if (tcf_vlan_action(a) == TCA_VLAN_ACT_PUSH) {
                                 if (tcf_vlan_push_proto(a) != htons(ETH_P_8021Q))
                                         return -EOPNOTSUPP;
 
                                 attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH;
                                 attr->vlan = tcf_vlan_push_vid(a);
+                        } else { /* action is TCA_VLAN_ACT_MODIFY */
+                                return -EOPNOTSUPP;
                         }
                         continue;
                 }
@@ -1132,23 +1164,19 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv, __be16 protocol,
                            struct tc_cls_flower_offload *f)
 {
         struct mlx5e_tc_table *tc = &priv->fs.tc;
-        int err = 0;
-        bool fdb_flow = false;
+        int err, attr_size = 0;
         u32 flow_tag, action;
         struct mlx5e_tc_flow *flow;
         struct mlx5_flow_spec *spec;
         struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+        u8 flow_flags = 0;
 
-        if (esw && esw->mode == SRIOV_OFFLOADS)
-                fdb_flow = true;
-
-        if (fdb_flow)
-                flow = kzalloc(sizeof(*flow) +
-                               sizeof(struct mlx5_esw_flow_attr),
-                               GFP_KERNEL);
-        else
-                flow = kzalloc(sizeof(*flow), GFP_KERNEL);
+        if (esw && esw->mode == SRIOV_OFFLOADS) {
+                flow_flags = MLX5E_TC_FLOW_ESWITCH;
+                attr_size  = sizeof(struct mlx5_esw_flow_attr);
+        }
 
+        flow = kzalloc(sizeof(*flow) + attr_size, GFP_KERNEL);
         spec = mlx5_vzalloc(sizeof(*spec));
         if (!spec || !flow) {
                 err = -ENOMEM;
@@ -1156,12 +1184,13 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv, __be16 protocol,
         }
 
         flow->cookie = f->cookie;
+        flow->flags = flow_flags;
 
-        err = parse_cls_flower(priv, spec, f);
+        err = parse_cls_flower(priv, flow, spec, f);
         if (err < 0)
                 goto err_free;
 
-        if (fdb_flow) {
+        if (flow->flags & MLX5E_TC_FLOW_ESWITCH) {
                 flow->attr  = (struct mlx5_esw_flow_attr *)(flow + 1);
                 err = parse_tc_fdb_actions(priv, f->exts, flow);
                 if (err < 0)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index f193128bac4b..57f5e2d7ebd1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -274,15 +274,18 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
                         sq->stats.tso_bytes += skb->len - ihs;
                 }
 
+                sq->stats.packets += skb_shinfo(skb)->gso_segs;
                 num_bytes = skb->len + (skb_shinfo(skb)->gso_segs - 1) * ihs;
         } else {
                 bf = sq->bf_budget &&
                      !skb->xmit_more &&
                      !skb_shinfo(skb)->nr_frags;
                 ihs = mlx5e_get_inline_hdr_size(sq, skb, bf);
+                sq->stats.packets++;
                 num_bytes = max_t(unsigned int, skb->len, ETH_ZLEN);
         }
 
+        sq->stats.bytes += num_bytes;
         wi->num_bytes = num_bytes;
 
         ds_cnt = sizeof(*wqe) / MLX5_SEND_WQE_DS;
@@ -381,8 +384,6 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
         if (bf)
                 sq->bf_budget--;
 
-        sq->stats.packets++;
-        sq->stats.bytes += num_bytes;
         return NETDEV_TX_OK;
 
 dma_unmap_wqe_err:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index 5b78883d5654..ad329b1680b4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -209,6 +209,7 @@ struct mlx5_esw_offload {
         struct mlx5_eswitch_rep *vport_reps;
         DECLARE_HASHTABLE(encap_tbl, 8);
         u8 inline_mode;
+        u64 num_flows;
 };
 
 struct mlx5_eswitch {
@@ -271,6 +272,11 @@ struct mlx5_flow_handle *
 mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
                                 struct mlx5_flow_spec *spec,
                                 struct mlx5_esw_flow_attr *attr);
+void
+mlx5_eswitch_del_offloaded_rule(struct mlx5_eswitch *esw,
+                                struct mlx5_flow_handle *rule,
+                                struct mlx5_esw_flow_attr *attr);
+
 struct mlx5_flow_handle *
 mlx5_eswitch_create_vport_rx_rule(struct mlx5_eswitch *esw, int vport, u32 tirn);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 4f5b0d47d5f3..307ec6c5fd3b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -93,10 +93,27 @@ mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
                                    spec, &flow_act, dest, i);
         if (IS_ERR(rule))
                 mlx5_fc_destroy(esw->dev, counter);
+        else
+                esw->offloads.num_flows++;
 
         return rule;
 }
 
+void
+mlx5_eswitch_del_offloaded_rule(struct mlx5_eswitch *esw,
+                                struct mlx5_flow_handle *rule,
+                                struct mlx5_esw_flow_attr *attr)
+{
+        struct mlx5_fc *counter = NULL;
+
+        if (!IS_ERR(rule)) {
+                counter = mlx5_flow_rule_counter(rule);
+                mlx5_del_flow_rules(rule);
+                mlx5_fc_destroy(esw->dev, counter);
+                esw->offloads.num_flows--;
+        }
+}
+
 static int esw_set_global_vlan_pop(struct mlx5_eswitch *esw, u8 val)
 {
         struct mlx5_eswitch_rep *rep;
@@ -908,6 +925,11 @@ int mlx5_devlink_eswitch_inline_mode_set(struct devlink *devlink, u8 mode)
             MLX5_CAP_INLINE_MODE_VPORT_CONTEXT)
                 return -EOPNOTSUPP;
 
+        if (esw->offloads.num_flows > 0) {
+                esw_warn(dev, "Can't set inline mode when flows are configured\n");
+                return -EOPNOTSUPP;
+        }
+
         err = esw_inline_mode_from_devlink(mode, &mlx5_mode);
         if (err)
                 goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 2478516a61e2..ded27bb9a3b6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1136,7 +1136,7 @@ static struct mlx5_flow_group *create_autogroup(struct mlx5_flow_table *ft,
                                                 u32 *match_criteria)
 {
         int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
-        struct list_head *prev = ft->node.children.prev;
+        struct list_head *prev = &ft->node.children;
         unsigned int candidate_index = 0;
         struct mlx5_flow_group *fg;
         void *match_criteria_addr;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index c4242a4e8130..60154a175bd3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -87,7 +87,7 @@ static struct mlx5_profile profile[] = {
         [2] = {
                 .mask           = MLX5_PROF_MASK_QP_SIZE |
                                   MLX5_PROF_MASK_MR_CACHE,
-                .log_max_qp     = 17,
+                .log_max_qp     = 18,
                 .mr_cache[0]    = {
                         .size   = 500,
                         .limit  = 250
@@ -1352,6 +1352,7 @@ static int init_one(struct pci_dev *pdev,
         if (err)
                 goto clean_load;
 
+        pci_save_state(pdev);
         return 0;
 
 clean_load:
@@ -1407,9 +1408,8 @@ static pci_ers_result_t mlx5_pci_err_detected(struct pci_dev *pdev,
 
         mlx5_enter_error_state(dev);
         mlx5_unload_one(dev, priv, false);
-        /* In case of kernel call save the pci state and drain the health wq */
+        /* In case of kernel call drain the health wq */
         if (state) {
-                pci_save_state(pdev);
                 mlx5_drain_health_wq(dev);
                 mlx5_pci_disable_device(dev);
         }
@@ -1461,6 +1461,7 @@ static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
 
         pci_set_master(pdev);
         pci_restore_state(pdev);
+        pci_save_state(pdev);
 
         if (wait_vital(pdev)) {
                 dev_err(&pdev->dev, "%s: wait_vital timed out\n", __func__);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
index 0899e2d310e2..d9616daf8a70 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -769,7 +769,7 @@ static inline void mlxsw_reg_spvid_pack(char *payload, u8 local_port, u16 pvid)
 #define MLXSW_REG_SPVM_ID 0x200F
 #define MLXSW_REG_SPVM_BASE_LEN 0x04 /* base length, without records */
 #define MLXSW_REG_SPVM_REC_LEN 0x04 /* record length */
-#define MLXSW_REG_SPVM_REC_MAX_COUNT 256
+#define MLXSW_REG_SPVM_REC_MAX_COUNT 255
 #define MLXSW_REG_SPVM_LEN (MLXSW_REG_SPVM_BASE_LEN +   \
                     MLXSW_REG_SPVM_REC_LEN * MLXSW_REG_SPVM_REC_MAX_COUNT)
 
@@ -1702,7 +1702,7 @@ static inline void mlxsw_reg_sfmr_pack(char *payload,
 #define MLXSW_REG_SPVMLR_ID 0x2020
 #define MLXSW_REG_SPVMLR_BASE_LEN 0x04 /* base length, without records */
 #define MLXSW_REG_SPVMLR_REC_LEN 0x04 /* record length */
-#define MLXSW_REG_SPVMLR_REC_MAX_COUNT 256
+#define MLXSW_REG_SPVMLR_REC_MAX_COUNT 255
 #define MLXSW_REG_SPVMLR_LEN (MLXSW_REG_SPVMLR_BASE_LEN + \
                               MLXSW_REG_SPVMLR_REC_LEN * \
                               MLXSW_REG_SPVMLR_REC_MAX_COUNT)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
index 22ab42925377..ae6cccc666e4 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
@@ -303,11 +303,11 @@ void mlxsw_sp_flower_destroy(struct mlxsw_sp_port *mlxsw_sp_port, bool ingress,
         ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, mlxsw_sp_port->dev,
                                            ingress,
                                            MLXSW_SP_ACL_PROFILE_FLOWER);
-        if (WARN_ON(IS_ERR(ruleset)))
+        if (IS_ERR(ruleset))
                 return;
 
         rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
-        if (!WARN_ON(!rule)) {
+        if (rule) {
                 mlxsw_sp_acl_rule_del(mlxsw_sp, rule);
                 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
         }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
index d42d03df751a..7e3a6fed3da6 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
@@ -422,8 +422,9 @@ static void qed_cxt_set_proto_cid_count(struct qed_hwfn *p_hwfn,
                 u32 page_sz = p_mgr->clients[ILT_CLI_CDUC].p_size.val;
                 u32 cxt_size = CONN_CXT_SIZE(p_hwfn);
                 u32 elems_per_page = ILT_PAGE_IN_BYTES(page_sz) / cxt_size;
+                u32 align = elems_per_page * DQ_RANGE_ALIGN;
 
-                p_conn->cid_count = roundup(p_conn->cid_count, elems_per_page);
+                p_conn->cid_count = roundup(p_conn->cid_count, align);
         }
 }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index e2a081ceaf52..e518f914eab1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -2389,9 +2389,8 @@ qed_chain_alloc_sanity_check(struct qed_dev *cdev,
          * size/capacity fields are of a u32 type.
          */
         if ((cnt_type == QED_CHAIN_CNT_TYPE_U16 &&
-             chain_size > 0x10000) ||
-            (cnt_type == QED_CHAIN_CNT_TYPE_U32 &&
-             chain_size > 0x100000000ULL)) {
+             chain_size > ((u32)U16_MAX + 1)) ||
+            (cnt_type == QED_CHAIN_CNT_TYPE_U32 && chain_size > U32_MAX)) {
                 DP_NOTICE(cdev,
                           "The actual chain size (0x%llx) is larger than the maximal possible value\n",
                           chain_size);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
index 3a44d6b395fa..098766f7fe88 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
@@ -190,6 +190,9 @@ qed_sp_iscsi_func_start(struct qed_hwfn *p_hwfn,
         p_init->num_sq_pages_in_ring = p_params->num_sq_pages_in_ring;
         p_init->num_r2tq_pages_in_ring = p_params->num_r2tq_pages_in_ring;
         p_init->num_uhq_pages_in_ring = p_params->num_uhq_pages_in_ring;
+        p_init->ooo_enable = p_params->ooo_enable;
+        p_init->ll2_rx_queue_id = p_hwfn->hw_info.resc_start[QED_LL2_QUEUE] +
+                                  p_params->ll2_ooo_queue_id;
         p_init->func_params.log_page_size = p_params->log_page_size;
         val = p_params->num_tasks;
         p_init->func_params.num_tasks = cpu_to_le16(val);
@@ -786,6 +789,23 @@ static void qed_iscsi_release_connection(struct qed_hwfn *p_hwfn,
         spin_unlock_bh(&p_hwfn->p_iscsi_info->lock);
 }
 
+void qed_iscsi_free_connection(struct qed_hwfn *p_hwfn,
+                               struct qed_iscsi_conn *p_conn)
+{
+        qed_chain_free(p_hwfn->cdev, &p_conn->xhq);
+        qed_chain_free(p_hwfn->cdev, &p_conn->uhq);
+        qed_chain_free(p_hwfn->cdev, &p_conn->r2tq);
+        dma_free_coherent(&p_hwfn->cdev->pdev->dev,
+                          sizeof(struct tcp_upload_params),
+                          p_conn->tcp_upload_params_virt_addr,
+                          p_conn->tcp_upload_params_phys_addr);
+        dma_free_coherent(&p_hwfn->cdev->pdev->dev,
+                          sizeof(struct scsi_terminate_extra_params),
+                          p_conn->queue_cnts_virt_addr,
+                          p_conn->queue_cnts_phys_addr);
+        kfree(p_conn);
+}
+
 struct qed_iscsi_info *qed_iscsi_alloc(struct qed_hwfn *p_hwfn)
 {
         struct qed_iscsi_info *p_iscsi_info;
@@ -807,6 +827,17 @@ void qed_iscsi_setup(struct qed_hwfn *p_hwfn,
 void qed_iscsi_free(struct qed_hwfn *p_hwfn,
                     struct qed_iscsi_info *p_iscsi_info)
 {
+        struct qed_iscsi_conn *p_conn = NULL;
+
+        while (!list_empty(&p_hwfn->p_iscsi_info->free_list)) {
+                p_conn = list_first_entry(&p_hwfn->p_iscsi_info->free_list,
+                                          struct qed_iscsi_conn, list_entry);
+                if (p_conn) {
+                        list_del(&p_conn->list_entry);
+                        qed_iscsi_free_connection(p_hwfn, p_conn);
+                }
+        }
+
         kfree(p_iscsi_info);
 }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index 9a0b9af10a57..0d3cef409c96 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -211,6 +211,8 @@ static void qed_ll2b_complete_rx_packet(struct qed_hwfn *p_hwfn,
         /* If need to reuse or there's no replacement buffer, repost this */
         if (rc)
                 goto out_post;
+        dma_unmap_single(&cdev->pdev->dev, buffer->phys_addr,
+                         cdev->ll2->rx_size, DMA_FROM_DEVICE);
 
         skb = build_skb(buffer->data, 0);
         if (!skb) {
@@ -474,7 +476,7 @@ qed_ll2_rxq_completion_gsi(struct qed_hwfn *p_hwfn,
 static int qed_ll2_rxq_completion_reg(struct qed_hwfn *p_hwfn,
                                       struct qed_ll2_info *p_ll2_conn,
                                       union core_rx_cqe_union *p_cqe,
-                                      unsigned long lock_flags,
+                                      unsigned long *p_lock_flags,
                                       bool b_last_cqe)
 {
         struct qed_ll2_rx_queue *p_rx = &p_ll2_conn->rx_queue;
@@ -495,10 +497,10 @@ static int qed_ll2_rxq_completion_reg(struct qed_hwfn *p_hwfn,
                           "Mismatch between active_descq and the LL2 Rx chain\n");
         list_add_tail(&p_pkt->list_entry, &p_rx->free_descq);
 
-        spin_unlock_irqrestore(&p_rx->lock, lock_flags);
+        spin_unlock_irqrestore(&p_rx->lock, *p_lock_flags);
         qed_ll2b_complete_rx_packet(p_hwfn, p_ll2_conn->my_id,
                                     p_pkt, &p_cqe->rx_cqe_fp, b_last_cqe);
-        spin_lock_irqsave(&p_rx->lock, lock_flags);
+        spin_lock_irqsave(&p_rx->lock, *p_lock_flags);
 
         return 0;
 }
@@ -538,7 +540,8 @@ static int qed_ll2_rxq_completion(struct qed_hwfn *p_hwfn, void *cookie)
                         break;
                 case CORE_RX_CQE_TYPE_REGULAR:
                         rc = qed_ll2_rxq_completion_reg(p_hwfn, p_ll2_conn,
-                                                        cqe, flags, b_last_cqe);
+                                                        cqe, &flags,
+                                                        b_last_cqe);
                         break;
                 default:
                         rc = -EIO;
@@ -968,7 +971,7 @@ static int qed_ll2_start_ooo(struct qed_dev *cdev,
 {
         struct qed_hwfn *hwfn = QED_LEADING_HWFN(cdev);
         u8 *handle = &hwfn->pf_params.iscsi_pf_params.ll2_ooo_queue_id;
-        struct qed_ll2_conn ll2_info;
+        struct qed_ll2_conn ll2_info = { 0 };
         int rc;
 
         ll2_info.conn_type = QED_LL2_TYPE_ISCSI_OOO;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ooo.c b/drivers/net/ethernet/qlogic/qed/qed_ooo.c
index 7d731c6cb892..378afce58b3f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ooo.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ooo.c
@@ -159,6 +159,8 @@ struct qed_ooo_info *qed_ooo_alloc(struct qed_hwfn *p_hwfn)
         if (!p_ooo_info->ooo_history.p_cqes)
                 goto no_history_mem;
 
+        p_ooo_info->ooo_history.num_of_cqes = QED_MAX_NUM_OOO_HISTORY_ENTRIES;
+
         return p_ooo_info;
 
 no_history_mem:
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge.h b/drivers/net/ethernet/qlogic/qlge/qlge.h
index 6d31f92ef2b6..84ac50f92c9c 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge.h
+++ b/drivers/net/ethernet/qlogic/qlge/qlge.h
@@ -1162,8 +1162,8 @@ struct ob_mac_tso_iocb_rsp {
 struct ib_mac_iocb_rsp {
         u8 opcode;              /* 0x20 */
         u8 flags1;
-#define IB_MAC_IOCB_RSP_OI      0x01    /* Overide intr delay */
-#define IB_MAC_IOCB_RSP_I       0x02    /* Disble Intr Generation */
+#define IB_MAC_IOCB_RSP_OI      0x01    /* Override intr delay */
+#define IB_MAC_IOCB_RSP_I       0x02    /* Disable Intr Generation */
 #define IB_MAC_CSUM_ERR_MASK 0x1c       /* A mask to use for csum errs */
 #define IB_MAC_IOCB_RSP_TE      0x04    /* Checksum error */
 #define IB_MAC_IOCB_RSP_NU      0x08    /* No checksum rcvd */
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 334bcc6df6b2..50d28261b6b9 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -2404,7 +2404,7 @@ static void efx_udp_tunnel_del(struct net_device *dev, struct udp_tunnel_info *t
         tnl.type = (u16)efx_tunnel_type;
         tnl.port = ti->port;
 
-        if (efx->type->udp_tnl_add_port)
+        if (efx->type->udp_tnl_del_port)
                 (void)efx->type->udp_tnl_del_port(efx, tnl);
 }
 
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 65077c77082a..91e9bd7159ab 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -1535,32 +1535,33 @@ static int smc_close(struct net_device *dev)
  * Ethtool support
  */
 static int
-smc_ethtool_getsettings(struct net_device *dev, struct ethtool_cmd *cmd)
+smc_ethtool_get_link_ksettings(struct net_device *dev,
+                               struct ethtool_link_ksettings *cmd)
 {
         struct smc_local *lp = netdev_priv(dev);
         int ret;
 
-        cmd->maxtxpkt = 1;
-        cmd->maxrxpkt = 1;
-
         if (lp->phy_type != 0) {
                 spin_lock_irq(&lp->lock);
-                ret = mii_ethtool_gset(&lp->mii, cmd);
+                ret = mii_ethtool_get_link_ksettings(&lp->mii, cmd);
                 spin_unlock_irq(&lp->lock);
         } else {
-                cmd->supported = SUPPORTED_10baseT_Half |
+                u32 supported = SUPPORTED_10baseT_Half |
                                  SUPPORTED_10baseT_Full |
                                  SUPPORTED_TP | SUPPORTED_AUI;
 
                 if (lp->ctl_rspeed == 10)
-                        ethtool_cmd_speed_set(cmd, SPEED_10);
+                        cmd->base.speed = SPEED_10;
                 else if (lp->ctl_rspeed == 100)
-                        ethtool_cmd_speed_set(cmd, SPEED_100);
+                        cmd->base.speed = SPEED_100;
+
+                cmd->base.autoneg = AUTONEG_DISABLE;
+                cmd->base.port = 0;
+                cmd->base.duplex = lp->tcr_cur_mode & TCR_SWFDUP ?
+                        DUPLEX_FULL : DUPLEX_HALF;
 
-                cmd->autoneg = AUTONEG_DISABLE;
-                cmd->transceiver = XCVR_INTERNAL;
-                cmd->port = 0;
-                cmd->duplex = lp->tcr_cur_mode & TCR_SWFDUP ? DUPLEX_FULL : DUPLEX_HALF;
+                ethtool_convert_legacy_u32_to_link_mode(
+                        cmd->link_modes.supported, supported);
 
                 ret = 0;
         }
@@ -1569,24 +1570,26 @@ smc_ethtool_getsettings(struct net_device *dev, struct ethtool_cmd *cmd)
 }
 
 static int
-smc_ethtool_setsettings(struct net_device *dev, struct ethtool_cmd *cmd)
+smc_ethtool_set_link_ksettings(struct net_device *dev,
+                               const struct ethtool_link_ksettings *cmd)
 {
         struct smc_local *lp = netdev_priv(dev);
         int ret;
 
         if (lp->phy_type != 0) {
                 spin_lock_irq(&lp->lock);
-                ret = mii_ethtool_sset(&lp->mii, cmd);
+                ret = mii_ethtool_set_link_ksettings(&lp->mii, cmd);
                 spin_unlock_irq(&lp->lock);
         } else {
-                if (cmd->autoneg != AUTONEG_DISABLE ||
-                    cmd->speed != SPEED_10 ||
-                    (cmd->duplex != DUPLEX_HALF && cmd->duplex != DUPLEX_FULL) ||
-                    (cmd->port != PORT_TP && cmd->port != PORT_AUI))
+                if (cmd->base.autoneg != AUTONEG_DISABLE ||
+                    cmd->base.speed != SPEED_10 ||
+                    (cmd->base.duplex != DUPLEX_HALF &&
+                     cmd->base.duplex != DUPLEX_FULL) ||
+                    (cmd->base.port != PORT_TP && cmd->base.port != PORT_AUI))
                         return -EINVAL;
 
-//              lp->port = cmd->port;
-                lp->ctl_rfduplx = cmd->duplex == DUPLEX_FULL;
+//              lp->port = cmd->base.port;
+                lp->ctl_rfduplx = cmd->base.duplex == DUPLEX_FULL;
 
 //              if (netif_running(dev))
 //                      smc_set_port(dev);
@@ -1744,8 +1747,6 @@ static int smc_ethtool_seteeprom(struct net_device *dev,
 
 
 static const struct ethtool_ops smc_ethtool_ops = {
-        .get_settings   = smc_ethtool_getsettings,
-        .set_settings   = smc_ethtool_setsettings,
         .get_drvinfo    = smc_ethtool_getdrvinfo,
 
         .get_msglevel   = smc_ethtool_getmsglevel,
@@ -1755,6 +1756,8 @@ static const struct ethtool_ops smc_ethtool_ops = {
         .get_eeprom_len = smc_ethtool_geteeprom_len,
         .get_eeprom     = smc_ethtool_geteeprom,
         .set_eeprom     = smc_ethtool_seteeprom,
+        .get_link_ksettings     = smc_ethtool_get_link_ksettings,
+        .set_link_ksettings     = smc_ethtool_set_link_ksettings,
 };
 
 static const struct net_device_ops smc_netdev_ops = {
diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig
index 296c8efd0038..9e631952b86f 100644
--- a/drivers/net/ethernet/ti/Kconfig
+++ b/drivers/net/ethernet/ti/Kconfig
@@ -74,15 +74,21 @@ config TI_CPSW
           will be called cpsw.
 
 config TI_CPTS
-        tristate "TI Common Platform Time Sync (CPTS) Support"
+        bool "TI Common Platform Time Sync (CPTS) Support"
         depends on TI_CPSW || TI_KEYSTONE_NETCP
-        imply PTP_1588_CLOCK
+        depends on PTP_1588_CLOCK
         ---help---
           This driver supports the Common Platform Time Sync unit of
           the CPSW Ethernet Switch and Keystone 2 1g/10g Switch Subsystem.
           The unit can time stamp PTP UDP/IPv4 and Layer 2 packets, and the
           driver offers a PTP Hardware Clock.
 
+config TI_CPTS_MOD
+        tristate
+        depends on TI_CPTS
+        default y if TI_CPSW=y || TI_KEYSTONE_NETCP=y
+        default m
+
 config TI_KEYSTONE_NETCP
         tristate "TI Keystone NETCP Core Support"
         select TI_CPSW_ALE
diff --git a/drivers/net/ethernet/ti/Makefile b/drivers/net/ethernet/ti/Makefile
index 1e7c10bf8713..10e6b0ce51ba 100644
--- a/drivers/net/ethernet/ti/Makefile
+++ b/drivers/net/ethernet/ti/Makefile
@@ -12,7 +12,7 @@ obj-$(CONFIG_TI_DAVINCI_MDIO) += davinci_mdio.o
 obj-$(CONFIG_TI_DAVINCI_CPDMA) += davinci_cpdma.o
 obj-$(CONFIG_TI_CPSW_PHY_SEL) += cpsw-phy-sel.o
 obj-$(CONFIG_TI_CPSW_ALE) += cpsw_ale.o
-obj-$(CONFIG_TI_CPTS) += cpts.o
+obj-$(CONFIG_TI_CPTS_MOD) += cpts.o
 obj-$(CONFIG_TI_CPSW) += ti_cpsw.o
 ti_cpsw-y := cpsw.o
 
diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
index b75d9cdcfb0c..ae48c809bac9 100644
--- a/drivers/net/fjes/fjes_main.c
+++ b/drivers/net/fjes/fjes_main.c
@@ -45,6 +45,8 @@ MODULE_DESCRIPTION("FUJITSU Extended Socket Network Device Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 
+#define ACPI_MOTHERBOARD_RESOURCE_HID "PNP0C02"
+
 static int fjes_request_irq(struct fjes_adapter *);
 static void fjes_free_irq(struct fjes_adapter *);
 
@@ -78,7 +80,7 @@ static void fjes_rx_irq(struct fjes_adapter *, int);
 static int fjes_poll(struct napi_struct *, int);
 
 static const struct acpi_device_id fjes_acpi_ids[] = {
-        {"PNP0C02", 0},
+        {ACPI_MOTHERBOARD_RESOURCE_HID, 0},
         {"", 0},
 };
 MODULE_DEVICE_TABLE(acpi, fjes_acpi_ids);
@@ -115,18 +117,17 @@ static struct resource fjes_resource[] = {
         },
 };
 
-static int fjes_acpi_add(struct acpi_device *device)
+static bool is_extended_socket_device(struct acpi_device *device)
 {
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL};
         char str_buf[sizeof(FJES_ACPI_SYMBOL) + 1];
-        struct platform_device *plat_dev;
         union acpi_object *str;
         acpi_status status;
         int result;
 
         status = acpi_evaluate_object(device->handle, "_STR", NULL, &buffer);
         if (ACPI_FAILURE(status))
-                return -ENODEV;
+                return false;
 
         str = buffer.pointer;
         result = utf16s_to_utf8s((wchar_t *)str->string.pointer,
@@ -136,10 +137,42 @@ static int fjes_acpi_add(struct acpi_device *device)
 
         if (strncmp(FJES_ACPI_SYMBOL, str_buf, strlen(FJES_ACPI_SYMBOL)) != 0) {
                 kfree(buffer.pointer);
-                return -ENODEV;
+                return false;
         }
         kfree(buffer.pointer);
 
+        return true;
+}
+
+static int acpi_check_extended_socket_status(struct acpi_device *device)
+{
+        unsigned long long sta;
+        acpi_status status;
+
+        status = acpi_evaluate_integer(device->handle, "_STA", NULL, &sta);
+        if (ACPI_FAILURE(status))
+                return -ENODEV;
+
+        if (!((sta & ACPI_STA_DEVICE_PRESENT) &&
+              (sta & ACPI_STA_DEVICE_ENABLED) &&
+              (sta & ACPI_STA_DEVICE_UI) &&
+              (sta & ACPI_STA_DEVICE_FUNCTIONING)))
+                return -ENODEV;
+
+        return 0;
+}
+
+static int fjes_acpi_add(struct acpi_device *device)
+{
+        struct platform_device *plat_dev;
+        acpi_status status;
+
+        if (!is_extended_socket_device(device))
+                return -ENODEV;
+
+        if (acpi_check_extended_socket_status(device))
+                return -ENODEV;
+
         status = acpi_walk_resources(device->handle, METHOD_NAME__CRS,
                                      fjes_get_acpi_resource, fjes_resource);
         if (ACPI_FAILURE(status))
@@ -1316,7 +1349,7 @@ static void fjes_netdev_setup(struct net_device *netdev)
         netdev->min_mtu = fjes_support_mtu[0];
         netdev->max_mtu = fjes_support_mtu[3];
         netdev->flags |= IFF_BROADCAST;
-        netdev->features |= NETIF_F_HW_CSUM | NETIF_F_HW_VLAN_CTAG_FILTER;
+        netdev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
 }
 
 static void fjes_irq_watch_task(struct work_struct *work)
@@ -1473,11 +1506,44 @@ static void fjes_watch_unshare_task(struct work_struct *work)
         }
 }
 
+static acpi_status
+acpi_find_extended_socket_device(acpi_handle obj_handle, u32 level,
+                                 void *context, void **return_value)
+{
+        struct acpi_device *device;
+        bool *found = context;
+        int result;
+
+        result = acpi_bus_get_device(obj_handle, &device);
+        if (result)
+                return AE_OK;
+
+        if (strcmp(acpi_device_hid(device), ACPI_MOTHERBOARD_RESOURCE_HID))
+                return AE_OK;
+
+        if (!is_extended_socket_device(device))
+                return AE_OK;
+
+        if (acpi_check_extended_socket_status(device))
+                return AE_OK;
+
+        *found = true;
+        return AE_CTRL_TERMINATE;
+}
+
 /* fjes_init_module - Driver Registration Routine */
 static int __init fjes_init_module(void)
 {
+        bool found = false;
         int result;
 
+        acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, ACPI_UINT32_MAX,
+                            acpi_find_extended_socket_device, NULL, &found,
+                            NULL);
+
+        if (!found)
+                return -ENODEV;
+
         pr_info("%s - version %s - %s\n",
                 fjes_driver_string, fjes_driver_version, fjes_copyright);
 
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index d3e73ac158ae..f9f3dba7a588 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -700,6 +700,8 @@ struct net_device_context {
 
         u32 tx_checksum_mask;
 
+        u32 tx_send_table[VRSS_SEND_TAB_SIZE];
+
         /* Ethtool settings */
         u8 duplex;
         u32 speed;
@@ -757,7 +759,6 @@ struct netvsc_device {
 
         struct nvsp_message revoke_packet;
 
-        u32 send_table[VRSS_SEND_TAB_SIZE];
         u32 max_chn;
         u32 num_chn;
         spinlock_t sc_lock; /* Protects num_sc_offered variable */
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index d35ebd993b38..8dd0b8770328 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -1136,15 +1136,11 @@ static void netvsc_receive(struct net_device *ndev,
 static void netvsc_send_table(struct hv_device *hdev,
                               struct nvsp_message *nvmsg)
 {
-        struct netvsc_device *nvscdev;
         struct net_device *ndev = hv_get_drvdata(hdev);
+        struct net_device_context *net_device_ctx = netdev_priv(ndev);
         int i;
         u32 count, *tab;
 
-        nvscdev = get_outbound_net_device(hdev);
-        if (!nvscdev)
-                return;
-
         count = nvmsg->msg.v5_msg.send_table.count;
         if (count != VRSS_SEND_TAB_SIZE) {
                 netdev_err(ndev, "Received wrong send-table size:%u\n", count);
@@ -1155,7 +1151,7 @@ static void netvsc_send_table(struct hv_device *hdev,
                       nvmsg->msg.v5_msg.send_table.offset);
 
         for (i = 0; i < count; i++)
-                nvscdev->send_table[i] = tab[i];
+                net_device_ctx->tx_send_table[i] = tab[i];
 }
 
 static void netvsc_send_vf(struct net_device_context *net_device_ctx,
@@ -1235,8 +1231,11 @@ void netvsc_channel_cb(void *context)
                 return;
 
         net_device = net_device_to_netvsc_device(ndev);
-        if (unlikely(net_device->destroy) &&
-            netvsc_channel_idle(net_device, q_idx))
+        if (unlikely(!net_device))
+                return;
+
+        if (unlikely(net_device->destroy &&
+                     netvsc_channel_idle(net_device, q_idx)))
                 return;
 
         /* commit_rd_index() -> hv_signal_on_read() needs this. */
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index bc05c895d958..5ede87f30463 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -206,17 +206,15 @@ static u16 netvsc_select_queue(struct net_device *ndev, struct sk_buff *skb,
                         void *accel_priv, select_queue_fallback_t fallback)
 {
         struct net_device_context *net_device_ctx = netdev_priv(ndev);
-        struct netvsc_device *nvsc_dev = net_device_ctx->nvdev;
+        unsigned int num_tx_queues = ndev->real_num_tx_queues;
         struct sock *sk = skb->sk;
         int q_idx = sk_tx_queue_get(sk);
 
-        if (q_idx < 0 || skb->ooo_okay ||
-            q_idx >= ndev->real_num_tx_queues) {
+        if (q_idx < 0 || skb->ooo_okay || q_idx >= num_tx_queues) {
                 u16 hash = __skb_tx_hash(ndev, skb, VRSS_SEND_TAB_SIZE);
                 int new_idx;
 
-                new_idx = nvsc_dev->send_table[hash]
-                        % nvsc_dev->num_chn;
+                new_idx = net_device_ctx->tx_send_table[hash] % num_tx_queues;
 
                 if (q_idx != new_idx && sk &&
                     sk_fullsock(sk) && rcu_access_pointer(sk->sk_dst_cache))
@@ -225,9 +223,6 @@ static u16 netvsc_select_queue(struct net_device *ndev, struct sk_buff *skb,
                 q_idx = new_idx;
         }
 
-        if (unlikely(!nvsc_dev->chan_table[q_idx].channel))
-                q_idx = 0;
-
         return q_idx;
 }
 
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index f9d0fa315a47..272b051a0199 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1883,17 +1883,6 @@ static int m88e1510_probe(struct phy_device *phydev)
         return m88e1510_hwmon_probe(phydev);
 }
 
-static void marvell_remove(struct phy_device *phydev)
-{
-#ifdef CONFIG_HWMON
-
-        struct marvell_priv *priv = phydev->priv;
-
-        if (priv && priv->hwmon_dev)
-                hwmon_device_unregister(priv->hwmon_dev);
-#endif
-}
-
 static struct phy_driver marvell_drivers[] = {
         {
                 .phy_id = MARVELL_PHY_ID_88E1101,
@@ -1974,7 +1963,6 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = &m88e1121_probe,
-                .remove = &marvell_remove,
                 .config_init = &m88e1121_config_init,
                 .config_aneg = &m88e1121_config_aneg,
                 .read_status = &marvell_read_status,
@@ -2087,7 +2075,6 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES | SUPPORTED_FIBRE,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = &m88e1510_probe,
-                .remove = &marvell_remove,
                 .config_init = &m88e1510_config_init,
                 .config_aneg = &m88e1510_config_aneg,
                 .read_status = &marvell_read_status,
@@ -2109,7 +2096,6 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = m88e1510_probe,
-                .remove = &marvell_remove,
                 .config_init = &marvell_config_init,
                 .config_aneg = &m88e1510_config_aneg,
                 .read_status = &marvell_read_status,
@@ -2127,7 +2113,6 @@ static struct phy_driver marvell_drivers[] = {
                 .phy_id_mask = MARVELL_PHY_ID_MASK,
                 .name = "Marvell 88E1545",
                 .probe = m88e1510_probe,
-                .remove = &marvell_remove,
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .config_init = &marvell_config_init,
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index daec6555f3b1..5198ccfa347f 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1864,7 +1864,7 @@ static struct phy_driver genphy_driver[] = {
         .phy_id         = 0xffffffff,
         .phy_id_mask    = 0xffffffff,
         .name           = "Generic PHY",
-        .soft_reset     = genphy_soft_reset,
+        .soft_reset     = genphy_no_soft_reset,
         .config_init    = genphy_config_init,
         .features       = PHY_GBIT_FEATURES | SUPPORTED_MII |
                           SUPPORTED_AUI | SUPPORTED_FIBRE |
diff --git a/drivers/net/phy/spi_ks8995.c b/drivers/net/phy/spi_ks8995.c
index 93ffedfa2994..1e2d4f1179da 100644
--- a/drivers/net/phy/spi_ks8995.c
+++ b/drivers/net/phy/spi_ks8995.c
@@ -491,13 +491,14 @@ static int ks8995_probe(struct spi_device *spi)
         if (err)
                 return err;
 
-        ks->regs_attr.size = ks->chip->regs_size;
         memcpy(&ks->regs_attr, &ks8995_registers_attr, sizeof(ks->regs_attr));
+        ks->regs_attr.size = ks->chip->regs_size;
 
         err = ks8995_reset(ks);
         if (err)
                 return err;
 
+        sysfs_attr_init(&ks->regs_attr.attr);
         err = sysfs_create_bin_file(&spi->dev.kobj, &ks->regs_attr);
         if (err) {
                 dev_err(&spi->dev, "unable to create sysfs file, err=%d\n",
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 4a24b5d15f5a..1b52520715ae 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2072,6 +2072,7 @@ static int team_dev_type_check_change(struct net_device *dev,
 static void team_setup(struct net_device *dev)
 {
         ether_setup(dev);
+        dev->max_mtu = ETH_MAX_MTU;
 
         dev->netdev_ops = &team_netdev_ops;
         dev->ethtool_ops = &team_ethtool_ops;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index dc1b1dd9157c..cc88cd7856f5 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -822,7 +822,18 @@ static void tun_net_uninit(struct net_device *dev)
 /* Net device open. */
 static int tun_net_open(struct net_device *dev)
 {
+        struct tun_struct *tun = netdev_priv(dev);
+        int i;
+
         netif_tx_start_all_queues(dev);
+
+        for (i = 0; i < tun->numqueues; i++) {
+                struct tun_file *tfile;
+
+                tfile = rtnl_dereference(tun->tfiles[i]);
+                tfile->socket.sk->sk_write_space(tfile->socket.sk);
+        }
+
         return 0;
 }
 
@@ -1103,9 +1114,10 @@ static unsigned int tun_chr_poll(struct file *file, poll_table *wait)
         if (!skb_array_empty(&tfile->tx_array))
                 mask |= POLLIN | POLLRDNORM;
 
-        if (sock_writeable(sk) ||
-            (!test_and_set_bit(SOCKWQ_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
-             sock_writeable(sk)))
+        if (tun->dev->flags & IFF_UP &&
+            (sock_writeable(sk) ||
+             (!test_and_set_bit(SOCKWQ_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
+              sock_writeable(sk))))
                 mask |= POLLOUT | POLLWRNORM;
 
         if (tun->dev->reg_state != NETREG_REGISTERED)
@@ -1919,6 +1931,8 @@ static int set_offload(struct tun_struct *tun, unsigned long arg)
                 return -EINVAL;
 
         tun->set_features = features;
+        tun->dev->wanted_features &= ~TUN_USER_FEATURES;
+        tun->dev->wanted_features |= features;
         netdev_update_features(tun->dev);
 
         return 0;
@@ -2570,7 +2584,6 @@ static int __init tun_init(void)
         int ret = 0;
 
         pr_info("%s, %s\n", DRV_DESCRIPTION, DRV_VERSION);
-        pr_info("%s\n", DRV_COPYRIGHT);
 
         ret = rtnl_link_register(&tun_link_ops);
         if (ret) {
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 805674550683..156f7f85e486 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -580,6 +580,10 @@ static const struct usb_device_id products[] = {
                 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x69),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
         },
+        {       /* Motorola Mapphone devices with MDM6600 */
+                USB_VENDOR_AND_INTERFACE_INFO(0x22b8, USB_CLASS_VENDOR_SPEC, 0xfb, 0xff),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
 
         /* 2. Combined interface devices matching on class+protocol */
         {       /* Huawei E367 and possibly others in "Windows mode" */
@@ -925,6 +929,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x413c, 0x81a9, 8)},    /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81b1, 8)},    /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81b3, 8)},    /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
+        {QMI_FIXED_INTF(0x413c, 0x81b6, 8)},    /* Dell Wireless 5811e */
+        {QMI_FIXED_INTF(0x413c, 0x81b6, 10)},   /* Dell Wireless 5811e */
         {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},    /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
         {QMI_FIXED_INTF(0x22de, 0x9061, 3)},    /* WeTelecom WPD-600N */
         {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)},    /* SIMCom 7230E */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 986243c932cc..0b1b9188625d 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -32,7 +32,7 @@
 #define NETNEXT_VERSION         "08"
 
 /* Information for net */
-#define NET_VERSION             "8"
+#define NET_VERSION             "9"
 
 #define DRIVER_VERSION          "v1." NETNEXT_VERSION "." NET_VERSION
 #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
@@ -501,6 +501,8 @@ enum rtl_register_content {
 #define RTL8153_RMS             RTL8153_MAX_PACKET
 #define RTL8152_TX_TIMEOUT      (5 * HZ)
 #define RTL8152_NAPI_WEIGHT     64
+#define rx_reserved_size(x)     ((x) + VLAN_ETH_HLEN + CRC_SIZE + \
+                                 sizeof(struct rx_desc) + RX_ALIGN)
 
 /* rtl8152 flags */
 enum rtl8152_flags {
@@ -1362,6 +1364,7 @@ static int alloc_all_mem(struct r8152 *tp)
         spin_lock_init(&tp->rx_lock);
         spin_lock_init(&tp->tx_lock);
         INIT_LIST_HEAD(&tp->tx_free);
+        INIT_LIST_HEAD(&tp->rx_done);
         skb_queue_head_init(&tp->tx_queue);
         skb_queue_head_init(&tp->rx_queue);
 
@@ -2252,8 +2255,7 @@ static void r8153_set_rx_early_timeout(struct r8152 *tp)
 
 static void r8153_set_rx_early_size(struct r8152 *tp)
 {
-        u32 mtu = tp->netdev->mtu;
-        u32 ocp_data = (agg_buf_sz - mtu - VLAN_ETH_HLEN - VLAN_HLEN) / 8;
+        u32 ocp_data = (agg_buf_sz - rx_reserved_size(tp->netdev->mtu)) / 4;
 
         ocp_write_word(tp, MCU_TYPE_USB, USB_RX_EARLY_SIZE, ocp_data);
 }
@@ -2898,7 +2900,8 @@ static void r8153_first_init(struct r8152 *tp)
 
         rtl_rx_vlan_en(tp, tp->netdev->features & NETIF_F_HW_VLAN_CTAG_RX);
 
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, RTL8153_RMS);
+        ocp_data = tp->netdev->mtu + VLAN_ETH_HLEN + CRC_SIZE;
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, ocp_data);
         ocp_write_byte(tp, MCU_TYPE_PLA, PLA_MTPS, MTPS_JUMBO);
 
         ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_TCR0);
@@ -2950,7 +2953,8 @@ static void r8153_enter_oob(struct r8152 *tp)
                 usleep_range(1000, 2000);
         }
 
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, RTL8153_RMS);
+        ocp_data = tp->netdev->mtu + VLAN_ETH_HLEN + CRC_SIZE;
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, ocp_data);
 
         ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_TEREDO_CFG);
         ocp_data &= ~TEREDO_WAKE_MASK;
@@ -4200,8 +4204,14 @@ static int rtl8152_change_mtu(struct net_device *dev, int new_mtu)
 
         dev->mtu = new_mtu;
 
-        if (netif_running(dev) && netif_carrier_ok(dev))
-                r8153_set_rx_early_size(tp);
+        if (netif_running(dev)) {
+                u32 rms = new_mtu + VLAN_ETH_HLEN + CRC_SIZE;
+
+                ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, rms);
+
+                if (netif_carrier_ok(dev))
+                        r8153_set_rx_early_size(tp);
+        }
 
         mutex_unlock(&tp->control);
 
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 22379da63400..d6988db1930d 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -340,6 +340,7 @@ static netdev_tx_t is_ip_tx_frame(struct sk_buff *skb, struct net_device *dev)
 
 static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev)
 {
+        int len = skb->len;
         netdev_tx_t ret = is_ip_tx_frame(skb, dev);
 
         if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
@@ -347,7 +348,7 @@ static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev)
 
                 u64_stats_update_begin(&dstats->syncp);
                 dstats->tx_pkts++;
-                dstats->tx_bytes += skb->len;
+                dstats->tx_bytes += len;
                 u64_stats_update_end(&dstats->syncp);
         } else {
                 this_cpu_inc(dev->dstats->tx_drps);
@@ -461,8 +462,10 @@ static void vrf_rt6_release(struct net_device *dev, struct net_vrf *vrf)
         }
 
         if (rt6_local) {
-                if (rt6_local->rt6i_idev)
+                if (rt6_local->rt6i_idev) {
                         in6_dev_put(rt6_local->rt6i_idev);
+                        rt6_local->rt6i_idev = NULL;
+                }
 
                 dst = &rt6_local->dst;
                 dev_put(dst->dev);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index e375560cc74e..bdb6ae16d4a8 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2976,6 +2976,44 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
         return 0;
 }
 
+static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+                              struct vxlan_config *conf)
+{
+        struct vxlan_net *vn = net_generic(net, vxlan_net_id);
+        struct vxlan_dev *vxlan = netdev_priv(dev);
+        int err;
+
+        err = vxlan_dev_configure(net, dev, conf, false);
+        if (err)
+                return err;
+
+        dev->ethtool_ops = &vxlan_ethtool_ops;
+
+        /* create an fdb entry for a valid default destination */
+        if (!vxlan_addr_any(&vxlan->default_dst.remote_ip)) {
+                err = vxlan_fdb_create(vxlan, all_zeros_mac,
+                                       &vxlan->default_dst.remote_ip,
+                                       NUD_REACHABLE | NUD_PERMANENT,
+                                       NLM_F_EXCL | NLM_F_CREATE,
+                                       vxlan->cfg.dst_port,
+                                       vxlan->default_dst.remote_vni,
+                                       vxlan->default_dst.remote_vni,
+                                       vxlan->default_dst.remote_ifindex,
+                                       NTF_SELF);
+                if (err)
+                        return err;
+        }
+
+        err = register_netdevice(dev);
+        if (err) {
+                vxlan_fdb_delete_default(vxlan, vxlan->default_dst.remote_vni);
+                return err;
+        }
+
+        list_add(&vxlan->next, &vn->vxlan_list);
+        return 0;
+}
+
 static int vxlan_nl2conf(struct nlattr *tb[], struct nlattr *data[],
                          struct net_device *dev, struct vxlan_config *conf,
                          bool changelink)
@@ -3172,8 +3210,6 @@ static int vxlan_nl2conf(struct nlattr *tb[], struct nlattr *data[],
 static int vxlan_newlink(struct net *src_net, struct net_device *dev,
                          struct nlattr *tb[], struct nlattr *data[])
 {
-        struct vxlan_net *vn = net_generic(src_net, vxlan_net_id);
-        struct vxlan_dev *vxlan = netdev_priv(dev);
         struct vxlan_config conf;
         int err;
 
@@ -3181,36 +3217,7 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
         if (err)
                 return err;
 
-        err = vxlan_dev_configure(src_net, dev, &conf, false);
-        if (err)
-                return err;
-
-        dev->ethtool_ops = &vxlan_ethtool_ops;
-
-        /* create an fdb entry for a valid default destination */
-        if (!vxlan_addr_any(&vxlan->default_dst.remote_ip)) {
-                err = vxlan_fdb_create(vxlan, all_zeros_mac,
-                                       &vxlan->default_dst.remote_ip,
-                                       NUD_REACHABLE | NUD_PERMANENT,
-                                       NLM_F_EXCL | NLM_F_CREATE,
-                                       vxlan->cfg.dst_port,
-                                       vxlan->default_dst.remote_vni,
-                                       vxlan->default_dst.remote_vni,
-                                       vxlan->default_dst.remote_ifindex,
-                                       NTF_SELF);
-                if (err)
-                        return err;
-        }
-
-        err = register_netdevice(dev);
-        if (err) {
-                vxlan_fdb_delete_default(vxlan, vxlan->default_dst.remote_vni);
-                return err;
-        }
-
-        list_add(&vxlan->next, &vn->vxlan_list);
-
-        return 0;
+        return __vxlan_dev_create(src_net, dev, &conf);
 }
 
 static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
@@ -3440,7 +3447,7 @@ struct net_device *vxlan_dev_create(struct net *net, const char *name,
         if (IS_ERR(dev))
                 return dev;
 
-        err = vxlan_dev_configure(net, dev, conf, false);
+        err = __vxlan_dev_create(net, dev, conf);
         if (err < 0) {
                 free_netdev(dev);
                 return ERR_PTR(err);
diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index a5045b5279d7..6742ae605660 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -381,8 +381,8 @@ static netdev_tx_t ucc_hdlc_tx(struct sk_buff *skb, struct net_device *dev)
         /* set bd status and length */
         bd_status = (bd_status & T_W_S) | T_R_S | T_I_S | T_L_S | T_TC_S;
 
-        iowrite16be(bd_status, &bd->status);
         iowrite16be(skb->len, &bd->length);
+        iowrite16be(bd_status, &bd->status);
 
         /* Move to next BD in the ring */
         if (!(bd_status & T_W_S))
@@ -457,7 +457,7 @@ static int hdlc_rx_done(struct ucc_hdlc_private *priv, int rx_work_limit)
         struct sk_buff *skb;
         hdlc_device *hdlc = dev_to_hdlc(dev);
         struct qe_bd *bd;
-        u32 bd_status;
+        u16 bd_status;
         u16 length, howmany = 0;
         u8 *bdbuffer;
         int i;
diff --git a/drivers/net/wimax/i2400m/usb.c b/drivers/net/wimax/i2400m/usb.c
index e7f5910a6519..f8eb66ef2944 100644
--- a/drivers/net/wimax/i2400m/usb.c
+++ b/drivers/net/wimax/i2400m/usb.c
@@ -467,6 +467,9 @@ int i2400mu_probe(struct usb_interface *iface,
         struct i2400mu *i2400mu;
         struct usb_device *usb_dev = interface_to_usbdev(iface);
 
+        if (iface->cur_altsetting->desc.bNumEndpoints < 4)
+                return -ENODEV;
+
         if (usb_dev->speed != USB_SPEED_HIGH)
                 dev_err(dev, "device not connected as high speed\n");
 
diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c
index 33fb26833cd0..d9f37ee4bfdd 100644
--- a/drivers/net/wireless/ath/ath10k/hw.c
+++ b/drivers/net/wireless/ath/ath10k/hw.c
@@ -51,7 +51,7 @@ const struct ath10k_hw_regs qca6174_regs = {
         .rtc_soc_base_address                   = 0x00000800,
         .rtc_wmac_base_address                  = 0x00001000,
         .soc_core_base_address                  = 0x0003a000,
-        .wlan_mac_base_address                  = 0x00020000,
+        .wlan_mac_base_address                  = 0x00010000,
         .ce_wrapper_base_address                = 0x00034000,
         .ce0_base_address                       = 0x00034400,
         .ce1_base_address                       = 0x00034800,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index d37b1695c64e..6927caecd48e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2319,7 +2319,7 @@ iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 
-        /* Called when we need to transmit (a) frame(s) from agg queue */
+        /* Called when we need to transmit (a) frame(s) from agg or dqa queue */
 
         iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
                                           tids, more_data, true);
@@ -2338,7 +2338,8 @@ static void __iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
         for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
                 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
 
-                if (tid_data->state != IWL_AGG_ON &&
+                if (!iwl_mvm_is_dqa_supported(mvm) &&
+                    tid_data->state != IWL_AGG_ON &&
                     tid_data->state != IWL_EMPTYING_HW_QUEUE_DELBA)
                         continue;
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index bd1dcc863d8f..b51a2853cc80 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -3135,7 +3135,7 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
                                        struct ieee80211_sta *sta,
                                        enum ieee80211_frame_release_type reason,
                                        u16 cnt, u16 tids, bool more_data,
-                                       bool agg)
+                                       bool single_sta_queue)
 {
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd cmd = {
@@ -3155,14 +3155,14 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
         for_each_set_bit(tid, &_tids, IWL_MAX_TID_COUNT)
                 cmd.awake_acs |= BIT(tid_to_ucode_ac[tid]);
 
-        /* If we're releasing frames from aggregation queues then check if the
-         * all queues combined that we're releasing frames from have
+        /* If we're releasing frames from aggregation or dqa queues then check
+         * if all the queues that we're releasing frames from, combined, have:
          *  - more frames than the service period, in which case more_data
          *    needs to be set
          *  - fewer than 'cnt' frames, in which case we need to adjust the
          *    firmware command (but do that unconditionally)
          */
-        if (agg) {
+        if (single_sta_queue) {
                 int remaining = cnt;
                 int sleep_tx_count;
 
@@ -3172,7 +3172,8 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
                         u16 n_queued;
 
                         tid_data = &mvmsta->tid_data[tid];
-                        if (WARN(tid_data->state != IWL_AGG_ON &&
+                        if (WARN(!iwl_mvm_is_dqa_supported(mvm) &&
+                                 tid_data->state != IWL_AGG_ON &&
                                  tid_data->state != IWL_EMPTYING_HW_QUEUE_DELBA,
                                  "TID %d state is %d\n",
                                  tid, tid_data->state)) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index 4be34f902278..1927ce607798 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -547,7 +547,7 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
                                        struct ieee80211_sta *sta,
                                        enum ieee80211_frame_release_type reason,
                                        u16 cnt, u16 tids, bool more_data,
-                                       bool agg);
+                                       bool single_sta_queue);
 int iwl_mvm_drain_sta(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
                       bool drain);
 void iwl_mvm_sta_modify_disable_tx(struct iwl_mvm *mvm,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index dd2b4a300819..3f37075f4cde 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -7,7 +7,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- * Copyright(c) 2016        Intel Deutschland GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -34,6 +34,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -628,8 +629,10 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
          * values.
          * Note that we don't need to make sure it isn't agg'd, since we're
          * TXing non-sta
+         * For DQA mode - we shouldn't increase it though
          */
-        atomic_inc(&mvm->pending_frames[sta_id]);
+        if (!iwl_mvm_is_dqa_supported(mvm))
+                atomic_inc(&mvm->pending_frames[sta_id]);
 
         return 0;
 }
@@ -1005,11 +1008,8 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
 
         spin_unlock(&mvmsta->lock);
 
-        /* Increase pending frames count if this isn't AMPDU */
-        if ((iwl_mvm_is_dqa_supported(mvm) &&
-             mvmsta->tid_data[tx_cmd->tid_tspec].state != IWL_AGG_ON &&
-             mvmsta->tid_data[tx_cmd->tid_tspec].state != IWL_AGG_STARTING) ||
-            (!iwl_mvm_is_dqa_supported(mvm) && !is_ampdu))
+        /* Increase pending frames count if this isn't AMPDU or DQA queue */
+        if (!iwl_mvm_is_dqa_supported(mvm) && !is_ampdu)
                 atomic_inc(&mvm->pending_frames[mvmsta->sta_id]);
 
         return 0;
@@ -1079,12 +1079,13 @@ static void iwl_mvm_check_ratid_empty(struct iwl_mvm *mvm,
         lockdep_assert_held(&mvmsta->lock);
 
         if ((tid_data->state == IWL_AGG_ON ||
-             tid_data->state == IWL_EMPTYING_HW_QUEUE_DELBA) &&
+             tid_data->state == IWL_EMPTYING_HW_QUEUE_DELBA ||
+             iwl_mvm_is_dqa_supported(mvm)) &&
             iwl_mvm_tid_queued(tid_data) == 0) {
                 /*
-                 * Now that this aggregation queue is empty tell mac80211 so it
-                 * knows we no longer have frames buffered for the station on
-                 * this TID (for the TIM bitmap calculation.)
+                 * Now that this aggregation or DQA queue is empty tell
+                 * mac80211 so it knows we no longer have frames buffered for
+                 * the station on this TID (for the TIM bitmap calculation.)
                  */
                 ieee80211_sta_set_buffered(sta, tid, false);
         }
@@ -1257,7 +1258,6 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
         u8 skb_freed = 0;
         u16 next_reclaimed, seq_ctl;
         bool is_ndp = false;
-        bool txq_agg = false; /* Is this TXQ aggregated */
 
         __skb_queue_head_init(&skbs);
 
@@ -1283,6 +1283,10 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                         info->flags |= IEEE80211_TX_STAT_ACK;
                         break;
                 case TX_STATUS_FAIL_DEST_PS:
+                        /* In DQA, the FW should have stopped the queue and not
+                         * return this status
+                         */
+                        WARN_ON(iwl_mvm_is_dqa_supported(mvm));
                         info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
                         break;
                 default:
@@ -1387,15 +1391,6 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                         bool send_eosp_ndp = false;
 
                         spin_lock_bh(&mvmsta->lock);
-                        if (iwl_mvm_is_dqa_supported(mvm)) {
-                                enum iwl_mvm_agg_state state;
-
-                                state = mvmsta->tid_data[tid].state;
-                                txq_agg = (state == IWL_AGG_ON ||
-                                        state == IWL_EMPTYING_HW_QUEUE_DELBA);
-                        } else {
-                                txq_agg = txq_id >= mvm->first_agg_queue;
-                        }
 
                         if (!is_ndp) {
                                 tid_data->next_reclaimed = next_reclaimed;
@@ -1452,11 +1447,11 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
          * If the txq is not an AMPDU queue, there is no chance we freed
          * several skbs. Check that out...
          */
-        if (txq_agg)
+        if (iwl_mvm_is_dqa_supported(mvm) || txq_id >= mvm->first_agg_queue)
                 goto out;
 
         /* We can't free more than one frame at once on a shared queue */
-        WARN_ON(!iwl_mvm_is_dqa_supported(mvm) && (skb_freed > 1));
+        WARN_ON(skb_freed > 1);
 
         /* If we have still frames for this STA nothing to do here */
         if (!atomic_sub_and_test(skb_freed, &mvm->pending_frames[sta_id]))
diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
index 5ebca1d0cfc7..b62e03d11c2e 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.c
+++ b/drivers/net/wireless/marvell/mwifiex/main.c
@@ -57,8 +57,8 @@ MODULE_PARM_DESC(mfg_mode, "manufacturing mode enable:1, disable:0");
  * In case of any errors during inittialization, this function also ensures
  * proper cleanup before exiting.
  */
-static int mwifiex_register(void *card, struct mwifiex_if_ops *if_ops,
-                            void **padapter)
+static int mwifiex_register(void *card, struct device *dev,
+                            struct mwifiex_if_ops *if_ops, void **padapter)
 {
         struct mwifiex_adapter *adapter;
         int i;
@@ -68,6 +68,7 @@ static int mwifiex_register(void *card, struct mwifiex_if_ops *if_ops,
                 return -ENOMEM;
 
         *padapter = adapter;
+        adapter->dev = dev;
         adapter->card = card;
 
         /* Save interface specific operations in adapter */
@@ -1568,12 +1569,11 @@ mwifiex_add_card(void *card, struct completion *fw_done,
 {
         struct mwifiex_adapter *adapter;
 
-        if (mwifiex_register(card, if_ops, (void **)&adapter)) {
+        if (mwifiex_register(card, dev, if_ops, (void **)&adapter)) {
                 pr_err("%s: software init failed\n", __func__);
                 goto err_init_sw;
         }
 
-        adapter->dev = dev;
         mwifiex_probe_of(adapter);
 
         adapter->iface_type = iface_type;
@@ -1718,6 +1718,9 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter)
         wiphy_unregister(adapter->wiphy);
         wiphy_free(adapter->wiphy);
 
+        if (adapter->irq_wakeup >= 0)
+                device_init_wakeup(adapter->dev, false);
+
         /* Unregister device */
         mwifiex_dbg(adapter, INFO,
                     "info: unregister device\n");
diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
index a0d918094889..b8c990d10d6e 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -2739,6 +2739,21 @@ static void mwifiex_pcie_device_dump(struct mwifiex_adapter *adapter)
         schedule_work(&card->work);
 }
 
+static void mwifiex_pcie_free_buffers(struct mwifiex_adapter *adapter)
+{
+        struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+
+        if (reg->sleep_cookie)
+                mwifiex_pcie_delete_sleep_cookie_buf(adapter);
+
+        mwifiex_pcie_delete_cmdrsp_buf(adapter);
+        mwifiex_pcie_delete_evtbd_ring(adapter);
+        mwifiex_pcie_delete_rxbd_ring(adapter);
+        mwifiex_pcie_delete_txbd_ring(adapter);
+        card->cmdrsp_buf = NULL;
+}
+
 /*
  * This function initializes the PCI-E host memory space, WCB rings, etc.
  *
@@ -2850,13 +2865,6 @@ err_enable_dev:
 
 /*
  * This function cleans up the allocated card buffers.
- *
- * The following are freed by this function -
- *      - TXBD ring buffers
- *      - RXBD ring buffers
- *      - Event BD ring buffers
- *      - Command response ring buffer
- *      - Sleep cookie buffer
  */
 static void mwifiex_cleanup_pcie(struct mwifiex_adapter *adapter)
 {
@@ -2875,6 +2883,8 @@ static void mwifiex_cleanup_pcie(struct mwifiex_adapter *adapter)
                                     "Failed to write driver not-ready signature\n");
         }
 
+        mwifiex_pcie_free_buffers(adapter);
+
         if (pdev) {
                 pci_iounmap(pdev, card->pci_mmap);
                 pci_iounmap(pdev, card->pci_mmap1);
@@ -3126,10 +3136,7 @@ err_cre_txbd:
         pci_iounmap(pdev, card->pci_mmap1);
 }
 
-/* This function cleans up the PCI-E host memory space.
- * Some code is extracted from mwifiex_unregister_dev()
- *
- */
+/* This function cleans up the PCI-E host memory space. */
 static void mwifiex_pcie_down_dev(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
@@ -3140,14 +3147,7 @@ static void mwifiex_pcie_down_dev(struct mwifiex_adapter *adapter)
 
         adapter->seq_num = 0;
 
-        if (reg->sleep_cookie)
-                mwifiex_pcie_delete_sleep_cookie_buf(adapter);
-
-        mwifiex_pcie_delete_cmdrsp_buf(adapter);
-        mwifiex_pcie_delete_evtbd_ring(adapter);
-        mwifiex_pcie_delete_rxbd_ring(adapter);
-        mwifiex_pcie_delete_txbd_ring(adapter);
-        card->cmdrsp_buf = NULL;
+        mwifiex_pcie_free_buffers(adapter);
 }
 
 static struct mwifiex_if_ops pcie_ops = {
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 829b26cd4549..8397f6c92451 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -165,13 +165,17 @@ static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->num_queues;
+        unsigned int num_queues;
         u16 index;
         struct xenvif_rx_cb *cb;
 
         BUG_ON(skb->dev != dev);
 
-        /* Drop the packet if queues are not set up */
+        /* Drop the packet if queues are not set up.
+         * This handler should be called inside an RCU read section
+         * so we don't need to enter it here explicitly.
+         */
+        num_queues = READ_ONCE(vif->num_queues);
         if (num_queues < 1)
                 goto drop;
 
@@ -222,18 +226,18 @@ static struct net_device_stats *xenvif_get_stats(struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
+        unsigned int num_queues;
         u64 rx_bytes = 0;
         u64 rx_packets = 0;
         u64 tx_bytes = 0;
         u64 tx_packets = 0;
         unsigned int index;
 
-        spin_lock(&vif->lock);
-        if (vif->queues == NULL)
-                goto out;
+        rcu_read_lock();
+        num_queues = READ_ONCE(vif->num_queues);
 
         /* Aggregate tx and rx stats from each queue */
-        for (index = 0; index < vif->num_queues; ++index) {
+        for (index = 0; index < num_queues; ++index) {
                 queue = &vif->queues[index];
                 rx_bytes += queue->stats.rx_bytes;
                 rx_packets += queue->stats.rx_packets;
@@ -241,8 +245,7 @@ static struct net_device_stats *xenvif_get_stats(struct net_device *dev)
                 tx_packets += queue->stats.tx_packets;
         }
 
-out:
-        spin_unlock(&vif->lock);
+        rcu_read_unlock();
 
         vif->dev->stats.rx_bytes = rx_bytes;
         vif->dev->stats.rx_packets = rx_packets;
@@ -378,10 +381,13 @@ static void xenvif_get_ethtool_stats(struct net_device *dev,
                                      struct ethtool_stats *stats, u64 * data)
 {
         struct xenvif *vif = netdev_priv(dev);
-        unsigned int num_queues = vif->num_queues;
+        unsigned int num_queues;
         int i;
         unsigned int queue_index;
 
+        rcu_read_lock();
+        num_queues = READ_ONCE(vif->num_queues);
+
         for (i = 0; i < ARRAY_SIZE(xenvif_stats); i++) {
                 unsigned long accum = 0;
                 for (queue_index = 0; queue_index < num_queues; ++queue_index) {
@@ -390,6 +396,8 @@ static void xenvif_get_ethtool_stats(struct net_device *dev,
                 }
                 data[i] = accum;
         }
+
+        rcu_read_unlock();
 }
 
 static void xenvif_get_strings(struct net_device *dev, u32 stringset, u8 * data)
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index f9bcf4a665bc..602d408fa25e 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -214,7 +214,7 @@ static void xenvif_fatal_tx_err(struct xenvif *vif)
         netdev_err(vif->dev, "fatal error; disabling device\n");
         vif->disabled = true;
         /* Disable the vif from queue 0's kthread */
-        if (vif->queues)
+        if (vif->num_queues)
                 xenvif_kick_thread(&vif->queues[0]);
 }
 
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index d2d7cd9145b1..a56d3eab35dd 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -495,26 +495,26 @@ static void backend_disconnect(struct backend_info *be)
         struct xenvif *vif = be->vif;
 
         if (vif) {
+                unsigned int num_queues = vif->num_queues;
                 unsigned int queue_index;
-                struct xenvif_queue *queues;
 
                 xen_unregister_watchers(vif);
 #ifdef CONFIG_DEBUG_FS
                 xenvif_debugfs_delif(vif);
 #endif /* CONFIG_DEBUG_FS */
                 xenvif_disconnect_data(vif);
-                for (queue_index = 0;
-                     queue_index < vif->num_queues;
-                     ++queue_index)
-                        xenvif_deinit_queue(&vif->queues[queue_index]);
 
-                spin_lock(&vif->lock);
-                queues = vif->queues;
+                /* At this point some of the handlers may still be active
+                 * so we need to have additional synchronization here.
+                 */
                 vif->num_queues = 0;
-                vif->queues = NULL;
-                spin_unlock(&vif->lock);
+                synchronize_net();
 
-                vfree(queues);
+                for (queue_index = 0; queue_index < num_queues; ++queue_index)
+                        xenvif_deinit_queue(&vif->queues[queue_index]);
+
+                vfree(vif->queues);
+                vif->queues = NULL;
 
                 xenvif_disconnect_ctrl(vif);
         }
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 779f516e7a4e..47a479f26e5d 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -343,8 +343,6 @@ static int __nvme_rdma_init_request(struct nvme_rdma_ctrl *ctrl,
         struct ib_device *ibdev = dev->dev;
         int ret;
 
-        BUG_ON(queue_idx >= ctrl->queue_count);
-
         ret = nvme_rdma_alloc_qe(ibdev, &req->sqe, sizeof(struct nvme_command),
                         DMA_TO_DEVICE);
         if (ret)
@@ -652,8 +650,22 @@ out_free_queues:
 
 static int nvme_rdma_init_io_queues(struct nvme_rdma_ctrl *ctrl)
 {
+        struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;
+        unsigned int nr_io_queues;
         int i, ret;
 
+        nr_io_queues = min(opts->nr_io_queues, num_online_cpus());
+        ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues);
+        if (ret)
+                return ret;
+
+        ctrl->queue_count = nr_io_queues + 1;
+        if (ctrl->queue_count < 2)
+                return 0;
+
+        dev_info(ctrl->ctrl.device,
+                "creating %d I/O queues.\n", nr_io_queues);
+
         for (i = 1; i < ctrl->queue_count; i++) {
                 ret = nvme_rdma_init_queue(ctrl, i,
                                            ctrl->ctrl.opts->queue_size);
@@ -1791,20 +1803,8 @@ static const struct nvme_ctrl_ops nvme_rdma_ctrl_ops = {
 
 static int nvme_rdma_create_io_queues(struct nvme_rdma_ctrl *ctrl)
 {
-        struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;
         int ret;
 
-        ret = nvme_set_queue_count(&ctrl->ctrl, &opts->nr_io_queues);
-        if (ret)
-                return ret;
-
-        ctrl->queue_count = opts->nr_io_queues + 1;
-        if (ctrl->queue_count < 2)
-                return 0;
-
-        dev_info(ctrl->ctrl.device,
-                "creating %d I/O queues.\n", opts->nr_io_queues);
-
         ret = nvme_rdma_init_io_queues(ctrl);
         if (ret)
                 return ret;
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 11b0a0a5f661..798653b329b2 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -425,6 +425,13 @@ void nvmet_sq_setup(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq,
         ctrl->sqs[qid] = sq;
 }
 
+static void nvmet_confirm_sq(struct percpu_ref *ref)
+{
+        struct nvmet_sq *sq = container_of(ref, struct nvmet_sq, ref);
+
+        complete(&sq->confirm_done);
+}
+
 void nvmet_sq_destroy(struct nvmet_sq *sq)
 {
         /*
@@ -433,7 +440,8 @@ void nvmet_sq_destroy(struct nvmet_sq *sq)
          */
         if (sq->ctrl && sq->ctrl->sqs && sq->ctrl->sqs[0] == sq)
                 nvmet_async_events_free(sq->ctrl);
-        percpu_ref_kill(&sq->ref);
+        percpu_ref_kill_and_confirm(&sq->ref, nvmet_confirm_sq);
+        wait_for_completion(&sq->confirm_done);
         wait_for_completion(&sq->free_done);
         percpu_ref_exit(&sq->ref);
 
@@ -461,6 +469,7 @@ int nvmet_sq_init(struct nvmet_sq *sq)
                 return ret;
         }
         init_completion(&sq->free_done);
+        init_completion(&sq->confirm_done);
 
         return 0;
 }
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index d1f06e7768ff..22f7bc6bac7f 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -223,8 +223,6 @@ static void nvme_loop_submit_async_event(struct nvme_ctrl *arg, int aer_idx)
 static int nvme_loop_init_iod(struct nvme_loop_ctrl *ctrl,
                 struct nvme_loop_iod *iod, unsigned int queue_idx)
 {
-        BUG_ON(queue_idx >= ctrl->queue_count);
-
         iod->req.cmd = &iod->cmd;
         iod->req.rsp = &iod->rsp;
         iod->queue = &ctrl->queues[queue_idx];
@@ -288,9 +286,9 @@ static struct blk_mq_ops nvme_loop_admin_mq_ops = {
 
 static void nvme_loop_destroy_admin_queue(struct nvme_loop_ctrl *ctrl)
 {
+        nvmet_sq_destroy(&ctrl->queues[0].nvme_sq);
         blk_cleanup_queue(ctrl->ctrl.admin_q);
         blk_mq_free_tag_set(&ctrl->admin_tag_set);
-        nvmet_sq_destroy(&ctrl->queues[0].nvme_sq);
 }
 
 static void nvme_loop_free_ctrl(struct nvme_ctrl *nctrl)
@@ -314,6 +312,43 @@ free_ctrl:
         kfree(ctrl);
 }
 
+static void nvme_loop_destroy_io_queues(struct nvme_loop_ctrl *ctrl)
+{
+        int i;
+
+        for (i = 1; i < ctrl->queue_count; i++)
+                nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
+}
+
+static int nvme_loop_init_io_queues(struct nvme_loop_ctrl *ctrl)
+{
+        struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;
+        unsigned int nr_io_queues;
+        int ret, i;
+
+        nr_io_queues = min(opts->nr_io_queues, num_online_cpus());
+        ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues);
+        if (ret || !nr_io_queues)
+                return ret;
+
+        dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n", nr_io_queues);
+
+        for (i = 1; i <= nr_io_queues; i++) {
+                ctrl->queues[i].ctrl = ctrl;
+                ret = nvmet_sq_init(&ctrl->queues[i].nvme_sq);
+                if (ret)
+                        goto out_destroy_queues;
+
+                ctrl->queue_count++;
+        }
+
+        return 0;
+
+out_destroy_queues:
+        nvme_loop_destroy_io_queues(ctrl);
+        return ret;
+}
+
 static int nvme_loop_configure_admin_queue(struct nvme_loop_ctrl *ctrl)
 {
         int error;
@@ -385,17 +420,13 @@ out_free_sq:
 
 static void nvme_loop_shutdown_ctrl(struct nvme_loop_ctrl *ctrl)
 {
-        int i;
-
         nvme_stop_keep_alive(&ctrl->ctrl);
 
         if (ctrl->queue_count > 1) {
                 nvme_stop_queues(&ctrl->ctrl);
                 blk_mq_tagset_busy_iter(&ctrl->tag_set,
                                         nvme_cancel_request, &ctrl->ctrl);
-
-                for (i = 1; i < ctrl->queue_count; i++)
-                        nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
+                nvme_loop_destroy_io_queues(ctrl);
         }
 
         if (ctrl->ctrl.state == NVME_CTRL_LIVE)
@@ -467,19 +498,14 @@ static void nvme_loop_reset_ctrl_work(struct work_struct *work)
         if (ret)
                 goto out_disable;
 
-        for (i = 1; i <= ctrl->ctrl.opts->nr_io_queues; i++) {
-                ctrl->queues[i].ctrl = ctrl;
-                ret = nvmet_sq_init(&ctrl->queues[i].nvme_sq);
-                if (ret)
-                        goto out_free_queues;
-
-                ctrl->queue_count++;
-        }
+        ret = nvme_loop_init_io_queues(ctrl);
+        if (ret)
+                goto out_destroy_admin;
 
-        for (i = 1; i <= ctrl->ctrl.opts->nr_io_queues; i++) {
+        for (i = 1; i < ctrl->queue_count; i++) {
                 ret = nvmf_connect_io_queue(&ctrl->ctrl, i);
                 if (ret)
-                        goto out_free_queues;
+                        goto out_destroy_io;
         }
 
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
@@ -492,9 +518,9 @@ static void nvme_loop_reset_ctrl_work(struct work_struct *work)
 
         return;
 
-out_free_queues:
-        for (i = 1; i < ctrl->queue_count; i++)
-                nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
+out_destroy_io:
+        nvme_loop_destroy_io_queues(ctrl);
+out_destroy_admin:
         nvme_loop_destroy_admin_queue(ctrl);
 out_disable:
         dev_warn(ctrl->ctrl.device, "Removing after reset failure\n");
@@ -533,25 +559,12 @@ static const struct nvme_ctrl_ops nvme_loop_ctrl_ops = {
 
 static int nvme_loop_create_io_queues(struct nvme_loop_ctrl *ctrl)
 {
-        struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;
         int ret, i;
 
-        ret = nvme_set_queue_count(&ctrl->ctrl, &opts->nr_io_queues);
-        if (ret || !opts->nr_io_queues)
+        ret = nvme_loop_init_io_queues(ctrl);
+        if (ret)
                 return ret;
 
-        dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n",
-                opts->nr_io_queues);
-
-        for (i = 1; i <= opts->nr_io_queues; i++) {
-                ctrl->queues[i].ctrl = ctrl;
-                ret = nvmet_sq_init(&ctrl->queues[i].nvme_sq);
-                if (ret)
-                        goto out_destroy_queues;
-
-                ctrl->queue_count++;
-        }
-
         memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
         ctrl->tag_set.ops = &nvme_loop_mq_ops;
         ctrl->tag_set.queue_depth = ctrl->ctrl.opts->queue_size;
@@ -575,7 +588,7 @@ static int nvme_loop_create_io_queues(struct nvme_loop_ctrl *ctrl)
                 goto out_free_tagset;
         }
 
-        for (i = 1; i <= opts->nr_io_queues; i++) {
+        for (i = 1; i < ctrl->queue_count; i++) {
                 ret = nvmf_connect_io_queue(&ctrl->ctrl, i);
                 if (ret)
                         goto out_cleanup_connect_q;
@@ -588,8 +601,7 @@ out_cleanup_connect_q:
 out_free_tagset:
         blk_mq_free_tag_set(&ctrl->tag_set);
 out_destroy_queues:
-        for (i = 1; i < ctrl->queue_count; i++)
-                nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
+        nvme_loop_destroy_io_queues(ctrl);
         return ret;
 }
 
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 1370eee0a3c0..f7ff15f17ca9 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -73,6 +73,7 @@ struct nvmet_sq {
         u16                     qid;
         u16                     size;
         struct completion       free_done;
+        struct completion       confirm_done;
 };
 
 /**
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 9aa1da3778b3..ecc4fe862561 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -703,11 +703,6 @@ static void nvmet_rdma_handle_command(struct nvmet_rdma_queue *queue,
 {
         u16 status;
 
-        cmd->queue = queue;
-        cmd->n_rdma = 0;
-        cmd->req.port = queue->port;
-
-
         ib_dma_sync_single_for_cpu(queue->dev->device,
                 cmd->cmd->sge[0].addr, cmd->cmd->sge[0].length,
                 DMA_FROM_DEVICE);
@@ -760,9 +755,12 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc)
 
         cmd->queue = queue;
         rsp = nvmet_rdma_get_rsp(queue);
+        rsp->queue = queue;
         rsp->cmd = cmd;
         rsp->flags = 0;
         rsp->req.cmd = cmd->nvme_cmd;
+        rsp->req.port = queue->port;
+        rsp->n_rdma = 0;
 
         if (unlikely(queue->state != NVMET_RDMA_Q_LIVE)) {
                 unsigned long flags;
diff --git a/drivers/parport/share.c b/drivers/parport/share.c
index bc090daa850a..5dc53d420ca8 100644
--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -939,8 +939,10 @@ parport_register_dev_model(struct parport *port, const char *name,
          * pardevice fields. -arca
          */
         port->ops->init_state(par_dev, par_dev->state);
-        port->proc_device = par_dev;
-        parport_device_proc_register(par_dev);
+        if (!test_and_set_bit(PARPORT_DEVPROC_REGISTERED, &port->devflags)) {
+                port->proc_device = par_dev;
+                parport_device_proc_register(par_dev);
+        }
 
         return par_dev;
 
diff --git a/drivers/pci/dwc/pci-exynos.c b/drivers/pci/dwc/pci-exynos.c
index 993b650ef275..44f774c12fb2 100644
--- a/drivers/pci/dwc/pci-exynos.c
+++ b/drivers/pci/dwc/pci-exynos.c
@@ -132,10 +132,6 @@ static int exynos5440_pcie_get_mem_resources(struct platform_device *pdev,
         struct device *dev = pci->dev;
         struct resource *res;
 
-        /* If using the PHY framework, doesn't need to get other resource */
-        if (ep->using_phy)
-                return 0;
-
         ep->mem_res = devm_kzalloc(dev, sizeof(*ep->mem_res), GFP_KERNEL);
         if (!ep->mem_res)
                 return -ENOMEM;
@@ -145,6 +141,10 @@ static int exynos5440_pcie_get_mem_resources(struct platform_device *pdev,
         if (IS_ERR(ep->mem_res->elbi_base))
                 return PTR_ERR(ep->mem_res->elbi_base);
 
+        /* If using the PHY framework, doesn't need to get other resource */
+        if (ep->using_phy)
+                return 0;
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
         ep->mem_res->phy_base = devm_ioremap_resource(dev, res);
         if (IS_ERR(ep->mem_res->phy_base))
diff --git a/drivers/pci/host/pci-thunder-pem.c b/drivers/pci/host/pci-thunder-pem.c
index 52b5bdccf5f0..b89c373555c5 100644
--- a/drivers/pci/host/pci-thunder-pem.c
+++ b/drivers/pci/host/pci-thunder-pem.c
@@ -14,6 +14,7 @@
  * Copyright (C) 2015 - 2016 Cavium, Inc.
  */
 
+#include <linux/bitfield.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/of_address.h>
@@ -334,6 +335,50 @@ static int thunder_pem_init(struct device *dev, struct pci_config_window *cfg,
 
 #if defined(CONFIG_ACPI) && defined(CONFIG_PCI_QUIRKS)
 
+#define PEM_RES_BASE            0x87e0c0000000UL
+#define PEM_NODE_MASK           GENMASK(45, 44)
+#define PEM_INDX_MASK           GENMASK(26, 24)
+#define PEM_MIN_DOM_IN_NODE     4
+#define PEM_MAX_DOM_IN_NODE     10
+
+static void thunder_pem_reserve_range(struct device *dev, int seg,
+                                      struct resource *r)
+{
+        resource_size_t start = r->start, end = r->end;
+        struct resource *res;
+        const char *regionid;
+
+        regionid = kasprintf(GFP_KERNEL, "PEM RC:%d", seg);
+        if (!regionid)
+                return;
+
+        res = request_mem_region(start, end - start + 1, regionid);
+        if (res)
+                res->flags &= ~IORESOURCE_BUSY;
+        else
+                kfree(regionid);
+
+        dev_info(dev, "%pR %s reserved\n", r,
+                 res ? "has been" : "could not be");
+}
+
+static void thunder_pem_legacy_fw(struct acpi_pci_root *root,
+                                 struct resource *res_pem)
+{
+        int node = acpi_get_node(root->device->handle);
+        int index;
+
+        if (node == NUMA_NO_NODE)
+                node = 0;
+
+        index = root->segment - PEM_MIN_DOM_IN_NODE;
+        index -= node * PEM_MAX_DOM_IN_NODE;
+        res_pem->start = PEM_RES_BASE | FIELD_PREP(PEM_NODE_MASK, node) |
+                                        FIELD_PREP(PEM_INDX_MASK, index);
+        res_pem->end = res_pem->start + SZ_16M - 1;
+        res_pem->flags = IORESOURCE_MEM;
+}
+
 static int thunder_pem_acpi_init(struct pci_config_window *cfg)
 {
         struct device *dev = cfg->parent;
@@ -346,10 +391,17 @@ static int thunder_pem_acpi_init(struct pci_config_window *cfg)
         if (!res_pem)
                 return -ENOMEM;
 
-        ret = acpi_get_rc_resources(dev, "THRX0002", root->segment, res_pem);
+        ret = acpi_get_rc_resources(dev, "CAVA02B", root->segment, res_pem);
+
+        /*
+         * If we fail to gather resources it means that we run with old
+         * FW where we need to calculate PEM-specific resources manually.
+         */
         if (ret) {
-                dev_err(dev, "can't get rc base address\n");
-                return ret;
+                thunder_pem_legacy_fw(root, res_pem);
+                /* Reserve PEM-specific resources and PCI configuration space */
+                thunder_pem_reserve_range(dev, root->segment, res_pem);
+                thunder_pem_reserve_range(dev, root->segment, &cfg->res);
         }
 
         return thunder_pem_init(dev, cfg, res_pem);
diff --git a/drivers/pci/host/pcie-iproc-bcma.c b/drivers/pci/host/pcie-iproc-bcma.c
index bd4c9ec25edc..384c27e664fe 100644
--- a/drivers/pci/host/pcie-iproc-bcma.c
+++ b/drivers/pci/host/pcie-iproc-bcma.c
@@ -44,8 +44,7 @@ static int iproc_pcie_bcma_probe(struct bcma_device *bdev)
 {
         struct device *dev = &bdev->dev;
         struct iproc_pcie *pcie;
-        LIST_HEAD(res);
-        struct resource res_mem;
+        LIST_HEAD(resources);
         int ret;
 
         pcie = devm_kzalloc(dev, sizeof(*pcie), GFP_KERNEL);
@@ -63,22 +62,23 @@ static int iproc_pcie_bcma_probe(struct bcma_device *bdev)
 
         pcie->base_addr = bdev->addr;
 
-        res_mem.start = bdev->addr_s[0];
-        res_mem.end = bdev->addr_s[0] + SZ_128M - 1;
-        res_mem.name = "PCIe MEM space";
-        res_mem.flags = IORESOURCE_MEM;
-        pci_add_resource(&res, &res_mem);
+        pcie->mem.start = bdev->addr_s[0];
+        pcie->mem.end = bdev->addr_s[0] + SZ_128M - 1;
+        pcie->mem.name = "PCIe MEM space";
+        pcie->mem.flags = IORESOURCE_MEM;
+        pci_add_resource(&resources, &pcie->mem);
 
         pcie->map_irq = iproc_pcie_bcma_map_irq;
 
-        ret = iproc_pcie_setup(pcie, &res);
-        if (ret)
+        ret = iproc_pcie_setup(pcie, &resources);
+        if (ret) {
                 dev_err(dev, "PCIe controller setup failed\n");
-
-        pci_free_resource_list(&res);
+                pci_free_resource_list(&resources);
+                return ret;
+        }
 
         bcma_set_drvdata(bdev, pcie);
-        return ret;
+        return 0;
 }
 
 static void iproc_pcie_bcma_remove(struct bcma_device *bdev)
diff --git a/drivers/pci/host/pcie-iproc-platform.c b/drivers/pci/host/pcie-iproc-platform.c
index f4909bb0b2ad..8c6a327ca6cd 100644
--- a/drivers/pci/host/pcie-iproc-platform.c
+++ b/drivers/pci/host/pcie-iproc-platform.c
@@ -51,7 +51,7 @@ static int iproc_pcie_pltfm_probe(struct platform_device *pdev)
         struct device_node *np = dev->of_node;
         struct resource reg;
         resource_size_t iobase = 0;
-        LIST_HEAD(res);
+        LIST_HEAD(resources);
         int ret;
 
         pcie = devm_kzalloc(dev, sizeof(*pcie), GFP_KERNEL);
@@ -96,10 +96,10 @@ static int iproc_pcie_pltfm_probe(struct platform_device *pdev)
                 pcie->phy = NULL;
         }
 
-        ret = of_pci_get_host_bridge_resources(np, 0, 0xff, &res, &iobase);
+        ret = of_pci_get_host_bridge_resources(np, 0, 0xff, &resources,
+                                               &iobase);
         if (ret) {
-                dev_err(dev,
-                        "unable to get PCI host bridge resources\n");
+                dev_err(dev, "unable to get PCI host bridge resources\n");
                 return ret;
         }
 
@@ -112,14 +112,15 @@ static int iproc_pcie_pltfm_probe(struct platform_device *pdev)
                 pcie->map_irq = of_irq_parse_and_map_pci;
         }
 
-        ret = iproc_pcie_setup(pcie, &res);
-        if (ret)
+        ret = iproc_pcie_setup(pcie, &resources);
+        if (ret) {
                 dev_err(dev, "PCIe controller setup failed\n");
-
-        pci_free_resource_list(&res);
+                pci_free_resource_list(&resources);
+                return ret;
+        }
 
         platform_set_drvdata(pdev, pcie);
-        return ret;
+        return 0;
 }
 
 static int iproc_pcie_pltfm_remove(struct platform_device *pdev)
diff --git a/drivers/pci/host/pcie-iproc.h b/drivers/pci/host/pcie-iproc.h
index 04fed8e907f1..0bbe2ea44f3e 100644
--- a/drivers/pci/host/pcie-iproc.h
+++ b/drivers/pci/host/pcie-iproc.h
@@ -90,6 +90,7 @@ struct iproc_pcie {
 #ifdef CONFIG_ARM
         struct pci_sys_data sysdata;
 #endif
+        struct resource mem;
         struct pci_bus *root_bus;
         struct phy *phy;
         int (*map_irq)(const struct pci_dev *, u8, u8);
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 973472c23d89..1dfa10cc566b 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -478,7 +478,7 @@ static void aspm_calc_l1ss_info(struct pcie_link_state *link,
 
 static void pcie_aspm_cap_init(struct pcie_link_state *link, int blacklist)
 {
-        struct pci_dev *child, *parent = link->pdev;
+        struct pci_dev *child = link->downstream, *parent = link->pdev;
         struct pci_bus *linkbus = parent->subordinate;
         struct aspm_register_info upreg, dwreg;
 
@@ -491,9 +491,7 @@ static void pcie_aspm_cap_init(struct pcie_link_state *link, int blacklist)
 
         /* Get upstream/downstream components' register state */
         pcie_get_aspm_reg(parent, &upreg);
-        child = pci_function_0(linkbus);
         pcie_get_aspm_reg(child, &dwreg);
-        link->downstream = child;
 
         /*
          * If ASPM not supported, don't mess with the clocks and link,
@@ -800,6 +798,7 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev)
         INIT_LIST_HEAD(&link->children);
         INIT_LIST_HEAD(&link->link);
         link->pdev = pdev;
+        link->downstream = pci_function_0(pdev->subordinate);
 
         /*
          * Root Ports and PCI/PCI-X to PCIe Bridges are roots of PCIe
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index f754453fe754..673683660b5c 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2174,6 +2174,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LSI_LOGIC, 0x005d, quirk_blacklist_vpd);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LSI_LOGIC, 0x005f, quirk_blacklist_vpd);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATTANSIC, PCI_ANY_ID,
                 quirk_blacklist_vpd);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_QLOGIC, 0x2261, quirk_blacklist_vpd);
 
 /*
  * For Broadcom 5706, 5708, 5709 rev. A nics, any read beyond the
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index dc5277ad1b5a..005cadb7a3f8 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -449,6 +449,7 @@ config PHY_QCOM_UFS
 config PHY_QCOM_USB_HS
         tristate "Qualcomm USB HS PHY module"
         depends on USB_ULPI_BUS
+        depends on EXTCON || !EXTCON # if EXTCON=m, this cannot be built-in
         select GENERIC_PHY
         help
           Support for the USB high-speed ULPI compliant phy on Qualcomm
@@ -510,12 +511,4 @@ config PHY_MESON8B_USB2
           and GXBB SoCs.
           If unsure, say N.
 
-config PHY_NSP_USB3
-        tristate "Broadcom NorthStar plus USB3 PHY driver"
-        depends on OF && (ARCH_BCM_NSP || COMPILE_TEST)
-        select GENERIC_PHY
-        default ARCH_BCM_NSP
-        help
-          Enable this to support the Broadcom Northstar plus USB3 PHY.
-          If unsure, say N.
 endmenu
diff --git a/drivers/phy/Makefile b/drivers/phy/Makefile
index e7b0feb1e125..dd8f3b5d2918 100644
--- a/drivers/phy/Makefile
+++ b/drivers/phy/Makefile
@@ -62,4 +62,3 @@ obj-$(CONFIG_PHY_CYGNUS_PCIE)		+= phy-bcm-cygnus-pcie.o
 obj-$(CONFIG_ARCH_TEGRA) += tegra/
 obj-$(CONFIG_PHY_NS2_PCIE)              += phy-bcm-ns2-pcie.o
 obj-$(CONFIG_PHY_MESON8B_USB2)          += phy-meson8b-usb2.o
-obj-$(CONFIG_PHY_NSP_USB3)              += phy-bcm-nsp-usb3.o
diff --git a/drivers/phy/phy-bcm-nsp-usb3.c b/drivers/phy/phy-bcm-nsp-usb3.c
deleted file mode 100644
index 49024eaa5545..000000000000
--- a/drivers/phy/phy-bcm-nsp-usb3.c
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- * Copyright (C) 2016 Broadcom
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation version 2.
- *
- * This program is distributed "as is" WITHOUT ANY WARRANTY of any
- * kind, whether express or implied; without even the implied warranty
- * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/delay.h>
-#include <linux/io.h>
-#include <linux/kernel.h>
-#include <linux/mfd/syscon.h>
-#include <linux/mdio.h>
-#include <linux/module.h>
-#include <linux/of.h>
-#include <linux/of_address.h>
-#include <linux/phy/phy.h>
-#include <linux/regmap.h>
-
-#define NSP_USB3_RST_CTRL_OFFSET        0x3f8
-
-/* mdio reg access */
-#define NSP_USB3_PHY_BASE_ADDR_REG      0x1f
-
-#define NSP_USB3_PHY_PLL30_BLOCK        0x8000
-#define NSP_USB3_PLL_CONTROL            0x01
-#define NSP_USB3_PLLA_CONTROL0          0x0a
-#define NSP_USB3_PLLA_CONTROL1          0x0b
-
-#define NSP_USB3_PHY_TX_PMD_BLOCK       0x8040
-#define NSP_USB3_TX_PMD_CONTROL1        0x01
-
-#define NSP_USB3_PHY_PIPE_BLOCK         0x8060
-#define NSP_USB3_LFPS_CMP               0x02
-#define NSP_USB3_LFPS_DEGLITCH          0x03
-
-struct nsp_usb3_phy {
-        struct regmap *usb3_ctrl;
-        struct phy *phy;
-        struct mdio_device *mdiodev;
-};
-
-static int nsp_usb3_phy_init(struct phy *phy)
-{
-        struct nsp_usb3_phy *iphy = phy_get_drvdata(phy);
-        struct mii_bus *bus = iphy->mdiodev->bus;
-        int addr = iphy->mdiodev->addr;
-        u32 data;
-        int rc;
-
-        rc = regmap_read(iphy->usb3_ctrl, 0, &data);
-        if (rc)
-                return rc;
-        data |= 1;
-        rc = regmap_write(iphy->usb3_ctrl, 0, data);
-        if (rc)
-                return rc;
-
-        rc = regmap_write(iphy->usb3_ctrl, NSP_USB3_RST_CTRL_OFFSET, 1);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PHY_BASE_ADDR_REG,
-                           NSP_USB3_PHY_PLL30_BLOCK);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLL_CONTROL, 0x1000);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLLA_CONTROL0, 0x6400);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLLA_CONTROL1, 0xc000);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLLA_CONTROL1, 0x8000);
-        if (rc)
-                return rc;
-
-        rc = regmap_write(iphy->usb3_ctrl, NSP_USB3_RST_CTRL_OFFSET, 0);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLL_CONTROL, 0x9000);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PHY_BASE_ADDR_REG,
-                           NSP_USB3_PHY_PIPE_BLOCK);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_LFPS_CMP, 0xf30d);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_LFPS_DEGLITCH, 0x6302);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PHY_BASE_ADDR_REG,
-                           NSP_USB3_PHY_TX_PMD_BLOCK);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_TX_PMD_CONTROL1, 0x1003);
-
-        return rc;
-}
-
-static struct phy_ops nsp_usb3_phy_ops = {
-        .init   = nsp_usb3_phy_init,
-        .owner  = THIS_MODULE,
-};
-
-static int nsp_usb3_phy_probe(struct mdio_device *mdiodev)
-{
-        struct device *dev = &mdiodev->dev;
-        struct phy_provider *provider;
-        struct nsp_usb3_phy *iphy;
-
-        iphy = devm_kzalloc(dev, sizeof(*iphy), GFP_KERNEL);
-        if (!iphy)
-                return -ENOMEM;
-        iphy->mdiodev = mdiodev;
-
-        iphy->usb3_ctrl = syscon_regmap_lookup_by_phandle(dev->of_node,
-                                                 "usb3-ctrl-syscon");
-        if (IS_ERR(iphy->usb3_ctrl))
-                return PTR_ERR(iphy->usb3_ctrl);
-
-        iphy->phy = devm_phy_create(dev, dev->of_node, &nsp_usb3_phy_ops);
-        if (IS_ERR(iphy->phy)) {
-                dev_err(dev, "failed to create PHY\n");
-                return PTR_ERR(iphy->phy);
-        }
-
-        phy_set_drvdata(iphy->phy, iphy);
-
-        provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
-        if (IS_ERR(provider)) {
-                dev_err(dev, "could not register PHY provider\n");
-                return PTR_ERR(provider);
-        }
-
-        return 0;
-}
-
-static const struct of_device_id nsp_usb3_phy_of_match[] = {
-        {.compatible = "brcm,nsp-usb3-phy",},
-        { /* sentinel */ }
-};
-
-static struct mdio_driver nsp_usb3_phy_driver = {
-        .mdiodrv = {
-                .driver = {
-                        .name = "nsp-usb3-phy",
-                        .of_match_table = nsp_usb3_phy_of_match,
-                },
-        },
-        .probe = nsp_usb3_phy_probe,
-};
-
-mdio_module_driver(nsp_usb3_phy_driver);
-
-MODULE_DESCRIPTION("Broadcom NSP USB3 PHY driver");
-MODULE_LICENSE("GPL v2");
-MODULE_AUTHOR("Yendapally Reddy Dhananjaya Reddy <yendapally.reddy@broadcom.com");
diff --git a/drivers/phy/phy-exynos-pcie.c b/drivers/phy/phy-exynos-pcie.c
index 4f60b83641d5..60baf25d98e2 100644
--- a/drivers/phy/phy-exynos-pcie.c
+++ b/drivers/phy/phy-exynos-pcie.c
@@ -254,8 +254,8 @@ static int exynos_pcie_phy_probe(struct platform_device *pdev)
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
         exynos_phy->blk_base = devm_ioremap_resource(dev, res);
-        if (IS_ERR(exynos_phy->phy_base))
-                return PTR_ERR(exynos_phy->phy_base);
+        if (IS_ERR(exynos_phy->blk_base))
+                return PTR_ERR(exynos_phy->blk_base);
 
         exynos_phy->drv_data = drv_data;
 
diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
index 7671424d46cb..31a3a98d067c 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
@@ -667,11 +667,11 @@ static const char * const uart_ao_b_groups[] = {
 };
 
 static const char * const i2c_ao_groups[] = {
-        "i2c_sdk_ao", "i2c_sda_ao",
+        "i2c_sck_ao", "i2c_sda_ao",
 };
 
 static const char * const i2c_slave_ao_groups[] = {
-        "i2c_slave_sdk_ao", "i2c_slave_sda_ao",
+        "i2c_slave_sck_ao", "i2c_slave_sda_ao",
 };
 
 static const char * const remote_input_ao_groups[] = {
diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c
index 676efcc032d2..3ae8066bc127 100644
--- a/drivers/pinctrl/pinctrl-st.c
+++ b/drivers/pinctrl/pinctrl-st.c
@@ -1285,6 +1285,22 @@ static void st_gpio_irq_unmask(struct irq_data *d)
         writel(BIT(d->hwirq), bank->base + REG_PIO_SET_PMASK);
 }
 
+static int st_gpio_irq_request_resources(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+
+        st_gpio_direction_input(gc, d->hwirq);
+
+        return gpiochip_lock_as_irq(gc, d->hwirq);
+}
+
+static void st_gpio_irq_release_resources(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+
+        gpiochip_unlock_as_irq(gc, d->hwirq);
+}
+
 static int st_gpio_irq_set_type(struct irq_data *d, unsigned type)
 {
         struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
@@ -1438,12 +1454,14 @@ static struct gpio_chip st_gpio_template = {
 };
 
 static struct irq_chip st_gpio_irqchip = {
-        .name           = "GPIO",
-        .irq_disable    = st_gpio_irq_mask,
-        .irq_mask       = st_gpio_irq_mask,
-        .irq_unmask     = st_gpio_irq_unmask,
-        .irq_set_type   = st_gpio_irq_set_type,
-        .flags          = IRQCHIP_SKIP_SET_WAKE,
+        .name                   = "GPIO",
+        .irq_request_resources  = st_gpio_irq_request_resources,
+        .irq_release_resources  = st_gpio_irq_release_resources,
+        .irq_disable            = st_gpio_irq_mask,
+        .irq_mask               = st_gpio_irq_mask,
+        .irq_unmask             = st_gpio_irq_unmask,
+        .irq_set_type           = st_gpio_irq_set_type,
+        .flags                  = IRQCHIP_SKIP_SET_WAKE,
 };
 
 static int st_gpiolib_register_bank(struct st_pinctrl *info,
diff --git a/drivers/pinctrl/qcom/pinctrl-ipq4019.c b/drivers/pinctrl/qcom/pinctrl-ipq4019.c
index b68ae424cee2..743d1f458205 100644
--- a/drivers/pinctrl/qcom/pinctrl-ipq4019.c
+++ b/drivers/pinctrl/qcom/pinctrl-ipq4019.c
@@ -405,6 +405,36 @@ static const struct msm_pingroup ipq4019_groups[] = {
         PINGROUP(67, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
         PINGROUP(68, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
         PINGROUP(69, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(70, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(71, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(72, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(73, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(74, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(75, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(76, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(77, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(78, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(79, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(80, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(81, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(82, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(83, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(84, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(85, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(86, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(87, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(88, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(89, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(90, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(91, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(92, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(93, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(94, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(95, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(96, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(97, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(98, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(99, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
 };
 
 static const struct msm_pinctrl_soc_data ipq4019_pinctrl = {
diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
index f8e9e1c2b2f6..273badd92561 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -422,6 +422,20 @@ static int msm_gpio_direction_output(struct gpio_chip *chip, unsigned offset, in
         return 0;
 }
 
+static int msm_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
+{
+        struct msm_pinctrl *pctrl = gpiochip_get_data(chip);
+        const struct msm_pingroup *g;
+        u32 val;
+
+        g = &pctrl->soc->groups[offset];
+
+        val = readl(pctrl->regs + g->ctl_reg);
+
+        /* 0 = output, 1 = input */
+        return val & BIT(g->oe_bit) ? 0 : 1;
+}
+
 static int msm_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
         const struct msm_pingroup *g;
@@ -510,6 +524,7 @@ static void msm_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
 static struct gpio_chip msm_gpio_template = {
         .direction_input  = msm_gpio_direction_input,
         .direction_output = msm_gpio_direction_output,
+        .get_direction    = msm_gpio_get_direction,
         .get              = msm_gpio_get,
         .set              = msm_gpio_set,
         .request          = gpiochip_generic_request,
@@ -594,10 +609,6 @@ static void msm_gpio_irq_unmask(struct irq_data *d)
 
         raw_spin_lock_irqsave(&pctrl->lock, flags);
 
-        val = readl(pctrl->regs + g->intr_status_reg);
-        val &= ~BIT(g->intr_status_bit);
-        writel(val, pctrl->regs + g->intr_status_reg);
-
         val = readl(pctrl->regs + g->intr_cfg_reg);
         val |= BIT(g->intr_enable_bit);
         writel(val, pctrl->regs + g->intr_cfg_reg);
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
index f9ddba7decc1..d7aa22cff480 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -988,9 +988,16 @@ samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d,
 
         for (i = 0; i < ctrl->nr_ext_resources + 1; i++) {
                 res = platform_get_resource(pdev, IORESOURCE_MEM, i);
-                virt_base[i] = devm_ioremap_resource(&pdev->dev, res);
-                if (IS_ERR(virt_base[i]))
-                        return ERR_CAST(virt_base[i]);
+                if (!res) {
+                        dev_err(&pdev->dev, "failed to get mem%d resource\n", i);
+                        return ERR_PTR(-EINVAL);
+                }
+                virt_base[i] = devm_ioremap(&pdev->dev, res->start,
+                                                resource_size(res));
+                if (!virt_base[i]) {
+                        dev_err(&pdev->dev, "failed to ioremap %pR\n", res);
+                        return ERR_PTR(-EIO);
+                }
         }
 
         bank = d->pin_banks;
diff --git a/drivers/pinctrl/ti/Kconfig b/drivers/pinctrl/ti/Kconfig
index 815a88673d38..542077069391 100644
--- a/drivers/pinctrl/ti/Kconfig
+++ b/drivers/pinctrl/ti/Kconfig
@@ -1,6 +1,6 @@
 config PINCTRL_TI_IODELAY
         tristate "TI IODelay Module pinconf driver"
-        depends on OF
+        depends on OF && (SOC_DRA7XX || COMPILE_TEST)
         select GENERIC_PINCTRL_GROUPS
         select GENERIC_PINMUX_FUNCTIONS
         select GENERIC_PINCONF
diff --git a/drivers/pinctrl/uniphier/pinctrl-uniphier-ld11.c b/drivers/pinctrl/uniphier/pinctrl-uniphier-ld11.c
index 77a0236ee781..83f8864fa76a 100644
--- a/drivers/pinctrl/uniphier/pinctrl-uniphier-ld11.c
+++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-ld11.c
@@ -390,22 +390,22 @@ static const struct pinctrl_pin_desc uniphier_ld11_pins[] = {
         UNIPHIER_PINCTRL_PIN(140, "AO1D0", 140,
                              140, UNIPHIER_PIN_DRV_1BIT,
                              140, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(141, "TCON0", 141,
+        UNIPHIER_PINCTRL_PIN(141, "AO1D1", 141,
                              141, UNIPHIER_PIN_DRV_1BIT,
                              141, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(142, "TCON1", 142,
+        UNIPHIER_PINCTRL_PIN(142, "AO1D2", 142,
                              142, UNIPHIER_PIN_DRV_1BIT,
                              142, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(143, "TCON2", 143,
+        UNIPHIER_PINCTRL_PIN(143, "XIRQ9", 143,
                              143, UNIPHIER_PIN_DRV_1BIT,
                              143, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(144, "TCON3", 144,
+        UNIPHIER_PINCTRL_PIN(144, "XIRQ10", 144,
                              144, UNIPHIER_PIN_DRV_1BIT,
                              144, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(145, "TCON4", 145,
+        UNIPHIER_PINCTRL_PIN(145, "XIRQ11", 145,
                              145, UNIPHIER_PIN_DRV_1BIT,
                              145, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(146, "TCON5", 146,
+        UNIPHIER_PINCTRL_PIN(146, "XIRQ13", 146,
                              146, UNIPHIER_PIN_DRV_1BIT,
                              146, UNIPHIER_PIN_PULL_DOWN),
         UNIPHIER_PINCTRL_PIN(147, "PWMA", 147,
diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index 5be4783e40d4..dea98ffb6f60 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -103,15 +103,6 @@ static struct quirk_entry quirk_asus_x200ca = {
         .wapf = 2,
 };
 
-static struct quirk_entry quirk_no_rfkill = {
-        .no_rfkill = true,
-};
-
-static struct quirk_entry quirk_no_rfkill_wapf4 = {
-        .wapf = 4,
-        .no_rfkill = true,
-};
-
 static struct quirk_entry quirk_asus_ux303ub = {
         .wmi_backlight_native = true,
 };
@@ -194,7 +185,7 @@ static const struct dmi_system_id asus_quirks[] = {
                         DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
                         DMI_MATCH(DMI_PRODUCT_NAME, "X456UA"),
                 },
-                .driver_data = &quirk_no_rfkill_wapf4,
+                .driver_data = &quirk_asus_wapf4,
         },
         {
                 .callback = dmi_matched,
@@ -203,7 +194,7 @@ static const struct dmi_system_id asus_quirks[] = {
                         DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
                         DMI_MATCH(DMI_PRODUCT_NAME, "X456UF"),
                 },
-                .driver_data = &quirk_no_rfkill_wapf4,
+                .driver_data = &quirk_asus_wapf4,
         },
         {
                 .callback = dmi_matched,
@@ -369,42 +360,6 @@ static const struct dmi_system_id asus_quirks[] = {
         },
         {
                 .callback = dmi_matched,
-                .ident = "ASUSTeK COMPUTER INC. X555UB",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "X555UB"),
-                },
-                .driver_data = &quirk_no_rfkill,
-        },
-        {
-                .callback = dmi_matched,
-                .ident = "ASUSTeK COMPUTER INC. N552VW",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N552VW"),
-                },
-                .driver_data = &quirk_no_rfkill,
-        },
-        {
-                .callback = dmi_matched,
-                .ident = "ASUSTeK COMPUTER INC. U303LB",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "U303LB"),
-                },
-                .driver_data = &quirk_no_rfkill,
-        },
-        {
-                .callback = dmi_matched,
-                .ident = "ASUSTeK COMPUTER INC. Z550MA",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Z550MA"),
-                },
-                .driver_data = &quirk_no_rfkill,
-        },
-        {
-                .callback = dmi_matched,
                 .ident = "ASUSTeK COMPUTER INC. UX303UB",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 43cb680adbb4..8fe5890bf539 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -159,6 +159,8 @@ MODULE_LICENSE("GPL");
 #define USB_INTEL_XUSB2PR               0xD0
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI   0x9c31
 
+static const char * const ashs_ids[] = { "ATK4001", "ATK4002", NULL };
+
 struct bios_args {
         u32 arg0;
         u32 arg1;
@@ -2051,6 +2053,16 @@ static int asus_wmi_fan_init(struct asus_wmi *asus)
         return 0;
 }
 
+static bool ashs_present(void)
+{
+        int i = 0;
+        while (ashs_ids[i]) {
+                if (acpi_dev_found(ashs_ids[i++]))
+                        return true;
+        }
+        return false;
+}
+
 /*
  * WMI Driver
  */
@@ -2095,7 +2107,11 @@ static int asus_wmi_add(struct platform_device *pdev)
         if (err)
                 goto fail_leds;
 
-        if (!asus->driver->quirks->no_rfkill) {
+        asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_WLAN, &result);
+        if (result & (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT))
+                asus->driver->wlan_ctrl_by_user = 1;
+
+        if (!(asus->driver->wlan_ctrl_by_user && ashs_present())) {
                 err = asus_wmi_rfkill_init(asus);
                 if (err)
                         goto fail_rfkill;
@@ -2134,10 +2150,6 @@ static int asus_wmi_add(struct platform_device *pdev)
         if (err)
                 goto fail_debugfs;
 
-        asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_WLAN, &result);
-        if (result & (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT))
-                asus->driver->wlan_ctrl_by_user = 1;
-
         return 0;
 
 fail_debugfs:
diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h
index fdff626c3b51..c9589d9342bb 100644
--- a/drivers/platform/x86/asus-wmi.h
+++ b/drivers/platform/x86/asus-wmi.h
@@ -39,7 +39,6 @@ struct key_entry;
 struct asus_wmi;
 
 struct quirk_entry {
-        bool no_rfkill;
         bool hotplug_wireless;
         bool scalar_panel_brightness;
         bool store_backlight_power;
diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c
index 2b218b1d13e5..e12cc3504d48 100644
--- a/drivers/platform/x86/fujitsu-laptop.c
+++ b/drivers/platform/x86/fujitsu-laptop.c
@@ -78,18 +78,18 @@
 
 #define FUJITSU_LCD_N_LEVELS 8
 
-#define ACPI_FUJITSU_CLASS              "fujitsu"
-#define ACPI_FUJITSU_HID                "FUJ02B1"
-#define ACPI_FUJITSU_DRIVER_NAME        "Fujitsu laptop FUJ02B1 ACPI brightness driver"
-#define ACPI_FUJITSU_DEVICE_NAME        "Fujitsu FUJ02B1"
-#define ACPI_FUJITSU_HOTKEY_HID         "FUJ02E3"
-#define ACPI_FUJITSU_HOTKEY_DRIVER_NAME "Fujitsu laptop FUJ02E3 ACPI hotkeys driver"
-#define ACPI_FUJITSU_HOTKEY_DEVICE_NAME "Fujitsu FUJ02E3"
+#define ACPI_FUJITSU_CLASS              "fujitsu"
+#define ACPI_FUJITSU_BL_HID             "FUJ02B1"
+#define ACPI_FUJITSU_BL_DRIVER_NAME     "Fujitsu laptop FUJ02B1 ACPI brightness driver"
+#define ACPI_FUJITSU_BL_DEVICE_NAME     "Fujitsu FUJ02B1"
+#define ACPI_FUJITSU_LAPTOP_HID         "FUJ02E3"
+#define ACPI_FUJITSU_LAPTOP_DRIVER_NAME "Fujitsu laptop FUJ02E3 ACPI hotkeys driver"
+#define ACPI_FUJITSU_LAPTOP_DEVICE_NAME "Fujitsu FUJ02E3"
 
 #define ACPI_FUJITSU_NOTIFY_CODE1     0x80
 
 /* FUNC interface - command values */
-#define FUNC_RFKILL     0x1000
+#define FUNC_FLAGS      0x1000
 #define FUNC_LEDS       0x1001
 #define FUNC_BUTTONS    0x1002
 #define FUNC_BACKLIGHT  0x1004
@@ -97,6 +97,11 @@
 /* FUNC interface - responses */
 #define UNSUPPORTED_CMD 0x80000000
 
+/* FUNC interface - status flags */
+#define FLAG_RFKILL     0x020
+#define FLAG_LID        0x100
+#define FLAG_DOCK       0x200
+
 #if IS_ENABLED(CONFIG_LEDS_CLASS)
 /* FUNC interface - LED control */
 #define FUNC_LED_OFF    0x1
@@ -136,7 +141,7 @@
 #endif
 
 /* Device controlling the backlight and associated keys */
-struct fujitsu_t {
+struct fujitsu_bl {
         acpi_handle acpi_handle;
         struct acpi_device *dev;
         struct input_dev *input;
@@ -150,12 +155,12 @@ struct fujitsu_t {
         unsigned int brightness_level;
 };
 
-static struct fujitsu_t *fujitsu;
+static struct fujitsu_bl *fujitsu_bl;
 static int use_alt_lcd_levels = -1;
 static int disable_brightness_adjust = -1;
 
-/* Device used to access other hotkeys on the laptop */
-struct fujitsu_hotkey_t {
+/* Device used to access hotkeys and other features on the laptop */
+struct fujitsu_laptop {
         acpi_handle acpi_handle;
         struct acpi_device *dev;
         struct input_dev *input;
@@ -163,17 +168,15 @@ struct fujitsu_hotkey_t {
         struct platform_device *pf_device;
         struct kfifo fifo;
         spinlock_t fifo_lock;
-        int rfkill_supported;
-        int rfkill_state;
+        int flags_supported;
+        int flags_state;
         int logolamp_registered;
         int kblamps_registered;
         int radio_led_registered;
         int eco_led_registered;
 };
 
-static struct fujitsu_hotkey_t *fujitsu_hotkey;
-
-static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event);
+static struct fujitsu_laptop *fujitsu_laptop;
 
 #if IS_ENABLED(CONFIG_LEDS_CLASS)
 static enum led_brightness logolamp_get(struct led_classdev *cdev);
@@ -222,8 +225,6 @@ static struct led_classdev eco_led = {
 static u32 dbg_level = 0x03;
 #endif
 
-static void acpi_fujitsu_notify(struct acpi_device *device, u32 event);
-
 /* Fujitsu ACPI interface function */
 
 static int call_fext_func(int cmd, int arg0, int arg1, int arg2)
@@ -239,7 +240,7 @@ static int call_fext_func(int cmd, int arg0, int arg1, int arg2)
         unsigned long long value;
         acpi_handle handle = NULL;
 
-        status = acpi_get_handle(fujitsu_hotkey->acpi_handle, "FUNC", &handle);
+        status = acpi_get_handle(fujitsu_laptop->acpi_handle, "FUNC", &handle);
         if (ACPI_FAILURE(status)) {
                 vdbg_printk(FUJLAPTOP_DBG_ERROR,
                                 "FUNC interface is not present\n");
@@ -300,9 +301,9 @@ static int radio_led_set(struct led_classdev *cdev,
                                 enum led_brightness brightness)
 {
         if (brightness >= LED_FULL)
-                return call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, RADIO_LED_ON);
+                return call_fext_func(FUNC_FLAGS, 0x5, RADIO_LED_ON, RADIO_LED_ON);
         else
-                return call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, 0x0);
+                return call_fext_func(FUNC_FLAGS, 0x5, RADIO_LED_ON, 0x0);
 }
 
 static int eco_led_set(struct led_classdev *cdev,
@@ -346,7 +347,7 @@ static enum led_brightness radio_led_get(struct led_classdev *cdev)
 {
         enum led_brightness brightness = LED_OFF;
 
-        if (call_fext_func(FUNC_RFKILL, 0x4, 0x0, 0x0) & RADIO_LED_ON)
+        if (call_fext_func(FUNC_FLAGS, 0x4, 0x0, 0x0) & RADIO_LED_ON)
                 brightness = LED_FULL;
 
         return brightness;
@@ -373,10 +374,10 @@ static int set_lcd_level(int level)
         vdbg_printk(FUJLAPTOP_DBG_TRACE, "set lcd level via SBLL [%d]\n",
                     level);
 
-        if (level < 0 || level >= fujitsu->max_brightness)
+        if (level < 0 || level >= fujitsu_bl->max_brightness)
                 return -EINVAL;
 
-        status = acpi_get_handle(fujitsu->acpi_handle, "SBLL", &handle);
+        status = acpi_get_handle(fujitsu_bl->acpi_handle, "SBLL", &handle);
         if (ACPI_FAILURE(status)) {
                 vdbg_printk(FUJLAPTOP_DBG_ERROR, "SBLL not present\n");
                 return -ENODEV;
@@ -398,10 +399,10 @@ static int set_lcd_level_alt(int level)
         vdbg_printk(FUJLAPTOP_DBG_TRACE, "set lcd level via SBL2 [%d]\n",
                     level);
 
-        if (level < 0 || level >= fujitsu->max_brightness)
+        if (level < 0 || level >= fujitsu_bl->max_brightness)
                 return -EINVAL;
 
-        status = acpi_get_handle(fujitsu->acpi_handle, "SBL2", &handle);
+        status = acpi_get_handle(fujitsu_bl->acpi_handle, "SBL2", &handle);
         if (ACPI_FAILURE(status)) {
                 vdbg_printk(FUJLAPTOP_DBG_ERROR, "SBL2 not present\n");
                 return -ENODEV;
@@ -421,19 +422,19 @@ static int get_lcd_level(void)
 
         vdbg_printk(FUJLAPTOP_DBG_TRACE, "get lcd level via GBLL\n");
 
-        status =
-            acpi_evaluate_integer(fujitsu->acpi_handle, "GBLL", NULL, &state);
+        status = acpi_evaluate_integer(fujitsu_bl->acpi_handle, "GBLL", NULL,
+                                       &state);
         if (ACPI_FAILURE(status))
                 return 0;
 
-        fujitsu->brightness_level = state & 0x0fffffff;
+        fujitsu_bl->brightness_level = state & 0x0fffffff;
 
         if (state & 0x80000000)
-                fujitsu->brightness_changed = 1;
+                fujitsu_bl->brightness_changed = 1;
         else
-                fujitsu->brightness_changed = 0;
+                fujitsu_bl->brightness_changed = 0;
 
-        return fujitsu->brightness_level;
+        return fujitsu_bl->brightness_level;
 }
 
 static int get_max_brightness(void)
@@ -443,14 +444,14 @@ static int get_max_brightness(void)
 
         vdbg_printk(FUJLAPTOP_DBG_TRACE, "get max lcd level via RBLL\n");
 
-        status =
-            acpi_evaluate_integer(fujitsu->acpi_handle, "RBLL", NULL, &state);
+        status = acpi_evaluate_integer(fujitsu_bl->acpi_handle, "RBLL", NULL,
+                                       &state);
         if (ACPI_FAILURE(status))
                 return -1;
 
-        fujitsu->max_brightness = state;
+        fujitsu_bl->max_brightness = state;
 
-        return fujitsu->max_brightness;
+        return fujitsu_bl->max_brightness;
 }
 
 /* Backlight device stuff */
@@ -483,7 +484,7 @@ static int bl_update_status(struct backlight_device *b)
         return ret;
 }
 
-static const struct backlight_ops fujitsubl_ops = {
+static const struct backlight_ops fujitsu_bl_ops = {
         .get_brightness = bl_get_brightness,
         .update_status = bl_update_status,
 };
@@ -511,7 +512,7 @@ show_brightness_changed(struct device *dev,
 
         int ret;
 
-        ret = fujitsu->brightness_changed;
+        ret = fujitsu_bl->brightness_changed;
         if (ret < 0)
                 return ret;
 
@@ -539,7 +540,7 @@ static ssize_t store_lcd_level(struct device *dev,
         int level, ret;
 
         if (sscanf(buf, "%i", &level) != 1
-            || (level < 0 || level >= fujitsu->max_brightness))
+            || (level < 0 || level >= fujitsu_bl->max_brightness))
                 return -EINVAL;
 
         if (use_alt_lcd_levels)
@@ -567,9 +568,9 @@ static ssize_t
 show_lid_state(struct device *dev,
                         struct device_attribute *attr, char *buf)
 {
-        if (!(fujitsu_hotkey->rfkill_supported & 0x100))
+        if (!(fujitsu_laptop->flags_supported & FLAG_LID))
                 return sprintf(buf, "unknown\n");
-        if (fujitsu_hotkey->rfkill_state & 0x100)
+        if (fujitsu_laptop->flags_state & FLAG_LID)
                 return sprintf(buf, "open\n");
         else
                 return sprintf(buf, "closed\n");
@@ -579,9 +580,9 @@ static ssize_t
 show_dock_state(struct device *dev,
                         struct device_attribute *attr, char *buf)
 {
-        if (!(fujitsu_hotkey->rfkill_supported & 0x200))
+        if (!(fujitsu_laptop->flags_supported & FLAG_DOCK))
                 return sprintf(buf, "unknown\n");
-        if (fujitsu_hotkey->rfkill_state & 0x200)
+        if (fujitsu_laptop->flags_state & FLAG_DOCK)
                 return sprintf(buf, "docked\n");
         else
                 return sprintf(buf, "undocked\n");
@@ -591,9 +592,9 @@ static ssize_t
 show_radios_state(struct device *dev,
                         struct device_attribute *attr, char *buf)
 {
-        if (!(fujitsu_hotkey->rfkill_supported & 0x20))
+        if (!(fujitsu_laptop->flags_supported & FLAG_RFKILL))
                 return sprintf(buf, "unknown\n");
-        if (fujitsu_hotkey->rfkill_state & 0x20)
+        if (fujitsu_laptop->flags_state & FLAG_RFKILL)
                 return sprintf(buf, "on\n");
         else
                 return sprintf(buf, "killed\n");
@@ -607,7 +608,7 @@ static DEVICE_ATTR(lid, 0444, show_lid_state, ignore_store);
 static DEVICE_ATTR(dock, 0444, show_dock_state, ignore_store);
 static DEVICE_ATTR(radios, 0444, show_radios_state, ignore_store);
 
-static struct attribute *fujitsupf_attributes[] = {
+static struct attribute *fujitsu_pf_attributes[] = {
         &dev_attr_brightness_changed.attr,
         &dev_attr_max_brightness.attr,
         &dev_attr_lcd_level.attr,
@@ -617,11 +618,11 @@ static struct attribute *fujitsupf_attributes[] = {
         NULL
 };
 
-static struct attribute_group fujitsupf_attribute_group = {
-        .attrs = fujitsupf_attributes
+static struct attribute_group fujitsu_pf_attribute_group = {
+        .attrs = fujitsu_pf_attributes
 };
 
-static struct platform_driver fujitsupf_driver = {
+static struct platform_driver fujitsu_pf_driver = {
         .driver = {
                    .name = "fujitsu-laptop",
                    }
@@ -630,39 +631,30 @@ static struct platform_driver fujitsupf_driver = {
 static void __init dmi_check_cb_common(const struct dmi_system_id *id)
 {
         pr_info("Identified laptop model '%s'\n", id->ident);
-        if (use_alt_lcd_levels == -1) {
-                if (acpi_has_method(NULL,
-                                "\\_SB.PCI0.LPCB.FJEX.SBL2"))
-                        use_alt_lcd_levels = 1;
-                else
-                        use_alt_lcd_levels = 0;
-                vdbg_printk(FUJLAPTOP_DBG_TRACE, "auto-detected usealt as "
-                        "%i\n", use_alt_lcd_levels);
-        }
 }
 
 static int __init dmi_check_cb_s6410(const struct dmi_system_id *id)
 {
         dmi_check_cb_common(id);
-        fujitsu->keycode1 = KEY_SCREENLOCK;     /* "Lock" */
-        fujitsu->keycode2 = KEY_HELP;   /* "Mobility Center" */
+        fujitsu_bl->keycode1 = KEY_SCREENLOCK;  /* "Lock" */
+        fujitsu_bl->keycode2 = KEY_HELP;        /* "Mobility Center" */
         return 1;
 }
 
 static int __init dmi_check_cb_s6420(const struct dmi_system_id *id)
 {
         dmi_check_cb_common(id);
-        fujitsu->keycode1 = KEY_SCREENLOCK;     /* "Lock" */
-        fujitsu->keycode2 = KEY_HELP;   /* "Mobility Center" */
+        fujitsu_bl->keycode1 = KEY_SCREENLOCK;  /* "Lock" */
+        fujitsu_bl->keycode2 = KEY_HELP;        /* "Mobility Center" */
         return 1;
 }
 
 static int __init dmi_check_cb_p8010(const struct dmi_system_id *id)
 {
         dmi_check_cb_common(id);
-        fujitsu->keycode1 = KEY_HELP;   /* "Support" */
-        fujitsu->keycode3 = KEY_SWITCHVIDEOMODE;        /* "Presentation" */
-        fujitsu->keycode4 = KEY_WWW;    /* "Internet" */
+        fujitsu_bl->keycode1 = KEY_HELP;                /* "Support" */
+        fujitsu_bl->keycode3 = KEY_SWITCHVIDEOMODE;     /* "Presentation" */
+        fujitsu_bl->keycode4 = KEY_WWW;                 /* "Internet" */
         return 1;
 }
 
@@ -693,7 +685,7 @@ static const struct dmi_system_id fujitsu_dmi_table[] __initconst = {
 
 /* ACPI device for LCD brightness control */
 
-static int acpi_fujitsu_add(struct acpi_device *device)
+static int acpi_fujitsu_bl_add(struct acpi_device *device)
 {
         int state = 0;
         struct input_dev *input;
@@ -702,22 +694,22 @@ static int acpi_fujitsu_add(struct acpi_device *device)
         if (!device)
                 return -EINVAL;
 
-        fujitsu->acpi_handle = device->handle;
-        sprintf(acpi_device_name(device), "%s", ACPI_FUJITSU_DEVICE_NAME);
+        fujitsu_bl->acpi_handle = device->handle;
+        sprintf(acpi_device_name(device), "%s", ACPI_FUJITSU_BL_DEVICE_NAME);
         sprintf(acpi_device_class(device), "%s", ACPI_FUJITSU_CLASS);
-        device->driver_data = fujitsu;
+        device->driver_data = fujitsu_bl;
 
-        fujitsu->input = input = input_allocate_device();
+        fujitsu_bl->input = input = input_allocate_device();
         if (!input) {
                 error = -ENOMEM;
                 goto err_stop;
         }
 
-        snprintf(fujitsu->phys, sizeof(fujitsu->phys),
+        snprintf(fujitsu_bl->phys, sizeof(fujitsu_bl->phys),
                  "%s/video/input0", acpi_device_hid(device));
 
         input->name = acpi_device_name(device);
-        input->phys = fujitsu->phys;
+        input->phys = fujitsu_bl->phys;
         input->id.bustype = BUS_HOST;
         input->id.product = 0x06;
         input->dev.parent = &device->dev;
@@ -730,7 +722,7 @@ static int acpi_fujitsu_add(struct acpi_device *device)
         if (error)
                 goto err_free_input_dev;
 
-        error = acpi_bus_update_power(fujitsu->acpi_handle, &state);
+        error = acpi_bus_update_power(fujitsu_bl->acpi_handle, &state);
         if (error) {
                 pr_err("Error reading power state\n");
                 goto err_unregister_input_dev;
@@ -740,7 +732,7 @@ static int acpi_fujitsu_add(struct acpi_device *device)
                acpi_device_name(device), acpi_device_bid(device),
                !device->power.state ? "on" : "off");
 
-        fujitsu->dev = device;
+        fujitsu_bl->dev = device;
 
         if (acpi_has_method(device->handle, METHOD_NAME__INI)) {
                 vdbg_printk(FUJLAPTOP_DBG_INFO, "Invoking _INI\n");
@@ -750,6 +742,15 @@ static int acpi_fujitsu_add(struct acpi_device *device)
                         pr_err("_INI Method failed\n");
         }
 
+        if (use_alt_lcd_levels == -1) {
+                if (acpi_has_method(NULL, "\\_SB.PCI0.LPCB.FJEX.SBL2"))
+                        use_alt_lcd_levels = 1;
+                else
+                        use_alt_lcd_levels = 0;
+                vdbg_printk(FUJLAPTOP_DBG_TRACE, "auto-detected usealt as %i\n",
+                            use_alt_lcd_levels);
+        }
+
         /* do config (detect defaults) */
         use_alt_lcd_levels = use_alt_lcd_levels == 1 ? 1 : 0;
         disable_brightness_adjust = disable_brightness_adjust == 1 ? 1 : 0;
@@ -758,7 +759,7 @@ static int acpi_fujitsu_add(struct acpi_device *device)
                     use_alt_lcd_levels, disable_brightness_adjust);
 
         if (get_max_brightness() <= 0)
-                fujitsu->max_brightness = FUJITSU_LCD_N_LEVELS;
+                fujitsu_bl->max_brightness = FUJITSU_LCD_N_LEVELS;
         get_lcd_level();
 
         return 0;
@@ -772,38 +773,38 @@ err_stop:
         return error;
 }
 
-static int acpi_fujitsu_remove(struct acpi_device *device)
+static int acpi_fujitsu_bl_remove(struct acpi_device *device)
 {
-        struct fujitsu_t *fujitsu = acpi_driver_data(device);
-        struct input_dev *input = fujitsu->input;
+        struct fujitsu_bl *fujitsu_bl = acpi_driver_data(device);
+        struct input_dev *input = fujitsu_bl->input;
 
         input_unregister_device(input);
 
-        fujitsu->acpi_handle = NULL;
+        fujitsu_bl->acpi_handle = NULL;
 
         return 0;
 }
 
 /* Brightness notify */
 
-static void acpi_fujitsu_notify(struct acpi_device *device, u32 event)
+static void acpi_fujitsu_bl_notify(struct acpi_device *device, u32 event)
 {
         struct input_dev *input;
         int keycode;
         int oldb, newb;
 
-        input = fujitsu->input;
+        input = fujitsu_bl->input;
 
         switch (event) {
         case ACPI_FUJITSU_NOTIFY_CODE1:
                 keycode = 0;
-                oldb = fujitsu->brightness_level;
+                oldb = fujitsu_bl->brightness_level;
                 get_lcd_level();
-                newb = fujitsu->brightness_level;
+                newb = fujitsu_bl->brightness_level;
 
                 vdbg_printk(FUJLAPTOP_DBG_TRACE,
                             "brightness button event [%i -> %i (%i)]\n",
-                            oldb, newb, fujitsu->brightness_changed);
+                            oldb, newb, fujitsu_bl->brightness_changed);
 
                 if (oldb < newb) {
                         if (disable_brightness_adjust != 1) {
@@ -840,7 +841,7 @@ static void acpi_fujitsu_notify(struct acpi_device *device, u32 event)
 
 /* ACPI device for hotkey handling */
 
-static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
+static int acpi_fujitsu_laptop_add(struct acpi_device *device)
 {
         int result = 0;
         int state = 0;
@@ -851,42 +852,42 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
         if (!device)
                 return -EINVAL;
 
-        fujitsu_hotkey->acpi_handle = device->handle;
+        fujitsu_laptop->acpi_handle = device->handle;
         sprintf(acpi_device_name(device), "%s",
-                ACPI_FUJITSU_HOTKEY_DEVICE_NAME);
+                ACPI_FUJITSU_LAPTOP_DEVICE_NAME);
         sprintf(acpi_device_class(device), "%s", ACPI_FUJITSU_CLASS);
-        device->driver_data = fujitsu_hotkey;
+        device->driver_data = fujitsu_laptop;
 
         /* kfifo */
-        spin_lock_init(&fujitsu_hotkey->fifo_lock);
-        error = kfifo_alloc(&fujitsu_hotkey->fifo, RINGBUFFERSIZE * sizeof(int),
+        spin_lock_init(&fujitsu_laptop->fifo_lock);
+        error = kfifo_alloc(&fujitsu_laptop->fifo, RINGBUFFERSIZE * sizeof(int),
                         GFP_KERNEL);
         if (error) {
                 pr_err("kfifo_alloc failed\n");
                 goto err_stop;
         }
 
-        fujitsu_hotkey->input = input = input_allocate_device();
+        fujitsu_laptop->input = input = input_allocate_device();
         if (!input) {
                 error = -ENOMEM;
                 goto err_free_fifo;
         }
 
-        snprintf(fujitsu_hotkey->phys, sizeof(fujitsu_hotkey->phys),
+        snprintf(fujitsu_laptop->phys, sizeof(fujitsu_laptop->phys),
                  "%s/video/input0", acpi_device_hid(device));
 
         input->name = acpi_device_name(device);
-        input->phys = fujitsu_hotkey->phys;
+        input->phys = fujitsu_laptop->phys;
         input->id.bustype = BUS_HOST;
         input->id.product = 0x06;
         input->dev.parent = &device->dev;
 
         set_bit(EV_KEY, input->evbit);
-        set_bit(fujitsu->keycode1, input->keybit);
-        set_bit(fujitsu->keycode2, input->keybit);
-        set_bit(fujitsu->keycode3, input->keybit);
-        set_bit(fujitsu->keycode4, input->keybit);
-        set_bit(fujitsu->keycode5, input->keybit);
+        set_bit(fujitsu_bl->keycode1, input->keybit);
+        set_bit(fujitsu_bl->keycode2, input->keybit);
+        set_bit(fujitsu_bl->keycode3, input->keybit);
+        set_bit(fujitsu_bl->keycode4, input->keybit);
+        set_bit(fujitsu_bl->keycode5, input->keybit);
         set_bit(KEY_TOUCHPAD_TOGGLE, input->keybit);
         set_bit(KEY_UNKNOWN, input->keybit);
 
@@ -894,7 +895,7 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
         if (error)
                 goto err_free_input_dev;
 
-        error = acpi_bus_update_power(fujitsu_hotkey->acpi_handle, &state);
+        error = acpi_bus_update_power(fujitsu_laptop->acpi_handle, &state);
         if (error) {
                 pr_err("Error reading power state\n");
                 goto err_unregister_input_dev;
@@ -904,7 +905,7 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
                 acpi_device_name(device), acpi_device_bid(device),
                 !device->power.state ? "on" : "off");
 
-        fujitsu_hotkey->dev = device;
+        fujitsu_laptop->dev = device;
 
         if (acpi_has_method(device->handle, METHOD_NAME__INI)) {
                 vdbg_printk(FUJLAPTOP_DBG_INFO, "Invoking _INI\n");
@@ -920,27 +921,27 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
                 ; /* No action, result is discarded */
         vdbg_printk(FUJLAPTOP_DBG_INFO, "Discarded %i ringbuffer entries\n", i);
 
-        fujitsu_hotkey->rfkill_supported =
-                call_fext_func(FUNC_RFKILL, 0x0, 0x0, 0x0);
+        fujitsu_laptop->flags_supported =
+                call_fext_func(FUNC_FLAGS, 0x0, 0x0, 0x0);
 
         /* Make sure our bitmask of supported functions is cleared if the
            RFKILL function block is not implemented, like on the S7020. */
-        if (fujitsu_hotkey->rfkill_supported == UNSUPPORTED_CMD)
-                fujitsu_hotkey->rfkill_supported = 0;
+        if (fujitsu_laptop->flags_supported == UNSUPPORTED_CMD)
+                fujitsu_laptop->flags_supported = 0;
 
-        if (fujitsu_hotkey->rfkill_supported)
-                fujitsu_hotkey->rfkill_state =
-                        call_fext_func(FUNC_RFKILL, 0x4, 0x0, 0x0);
+        if (fujitsu_laptop->flags_supported)
+                fujitsu_laptop->flags_state =
+                        call_fext_func(FUNC_FLAGS, 0x4, 0x0, 0x0);
 
         /* Suspect this is a keymap of the application panel, print it */
         pr_info("BTNI: [0x%x]\n", call_fext_func(FUNC_BUTTONS, 0x0, 0x0, 0x0));
 
 #if IS_ENABLED(CONFIG_LEDS_CLASS)
         if (call_fext_func(FUNC_LEDS, 0x0, 0x0, 0x0) & LOGOLAMP_POWERON) {
-                result = led_classdev_register(&fujitsu->pf_device->dev,
+                result = led_classdev_register(&fujitsu_bl->pf_device->dev,
                                                 &logolamp_led);
                 if (result == 0) {
-                        fujitsu_hotkey->logolamp_registered = 1;
+                        fujitsu_laptop->logolamp_registered = 1;
                 } else {
                         pr_err("Could not register LED handler for logo lamp, error %i\n",
                                result);
@@ -949,10 +950,10 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
 
         if ((call_fext_func(FUNC_LEDS, 0x0, 0x0, 0x0) & KEYBOARD_LAMPS) &&
            (call_fext_func(FUNC_BUTTONS, 0x0, 0x0, 0x0) == 0x0)) {
-                result = led_classdev_register(&fujitsu->pf_device->dev,
+                result = led_classdev_register(&fujitsu_bl->pf_device->dev,
                                                 &kblamps_led);
                 if (result == 0) {
-                        fujitsu_hotkey->kblamps_registered = 1;
+                        fujitsu_laptop->kblamps_registered = 1;
                 } else {
                         pr_err("Could not register LED handler for keyboard lamps, error %i\n",
                                result);
@@ -966,10 +967,10 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
          * that an RF LED is present.
          */
         if (call_fext_func(FUNC_BUTTONS, 0x0, 0x0, 0x0) & BIT(24)) {
-                result = led_classdev_register(&fujitsu->pf_device->dev,
+                result = led_classdev_register(&fujitsu_bl->pf_device->dev,
                                                 &radio_led);
                 if (result == 0) {
-                        fujitsu_hotkey->radio_led_registered = 1;
+                        fujitsu_laptop->radio_led_registered = 1;
                 } else {
                         pr_err("Could not register LED handler for radio LED, error %i\n",
                                result);
@@ -983,10 +984,10 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
         */
         if ((call_fext_func(FUNC_LEDS, 0x0, 0x0, 0x0) & BIT(14)) &&
            (call_fext_func(FUNC_LEDS, 0x2, ECO_LED, 0x0) != UNSUPPORTED_CMD)) {
-                result = led_classdev_register(&fujitsu->pf_device->dev,
+                result = led_classdev_register(&fujitsu_bl->pf_device->dev,
                                                 &eco_led);
                 if (result == 0) {
-                        fujitsu_hotkey->eco_led_registered = 1;
+                        fujitsu_laptop->eco_led_registered = 1;
                 } else {
                         pr_err("Could not register LED handler for eco LED, error %i\n",
                                result);
@@ -1002,47 +1003,47 @@ err_unregister_input_dev:
 err_free_input_dev:
         input_free_device(input);
 err_free_fifo:
-        kfifo_free(&fujitsu_hotkey->fifo);
+        kfifo_free(&fujitsu_laptop->fifo);
 err_stop:
         return error;
 }
 
-static int acpi_fujitsu_hotkey_remove(struct acpi_device *device)
+static int acpi_fujitsu_laptop_remove(struct acpi_device *device)
 {
-        struct fujitsu_hotkey_t *fujitsu_hotkey = acpi_driver_data(device);
-        struct input_dev *input = fujitsu_hotkey->input;
+        struct fujitsu_laptop *fujitsu_laptop = acpi_driver_data(device);
+        struct input_dev *input = fujitsu_laptop->input;
 
 #if IS_ENABLED(CONFIG_LEDS_CLASS)
-        if (fujitsu_hotkey->logolamp_registered)
+        if (fujitsu_laptop->logolamp_registered)
                 led_classdev_unregister(&logolamp_led);
 
-        if (fujitsu_hotkey->kblamps_registered)
+        if (fujitsu_laptop->kblamps_registered)
                 led_classdev_unregister(&kblamps_led);
 
-        if (fujitsu_hotkey->radio_led_registered)
+        if (fujitsu_laptop->radio_led_registered)
                 led_classdev_unregister(&radio_led);
 
-        if (fujitsu_hotkey->eco_led_registered)
+        if (fujitsu_laptop->eco_led_registered)
                 led_classdev_unregister(&eco_led);
 #endif
 
         input_unregister_device(input);
 
-        kfifo_free(&fujitsu_hotkey->fifo);
+        kfifo_free(&fujitsu_laptop->fifo);
 
-        fujitsu_hotkey->acpi_handle = NULL;
+        fujitsu_laptop->acpi_handle = NULL;
 
         return 0;
 }
 
-static void acpi_fujitsu_hotkey_press(int keycode)
+static void acpi_fujitsu_laptop_press(int keycode)
 {
-        struct input_dev *input = fujitsu_hotkey->input;
+        struct input_dev *input = fujitsu_laptop->input;
         int status;
 
-        status = kfifo_in_locked(&fujitsu_hotkey->fifo,
+        status = kfifo_in_locked(&fujitsu_laptop->fifo,
                                  (unsigned char *)&keycode, sizeof(keycode),
-                                 &fujitsu_hotkey->fifo_lock);
+                                 &fujitsu_laptop->fifo_lock);
         if (status != sizeof(keycode)) {
                 vdbg_printk(FUJLAPTOP_DBG_WARN,
                             "Could not push keycode [0x%x]\n", keycode);
@@ -1054,16 +1055,16 @@ static void acpi_fujitsu_hotkey_press(int keycode)
                     "Push keycode into ringbuffer [%d]\n", keycode);
 }
 
-static void acpi_fujitsu_hotkey_release(void)
+static void acpi_fujitsu_laptop_release(void)
 {
-        struct input_dev *input = fujitsu_hotkey->input;
+        struct input_dev *input = fujitsu_laptop->input;
         int keycode, status;
 
         while (true) {
-                status = kfifo_out_locked(&fujitsu_hotkey->fifo,
+                status = kfifo_out_locked(&fujitsu_laptop->fifo,
                                           (unsigned char *)&keycode,
                                           sizeof(keycode),
-                                          &fujitsu_hotkey->fifo_lock);
+                                          &fujitsu_laptop->fifo_lock);
                 if (status != sizeof(keycode))
                         return;
                 input_report_key(input, keycode, 0);
@@ -1073,14 +1074,14 @@ static void acpi_fujitsu_hotkey_release(void)
         }
 }
 
-static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event)
+static void acpi_fujitsu_laptop_notify(struct acpi_device *device, u32 event)
 {
         struct input_dev *input;
         int keycode;
         unsigned int irb = 1;
         int i;
 
-        input = fujitsu_hotkey->input;
+        input = fujitsu_laptop->input;
 
         if (event != ACPI_FUJITSU_NOTIFY_CODE1) {
                 keycode = KEY_UNKNOWN;
@@ -1093,9 +1094,9 @@ static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event)
                 return;
         }
 
-        if (fujitsu_hotkey->rfkill_supported)
-                fujitsu_hotkey->rfkill_state =
-                        call_fext_func(FUNC_RFKILL, 0x4, 0x0, 0x0);
+        if (fujitsu_laptop->flags_supported)
+                fujitsu_laptop->flags_state =
+                        call_fext_func(FUNC_FLAGS, 0x4, 0x0, 0x0);
 
         i = 0;
         while ((irb =
@@ -1103,19 +1104,19 @@ static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event)
                         && (i++) < MAX_HOTKEY_RINGBUFFER_SIZE) {
                 switch (irb & 0x4ff) {
                 case KEY1_CODE:
-                        keycode = fujitsu->keycode1;
+                        keycode = fujitsu_bl->keycode1;
                         break;
                 case KEY2_CODE:
-                        keycode = fujitsu->keycode2;
+                        keycode = fujitsu_bl->keycode2;
                         break;
                 case KEY3_CODE:
-                        keycode = fujitsu->keycode3;
+                        keycode = fujitsu_bl->keycode3;
                         break;
                 case KEY4_CODE:
-                        keycode = fujitsu->keycode4;
+                        keycode = fujitsu_bl->keycode4;
                         break;
                 case KEY5_CODE:
-                        keycode = fujitsu->keycode5;
+                        keycode = fujitsu_bl->keycode5;
                         break;
                 case 0:
                         keycode = 0;
@@ -1128,17 +1129,17 @@ static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event)
                 }
 
                 if (keycode > 0)
-                        acpi_fujitsu_hotkey_press(keycode);
+                        acpi_fujitsu_laptop_press(keycode);
                 else if (keycode == 0)
-                        acpi_fujitsu_hotkey_release();
+                        acpi_fujitsu_laptop_release();
         }
 
         /* On some models (first seen on the Skylake-based Lifebook
          * E736/E746/E756), the touchpad toggle hotkey (Fn+F4) is
-         * handled in software; its state is queried using FUNC_RFKILL
+         * handled in software; its state is queried using FUNC_FLAGS
          */
-        if ((fujitsu_hotkey->rfkill_supported & BIT(26)) &&
-            (call_fext_func(FUNC_RFKILL, 0x1, 0x0, 0x0) & BIT(26))) {
+        if ((fujitsu_laptop->flags_supported & BIT(26)) &&
+            (call_fext_func(FUNC_FLAGS, 0x1, 0x0, 0x0) & BIT(26))) {
                 keycode = KEY_TOUCHPAD_TOGGLE;
                 input_report_key(input, keycode, 1);
                 input_sync(input);
@@ -1150,83 +1151,81 @@ static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event)
 
 /* Initialization */
 
-static const struct acpi_device_id fujitsu_device_ids[] = {
-        {ACPI_FUJITSU_HID, 0},
+static const struct acpi_device_id fujitsu_bl_device_ids[] = {
+        {ACPI_FUJITSU_BL_HID, 0},
         {"", 0},
 };
 
-static struct acpi_driver acpi_fujitsu_driver = {
-        .name = ACPI_FUJITSU_DRIVER_NAME,
+static struct acpi_driver acpi_fujitsu_bl_driver = {
+        .name = ACPI_FUJITSU_BL_DRIVER_NAME,
         .class = ACPI_FUJITSU_CLASS,
-        .ids = fujitsu_device_ids,
+        .ids = fujitsu_bl_device_ids,
         .ops = {
-                .add = acpi_fujitsu_add,
-                .remove = acpi_fujitsu_remove,
-                .notify = acpi_fujitsu_notify,
+                .add = acpi_fujitsu_bl_add,
+                .remove = acpi_fujitsu_bl_remove,
+                .notify = acpi_fujitsu_bl_notify,
                 },
 };
 
-static const struct acpi_device_id fujitsu_hotkey_device_ids[] = {
-        {ACPI_FUJITSU_HOTKEY_HID, 0},
+static const struct acpi_device_id fujitsu_laptop_device_ids[] = {
+        {ACPI_FUJITSU_LAPTOP_HID, 0},
         {"", 0},
 };
 
-static struct acpi_driver acpi_fujitsu_hotkey_driver = {
-        .name = ACPI_FUJITSU_HOTKEY_DRIVER_NAME,
+static struct acpi_driver acpi_fujitsu_laptop_driver = {
+        .name = ACPI_FUJITSU_LAPTOP_DRIVER_NAME,
         .class = ACPI_FUJITSU_CLASS,
-        .ids = fujitsu_hotkey_device_ids,
+        .ids = fujitsu_laptop_device_ids,
         .ops = {
-                .add = acpi_fujitsu_hotkey_add,
-                .remove = acpi_fujitsu_hotkey_remove,
-                .notify = acpi_fujitsu_hotkey_notify,
+                .add = acpi_fujitsu_laptop_add,
+                .remove = acpi_fujitsu_laptop_remove,
+                .notify = acpi_fujitsu_laptop_notify,
                 },
 };
 
 static const struct acpi_device_id fujitsu_ids[] __used = {
-        {ACPI_FUJITSU_HID, 0},
-        {ACPI_FUJITSU_HOTKEY_HID, 0},
+        {ACPI_FUJITSU_BL_HID, 0},
+        {ACPI_FUJITSU_LAPTOP_HID, 0},
         {"", 0}
 };
 MODULE_DEVICE_TABLE(acpi, fujitsu_ids);
 
 static int __init fujitsu_init(void)
 {
-        int ret, result, max_brightness;
+        int ret, max_brightness;
 
         if (acpi_disabled)
                 return -ENODEV;
 
-        fujitsu = kzalloc(sizeof(struct fujitsu_t), GFP_KERNEL);
-        if (!fujitsu)
+        fujitsu_bl = kzalloc(sizeof(struct fujitsu_bl), GFP_KERNEL);
+        if (!fujitsu_bl)
                 return -ENOMEM;
-        fujitsu->keycode1 = KEY_PROG1;
-        fujitsu->keycode2 = KEY_PROG2;
-        fujitsu->keycode3 = KEY_PROG3;
-        fujitsu->keycode4 = KEY_PROG4;
-        fujitsu->keycode5 = KEY_RFKILL;
+        fujitsu_bl->keycode1 = KEY_PROG1;
+        fujitsu_bl->keycode2 = KEY_PROG2;
+        fujitsu_bl->keycode3 = KEY_PROG3;
+        fujitsu_bl->keycode4 = KEY_PROG4;
+        fujitsu_bl->keycode5 = KEY_RFKILL;
         dmi_check_system(fujitsu_dmi_table);
 
-        result = acpi_bus_register_driver(&acpi_fujitsu_driver);
-        if (result < 0) {
-                ret = -ENODEV;
+        ret = acpi_bus_register_driver(&acpi_fujitsu_bl_driver);
+        if (ret)
                 goto fail_acpi;
-        }
 
         /* Register platform stuff */
 
-        fujitsu->pf_device = platform_device_alloc("fujitsu-laptop", -1);
-        if (!fujitsu->pf_device) {
+        fujitsu_bl->pf_device = platform_device_alloc("fujitsu-laptop", -1);
+        if (!fujitsu_bl->pf_device) {
                 ret = -ENOMEM;
                 goto fail_platform_driver;
         }
 
-        ret = platform_device_add(fujitsu->pf_device);
+        ret = platform_device_add(fujitsu_bl->pf_device);
         if (ret)
                 goto fail_platform_device1;
 
         ret =
-            sysfs_create_group(&fujitsu->pf_device->dev.kobj,
-                               &fujitsupf_attribute_group);
+            sysfs_create_group(&fujitsu_bl->pf_device->dev.kobj,
+                               &fujitsu_pf_attribute_group);
         if (ret)
                 goto fail_platform_device2;
 
@@ -1236,90 +1235,88 @@ static int __init fujitsu_init(void)
                 struct backlight_properties props;
 
                 memset(&props, 0, sizeof(struct backlight_properties));
-                max_brightness = fujitsu->max_brightness;
+                max_brightness = fujitsu_bl->max_brightness;
                 props.type = BACKLIGHT_PLATFORM;
                 props.max_brightness = max_brightness - 1;
-                fujitsu->bl_device = backlight_device_register("fujitsu-laptop",
-                                                               NULL, NULL,
-                                                               &fujitsubl_ops,
-                                                               &props);
-                if (IS_ERR(fujitsu->bl_device)) {
-                        ret = PTR_ERR(fujitsu->bl_device);
-                        fujitsu->bl_device = NULL;
+                fujitsu_bl->bl_device = backlight_device_register("fujitsu-laptop",
+                                                                  NULL, NULL,
+                                                                  &fujitsu_bl_ops,
+                                                                  &props);
+                if (IS_ERR(fujitsu_bl->bl_device)) {
+                        ret = PTR_ERR(fujitsu_bl->bl_device);
+                        fujitsu_bl->bl_device = NULL;
                         goto fail_sysfs_group;
                 }
-                fujitsu->bl_device->props.brightness = fujitsu->brightness_level;
+                fujitsu_bl->bl_device->props.brightness = fujitsu_bl->brightness_level;
         }
 
-        ret = platform_driver_register(&fujitsupf_driver);
+        ret = platform_driver_register(&fujitsu_pf_driver);
         if (ret)
                 goto fail_backlight;
 
-        /* Register hotkey driver */
+        /* Register laptop driver */
 
-        fujitsu_hotkey = kzalloc(sizeof(struct fujitsu_hotkey_t), GFP_KERNEL);
-        if (!fujitsu_hotkey) {
+        fujitsu_laptop = kzalloc(sizeof(struct fujitsu_laptop), GFP_KERNEL);
+        if (!fujitsu_laptop) {
                 ret = -ENOMEM;
-                goto fail_hotkey;
+                goto fail_laptop;
         }
 
-        result = acpi_bus_register_driver(&acpi_fujitsu_hotkey_driver);
-        if (result < 0) {
-                ret = -ENODEV;
-                goto fail_hotkey1;
-        }
+        ret = acpi_bus_register_driver(&acpi_fujitsu_laptop_driver);
+        if (ret)
+                goto fail_laptop1;
 
         /* Sync backlight power status (needs FUJ02E3 device, hence deferred) */
         if (acpi_video_get_backlight_type() == acpi_backlight_vendor) {
                 if (call_fext_func(FUNC_BACKLIGHT, 0x2, 0x4, 0x0) == 3)
-                        fujitsu->bl_device->props.power = FB_BLANK_POWERDOWN;
+                        fujitsu_bl->bl_device->props.power = FB_BLANK_POWERDOWN;
                 else
-                        fujitsu->bl_device->props.power = FB_BLANK_UNBLANK;
+                        fujitsu_bl->bl_device->props.power = FB_BLANK_UNBLANK;
         }
 
         pr_info("driver " FUJITSU_DRIVER_VERSION " successfully loaded\n");
 
         return 0;
 
-fail_hotkey1:
-        kfree(fujitsu_hotkey);
-fail_hotkey:
-        platform_driver_unregister(&fujitsupf_driver);
+fail_laptop1:
+        kfree(fujitsu_laptop);
+fail_laptop:
+        platform_driver_unregister(&fujitsu_pf_driver);
 fail_backlight:
-        backlight_device_unregister(fujitsu->bl_device);
+        backlight_device_unregister(fujitsu_bl->bl_device);
 fail_sysfs_group:
-        sysfs_remove_group(&fujitsu->pf_device->dev.kobj,
-                           &fujitsupf_attribute_group);
+        sysfs_remove_group(&fujitsu_bl->pf_device->dev.kobj,
+                           &fujitsu_pf_attribute_group);
 fail_platform_device2:
-        platform_device_del(fujitsu->pf_device);
+        platform_device_del(fujitsu_bl->pf_device);
 fail_platform_device1:
-        platform_device_put(fujitsu->pf_device);
+        platform_device_put(fujitsu_bl->pf_device);
 fail_platform_driver:
-        acpi_bus_unregister_driver(&acpi_fujitsu_driver);
+        acpi_bus_unregister_driver(&acpi_fujitsu_bl_driver);
 fail_acpi:
-        kfree(fujitsu);
+        kfree(fujitsu_bl);
 
         return ret;
 }
 
 static void __exit fujitsu_cleanup(void)
 {
-        acpi_bus_unregister_driver(&acpi_fujitsu_hotkey_driver);
+        acpi_bus_unregister_driver(&acpi_fujitsu_laptop_driver);
 
-        kfree(fujitsu_hotkey);
+        kfree(fujitsu_laptop);
 
-        platform_driver_unregister(&fujitsupf_driver);
+        platform_driver_unregister(&fujitsu_pf_driver);
 
-        backlight_device_unregister(fujitsu->bl_device);
+        backlight_device_unregister(fujitsu_bl->bl_device);
 
-        sysfs_remove_group(&fujitsu->pf_device->dev.kobj,
-                           &fujitsupf_attribute_group);
+        sysfs_remove_group(&fujitsu_bl->pf_device->dev.kobj,
+                           &fujitsu_pf_attribute_group);
 
-        platform_device_unregister(fujitsu->pf_device);
+        platform_device_unregister(fujitsu_bl->pf_device);
 
-        acpi_bus_unregister_driver(&acpi_fujitsu_driver);
+        acpi_bus_unregister_driver(&acpi_fujitsu_bl_driver);
 
-        kfree(fujitsu);
+        kfree(fujitsu_bl);
 
         pr_info("driver unloaded\n");
 }
@@ -1341,7 +1338,3 @@ MODULE_AUTHOR("Jonathan Woithe, Peter Gruber, Tony Vroon");
 MODULE_DESCRIPTION("Fujitsu laptop extras support");
 MODULE_VERSION(FUJITSU_DRIVER_VERSION);
 MODULE_LICENSE("GPL");
-
-MODULE_ALIAS("dmi:*:svnFUJITSUSIEMENS:*:pvr:rvnFUJITSU:rnFJNB1D3:*:cvrS6410:*");
-MODULE_ALIAS("dmi:*:svnFUJITSUSIEMENS:*:pvr:rvnFUJITSU:rnFJNB1E6:*:cvrS6420:*");
-MODULE_ALIAS("dmi:*:svnFUJITSU:*:pvr:rvnFUJITSU:rnFJNB19C:*:cvrS7020:*");
diff --git a/drivers/ptp/ptp_kvm.c b/drivers/ptp/ptp_kvm.c
index 09b4df74291e..bb865695d7a6 100644
--- a/drivers/ptp/ptp_kvm.c
+++ b/drivers/ptp/ptp_kvm.c
@@ -193,10 +193,7 @@ static int __init ptp_kvm_init(void)
 
         kvm_ptp_clock.ptp_clock = ptp_clock_register(&kvm_ptp_clock.caps, NULL);
 
-        if (IS_ERR(kvm_ptp_clock.ptp_clock))
-                return PTR_ERR(kvm_ptp_clock.ptp_clock);
-
-        return 0;
+        return PTR_ERR_OR_ZERO(kvm_ptp_clock.ptp_clock);
 }
 
 module_init(ptp_kvm_init);
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 9d19b9a62011..315a4be8dc1e 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -37,8 +37,8 @@
 #include "tsi721.h"
 
 #ifdef DEBUG
-u32 dbg_level;
-module_param(dbg_level, uint, S_IWUSR | S_IRUGO);
+u32 tsi_dbg_level;
+module_param_named(dbg_level, tsi_dbg_level, uint, S_IWUSR | S_IRUGO);
 MODULE_PARM_DESC(dbg_level, "Debugging output level (default 0 = none)");
 #endif
 
diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h
index 5941437cbdd1..957eadc58150 100644
--- a/drivers/rapidio/devices/tsi721.h
+++ b/drivers/rapidio/devices/tsi721.h
@@ -40,11 +40,11 @@ enum {
 };
 
 #ifdef DEBUG
-extern u32 dbg_level;
+extern u32 tsi_dbg_level;
 
 #define tsi_debug(level, dev, fmt, arg...)                              \
         do {                                                            \
-                if (DBG_##level & dbg_level)                            \
+                if (DBG_##level & tsi_dbg_level)                                \
                         dev_dbg(dev, "%s: " fmt "\n", __func__, ##arg); \
         } while (0)
 #else
diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
index 65f86bc24c07..1dc43fc5f65f 100644
--- a/drivers/remoteproc/Kconfig
+++ b/drivers/remoteproc/Kconfig
@@ -76,7 +76,7 @@ config QCOM_ADSP_PIL
         depends on OF && ARCH_QCOM
         depends on REMOTEPROC
         depends on QCOM_SMEM
-        depends on QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n)
+        depends on RPMSG_QCOM_SMD || QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n && RPMSG_QCOM_SMD=n)
         select MFD_SYSCON
         select QCOM_MDT_LOADER
         select QCOM_RPROC_COMMON
@@ -93,7 +93,7 @@ config QCOM_Q6V5_PIL
         depends on OF && ARCH_QCOM
         depends on QCOM_SMEM
         depends on REMOTEPROC
-        depends on QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n)
+        depends on RPMSG_QCOM_SMD || QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n && RPMSG_QCOM_SMD=n)
         select MFD_SYSCON
         select QCOM_RPROC_COMMON
         select QCOM_SCM
@@ -104,7 +104,7 @@ config QCOM_Q6V5_PIL
 config QCOM_WCNSS_PIL
         tristate "Qualcomm WCNSS Peripheral Image Loader"
         depends on OF && ARCH_QCOM
-        depends on QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n)
+        depends on RPMSG_QCOM_SMD || QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n && RPMSG_QCOM_SMD=n)
         depends on QCOM_SMEM
         depends on REMOTEPROC
         select QCOM_MDT_LOADER
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 230043c1c90f..3c52867dfe28 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1241,16 +1241,15 @@ config SCSI_LPFC
         tristate "Emulex LightPulse Fibre Channel Support"
         depends on PCI && SCSI
         depends on SCSI_FC_ATTRS
-        depends on NVME_FC && NVME_TARGET_FC
         select CRC_T10DIF
-        help
+        ---help---
           This lpfc driver supports the Emulex LightPulse
           Family of Fibre Channel PCI host adapters.
 
 config SCSI_LPFC_DEBUG_FS
         bool "Emulex LightPulse Fibre Channel debugfs Support"
         depends on SCSI_LPFC && DEBUG_FS
-        help
+        ---help---
           This makes debugging information from the lpfc driver
           available via the debugfs filesystem.
 
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index a3ad04293487..c8172f16cf33 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -2056,7 +2056,6 @@ static int fillup_pools(struct aac_dev *dev, struct hw_fib **hw_fib_pool,
 {
         struct hw_fib **hw_fib_p;
         struct fib **fib_p;
-        int rcode = 1;
 
         hw_fib_p = hw_fib_pool;
         fib_p = fib_pool;
@@ -2074,11 +2073,11 @@ static int fillup_pools(struct aac_dev *dev, struct hw_fib **hw_fib_pool,
                 }
         }
 
+        /*
+         * Get the actual number of allocated fibs
+         */
         num = hw_fib_p - hw_fib_pool;
-        if (!num)
-                rcode = 0;
-
-        return rcode;
+        return num;
 }
 
 static void wakeup_fibctx_threads(struct aac_dev *dev,
@@ -2186,7 +2185,6 @@ static void aac_process_events(struct aac_dev *dev)
         struct fib *fib;
         unsigned long flags;
         spinlock_t *t_lock;
-        unsigned int rcode;
 
         t_lock = dev->queues->queue[HostNormCmdQueue].lock;
         spin_lock_irqsave(t_lock, flags);
@@ -2269,8 +2267,8 @@ static void aac_process_events(struct aac_dev *dev)
                  * Fill up fib pointer pools with actual fibs
                  * and hw_fibs
                  */
-                rcode = fillup_pools(dev, hw_fib_pool, fib_pool, num);
-                if (!rcode)
+                num = fillup_pools(dev, hw_fib_pool, fib_pool, num);
+                if (!num)
                         goto free_mem;
 
                 /*
diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c
index 2e5338dec621..7b0410e0f569 100644
--- a/drivers/scsi/aacraid/src.c
+++ b/drivers/scsi/aacraid/src.c
@@ -468,7 +468,7 @@ err_out:
         return -1;
 
 err_blink:
-        return (status > 16) & 0xFF;
+        return (status >> 16) & 0xFF;
 }
 
 static inline u32 aac_get_vector(struct aac_dev *dev)
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 109e2c99e6c1..95d8f25cbcca 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -6278,7 +6278,7 @@ ahd_reset(struct ahd_softc *ahd, int reinit)
                  * does not disable its parity logic prior to
                  * the start of the reset.  This may cause a
                  * parity error to be detected and thus a
-                 * spurious SERR or PERR assertion.  Disble
+                 * spurious SERR or PERR assertion.  Disable
                  * PERR and SERR responses during the CHIPRST.
                  */
                 mod_cmd = cmd & ~(PCIM_CMD_PERRESPEN|PCIM_CMD_SERRESPEN);
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index 48e200102221..c01b47e5b55a 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -113,7 +113,7 @@ struct alua_queue_data {
 #define ALUA_POLICY_SWITCH_ALL          1
 
 static void alua_rtpg_work(struct work_struct *work);
-static void alua_rtpg_queue(struct alua_port_group *pg,
+static bool alua_rtpg_queue(struct alua_port_group *pg,
                             struct scsi_device *sdev,
                             struct alua_queue_data *qdata, bool force);
 static void alua_check(struct scsi_device *sdev, bool force);
@@ -862,7 +862,13 @@ static void alua_rtpg_work(struct work_struct *work)
         kref_put(&pg->kref, release_port_group);
 }
 
-static void alua_rtpg_queue(struct alua_port_group *pg,
+/**
+ * alua_rtpg_queue() - cause RTPG to be submitted asynchronously
+ *
+ * Returns true if and only if alua_rtpg_work() will be called asynchronously.
+ * That function is responsible for calling @qdata->fn().
+ */
+static bool alua_rtpg_queue(struct alua_port_group *pg,
                             struct scsi_device *sdev,
                             struct alua_queue_data *qdata, bool force)
 {
@@ -870,8 +876,8 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
         unsigned long flags;
         struct workqueue_struct *alua_wq = kaluad_wq;
 
-        if (!pg)
-                return;
+        if (WARN_ON_ONCE(!pg) || scsi_device_get(sdev))
+                return false;
 
         spin_lock_irqsave(&pg->lock, flags);
         if (qdata) {
@@ -884,14 +890,12 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
                 pg->flags |= ALUA_PG_RUN_RTPG;
                 kref_get(&pg->kref);
                 pg->rtpg_sdev = sdev;
-                scsi_device_get(sdev);
                 start_queue = 1;
         } else if (!(pg->flags & ALUA_PG_RUN_RTPG) && force) {
                 pg->flags |= ALUA_PG_RUN_RTPG;
                 /* Do not queue if the worker is already running */
                 if (!(pg->flags & ALUA_PG_RUNNING)) {
                         kref_get(&pg->kref);
-                        sdev = NULL;
                         start_queue = 1;
                 }
         }
@@ -900,13 +904,17 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
                 alua_wq = kaluad_sync_wq;
         spin_unlock_irqrestore(&pg->lock, flags);
 
-        if (start_queue &&
-            !queue_delayed_work(alua_wq, &pg->rtpg_work,
-                                msecs_to_jiffies(ALUA_RTPG_DELAY_MSECS))) {
-                if (sdev)
-                        scsi_device_put(sdev);
-                kref_put(&pg->kref, release_port_group);
+        if (start_queue) {
+                if (queue_delayed_work(alua_wq, &pg->rtpg_work,
+                                msecs_to_jiffies(ALUA_RTPG_DELAY_MSECS)))
+                        sdev = NULL;
+                else
+                        kref_put(&pg->kref, release_port_group);
         }
+        if (sdev)
+                scsi_device_put(sdev);
+
+        return true;
 }
 
 /*
@@ -1007,11 +1015,13 @@ static int alua_activate(struct scsi_device *sdev,
                 mutex_unlock(&h->init_mutex);
                 goto out;
         }
-        fn = NULL;
         rcu_read_unlock();
         mutex_unlock(&h->init_mutex);
 
-        alua_rtpg_queue(pg, sdev, qdata, true);
+        if (alua_rtpg_queue(pg, sdev, qdata, true))
+                fn = NULL;
+        else
+                err = SCSI_DH_DEV_OFFLINED;
         kref_put(&pg->kref, release_port_group);
 out:
         if (fn)
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 524a0c755ed7..9d659aaace15 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -2956,7 +2956,7 @@ static int hpsa_send_reset(struct ctlr_info *h, unsigned char *scsi3addr,
         /* fill_cmd can't fail here, no data buffer to map. */
         (void) fill_cmd(c, reset_type, h, NULL, 0, 0,
                         scsi3addr, TYPE_MSG);
-        rc = hpsa_scsi_do_simple_cmd(h, c, reply_queue, DEFAULT_TIMEOUT);
+        rc = hpsa_scsi_do_simple_cmd(h, c, reply_queue, NO_TIMEOUT);
         if (rc) {
                 dev_warn(&h->pdev->dev, "Failed to send reset command\n");
                 goto out;
@@ -3714,7 +3714,7 @@ exit_failed:
  *  # (integer code indicating one of several NOT READY states
  *     describing why a volume is to be kept offline)
  */
-static int hpsa_volume_offline(struct ctlr_info *h,
+static unsigned char hpsa_volume_offline(struct ctlr_info *h,
                                         unsigned char scsi3addr[])
 {
         struct CommandList *c;
@@ -3735,7 +3735,7 @@ static int hpsa_volume_offline(struct ctlr_info *h,
                                         DEFAULT_TIMEOUT);
         if (rc) {
                 cmd_free(h, c);
-                return 0;
+                return HPSA_VPD_LV_STATUS_UNSUPPORTED;
         }
         sense = c->err_info->SenseInfo;
         if (c->err_info->SenseLen > sizeof(c->err_info->SenseInfo))
@@ -3746,19 +3746,13 @@ static int hpsa_volume_offline(struct ctlr_info *h,
         cmd_status = c->err_info->CommandStatus;
         scsi_status = c->err_info->ScsiStatus;
         cmd_free(h, c);
-        /* Is the volume 'not ready'? */
-        if (cmd_status != CMD_TARGET_STATUS ||
-                scsi_status != SAM_STAT_CHECK_CONDITION ||
-                sense_key != NOT_READY ||
-                asc != ASC_LUN_NOT_READY)  {
-                return 0;
-        }
 
         /* Determine the reason for not ready state */
         ldstat = hpsa_get_volume_status(h, scsi3addr);
 
         /* Keep volume offline in certain cases: */
         switch (ldstat) {
+        case HPSA_LV_FAILED:
         case HPSA_LV_UNDERGOING_ERASE:
         case HPSA_LV_NOT_AVAILABLE:
         case HPSA_LV_UNDERGOING_RPI:
@@ -3780,7 +3774,7 @@ static int hpsa_volume_offline(struct ctlr_info *h,
         default:
                 break;
         }
-        return 0;
+        return HPSA_LV_OK;
 }
 
 /*
@@ -3853,10 +3847,10 @@ static int hpsa_update_device_info(struct ctlr_info *h,
         /* Do an inquiry to the device to see what it is. */
         if (hpsa_scsi_do_inquiry(h, scsi3addr, 0, inq_buff,
                 (unsigned char) OBDR_TAPE_INQ_SIZE) != 0) {
-                /* Inquiry failed (msg printed already) */
                 dev_err(&h->pdev->dev,
-                        "hpsa_update_device_info: inquiry failed\n");
-                rc = -EIO;
+                        "%s: inquiry failed, device will be skipped.\n",
+                        __func__);
+                rc = HPSA_INQUIRY_FAILED;
                 goto bail_out;
         }
 
@@ -3885,15 +3879,20 @@ static int hpsa_update_device_info(struct ctlr_info *h,
         if ((this_device->devtype == TYPE_DISK ||
                 this_device->devtype == TYPE_ZBC) &&
                 is_logical_dev_addr_mode(scsi3addr)) {
-                int volume_offline;
+                unsigned char volume_offline;
 
                 hpsa_get_raid_level(h, scsi3addr, &this_device->raid_level);
                 if (h->fw_support & MISC_FW_RAID_OFFLOAD_BASIC)
                         hpsa_get_ioaccel_status(h, scsi3addr, this_device);
                 volume_offline = hpsa_volume_offline(h, scsi3addr);
-                if (volume_offline < 0 || volume_offline > 0xff)
-                        volume_offline = HPSA_VPD_LV_STATUS_UNSUPPORTED;
-                this_device->volume_offline = volume_offline & 0xff;
+                this_device->volume_offline = volume_offline;
+                if (volume_offline == HPSA_LV_FAILED) {
+                        rc = HPSA_LV_FAILED;
+                        dev_err(&h->pdev->dev,
+                                "%s: LV failed, device will be skipped.\n",
+                                __func__);
+                        goto bail_out;
+                }
         } else {
                 this_device->raid_level = RAID_UNKNOWN;
                 this_device->offload_config = 0;
@@ -4379,8 +4378,7 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h)
                         goto out;
                 }
                 if (rc) {
-                        dev_warn(&h->pdev->dev,
-                                "Inquiry failed, skipping device.\n");
+                        h->drv_req_rescan = 1;
                         continue;
                 }
 
@@ -5558,7 +5556,7 @@ static void hpsa_scan_complete(struct ctlr_info *h)
 
         spin_lock_irqsave(&h->scan_lock, flags);
         h->scan_finished = 1;
-        wake_up_all(&h->scan_wait_queue);
+        wake_up(&h->scan_wait_queue);
         spin_unlock_irqrestore(&h->scan_lock, flags);
 }
 
@@ -5576,11 +5574,23 @@ static void hpsa_scan_start(struct Scsi_Host *sh)
         if (unlikely(lockup_detected(h)))
                 return hpsa_scan_complete(h);
 
+        /*
+         * If a scan is already waiting to run, no need to add another
+         */
+        spin_lock_irqsave(&h->scan_lock, flags);
+        if (h->scan_waiting) {
+                spin_unlock_irqrestore(&h->scan_lock, flags);
+                return;
+        }
+
+        spin_unlock_irqrestore(&h->scan_lock, flags);
+
         /* wait until any scan already in progress is finished. */
         while (1) {
                 spin_lock_irqsave(&h->scan_lock, flags);
                 if (h->scan_finished)
                         break;
+                h->scan_waiting = 1;
                 spin_unlock_irqrestore(&h->scan_lock, flags);
                 wait_event(h->scan_wait_queue, h->scan_finished);
                 /* Note: We don't need to worry about a race between this
@@ -5590,6 +5600,7 @@ static void hpsa_scan_start(struct Scsi_Host *sh)
                  */
         }
         h->scan_finished = 0; /* mark scan as in progress */
+        h->scan_waiting = 0;
         spin_unlock_irqrestore(&h->scan_lock, flags);
 
         if (unlikely(lockup_detected(h)))
@@ -8792,6 +8803,7 @@ reinit_after_soft_reset:
         init_waitqueue_head(&h->event_sync_wait_queue);
         mutex_init(&h->reset_mutex);
         h->scan_finished = 1; /* no scan currently in progress */
+        h->scan_waiting = 0;
 
         pci_set_drvdata(pdev, h);
         h->ndevices = 0;
diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
index bf6cdc106654..6f04f2ad4125 100644
--- a/drivers/scsi/hpsa.h
+++ b/drivers/scsi/hpsa.h
@@ -201,6 +201,7 @@ struct ctlr_info {
         dma_addr_t              errinfo_pool_dhandle;
         unsigned long           *cmd_pool_bits;
         int                     scan_finished;
+        u8                      scan_waiting : 1;
         spinlock_t              scan_lock;
         wait_queue_head_t       scan_wait_queue;
 
diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h
index a584cdf07058..5961705eef76 100644
--- a/drivers/scsi/hpsa_cmd.h
+++ b/drivers/scsi/hpsa_cmd.h
@@ -156,6 +156,7 @@
 #define CFGTBL_BusType_Fibre2G  0x00000200l
 
 /* VPD Inquiry types */
+#define HPSA_INQUIRY_FAILED             0x02
 #define HPSA_VPD_SUPPORTED_PAGES        0x00
 #define HPSA_VPD_LV_DEVICE_ID           0x83
 #define HPSA_VPD_LV_DEVICE_GEOMETRY     0xC1
@@ -166,6 +167,7 @@
 /* Logical volume states */
 #define HPSA_VPD_LV_STATUS_UNSUPPORTED                  0xff
 #define HPSA_LV_OK                                      0x0
+#define HPSA_LV_FAILED                                  0x01
 #define HPSA_LV_NOT_AVAILABLE                           0x0b
 #define HPSA_LV_UNDERGOING_ERASE                        0x0F
 #define HPSA_LV_UNDERGOING_RPI                          0x12
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 07c08ce68d70..894b1e3ebd56 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -561,8 +561,12 @@ static void iscsi_complete_task(struct iscsi_task *task, int state)
         WARN_ON_ONCE(task->state == ISCSI_TASK_FREE);
         task->state = state;
 
-        if (!list_empty(&task->running))
+        spin_lock_bh(&conn->taskqueuelock);
+        if (!list_empty(&task->running)) {
+                pr_debug_once("%s while task on list", __func__);
                 list_del_init(&task->running);
+        }
+        spin_unlock_bh(&conn->taskqueuelock);
 
         if (conn->task == task)
                 conn->task = NULL;
@@ -784,7 +788,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
                 if (session->tt->xmit_task(task))
                         goto free_task;
         } else {
+                spin_lock_bh(&conn->taskqueuelock);
                 list_add_tail(&task->running, &conn->mgmtqueue);
+                spin_unlock_bh(&conn->taskqueuelock);
                 iscsi_conn_queue_work(conn);
         }
 
@@ -1475,8 +1481,10 @@ void iscsi_requeue_task(struct iscsi_task *task)
          * this may be on the requeue list already if the xmit_task callout
          * is handling the r2ts while we are adding new ones
          */
+        spin_lock_bh(&conn->taskqueuelock);
         if (list_empty(&task->running))
                 list_add_tail(&task->running, &conn->requeue);
+        spin_unlock_bh(&conn->taskqueuelock);
         iscsi_conn_queue_work(conn);
 }
 EXPORT_SYMBOL_GPL(iscsi_requeue_task);
@@ -1513,22 +1521,26 @@ static int iscsi_data_xmit(struct iscsi_conn *conn)
          * only have one nop-out as a ping from us and targets should not
          * overflow us with nop-ins
          */
+        spin_lock_bh(&conn->taskqueuelock);
 check_mgmt:
         while (!list_empty(&conn->mgmtqueue)) {
                 conn->task = list_entry(conn->mgmtqueue.next,
                                          struct iscsi_task, running);
                 list_del_init(&conn->task->running);
+                spin_unlock_bh(&conn->taskqueuelock);
                 if (iscsi_prep_mgmt_task(conn, conn->task)) {
                         /* regular RX path uses back_lock */
                         spin_lock_bh(&conn->session->back_lock);
                         __iscsi_put_task(conn->task);
                         spin_unlock_bh(&conn->session->back_lock);
                         conn->task = NULL;
+                        spin_lock_bh(&conn->taskqueuelock);
                         continue;
                 }
                 rc = iscsi_xmit_task(conn);
                 if (rc)
                         goto done;
+                spin_lock_bh(&conn->taskqueuelock);
         }
 
         /* process pending command queue */
@@ -1536,19 +1548,24 @@ check_mgmt:
                 conn->task = list_entry(conn->cmdqueue.next, struct iscsi_task,
                                         running);
                 list_del_init(&conn->task->running);
+                spin_unlock_bh(&conn->taskqueuelock);
                 if (conn->session->state == ISCSI_STATE_LOGGING_OUT) {
                         fail_scsi_task(conn->task, DID_IMM_RETRY);
+                        spin_lock_bh(&conn->taskqueuelock);
                         continue;
                 }
                 rc = iscsi_prep_scsi_cmd_pdu(conn->task);
                 if (rc) {
                         if (rc == -ENOMEM || rc == -EACCES) {
+                                spin_lock_bh(&conn->taskqueuelock);
                                 list_add_tail(&conn->task->running,
                                               &conn->cmdqueue);
                                 conn->task = NULL;
+                                spin_unlock_bh(&conn->taskqueuelock);
                                 goto done;
                         } else
                                 fail_scsi_task(conn->task, DID_ABORT);
+                        spin_lock_bh(&conn->taskqueuelock);
                         continue;
                 }
                 rc = iscsi_xmit_task(conn);
@@ -1559,6 +1576,7 @@ check_mgmt:
                  * we need to check the mgmt queue for nops that need to
                  * be sent to aviod starvation
                  */
+                spin_lock_bh(&conn->taskqueuelock);
                 if (!list_empty(&conn->mgmtqueue))
                         goto check_mgmt;
         }
@@ -1578,12 +1596,15 @@ check_mgmt:
                 conn->task = task;
                 list_del_init(&conn->task->running);
                 conn->task->state = ISCSI_TASK_RUNNING;
+                spin_unlock_bh(&conn->taskqueuelock);
                 rc = iscsi_xmit_task(conn);
                 if (rc)
                         goto done;
+                spin_lock_bh(&conn->taskqueuelock);
                 if (!list_empty(&conn->mgmtqueue))
                         goto check_mgmt;
         }
+        spin_unlock_bh(&conn->taskqueuelock);
         spin_unlock_bh(&conn->session->frwd_lock);
         return -ENODATA;
 
@@ -1739,7 +1760,9 @@ int iscsi_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *sc)
                         goto prepd_reject;
                 }
         } else {
+                spin_lock_bh(&conn->taskqueuelock);
                 list_add_tail(&task->running, &conn->cmdqueue);
+                spin_unlock_bh(&conn->taskqueuelock);
                 iscsi_conn_queue_work(conn);
         }
 
@@ -2897,6 +2920,7 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
         INIT_LIST_HEAD(&conn->mgmtqueue);
         INIT_LIST_HEAD(&conn->cmdqueue);
         INIT_LIST_HEAD(&conn->requeue);
+        spin_lock_init(&conn->taskqueuelock);
         INIT_WORK(&conn->xmitwork, iscsi_xmitworker);
 
         /* allocate login_task used for the login/text sequences */
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 763f012fdeca..87f5e694dbed 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -221,7 +221,7 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
                 task->num_scatter = qc->n_elem;
         } else {
                 for_each_sg(qc->sg, sg, qc->n_elem, si)
-                        xfer += sg->length;
+                        xfer += sg_dma_len(sg);
 
                 task->total_xfer_len = xfer;
                 task->num_scatter = si;
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index 0bba2e30b4f0..257bbdd0f0b8 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -99,12 +99,13 @@ struct lpfc_sli2_slim;
 #define FC_MAX_ADPTMSG          64
 
 #define MAX_HBAEVT      32
+#define MAX_HBAS_NO_RESET 16
 
 /* Number of MSI-X vectors the driver uses */
 #define LPFC_MSIX_VECTORS       2
 
 /* lpfc wait event data ready flag */
-#define LPFC_DATA_READY         (1<<0)
+#define LPFC_DATA_READY         0       /* bit 0 */
 
 /* queue dump line buffer size */
 #define LPFC_LBUF_SZ            128
@@ -692,6 +693,7 @@ struct lpfc_hba {
                                          * capability
                                          */
 #define HBA_NVME_IOQ_FLUSH      0x80000 /* NVME IO queues flushed. */
+#define NVME_XRI_ABORT_EVENT    0x100000
 
         uint32_t fcp_ring_in_use; /* When polling test if intr-hndlr active*/
         struct lpfc_dmabuf slim2p;
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 5c783ef7f260..22819afbaef5 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -3010,6 +3010,12 @@ MODULE_PARM_DESC(lpfc_poll, "FCP ring polling mode control:"
 static DEVICE_ATTR(lpfc_poll, S_IRUGO | S_IWUSR,
                    lpfc_poll_show, lpfc_poll_store);
 
+int lpfc_no_hba_reset_cnt;
+unsigned long lpfc_no_hba_reset[MAX_HBAS_NO_RESET] = {
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+module_param_array(lpfc_no_hba_reset, ulong, &lpfc_no_hba_reset_cnt, 0444);
+MODULE_PARM_DESC(lpfc_no_hba_reset, "WWPN of HBAs that should not be reset");
+
 LPFC_ATTR(sli_mode, 0, 0, 3,
         "SLI mode selector:"
         " 0 - auto (SLI-3 if supported),"
@@ -3309,9 +3315,9 @@ LPFC_ATTR_R(nvmet_mrq_post, LPFC_DEF_MRQ_POST,
  * lpfc_enable_fc4_type: Defines what FC4 types are supported.
  * Supported Values:  1 - register just FCP
  *                    3 - register both FCP and NVME
- * Supported values are [1,3]. Default value is 3
+ * Supported values are [1,3]. Default value is 1
  */
-LPFC_ATTR_R(enable_fc4_type, LPFC_ENABLE_BOTH,
+LPFC_ATTR_R(enable_fc4_type, LPFC_ENABLE_FCP,
             LPFC_ENABLE_FCP, LPFC_ENABLE_BOTH,
             "Define fc4 type to register with fabric.");
 
@@ -4451,7 +4457,8 @@ lpfc_fcp_imax_store(struct device *dev, struct device_attribute *attr,
                 return -EINVAL;
 
         phba->cfg_fcp_imax = (uint32_t)val;
-        for (i = 0; i < phba->io_channel_irqs; i++)
+
+        for (i = 0; i < phba->io_channel_irqs; i += LPFC_MAX_EQ_DELAY_EQID_CNT)
                 lpfc_modify_hba_eq_delay(phba, i);
 
         return strlen(buf);
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index 843dd73004da..54e6ac42fbcd 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -384,7 +384,7 @@ void lpfc_free_sysfs_attr(struct lpfc_vport *);
 extern struct device_attribute *lpfc_hba_attrs[];
 extern struct device_attribute *lpfc_vport_attrs[];
 extern struct scsi_host_template lpfc_template;
-extern struct scsi_host_template lpfc_template_s3;
+extern struct scsi_host_template lpfc_template_no_hr;
 extern struct scsi_host_template lpfc_template_nvme;
 extern struct scsi_host_template lpfc_vport_template;
 extern struct fc_function_template lpfc_transport_functions;
@@ -554,3 +554,5 @@ void lpfc_nvme_abort_fcreq_cmpl(struct lpfc_hba *phba,
                                 struct lpfc_wcqe_complete *abts_cmpl);
 extern int lpfc_enable_nvmet_cnt;
 extern unsigned long long lpfc_enable_nvmet[];
+extern int lpfc_no_hba_reset_cnt;
+extern unsigned long lpfc_no_hba_reset[];
diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index c22bb3f887e1..d3e9af983015 100644
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -939,8 +939,8 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
                                          "FC4 x%08x, Data: x%08x x%08x\n",
                                          ndlp, did, ndlp->nlp_fc4_type,
                                          FC_TYPE_FCP, FC_TYPE_NVME);
+                        ndlp->nlp_prev_state = NLP_STE_REG_LOGIN_ISSUE;
                 }
-                ndlp->nlp_prev_state = NLP_STE_REG_LOGIN_ISSUE;
                 lpfc_nlp_set_state(vport, ndlp, NLP_STE_PRLI_ISSUE);
                 lpfc_issue_els_prli(vport, ndlp, 0);
         } else
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 9f4798e9d938..913eed822cb8 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -3653,17 +3653,6 @@ lpfc_idiag_queacc_write(struct file *file, const char __user *buf,
                         idiag.ptr_private = phba->sli4_hba.nvmels_cq;
                         goto pass_check;
                 }
-                /* NVME LS complete queue */
-                if (phba->sli4_hba.nvmels_cq &&
-                    phba->sli4_hba.nvmels_cq->queue_id == queid) {
-                        /* Sanity check */
-                        rc = lpfc_idiag_que_param_check(
-                                        phba->sli4_hba.nvmels_cq, index, count);
-                        if (rc)
-                                goto error_out;
-                        idiag.ptr_private = phba->sli4_hba.nvmels_cq;
-                        goto pass_check;
-                }
                 /* FCP complete queue */
                 if (phba->sli4_hba.fcp_cq) {
                         for (qidx = 0; qidx < phba->cfg_fcp_io_channel;
@@ -3738,17 +3727,6 @@ lpfc_idiag_queacc_write(struct file *file, const char __user *buf,
                         idiag.ptr_private = phba->sli4_hba.nvmels_wq;
                         goto pass_check;
                 }
-                /* NVME LS work queue */
-                if (phba->sli4_hba.nvmels_wq &&
-                    phba->sli4_hba.nvmels_wq->queue_id == queid) {
-                        /* Sanity check */
-                        rc = lpfc_idiag_que_param_check(
-                                        phba->sli4_hba.nvmels_wq, index, count);
-                        if (rc)
-                                goto error_out;
-                        idiag.ptr_private = phba->sli4_hba.nvmels_wq;
-                        goto pass_check;
-                }
                 /* FCP work queue */
                 if (phba->sli4_hba.fcp_wq) {
                         for (qidx = 0; qidx < phba->cfg_fcp_io_channel;
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h
index c05f56c3023f..7b7d314af0e0 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.h
+++ b/drivers/scsi/lpfc/lpfc_debugfs.h
@@ -44,14 +44,6 @@
 /* hbqinfo output buffer size */
 #define LPFC_HBQINFO_SIZE 8192
 
-enum {
-        DUMP_FCP,
-        DUMP_NVME,
-        DUMP_MBX,
-        DUMP_ELS,
-        DUMP_NVMELS,
-};
-
 /* nvmestat output buffer size */
 #define LPFC_NVMESTAT_SIZE 8192
 #define LPFC_NVMEKTIME_SIZE 8192
@@ -283,8 +275,22 @@ struct lpfc_idiag {
         struct lpfc_idiag_offset offset;
         void *ptr_private;
 };
+
+#else
+
+#define lpfc_nvmeio_data(phba, fmt, arg...) \
+        no_printk(fmt, ##arg)
+
 #endif
 
+enum {
+        DUMP_FCP,
+        DUMP_NVME,
+        DUMP_MBX,
+        DUMP_ELS,
+        DUMP_NVMELS,
+};
+
 /* Mask for discovery_trace */
 #define LPFC_DISC_TRC_ELS_CMD           0x1     /* Trace ELS commands */
 #define LPFC_DISC_TRC_ELS_RSP           0x2     /* Trace ELS response */
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 2d26440e6f2f..a5ca37e45fb6 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -5177,15 +5177,15 @@ lpfc_rdp_res_speed(struct fc_rdp_port_speed_desc *desc, struct lpfc_hba *phba)
 
 static uint32_t
 lpfc_rdp_res_diag_port_names(struct fc_rdp_port_name_desc *desc,
-                struct lpfc_hba *phba)
+                struct lpfc_vport *vport)
 {
 
         desc->tag = cpu_to_be32(RDP_PORT_NAMES_DESC_TAG);
 
-        memcpy(desc->port_names.wwnn, phba->wwnn,
+        memcpy(desc->port_names.wwnn, &vport->fc_nodename,
                         sizeof(desc->port_names.wwnn));
 
-        memcpy(desc->port_names.wwpn, phba->wwpn,
+        memcpy(desc->port_names.wwpn, &vport->fc_portname,
                         sizeof(desc->port_names.wwpn));
 
         desc->length = cpu_to_be32(sizeof(desc->port_names));
@@ -5279,7 +5279,7 @@ lpfc_els_rdp_cmpl(struct lpfc_hba *phba, struct lpfc_rdp_context *rdp_context,
         len += lpfc_rdp_res_link_error((struct fc_rdp_link_error_status_desc *)
                                        (len + pcmd), &rdp_context->link_stat);
         len += lpfc_rdp_res_diag_port_names((struct fc_rdp_port_name_desc *)
-                                             (len + pcmd), phba);
+                                             (len + pcmd), vport);
         len += lpfc_rdp_res_attach_port_names((struct fc_rdp_port_name_desc *)
                                         (len + pcmd), vport, ndlp);
         len += lpfc_rdp_res_fec_desc((struct fc_fec_rdp_desc *)(len + pcmd),
@@ -7968,7 +7968,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                         did, vport->port_state, ndlp->nlp_flag);
 
                 phba->fc_stat.elsRcvPRLI++;
-                if (vport->port_state < LPFC_DISC_AUTH) {
+                if ((vport->port_state < LPFC_DISC_AUTH) &&
+                    (vport->fc_flag & FC_FABRIC)) {
                         rjt_err = LSRJT_UNABLE_TPC;
                         rjt_exp = LSEXP_NOTHING_MORE;
                         break;
@@ -8371,11 +8372,17 @@ lpfc_cmpl_reg_new_vport(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
                         spin_lock_irq(shost->host_lock);
                         vport->fc_flag |= FC_VPORT_NEEDS_REG_VPI;
                         spin_unlock_irq(shost->host_lock);
-                        if (vport->port_type == LPFC_PHYSICAL_PORT
-                                && !(vport->fc_flag & FC_LOGO_RCVD_DID_CHNG))
-                                lpfc_issue_init_vfi(vport);
-                        else
+                        if (mb->mbxStatus == MBX_NOT_FINISHED)
+                                break;
+                        if ((vport->port_type == LPFC_PHYSICAL_PORT) &&
+                            !(vport->fc_flag & FC_LOGO_RCVD_DID_CHNG)) {
+                                if (phba->sli_rev == LPFC_SLI_REV4)
+                                        lpfc_issue_init_vfi(vport);
+                                else
+                                        lpfc_initial_flogi(vport);
+                        } else {
                                 lpfc_initial_fdisc(vport);
+                        }
                         break;
                 }
         } else {
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index 194a14d5f8a9..180b072beef6 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -313,8 +313,7 @@ lpfc_dev_loss_tmo_handler(struct lpfc_nodelist *ndlp)
                                  ndlp->nlp_state, ndlp->nlp_rpi);
         }
 
-        if (!(vport->load_flag & FC_UNLOADING) &&
-            !(ndlp->nlp_flag & NLP_DELAY_TMO) &&
+        if (!(ndlp->nlp_flag & NLP_DELAY_TMO) &&
             !(ndlp->nlp_flag & NLP_NPR_2B_DISC) &&
             (ndlp->nlp_state != NLP_STE_UNMAPPED_NODE) &&
             (ndlp->nlp_state != NLP_STE_REG_LOGIN_ISSUE) &&
@@ -641,6 +640,8 @@ lpfc_work_done(struct lpfc_hba *phba)
                         lpfc_handle_rrq_active(phba);
                 if (phba->hba_flag & FCP_XRI_ABORT_EVENT)
                         lpfc_sli4_fcp_xri_abort_event_proc(phba);
+                if (phba->hba_flag & NVME_XRI_ABORT_EVENT)
+                        lpfc_sli4_nvme_xri_abort_event_proc(phba);
                 if (phba->hba_flag & ELS_XRI_ABORT_EVENT)
                         lpfc_sli4_els_xri_abort_event_proc(phba);
                 if (phba->hba_flag & ASYNC_EVENT)
@@ -2173,7 +2174,7 @@ lpfc_mbx_cmpl_fcf_scan_read_fcf_rec(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq)
         uint32_t boot_flag, addr_mode;
         uint16_t fcf_index, next_fcf_index;
         struct lpfc_fcf_rec *fcf_rec = NULL;
-        uint16_t vlan_id;
+        uint16_t vlan_id = LPFC_FCOE_NULL_VID;
         bool select_new_fcf;
         int rc;
 
@@ -4020,9 +4021,11 @@ lpfc_register_remote_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
                 rdata = rport->dd_data;
                 /* break the link before dropping the ref */
                 ndlp->rport = NULL;
-                if (rdata && rdata->pnode == ndlp)
-                        lpfc_nlp_put(ndlp);
-                rdata->pnode = NULL;
+                if (rdata) {
+                        if (rdata->pnode == ndlp)
+                                lpfc_nlp_put(ndlp);
+                        rdata->pnode = NULL;
+                }
                 /* drop reference for earlier registeration */
                 put_device(&rport->dev);
         }
@@ -4344,9 +4347,8 @@ lpfc_initialize_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 {
         INIT_LIST_HEAD(&ndlp->els_retry_evt.evt_listp);
         INIT_LIST_HEAD(&ndlp->dev_loss_evt.evt_listp);
-        init_timer(&ndlp->nlp_delayfunc);
-        ndlp->nlp_delayfunc.function = lpfc_els_retry_delay;
-        ndlp->nlp_delayfunc.data = (unsigned long)ndlp;
+        setup_timer(&ndlp->nlp_delayfunc, lpfc_els_retry_delay,
+                        (unsigned long)ndlp);
         ndlp->nlp_DID = did;
         ndlp->vport = vport;
         ndlp->phba = vport->phba;
@@ -4606,9 +4608,9 @@ lpfc_sli4_dequeue_nport_iocbs(struct lpfc_hba *phba,
                 pring = qp->pring;
                 if (!pring)
                         continue;
-                spin_lock_irq(&pring->ring_lock);
+                spin_lock(&pring->ring_lock);
                 __lpfc_dequeue_nport_iocbs(phba, ndlp, pring, dequeue_list);
-                spin_unlock_irq(&pring->ring_lock);
+                spin_unlock(&pring->ring_lock);
         }
         spin_unlock_irq(&phba->hbalock);
 }
diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h
index cfdb068a3bfc..15277705cb6b 100644
--- a/drivers/scsi/lpfc/lpfc_hw4.h
+++ b/drivers/scsi/lpfc/lpfc_hw4.h
@@ -1001,7 +1001,7 @@ struct eq_delay_info {
         uint32_t phase;
         uint32_t delay_multi;
 };
-#define LPFC_MAX_EQ_DELAY       8
+#define LPFC_MAX_EQ_DELAY_EQID_CNT      8
 
 struct sgl_page_pairs {
         uint32_t sgl_pg0_addr_lo;
@@ -1070,7 +1070,7 @@ struct lpfc_mbx_modify_eq_delay {
         union {
                 struct {
                         uint32_t num_eq;
-                        struct eq_delay_info eq[LPFC_MAX_EQ_DELAY];
+                        struct eq_delay_info eq[LPFC_MAX_EQ_DELAY_EQID_CNT];
                 } request;
                 struct {
                         uint32_t word0;
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 0ee429d773f3..6cc561b04211 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -3555,6 +3555,44 @@ out_free_mem:
         return rc;
 }
 
+static uint64_t
+lpfc_get_wwpn(struct lpfc_hba *phba)
+{
+        uint64_t wwn;
+        int rc;
+        LPFC_MBOXQ_t *mboxq;
+        MAILBOX_t *mb;
+
+
+        mboxq = (LPFC_MBOXQ_t *) mempool_alloc(phba->mbox_mem_pool,
+                                                GFP_KERNEL);
+        if (!mboxq)
+                return (uint64_t)-1;
+
+        /* First get WWN of HBA instance */
+        lpfc_read_nv(phba, mboxq);
+        rc = lpfc_sli_issue_mbox(phba, mboxq, MBX_POLL);
+        if (rc != MBX_SUCCESS) {
+                lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+                                "6019 Mailbox failed , mbxCmd x%x "
+                                "READ_NV, mbxStatus x%x\n",
+                                bf_get(lpfc_mqe_command, &mboxq->u.mqe),
+                                bf_get(lpfc_mqe_status, &mboxq->u.mqe));
+                mempool_free(mboxq, phba->mbox_mem_pool);
+                return (uint64_t) -1;
+        }
+        mb = &mboxq->u.mb;
+        memcpy(&wwn, (char *)mb->un.varRDnvp.portname, sizeof(uint64_t));
+        /* wwn is WWPN of HBA instance */
+        mempool_free(mboxq, phba->mbox_mem_pool);
+        if (phba->sli_rev == LPFC_SLI_REV4)
+                return be64_to_cpu(wwn);
+        else
+                return (((wwn & 0xffffffff00000000) >> 32) |
+                        ((wwn & 0x00000000ffffffff) << 32));
+
+}
+
 /**
  * lpfc_sli4_nvme_sgl_update - update xri-sgl sizing and mapping
  * @phba: pointer to lpfc hba data structure.
@@ -3676,17 +3714,32 @@ lpfc_create_port(struct lpfc_hba *phba, int instance, struct device *dev)
         struct lpfc_vport *vport;
         struct Scsi_Host  *shost = NULL;
         int error = 0;
+        int i;
+        uint64_t wwn;
+        bool use_no_reset_hba = false;
+
+        wwn = lpfc_get_wwpn(phba);
+
+        for (i = 0; i < lpfc_no_hba_reset_cnt; i++) {
+                if (wwn == lpfc_no_hba_reset[i]) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+                                        "6020 Setting use_no_reset port=%llx\n",
+                                        wwn);
+                        use_no_reset_hba = true;
+                        break;
+                }
+        }
 
         if (phba->cfg_enable_fc4_type & LPFC_ENABLE_FCP) {
                 if (dev != &phba->pcidev->dev) {
                         shost = scsi_host_alloc(&lpfc_vport_template,
                                                 sizeof(struct lpfc_vport));
                 } else {
-                        if (phba->sli_rev == LPFC_SLI_REV4)
+                        if (!use_no_reset_hba)
                                 shost = scsi_host_alloc(&lpfc_template,
                                                 sizeof(struct lpfc_vport));
                         else
-                                shost = scsi_host_alloc(&lpfc_template_s3,
+                                shost = scsi_host_alloc(&lpfc_template_no_hr,
                                                 sizeof(struct lpfc_vport));
                 }
         } else if (phba->cfg_enable_fc4_type & LPFC_ENABLE_NVME) {
@@ -3734,17 +3787,14 @@ lpfc_create_port(struct lpfc_hba *phba, int instance, struct device *dev)
         INIT_LIST_HEAD(&vport->rcv_buffer_list);
         spin_lock_init(&vport->work_port_lock);
 
-        init_timer(&vport->fc_disctmo);
-        vport->fc_disctmo.function = lpfc_disc_timeout;
-        vport->fc_disctmo.data = (unsigned long)vport;
+        setup_timer(&vport->fc_disctmo, lpfc_disc_timeout,
+                        (unsigned long)vport);
 
-        init_timer(&vport->els_tmofunc);
-        vport->els_tmofunc.function = lpfc_els_timeout;
-        vport->els_tmofunc.data = (unsigned long)vport;
+        setup_timer(&vport->els_tmofunc, lpfc_els_timeout,
+                        (unsigned long)vport);
 
-        init_timer(&vport->delayed_disc_tmo);
-        vport->delayed_disc_tmo.function = lpfc_delayed_disc_tmo;
-        vport->delayed_disc_tmo.data = (unsigned long)vport;
+        setup_timer(&vport->delayed_disc_tmo, lpfc_delayed_disc_tmo,
+                        (unsigned long)vport);
 
         error = scsi_add_host_with_dma(shost, dev, &phba->pcidev->dev);
         if (error)
@@ -5406,21 +5456,15 @@ lpfc_setup_driver_resource_phase1(struct lpfc_hba *phba)
         INIT_LIST_HEAD(&phba->luns);
 
         /* MBOX heartbeat timer */
-        init_timer(&psli->mbox_tmo);
-        psli->mbox_tmo.function = lpfc_mbox_timeout;
-        psli->mbox_tmo.data = (unsigned long) phba;
+        setup_timer(&psli->mbox_tmo, lpfc_mbox_timeout, (unsigned long)phba);
         /* Fabric block timer */
-        init_timer(&phba->fabric_block_timer);
-        phba->fabric_block_timer.function = lpfc_fabric_block_timeout;
-        phba->fabric_block_timer.data = (unsigned long) phba;
+        setup_timer(&phba->fabric_block_timer, lpfc_fabric_block_timeout,
+                        (unsigned long)phba);
         /* EA polling mode timer */
-        init_timer(&phba->eratt_poll);
-        phba->eratt_poll.function = lpfc_poll_eratt;
-        phba->eratt_poll.data = (unsigned long) phba;
+        setup_timer(&phba->eratt_poll, lpfc_poll_eratt,
+                        (unsigned long)phba);
         /* Heartbeat timer */
-        init_timer(&phba->hb_tmofunc);
-        phba->hb_tmofunc.function = lpfc_hb_timeout;
-        phba->hb_tmofunc.data = (unsigned long)phba;
+        setup_timer(&phba->hb_tmofunc, lpfc_hb_timeout, (unsigned long)phba);
 
         return 0;
 }
@@ -5446,9 +5490,8 @@ lpfc_sli_driver_resource_setup(struct lpfc_hba *phba)
          */
 
         /* FCP polling mode timer */
-        init_timer(&phba->fcp_poll_timer);
-        phba->fcp_poll_timer.function = lpfc_poll_timeout;
-        phba->fcp_poll_timer.data = (unsigned long) phba;
+        setup_timer(&phba->fcp_poll_timer, lpfc_poll_timeout,
+                        (unsigned long)phba);
 
         /* Host attention work mask setup */
         phba->work_ha_mask = (HA_ERATT | HA_MBATT | HA_LATT);
@@ -5482,7 +5525,8 @@ lpfc_sli_driver_resource_setup(struct lpfc_hba *phba)
 
         /* Initialize the host templates the configured values. */
         lpfc_vport_template.sg_tablesize = phba->cfg_sg_seg_cnt;
-        lpfc_template_s3.sg_tablesize = phba->cfg_sg_seg_cnt;
+        lpfc_template_no_hr.sg_tablesize = phba->cfg_sg_seg_cnt;
+        lpfc_template.sg_tablesize = phba->cfg_sg_seg_cnt;
 
         /* There are going to be 2 reserved BDEs: 1 FCP cmnd + 1 FCP rsp */
         if (phba->cfg_enable_bg) {
@@ -5617,14 +5661,11 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
          * Initialize timers used by driver
          */
 
-        init_timer(&phba->rrq_tmr);
-        phba->rrq_tmr.function = lpfc_rrq_timeout;
-        phba->rrq_tmr.data = (unsigned long)phba;
+        setup_timer(&phba->rrq_tmr, lpfc_rrq_timeout, (unsigned long)phba);
 
         /* FCF rediscover timer */
-        init_timer(&phba->fcf.redisc_wait);
-        phba->fcf.redisc_wait.function = lpfc_sli4_fcf_redisc_wait_tmo;
-        phba->fcf.redisc_wait.data = (unsigned long)phba;
+        setup_timer(&phba->fcf.redisc_wait, lpfc_sli4_fcf_redisc_wait_tmo,
+                        (unsigned long)phba);
 
         /*
          * Control structure for handling external multi-buffer mailbox
@@ -5706,6 +5747,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
         /* Initialize the host templates with the updated values. */
         lpfc_vport_template.sg_tablesize = phba->cfg_sg_seg_cnt;
         lpfc_template.sg_tablesize = phba->cfg_sg_seg_cnt;
+        lpfc_template_no_hr.sg_tablesize = phba->cfg_sg_seg_cnt;
 
         if (phba->cfg_sg_dma_buf_size  <= LPFC_MIN_SG_SLI4_BUF_SZ)
                 phba->cfg_sg_dma_buf_size = LPFC_MIN_SG_SLI4_BUF_SZ;
@@ -5736,6 +5778,8 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                 /* Initialize the Abort nvme buffer list used by driver */
                 spin_lock_init(&phba->sli4_hba.abts_nvme_buf_list_lock);
                 INIT_LIST_HEAD(&phba->sli4_hba.lpfc_abts_nvme_buf_list);
+                /* Fast-path XRI aborted CQ Event work queue list */
+                INIT_LIST_HEAD(&phba->sli4_hba.sp_nvme_xri_aborted_work_queue);
         }
 
         /* This abort list used by worker thread */
@@ -5847,10 +5891,17 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                 /* Check to see if it matches any module parameter */
                 for (i = 0; i < lpfc_enable_nvmet_cnt; i++) {
                         if (wwn == lpfc_enable_nvmet[i]) {
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "6017 NVME Target %016llx\n",
                                                 wwn);
                                 phba->nvmet_support = 1; /* a match */
+#else
+                                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                                "6021 Can't enable NVME Target."
+                                                " NVME_TARGET_FC infrastructure"
+                                                " is not in kernel\n");
+#endif
                         }
                 }
         }
@@ -8712,12 +8763,9 @@ lpfc_sli4_queue_setup(struct lpfc_hba *phba)
                 }
         }
 
-        /*
-         * Configure EQ delay multipier for interrupt coalescing using
-         * MODIFY_EQ_DELAY for all EQs created, LPFC_MAX_EQ_DELAY at a time.
-         */
-        for (qidx = 0; qidx < io_channel; qidx += LPFC_MAX_EQ_DELAY)
+        for (qidx = 0; qidx < io_channel; qidx += LPFC_MAX_EQ_DELAY_EQID_CNT)
                 lpfc_modify_hba_eq_delay(phba, qidx);
+
         return 0;
 
 out_destroy:
@@ -8973,6 +9021,11 @@ lpfc_sli4_cq_event_release_all(struct lpfc_hba *phba)
         /* Pending ELS XRI abort events */
         list_splice_init(&phba->sli4_hba.sp_els_xri_aborted_work_queue,
                          &cqelist);
+        if (phba->cfg_enable_fc4_type & LPFC_ENABLE_NVME) {
+                /* Pending NVME XRI abort events */
+                list_splice_init(&phba->sli4_hba.sp_nvme_xri_aborted_work_queue,
+                                 &cqelist);
+        }
         /* Pending asynnc events */
         list_splice_init(&phba->sli4_hba.sp_asynce_work_queue,
                          &cqelist);
@@ -10400,12 +10453,7 @@ lpfc_pci_remove_one_s3(struct pci_dev *pdev)
         fc_remove_host(shost);
         scsi_remove_host(shost);
 
-        /* Perform ndlp cleanup on the physical port.  The nvme and nvmet
-         * localports are destroyed after to cleanup all transport memory.
-         */
         lpfc_cleanup(vport);
-        lpfc_nvmet_destroy_targetport(phba);
-        lpfc_nvme_destroy_localport(vport);
 
         /*
          * Bring down the SLI Layer. This step disable all interrupts,
@@ -12018,6 +12066,7 @@ static struct pci_driver lpfc_driver = {
         .id_table       = lpfc_id_table,
         .probe          = lpfc_pci_probe_one,
         .remove         = lpfc_pci_remove_one,
+        .shutdown       = lpfc_pci_remove_one,
         .suspend        = lpfc_pci_suspend_one,
         .resume         = lpfc_pci_resume_one,
         .err_handler    = &lpfc_err_handler,
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index c61d8d692ede..5986c7957199 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -646,7 +646,6 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
         }
 
         dma_buf->iocbq = lpfc_sli_get_iocbq(phba);
-        dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
         if (!dma_buf->iocbq) {
                 kfree(dma_buf->context);
                 pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
@@ -658,6 +657,7 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
                                 "2621 Ran out of nvmet iocb/WQEs\n");
                 return NULL;
         }
+        dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
         nvmewqe = dma_buf->iocbq;
         wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;
         /* Initialize WQE */
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 609a908ea9db..0024de1c6c1f 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -316,7 +316,7 @@ lpfc_nvme_gen_req(struct lpfc_vport *vport, struct lpfc_dmabuf *bmp,
         bf_set(wqe_dfctl, &wqe->gen_req.wge_ctl, 0);
         bf_set(wqe_si, &wqe->gen_req.wge_ctl, 1);
         bf_set(wqe_la, &wqe->gen_req.wge_ctl, 1);
-        bf_set(wqe_rctl, &wqe->gen_req.wge_ctl, FC_RCTL_DD_UNSOL_CTL);
+        bf_set(wqe_rctl, &wqe->gen_req.wge_ctl, FC_RCTL_ELS4_REQ);
         bf_set(wqe_type, &wqe->gen_req.wge_ctl, FC_TYPE_NVME);
 
         /* Word 6 */
@@ -620,15 +620,15 @@ lpfc_nvme_adj_fcp_sgls(struct lpfc_vport *vport,
          * Embed the payload in the last half of the WQE
          * WQE words 16-30 get the NVME CMD IU payload
          *
-         * WQE Word 16 is already setup with flags
-         * WQE words 17-19 get payload Words 2-4
+         * WQE words 16-19 get payload Words 1-4
          * WQE words 20-21 get payload Words 6-7
          * WQE words 22-29 get payload Words 16-23
          */
-        wptr = &wqe->words[17];  /* WQE ptr */
+        wptr = &wqe->words[16];  /* WQE ptr */
         dptr = (uint32_t *)nCmd->cmdaddr;  /* payload ptr */
-        dptr += 2;              /* Skip Words 0-1 in payload */
+        dptr++;                 /* Skip Word 0 in payload */
 
+        *wptr++ = *dptr++;      /* Word 1 */
         *wptr++ = *dptr++;      /* Word 2 */
         *wptr++ = *dptr++;      /* Word 3 */
         *wptr++ = *dptr++;      /* Word 4 */
@@ -978,9 +978,6 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport,
                         bf_set(wqe_cmd_type, &wqe->generic.wqe_com,
                                NVME_WRITE_CMD);
 
-                        /* Word 16 */
-                        wqe->words[16] = LPFC_NVME_EMBED_WRITE;
-
                         phba->fc4NvmeOutputRequests++;
                 } else {
                         /* Word 7 */
@@ -1002,9 +999,6 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport,
                         bf_set(wqe_cmd_type, &wqe->generic.wqe_com,
                                NVME_READ_CMD);
 
-                        /* Word 16 */
-                        wqe->words[16] = LPFC_NVME_EMBED_READ;
-
                         phba->fc4NvmeInputRequests++;
                 }
         } else {
@@ -1026,9 +1020,6 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport,
                 /* Word 11 */
                 bf_set(wqe_cmd_type, &wqe->generic.wqe_com, NVME_READ_CMD);
 
-                /* Word 16 */
-                wqe->words[16] = LPFC_NVME_EMBED_CMD;
-
                 phba->fc4NvmeControlRequests++;
         }
         /*
@@ -1286,6 +1277,7 @@ lpfc_nvme_fcp_io_submit(struct nvme_fc_local_port *pnvme_lport,
         pnvme_fcreq->private = (void *)lpfc_ncmd;
         lpfc_ncmd->nvmeCmd = pnvme_fcreq;
         lpfc_ncmd->nrport = rport;
+        lpfc_ncmd->ndlp = ndlp;
         lpfc_ncmd->start_time = jiffies;
 
         lpfc_nvme_prep_io_cmd(vport, lpfc_ncmd, ndlp);
@@ -1319,7 +1311,7 @@ lpfc_nvme_fcp_io_submit(struct nvme_fc_local_port *pnvme_lport,
                                  "sid: x%x did: x%x oxid: x%x\n",
                                  ret, vport->fc_myDID, ndlp->nlp_DID,
                                  lpfc_ncmd->cur_iocbq.sli4_xritag);
-                ret = -EINVAL;
+                ret = -EBUSY;
                 goto out_free_nvme_buf;
         }
 
@@ -1821,10 +1813,10 @@ lpfc_post_nvme_sgl_list(struct lpfc_hba *phba,
                                                 pdma_phys_sgl1, cur_xritag);
                                 if (status) {
                                         /* failure, put on abort nvme list */
-                                        lpfc_ncmd->exch_busy = 1;
+                                        lpfc_ncmd->flags |= LPFC_SBUF_XBUSY;
                                 } else {
                                         /* success, put on NVME buffer list */
-                                        lpfc_ncmd->exch_busy = 0;
+                                        lpfc_ncmd->flags &= ~LPFC_SBUF_XBUSY;
                                         lpfc_ncmd->status = IOSTAT_SUCCESS;
                                         num_posted++;
                                 }
@@ -1854,10 +1846,10 @@ lpfc_post_nvme_sgl_list(struct lpfc_hba *phba,
                                          struct lpfc_nvme_buf, list);
                         if (status) {
                                 /* failure, put on abort nvme list */
-                                lpfc_ncmd->exch_busy = 1;
+                                lpfc_ncmd->flags |= LPFC_SBUF_XBUSY;
                         } else {
                                 /* success, put on NVME buffer list */
-                                lpfc_ncmd->exch_busy = 0;
+                                lpfc_ncmd->flags &= ~LPFC_SBUF_XBUSY;
                                 lpfc_ncmd->status = IOSTAT_SUCCESS;
                                 num_posted++;
                         }
@@ -2099,7 +2091,7 @@ lpfc_release_nvme_buf(struct lpfc_hba *phba, struct lpfc_nvme_buf *lpfc_ncmd)
         unsigned long iflag = 0;
 
         lpfc_ncmd->nonsg_phys = 0;
-        if (lpfc_ncmd->exch_busy) {
+        if (lpfc_ncmd->flags & LPFC_SBUF_XBUSY) {
                 spin_lock_irqsave(&phba->sli4_hba.abts_nvme_buf_list_lock,
                                         iflag);
                 lpfc_ncmd->nvmeCmd = NULL;
@@ -2135,11 +2127,12 @@ lpfc_release_nvme_buf(struct lpfc_hba *phba, struct lpfc_nvme_buf *lpfc_ncmd)
 int
 lpfc_nvme_create_localport(struct lpfc_vport *vport)
 {
+        int ret = 0;
         struct lpfc_hba  *phba = vport->phba;
         struct nvme_fc_port_info nfcp_info;
         struct nvme_fc_local_port *localport;
         struct lpfc_nvme_lport *lport;
-        int len, ret = 0;
+        int len;
 
         /* Initialize this localport instance.  The vport wwn usage ensures
          * that NPIV is accounted for.
@@ -2156,8 +2149,12 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
         /* localport is allocated from the stack, but the registration
          * call allocates heap memory as well as the private area.
          */
+#if (IS_ENABLED(CONFIG_NVME_FC))
         ret = nvme_fc_register_localport(&nfcp_info, &lpfc_nvme_template,
                                          &vport->phba->pcidev->dev, &localport);
+#else
+        ret = -ENOMEM;
+#endif
         if (!ret) {
                 lpfc_printf_vlog(vport, KERN_INFO, LOG_NVME | LOG_NVME_DISC,
                                  "6005 Successfully registered local "
@@ -2173,10 +2170,10 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
                 lport->vport = vport;
                 INIT_LIST_HEAD(&lport->rport_list);
                 vport->nvmei_support = 1;
+                len  = lpfc_new_nvme_buf(vport, phba->sli4_hba.nvme_xri_max);
+                vport->phba->total_nvme_bufs += len;
         }
 
-        len  = lpfc_new_nvme_buf(vport, phba->sli4_hba.nvme_xri_max);
-        vport->phba->total_nvme_bufs += len;
         return ret;
 }
 
@@ -2193,6 +2190,7 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
 void
 lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
 {
+#if (IS_ENABLED(CONFIG_NVME_FC))
         struct nvme_fc_local_port *localport;
         struct lpfc_nvme_lport *lport;
         struct lpfc_nvme_rport *rport = NULL, *rport_next = NULL;
@@ -2208,7 +2206,6 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
         lpfc_printf_vlog(vport, KERN_INFO, LOG_NVME,
                          "6011 Destroying NVME localport %p\n",
                          localport);
-
         list_for_each_entry_safe(rport, rport_next, &lport->rport_list, list) {
                 /* The last node ref has to get released now before the rport
                  * private memory area is released by the transport.
@@ -2222,6 +2219,7 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
                                          "6008 rport fail destroy %x\n", ret);
                 wait_for_completion_timeout(&rport->rport_unreg_done, 5);
         }
+
         /* lport's rport list is clear.  Unregister
          * lport and release resources.
          */
@@ -2245,6 +2243,7 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
                                  "Failed, status x%x\n",
                                  ret);
         }
+#endif
 }
 
 void
@@ -2275,6 +2274,7 @@ lpfc_nvme_update_localport(struct lpfc_vport *vport)
 int
 lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 {
+#if (IS_ENABLED(CONFIG_NVME_FC))
         int ret = 0;
         struct nvme_fc_local_port *localport;
         struct lpfc_nvme_lport *lport;
@@ -2348,7 +2348,6 @@ lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
                         rpinfo.port_role |= FC_PORT_ROLE_NVME_INITIATOR;
                 rpinfo.port_name = wwn_to_u64(ndlp->nlp_portname.u.wwn);
                 rpinfo.node_name = wwn_to_u64(ndlp->nlp_nodename.u.wwn);
-
                 ret = nvme_fc_register_remoteport(localport, &rpinfo,
                                                   &remote_port);
                 if (!ret) {
@@ -2384,6 +2383,9 @@ lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
                                  ndlp->nlp_type, ndlp->nlp_DID, ndlp);
         }
         return ret;
+#else
+        return 0;
+#endif
 }
 
 /* lpfc_nvme_unregister_port - unbind the DID and port_role from this rport.
@@ -2401,6 +2403,7 @@ lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 void
 lpfc_nvme_unregister_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 {
+#if (IS_ENABLED(CONFIG_NVME_FC))
         int ret;
         struct nvme_fc_local_port *localport;
         struct lpfc_nvme_lport *lport;
@@ -2458,7 +2461,61 @@ lpfc_nvme_unregister_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
         return;
 
  input_err:
+#endif
         lpfc_printf_vlog(vport, KERN_ERR, LOG_NVME_DISC,
                          "6168: State error: lport %p, rport%p FCID x%06x\n",
                          vport->localport, ndlp->rport, ndlp->nlp_DID);
 }
+
+/**
+ * lpfc_sli4_nvme_xri_aborted - Fast-path process of NVME xri abort
+ * @phba: pointer to lpfc hba data structure.
+ * @axri: pointer to the fcp xri abort wcqe structure.
+ *
+ * This routine is invoked by the worker thread to process a SLI4 fast-path
+ * FCP aborted xri.
+ **/
+void
+lpfc_sli4_nvme_xri_aborted(struct lpfc_hba *phba,
+                           struct sli4_wcqe_xri_aborted *axri)
+{
+        uint16_t xri = bf_get(lpfc_wcqe_xa_xri, axri);
+        uint16_t rxid = bf_get(lpfc_wcqe_xa_remote_xid, axri);
+        struct lpfc_nvme_buf *lpfc_ncmd, *next_lpfc_ncmd;
+        struct lpfc_nodelist *ndlp;
+        unsigned long iflag = 0;
+        int rrq_empty = 0;
+
+        if (!(phba->cfg_enable_fc4_type & LPFC_ENABLE_NVME))
+                return;
+        spin_lock_irqsave(&phba->hbalock, iflag);
+        spin_lock(&phba->sli4_hba.abts_nvme_buf_list_lock);
+        list_for_each_entry_safe(lpfc_ncmd, next_lpfc_ncmd,
+                                 &phba->sli4_hba.lpfc_abts_nvme_buf_list,
+                                 list) {
+                if (lpfc_ncmd->cur_iocbq.sli4_xritag == xri) {
+                        list_del(&lpfc_ncmd->list);
+                        lpfc_ncmd->flags &= ~LPFC_SBUF_XBUSY;
+                        lpfc_ncmd->status = IOSTAT_SUCCESS;
+                        spin_unlock(
+                                &phba->sli4_hba.abts_nvme_buf_list_lock);
+
+                        rrq_empty = list_empty(&phba->active_rrq_list);
+                        spin_unlock_irqrestore(&phba->hbalock, iflag);
+                        ndlp = lpfc_ncmd->ndlp;
+                        if (ndlp) {
+                                lpfc_set_rrq_active(
+                                        phba, ndlp,
+                                        lpfc_ncmd->cur_iocbq.sli4_lxritag,
+                                        rxid, 1);
+                                lpfc_sli4_abts_err_handler(phba, ndlp, axri);
+                        }
+                        lpfc_release_nvme_buf(phba, lpfc_ncmd);
+                        if (rrq_empty)
+                                lpfc_worker_wake_up(phba);
+                        return;
+                }
+        }
+        spin_unlock(&phba->sli4_hba.abts_nvme_buf_list_lock);
+        spin_unlock_irqrestore(&phba->hbalock, iflag);
+}
diff --git a/drivers/scsi/lpfc/lpfc_nvme.h b/drivers/scsi/lpfc/lpfc_nvme.h
index b2fae5e813f8..1347deb8dd6c 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.h
+++ b/drivers/scsi/lpfc/lpfc_nvme.h
@@ -57,6 +57,7 @@ struct lpfc_nvme_buf {
         struct list_head list;
         struct nvmefc_fcp_req *nvmeCmd;
         struct lpfc_nvme_rport *nrport;
+        struct lpfc_nodelist *ndlp;
 
         uint32_t timeout;
 
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index c421e1738ee9..acba1b67e505 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -520,7 +520,7 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
         struct lpfc_hba *phba = ctxp->phba;
         struct lpfc_iocbq *nvmewqeq;
         unsigned long iflags;
-        int rc, id;
+        int rc;
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
         if (phba->ktime_on) {
@@ -530,7 +530,7 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
                         ctxp->ts_nvme_data = ktime_get_ns();
         }
         if (phba->cpucheck_on & LPFC_CHECK_NVMET_IO) {
-                id = smp_processor_id();
+                int id = smp_processor_id();
                 ctxp->cpu = id;
                 if (id < LPFC_CHECK_CPU_CNT)
                         phba->cpucheck_xmt_io[id]++;
@@ -571,6 +571,7 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
                                 "6102 Bad state IO x%x aborted\n",
                                 ctxp->oxid);
+                rc = -ENXIO;
                 goto aerr;
         }
 
@@ -580,6 +581,7 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
                                 "6152 FCP Drop IO x%x: Prep\n",
                                 ctxp->oxid);
+                rc = -ENXIO;
                 goto aerr;
         }
 
@@ -618,8 +620,9 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
         ctxp->wqeq->hba_wqidx = 0;
         nvmewqeq->context2 = NULL;
         nvmewqeq->context3 = NULL;
+        rc = -EBUSY;
 aerr:
-        return -ENXIO;
+        return rc;
 }
 
 static void
@@ -668,9 +671,13 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
         lpfc_tgttemplate.target_features = NVMET_FCTGTFEAT_READDATA_RSP |
                                            NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED;
 
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
         error = nvmet_fc_register_targetport(&pinfo, &lpfc_tgttemplate,
                                              &phba->pcidev->dev,
                                              &phba->targetport);
+#else
+        error = -ENOMEM;
+#endif
         if (error) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_DISC,
                                 "6025 Cannot register NVME targetport "
@@ -731,9 +738,25 @@ lpfc_nvmet_update_targetport(struct lpfc_hba *phba)
         return 0;
 }
 
+/**
+ * lpfc_sli4_nvmet_xri_aborted - Fast-path process of nvmet xri abort
+ * @phba: pointer to lpfc hba data structure.
+ * @axri: pointer to the nvmet xri abort wcqe structure.
+ *
+ * This routine is invoked by the worker thread to process a SLI4 fast-path
+ * NVMET aborted xri.
+ **/
+void
+lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
+                            struct sli4_wcqe_xri_aborted *axri)
+{
+        /* TODO: work in progress */
+}
+
 void
 lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
 {
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
         struct lpfc_nvmet_tgtport *tgtp;
 
         if (phba->nvmet_support == 0)
@@ -745,6 +768,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
                 wait_for_completion_timeout(&tgtp->tport_unreg_done, 5);
         }
         phba->targetport = NULL;
+#endif
 }
 
 /**
@@ -764,6 +788,7 @@ static void
 lpfc_nvmet_unsol_ls_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                            struct hbq_dmabuf *nvmebuf)
 {
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
         struct lpfc_nvmet_tgtport *tgtp;
         struct fc_frame_header *fc_hdr;
         struct lpfc_nvmet_rcv_ctx *ctxp;
@@ -844,6 +869,7 @@ dropit:
 
         atomic_inc(&tgtp->xmt_ls_abort);
         lpfc_nvmet_unsol_ls_issue_abort(phba, ctxp, sid, oxid);
+#endif
 }
 
 /**
@@ -865,6 +891,7 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
                             struct rqb_dmabuf *nvmebuf,
                             uint64_t isr_timestamp)
 {
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
         struct lpfc_nvmet_rcv_ctx *ctxp;
         struct lpfc_nvmet_tgtport *tgtp;
         struct fc_frame_header *fc_hdr;
@@ -955,7 +982,7 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
 
         atomic_inc(&tgtp->rcv_fcp_cmd_drop);
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                        "6159 FCP Drop IO x%x: nvmet_fc_rcv_fcp_req x%x\n",
+                        "6159 FCP Drop IO x%x: err x%x\n",
                         ctxp->oxid, rc);
 dropit:
         lpfc_nvmeio_data(phba, "NVMET FCP DROP: xri x%x sz %d from %06x\n",
@@ -970,6 +997,7 @@ dropit:
                 /* We assume a rcv'ed cmd ALWAYs fits into 1 buffer */
                 lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
         }
+#endif
 }
 
 /**
@@ -1114,7 +1142,7 @@ lpfc_nvmet_prep_ls_wqe(struct lpfc_hba *phba,
         bf_set(wqe_dfctl, &wqe->xmit_sequence.wge_ctl, 0);
         bf_set(wqe_ls, &wqe->xmit_sequence.wge_ctl, 1);
         bf_set(wqe_la, &wqe->xmit_sequence.wge_ctl, 0);
-        bf_set(wqe_rctl, &wqe->xmit_sequence.wge_ctl, FC_RCTL_DD_SOL_CTL);
+        bf_set(wqe_rctl, &wqe->xmit_sequence.wge_ctl, FC_RCTL_ELS4_REP);
         bf_set(wqe_type, &wqe->xmit_sequence.wge_ctl, FC_TYPE_NVME);
 
         /* Word 6 */
@@ -1445,7 +1473,6 @@ lpfc_nvmet_prep_fcp_wqe(struct lpfc_hba *phba,
 
         case NVMET_FCOP_RSP:
                 /* Words 0 - 2 */
-                sgel = &rsp->sg[0];
                 physaddr = rsp->rspdma;
                 wqe->fcp_trsp.bde.tus.f.bdeFlags = BUFF_TYPE_BDE_64;
                 wqe->fcp_trsp.bde.tus.f.bdeSize = rsp->rsplen;
@@ -1681,8 +1708,8 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba,
         struct lpfc_nodelist *ndlp;
 
         lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
-                        "6067 %s: Entrypoint: sid %x xri %x\n", __func__,
-                        sid, xri);
+                        "6067 Abort: sid %x xri x%x/x%x\n",
+                        sid, xri, ctxp->wqeq->sli4_xritag);
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
 
@@ -1693,7 +1720,7 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba,
                 atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_WARNING, LOG_NVME_ABTS,
                                 "6134 Drop ABTS - wrong NDLP state x%x.\n",
-                                ndlp->nlp_state);
+                                (ndlp) ? ndlp->nlp_state : NLP_STE_MAX_STATE);
 
                 /* No failure to an ABTS request. */
                 return 0;
@@ -1791,7 +1818,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
                 atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_WARNING, LOG_NVME_ABTS,
                                 "6160 Drop ABTS - wrong NDLP state x%x.\n",
-                                ndlp->nlp_state);
+                                (ndlp) ? ndlp->nlp_state : NLP_STE_MAX_STATE);
 
                 /* No failure to an ABTS request. */
                 return 0;
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index 9d6384af9fce..54fd0c81ceaf 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -5953,12 +5953,13 @@ struct scsi_host_template lpfc_template_nvme = {
         .track_queue_depth      = 0,
 };
 
-struct scsi_host_template lpfc_template_s3 = {
+struct scsi_host_template lpfc_template_no_hr = {
         .module                 = THIS_MODULE,
         .name                   = LPFC_DRIVER_NAME,
         .proc_name              = LPFC_DRIVER_NAME,
         .info                   = lpfc_info,
         .queuecommand           = lpfc_queuecommand,
+        .eh_timed_out           = fc_eh_timed_out,
         .eh_abort_handler       = lpfc_abort_handler,
         .eh_device_reset_handler = lpfc_device_reset_handler,
         .eh_target_reset_handler = lpfc_target_reset_handler,
@@ -6015,7 +6016,6 @@ struct scsi_host_template lpfc_vport_template = {
         .eh_abort_handler       = lpfc_abort_handler,
         .eh_device_reset_handler = lpfc_device_reset_handler,
         .eh_target_reset_handler = lpfc_target_reset_handler,
-        .eh_bus_reset_handler   = lpfc_bus_reset_handler,
         .slave_alloc            = lpfc_slave_alloc,
         .slave_configure        = lpfc_slave_configure,
         .slave_destroy          = lpfc_slave_destroy,
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index e43e5e23c24b..1c9fa45df7eb 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -1,3 +1,4 @@
+
 /*******************************************************************
  * This file is part of the Emulex Linux Device Driver for         *
  * Fibre Channel Host Bus Adapters.                                *
@@ -952,7 +953,7 @@ __lpfc_sli_get_els_sglq(struct lpfc_hba *phba, struct lpfc_iocbq *piocbq)
         start_sglq = sglq;
         while (!found) {
                 if (!sglq)
-                        return NULL;
+                        break;
                 if (ndlp && ndlp->active_rrqs_xri_bitmap &&
                     test_bit(sglq->sli4_lxritag,
                     ndlp->active_rrqs_xri_bitmap)) {
@@ -12213,6 +12214,41 @@ void lpfc_sli4_fcp_xri_abort_event_proc(struct lpfc_hba *phba)
 }
 
 /**
+ * lpfc_sli4_nvme_xri_abort_event_proc - Process nvme xri abort event
+ * @phba: pointer to lpfc hba data structure.
+ *
+ * This routine is invoked by the worker thread to process all the pending
+ * SLI4 NVME abort XRI events.
+ **/
+void lpfc_sli4_nvme_xri_abort_event_proc(struct lpfc_hba *phba)
+{
+        struct lpfc_cq_event *cq_event;
+
+        /* First, declare the fcp xri abort event has been handled */
+        spin_lock_irq(&phba->hbalock);
+        phba->hba_flag &= ~NVME_XRI_ABORT_EVENT;
+        spin_unlock_irq(&phba->hbalock);
+        /* Now, handle all the fcp xri abort events */
+        while (!list_empty(&phba->sli4_hba.sp_nvme_xri_aborted_work_queue)) {
+                /* Get the first event from the head of the event queue */
+                spin_lock_irq(&phba->hbalock);
+                list_remove_head(&phba->sli4_hba.sp_nvme_xri_aborted_work_queue,
+                                 cq_event, struct lpfc_cq_event, list);
+                spin_unlock_irq(&phba->hbalock);
+                /* Notify aborted XRI for NVME work queue */
+                if (phba->nvmet_support) {
+                        lpfc_sli4_nvmet_xri_aborted(phba,
+                                                    &cq_event->cqe.wcqe_axri);
+                } else {
+                        lpfc_sli4_nvme_xri_aborted(phba,
+                                                   &cq_event->cqe.wcqe_axri);
+                }
+                /* Free the event processed back to the free pool */
+                lpfc_sli4_cq_event_release(phba, cq_event);
+        }
+}
+
+/**
  * lpfc_sli4_els_xri_abort_event_proc - Process els xri abort event
  * @phba: pointer to lpfc hba data structure.
  *
@@ -12709,10 +12745,22 @@ lpfc_sli4_sp_handle_abort_xri_wcqe(struct lpfc_hba *phba,
                 spin_unlock_irqrestore(&phba->hbalock, iflags);
                 workposted = true;
                 break;
+        case LPFC_NVME:
+                spin_lock_irqsave(&phba->hbalock, iflags);
+                list_add_tail(&cq_event->list,
+                              &phba->sli4_hba.sp_nvme_xri_aborted_work_queue);
+                /* Set the nvme xri abort event flag */
+                phba->hba_flag |= NVME_XRI_ABORT_EVENT;
+                spin_unlock_irqrestore(&phba->hbalock, iflags);
+                workposted = true;
+                break;
         default:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
-                                "0603 Invalid work queue CQE subtype (x%x)\n",
-                                cq->subtype);
+                                "0603 Invalid CQ subtype %d: "
+                                "%08x %08x %08x %08x\n",
+                                cq->subtype, wcqe->word0, wcqe->parameter,
+                                wcqe->word2, wcqe->word3);
+                lpfc_sli4_cq_event_release(phba, cq_event);
                 workposted = false;
                 break;
         }
@@ -13827,6 +13875,8 @@ lpfc_dual_chute_pci_bar_map(struct lpfc_hba *phba, uint16_t pci_barset)
  * @startq: The starting FCP EQ to modify
  *
  * This function sends an MODIFY_EQ_DELAY mailbox command to the HBA.
+ * The command allows up to LPFC_MAX_EQ_DELAY_EQID_CNT EQ ID's to be
+ * updated in one mailbox command.
  *
  * The @phba struct is used to send mailbox command to HBA. The @startq
  * is used to get the starting FCP EQ to change.
@@ -13879,7 +13929,7 @@ lpfc_modify_hba_eq_delay(struct lpfc_hba *phba, uint32_t startq)
                 eq_delay->u.request.eq[cnt].phase = 0;
                 eq_delay->u.request.eq[cnt].delay_multi = dmult;
                 cnt++;
-                if (cnt >= LPFC_MAX_EQ_DELAY)
+                if (cnt >= LPFC_MAX_EQ_DELAY_EQID_CNT)
                         break;
         }
         eq_delay->u.request.num_eq = cnt;
@@ -15185,17 +15235,17 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                 drq = drqp[idx];
                 cq  = cqp[idx];
 
-                if (hrq->entry_count != drq->entry_count) {
-                        status = -EINVAL;
-                        goto out;
-                }
-
                 /* sanity check on queue memory */
                 if (!hrq || !drq || !cq) {
                         status = -ENODEV;
                         goto out;
                 }
 
+                if (hrq->entry_count != drq->entry_count) {
+                        status = -EINVAL;
+                        goto out;
+                }
+
                 if (idx == 0) {
                         bf_set(lpfc_mbx_rq_create_num_pages,
                                &rq_create->u.request,
diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h
index 91153c9f6d18..710458cf11d6 100644
--- a/drivers/scsi/lpfc/lpfc_sli4.h
+++ b/drivers/scsi/lpfc/lpfc_sli4.h
@@ -642,6 +642,7 @@ struct lpfc_sli4_hba {
         struct list_head sp_asynce_work_queue;
         struct list_head sp_fcp_xri_aborted_work_queue;
         struct list_head sp_els_xri_aborted_work_queue;
+        struct list_head sp_nvme_xri_aborted_work_queue;
         struct list_head sp_unsol_work_queue;
         struct lpfc_sli4_link link_state;
         struct lpfc_sli4_lnk_info lnk_info;
@@ -794,9 +795,14 @@ void lpfc_sli4_fcf_redisc_event_proc(struct lpfc_hba *);
 int lpfc_sli4_resume_rpi(struct lpfc_nodelist *,
                         void (*)(struct lpfc_hba *, LPFC_MBOXQ_t *), void *);
 void lpfc_sli4_fcp_xri_abort_event_proc(struct lpfc_hba *);
+void lpfc_sli4_nvme_xri_abort_event_proc(struct lpfc_hba *phba);
 void lpfc_sli4_els_xri_abort_event_proc(struct lpfc_hba *);
 void lpfc_sli4_fcp_xri_aborted(struct lpfc_hba *,
                                struct sli4_wcqe_xri_aborted *);
+void lpfc_sli4_nvme_xri_aborted(struct lpfc_hba *phba,
+                                struct sli4_wcqe_xri_aborted *axri);
+void lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
+                                 struct sli4_wcqe_xri_aborted *axri);
 void lpfc_sli4_els_xri_aborted(struct lpfc_hba *,
                                struct sli4_wcqe_xri_aborted *);
 void lpfc_sli4_vport_delete_els_xri_aborted(struct lpfc_vport *);
diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h
index 86c6c9b26b82..d4e95e28f4e3 100644
--- a/drivers/scsi/lpfc/lpfc_version.h
+++ b/drivers/scsi/lpfc/lpfc_version.h
@@ -20,7 +20,7 @@
  * included with this package.                                     *
  *******************************************************************/
 
-#define LPFC_DRIVER_VERSION "11.2.0.7"
+#define LPFC_DRIVER_VERSION "11.2.0.10"
 #define LPFC_DRIVER_NAME                "lpfc"
 
 /* Used for SLI 2/3 */
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
index e7e5974e1a2c..2b209bbb4c91 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -35,8 +35,8 @@
 /*
  * MegaRAID SAS Driver meta data
  */
-#define MEGASAS_VERSION                         "07.701.16.00-rc1"
-#define MEGASAS_RELDATE                         "February 2, 2017"
+#define MEGASAS_VERSION                         "07.701.17.00-rc1"
+#define MEGASAS_RELDATE                         "March 2, 2017"
 
 /*
  * Device IDs
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 7ac9a9ee9bd4..0016f12cc563 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -1963,6 +1963,9 @@ scan_target:
         if (!mr_device_priv_data)
                 return -ENOMEM;
         sdev->hostdata = mr_device_priv_data;
+
+        atomic_set(&mr_device_priv_data->r1_ldio_hint,
+                   instance->r1_ldio_hint_default);
         return 0;
 }
 
@@ -5034,10 +5037,12 @@ megasas_setup_irqs_msix(struct megasas_instance *instance, u8 is_probe)
                                          &instance->irq_context[j]);
                         /* Retry irq register for IO_APIC*/
                         instance->msix_vectors = 0;
-                        if (is_probe)
+                        if (is_probe) {
+                                pci_free_irq_vectors(instance->pdev);
                                 return megasas_setup_irqs_ioapic(instance);
-                        else
+                        } else {
                                 return -1;
+                        }
                 }
         }
         return 0;
@@ -5277,9 +5282,11 @@ static int megasas_init_fw(struct megasas_instance *instance)
                         MPI2_REPLY_POST_HOST_INDEX_OFFSET);
         }
 
-        i = pci_alloc_irq_vectors(instance->pdev, 1, 1, PCI_IRQ_LEGACY);
-        if (i < 0)
-                goto fail_setup_irqs;
+        if (!instance->msix_vectors) {
+                i = pci_alloc_irq_vectors(instance->pdev, 1, 1, PCI_IRQ_LEGACY);
+                if (i < 0)
+                        goto fail_setup_irqs;
+        }
 
         dev_info(&instance->pdev->dev,
                 "firmware supports msix\t: (%d)", fw_msix_count);
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index 29650ba669da..f990ab4d45e1 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -2159,7 +2159,7 @@ megasas_set_raidflag_cpu_affinity(union RAID_CONTEXT_UNION *praid_context,
                                 cpu_sel = MR_RAID_CTX_CPUSEL_1;
 
                         if (is_stream_detected(rctx_g35) &&
-                            (raid->level == 5) &&
+                            ((raid->level == 5) || (raid->level == 6)) &&
                             (raid->writeMode == MR_RL_WRITE_THROUGH_MODE) &&
                             (cpu_sel == MR_RAID_CTX_CPUSEL_FCFS))
                                 cpu_sel = MR_RAID_CTX_CPUSEL_0;
@@ -2338,7 +2338,7 @@ megasas_build_ldio_fusion(struct megasas_instance *instance,
                                 fp_possible = false;
                                 atomic_dec(&instance->fw_outstanding);
                         } else if ((scsi_buff_len > MR_LARGE_IO_MIN_SIZE) ||
-                                   atomic_dec_if_positive(&mrdev_priv->r1_ldio_hint)) {
+                                   (atomic_dec_if_positive(&mrdev_priv->r1_ldio_hint) > 0)) {
                                 fp_possible = false;
                                 atomic_dec(&instance->fw_outstanding);
                                 if (scsi_buff_len > MR_LARGE_IO_MIN_SIZE)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h
index 7fe7e6ed595b..8981806fb13f 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.h
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.h
@@ -1442,9 +1442,6 @@ void mpt3sas_transport_update_links(struct MPT3SAS_ADAPTER *ioc,
         u64 sas_address, u16 handle, u8 phy_number, u8 link_rate);
 extern struct sas_function_template mpt3sas_transport_functions;
 extern struct scsi_transport_template *mpt3sas_transport_template;
-extern int scsi_internal_device_block(struct scsi_device *sdev);
-extern int scsi_internal_device_unblock(struct scsi_device *sdev,
-                                enum scsi_device_state new_state);
 /* trigger data externs */
 void mpt3sas_send_trigger_data_event(struct MPT3SAS_ADAPTER *ioc,
         struct SL_WH_TRIGGERS_EVENT_DATA_T *event_data);
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 46e866c36c8a..919ba2bb15f1 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -2859,7 +2859,7 @@ _scsih_internal_device_block(struct scsi_device *sdev,
             sas_device_priv_data->sas_target->handle);
         sas_device_priv_data->block = 1;
 
-        r = scsi_internal_device_block(sdev);
+        r = scsi_internal_device_block(sdev, false);
         if (r == -EINVAL)
                 sdev_printk(KERN_WARNING, sdev,
                     "device_block failed with return(%d) for handle(0x%04x)\n",
@@ -2895,7 +2895,7 @@ _scsih_internal_device_unblock(struct scsi_device *sdev,
                     "performing a block followed by an unblock\n",
                     r, sas_device_priv_data->sas_target->handle);
                 sas_device_priv_data->block = 1;
-                r = scsi_internal_device_block(sdev);
+                r = scsi_internal_device_block(sdev, false);
                 if (r)
                         sdev_printk(KERN_WARNING, sdev, "retried device_block "
                             "failed with return(%d) for handle(0x%04x)\n",
@@ -4677,7 +4677,6 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
         struct MPT3SAS_DEVICE *sas_device_priv_data;
         u32 response_code = 0;
         unsigned long flags;
-        unsigned int sector_sz;
 
         mpi_reply = mpt3sas_base_get_reply_virt_addr(ioc, reply);
 
@@ -4742,20 +4741,6 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
         }
 
         xfer_cnt = le32_to_cpu(mpi_reply->TransferCount);
-
-        /* In case of bogus fw or device, we could end up having
-         * unaligned partial completion. We can force alignment here,
-         * then scsi-ml does not need to handle this misbehavior.
-         */
-        sector_sz = scmd->device->sector_size;
-        if (unlikely(!blk_rq_is_passthrough(scmd->request) && sector_sz &&
-                     xfer_cnt % sector_sz)) {
-                sdev_printk(KERN_INFO, scmd->device,
-                    "unaligned partial completion avoided (xfer_cnt=%u, sector_sz=%u)\n",
-                            xfer_cnt, sector_sz);
-                xfer_cnt = round_down(xfer_cnt, sector_sz);
-        }
-
         scsi_set_resid(scmd, scsi_bufflen(scmd) - xfer_cnt);
         if (ioc_status & MPI2_IOCSTATUS_FLAG_LOG_INFO_AVAILABLE)
                 log_info =  le32_to_cpu(mpi_reply->IOCLogInfo);
diff --git a/drivers/scsi/qedf/qedf_dbg.h b/drivers/scsi/qedf/qedf_dbg.h
index 23bd70628a2f..7d173f48a81e 100644
--- a/drivers/scsi/qedf/qedf_dbg.h
+++ b/drivers/scsi/qedf/qedf_dbg.h
@@ -81,14 +81,17 @@ struct qedf_dbg_ctx {
 #define QEDF_INFO(pdev, level, fmt, ...)        \
                 qedf_dbg_info(pdev, __func__, __LINE__, level, fmt,     \
                               ## __VA_ARGS__)
-
-extern void qedf_dbg_err(struct qedf_dbg_ctx *qedf, const char *func, u32 line,
+__printf(4, 5)
+void qedf_dbg_err(struct qedf_dbg_ctx *qedf, const char *func, u32 line,
                           const char *fmt, ...);
-extern void qedf_dbg_warn(struct qedf_dbg_ctx *qedf, const char *func, u32 line,
+__printf(4, 5)
+void qedf_dbg_warn(struct qedf_dbg_ctx *qedf, const char *func, u32 line,
                            const char *, ...);
-extern void qedf_dbg_notice(struct qedf_dbg_ctx *qedf, const char *func,
+__printf(4, 5)
+void qedf_dbg_notice(struct qedf_dbg_ctx *qedf, const char *func,
                             u32 line, const char *, ...);
-extern void qedf_dbg_info(struct qedf_dbg_ctx *qedf, const char *func, u32 line,
+__printf(5, 6)
+void qedf_dbg_info(struct qedf_dbg_ctx *qedf, const char *func, u32 line,
                           u32 info, const char *fmt, ...);
 
 /* GRC Dump related defines */
diff --git a/drivers/scsi/qedf/qedf_fip.c b/drivers/scsi/qedf/qedf_fip.c
index 868d423380d1..ed58b9104f58 100644
--- a/drivers/scsi/qedf/qedf_fip.c
+++ b/drivers/scsi/qedf/qedf_fip.c
@@ -203,7 +203,7 @@ void qedf_fip_recv(struct qedf_ctx *qedf, struct sk_buff *skb)
                         case FIP_DT_MAC:
                                 mp = (struct fip_mac_desc *)desc;
                                 QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_LL2,
-                                    "fd_mac=%pM.\n", __func__, mp->fd_mac);
+                                    "fd_mac=%pM\n", mp->fd_mac);
                                 ether_addr_copy(cvl_mac, mp->fd_mac);
                                 break;
                         case FIP_DT_NAME:
diff --git a/drivers/scsi/qedf/qedf_io.c b/drivers/scsi/qedf/qedf_io.c
index ee0dcf9d3aba..46debe5034af 100644
--- a/drivers/scsi/qedf/qedf_io.c
+++ b/drivers/scsi/qedf/qedf_io.c
@@ -1342,7 +1342,7 @@ void qedf_scsi_completion(struct qedf_ctx *qedf, struct fcoe_cqe *cqe,
                 } else {
                         refcount = kref_read(&io_req->refcount);
                         QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_IO,
-                            "%d:0:%d:%d xid=0x%0x op=0x%02x "
+                            "%d:0:%d:%lld xid=0x%0x op=0x%02x "
                             "lba=%02x%02x%02x%02x cdb_status=%d "
                             "fcp_resid=0x%x refcount=%d.\n",
                             qedf->lport->host->host_no, sc_cmd->device->id,
@@ -1426,7 +1426,7 @@ void qedf_scsi_done(struct qedf_ctx *qedf, struct qedf_ioreq *io_req,
 
         sc_cmd->result = result << 16;
         refcount = kref_read(&io_req->refcount);
-        QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_IO, "%d:0:%d:%d: Completing "
+        QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_IO, "%d:0:%d:%lld: Completing "
             "sc_cmd=%p result=0x%08x op=0x%02x lba=0x%02x%02x%02x%02x, "
             "allowed=%d retries=%d refcount=%d.\n",
             qedf->lport->host->host_no, sc_cmd->device->id,
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index d9d7a86b5f8b..8e2a160490e6 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -2456,8 +2456,8 @@ static int qedf_alloc_bdq(struct qedf_ctx *qedf)
         }
 
         QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_DISC,
-            "BDQ PBL addr=0x%p dma=0x%llx.\n", qedf->bdq_pbl,
-            qedf->bdq_pbl_dma);
+                  "BDQ PBL addr=0x%p dma=%pad\n",
+                  qedf->bdq_pbl, &qedf->bdq_pbl_dma);
 
         /*
          * Populate BDQ PBL with physical and virtual address of individual
diff --git a/drivers/scsi/qedi/qedi_debugfs.c b/drivers/scsi/qedi/qedi_debugfs.c
index 955936274241..59417199bf36 100644
--- a/drivers/scsi/qedi/qedi_debugfs.c
+++ b/drivers/scsi/qedi/qedi_debugfs.c
@@ -14,7 +14,7 @@
 #include <linux/debugfs.h>
 #include <linux/module.h>
 
-int do_not_recover;
+int qedi_do_not_recover;
 static struct dentry *qedi_dbg_root;
 
 void
@@ -74,22 +74,22 @@ qedi_dbg_exit(void)
 static ssize_t
 qedi_dbg_do_not_recover_enable(struct qedi_dbg_ctx *qedi_dbg)
 {
-        if (!do_not_recover)
-                do_not_recover = 1;
+        if (!qedi_do_not_recover)
+                qedi_do_not_recover = 1;
 
         QEDI_INFO(qedi_dbg, QEDI_LOG_DEBUGFS, "do_not_recover=%d\n",
-                  do_not_recover);
+                  qedi_do_not_recover);
         return 0;
 }
 
 static ssize_t
 qedi_dbg_do_not_recover_disable(struct qedi_dbg_ctx *qedi_dbg)
 {
-        if (do_not_recover)
-                do_not_recover = 0;
+        if (qedi_do_not_recover)
+                qedi_do_not_recover = 0;
 
         QEDI_INFO(qedi_dbg, QEDI_LOG_DEBUGFS, "do_not_recover=%d\n",
-                  do_not_recover);
+                  qedi_do_not_recover);
         return 0;
 }
 
@@ -141,7 +141,7 @@ qedi_dbg_do_not_recover_cmd_read(struct file *filp, char __user *buffer,
         if (*ppos)
                 return 0;
 
-        cnt = sprintf(buffer, "do_not_recover=%d\n", do_not_recover);
+        cnt = sprintf(buffer, "do_not_recover=%d\n", qedi_do_not_recover);
         cnt = min_t(int, count, cnt - *ppos);
         *ppos += cnt;
         return cnt;
diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
index c9f0ef4e11b3..2bce3efc66a4 100644
--- a/drivers/scsi/qedi/qedi_fw.c
+++ b/drivers/scsi/qedi/qedi_fw.c
@@ -1461,9 +1461,9 @@ static void qedi_tmf_work(struct work_struct *work)
                   get_itt(tmf_hdr->rtt), get_itt(ctask->itt), cmd->task_id,
                   qedi_conn->iscsi_conn_id);
 
-        if (do_not_recover) {
+        if (qedi_do_not_recover) {
                 QEDI_ERR(&qedi->dbg_ctx, "DONT SEND CLEANUP/ABORT %d\n",
-                         do_not_recover);
+                         qedi_do_not_recover);
                 goto abort_ret;
         }
 
diff --git a/drivers/scsi/qedi/qedi_gbl.h b/drivers/scsi/qedi/qedi_gbl.h
index 8e488de88ece..63d793f46064 100644
--- a/drivers/scsi/qedi/qedi_gbl.h
+++ b/drivers/scsi/qedi/qedi_gbl.h
@@ -12,8 +12,14 @@
 
 #include "qedi_iscsi.h"
 
+#ifdef CONFIG_DEBUG_FS
+extern int qedi_do_not_recover;
+#else
+#define qedi_do_not_recover (0)
+#endif
+
 extern uint qedi_io_tracing;
-extern int do_not_recover;
+
 extern struct scsi_host_template qedi_host_template;
 extern struct iscsi_transport qedi_iscsi_transport;
 extern const struct qed_iscsi_ops *qedi_ops;
diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
index b9f79d36142d..4cc474364c50 100644
--- a/drivers/scsi/qedi/qedi_iscsi.c
+++ b/drivers/scsi/qedi/qedi_iscsi.c
@@ -833,7 +833,7 @@ qedi_ep_connect(struct Scsi_Host *shost, struct sockaddr *dst_addr,
                 return ERR_PTR(ret);
         }
 
-        if (do_not_recover) {
+        if (qedi_do_not_recover) {
                 ret = -ENOMEM;
                 return ERR_PTR(ret);
         }
@@ -957,7 +957,7 @@ static int qedi_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
         struct qedi_endpoint *qedi_ep;
         int ret = 0;
 
-        if (do_not_recover)
+        if (qedi_do_not_recover)
                 return 1;
 
         qedi_ep = ep->dd_data;
@@ -1025,7 +1025,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
                 }
 
                 if (test_bit(QEDI_IN_RECOVERY, &qedi->flags)) {
-                        if (do_not_recover) {
+                        if (qedi_do_not_recover) {
                                 QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
                                           "Do not recover cid=0x%x\n",
                                           qedi_ep->iscsi_cid);
@@ -1039,7 +1039,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
                 }
         }
 
-        if (do_not_recover)
+        if (qedi_do_not_recover)
                 goto ep_exit_recover;
 
         switch (qedi_ep->state) {
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 5eda21d903e9..92775a8b74b1 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -1805,7 +1805,7 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
          */
         qedi_ops->common->update_pf_params(qedi->cdev, &qedi->pf_params);
 
-        qedi_setup_int(qedi);
+        rc = qedi_setup_int(qedi);
         if (rc)
                 goto stop_iscsi_func;
 
@@ -2007,6 +2007,7 @@ static void qedi_remove(struct pci_dev *pdev)
 
 static struct pci_device_id qedi_pci_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, 0x165E) },
+        { PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, 0x8084) },
         { 0 },
 };
 MODULE_DEVICE_TABLE(pci, qedi_pci_tbl);
diff --git a/drivers/scsi/qla2xxx/Kconfig b/drivers/scsi/qla2xxx/Kconfig
index 67c0d5aa3212..de952935b5d2 100644
--- a/drivers/scsi/qla2xxx/Kconfig
+++ b/drivers/scsi/qla2xxx/Kconfig
@@ -3,6 +3,7 @@ config SCSI_QLA_FC
         depends on PCI && SCSI
         depends on SCSI_FC_ATTRS
         select FW_LOADER
+        select BTREE
         ---help---
         This qla2xxx driver supports all QLogic Fibre Channel
         PCI and PCIe host adapters.
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index f610103994af..435ff7fd6384 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -2154,8 +2154,6 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
                     "Timer for the VP[%d] has stopped\n", vha->vp_idx);
         }
 
-        BUG_ON(atomic_read(&vha->vref_count));
-
         qla2x00_free_fcports(vha);
 
         mutex_lock(&ha->vport_lock);
@@ -2166,7 +2164,7 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
         dma_free_coherent(&ha->pdev->dev, vha->gnl.size, vha->gnl.l,
             vha->gnl.ldma);
 
-        if (vha->qpair->vp_idx == vha->vp_idx) {
+        if (vha->qpair && vha->qpair->vp_idx == vha->vp_idx) {
                 if (qla2xxx_delete_qpair(vha, vha->qpair) != QLA_SUCCESS)
                         ql_log(ql_log_warn, vha, 0x7087,
                             "Queue Pair delete failed.\n");
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 21d9fb7fc887..51b4179469d1 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -2707,13 +2707,9 @@ ql_dump_buffer(uint32_t level, scsi_qla_host_t *vha, int32_t id,
             "%-+5d  0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F\n", size);
         ql_dbg(level, vha, id,
             "----- -----------------------------------------------\n");
-        for (cnt = 0; cnt < size; cnt++, buf++) {
-                if (cnt % 16 == 0)
-                        ql_dbg(level, vha, id, "%04x:", cnt & ~0xFU);
-                printk(" %02x", *buf);
-                if (cnt % 16 == 15)
-                        printk("\n");
+        for (cnt = 0; cnt < size; cnt += 16) {
+                ql_dbg(level, vha, id, "%04x: ", cnt);
+                print_hex_dump(KERN_CONT, "", DUMP_PREFIX_NONE, 16, 1,
+                               buf + cnt, min(16U, size - cnt), false);
         }
-        if (cnt % 16 != 0)
-                printk("\n");
 }
diff --git a/drivers/scsi/qla2xxx/qla_dbg.h b/drivers/scsi/qla2xxx/qla_dbg.h
index e1fc4e66966a..c6bffe929fe7 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.h
+++ b/drivers/scsi/qla2xxx/qla_dbg.h
@@ -348,6 +348,7 @@ ql_log_pci(uint32_t, struct pci_dev *pdev, int32_t, const char *fmt, ...);
 #define ql_dbg_tgt      0x00004000 /* Target mode */
 #define ql_dbg_tgt_mgt  0x00002000 /* Target mode management */
 #define ql_dbg_tgt_tmr  0x00001000 /* Target mode task management */
+#define ql_dbg_tgt_dif  0x00000800 /* Target mode dif */
 
 extern int qla27xx_dump_mpi_ram(struct qla_hw_data *, uint32_t, uint32_t *,
         uint32_t, void **);
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 625d438e3cce..ae119018dfaa 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -25,6 +25,7 @@
 #include <linux/firmware.h>
 #include <linux/aer.h>
 #include <linux/mutex.h>
+#include <linux/btree.h>
 
 #include <scsi/scsi.h>
 #include <scsi/scsi_host.h>
@@ -395,11 +396,15 @@ struct srb_iocb {
                         struct completion comp;
                 } abt;
                 struct ct_arg ctarg;
+#define MAX_IOCB_MB_REG 28
+#define SIZEOF_IOCB_MB_REG (MAX_IOCB_MB_REG * sizeof(uint16_t))
                 struct {
-                        __le16 in_mb[28];       /* fr fw */
-                        __le16 out_mb[28];      /* to fw */
+                        __le16 in_mb[MAX_IOCB_MB_REG];  /* from FW */
+                        __le16 out_mb[MAX_IOCB_MB_REG]; /* to FW */
                         void *out, *in;
                         dma_addr_t out_dma, in_dma;
+                        struct completion comp;
+                        int rc;
                 } mbx;
                 struct {
                         struct imm_ntfy_from_isp *ntfy;
@@ -437,7 +442,7 @@ typedef struct srb {
         uint32_t handle;
         uint16_t flags;
         uint16_t type;
-        char *name;
+        const char *name;
         int iocbs;
         struct qla_qpair *qpair;
         u32 gen1;       /* scratch */
@@ -2300,6 +2305,8 @@ typedef struct fc_port {
         struct ct_sns_desc ct_desc;
         enum discovery_state disc_state;
         enum login_state fw_login_state;
+        unsigned long plogi_nack_done_deadline;
+
         u32 login_gen, last_login_gen;
         u32 rscn_gen, last_rscn_gen;
         u32 chip_reset;
@@ -3106,6 +3113,16 @@ struct qla_chip_state_84xx {
         uint32_t gold_fw_version;
 };
 
+struct qla_dif_statistics {
+        uint64_t dif_input_bytes;
+        uint64_t dif_output_bytes;
+        uint64_t dif_input_requests;
+        uint64_t dif_output_requests;
+        uint32_t dif_guard_err;
+        uint32_t dif_ref_tag_err;
+        uint32_t dif_app_tag_err;
+};
+
 struct qla_statistics {
         uint32_t total_isp_aborts;
         uint64_t input_bytes;
@@ -3118,6 +3135,8 @@ struct qla_statistics {
         uint32_t stat_max_pend_cmds;
         uint32_t stat_max_qfull_cmds_alloc;
         uint32_t stat_max_qfull_cmds_dropped;
+
+        struct qla_dif_statistics qla_dif_stats;
 };
 
 struct bidi_statistics {
@@ -3125,6 +3144,16 @@ struct bidi_statistics {
         unsigned long long transfer_bytes;
 };
 
+struct qla_tc_param {
+        struct scsi_qla_host *vha;
+        uint32_t blk_sz;
+        uint32_t bufflen;
+        struct scatterlist *sg;
+        struct scatterlist *prot_sg;
+        struct crc_context *ctx;
+        uint8_t *ctx_dsd_alloced;
+};
+
 /* Multi queue support */
 #define MBC_INITIALIZE_MULTIQ 0x1f
 #define QLA_QUE_PAGE 0X1000
@@ -3272,6 +3301,8 @@ struct qlt_hw_data {
         uint8_t tgt_node_name[WWN_SIZE];
 
         struct dentry *dfs_tgt_sess;
+        struct dentry *dfs_tgt_port_database;
+
         struct list_head q_full_list;
         uint32_t num_pend_cmds;
         uint32_t num_qfull_cmds_alloc;
@@ -3281,6 +3312,7 @@ struct qlt_hw_data {
         spinlock_t sess_lock;
         int rspq_vector_cpuid;
         spinlock_t atio_lock ____cacheline_aligned;
+        struct btree_head32 host_map;
 };
 
 #define MAX_QFULL_CMDS_ALLOC    8192
@@ -3290,6 +3322,10 @@ struct qlt_hw_data {
 
 #define LEAK_EXCHG_THRESH_HOLD_PERCENT 75       /* 75 percent */
 
+#define QLA_EARLY_LINKUP(_ha) \
+        ((_ha->flags.n2n_ae || _ha->flags.lip_ae) && \
+         _ha->flags.fw_started && !_ha->flags.fw_init_done)
+
 /*
  * Qlogic host adapter specific data structure.
 */
@@ -3339,7 +3375,11 @@ struct qla_hw_data {
                 uint32_t        fawwpn_enabled:1;
                 uint32_t        exlogins_enabled:1;
                 uint32_t        exchoffld_enabled:1;
-                /* 35 bits */
+
+                uint32_t        lip_ae:1;
+                uint32_t        n2n_ae:1;
+                uint32_t        fw_started:1;
+                uint32_t        fw_init_done:1;
         } flags;
 
         /* This spinlock is used to protect "io transactions", you must
@@ -3432,7 +3472,6 @@ struct qla_hw_data {
 #define P2P_LOOP  3
         uint8_t         interrupts_on;
         uint32_t        isp_abort_cnt;
-
 #define PCI_DEVICE_ID_QLOGIC_ISP2532    0x2532
 #define PCI_DEVICE_ID_QLOGIC_ISP8432    0x8432
 #define PCI_DEVICE_ID_QLOGIC_ISP8001    0x8001
@@ -3913,6 +3952,7 @@ typedef struct scsi_qla_host {
         struct list_head vp_fcports;    /* list of fcports */
         struct list_head work_list;
         spinlock_t work_lock;
+        struct work_struct iocb_work;
 
         /* Commonly used flags and state information. */
         struct Scsi_Host *host;
@@ -4076,6 +4116,7 @@ typedef struct scsi_qla_host {
         /* Count of active session/fcport */
         int fcport_count;
         wait_queue_head_t fcport_waitQ;
+        wait_queue_head_t vref_waitq;
 } scsi_qla_host_t;
 
 struct qla27xx_image_status {
@@ -4131,14 +4172,17 @@ struct qla2_sgx {
         mb();                                           \
         if (__vha->flags.delete_progress) {             \
                 atomic_dec(&__vha->vref_count);         \
+                wake_up(&__vha->vref_waitq);            \
                 __bail = 1;                             \
         } else {                                        \
                 __bail = 0;                             \
         }                                               \
 } while (0)
 
-#define QLA_VHA_MARK_NOT_BUSY(__vha)                    \
+#define QLA_VHA_MARK_NOT_BUSY(__vha) do {               \
         atomic_dec(&__vha->vref_count);                 \
+        wake_up(&__vha->vref_waitq);                    \
+} while (0)                                             \
 
 #define QLA_QPAIR_MARK_BUSY(__qpair, __bail) do {       \
         atomic_inc(&__qpair->ref_count);                \
diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c
index b48cce696bac..989e17b0758c 100644
--- a/drivers/scsi/qla2xxx/qla_dfs.c
+++ b/drivers/scsi/qla2xxx/qla_dfs.c
@@ -19,11 +19,11 @@ qla2x00_dfs_tgt_sess_show(struct seq_file *s, void *unused)
         struct qla_hw_data *ha = vha->hw;
         unsigned long flags;
         struct fc_port *sess = NULL;
-        struct qla_tgt *tgt= vha->vha_tgt.qla_tgt;
+        struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
 
-        seq_printf(s, "%s\n",vha->host_str);
+        seq_printf(s, "%s\n", vha->host_str);
         if (tgt) {
-                seq_printf(s, "Port ID   Port Name                Handle\n");
+                seq_puts(s, "Port ID   Port Name                Handle\n");
 
                 spin_lock_irqsave(&ha->tgt.sess_lock, flags);
                 list_for_each_entry(sess, &vha->vp_fcports, list)
@@ -44,7 +44,6 @@ qla2x00_dfs_tgt_sess_open(struct inode *inode, struct file *file)
         return single_open(file, qla2x00_dfs_tgt_sess_show, vha);
 }
 
-
 static const struct file_operations dfs_tgt_sess_ops = {
         .open           = qla2x00_dfs_tgt_sess_open,
         .read           = seq_read,
@@ -53,6 +52,78 @@ static const struct file_operations dfs_tgt_sess_ops = {
 };
 
 static int
+qla2x00_dfs_tgt_port_database_show(struct seq_file *s, void *unused)
+{
+        scsi_qla_host_t *vha = s->private;
+        struct qla_hw_data *ha = vha->hw;
+        struct gid_list_info *gid_list;
+        dma_addr_t gid_list_dma;
+        fc_port_t fc_port;
+        char *id_iter;
+        int rc, i;
+        uint16_t entries, loop_id;
+        struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
+
+        seq_printf(s, "%s\n", vha->host_str);
+        if (tgt) {
+                gid_list = dma_alloc_coherent(&ha->pdev->dev,
+                    qla2x00_gid_list_size(ha),
+                    &gid_list_dma, GFP_KERNEL);
+                if (!gid_list) {
+                        ql_dbg(ql_dbg_user, vha, 0x705c,
+                            "DMA allocation failed for %u\n",
+                             qla2x00_gid_list_size(ha));
+                        return 0;
+                }
+
+                rc = qla24xx_gidlist_wait(vha, gid_list, gid_list_dma,
+                    &entries);
+                if (rc != QLA_SUCCESS)
+                        goto out_free_id_list;
+
+                id_iter = (char *)gid_list;
+
+                seq_puts(s, "Port Name  Port ID         Loop ID\n");
+
+                for (i = 0; i < entries; i++) {
+                        struct gid_list_info *gid =
+                            (struct gid_list_info *)id_iter;
+                        loop_id = le16_to_cpu(gid->loop_id);
+                        memset(&fc_port, 0, sizeof(fc_port_t));
+
+                        fc_port.loop_id = loop_id;
+
+                        rc = qla24xx_gpdb_wait(vha, &fc_port, 0);
+                        seq_printf(s, "%8phC  %02x%02x%02x  %d\n",
+                                fc_port.port_name, fc_port.d_id.b.domain,
+                                fc_port.d_id.b.area, fc_port.d_id.b.al_pa,
+                                fc_port.loop_id);
+                        id_iter += ha->gid_list_info_size;
+                }
+out_free_id_list:
+                dma_free_coherent(&ha->pdev->dev, qla2x00_gid_list_size(ha),
+                    gid_list, gid_list_dma);
+        }
+
+        return 0;
+}
+
+static int
+qla2x00_dfs_tgt_port_database_open(struct inode *inode, struct file *file)
+{
+        scsi_qla_host_t *vha = inode->i_private;
+
+        return single_open(file, qla2x00_dfs_tgt_port_database_show, vha);
+}
+
+static const struct file_operations dfs_tgt_port_database_ops = {
+        .open           = qla2x00_dfs_tgt_port_database_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int
 qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused)
 {
         struct scsi_qla_host *vha = s->private;
@@ -114,6 +185,21 @@ qla_dfs_tgt_counters_show(struct seq_file *s, void *unused)
         seq_printf(s, "num Q full sent = %lld\n",
                 vha->tgt_counters.num_q_full_sent);
 
+        /* DIF stats */
+        seq_printf(s, "DIF Inp Bytes = %lld\n",
+                vha->qla_stats.qla_dif_stats.dif_input_bytes);
+        seq_printf(s, "DIF Outp Bytes = %lld\n",
+                vha->qla_stats.qla_dif_stats.dif_output_bytes);
+        seq_printf(s, "DIF Inp Req = %lld\n",
+                vha->qla_stats.qla_dif_stats.dif_input_requests);
+        seq_printf(s, "DIF Outp Req = %lld\n",
+                vha->qla_stats.qla_dif_stats.dif_output_requests);
+        seq_printf(s, "DIF Guard err = %d\n",
+                vha->qla_stats.qla_dif_stats.dif_guard_err);
+        seq_printf(s, "DIF Ref tag err = %d\n",
+                vha->qla_stats.qla_dif_stats.dif_ref_tag_err);
+        seq_printf(s, "DIF App tag err = %d\n",
+                vha->qla_stats.qla_dif_stats.dif_app_tag_err);
         return 0;
 }
 
@@ -281,6 +367,14 @@ create_nodes:
                 goto out;
         }
 
+        ha->tgt.dfs_tgt_port_database = debugfs_create_file("tgt_port_database",
+            S_IRUSR,  ha->dfs_dir, vha, &dfs_tgt_port_database_ops);
+        if (!ha->tgt.dfs_tgt_port_database) {
+                ql_log(ql_log_warn, vha, 0xffff,
+                    "Unable to create debugFS tgt_port_database node.\n");
+                goto out;
+        }
+
         ha->dfs_fce = debugfs_create_file("fce", S_IRUSR, ha->dfs_dir, vha,
             &dfs_fce_ops);
         if (!ha->dfs_fce) {
@@ -311,6 +405,11 @@ qla2x00_dfs_remove(scsi_qla_host_t *vha)
                 ha->tgt.dfs_tgt_sess = NULL;
         }
 
+        if (ha->tgt.dfs_tgt_port_database) {
+                debugfs_remove(ha->tgt.dfs_tgt_port_database);
+                ha->tgt.dfs_tgt_port_database = NULL;
+        }
+
         if (ha->dfs_fw_resource_cnt) {
                 debugfs_remove(ha->dfs_fw_resource_cnt);
                 ha->dfs_fw_resource_cnt = NULL;
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index b3d6441d1d90..5b2451745e9f 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -193,6 +193,7 @@ extern int qla24xx_post_upd_fcport_work(struct scsi_qla_host *, fc_port_t *);
 void qla2x00_handle_login_done_event(struct scsi_qla_host *, fc_port_t *,
         uint16_t *);
 int qla24xx_post_gnl_work(struct scsi_qla_host *, fc_port_t *);
+int qla24xx_async_abort_cmd(srb_t *);
 
 /*
  * Global Functions in qla_mid.c source file.
@@ -256,11 +257,11 @@ extern unsigned long qla2x00_get_async_timeout(struct scsi_qla_host *);
 extern void *qla2x00_alloc_iocbs(scsi_qla_host_t *, srb_t *);
 extern int qla2x00_issue_marker(scsi_qla_host_t *, int);
 extern int qla24xx_walk_and_build_sglist_no_difb(struct qla_hw_data *, srb_t *,
-        uint32_t *, uint16_t, struct qla_tgt_cmd *);
+        uint32_t *, uint16_t, struct qla_tc_param *);
 extern int qla24xx_walk_and_build_sglist(struct qla_hw_data *, srb_t *,
-        uint32_t *, uint16_t, struct qla_tgt_cmd *);
+        uint32_t *, uint16_t, struct qla_tc_param *);
 extern int qla24xx_walk_and_build_prot_sglist(struct qla_hw_data *, srb_t *,
-        uint32_t *, uint16_t, struct qla_tgt_cmd *);
+        uint32_t *, uint16_t, struct qla_tc_param *);
 extern int qla24xx_get_one_block_sg(uint32_t, struct qla2_sgx *, uint32_t *);
 extern int qla24xx_configure_prot_mode(srb_t *, uint16_t *);
 extern int qla24xx_build_scsi_crc_2_iocbs(srb_t *,
@@ -368,7 +369,7 @@ qla2x00_get_link_status(scsi_qla_host_t *, uint16_t, struct link_statistics *,
 
 extern int
 qla24xx_get_isp_stats(scsi_qla_host_t *, struct link_statistics *,
-    dma_addr_t, uint);
+    dma_addr_t, uint16_t);
 
 extern int qla24xx_abort_command(srb_t *);
 extern int qla24xx_async_abort_command(srb_t *);
@@ -472,6 +473,13 @@ qla2x00_dump_mctp_data(scsi_qla_host_t *, dma_addr_t, uint32_t, uint32_t);
 extern int
 qla26xx_dport_diagnostics(scsi_qla_host_t *, void *, uint, uint);
 
+int qla24xx_send_mb_cmd(struct scsi_qla_host *, mbx_cmd_t *);
+int qla24xx_gpdb_wait(struct scsi_qla_host *, fc_port_t *, u8);
+int qla24xx_gidlist_wait(struct scsi_qla_host *, void *, dma_addr_t,
+    uint16_t *);
+int __qla24xx_parse_gpdb(struct scsi_qla_host *, fc_port_t *,
+        struct port_database_24xx *);
+
 /*
  * Global Function Prototypes in qla_isr.c source file.
  */
@@ -846,5 +854,7 @@ extern struct fc_port *qlt_find_sess_invalidate_other(scsi_qla_host_t *,
         uint64_t wwn, port_id_t port_id, uint16_t loop_id, struct fc_port **);
 void qla24xx_delete_sess_fn(struct work_struct *);
 void qlt_unknown_atio_work_fn(struct work_struct *);
+void qlt_update_host_map(struct scsi_qla_host *, port_id_t);
+void qlt_remove_target_resources(struct qla_hw_data *);
 
 #endif /* _QLA_GBL_H */
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 32fb9007f137..f9d2fe7b1ade 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -629,7 +629,6 @@ void qla24xx_async_gpdb_sp_done(void *s, int res)
         struct srb *sp = s;
         struct scsi_qla_host *vha = sp->vha;
         struct qla_hw_data *ha = vha->hw;
-        uint64_t zero = 0;
         struct port_database_24xx *pd;
         fc_port_t *fcport = sp->fcport;
         u16 *mb = sp->u.iocb_cmd.u.mbx.in_mb;
@@ -649,48 +648,7 @@ void qla24xx_async_gpdb_sp_done(void *s, int res)
 
         pd = (struct port_database_24xx *)sp->u.iocb_cmd.u.mbx.in;
 
-        /* Check for logged in state. */
-        if (pd->current_login_state != PDS_PRLI_COMPLETE &&
-            pd->last_login_state != PDS_PRLI_COMPLETE) {
-                ql_dbg(ql_dbg_mbx, vha, 0xffff,
-                    "Unable to verify login-state (%x/%x) for "
-                    "loop_id %x.\n", pd->current_login_state,
-                    pd->last_login_state, fcport->loop_id);
-                rval = QLA_FUNCTION_FAILED;
-                goto gpd_error_out;
-        }
-
-        if (fcport->loop_id == FC_NO_LOOP_ID ||
-            (memcmp(fcport->port_name, (uint8_t *)&zero, 8) &&
-                memcmp(fcport->port_name, pd->port_name, 8))) {
-                /* We lost the device mid way. */
-                rval = QLA_NOT_LOGGED_IN;
-                goto gpd_error_out;
-        }
-
-        /* Names are little-endian. */
-        memcpy(fcport->node_name, pd->node_name, WWN_SIZE);
-
-        /* Get port_id of device. */
-        fcport->d_id.b.domain = pd->port_id[0];
-        fcport->d_id.b.area = pd->port_id[1];
-        fcport->d_id.b.al_pa = pd->port_id[2];
-        fcport->d_id.b.rsvd_1 = 0;
-
-        /* If not target must be initiator or unknown type. */
-        if ((pd->prli_svc_param_word_3[0] & BIT_4) == 0)
-                fcport->port_type = FCT_INITIATOR;
-        else
-                fcport->port_type = FCT_TARGET;
-
-        /* Passback COS information. */
-        fcport->supported_classes = (pd->flags & PDF_CLASS_2) ?
-                FC_COS_CLASS2 : FC_COS_CLASS3;
-
-        if (pd->prli_svc_param_word_3[0] & BIT_7) {
-                fcport->flags |= FCF_CONF_COMP_SUPPORTED;
-                fcport->conf_compl_supported = 1;
-        }
+        rval = __qla24xx_parse_gpdb(vha, fcport, pd);
 
 gpd_error_out:
         memset(&ea, 0, sizeof(ea));
@@ -876,10 +834,14 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport)
         fcport->login_retry--;
 
         if ((fcport->fw_login_state == DSC_LS_PLOGI_PEND) ||
-            (fcport->fw_login_state == DSC_LS_PLOGI_COMP) ||
             (fcport->fw_login_state == DSC_LS_PRLI_PEND))
                 return 0;
 
+        if (fcport->fw_login_state == DSC_LS_PLOGI_COMP) {
+                if (time_before_eq(jiffies, fcport->plogi_nack_done_deadline))
+                        return 0;
+        }
+
         /* for pure Target Mode. Login will not be initiated */
         if (vha->host->active_mode == MODE_TARGET)
                 return 0;
@@ -1041,10 +1003,14 @@ void qla24xx_handle_relogin_event(scsi_qla_host_t *vha,
                 fcport->flags);
 
         if ((fcport->fw_login_state == DSC_LS_PLOGI_PEND) ||
-            (fcport->fw_login_state == DSC_LS_PLOGI_COMP) ||
             (fcport->fw_login_state == DSC_LS_PRLI_PEND))
                 return;
 
+        if (fcport->fw_login_state == DSC_LS_PLOGI_COMP) {
+                if (time_before_eq(jiffies, fcport->plogi_nack_done_deadline))
+                        return;
+        }
+
         if (fcport->flags & FCF_ASYNC_SENT) {
                 fcport->login_retry++;
                 set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
@@ -1258,7 +1224,7 @@ qla24xx_abort_sp_done(void *ptr, int res)
         complete(&abt->u.abt.comp);
 }
 
-static int
+int
 qla24xx_async_abort_cmd(srb_t *cmd_sp)
 {
         scsi_qla_host_t *vha = cmd_sp->vha;
@@ -3212,6 +3178,7 @@ next_check:
         } else {
                 ql_dbg(ql_dbg_init, vha, 0x00d3,
                     "Init Firmware -- success.\n");
+                ha->flags.fw_started = 1;
         }
 
         return (rval);
@@ -3374,8 +3341,8 @@ qla2x00_configure_hba(scsi_qla_host_t *vha)
         uint8_t       domain;
         char            connect_type[22];
         struct qla_hw_data *ha = vha->hw;
-        unsigned long flags;
         scsi_qla_host_t *base_vha = pci_get_drvdata(ha->pdev);
+        port_id_t id;
 
         /* Get host addresses. */
         rval = qla2x00_get_adapter_id(vha,
@@ -3453,13 +3420,11 @@ qla2x00_configure_hba(scsi_qla_host_t *vha)
 
         /* Save Host port and loop ID. */
         /* byte order - Big Endian */
-        vha->d_id.b.domain = domain;
-        vha->d_id.b.area = area;
-        vha->d_id.b.al_pa = al_pa;
-
-        spin_lock_irqsave(&ha->vport_slock, flags);
-        qlt_update_vp_map(vha, SET_AL_PA);
-        spin_unlock_irqrestore(&ha->vport_slock, flags);
+        id.b.domain = domain;
+        id.b.area = area;
+        id.b.al_pa = al_pa;
+        id.b.rsvd_1 = 0;
+        qlt_update_host_map(vha, id);
 
         if (!vha->flags.init_done)
                 ql_log(ql_log_info, vha, 0x2010,
@@ -4036,6 +4001,7 @@ qla2x00_configure_loop(scsi_qla_host_t *vha)
                         atomic_set(&vha->loop_state, LOOP_READY);
                         ql_dbg(ql_dbg_disc, vha, 0x2069,
                             "LOOP READY.\n");
+                        ha->flags.fw_init_done = 1;
 
                         /*
                          * Process any ATIO queue entries that came in
@@ -5148,6 +5114,7 @@ qla2x00_update_fcports(scsi_qla_host_t *base_vha)
                         }
                 }
                 atomic_dec(&vha->vref_count);
+                wake_up(&vha->vref_waitq);
         }
         spin_unlock_irqrestore(&ha->vport_slock, flags);
 }
@@ -5526,6 +5493,11 @@ qla2x00_abort_isp_cleanup(scsi_qla_host_t *vha)
         if (!(IS_P3P_TYPE(ha)))
                 ha->isp_ops->reset_chip(vha);
 
+        ha->flags.n2n_ae = 0;
+        ha->flags.lip_ae = 0;
+        ha->current_topology = 0;
+        ha->flags.fw_started = 0;
+        ha->flags.fw_init_done = 0;
         ha->chip_reset++;
 
         atomic_set(&vha->loop_down_timer, LOOP_DOWN_TIME);
@@ -6802,6 +6774,8 @@ qla2x00_try_to_stop_firmware(scsi_qla_host_t *vha)
                 return;
         if (!ha->fw_major_version)
                 return;
+        if (!ha->flags.fw_started)
+                return;
 
         ret = qla2x00_stop_firmware(vha);
         for (retries = 5; ret != QLA_SUCCESS && ret != QLA_FUNCTION_TIMEOUT &&
@@ -6815,6 +6789,9 @@ qla2x00_try_to_stop_firmware(scsi_qla_host_t *vha)
                     "Attempting retry of stop-firmware command.\n");
                 ret = qla2x00_stop_firmware(vha);
         }
+
+        ha->flags.fw_started = 0;
+        ha->flags.fw_init_done = 0;
 }
 
 int
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 535079280288..ea027f6a7fd4 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -889,7 +889,7 @@ qla24xx_get_one_block_sg(uint32_t blk_sz, struct qla2_sgx *sgx,
 
 int
 qla24xx_walk_and_build_sglist_no_difb(struct qla_hw_data *ha, srb_t *sp,
-        uint32_t *dsd, uint16_t tot_dsds, struct qla_tgt_cmd *tc)
+        uint32_t *dsd, uint16_t tot_dsds, struct qla_tc_param *tc)
 {
         void *next_dsd;
         uint8_t avail_dsds = 0;
@@ -898,7 +898,6 @@ qla24xx_walk_and_build_sglist_no_difb(struct qla_hw_data *ha, srb_t *sp,
         struct scatterlist *sg_prot;
         uint32_t *cur_dsd = dsd;
         uint16_t        used_dsds = tot_dsds;
-
         uint32_t        prot_int; /* protection interval */
         uint32_t        partial;
         struct qla2_sgx sgx;
@@ -966,7 +965,7 @@ alloc_and_fill:
                         } else {
                                 list_add_tail(&dsd_ptr->list,
                                     &(tc->ctx->dsd_list));
-                                tc->ctx_dsd_alloced = 1;
+                                *tc->ctx_dsd_alloced = 1;
                         }
 
 
@@ -1005,7 +1004,7 @@ alloc_and_fill:
 
 int
 qla24xx_walk_and_build_sglist(struct qla_hw_data *ha, srb_t *sp, uint32_t *dsd,
-        uint16_t tot_dsds, struct qla_tgt_cmd *tc)
+        uint16_t tot_dsds, struct qla_tc_param *tc)
 {
         void *next_dsd;
         uint8_t avail_dsds = 0;
@@ -1066,7 +1065,7 @@ qla24xx_walk_and_build_sglist(struct qla_hw_data *ha, srb_t *sp, uint32_t *dsd,
                         } else {
                                 list_add_tail(&dsd_ptr->list,
                                     &(tc->ctx->dsd_list));
-                                tc->ctx_dsd_alloced = 1;
+                                *tc->ctx_dsd_alloced = 1;
                         }
 
                         /* add new list to cmd iocb or last list */
@@ -1092,7 +1091,7 @@ qla24xx_walk_and_build_sglist(struct qla_hw_data *ha, srb_t *sp, uint32_t *dsd,
 
 int
 qla24xx_walk_and_build_prot_sglist(struct qla_hw_data *ha, srb_t *sp,
-        uint32_t *dsd, uint16_t tot_dsds, struct qla_tgt_cmd *tc)
+        uint32_t *dsd, uint16_t tot_dsds, struct qla_tc_param *tc)
 {
         void *next_dsd;
         uint8_t avail_dsds = 0;
@@ -1158,7 +1157,7 @@ qla24xx_walk_and_build_prot_sglist(struct qla_hw_data *ha, srb_t *sp,
                         } else {
                                 list_add_tail(&dsd_ptr->list,
                                     &(tc->ctx->dsd_list));
-                                tc->ctx_dsd_alloced = 1;
+                                *tc->ctx_dsd_alloced = 1;
                         }
 
                         /* add new list to cmd iocb or last list */
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 3c66ea29de27..3203367a4f42 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -708,6 +708,8 @@ skip_rio:
                     "mbx7=%xh.\n", mb[1], mb[2], mb[3], mbx);
 
                 ha->isp_ops->fw_dump(vha, 1);
+                ha->flags.fw_init_done = 0;
+                ha->flags.fw_started = 0;
 
                 if (IS_FWI2_CAPABLE(ha)) {
                         if (mb[1] == 0 && mb[2] == 0) {
@@ -761,6 +763,9 @@ skip_rio:
                 break;
 
         case MBA_LIP_OCCURRED:          /* Loop Initialization Procedure */
+                ha->flags.lip_ae = 1;
+                ha->flags.n2n_ae = 0;
+
                 ql_dbg(ql_dbg_async, vha, 0x5009,
                     "LIP occurred (%x).\n", mb[1]);
 
@@ -797,6 +802,10 @@ skip_rio:
                 break;
 
         case MBA_LOOP_DOWN:             /* Loop Down Event */
+                ha->flags.n2n_ae = 0;
+                ha->flags.lip_ae = 0;
+                ha->current_topology = 0;
+
                 mbx = (IS_QLA81XX(ha) || IS_QLA8031(ha))
                         ? RD_REG_WORD(&reg24->mailbox4) : 0;
                 mbx = (IS_P3P_TYPE(ha)) ? RD_REG_WORD(&reg82->mailbox_out[4])
@@ -866,6 +875,9 @@ skip_rio:
 
         /* case MBA_DCBX_COMPLETE: */
         case MBA_POINT_TO_POINT:        /* Point-to-Point */
+                ha->flags.lip_ae = 0;
+                ha->flags.n2n_ae = 1;
+
                 if (IS_QLA2100(ha))
                         break;
 
@@ -1620,9 +1632,9 @@ qla24xx_logio_entry(scsi_qla_host_t *vha, struct req_que *req,
                 QLA_LOGIO_LOGIN_RETRIED : 0;
         if (logio->entry_status) {
                 ql_log(ql_log_warn, fcport->vha, 0x5034,
-                    "Async-%s error entry - hdl=%x"
+                    "Async-%s error entry - %8phC hdl=%x"
                     "portid=%02x%02x%02x entry-status=%x.\n",
-                    type, sp->handle, fcport->d_id.b.domain,
+                    type, fcport->port_name, sp->handle, fcport->d_id.b.domain,
                     fcport->d_id.b.area, fcport->d_id.b.al_pa,
                     logio->entry_status);
                 ql_dump_buffer(ql_dbg_async + ql_dbg_buffer, vha, 0x504d,
@@ -1633,8 +1645,9 @@ qla24xx_logio_entry(scsi_qla_host_t *vha, struct req_que *req,
 
         if (le16_to_cpu(logio->comp_status) == CS_COMPLETE) {
                 ql_dbg(ql_dbg_async, fcport->vha, 0x5036,
-                    "Async-%s complete - hdl=%x portid=%02x%02x%02x "
-                    "iop0=%x.\n", type, sp->handle, fcport->d_id.b.domain,
+                    "Async-%s complete - %8phC hdl=%x portid=%02x%02x%02x "
+                    "iop0=%x.\n", type, fcport->port_name, sp->handle,
+                    fcport->d_id.b.domain,
                     fcport->d_id.b.area, fcport->d_id.b.al_pa,
                     le32_to_cpu(logio->io_parameter[0]));
 
@@ -1674,6 +1687,17 @@ qla24xx_logio_entry(scsi_qla_host_t *vha, struct req_que *req,
         case LSC_SCODE_NPORT_USED:
                 data[0] = MBS_LOOP_ID_USED;
                 break;
+        case LSC_SCODE_CMD_FAILED:
+                if (iop[1] == 0x0606) {
+                        /*
+                         * PLOGI/PRLI Completed. We must have Recv PLOGI/PRLI,
+                         * Target side acked.
+                         */
+                        data[0] = MBS_COMMAND_COMPLETE;
+                        goto logio_done;
+                }
+                data[0] = MBS_COMMAND_ERROR;
+                break;
         case LSC_SCODE_NOXCB:
                 vha->hw->exch_starvation++;
                 if (vha->hw->exch_starvation > 5) {
@@ -1695,8 +1719,9 @@ qla24xx_logio_entry(scsi_qla_host_t *vha, struct req_que *req,
         }
 
         ql_dbg(ql_dbg_async, fcport->vha, 0x5037,
-            "Async-%s failed - hdl=%x portid=%02x%02x%02x comp=%x "
-            "iop0=%x iop1=%x.\n", type, sp->handle, fcport->d_id.b.domain,
+            "Async-%s failed - %8phC hdl=%x portid=%02x%02x%02x comp=%x "
+            "iop0=%x iop1=%x.\n", type, fcport->port_name,
+                sp->handle, fcport->d_id.b.domain,
             fcport->d_id.b.area, fcport->d_id.b.al_pa,
             le16_to_cpu(logio->comp_status),
             le32_to_cpu(logio->io_parameter[0]),
@@ -2679,7 +2704,7 @@ qla24xx_abort_iocb_entry(scsi_qla_host_t *vha, struct req_que *req,
                 return;
 
         abt = &sp->u.iocb_cmd;
-        abt->u.abt.comp_status = le32_to_cpu(pkt->nport_handle);
+        abt->u.abt.comp_status = le16_to_cpu(pkt->nport_handle);
         sp->done(sp, 0);
 }
 
@@ -2693,7 +2718,7 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,
         struct sts_entry_24xx *pkt;
         struct qla_hw_data *ha = vha->hw;
 
-        if (!vha->flags.online)
+        if (!ha->flags.fw_started)
                 return;
 
         while (rsp->ring_ptr->signature != RESPONSE_PROCESSED) {
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 35079f417417..a113ab3592a7 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -10,6 +10,28 @@
 #include <linux/delay.h>
 #include <linux/gfp.h>
 
+static struct mb_cmd_name {
+        uint16_t cmd;
+        const char *str;
+} mb_str[] = {
+        {MBC_GET_PORT_DATABASE,         "GPDB"},
+        {MBC_GET_ID_LIST,               "GIDList"},
+        {MBC_GET_LINK_PRIV_STATS,       "Stats"},
+};
+
+static const char *mb_to_str(uint16_t cmd)
+{
+        int i;
+        struct mb_cmd_name *e;
+
+        for (i = 0; i < ARRAY_SIZE(mb_str); i++) {
+                e = mb_str + i;
+                if (cmd == e->cmd)
+                        return e->str;
+        }
+        return "unknown";
+}
+
 static struct rom_cmd {
         uint16_t cmd;
 } rom_cmds[] = {
@@ -2818,7 +2840,7 @@ qla2x00_get_link_status(scsi_qla_host_t *vha, uint16_t loop_id,
 
 int
 qla24xx_get_isp_stats(scsi_qla_host_t *vha, struct link_statistics *stats,
-    dma_addr_t stats_dma, uint options)
+    dma_addr_t stats_dma, uint16_t options)
 {
         int rval;
         mbx_cmd_t mc;
@@ -2828,19 +2850,17 @@ qla24xx_get_isp_stats(scsi_qla_host_t *vha, struct link_statistics *stats,
         ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x1088,
             "Entered %s.\n", __func__);
 
-        mcp->mb[0] = MBC_GET_LINK_PRIV_STATS;
-        mcp->mb[2] = MSW(stats_dma);
-        mcp->mb[3] = LSW(stats_dma);
-        mcp->mb[6] = MSW(MSD(stats_dma));
-        mcp->mb[7] = LSW(MSD(stats_dma));
-        mcp->mb[8] = sizeof(struct link_statistics) / 4;
-        mcp->mb[9] = vha->vp_idx;
-        mcp->mb[10] = options;
-        mcp->out_mb = MBX_10|MBX_9|MBX_8|MBX_7|MBX_6|MBX_3|MBX_2|MBX_0;
-        mcp->in_mb = MBX_2|MBX_1|MBX_0;
-        mcp->tov = MBX_TOV_SECONDS;
-        mcp->flags = IOCTL_CMD;
-        rval = qla2x00_mailbox_command(vha, mcp);
+        memset(&mc, 0, sizeof(mc));
+        mc.mb[0] = MBC_GET_LINK_PRIV_STATS;
+        mc.mb[2] = MSW(stats_dma);
+        mc.mb[3] = LSW(stats_dma);
+        mc.mb[6] = MSW(MSD(stats_dma));
+        mc.mb[7] = LSW(MSD(stats_dma));
+        mc.mb[8] = sizeof(struct link_statistics) / 4;
+        mc.mb[9] = cpu_to_le16(vha->vp_idx);
+        mc.mb[10] = cpu_to_le16(options);
+
+        rval = qla24xx_send_mb_cmd(vha, &mc);
 
         if (rval == QLA_SUCCESS) {
                 if (mcp->mb[0] != MBS_COMMAND_COMPLETE) {
@@ -3603,6 +3623,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
         scsi_qla_host_t *vp = NULL;
         unsigned long   flags;
         int found;
+        port_id_t id;
 
         ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b6,
             "Entered %s.\n", __func__);
@@ -3610,28 +3631,27 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
         if (rptid_entry->entry_status != 0)
                 return;
 
+        id.b.domain = rptid_entry->port_id[2];
+        id.b.area   = rptid_entry->port_id[1];
+        id.b.al_pa  = rptid_entry->port_id[0];
+        id.b.rsvd_1 = 0;
+
         if (rptid_entry->format == 0) {
                 /* loop */
-                ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b7,
+                ql_dbg(ql_dbg_async, vha, 0x10b7,
                     "Format 0 : Number of VPs setup %d, number of "
                     "VPs acquired %d.\n", rptid_entry->vp_setup,
                     rptid_entry->vp_acquired);
-                ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b8,
+                ql_dbg(ql_dbg_async, vha, 0x10b8,
                     "Primary port id %02x%02x%02x.\n",
                     rptid_entry->port_id[2], rptid_entry->port_id[1],
                     rptid_entry->port_id[0]);
 
-                vha->d_id.b.domain = rptid_entry->port_id[2];
-                vha->d_id.b.area = rptid_entry->port_id[1];
-                vha->d_id.b.al_pa = rptid_entry->port_id[0];
-
-                spin_lock_irqsave(&ha->vport_slock, flags);
-                qlt_update_vp_map(vha, SET_AL_PA);
-                spin_unlock_irqrestore(&ha->vport_slock, flags);
+                qlt_update_host_map(vha, id);
 
         } else if (rptid_entry->format == 1) {
                 /* fabric */
-                ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b9,
+                ql_dbg(ql_dbg_async, vha, 0x10b9,
                     "Format 1: VP[%d] enabled - status %d - with "
                     "port id %02x%02x%02x.\n", rptid_entry->vp_idx,
                         rptid_entry->vp_status,
@@ -3653,12 +3673,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
                                             WWN_SIZE);
                                 }
 
-                                vha->d_id.b.domain = rptid_entry->port_id[2];
-                                vha->d_id.b.area = rptid_entry->port_id[1];
-                                vha->d_id.b.al_pa = rptid_entry->port_id[0];
-                                spin_lock_irqsave(&ha->vport_slock, flags);
-                                qlt_update_vp_map(vha, SET_AL_PA);
-                                spin_unlock_irqrestore(&ha->vport_slock, flags);
+                                qlt_update_host_map(vha, id);
                         }
 
                         fc_host_port_name(vha->host) =
@@ -3694,12 +3709,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
                         if (!found)
                                 return;
 
-                        vp->d_id.b.domain = rptid_entry->port_id[2];
-                        vp->d_id.b.area =  rptid_entry->port_id[1];
-                        vp->d_id.b.al_pa = rptid_entry->port_id[0];
-                        spin_lock_irqsave(&ha->vport_slock, flags);
-                        qlt_update_vp_map(vp, SET_AL_PA);
-                        spin_unlock_irqrestore(&ha->vport_slock, flags);
+                        qlt_update_host_map(vp, id);
 
                         /*
                          * Cannot configure here as we are still sitting on the
@@ -5827,3 +5837,225 @@ qla26xx_dport_diagnostics(scsi_qla_host_t *vha,
 
         return rval;
 }
+
+static void qla2x00_async_mb_sp_done(void *s, int res)
+{
+        struct srb *sp = s;
+
+        sp->u.iocb_cmd.u.mbx.rc = res;
+
+        complete(&sp->u.iocb_cmd.u.mbx.comp);
+        /* don't free sp here. Let the caller do the free */
+}
+
+/*
+ * This mailbox uses the iocb interface to send MB command.
+ * This allows non-critial (non chip setup) command to go
+ * out in parrallel.
+ */
+int qla24xx_send_mb_cmd(struct scsi_qla_host *vha, mbx_cmd_t *mcp)
+{
+        int rval = QLA_FUNCTION_FAILED;
+        srb_t *sp;
+        struct srb_iocb *c;
+
+        if (!vha->hw->flags.fw_started)
+                goto done;
+
+        sp = qla2x00_get_sp(vha, NULL, GFP_KERNEL);
+        if (!sp)
+                goto done;
+
+        sp->type = SRB_MB_IOCB;
+        sp->name = mb_to_str(mcp->mb[0]);
+
+        qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);
+
+        memcpy(sp->u.iocb_cmd.u.mbx.out_mb, mcp->mb, SIZEOF_IOCB_MB_REG);
+
+        c = &sp->u.iocb_cmd;
+        c->timeout = qla2x00_async_iocb_timeout;
+        init_completion(&c->u.mbx.comp);
+
+        sp->done = qla2x00_async_mb_sp_done;
+
+        rval = qla2x00_start_sp(sp);
+        if (rval != QLA_SUCCESS) {
+                ql_dbg(ql_dbg_mbx, vha, 0xffff,
+                    "%s: %s Failed submission. %x.\n",
+                    __func__, sp->name, rval);
+                goto done_free_sp;
+        }
+
+        ql_dbg(ql_dbg_mbx, vha, 0xffff, "MB:%s hndl %x submitted\n",
+            sp->name, sp->handle);
+
+        wait_for_completion(&c->u.mbx.comp);
+        memcpy(mcp->mb, sp->u.iocb_cmd.u.mbx.in_mb, SIZEOF_IOCB_MB_REG);
+
+        rval = c->u.mbx.rc;
+        switch (rval) {
+        case QLA_FUNCTION_TIMEOUT:
+                ql_dbg(ql_dbg_mbx, vha, 0xffff, "%s: %s Timeout. %x.\n",
+                    __func__, sp->name, rval);
+                break;
+        case  QLA_SUCCESS:
+                ql_dbg(ql_dbg_mbx, vha, 0xffff, "%s: %s done.\n",
+                    __func__, sp->name);
+                sp->free(sp);
+                break;
+        default:
+                ql_dbg(ql_dbg_mbx, vha, 0xffff, "%s: %s Failed. %x.\n",
+                    __func__, sp->name, rval);
+                sp->free(sp);
+                break;
+        }
+
+        return rval;
+
+done_free_sp:
+        sp->free(sp);
+done:
+        return rval;
+}
+
+/*
+ * qla24xx_gpdb_wait
+ * NOTE: Do not call this routine from DPC thread
+ */
+int qla24xx_gpdb_wait(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt)
+{
+        int rval = QLA_FUNCTION_FAILED;
+        dma_addr_t pd_dma;
+        struct port_database_24xx *pd;
+        struct qla_hw_data *ha = vha->hw;
+        mbx_cmd_t mc;
+
+        if (!vha->hw->flags.fw_started)
+                goto done;
+
+        pd = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &pd_dma);
+        if (pd  == NULL) {
+                ql_log(ql_log_warn, vha, 0xffff,
+                        "Failed to allocate port database structure.\n");
+                goto done_free_sp;
+        }
+        memset(pd, 0, max(PORT_DATABASE_SIZE, PORT_DATABASE_24XX_SIZE));
+
+        memset(&mc, 0, sizeof(mc));
+        mc.mb[0] = MBC_GET_PORT_DATABASE;
+        mc.mb[1] = cpu_to_le16(fcport->loop_id);
+        mc.mb[2] = MSW(pd_dma);
+        mc.mb[3] = LSW(pd_dma);
+        mc.mb[6] = MSW(MSD(pd_dma));
+        mc.mb[7] = LSW(MSD(pd_dma));
+        mc.mb[9] = cpu_to_le16(vha->vp_idx);
+        mc.mb[10] = cpu_to_le16((uint16_t)opt);
+
+        rval = qla24xx_send_mb_cmd(vha, &mc);
+        if (rval != QLA_SUCCESS) {
+                ql_dbg(ql_dbg_mbx, vha, 0xffff,
+                    "%s: %8phC fail\n", __func__, fcport->port_name);
+                goto done_free_sp;
+        }
+
+        rval = __qla24xx_parse_gpdb(vha, fcport, pd);
+
+        ql_dbg(ql_dbg_mbx, vha, 0xffff, "%s: %8phC done\n",
+            __func__, fcport->port_name);
+
+done_free_sp:
+        if (pd)
+                dma_pool_free(ha->s_dma_pool, pd, pd_dma);
+done:
+        return rval;
+}
+
+int __qla24xx_parse_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport,
+    struct port_database_24xx *pd)
+{
+        int rval = QLA_SUCCESS;
+        uint64_t zero = 0;
+
+        /* Check for logged in state. */
+        if (pd->current_login_state != PDS_PRLI_COMPLETE &&
+                pd->last_login_state != PDS_PRLI_COMPLETE) {
+                ql_dbg(ql_dbg_mbx, vha, 0xffff,
+                           "Unable to verify login-state (%x/%x) for "
+                           "loop_id %x.\n", pd->current_login_state,
+                           pd->last_login_state, fcport->loop_id);
+                rval = QLA_FUNCTION_FAILED;
+                goto gpd_error_out;
+        }
+
+        if (fcport->loop_id == FC_NO_LOOP_ID ||
+            (memcmp(fcport->port_name, (uint8_t *)&zero, 8) &&
+             memcmp(fcport->port_name, pd->port_name, 8))) {
+                /* We lost the device mid way. */
+                rval = QLA_NOT_LOGGED_IN;
+                goto gpd_error_out;
+        }
+
+        /* Names are little-endian. */
+        memcpy(fcport->node_name, pd->node_name, WWN_SIZE);
+        memcpy(fcport->port_name, pd->port_name, WWN_SIZE);
+
+        /* Get port_id of device. */
+        fcport->d_id.b.domain = pd->port_id[0];
+        fcport->d_id.b.area = pd->port_id[1];
+        fcport->d_id.b.al_pa = pd->port_id[2];
+        fcport->d_id.b.rsvd_1 = 0;
+
+        /* If not target must be initiator or unknown type. */
+        if ((pd->prli_svc_param_word_3[0] & BIT_4) == 0)
+                fcport->port_type = FCT_INITIATOR;
+        else
+                fcport->port_type = FCT_TARGET;
+
+        /* Passback COS information. */
+        fcport->supported_classes = (pd->flags & PDF_CLASS_2) ?
+                FC_COS_CLASS2 : FC_COS_CLASS3;
+
+        if (pd->prli_svc_param_word_3[0] & BIT_7) {
+                fcport->flags |= FCF_CONF_COMP_SUPPORTED;
+                fcport->conf_compl_supported = 1;
+        }
+
+gpd_error_out:
+        return rval;
+}
+
+/*
+ * qla24xx_gidlist__wait
+ * NOTE: don't call this routine from DPC thread.
+ */
+int qla24xx_gidlist_wait(struct scsi_qla_host *vha,
+        void *id_list, dma_addr_t id_list_dma, uint16_t *entries)
+{
+        int rval = QLA_FUNCTION_FAILED;
+        mbx_cmd_t mc;
+
+        if (!vha->hw->flags.fw_started)
+                goto done;
+
+        memset(&mc, 0, sizeof(mc));
+        mc.mb[0] = MBC_GET_ID_LIST;
+        mc.mb[2] = MSW(id_list_dma);
+        mc.mb[3] = LSW(id_list_dma);
+        mc.mb[6] = MSW(MSD(id_list_dma));
+        mc.mb[7] = LSW(MSD(id_list_dma));
+        mc.mb[8] = 0;
+        mc.mb[9] = cpu_to_le16(vha->vp_idx);
+
+        rval = qla24xx_send_mb_cmd(vha, &mc);
+        if (rval != QLA_SUCCESS) {
+                ql_dbg(ql_dbg_mbx, vha, 0xffff,
+                        "%s:  fail\n", __func__);
+        } else {
+                *entries = mc.mb[1];
+                ql_dbg(ql_dbg_mbx, vha, 0xffff,
+                        "%s:  done\n", __func__);
+        }
+done:
+        return rval;
+}
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index c6d6f0d912ff..09a490c98763 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -74,13 +74,14 @@ qla24xx_deallocate_vp_id(scsi_qla_host_t *vha)
          * ensures no active vp_list traversal while the vport is removed
          * from the queue)
          */
-        spin_lock_irqsave(&ha->vport_slock, flags);
-        while (atomic_read(&vha->vref_count)) {
-                spin_unlock_irqrestore(&ha->vport_slock, flags);
-
-                msleep(500);
+        wait_event_timeout(vha->vref_waitq, atomic_read(&vha->vref_count),
+            10*HZ);
 
-                spin_lock_irqsave(&ha->vport_slock, flags);
+        spin_lock_irqsave(&ha->vport_slock, flags);
+        if (atomic_read(&vha->vref_count)) {
+                ql_dbg(ql_dbg_vport, vha, 0xfffa,
+                    "vha->vref_count=%u timeout\n", vha->vref_count.counter);
+                vha->vref_count = (atomic_t)ATOMIC_INIT(0);
         }
         list_del(&vha->list);
         qlt_update_vp_map(vha, RESET_VP_IDX);
@@ -269,6 +270,7 @@ qla2x00_alert_all_vps(struct rsp_que *rsp, uint16_t *mb)
 
                         spin_lock_irqsave(&ha->vport_slock, flags);
                         atomic_dec(&vha->vref_count);
+                        wake_up(&vha->vref_waitq);
                 }
                 i++;
         }
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 1fed235a1b4a..3e7011757c82 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1651,7 +1651,8 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                 /* Don't abort commands in adapter during EEH
                                  * recovery as it's not accessible/responding.
                                  */
-                                if (GET_CMD_SP(sp) && !ha->flags.eeh_busy) {
+                                if (GET_CMD_SP(sp) && !ha->flags.eeh_busy &&
+                                    (sp->type == SRB_SCSI_CMD)) {
                                         /* Get a reference to the sp and drop the lock.
                                          * The reference ensures this sp->done() call
                                          * - and not the call in qla2xxx_eh_abort() -
@@ -2560,6 +2561,20 @@ qla2xxx_scan_finished(struct Scsi_Host *shost, unsigned long time)
         return atomic_read(&vha->loop_state) == LOOP_READY;
 }
 
+static void qla2x00_iocb_work_fn(struct work_struct *work)
+{
+        struct scsi_qla_host *vha = container_of(work,
+                struct scsi_qla_host, iocb_work);
+        int cnt = 0;
+
+        while (!list_empty(&vha->work_list)) {
+                qla2x00_do_work(vha);
+                cnt++;
+                if (cnt > 10)
+                        break;
+        }
+}
+
 /*
  * PCI driver interface
  */
@@ -3078,6 +3093,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
          */
         qla2xxx_wake_dpc(base_vha);
 
+        INIT_WORK(&base_vha->iocb_work, qla2x00_iocb_work_fn);
         INIT_WORK(&ha->board_disable, qla2x00_disable_board_on_pci_error);
 
         if (IS_QLA8031(ha) || IS_MCTP_CAPABLE(ha)) {
@@ -3469,6 +3485,7 @@ qla2x00_remove_one(struct pci_dev *pdev)
         qla2x00_free_sysfs_attr(base_vha, true);
 
         fc_remove_host(base_vha->host);
+        qlt_remove_target_resources(ha);
 
         scsi_remove_host(base_vha->host);
 
@@ -4268,6 +4285,7 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht,
         spin_lock_init(&vha->work_lock);
         spin_lock_init(&vha->cmd_list_lock);
         init_waitqueue_head(&vha->fcport_waitQ);
+        init_waitqueue_head(&vha->vref_waitq);
 
         vha->gnl.size = sizeof(struct get_name_list_extended) *
                         (ha->max_loop_id + 1);
@@ -4319,7 +4337,11 @@ qla2x00_post_work(struct scsi_qla_host *vha, struct qla_work_evt *e)
         spin_lock_irqsave(&vha->work_lock, flags);
         list_add_tail(&e->list, &vha->work_list);
         spin_unlock_irqrestore(&vha->work_lock, flags);
-        qla2xxx_wake_dpc(vha);
+
+        if (QLA_EARLY_LINKUP(vha->hw))
+                schedule_work(&vha->iocb_work);
+        else
+                qla2xxx_wake_dpc(vha);
 
         return QLA_SUCCESS;
 }
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 45f5077684f0..0e03ca2ab3e5 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -130,6 +130,9 @@ static void qlt_send_term_imm_notif(struct scsi_qla_host *vha,
 static struct fc_port *qlt_create_sess(struct scsi_qla_host *vha,
         fc_port_t *fcport, bool local);
 void qlt_unreg_sess(struct fc_port *sess);
+static void qlt_24xx_handle_abts(struct scsi_qla_host *,
+        struct abts_recv_from_24xx *);
+
 /*
  * Global Variables
  */
@@ -140,6 +143,20 @@ static struct workqueue_struct *qla_tgt_wq;
 static DEFINE_MUTEX(qla_tgt_mutex);
 static LIST_HEAD(qla_tgt_glist);
 
+static const char *prot_op_str(u32 prot_op)
+{
+        switch (prot_op) {
+        case TARGET_PROT_NORMAL:        return "NORMAL";
+        case TARGET_PROT_DIN_INSERT:    return "DIN_INSERT";
+        case TARGET_PROT_DOUT_INSERT:   return "DOUT_INSERT";
+        case TARGET_PROT_DIN_STRIP:     return "DIN_STRIP";
+        case TARGET_PROT_DOUT_STRIP:    return "DOUT_STRIP";
+        case TARGET_PROT_DIN_PASS:      return "DIN_PASS";
+        case TARGET_PROT_DOUT_PASS:     return "DOUT_PASS";
+        default:                        return "UNKNOWN";
+        }
+}
+
 /* This API intentionally takes dest as a parameter, rather than returning
  * int value to avoid caller forgetting to issue wmb() after the store */
 void qlt_do_generation_tick(struct scsi_qla_host *vha, int *dest)
@@ -170,21 +187,23 @@ static inline
 struct scsi_qla_host *qlt_find_host_by_d_id(struct scsi_qla_host *vha,
         uint8_t *d_id)
 {
-        struct qla_hw_data *ha = vha->hw;
-        uint8_t vp_idx;
-
-        if ((vha->d_id.b.area != d_id[1]) || (vha->d_id.b.domain != d_id[0]))
-                return NULL;
+        struct scsi_qla_host *host;
+        uint32_t key = 0;
 
-        if (vha->d_id.b.al_pa == d_id[2])
+        if ((vha->d_id.b.area == d_id[1]) && (vha->d_id.b.domain == d_id[0]) &&
+            (vha->d_id.b.al_pa == d_id[2]))
                 return vha;
 
-        BUG_ON(ha->tgt.tgt_vp_map == NULL);
-        vp_idx = ha->tgt.tgt_vp_map[d_id[2]].idx;
-        if (likely(test_bit(vp_idx, ha->vp_idx_map)))
-                return ha->tgt.tgt_vp_map[vp_idx].vha;
+        key  = (uint32_t)d_id[0] << 16;
+        key |= (uint32_t)d_id[1] <<  8;
+        key |= (uint32_t)d_id[2];
 
-        return NULL;
+        host = btree_lookup32(&vha->hw->tgt.host_map, key);
+        if (!host)
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xffff,
+                           "Unable to find host %06x\n", key);
+
+        return host;
 }
 
 static inline
@@ -389,6 +408,8 @@ static bool qlt_24xx_atio_pkt_all_vps(struct scsi_qla_host *vha,
                         (struct abts_recv_from_24xx *)atio;
                 struct scsi_qla_host *host = qlt_find_host_by_vp_idx(vha,
                         entry->vp_index);
+                unsigned long flags;
+
                 if (unlikely(!host)) {
                         ql_dbg(ql_dbg_tgt, vha, 0xffff,
                             "qla_target(%d): Response pkt (ABTS_RECV_24XX) "
@@ -396,9 +417,12 @@ static bool qlt_24xx_atio_pkt_all_vps(struct scsi_qla_host *vha,
                             vha->vp_idx, entry->vp_index);
                         break;
                 }
-                qlt_response_pkt(host, (response_t *)atio);
+                if (!ha_locked)
+                        spin_lock_irqsave(&host->hw->hardware_lock, flags);
+                qlt_24xx_handle_abts(host, (struct abts_recv_from_24xx *)atio);
+                if (!ha_locked)
+                        spin_unlock_irqrestore(&host->hw->hardware_lock, flags);
                 break;
-
         }
 
         /* case PUREX_IOCB_TYPE: ql2xmvasynctoatio */
@@ -554,6 +578,7 @@ void qla2x00_async_nack_sp_done(void *s, int res)
                 sp->fcport->login_gen++;
                 sp->fcport->fw_login_state = DSC_LS_PLOGI_COMP;
                 sp->fcport->logout_on_delete = 1;
+                sp->fcport->plogi_nack_done_deadline = jiffies + HZ;
                 break;
 
         case SRB_NACK_PRLI:
@@ -613,6 +638,7 @@ int qla24xx_async_notify_ack(scsi_qla_host_t *vha, fc_port_t *fcport,
                 break;
         case SRB_NACK_PRLI:
                 fcport->fw_login_state = DSC_LS_PRLI_PEND;
+                fcport->deleted = 0;
                 c = "PRLI";
                 break;
         case SRB_NACK_LOGO:
@@ -1215,7 +1241,7 @@ static int qla24xx_get_loop_id(struct scsi_qla_host *vha, const uint8_t *s_id,
         }
 
         /* Get list of logged in devices */
-        rc = qla2x00_get_id_list(vha, gid_list, gid_list_dma, &entries);
+        rc = qla24xx_gidlist_wait(vha, gid_list, gid_list_dma, &entries);
         if (rc != QLA_SUCCESS) {
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf045,
                     "qla_target(%d): get_id_list() failed: %x\n",
@@ -1551,6 +1577,9 @@ static void qlt_send_notify_ack(struct scsi_qla_host *vha,
         request_t *pkt;
         struct nack_to_isp *nack;
 
+        if (!ha->flags.fw_started)
+                return;
+
         ql_dbg(ql_dbg_tgt, vha, 0xe004, "Sending NOTIFY_ACK (ha=%p)\n", ha);
 
         /* Send marker if required */
@@ -2013,6 +2042,70 @@ void qlt_free_mcmd(struct qla_tgt_mgmt_cmd *mcmd)
 }
 EXPORT_SYMBOL(qlt_free_mcmd);
 
+/*
+ * ha->hardware_lock supposed to be held on entry. Might drop it, then
+ * reacquire
+ */
+void qlt_send_resp_ctio(scsi_qla_host_t *vha, struct qla_tgt_cmd *cmd,
+    uint8_t scsi_status, uint8_t sense_key, uint8_t asc, uint8_t ascq)
+{
+        struct atio_from_isp *atio = &cmd->atio;
+        struct ctio7_to_24xx *ctio;
+        uint16_t temp;
+
+        ql_dbg(ql_dbg_tgt_dif, vha, 0x3066,
+            "Sending response CTIO7 (vha=%p, atio=%p, scsi_status=%02x, "
+            "sense_key=%02x, asc=%02x, ascq=%02x",
+            vha, atio, scsi_status, sense_key, asc, ascq);
+
+        ctio = (struct ctio7_to_24xx *)qla2x00_alloc_iocbs(vha, NULL);
+        if (!ctio) {
+                ql_dbg(ql_dbg_async, vha, 0x3067,
+                    "qla2x00t(%ld): %s failed: unable to allocate request packet",
+                    vha->host_no, __func__);
+                goto out;
+        }
+
+        ctio->entry_type = CTIO_TYPE7;
+        ctio->entry_count = 1;
+        ctio->handle = QLA_TGT_SKIP_HANDLE;
+        ctio->nport_handle = cmd->sess->loop_id;
+        ctio->timeout = cpu_to_le16(QLA_TGT_TIMEOUT);
+        ctio->vp_index = vha->vp_idx;
+        ctio->initiator_id[0] = atio->u.isp24.fcp_hdr.s_id[2];
+        ctio->initiator_id[1] = atio->u.isp24.fcp_hdr.s_id[1];
+        ctio->initiator_id[2] = atio->u.isp24.fcp_hdr.s_id[0];
+        ctio->exchange_addr = atio->u.isp24.exchange_addr;
+        ctio->u.status1.flags = (atio->u.isp24.attr << 9) |
+            cpu_to_le16(CTIO7_FLAGS_STATUS_MODE_1 | CTIO7_FLAGS_SEND_STATUS);
+        temp = be16_to_cpu(atio->u.isp24.fcp_hdr.ox_id);
+        ctio->u.status1.ox_id = cpu_to_le16(temp);
+        ctio->u.status1.scsi_status =
+            cpu_to_le16(SS_RESPONSE_INFO_LEN_VALID | scsi_status);
+        ctio->u.status1.response_len = cpu_to_le16(18);
+        ctio->u.status1.residual = cpu_to_le32(get_datalen_for_atio(atio));
+
+        if (ctio->u.status1.residual != 0)
+                ctio->u.status1.scsi_status |=
+                    cpu_to_le16(SS_RESIDUAL_UNDER);
+
+        /* Response code and sense key */
+        put_unaligned_le32(((0x70 << 24) | (sense_key << 8)),
+            (&ctio->u.status1.sense_data)[0]);
+        /* Additional sense length */
+        put_unaligned_le32(0x0a, (&ctio->u.status1.sense_data)[1]);
+        /* ASC and ASCQ */
+        put_unaligned_le32(((asc << 24) | (ascq << 16)),
+            (&ctio->u.status1.sense_data)[3]);
+
+        /* Memory Barrier */
+        wmb();
+
+        qla2x00_start_iocbs(vha, vha->req);
+out:
+        return;
+}
+
 /* callback from target fabric module code */
 void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *mcmd)
 {
@@ -2261,7 +2354,7 @@ static int qlt_24xx_build_ctio_pkt(struct qla_tgt_prm *prm,
                  */
                 return -EAGAIN;
         } else
-                ha->tgt.cmds[h-1] = prm->cmd;
+                ha->tgt.cmds[h - 1] = prm->cmd;
 
         pkt->handle = h | CTIO_COMPLETION_HANDLE_MARK;
         pkt->nport_handle = prm->cmd->loop_id;
@@ -2391,6 +2484,50 @@ static inline int qlt_has_data(struct qla_tgt_cmd *cmd)
         return cmd->bufflen > 0;
 }
 
+static void qlt_print_dif_err(struct qla_tgt_prm *prm)
+{
+        struct qla_tgt_cmd *cmd;
+        struct scsi_qla_host *vha;
+
+        /* asc 0x10=dif error */
+        if (prm->sense_buffer && (prm->sense_buffer[12] == 0x10)) {
+                cmd = prm->cmd;
+                vha = cmd->vha;
+                /* ASCQ */
+                switch (prm->sense_buffer[13]) {
+                case 1:
+                        ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                            "BE detected Guard TAG ERR: lba[0x%llx|%lld] len[0x%x] "
+                            "se_cmd=%p tag[%x]",
+                            cmd->lba, cmd->lba, cmd->num_blks, &cmd->se_cmd,
+                            cmd->atio.u.isp24.exchange_addr);
+                        break;
+                case 2:
+                        ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                            "BE detected APP TAG ERR: lba[0x%llx|%lld] len[0x%x] "
+                            "se_cmd=%p tag[%x]",
+                            cmd->lba, cmd->lba, cmd->num_blks, &cmd->se_cmd,
+                            cmd->atio.u.isp24.exchange_addr);
+                        break;
+                case 3:
+                        ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                            "BE detected REF TAG ERR: lba[0x%llx|%lld] len[0x%x] "
+                            "se_cmd=%p tag[%x]",
+                            cmd->lba, cmd->lba, cmd->num_blks, &cmd->se_cmd,
+                            cmd->atio.u.isp24.exchange_addr);
+                        break;
+                default:
+                        ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                            "BE detected Dif ERR: lba[%llx|%lld] len[%x] "
+                            "se_cmd=%p tag[%x]",
+                            cmd->lba, cmd->lba, cmd->num_blks, &cmd->se_cmd,
+                            cmd->atio.u.isp24.exchange_addr);
+                        break;
+                }
+                ql_dump_buffer(ql_dbg_tgt_dif, vha, 0xffff, cmd->cdb, 16);
+        }
+}
+
 /*
  * Called without ha->hardware_lock held
  */
@@ -2512,18 +2649,9 @@ skip_explict_conf:
                 for (i = 0; i < prm->sense_buffer_len/4; i++)
                         ((uint32_t *)ctio->u.status1.sense_data)[i] =
                                 cpu_to_be32(((uint32_t *)prm->sense_buffer)[i]);
-#if 0
-                if (unlikely((prm->sense_buffer_len % 4) != 0)) {
-                        static int q;
-                        if (q < 10) {
-                                ql_dbg(ql_dbg_tgt, vha, 0xe04f,
-                                    "qla_target(%d): %d bytes of sense "
-                                    "lost", prm->tgt->ha->vp_idx,
-                                    prm->sense_buffer_len % 4);
-                                q++;
-                        }
-                }
-#endif
+
+                qlt_print_dif_err(prm);
+
         } else {
                 ctio->u.status1.flags &=
                     ~cpu_to_le16(CTIO7_FLAGS_STATUS_MODE_0);
@@ -2537,19 +2665,9 @@ skip_explict_conf:
         /* Sense with len > 24, is it possible ??? */
 }
 
-
-
-/* diff  */
 static inline int
 qlt_hba_err_chk_enabled(struct se_cmd *se_cmd)
 {
-        /*
-         * Uncomment when corresponding SCSI changes are done.
-         *
-         if (!sp->cmd->prot_chk)
-         return 0;
-         *
-         */
         switch (se_cmd->prot_op) {
         case TARGET_PROT_DOUT_INSERT:
         case TARGET_PROT_DIN_STRIP:
@@ -2570,16 +2688,38 @@ qlt_hba_err_chk_enabled(struct se_cmd *se_cmd)
         return 0;
 }
 
+static inline int
+qla_tgt_ref_mask_check(struct se_cmd *se_cmd)
+{
+        switch (se_cmd->prot_op) {
+        case TARGET_PROT_DIN_INSERT:
+        case TARGET_PROT_DOUT_INSERT:
+        case TARGET_PROT_DIN_STRIP:
+        case TARGET_PROT_DOUT_STRIP:
+        case TARGET_PROT_DIN_PASS:
+        case TARGET_PROT_DOUT_PASS:
+            return 1;
+        default:
+            return 0;
+        }
+        return 0;
+}
+
 /*
- * qla24xx_set_t10dif_tags_from_cmd - Extract Ref and App tags from SCSI command
- *
+ * qla_tgt_set_dif_tags - Extract Ref and App tags from SCSI command
  */
-static inline void
-qlt_set_t10dif_tags(struct se_cmd *se_cmd, struct crc_context *ctx)
+static void
+qla_tgt_set_dif_tags(struct qla_tgt_cmd *cmd, struct crc_context *ctx,
+    uint16_t *pfw_prot_opts)
 {
+        struct se_cmd *se_cmd = &cmd->se_cmd;
         uint32_t lba = 0xffffffff & se_cmd->t_task_lba;
+        scsi_qla_host_t *vha = cmd->tgt->vha;
+        struct qla_hw_data *ha = vha->hw;
+        uint32_t t32 = 0;
 
-        /* wait til Mode Sense/Select cmd, modepage Ah, subpage 2
+        /*
+         * wait till Mode Sense/Select cmd, modepage Ah, subpage 2
          * have been immplemented by TCM, before AppTag is avail.
          * Look for modesense_handlers[]
          */
@@ -2587,65 +2727,73 @@ qlt_set_t10dif_tags(struct se_cmd *se_cmd, struct crc_context *ctx)
         ctx->app_tag_mask[0] = 0x0;
         ctx->app_tag_mask[1] = 0x0;
 
+        if (IS_PI_UNINIT_CAPABLE(ha)) {
+                if ((se_cmd->prot_type == TARGET_DIF_TYPE1_PROT) ||
+                    (se_cmd->prot_type == TARGET_DIF_TYPE2_PROT))
+                        *pfw_prot_opts |= PO_DIS_VALD_APP_ESC;
+                else if (se_cmd->prot_type == TARGET_DIF_TYPE3_PROT)
+                        *pfw_prot_opts |= PO_DIS_VALD_APP_REF_ESC;
+        }
+
+        t32 = ha->tgt.tgt_ops->get_dif_tags(cmd, pfw_prot_opts);
+
         switch (se_cmd->prot_type) {
         case TARGET_DIF_TYPE0_PROT:
                 /*
-                 * No check for ql2xenablehba_err_chk, as it would be an
-                 * I/O error if hba tag generation is not done.
+                 * No check for ql2xenablehba_err_chk, as it
+                 * would be an I/O error if hba tag generation
+                 * is not done.
                  */
                 ctx->ref_tag = cpu_to_le32(lba);
-
-                if (!qlt_hba_err_chk_enabled(se_cmd))
-                        break;
-
                 /* enable ALL bytes of the ref tag */
                 ctx->ref_tag_mask[0] = 0xff;
                 ctx->ref_tag_mask[1] = 0xff;
                 ctx->ref_tag_mask[2] = 0xff;
                 ctx->ref_tag_mask[3] = 0xff;
                 break;
-        /*
-         * For TYpe 1 protection: 16 bit GUARD tag, 32 bit REF tag, and
-         * 16 bit app tag.
-         */
         case TARGET_DIF_TYPE1_PROT:
-                ctx->ref_tag = cpu_to_le32(lba);
-
-                if (!qlt_hba_err_chk_enabled(se_cmd))
-                        break;
-
-                /* enable ALL bytes of the ref tag */
-                ctx->ref_tag_mask[0] = 0xff;
-                ctx->ref_tag_mask[1] = 0xff;
-                ctx->ref_tag_mask[2] = 0xff;
-                ctx->ref_tag_mask[3] = 0xff;
-                break;
-        /*
-         * For TYPE 2 protection: 16 bit GUARD + 32 bit REF tag has to
-         * match LBA in CDB + N
-         */
+            /*
+             * For TYPE 1 protection: 16 bit GUARD tag, 32 bit
+             * REF tag, and 16 bit app tag.
+             */
+            ctx->ref_tag = cpu_to_le32(lba);
+            if (!qla_tgt_ref_mask_check(se_cmd) ||
+                !(ha->tgt.tgt_ops->chk_dif_tags(t32))) {
+                    *pfw_prot_opts |= PO_DIS_REF_TAG_VALD;
+                    break;
+            }
+            /* enable ALL bytes of the ref tag */
+            ctx->ref_tag_mask[0] = 0xff;
+            ctx->ref_tag_mask[1] = 0xff;
+            ctx->ref_tag_mask[2] = 0xff;
+            ctx->ref_tag_mask[3] = 0xff;
+            break;
         case TARGET_DIF_TYPE2_PROT:
-                ctx->ref_tag = cpu_to_le32(lba);
-
-                if (!qlt_hba_err_chk_enabled(se_cmd))
-                        break;
-
-                /* enable ALL bytes of the ref tag */
-                ctx->ref_tag_mask[0] = 0xff;
-                ctx->ref_tag_mask[1] = 0xff;
-                ctx->ref_tag_mask[2] = 0xff;
-                ctx->ref_tag_mask[3] = 0xff;
-                break;
-
-        /* For Type 3 protection: 16 bit GUARD only */
+            /*
+             * For TYPE 2 protection: 16 bit GUARD + 32 bit REF
+             * tag has to match LBA in CDB + N
+             */
+            ctx->ref_tag = cpu_to_le32(lba);
+            if (!qla_tgt_ref_mask_check(se_cmd) ||
+                !(ha->tgt.tgt_ops->chk_dif_tags(t32))) {
+                    *pfw_prot_opts |= PO_DIS_REF_TAG_VALD;
+                    break;
+            }
+            /* enable ALL bytes of the ref tag */
+            ctx->ref_tag_mask[0] = 0xff;
+            ctx->ref_tag_mask[1] = 0xff;
+            ctx->ref_tag_mask[2] = 0xff;
+            ctx->ref_tag_mask[3] = 0xff;
+            break;
         case TARGET_DIF_TYPE3_PROT:
-                ctx->ref_tag_mask[0] = ctx->ref_tag_mask[1] =
-                        ctx->ref_tag_mask[2] = ctx->ref_tag_mask[3] = 0x00;
-                break;
+            /* For TYPE 3 protection: 16 bit GUARD only */
+            *pfw_prot_opts |= PO_DIS_REF_TAG_VALD;
+            ctx->ref_tag_mask[0] = ctx->ref_tag_mask[1] =
+                ctx->ref_tag_mask[2] = ctx->ref_tag_mask[3] = 0x00;
+            break;
         }
 }
 
-
 static inline int
 qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
 {
@@ -2664,6 +2812,7 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
         struct se_cmd           *se_cmd = &cmd->se_cmd;
         uint32_t h;
         struct atio_from_isp *atio = &prm->cmd->atio;
+        struct qla_tc_param     tc;
         uint16_t t16;
 
         ha = vha->hw;
@@ -2689,16 +2838,15 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
         case TARGET_PROT_DIN_INSERT:
         case TARGET_PROT_DOUT_STRIP:
                 transfer_length = data_bytes;
-                data_bytes += dif_bytes;
+                if (cmd->prot_sg_cnt)
+                        data_bytes += dif_bytes;
                 break;
-
         case TARGET_PROT_DIN_STRIP:
         case TARGET_PROT_DOUT_INSERT:
         case TARGET_PROT_DIN_PASS:
         case TARGET_PROT_DOUT_PASS:
                 transfer_length = data_bytes + dif_bytes;
                 break;
-
         default:
                 BUG();
                 break;
@@ -2734,7 +2882,6 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
                 break;
         }
 
-
         /* ---- PKT ---- */
         /* Update entry type to indicate Command Type CRC_2 IOCB */
         pkt->entry_type  = CTIO_CRC2;
@@ -2752,9 +2899,8 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
         } else
                 ha->tgt.cmds[h-1] = prm->cmd;
 
-
         pkt->handle  = h | CTIO_COMPLETION_HANDLE_MARK;
-        pkt->nport_handle = prm->cmd->loop_id;
+        pkt->nport_handle = cpu_to_le16(prm->cmd->loop_id);
         pkt->timeout = cpu_to_le16(QLA_TGT_TIMEOUT);
         pkt->initiator_id[0] = atio->u.isp24.fcp_hdr.s_id[2];
         pkt->initiator_id[1] = atio->u.isp24.fcp_hdr.s_id[1];
@@ -2775,12 +2921,10 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
         else if (cmd->dma_data_direction == DMA_FROM_DEVICE)
                 pkt->flags = cpu_to_le16(CTIO7_FLAGS_DATA_OUT);
 
-
         pkt->dseg_count = prm->tot_dsds;
         /* Fibre channel byte count */
         pkt->transfer_length = cpu_to_le32(transfer_length);
 
-
         /* ----- CRC context -------- */
 
         /* Allocate CRC context from global pool */
@@ -2800,13 +2944,12 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
         /* Set handle */
         crc_ctx_pkt->handle = pkt->handle;
 
-        qlt_set_t10dif_tags(se_cmd, crc_ctx_pkt);
+        qla_tgt_set_dif_tags(cmd, crc_ctx_pkt, &fw_prot_opts);
 
         pkt->crc_context_address[0] = cpu_to_le32(LSD(crc_ctx_dma));
         pkt->crc_context_address[1] = cpu_to_le32(MSD(crc_ctx_dma));
         pkt->crc_context_len = CRC_CONTEXT_LEN_FW;
 
-
         if (!bundling) {
                 cur_dsd = (uint32_t *) &crc_ctx_pkt->u.nobundling.data_address;
         } else {
@@ -2827,16 +2970,24 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
         crc_ctx_pkt->byte_count = cpu_to_le32(data_bytes);
         crc_ctx_pkt->guard_seed = cpu_to_le16(0);
 
+        memset((uint8_t *)&tc, 0 , sizeof(tc));
+        tc.vha = vha;
+        tc.blk_sz = cmd->blk_sz;
+        tc.bufflen = cmd->bufflen;
+        tc.sg = cmd->sg;
+        tc.prot_sg = cmd->prot_sg;
+        tc.ctx = crc_ctx_pkt;
+        tc.ctx_dsd_alloced = &cmd->ctx_dsd_alloced;
 
         /* Walks data segments */
         pkt->flags |= cpu_to_le16(CTIO7_FLAGS_DSD_PTR);
 
         if (!bundling && prm->prot_seg_cnt) {
                 if (qla24xx_walk_and_build_sglist_no_difb(ha, NULL, cur_dsd,
-                        prm->tot_dsds, cmd))
+                        prm->tot_dsds, &tc))
                         goto crc_queuing_error;
         } else if (qla24xx_walk_and_build_sglist(ha, NULL, cur_dsd,
-                (prm->tot_dsds - prm->prot_seg_cnt), cmd))
+                (prm->tot_dsds - prm->prot_seg_cnt), &tc))
                 goto crc_queuing_error;
 
         if (bundling && prm->prot_seg_cnt) {
@@ -2845,18 +2996,18 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
 
                 cur_dsd = (uint32_t *) &crc_ctx_pkt->u.bundling.dif_address;
                 if (qla24xx_walk_and_build_prot_sglist(ha, NULL, cur_dsd,
-                        prm->prot_seg_cnt, cmd))
+                        prm->prot_seg_cnt, &tc))
                         goto crc_queuing_error;
         }
         return QLA_SUCCESS;
 
 crc_queuing_error:
         /* Cleanup will be performed by the caller */
+        vha->hw->tgt.cmds[h - 1] = NULL;
 
         return QLA_FUNCTION_FAILED;
 }
 
-
 /*
  * Callback to setup response of xmit_type of QLA_TGT_XMIT_DATA and *
  * QLA_TGT_XMIT_STATUS for >= 24xx silicon
@@ -2906,7 +3057,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
         else
                 vha->tgt_counters.core_qla_que_buf++;
 
-        if (!vha->flags.online || cmd->reset_count != ha->chip_reset) {
+        if (!ha->flags.fw_started || cmd->reset_count != ha->chip_reset) {
                 /*
                  * Either the port is not online or this request was from
                  * previous life, just abort the processing.
@@ -3047,7 +3198,7 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
 
         spin_lock_irqsave(&ha->hardware_lock, flags);
 
-        if (!vha->flags.online || (cmd->reset_count != ha->chip_reset) ||
+        if (!ha->flags.fw_started || (cmd->reset_count != ha->chip_reset) ||
             (cmd->sess && cmd->sess->deleted)) {
                 /*
                  * Either the port is not online or this request was from
@@ -3104,139 +3255,113 @@ EXPORT_SYMBOL(qlt_rdy_to_xfer);
 
 
 /*
- * Checks the guard or meta-data for the type of error
- * detected by the HBA.
+ * it is assumed either hardware_lock or qpair lock is held.
  */
-static inline int
+static void
 qlt_handle_dif_error(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd,
-                struct ctio_crc_from_fw *sts)
+        struct ctio_crc_from_fw *sts)
 {
         uint8_t         *ap = &sts->actual_dif[0];
         uint8_t         *ep = &sts->expected_dif[0];
-        uint32_t        e_ref_tag, a_ref_tag;
-        uint16_t        e_app_tag, a_app_tag;
-        uint16_t        e_guard, a_guard;
         uint64_t        lba = cmd->se_cmd.t_task_lba;
+        uint8_t scsi_status, sense_key, asc, ascq;
+        unsigned long flags;
 
-        a_guard   = be16_to_cpu(*(uint16_t *)(ap + 0));
-        a_app_tag = be16_to_cpu(*(uint16_t *)(ap + 2));
-        a_ref_tag = be32_to_cpu(*(uint32_t *)(ap + 4));
-
-        e_guard   = be16_to_cpu(*(uint16_t *)(ep + 0));
-        e_app_tag = be16_to_cpu(*(uint16_t *)(ep + 2));
-        e_ref_tag = be32_to_cpu(*(uint32_t *)(ep + 4));
-
-        ql_dbg(ql_dbg_tgt, vha, 0xe075,
-            "iocb(s) %p Returned STATUS.\n", sts);
-
-        ql_dbg(ql_dbg_tgt, vha, 0xf075,
-            "dif check TGT cdb 0x%x lba 0x%llx: [Actual|Expected] Ref Tag[0x%x|0x%x], App Tag [0x%x|0x%x], Guard [0x%x|0x%x]\n",
-            cmd->atio.u.isp24.fcp_cmnd.cdb[0], lba,
-            a_ref_tag, e_ref_tag, a_app_tag, e_app_tag, a_guard, e_guard);
-
-        /*
-         * Ignore sector if:
-         * For type     3: ref & app tag is all 'f's
-         * For type 0,1,2: app tag is all 'f's
-         */
-        if ((a_app_tag == 0xffff) &&
-            ((cmd->se_cmd.prot_type != TARGET_DIF_TYPE3_PROT) ||
-             (a_ref_tag == 0xffffffff))) {
-                uint32_t blocks_done;
-
-                /* 2TB boundary case covered automatically with this */
-                blocks_done = e_ref_tag - (uint32_t)lba + 1;
-                cmd->se_cmd.bad_sector = e_ref_tag;
-                cmd->se_cmd.pi_err = 0;
-                ql_dbg(ql_dbg_tgt, vha, 0xf074,
-                        "need to return scsi good\n");
-
-                /* Update protection tag */
-                if (cmd->prot_sg_cnt) {
-                        uint32_t i, k = 0, num_ent;
-                        struct scatterlist *sg, *sgl;
-
-
-                        sgl = cmd->prot_sg;
-
-                        /* Patch the corresponding protection tags */
-                        for_each_sg(sgl, sg, cmd->prot_sg_cnt, i) {
-                                num_ent = sg_dma_len(sg) / 8;
-                                if (k + num_ent < blocks_done) {
-                                        k += num_ent;
-                                        continue;
-                                }
-                                k = blocks_done;
-                                break;
-                        }
+        cmd->trc_flags |= TRC_DIF_ERR;
 
-                        if (k != blocks_done) {
-                                ql_log(ql_log_warn, vha, 0xf076,
-                                    "unexpected tag values tag:lba=%u:%llu)\n",
-                                    e_ref_tag, (unsigned long long)lba);
-                                goto out;
-                        }
+        cmd->a_guard   = be16_to_cpu(*(uint16_t *)(ap + 0));
+        cmd->a_app_tag = be16_to_cpu(*(uint16_t *)(ap + 2));
+        cmd->a_ref_tag = be32_to_cpu(*(uint32_t *)(ap + 4));
 
-#if 0
-                        struct sd_dif_tuple *spt;
-                        /* TODO:
-                         * This section came from initiator. Is it valid here?
-                         * should ulp be override with actual val???
-                         */
-                        spt = page_address(sg_page(sg)) + sg->offset;
-                        spt += j;
+        cmd->e_guard   = be16_to_cpu(*(uint16_t *)(ep + 0));
+        cmd->e_app_tag = be16_to_cpu(*(uint16_t *)(ep + 2));
+        cmd->e_ref_tag = be32_to_cpu(*(uint32_t *)(ep + 4));
 
-                        spt->app_tag = 0xffff;
-                        if (cmd->se_cmd.prot_type == SCSI_PROT_DIF_TYPE3)
-                                spt->ref_tag = 0xffffffff;
-#endif
-                }
+        ql_dbg(ql_dbg_tgt_dif, vha, 0xf075,
+            "%s: aborted %d state %d\n", __func__, cmd->aborted, cmd->state);
 
-                return 0;
-        }
+        scsi_status = sense_key = asc = ascq = 0;
 
-        /* check guard */
-        if (e_guard != a_guard) {
-                cmd->se_cmd.pi_err = TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED;
-                cmd->se_cmd.bad_sector = cmd->se_cmd.t_task_lba;
-
-                ql_log(ql_log_warn, vha, 0xe076,
-                    "Guard ERR: cdb 0x%x lba 0x%llx: [Actual|Expected] Ref Tag[0x%x|0x%x], App Tag [0x%x|0x%x], Guard [0x%x|0x%x] cmd=%p\n",
-                    cmd->atio.u.isp24.fcp_cmnd.cdb[0], lba,
-                    a_ref_tag, e_ref_tag, a_app_tag, e_app_tag,
-                    a_guard, e_guard, cmd);
-                goto out;
+        /* check appl tag */
+        if (cmd->e_app_tag != cmd->a_app_tag) {
+                ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                        "App Tag ERR: cdb[%x] lba[%llx %llx] blks[%x] [Actual|Expected] "
+                        "Ref[%x|%x], App[%x|%x], "
+                        "Guard [%x|%x] cmd=%p ox_id[%04x]",
+                        cmd->cdb[0], lba, (lba+cmd->num_blks), cmd->num_blks,
+                        cmd->a_ref_tag, cmd->e_ref_tag,
+                        cmd->a_app_tag, cmd->e_app_tag,
+                        cmd->a_guard, cmd->e_guard,
+                        cmd, cmd->atio.u.isp24.fcp_hdr.ox_id);
+
+                cmd->dif_err_code = DIF_ERR_APP;
+                scsi_status = SAM_STAT_CHECK_CONDITION;
+                sense_key = ABORTED_COMMAND;
+                asc = 0x10;
+                ascq = 0x2;
         }
 
         /* check ref tag */
-        if (e_ref_tag != a_ref_tag) {
-                cmd->se_cmd.pi_err = TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED;
-                cmd->se_cmd.bad_sector = e_ref_tag;
-
-                ql_log(ql_log_warn, vha, 0xe077,
-                        "Ref Tag ERR: cdb 0x%x lba 0x%llx: [Actual|Expected] Ref Tag[0x%x|0x%x], App Tag [0x%x|0x%x], Guard [0x%x|0x%x] cmd=%p\n",
-                        cmd->atio.u.isp24.fcp_cmnd.cdb[0], lba,
-                        a_ref_tag, e_ref_tag, a_app_tag, e_app_tag,
-                        a_guard, e_guard, cmd);
+        if (cmd->e_ref_tag != cmd->a_ref_tag) {
+                ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                        "Ref Tag ERR: cdb[%x] lba[%llx %llx] blks[%x] [Actual|Expected] "
+                        "Ref[%x|%x], App[%x|%x], "
+                        "Guard[%x|%x] cmd=%p ox_id[%04x] ",
+                        cmd->cdb[0], lba, (lba+cmd->num_blks), cmd->num_blks,
+                        cmd->a_ref_tag, cmd->e_ref_tag,
+                        cmd->a_app_tag, cmd->e_app_tag,
+                        cmd->a_guard, cmd->e_guard,
+                        cmd, cmd->atio.u.isp24.fcp_hdr.ox_id);
+
+                cmd->dif_err_code = DIF_ERR_REF;
+                scsi_status = SAM_STAT_CHECK_CONDITION;
+                sense_key = ABORTED_COMMAND;
+                asc = 0x10;
+                ascq = 0x3;
                 goto out;
         }
 
-        /* check appl tag */
-        if (e_app_tag != a_app_tag) {
-                cmd->se_cmd.pi_err = TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED;
-                cmd->se_cmd.bad_sector = cmd->se_cmd.t_task_lba;
-
-                ql_log(ql_log_warn, vha, 0xe078,
-                        "App Tag ERR: cdb 0x%x lba 0x%llx: [Actual|Expected] Ref Tag[0x%x|0x%x], App Tag [0x%x|0x%x], Guard [0x%x|0x%x] cmd=%p\n",
-                        cmd->atio.u.isp24.fcp_cmnd.cdb[0], lba,
-                        a_ref_tag, e_ref_tag, a_app_tag, e_app_tag,
-                        a_guard, e_guard, cmd);
-                goto out;
+        /* check guard */
+        if (cmd->e_guard != cmd->a_guard) {
+                ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                        "Guard ERR: cdb[%x] lba[%llx %llx] blks[%x] [Actual|Expected] "
+                        "Ref[%x|%x], App[%x|%x], "
+                        "Guard [%x|%x] cmd=%p ox_id[%04x]",
+                        cmd->cdb[0], lba, (lba+cmd->num_blks), cmd->num_blks,
+                        cmd->a_ref_tag, cmd->e_ref_tag,
+                        cmd->a_app_tag, cmd->e_app_tag,
+                        cmd->a_guard, cmd->e_guard,
+                        cmd, cmd->atio.u.isp24.fcp_hdr.ox_id);
+                cmd->dif_err_code = DIF_ERR_GRD;
+                scsi_status = SAM_STAT_CHECK_CONDITION;
+                sense_key = ABORTED_COMMAND;
+                asc = 0x10;
+                ascq = 0x1;
         }
 out:
-        return 1;
-}
+        switch (cmd->state) {
+        case QLA_TGT_STATE_NEED_DATA:
+                /* handle_data will load DIF error code  */
+                cmd->state = QLA_TGT_STATE_DATA_IN;
+                vha->hw->tgt.tgt_ops->handle_data(cmd);
+                break;
+        default:
+                spin_lock_irqsave(&cmd->cmd_lock, flags);
+                if (cmd->aborted) {
+                        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+                        vha->hw->tgt.tgt_ops->free_cmd(cmd);
+                        break;
+                }
+                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
 
+                qlt_send_resp_ctio(vha, cmd, scsi_status, sense_key, asc, ascq);
+                /* assume scsi status gets out on the wire.
+                 * Will not wait for completion.
+                 */
+                vha->hw->tgt.tgt_ops->free_cmd(cmd);
+                break;
+        }
+}
 
 /* If hardware_lock held on entry, might drop it, then reaquire */
 /* This function sends the appropriate CTIO to ISP 2xxx or 24xx */
@@ -3251,7 +3376,7 @@ static int __qlt_send_term_imm_notif(struct scsi_qla_host *vha,
         ql_dbg(ql_dbg_tgt_tmr, vha, 0xe01c,
             "Sending TERM ELS CTIO (ha=%p)\n", ha);
 
-        pkt = (request_t *)qla2x00_alloc_iocbs_ready(vha, NULL);
+        pkt = (request_t *)qla2x00_alloc_iocbs(vha, NULL);
         if (pkt == NULL) {
                 ql_dbg(ql_dbg_tgt, vha, 0xe080,
                     "qla_target(%d): %s failed: unable to allocate "
@@ -3543,6 +3668,16 @@ static int qlt_term_ctio_exchange(struct scsi_qla_host *vha, void *ctio,
 {
         int term = 0;
 
+        if (cmd->se_cmd.prot_op)
+                ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                    "Term DIF cmd: lba[0x%llx|%lld] len[0x%x] "
+                    "se_cmd=%p tag[%x] op %#x/%s",
+                     cmd->lba, cmd->lba,
+                     cmd->num_blks, &cmd->se_cmd,
+                     cmd->atio.u.isp24.exchange_addr,
+                     cmd->se_cmd.prot_op,
+                     prot_op_str(cmd->se_cmd.prot_op));
+
         if (ctio != NULL) {
                 struct ctio7_from_24xx *c = (struct ctio7_from_24xx *)ctio;
                 term = !(c->flags &
@@ -3760,32 +3895,15 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle,
                         struct ctio_crc_from_fw *crc =
                                 (struct ctio_crc_from_fw *)ctio;
                         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf073,
-                            "qla_target(%d): CTIO with DIF_ERROR status %x received (state %x, se_cmd %p) actual_dif[0x%llx] expect_dif[0x%llx]\n",
+                            "qla_target(%d): CTIO with DIF_ERROR status %x "
+                            "received (state %x, ulp_cmd %p) actual_dif[0x%llx] "
+                            "expect_dif[0x%llx]\n",
                             vha->vp_idx, status, cmd->state, se_cmd,
                             *((u64 *)&crc->actual_dif[0]),
                             *((u64 *)&crc->expected_dif[0]));
 
-                        if (qlt_handle_dif_error(vha, cmd, ctio)) {
-                                if (cmd->state == QLA_TGT_STATE_NEED_DATA) {
-                                        /* scsi Write/xfer rdy complete */
-                                        goto skip_term;
-                                } else {
-                                        /* scsi read/xmit respond complete
-                                         * call handle dif to send scsi status
-                                         * rather than terminate exchange.
-                                         */
-                                        cmd->state = QLA_TGT_STATE_PROCESSED;
-                                        ha->tgt.tgt_ops->handle_dif_err(cmd);
-                                        return;
-                                }
-                        } else {
-                                /* Need to generate a SCSI good completion.
-                                 * because FW did not send scsi status.
-                                 */
-                                status = 0;
-                                goto skip_term;
-                        }
-                        break;
+                        qlt_handle_dif_error(vha, cmd, ctio);
+                        return;
                 }
                 default:
                         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf05b,
@@ -3808,7 +3926,6 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle,
                                 return;
                 }
         }
-skip_term:
 
         if (cmd->state == QLA_TGT_STATE_PROCESSED) {
                 cmd->trc_flags |= TRC_CTIO_DONE;
@@ -4584,7 +4701,8 @@ static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
                 }
 
                 if (sess != NULL) {
-                        if (sess->fw_login_state == DSC_LS_PLOGI_PEND) {
+                        if (sess->fw_login_state != DSC_LS_PLOGI_PEND &&
+                            sess->fw_login_state != DSC_LS_PLOGI_COMP) {
                                 /*
                                  * Impatient initiator sent PRLI before last
                                  * PLOGI could finish. Will force him to re-try,
@@ -4623,15 +4741,23 @@ static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
 
                 /* Make session global (not used in fabric mode) */
                 if (ha->current_topology != ISP_CFG_F) {
-                        set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
-                        set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
-                        qla2xxx_wake_dpc(vha);
+                        if (sess) {
+                                ql_dbg(ql_dbg_disc, vha, 0xffff,
+                                    "%s %d %8phC post nack\n",
+                                    __func__, __LINE__, sess->port_name);
+                                qla24xx_post_nack_work(vha, sess, iocb,
+                                        SRB_NACK_PRLI);
+                                res = 0;
+                        } else {
+                                set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+                                set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
+                                qla2xxx_wake_dpc(vha);
+                        }
                 } else {
                         if (sess) {
                                 ql_dbg(ql_dbg_disc, vha, 0xffff,
-                                           "%s %d %8phC post nack\n",
-                                           __func__, __LINE__, sess->port_name);
-
+                                    "%s %d %8phC post nack\n",
+                                    __func__, __LINE__, sess->port_name);
                                 qla24xx_post_nack_work(vha, sess, iocb,
                                         SRB_NACK_PRLI);
                                 res = 0;
@@ -4639,7 +4765,6 @@ static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
                 }
                 break;
 
-
         case ELS_TPRLO:
                 if (le16_to_cpu(iocb->u.isp24.flags) &
                         NOTIFY24XX_FLAGS_GLOBAL_TPRLO) {
@@ -5079,16 +5204,22 @@ qlt_send_busy(struct scsi_qla_host *vha,
 
 static int
 qlt_chk_qfull_thresh_hold(struct scsi_qla_host *vha,
-        struct atio_from_isp *atio)
+        struct atio_from_isp *atio, bool ha_locked)
 {
         struct qla_hw_data *ha = vha->hw;
         uint16_t status;
+        unsigned long flags;
 
         if (ha->tgt.num_pend_cmds < Q_FULL_THRESH_HOLD(ha))
                 return 0;
 
+        if (!ha_locked)
+                spin_lock_irqsave(&ha->hardware_lock, flags);
         status = temp_sam_status;
         qlt_send_busy(vha, atio, status);
+        if (!ha_locked)
+                spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
         return 1;
 }
 
@@ -5103,7 +5234,7 @@ static void qlt_24xx_atio_pkt(struct scsi_qla_host *vha,
         unsigned long flags;
 
         if (unlikely(tgt == NULL)) {
-                ql_dbg(ql_dbg_io, vha, 0x3064,
+                ql_dbg(ql_dbg_tgt, vha, 0x3064,
                     "ATIO pkt, but no tgt (ha %p)", ha);
                 return;
         }
@@ -5133,7 +5264,7 @@ static void qlt_24xx_atio_pkt(struct scsi_qla_host *vha,
 
 
                 if (likely(atio->u.isp24.fcp_cmnd.task_mgmt_flags == 0)) {
-                        rc = qlt_chk_qfull_thresh_hold(vha, atio);
+                        rc = qlt_chk_qfull_thresh_hold(vha, atio, ha_locked);
                         if (rc != 0) {
                                 tgt->atio_irq_cmd_count--;
                                 return;
@@ -5256,7 +5387,7 @@ static void qlt_response_pkt(struct scsi_qla_host *vha, response_t *pkt)
                         break;
                 }
 
-                rc = qlt_chk_qfull_thresh_hold(vha, atio);
+                rc = qlt_chk_qfull_thresh_hold(vha, atio, true);
                 if (rc != 0) {
                         tgt->irq_cmd_count--;
                         return;
@@ -5531,7 +5662,7 @@ static fc_port_t *qlt_get_port_database(struct scsi_qla_host *vha,
 
         fcport->loop_id = loop_id;
 
-        rc = qla2x00_get_port_database(vha, fcport, 0);
+        rc = qla24xx_gpdb_wait(vha, fcport, 0);
         if (rc != QLA_SUCCESS) {
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf070,
                     "qla_target(%d): Failed to retrieve fcport "
@@ -5713,30 +5844,23 @@ static void qlt_abort_work(struct qla_tgt *tgt,
                 }
         }
 
-        spin_lock_irqsave(&ha->hardware_lock, flags);
-
-        if (tgt->tgt_stop)
-                goto out_term;
-
         rc = __qlt_24xx_handle_abts(vha, &prm->abts, sess);
+        ha->tgt.tgt_ops->put_sess(sess);
+        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
+
         if (rc != 0)
                 goto out_term;
-        spin_unlock_irqrestore(&ha->hardware_lock, flags);
-        if (sess)
-                ha->tgt.tgt_ops->put_sess(sess);
-        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
         return;
 
 out_term2:
-        spin_lock_irqsave(&ha->hardware_lock, flags);
+        if (sess)
+                ha->tgt.tgt_ops->put_sess(sess);
+        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
 
 out_term:
+        spin_lock_irqsave(&ha->hardware_lock, flags);
         qlt_24xx_send_abts_resp(vha, &prm->abts, FCP_TMF_REJECTED, false);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
-
-        if (sess)
-                ha->tgt.tgt_ops->put_sess(sess);
-        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
 }
 
 static void qlt_tmr_work(struct qla_tgt *tgt,
@@ -5756,7 +5880,7 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
         spin_lock_irqsave(&ha->tgt.sess_lock, flags);
 
         if (tgt->tgt_stop)
-                goto out_term;
+                goto out_term2;
 
         s_id = prm->tm_iocb2.u.isp24.fcp_hdr.s_id;
         sess = ha->tgt.tgt_ops->find_sess_by_s_id(vha, s_id);
@@ -5768,11 +5892,11 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
 
                 spin_lock_irqsave(&ha->tgt.sess_lock, flags);
                 if (!sess)
-                        goto out_term;
+                        goto out_term2;
         } else {
                 if (sess->deleted) {
                         sess = NULL;
-                        goto out_term;
+                        goto out_term2;
                 }
 
                 if (!kref_get_unless_zero(&sess->sess_kref)) {
@@ -5780,7 +5904,7 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
                             "%s: kref_get fail %8phC\n",
                              __func__, sess->port_name);
                         sess = NULL;
-                        goto out_term;
+                        goto out_term2;
                 }
         }
 
@@ -5790,17 +5914,19 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
         unpacked_lun = scsilun_to_int((struct scsi_lun *)&lun);
 
         rc = qlt_issue_task_mgmt(sess, unpacked_lun, fn, iocb, 0);
-        if (rc != 0)
-                goto out_term;
-
         ha->tgt.tgt_ops->put_sess(sess);
         spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
+
+        if (rc != 0)
+                goto out_term;
         return;
 
+out_term2:
+        if (sess)
+                ha->tgt.tgt_ops->put_sess(sess);
+        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
 out_term:
         qlt_send_term_exchange(vha, NULL, &prm->tm_iocb2, 1, 0);
-        ha->tgt.tgt_ops->put_sess(sess);
-        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
 }
 
 static void qlt_sess_work_fn(struct work_struct *work)
@@ -5893,13 +6019,13 @@ int qlt_add_target(struct qla_hw_data *ha, struct scsi_qla_host *base_vha)
         tgt->datasegs_per_cmd = QLA_TGT_DATASEGS_PER_CMD_24XX;
         tgt->datasegs_per_cont = QLA_TGT_DATASEGS_PER_CONT_24XX;
 
-        if (base_vha->fc_vport)
-                return 0;
-
         mutex_lock(&qla_tgt_mutex);
         list_add_tail(&tgt->tgt_list_entry, &qla_tgt_glist);
         mutex_unlock(&qla_tgt_mutex);
 
+        if (ha->tgt.tgt_ops && ha->tgt.tgt_ops->add_target)
+                ha->tgt.tgt_ops->add_target(base_vha);
+
         return 0;
 }
 
@@ -5928,6 +6054,17 @@ int qlt_remove_target(struct qla_hw_data *ha, struct scsi_qla_host *vha)
         return 0;
 }
 
+void qlt_remove_target_resources(struct qla_hw_data *ha)
+{
+        struct scsi_qla_host *node;
+        u32 key = 0;
+
+        btree_for_each_safe32(&ha->tgt.host_map, key, node)
+                btree_remove32(&ha->tgt.host_map, key);
+
+        btree_destroy32(&ha->tgt.host_map);
+}
+
 static void qlt_lport_dump(struct scsi_qla_host *vha, u64 wwpn,
         unsigned char *b)
 {
@@ -6234,7 +6371,7 @@ qlt_24xx_process_atio_queue(struct scsi_qla_host *vha, uint8_t ha_locked)
         struct atio_from_isp *pkt;
         int cnt, i;
 
-        if (!vha->flags.online)
+        if (!ha->flags.fw_started)
                 return;
 
         while ((ha->tgt.atio_ring_ptr->signature != ATIO_PROCESSED) ||
@@ -6581,6 +6718,8 @@ qlt_modify_vp_config(struct scsi_qla_host *vha,
 void
 qlt_probe_one_stage1(struct scsi_qla_host *base_vha, struct qla_hw_data *ha)
 {
+        int rc;
+
         if (!QLA_TGT_MODE_ENABLED())
                 return;
 
@@ -6600,6 +6739,13 @@ qlt_probe_one_stage1(struct scsi_qla_host *base_vha, struct qla_hw_data *ha)
             qlt_unknown_atio_work_fn);
 
         qlt_clear_mode(base_vha);
+
+        rc = btree_init32(&ha->tgt.host_map);
+        if (rc)
+                ql_log(ql_log_info, base_vha, 0xffff,
+                    "Unable to initialize ha->host_map btree\n");
+
+        qlt_update_vp_map(base_vha, SET_VP_IDX);
 }
 
 irqreturn_t
@@ -6642,6 +6788,8 @@ qlt_handle_abts_recv_work(struct work_struct *work)
         spin_lock_irqsave(&ha->hardware_lock, flags);
         qlt_response_pkt_all_vps(vha, (response_t *)&op->atio);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+        kfree(op);
 }
 
 void
@@ -6706,25 +6854,69 @@ qlt_mem_free(struct qla_hw_data *ha)
 void
 qlt_update_vp_map(struct scsi_qla_host *vha, int cmd)
 {
+        void *slot;
+        u32 key;
+        int rc;
+
         if (!QLA_TGT_MODE_ENABLED())
                 return;
 
+        key = vha->d_id.b24;
+
         switch (cmd) {
         case SET_VP_IDX:
                 vha->hw->tgt.tgt_vp_map[vha->vp_idx].vha = vha;
                 break;
         case SET_AL_PA:
-                vha->hw->tgt.tgt_vp_map[vha->d_id.b.al_pa].idx = vha->vp_idx;
+                slot = btree_lookup32(&vha->hw->tgt.host_map, key);
+                if (!slot) {
+                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xffff,
+                            "Save vha in host_map %p %06x\n", vha, key);
+                        rc = btree_insert32(&vha->hw->tgt.host_map,
+                                key, vha, GFP_ATOMIC);
+                        if (rc)
+                                ql_log(ql_log_info, vha, 0xffff,
+                                    "Unable to insert s_id into host_map: %06x\n",
+                                    key);
+                        return;
+                }
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xffff,
+                        "replace existing vha in host_map %p %06x\n", vha, key);
+                btree_update32(&vha->hw->tgt.host_map, key, vha);
                 break;
         case RESET_VP_IDX:
                 vha->hw->tgt.tgt_vp_map[vha->vp_idx].vha = NULL;
                 break;
         case RESET_AL_PA:
-                vha->hw->tgt.tgt_vp_map[vha->d_id.b.al_pa].idx = 0;
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xffff,
+                   "clear vha in host_map %p %06x\n", vha, key);
+                slot = btree_lookup32(&vha->hw->tgt.host_map, key);
+                if (slot)
+                        btree_remove32(&vha->hw->tgt.host_map, key);
+                vha->d_id.b24 = 0;
                 break;
         }
 }
 
+void qlt_update_host_map(struct scsi_qla_host *vha, port_id_t id)
+{
+        unsigned long flags;
+        struct qla_hw_data *ha = vha->hw;
+
+        if (!vha->d_id.b24) {
+                spin_lock_irqsave(&ha->vport_slock, flags);
+                vha->d_id = id;
+                qlt_update_vp_map(vha, SET_AL_PA);
+                spin_unlock_irqrestore(&ha->vport_slock, flags);
+        } else if (vha->d_id.b24 != id.b24) {
+                spin_lock_irqsave(&ha->vport_slock, flags);
+                qlt_update_vp_map(vha, RESET_AL_PA);
+                vha->d_id = id;
+                qlt_update_vp_map(vha, SET_AL_PA);
+                spin_unlock_irqrestore(&ha->vport_slock, flags);
+        }
+}
+
 static int __init qlt_parse_ini_mode(void)
 {
         if (strcasecmp(qlini_mode, QLA2XXX_INI_MODE_STR_EXCLUSIVE) == 0)
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index a7f90dcaae37..d64420251194 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -378,6 +378,14 @@ static inline void adjust_corrupted_atio(struct atio_from_isp *atio)
         atio->u.isp24.fcp_cmnd.add_cdb_len = 0;
 }
 
+static inline int get_datalen_for_atio(struct atio_from_isp *atio)
+{
+        int len = atio->u.isp24.fcp_cmnd.add_cdb_len;
+
+        return (be32_to_cpu(get_unaligned((uint32_t *)
+            &atio->u.isp24.fcp_cmnd.add_cdb[len * 4])));
+}
+
 #define CTIO_TYPE7 0x12 /* Continue target I/O entry (for 24xx) */
 
 /*
@@ -667,7 +675,6 @@ struct qla_tgt_func_tmpl {
         int (*handle_cmd)(struct scsi_qla_host *, struct qla_tgt_cmd *,
                         unsigned char *, uint32_t, int, int, int);
         void (*handle_data)(struct qla_tgt_cmd *);
-        void (*handle_dif_err)(struct qla_tgt_cmd *);
         int (*handle_tmr)(struct qla_tgt_mgmt_cmd *, uint32_t, uint16_t,
                         uint32_t);
         void (*free_cmd)(struct qla_tgt_cmd *);
@@ -684,6 +691,9 @@ struct qla_tgt_func_tmpl {
         void (*clear_nacl_from_fcport_map)(struct fc_port *);
         void (*put_sess)(struct fc_port *);
         void (*shutdown_sess)(struct fc_port *);
+        int (*get_dif_tags)(struct qla_tgt_cmd *cmd, uint16_t *pfw_prot_opts);
+        int (*chk_dif_tags)(uint32_t tag);
+        void (*add_target)(struct scsi_qla_host *);
 };
 
 int qla2x00_wait_for_hba_online(struct scsi_qla_host *);
@@ -720,8 +730,8 @@ int qla2x00_wait_for_hba_online(struct scsi_qla_host *);
 #define QLA_TGT_ABORT_ALL               0xFFFE
 #define QLA_TGT_NEXUS_LOSS_SESS         0xFFFD
 #define QLA_TGT_NEXUS_LOSS              0xFFFC
-#define QLA_TGT_ABTS                                    0xFFFB
-#define QLA_TGT_2G_ABORT_TASK                   0xFFFA
+#define QLA_TGT_ABTS                    0xFFFB
+#define QLA_TGT_2G_ABORT_TASK           0xFFFA
 
 /* Notify Acknowledge flags */
 #define NOTIFY_ACK_RES_COUNT        BIT_8
@@ -845,6 +855,7 @@ enum trace_flags {
         TRC_CMD_FREE = BIT_17,
         TRC_DATA_IN = BIT_18,
         TRC_ABORT = BIT_19,
+        TRC_DIF_ERR = BIT_20,
 };
 
 struct qla_tgt_cmd {
@@ -862,7 +873,6 @@ struct qla_tgt_cmd {
         unsigned int sg_mapped:1;
         unsigned int free_sg:1;
         unsigned int write_data_transferred:1;
-        unsigned int ctx_dsd_alloced:1;
         unsigned int q_full:1;
         unsigned int term_exchg:1;
         unsigned int cmd_sent_to_fw:1;
@@ -885,11 +895,25 @@ struct qla_tgt_cmd {
         struct list_head cmd_list;
 
         struct atio_from_isp atio;
-        /* t10dif */
+
+        uint8_t ctx_dsd_alloced;
+
+        /* T10-DIF */
+#define DIF_ERR_NONE 0
+#define DIF_ERR_GRD 1
+#define DIF_ERR_REF 2
+#define DIF_ERR_APP 3
+        int8_t dif_err_code;
         struct scatterlist *prot_sg;
         uint32_t prot_sg_cnt;
-        uint32_t blk_sz;
+        uint32_t blk_sz, num_blks;
+        uint8_t scsi_status, sense_key, asc, ascq;
+
         struct crc_context *ctx;
+        uint8_t         *cdb;
+        uint64_t        lba;
+        uint16_t        a_guard, e_guard, a_app_tag, e_app_tag;
+        uint32_t        a_ref_tag, e_ref_tag;
 
         uint64_t jiffies_at_alloc;
         uint64_t jiffies_at_free;
@@ -1053,4 +1077,7 @@ extern int qlt_free_qfull_cmds(struct scsi_qla_host *);
 extern void qlt_logo_completion_handler(fc_port_t *, int);
 extern void qlt_do_generation_tick(struct scsi_qla_host *, int *);
 
+void qlt_send_resp_ctio(scsi_qla_host_t *, struct qla_tgt_cmd *, uint8_t,
+    uint8_t, uint8_t, uint8_t);
+
 #endif /* __QLA_TARGET_H */
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 3cb1964b7786..45bc84e8e3bf 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,9 +7,9 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "8.07.00.38-k"
+#define QLA2XXX_VERSION      "9.00.00.00-k"
 
-#define QLA_DRIVER_MAJOR_VER    8
-#define QLA_DRIVER_MINOR_VER    7
+#define QLA_DRIVER_MAJOR_VER    9
+#define QLA_DRIVER_MINOR_VER    0
 #define QLA_DRIVER_PATCH_VER    0
 #define QLA_DRIVER_BETA_VER     0
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 8e8ab0fa9672..7443e4efa3ae 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -531,6 +531,24 @@ static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
                         return;
                 }
 
+                switch (cmd->dif_err_code) {
+                case DIF_ERR_GRD:
+                        cmd->se_cmd.pi_err =
+                            TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED;
+                        break;
+                case DIF_ERR_REF:
+                        cmd->se_cmd.pi_err =
+                            TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED;
+                        break;
+                case DIF_ERR_APP:
+                        cmd->se_cmd.pi_err =
+                            TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED;
+                        break;
+                case DIF_ERR_NONE:
+                default:
+                        break;
+                }
+
                 if (cmd->se_cmd.pi_err)
                         transport_generic_request_failure(&cmd->se_cmd,
                                 cmd->se_cmd.pi_err);
@@ -555,25 +573,23 @@ static void tcm_qla2xxx_handle_data(struct qla_tgt_cmd *cmd)
         queue_work_on(smp_processor_id(), tcm_qla2xxx_free_wq, &cmd->work);
 }
 
-static void tcm_qla2xxx_handle_dif_work(struct work_struct *work)
+static int tcm_qla2xxx_chk_dif_tags(uint32_t tag)
 {
-        struct qla_tgt_cmd *cmd = container_of(work, struct qla_tgt_cmd, work);
-
-        /* take an extra kref to prevent cmd free too early.
-         * need to wait for SCSI status/check condition to
-         * finish responding generate by transport_generic_request_failure.
-         */
-        kref_get(&cmd->se_cmd.cmd_kref);
-        transport_generic_request_failure(&cmd->se_cmd, cmd->se_cmd.pi_err);
+        return 0;
 }
 
-/*
- * Called from qla_target.c:qlt_do_ctio_completion()
- */
-static void tcm_qla2xxx_handle_dif_err(struct qla_tgt_cmd *cmd)
+static int tcm_qla2xxx_dif_tags(struct qla_tgt_cmd *cmd,
+    uint16_t *pfw_prot_opts)
 {
-        INIT_WORK(&cmd->work, tcm_qla2xxx_handle_dif_work);
-        queue_work(tcm_qla2xxx_free_wq, &cmd->work);
+        struct se_cmd *se_cmd = &cmd->se_cmd;
+
+        if (!(se_cmd->prot_checks & TARGET_DIF_CHECK_GUARD))
+                *pfw_prot_opts |= PO_DISABLE_GUARD_CHECK;
+
+        if (!(se_cmd->prot_checks & TARGET_DIF_CHECK_APPTAG))
+                *pfw_prot_opts |= PO_DIS_APP_TAG_VALD;
+
+        return 0;
 }
 
 /*
@@ -1610,7 +1626,6 @@ static void tcm_qla2xxx_update_sess(struct fc_port *sess, port_id_t s_id,
 static struct qla_tgt_func_tmpl tcm_qla2xxx_template = {
         .handle_cmd             = tcm_qla2xxx_handle_cmd,
         .handle_data            = tcm_qla2xxx_handle_data,
-        .handle_dif_err         = tcm_qla2xxx_handle_dif_err,
         .handle_tmr             = tcm_qla2xxx_handle_tmr,
         .free_cmd               = tcm_qla2xxx_free_cmd,
         .free_mcmd              = tcm_qla2xxx_free_mcmd,
@@ -1622,6 +1637,8 @@ static struct qla_tgt_func_tmpl tcm_qla2xxx_template = {
         .clear_nacl_from_fcport_map = tcm_qla2xxx_clear_nacl_from_fcport_map,
         .put_sess               = tcm_qla2xxx_put_sess,
         .shutdown_sess          = tcm_qla2xxx_shutdown_sess,
+        .get_dif_tags           = tcm_qla2xxx_dif_tags,
+        .chk_dif_tags           = tcm_qla2xxx_chk_dif_tags,
 };
 
 static int tcm_qla2xxx_init_lport(struct tcm_qla2xxx_lport *lport)
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ba2286652ff6..19125d72f322 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -2932,6 +2932,8 @@ EXPORT_SYMBOL(scsi_target_resume);
 /**
  * scsi_internal_device_block - internal function to put a device temporarily into the SDEV_BLOCK state
  * @sdev:       device to block
+ * @wait:       Whether or not to wait until ongoing .queuecommand() /
+ *              .queue_rq() calls have finished.
  *
  * Block request made by scsi lld's to temporarily stop all
  * scsi commands on the specified device. May sleep.
@@ -2949,7 +2951,7 @@ EXPORT_SYMBOL(scsi_target_resume);
  * remove the rport mutex lock and unlock calls from srp_queuecommand().
  */
 int
-scsi_internal_device_block(struct scsi_device *sdev)
+scsi_internal_device_block(struct scsi_device *sdev, bool wait)
 {
         struct request_queue *q = sdev->request_queue;
         unsigned long flags;
@@ -2969,12 +2971,16 @@ scsi_internal_device_block(struct scsi_device *sdev)
          * request queue. 
          */
         if (q->mq_ops) {
-                blk_mq_quiesce_queue(q);
+                if (wait)
+                        blk_mq_quiesce_queue(q);
+                else
+                        blk_mq_stop_hw_queues(q);
         } else {
                 spin_lock_irqsave(q->queue_lock, flags);
                 blk_stop_queue(q);
                 spin_unlock_irqrestore(q->queue_lock, flags);
-                scsi_wait_for_queuecommand(sdev);
+                if (wait)
+                        scsi_wait_for_queuecommand(sdev);
         }
 
         return 0;
@@ -3036,7 +3042,7 @@ EXPORT_SYMBOL_GPL(scsi_internal_device_unblock);
 static void
 device_block(struct scsi_device *sdev, void *data)
 {
-        scsi_internal_device_block(sdev);
+        scsi_internal_device_block(sdev, true);
 }
 
 static int
diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
index 99bfc985e190..f11bd102d6d5 100644
--- a/drivers/scsi/scsi_priv.h
+++ b/drivers/scsi/scsi_priv.h
@@ -188,8 +188,5 @@ static inline void scsi_dh_remove_device(struct scsi_device *sdev) { }
  */
 
 #define SCSI_DEVICE_BLOCK_MAX_TIMEOUT   600     /* units in seconds */
-extern int scsi_internal_device_block(struct scsi_device *sdev);
-extern int scsi_internal_device_unblock(struct scsi_device *sdev,
-                                        enum scsi_device_state new_state);
 
 #endif /* _SCSI_PRIV_H */
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index c7839f6c35cc..fcfeddc79331 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1783,6 +1783,8 @@ static int sd_done(struct scsi_cmnd *SCpnt)
 {
         int result = SCpnt->result;
         unsigned int good_bytes = result ? 0 : scsi_bufflen(SCpnt);
+        unsigned int sector_size = SCpnt->device->sector_size;
+        unsigned int resid;
         struct scsi_sense_hdr sshdr;
         struct scsi_disk *sdkp = scsi_disk(SCpnt->request->rq_disk);
         struct request *req = SCpnt->request;
@@ -1813,6 +1815,21 @@ static int sd_done(struct scsi_cmnd *SCpnt)
                         scsi_set_resid(SCpnt, blk_rq_bytes(req));
                 }
                 break;
+        default:
+                /*
+                 * In case of bogus fw or device, we could end up having
+                 * an unaligned partial completion. Check this here and force
+                 * alignment.
+                 */
+                resid = scsi_get_resid(SCpnt);
+                if (resid & (sector_size - 1)) {
+                        sd_printk(KERN_INFO, sdkp,
+                                "Unaligned partial completion (resid=%u, sector_sz=%u)\n",
+                                resid, sector_size);
+                        resid = min(scsi_bufflen(SCpnt),
+                                    round_up(resid, sector_size));
+                        scsi_set_resid(SCpnt, resid);
+                }
         }
 
         if (result) {
@@ -3075,23 +3092,6 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
         put_device(&sdkp->dev);
 }
 
-struct sd_devt {
-        int idx;
-        struct disk_devt disk_devt;
-};
-
-static void sd_devt_release(struct disk_devt *disk_devt)
-{
-        struct sd_devt *sd_devt = container_of(disk_devt, struct sd_devt,
-                        disk_devt);
-
-        spin_lock(&sd_index_lock);
-        ida_remove(&sd_index_ida, sd_devt->idx);
-        spin_unlock(&sd_index_lock);
-
-        kfree(sd_devt);
-}
-
 /**
  *      sd_probe - called during driver initialization and whenever a
  *      new scsi device is attached to the system. It is called once
@@ -3113,7 +3113,6 @@ static void sd_devt_release(struct disk_devt *disk_devt)
 static int sd_probe(struct device *dev)
 {
         struct scsi_device *sdp = to_scsi_device(dev);
-        struct sd_devt *sd_devt;
         struct scsi_disk *sdkp;
         struct gendisk *gd;
         int index;
@@ -3139,13 +3138,9 @@ static int sd_probe(struct device *dev)
         if (!sdkp)
                 goto out;
 
-        sd_devt = kzalloc(sizeof(*sd_devt), GFP_KERNEL);
-        if (!sd_devt)
-                goto out_free;
-
         gd = alloc_disk(SD_MINORS);
         if (!gd)
-                goto out_free_devt;
+                goto out_free;
 
         do {
                 if (!ida_pre_get(&sd_index_ida, GFP_KERNEL))
@@ -3161,11 +3156,6 @@ static int sd_probe(struct device *dev)
                 goto out_put;
         }
 
-        atomic_set(&sd_devt->disk_devt.count, 1);
-        sd_devt->disk_devt.release = sd_devt_release;
-        sd_devt->idx = index;
-        gd->disk_devt = &sd_devt->disk_devt;
-
         error = sd_format_disk_name("sd", index, gd->disk_name, DISK_NAME_LEN);
         if (error) {
                 sdev_printk(KERN_WARNING, sdp, "SCSI disk (sd) name length exceeded.\n");
@@ -3205,12 +3195,11 @@ static int sd_probe(struct device *dev)
         return 0;
 
  out_free_index:
-        put_disk_devt(&sd_devt->disk_devt);
-        sd_devt = NULL;
+        spin_lock(&sd_index_lock);
+        ida_remove(&sd_index_ida, index);
+        spin_unlock(&sd_index_lock);
  out_put:
         put_disk(gd);
- out_free_devt:
-        kfree(sd_devt);
  out_free:
         kfree(sdkp);
  out:
@@ -3271,7 +3260,10 @@ static void scsi_disk_release(struct device *dev)
         struct scsi_disk *sdkp = to_scsi_disk(dev);
         struct gendisk *disk = sdkp->disk;
         
-        put_disk_devt(disk->disk_devt);
+        spin_lock(&sd_index_lock);
+        ida_remove(&sd_index_ida, sdkp->index);
+        spin_unlock(&sd_index_lock);
+
         disk->private_data = NULL;
         put_disk(disk);
         put_device(&sdkp->device->sdev_gendev);
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 29b86505f796..225abaad4d1c 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -996,6 +996,8 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
                 result = get_user(val, ip);
                 if (result)
                         return result;
+                if (val > SG_MAX_CDB_SIZE)
+                        return -ENOMEM;
                 sfp->next_cmd_len = (val > 0) ? val : 0;
                 return 0;
         case SG_GET_VERSION_NUM:
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 638e5f427c90..016639d7fef1 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -400,8 +400,6 @@ MODULE_PARM_DESC(storvsc_vcpus_per_sub_channel, "Ratio of VCPUs to subchannels")
  */
 static int storvsc_timeout = 180;
 
-static int msft_blist_flags = BLIST_TRY_VPD_PAGES;
-
 #if IS_ENABLED(CONFIG_SCSI_FC_ATTRS)
 static struct scsi_transport_template *fc_transport_template;
 #endif
@@ -1383,6 +1381,22 @@ static int storvsc_do_io(struct hv_device *device,
         return ret;
 }
 
+static int storvsc_device_alloc(struct scsi_device *sdevice)
+{
+        /*
+         * Set blist flag to permit the reading of the VPD pages even when
+         * the target may claim SPC-2 compliance. MSFT targets currently
+         * claim SPC-2 compliance while they implement post SPC-2 features.
+         * With this flag we can correctly handle WRITE_SAME_16 issues.
+         *
+         * Hypervisor reports SCSI_UNKNOWN type for DVD ROM device but
+         * still supports REPORT LUN.
+         */
+        sdevice->sdev_bflags = BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES;
+
+        return 0;
+}
+
 static int storvsc_device_configure(struct scsi_device *sdevice)
 {
 
@@ -1396,14 +1410,6 @@ static int storvsc_device_configure(struct scsi_device *sdevice)
         sdevice->no_write_same = 1;
 
         /*
-         * Add blist flags to permit the reading of the VPD pages even when
-         * the target may claim SPC-2 compliance. MSFT targets currently
-         * claim SPC-2 compliance while they implement post SPC-2 features.
-         * With this patch we can correctly handle WRITE_SAME_16 issues.
-         */
-        sdevice->sdev_bflags |= msft_blist_flags;
-
-        /*
          * If the host is WIN8 or WIN8 R2, claim conformance to SPC-3
          * if the device is a MSFT virtual device.  If the host is
          * WIN10 or newer, allow write_same.
@@ -1661,6 +1667,7 @@ static struct scsi_host_template scsi_driver = {
         .eh_host_reset_handler =        storvsc_host_reset_handler,
         .proc_name =            "storvsc_host",
         .eh_timed_out =         storvsc_eh_timed_out,
+        .slave_alloc =          storvsc_device_alloc,
         .slave_configure =      storvsc_device_configure,
         .cmd_per_lun =          255,
         .this_id =              -1,
diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h
index 318e4a1f76c9..54deeb754db5 100644
--- a/drivers/scsi/ufs/ufs.h
+++ b/drivers/scsi/ufs/ufs.h
@@ -146,7 +146,7 @@ enum attr_idn {
 /* Descriptor idn for Query requests */
 enum desc_idn {
         QUERY_DESC_IDN_DEVICE           = 0x0,
-        QUERY_DESC_IDN_CONFIGURAION     = 0x1,
+        QUERY_DESC_IDN_CONFIGURATION    = 0x1,
         QUERY_DESC_IDN_UNIT             = 0x2,
         QUERY_DESC_IDN_RFU_0            = 0x3,
         QUERY_DESC_IDN_INTERCONNECT     = 0x4,
@@ -162,19 +162,13 @@ enum desc_header_offset {
         QUERY_DESC_DESC_TYPE_OFFSET     = 0x01,
 };
 
-enum ufs_desc_max_size {
-        QUERY_DESC_DEVICE_MAX_SIZE              = 0x40,
-        QUERY_DESC_CONFIGURAION_MAX_SIZE        = 0x90,
-        QUERY_DESC_UNIT_MAX_SIZE                = 0x23,
-        QUERY_DESC_INTERCONNECT_MAX_SIZE        = 0x06,
-        /*
-         * Max. 126 UNICODE characters (2 bytes per character) plus 2 bytes
-         * of descriptor header.
-         */
-        QUERY_DESC_STRING_MAX_SIZE              = 0xFE,
-        QUERY_DESC_GEOMETRY_MAX_SIZE            = 0x44,
-        QUERY_DESC_POWER_MAX_SIZE               = 0x62,
-        QUERY_DESC_RFU_MAX_SIZE                 = 0x00,
+enum ufs_desc_def_size {
+        QUERY_DESC_DEVICE_DEF_SIZE              = 0x40,
+        QUERY_DESC_CONFIGURATION_DEF_SIZE       = 0x90,
+        QUERY_DESC_UNIT_DEF_SIZE                = 0x23,
+        QUERY_DESC_INTERCONNECT_DEF_SIZE        = 0x06,
+        QUERY_DESC_GEOMETRY_DEF_SIZE            = 0x44,
+        QUERY_DESC_POWER_DEF_SIZE               = 0x62,
 };
 
 /* Unit descriptor parameters offsets in bytes*/
diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c
index a72a4ba78125..8e5e6c04c035 100644
--- a/drivers/scsi/ufs/ufshcd-pltfrm.c
+++ b/drivers/scsi/ufs/ufshcd-pltfrm.c
@@ -309,8 +309,8 @@ int ufshcd_pltfrm_init(struct platform_device *pdev,
 
         mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         mmio_base = devm_ioremap_resource(dev, mem_res);
-        if (IS_ERR(*(void **)&mmio_base)) {
-                err = PTR_ERR(*(void **)&mmio_base);
+        if (IS_ERR(mmio_base)) {
+                err = PTR_ERR(mmio_base);
                 goto out;
         }
 
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index dc6efbd1be8e..096e95b911bd 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -100,19 +100,6 @@
 #define ufshcd_hex_dump(prefix_str, buf, len) \
 print_hex_dump(KERN_ERR, prefix_str, DUMP_PREFIX_OFFSET, 16, 4, buf, len, false)
 
-static u32 ufs_query_desc_max_size[] = {
-        QUERY_DESC_DEVICE_MAX_SIZE,
-        QUERY_DESC_CONFIGURAION_MAX_SIZE,
-        QUERY_DESC_UNIT_MAX_SIZE,
-        QUERY_DESC_RFU_MAX_SIZE,
-        QUERY_DESC_INTERCONNECT_MAX_SIZE,
-        QUERY_DESC_STRING_MAX_SIZE,
-        QUERY_DESC_RFU_MAX_SIZE,
-        QUERY_DESC_GEOMETRY_MAX_SIZE,
-        QUERY_DESC_POWER_MAX_SIZE,
-        QUERY_DESC_RFU_MAX_SIZE,
-};
-
 enum {
         UFSHCD_MAX_CHANNEL      = 0,
         UFSHCD_MAX_ID           = 1,
@@ -2857,7 +2844,7 @@ static int __ufshcd_query_descriptor(struct ufs_hba *hba,
                 goto out;
         }
 
-        if (*buf_len <= QUERY_DESC_MIN_SIZE || *buf_len > QUERY_DESC_MAX_SIZE) {
+        if (*buf_len < QUERY_DESC_MIN_SIZE || *buf_len > QUERY_DESC_MAX_SIZE) {
                 dev_err(hba->dev, "%s: descriptor buffer size (%d) is out of range\n",
                                 __func__, *buf_len);
                 err = -EINVAL;
@@ -2938,6 +2925,92 @@ static int ufshcd_query_descriptor_retry(struct ufs_hba *hba,
 }
 
 /**
+ * ufshcd_read_desc_length - read the specified descriptor length from header
+ * @hba: Pointer to adapter instance
+ * @desc_id: descriptor idn value
+ * @desc_index: descriptor index
+ * @desc_length: pointer to variable to read the length of descriptor
+ *
+ * Return 0 in case of success, non-zero otherwise
+ */
+static int ufshcd_read_desc_length(struct ufs_hba *hba,
+        enum desc_idn desc_id,
+        int desc_index,
+        int *desc_length)
+{
+        int ret;
+        u8 header[QUERY_DESC_HDR_SIZE];
+        int header_len = QUERY_DESC_HDR_SIZE;
+
+        if (desc_id >= QUERY_DESC_IDN_MAX)
+                return -EINVAL;
+
+        ret = ufshcd_query_descriptor_retry(hba, UPIU_QUERY_OPCODE_READ_DESC,
+                                        desc_id, desc_index, 0, header,
+                                        &header_len);
+
+        if (ret) {
+                dev_err(hba->dev, "%s: Failed to get descriptor header id %d",
+                        __func__, desc_id);
+                return ret;
+        } else if (desc_id != header[QUERY_DESC_DESC_TYPE_OFFSET]) {
+                dev_warn(hba->dev, "%s: descriptor header id %d and desc_id %d mismatch",
+                        __func__, header[QUERY_DESC_DESC_TYPE_OFFSET],
+                        desc_id);
+                ret = -EINVAL;
+        }
+
+        *desc_length = header[QUERY_DESC_LENGTH_OFFSET];
+        return ret;
+
+}
+
+/**
+ * ufshcd_map_desc_id_to_length - map descriptor IDN to its length
+ * @hba: Pointer to adapter instance
+ * @desc_id: descriptor idn value
+ * @desc_len: mapped desc length (out)
+ *
+ * Return 0 in case of success, non-zero otherwise
+ */
+int ufshcd_map_desc_id_to_length(struct ufs_hba *hba,
+        enum desc_idn desc_id, int *desc_len)
+{
+        switch (desc_id) {
+        case QUERY_DESC_IDN_DEVICE:
+                *desc_len = hba->desc_size.dev_desc;
+                break;
+        case QUERY_DESC_IDN_POWER:
+                *desc_len = hba->desc_size.pwr_desc;
+                break;
+        case QUERY_DESC_IDN_GEOMETRY:
+                *desc_len = hba->desc_size.geom_desc;
+                break;
+        case QUERY_DESC_IDN_CONFIGURATION:
+                *desc_len = hba->desc_size.conf_desc;
+                break;
+        case QUERY_DESC_IDN_UNIT:
+                *desc_len = hba->desc_size.unit_desc;
+                break;
+        case QUERY_DESC_IDN_INTERCONNECT:
+                *desc_len = hba->desc_size.interc_desc;
+                break;
+        case QUERY_DESC_IDN_STRING:
+                *desc_len = QUERY_DESC_MAX_SIZE;
+                break;
+        case QUERY_DESC_IDN_RFU_0:
+        case QUERY_DESC_IDN_RFU_1:
+                *desc_len = 0;
+                break;
+        default:
+                *desc_len = 0;
+                return -EINVAL;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(ufshcd_map_desc_id_to_length);
+
+/**
  * ufshcd_read_desc_param - read the specified descriptor parameter
  * @hba: Pointer to adapter instance
  * @desc_id: descriptor idn value
@@ -2951,42 +3024,49 @@ static int ufshcd_query_descriptor_retry(struct ufs_hba *hba,
 static int ufshcd_read_desc_param(struct ufs_hba *hba,
                                   enum desc_idn desc_id,
                                   int desc_index,
-                                  u32 param_offset,
+                                  u8 param_offset,
                                   u8 *param_read_buf,
-                                  u32 param_size)
+                                  u8 param_size)
 {
         int ret;
         u8 *desc_buf;
-        u32 buff_len;
+        int buff_len;
         bool is_kmalloc = true;
 
-        /* safety checks */
-        if (desc_id >= QUERY_DESC_IDN_MAX)
+        /* Safety check */
+        if (desc_id >= QUERY_DESC_IDN_MAX || !param_size)
                 return -EINVAL;
 
-        buff_len = ufs_query_desc_max_size[desc_id];
-        if ((param_offset + param_size) > buff_len)
-                return -EINVAL;
+        /* Get the max length of descriptor from structure filled up at probe
+         * time.
+         */
+        ret = ufshcd_map_desc_id_to_length(hba, desc_id, &buff_len);
 
-        if (!param_offset && (param_size == buff_len)) {
-                /* memory space already available to hold full descriptor */
-                desc_buf = param_read_buf;
-                is_kmalloc = false;
-        } else {
-                /* allocate memory to hold full descriptor */
+        /* Sanity checks */
+        if (ret || !buff_len) {
+                dev_err(hba->dev, "%s: Failed to get full descriptor length",
+                        __func__);
+                return ret;
+        }
+
+        /* Check whether we need temp memory */
+        if (param_offset != 0 || param_size < buff_len) {
                 desc_buf = kmalloc(buff_len, GFP_KERNEL);
                 if (!desc_buf)
                         return -ENOMEM;
+        } else {
+                desc_buf = param_read_buf;
+                is_kmalloc = false;
         }
 
+        /* Request for full descriptor */
         ret = ufshcd_query_descriptor_retry(hba, UPIU_QUERY_OPCODE_READ_DESC,
-                                        desc_id, desc_index, 0, desc_buf,
-                                        &buff_len);
+                                        desc_id, desc_index, 0,
+                                        desc_buf, &buff_len);
 
         if (ret) {
                 dev_err(hba->dev, "%s: Failed reading descriptor. desc_id %d, desc_index %d, param_offset %d, ret %d",
                         __func__, desc_id, desc_index, param_offset, ret);
-
                 goto out;
         }
 
@@ -2998,25 +3078,9 @@ static int ufshcd_read_desc_param(struct ufs_hba *hba,
                 goto out;
         }
 
-        /*
-         * While reading variable size descriptors (like string descriptor),
-         * some UFS devices may report the "LENGTH" (field in "Transaction
-         * Specific fields" of Query Response UPIU) same as what was requested
-         * in Query Request UPIU instead of reporting the actual size of the
-         * variable size descriptor.
-         * Although it's safe to ignore the "LENGTH" field for variable size
-         * descriptors as we can always derive the length of the descriptor from
-         * the descriptor header fields. Hence this change impose the length
-         * match check only for fixed size descriptors (for which we always
-         * request the correct size as part of Query Request UPIU).
-         */
-        if ((desc_id != QUERY_DESC_IDN_STRING) &&
-            (buff_len != desc_buf[QUERY_DESC_LENGTH_OFFSET])) {
-                dev_err(hba->dev, "%s: desc_buf length mismatch: buff_len %d, buff_len(desc_header) %d",
-                        __func__, buff_len, desc_buf[QUERY_DESC_LENGTH_OFFSET]);
-                ret = -EINVAL;
-                goto out;
-        }
+        /* Check wherher we will not copy more data, than available */
+        if (is_kmalloc && param_size > buff_len)
+                param_size = buff_len;
 
         if (is_kmalloc)
                 memcpy(param_read_buf, &desc_buf[param_offset], param_size);
@@ -4598,8 +4662,6 @@ static void __ufshcd_transfer_req_compl(struct ufs_hba *hba,
                 }
                 if (ufshcd_is_clkscaling_supported(hba))
                         hba->clk_scaling.active_reqs--;
-                if (ufshcd_is_clkscaling_supported(hba))
-                        hba->clk_scaling.active_reqs--;
         }
 
         /* clear corresponding bits of completed commands */
@@ -5919,8 +5981,8 @@ static int ufshcd_set_icc_levels_attr(struct ufs_hba *hba, u32 icc_level)
 static void ufshcd_init_icc_levels(struct ufs_hba *hba)
 {
         int ret;
-        int buff_len = QUERY_DESC_POWER_MAX_SIZE;
-        u8 desc_buf[QUERY_DESC_POWER_MAX_SIZE];
+        int buff_len = hba->desc_size.pwr_desc;
+        u8 desc_buf[hba->desc_size.pwr_desc];
 
         ret = ufshcd_read_power_desc(hba, desc_buf, buff_len);
         if (ret) {
@@ -6017,11 +6079,10 @@ static int ufs_get_device_desc(struct ufs_hba *hba,
 {
         int err;
         u8 model_index;
-        u8 str_desc_buf[QUERY_DESC_STRING_MAX_SIZE + 1] = {0};
-        u8 desc_buf[QUERY_DESC_DEVICE_MAX_SIZE];
+        u8 str_desc_buf[QUERY_DESC_MAX_SIZE + 1] = {0};
+        u8 desc_buf[hba->desc_size.dev_desc];
 
-        err = ufshcd_read_device_desc(hba, desc_buf,
-                                        QUERY_DESC_DEVICE_MAX_SIZE);
+        err = ufshcd_read_device_desc(hba, desc_buf, hba->desc_size.dev_desc);
         if (err) {
                 dev_err(hba->dev, "%s: Failed reading Device Desc. err = %d\n",
                         __func__, err);
@@ -6038,14 +6099,14 @@ static int ufs_get_device_desc(struct ufs_hba *hba,
         model_index = desc_buf[DEVICE_DESC_PARAM_PRDCT_NAME];
 
         err = ufshcd_read_string_desc(hba, model_index, str_desc_buf,
-                                        QUERY_DESC_STRING_MAX_SIZE, ASCII_STD);
+                                QUERY_DESC_MAX_SIZE, ASCII_STD);
         if (err) {
                 dev_err(hba->dev, "%s: Failed reading Product Name. err = %d\n",
                         __func__, err);
                 goto out;
         }
 
-        str_desc_buf[QUERY_DESC_STRING_MAX_SIZE] = '\0';
+        str_desc_buf[QUERY_DESC_MAX_SIZE] = '\0';
         strlcpy(dev_desc->model, (str_desc_buf + QUERY_DESC_HDR_SIZE),
                 min_t(u8, str_desc_buf[QUERY_DESC_LENGTH_OFFSET],
                       MAX_MODEL_LEN));
@@ -6251,6 +6312,51 @@ static void ufshcd_clear_dbg_ufs_stats(struct ufs_hba *hba)
         hba->req_abort_count = 0;
 }
 
+static void ufshcd_init_desc_sizes(struct ufs_hba *hba)
+{
+        int err;
+
+        err = ufshcd_read_desc_length(hba, QUERY_DESC_IDN_DEVICE, 0,
+                &hba->desc_size.dev_desc);
+        if (err)
+                hba->desc_size.dev_desc = QUERY_DESC_DEVICE_DEF_SIZE;
+
+        err = ufshcd_read_desc_length(hba, QUERY_DESC_IDN_POWER, 0,
+                &hba->desc_size.pwr_desc);
+        if (err)
+                hba->desc_size.pwr_desc = QUERY_DESC_POWER_DEF_SIZE;
+
+        err = ufshcd_read_desc_length(hba, QUERY_DESC_IDN_INTERCONNECT, 0,
+                &hba->desc_size.interc_desc);
+        if (err)
+                hba->desc_size.interc_desc = QUERY_DESC_INTERCONNECT_DEF_SIZE;
+
+        err = ufshcd_read_desc_length(hba, QUERY_DESC_IDN_CONFIGURATION, 0,
+                &hba->desc_size.conf_desc);
+        if (err)
+                hba->desc_size.conf_desc = QUERY_DESC_CONFIGURATION_DEF_SIZE;
+
+        err = ufshcd_read_desc_length(hba, QUERY_DESC_IDN_UNIT, 0,
+                &hba->desc_size.unit_desc);
+        if (err)
+                hba->desc_size.unit_desc = QUERY_DESC_UNIT_DEF_SIZE;
+
+        err = ufshcd_read_desc_length(hba, QUERY_DESC_IDN_GEOMETRY, 0,
+                &hba->desc_size.geom_desc);
+        if (err)
+                hba->desc_size.geom_desc = QUERY_DESC_GEOMETRY_DEF_SIZE;
+}
+
+static void ufshcd_def_desc_sizes(struct ufs_hba *hba)
+{
+        hba->desc_size.dev_desc = QUERY_DESC_DEVICE_DEF_SIZE;
+        hba->desc_size.pwr_desc = QUERY_DESC_POWER_DEF_SIZE;
+        hba->desc_size.interc_desc = QUERY_DESC_INTERCONNECT_DEF_SIZE;
+        hba->desc_size.conf_desc = QUERY_DESC_CONFIGURATION_DEF_SIZE;
+        hba->desc_size.unit_desc = QUERY_DESC_UNIT_DEF_SIZE;
+        hba->desc_size.geom_desc = QUERY_DESC_GEOMETRY_DEF_SIZE;
+}
+
 /**
  * ufshcd_probe_hba - probe hba to detect device and initialize
  * @hba: per-adapter instance
@@ -6285,6 +6391,9 @@ static int ufshcd_probe_hba(struct ufs_hba *hba)
         if (ret)
                 goto out;
 
+        /* Init check for device descriptor sizes */
+        ufshcd_init_desc_sizes(hba);
+
         ret = ufs_get_device_desc(hba, &card);
         if (ret) {
                 dev_err(hba->dev, "%s: Failed getting device info. err = %d\n",
@@ -6320,6 +6429,7 @@ static int ufshcd_probe_hba(struct ufs_hba *hba)
 
         /* set the state as operational after switching to desired gear */
         hba->ufshcd_state = UFSHCD_STATE_OPERATIONAL;
+
         /*
          * If we are in error handling context or in power management callbacks
          * context, no need to scan the host
@@ -7530,7 +7640,7 @@ static inline ssize_t ufshcd_pm_lvl_store(struct device *dev,
         if (kstrtoul(buf, 0, &value))
                 return -EINVAL;
 
-        if ((value < UFS_PM_LVL_0) || (value >= UFS_PM_LVL_MAX))
+        if (value >= UFS_PM_LVL_MAX)
                 return -EINVAL;
 
         spin_lock_irqsave(hba->host->host_lock, flags);
@@ -7774,6 +7884,9 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
         hba->mmio_base = mmio_base;
         hba->irq = irq;
 
+        /* Set descriptor lengths to specification defaults */
+        ufshcd_def_desc_sizes(hba);
+
         err = ufshcd_hba_init(hba);
         if (err)
                 goto out_error;
diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
index 7630600217a2..cdc8bd05f7df 100644
--- a/drivers/scsi/ufs/ufshcd.h
+++ b/drivers/scsi/ufs/ufshcd.h
@@ -220,6 +220,15 @@ struct ufs_dev_cmd {
         struct ufs_query query;
 };
 
+struct ufs_desc_size {
+        int dev_desc;
+        int pwr_desc;
+        int geom_desc;
+        int interc_desc;
+        int unit_desc;
+        int conf_desc;
+};
+
 /**
  * struct ufs_clk_info - UFS clock related info
  * @list: list headed by hba->clk_list_head
@@ -483,6 +492,7 @@ struct ufs_stats {
  * @clk_list_head: UFS host controller clocks list node head
  * @pwr_info: holds current power mode
  * @max_pwr_info: keeps the device max valid pwm
+ * @desc_size: descriptor sizes reported by device
  * @urgent_bkops_lvl: keeps track of urgent bkops level for device
  * @is_urgent_bkops_lvl_checked: keeps track if the urgent bkops level for
  *  device is known or not.
@@ -666,6 +676,7 @@ struct ufs_hba {
         bool is_urgent_bkops_lvl_checked;
 
         struct rw_semaphore clk_scaling_lock;
+        struct ufs_desc_size desc_size;
 };
 
 /* Returns true if clocks can be gated. Otherwise false */
@@ -832,6 +843,10 @@ int ufshcd_query_flag(struct ufs_hba *hba, enum query_opcode opcode,
         enum flag_idn idn, bool *flag_res);
 int ufshcd_hold(struct ufs_hba *hba, bool async);
 void ufshcd_release(struct ufs_hba *hba);
+
+int ufshcd_map_desc_id_to_length(struct ufs_hba *hba, enum desc_idn desc_id,
+        int *desc_length);
+
 u32 ufshcd_get_local_unipro_ver(struct ufs_hba *hba);
 
 /* Wrapper functions for safely calling variant operations */
diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index ef474a748744..c374e3b5c678 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -1487,7 +1487,7 @@ static int pvscsi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 irq_flag &= ~PCI_IRQ_MSI;
 
         error = pci_alloc_irq_vectors(adapter->dev, 1, 1, irq_flag);
-        if (error)
+        if (error < 0)
                 goto out_reset_adapter;
 
         adapter->use_req_threshold = pvscsi_setup_req_threshold(adapter, true);
diff --git a/drivers/staging/lustre/lnet/lnet/lib-socket.c b/drivers/staging/lustre/lnet/lnet/lib-socket.c
index b7b87ecefcdf..9fca8d225ee0 100644
--- a/drivers/staging/lustre/lnet/lnet/lib-socket.c
+++ b/drivers/staging/lustre/lnet/lnet/lib-socket.c
@@ -532,7 +532,7 @@ lnet_sock_accept(struct socket **newsockp, struct socket *sock)
 
         newsock->ops = sock->ops;
 
-        rc = sock->ops->accept(sock, newsock, O_NONBLOCK);
+        rc = sock->ops->accept(sock, newsock, O_NONBLOCK, false);
         if (rc == -EAGAIN) {
                 /* Nothing ready, so wait for activity */
                 init_waitqueue_entry(&wait, current);
@@ -540,7 +540,7 @@ lnet_sock_accept(struct socket **newsockp, struct socket *sock)
                 set_current_state(TASK_INTERRUPTIBLE);
                 schedule();
                 remove_wait_queue(sk_sleep(sock->sk), &wait);
-                rc = sock->ops->accept(sock, newsock, O_NONBLOCK);
+                rc = sock->ops->accept(sock, newsock, O_NONBLOCK, false);
         }
 
         if (rc)
diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
index 7f8cf875157c..65a285631994 100644
--- a/drivers/staging/octeon/ethernet-rx.c
+++ b/drivers/staging/octeon/ethernet-rx.c
@@ -336,7 +336,6 @@ static int cvm_oct_poll(struct oct_rx_group *rx_group, int budget)
                 if (likely((port < TOTAL_NUMBER_OF_PORTS) &&
                            cvm_oct_device[port])) {
                         struct net_device *dev = cvm_oct_device[port];
-                        struct octeon_ethernet *priv = netdev_priv(dev);
 
                         /*
                          * Only accept packets for devices that are
diff --git a/drivers/staging/vc04_services/Kconfig b/drivers/staging/vc04_services/Kconfig
index e61e4ca064a8..74094fff4367 100644
--- a/drivers/staging/vc04_services/Kconfig
+++ b/drivers/staging/vc04_services/Kconfig
@@ -1,6 +1,7 @@
 config BCM2835_VCHIQ
         tristate "Videocore VCHIQ"
         depends on HAS_DMA
+        depends on OF
         depends on RASPBERRYPI_FIRMWARE || (COMPILE_TEST && !RASPBERRYPI_FIRMWARE)
         default y
         help
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index f5e330099bfc..fd7c16a7ca6e 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -43,7 +43,7 @@
 #include "target_core_ua.h"
 
 static sense_reason_t core_alua_check_transition(int state, int valid,
-                                                 int *primary);
+                                                 int *primary, int explicit);
 static int core_alua_set_tg_pt_secondary_state(
                 struct se_lun *lun, int explicit, int offline);
 
@@ -335,8 +335,8 @@ target_emulate_set_target_port_groups(struct se_cmd *cmd)
                  * the state is a primary or secondary target port asymmetric
                  * access state.
                  */
-                rc = core_alua_check_transition(alua_access_state,
-                                                valid_states, &primary);
+                rc = core_alua_check_transition(alua_access_state, valid_states,
+                                                &primary, 1);
                 if (rc) {
                         /*
                          * If the SET TARGET PORT GROUPS attempts to establish
@@ -691,7 +691,7 @@ target_alua_state_check(struct se_cmd *cmd)
 
         if (dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE)
                 return 0;
-        if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH)
+        if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH_ALUA)
                 return 0;
 
         /*
@@ -762,7 +762,7 @@ target_alua_state_check(struct se_cmd *cmd)
  * Check implicit and explicit ALUA state change request.
  */
 static sense_reason_t
-core_alua_check_transition(int state, int valid, int *primary)
+core_alua_check_transition(int state, int valid, int *primary, int explicit)
 {
         /*
          * OPTIMIZED, NON-OPTIMIZED, STANDBY and UNAVAILABLE are
@@ -804,11 +804,14 @@ core_alua_check_transition(int state, int valid, int *primary)
                 *primary = 0;
                 break;
         case ALUA_ACCESS_STATE_TRANSITION:
-                /*
-                 * Transitioning is set internally, and
-                 * cannot be selected manually.
-                 */
-                goto not_supported;
+                if (!(valid & ALUA_T_SUP) || explicit)
+                        /*
+                         * Transitioning is set internally and by tcmu daemon,
+                         * and cannot be selected through a STPG.
+                         */
+                        goto not_supported;
+                *primary = 0;
+                break;
         default:
                 pr_err("Unknown ALUA access state: 0x%02x\n", state);
                 return TCM_INVALID_PARAMETER_LIST;
@@ -1013,7 +1016,7 @@ static void core_alua_queue_state_change_ua(struct t10_alua_tg_pt_gp *tg_pt_gp)
 static void core_alua_do_transition_tg_pt_work(struct work_struct *work)
 {
         struct t10_alua_tg_pt_gp *tg_pt_gp = container_of(work,
-                struct t10_alua_tg_pt_gp, tg_pt_gp_transition_work.work);
+                struct t10_alua_tg_pt_gp, tg_pt_gp_transition_work);
         struct se_device *dev = tg_pt_gp->tg_pt_gp_dev;
         bool explicit = (tg_pt_gp->tg_pt_gp_alua_access_status ==
                          ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG);
@@ -1070,32 +1073,19 @@ static int core_alua_do_transition_tg_pt(
         if (atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state) == new_state)
                 return 0;
 
-        if (new_state == ALUA_ACCESS_STATE_TRANSITION)
+        if (explicit && new_state == ALUA_ACCESS_STATE_TRANSITION)
                 return -EAGAIN;
 
         /*
          * Flush any pending transitions
          */
-        if (!explicit && tg_pt_gp->tg_pt_gp_implicit_trans_secs &&
-            atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state) ==
-            ALUA_ACCESS_STATE_TRANSITION) {
-                /* Just in case */
-                tg_pt_gp->tg_pt_gp_alua_pending_state = new_state;
-                tg_pt_gp->tg_pt_gp_transition_complete = &wait;
-                flush_delayed_work(&tg_pt_gp->tg_pt_gp_transition_work);
-                wait_for_completion(&wait);
-                tg_pt_gp->tg_pt_gp_transition_complete = NULL;
-                return 0;
-        }
+        if (!explicit)
+                flush_work(&tg_pt_gp->tg_pt_gp_transition_work);
 
         /*
          * Save the old primary ALUA access state, and set the current state
          * to ALUA_ACCESS_STATE_TRANSITION.
          */
-        tg_pt_gp->tg_pt_gp_alua_previous_state =
-                atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state);
-        tg_pt_gp->tg_pt_gp_alua_pending_state = new_state;
-
         atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
                         ALUA_ACCESS_STATE_TRANSITION);
         tg_pt_gp->tg_pt_gp_alua_access_status = (explicit) ?
@@ -1104,6 +1094,13 @@ static int core_alua_do_transition_tg_pt(
 
         core_alua_queue_state_change_ua(tg_pt_gp);
 
+        if (new_state == ALUA_ACCESS_STATE_TRANSITION)
+                return 0;
+
+        tg_pt_gp->tg_pt_gp_alua_previous_state =
+                atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state);
+        tg_pt_gp->tg_pt_gp_alua_pending_state = new_state;
+
         /*
          * Check for the optional ALUA primary state transition delay
          */
@@ -1117,17 +1114,9 @@ static int core_alua_do_transition_tg_pt(
         atomic_inc(&tg_pt_gp->tg_pt_gp_ref_cnt);
         spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
 
-        if (!explicit && tg_pt_gp->tg_pt_gp_implicit_trans_secs) {
-                unsigned long transition_tmo;
-
-                transition_tmo = tg_pt_gp->tg_pt_gp_implicit_trans_secs * HZ;
-                queue_delayed_work(tg_pt_gp->tg_pt_gp_dev->tmr_wq,
-                                   &tg_pt_gp->tg_pt_gp_transition_work,
-                                   transition_tmo);
-        } else {
+        schedule_work(&tg_pt_gp->tg_pt_gp_transition_work);
+        if (explicit) {
                 tg_pt_gp->tg_pt_gp_transition_complete = &wait;
-                queue_delayed_work(tg_pt_gp->tg_pt_gp_dev->tmr_wq,
-                                   &tg_pt_gp->tg_pt_gp_transition_work, 0);
                 wait_for_completion(&wait);
                 tg_pt_gp->tg_pt_gp_transition_complete = NULL;
         }
@@ -1149,8 +1138,12 @@ int core_alua_do_port_transition(
         struct t10_alua_tg_pt_gp *tg_pt_gp;
         int primary, valid_states, rc = 0;
 
+        if (l_dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH_ALUA)
+                return -ENODEV;
+
         valid_states = l_tg_pt_gp->tg_pt_gp_alua_supported_states;
-        if (core_alua_check_transition(new_state, valid_states, &primary) != 0)
+        if (core_alua_check_transition(new_state, valid_states, &primary,
+                                       explicit) != 0)
                 return -EINVAL;
 
         local_lu_gp_mem = l_dev->dev_alua_lu_gp_mem;
@@ -1695,8 +1688,8 @@ struct t10_alua_tg_pt_gp *core_alua_allocate_tg_pt_gp(struct se_device *dev,
         mutex_init(&tg_pt_gp->tg_pt_gp_md_mutex);
         spin_lock_init(&tg_pt_gp->tg_pt_gp_lock);
         atomic_set(&tg_pt_gp->tg_pt_gp_ref_cnt, 0);
-        INIT_DELAYED_WORK(&tg_pt_gp->tg_pt_gp_transition_work,
-                          core_alua_do_transition_tg_pt_work);
+        INIT_WORK(&tg_pt_gp->tg_pt_gp_transition_work,
+                  core_alua_do_transition_tg_pt_work);
         tg_pt_gp->tg_pt_gp_dev = dev;
         atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
                 ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED);
@@ -1804,7 +1797,7 @@ void core_alua_free_tg_pt_gp(
         dev->t10_alua.alua_tg_pt_gps_counter--;
         spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
 
-        flush_delayed_work(&tg_pt_gp->tg_pt_gp_transition_work);
+        flush_work(&tg_pt_gp->tg_pt_gp_transition_work);
 
         /*
          * Allow a struct t10_alua_tg_pt_gp_member * referenced by
@@ -1973,7 +1966,7 @@ ssize_t core_alua_store_tg_pt_gp_info(
         unsigned char buf[TG_PT_GROUP_NAME_BUF];
         int move = 0;
 
-        if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH ||
+        if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH_ALUA ||
             (dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE))
                 return -ENODEV;
 
@@ -2230,7 +2223,7 @@ ssize_t core_alua_store_offline_bit(
         unsigned long tmp;
         int ret;
 
-        if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH ||
+        if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH_ALUA ||
             (dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE))
                 return -ENODEV;
 
@@ -2316,7 +2309,8 @@ ssize_t core_alua_store_secondary_write_metadata(
 
 int core_setup_alua(struct se_device *dev)
 {
-        if (!(dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH) &&
+        if (!(dev->transport->transport_flags &
+             TRANSPORT_FLAG_PASSTHROUGH_ALUA) &&
             !(dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE)) {
                 struct t10_alua_lu_gp_member *lu_gp_mem;
 
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 54b36c9835be..38b5025e4c7a 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -421,6 +421,10 @@ static int target_fabric_tf_ops_check(const struct target_core_fabric_ops *tfo)
                 pr_err("Missing tfo->aborted_task()\n");
                 return -EINVAL;
         }
+        if (!tfo->check_stop_free) {
+                pr_err("Missing tfo->check_stop_free()\n");
+                return -EINVAL;
+        }
         /*
          * We at least require tfo->fabric_make_wwn(), tfo->fabric_drop_wwn()
          * tfo->fabric_make_tpg() and tfo->fabric_drop_tpg() in
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index a8f8e53f2f57..94cda7991e80 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -154,7 +154,7 @@ static void pscsi_tape_read_blocksize(struct se_device *dev,
 
         buf = kzalloc(12, GFP_KERNEL);
         if (!buf)
-                return;
+                goto out_free;
 
         memset(cdb, 0, MAX_COMMAND_SIZE);
         cdb[0] = MODE_SENSE;
@@ -169,9 +169,10 @@ static void pscsi_tape_read_blocksize(struct se_device *dev,
          * If MODE_SENSE still returns zero, set the default value to 1024.
          */
         sdev->sector_size = (buf[9] << 16) | (buf[10] << 8) | (buf[11]);
+out_free:
         if (!sdev->sector_size)
                 sdev->sector_size = 1024;
-out_free:
+
         kfree(buf);
 }
 
@@ -314,9 +315,10 @@ static int pscsi_add_device_to_list(struct se_device *dev,
                                 sd->lun, sd->queue_depth);
         }
 
-        dev->dev_attrib.hw_block_size = sd->sector_size;
+        dev->dev_attrib.hw_block_size =
+                min_not_zero((int)sd->sector_size, 512);
         dev->dev_attrib.hw_max_sectors =
-                min_t(int, sd->host->max_sectors, queue_max_hw_sectors(q));
+                min_not_zero(sd->host->max_sectors, queue_max_hw_sectors(q));
         dev->dev_attrib.hw_queue_depth = sd->queue_depth;
 
         /*
@@ -339,8 +341,10 @@ static int pscsi_add_device_to_list(struct se_device *dev,
         /*
          * For TYPE_TAPE, attempt to determine blocksize with MODE_SENSE.
          */
-        if (sd->type == TYPE_TAPE)
+        if (sd->type == TYPE_TAPE) {
                 pscsi_tape_read_blocksize(dev, sd);
+                dev->dev_attrib.hw_block_size = sd->sector_size;
+        }
         return 0;
 }
 
@@ -406,7 +410,7 @@ static int pscsi_create_type_disk(struct se_device *dev, struct scsi_device *sd)
 /*
  * Called with struct Scsi_Host->host_lock called.
  */
-static int pscsi_create_type_rom(struct se_device *dev, struct scsi_device *sd)
+static int pscsi_create_type_nondisk(struct se_device *dev, struct scsi_device *sd)
         __releases(sh->host_lock)
 {
         struct pscsi_hba_virt *phv = dev->se_hba->hba_ptr;
@@ -433,28 +437,6 @@ static int pscsi_create_type_rom(struct se_device *dev, struct scsi_device *sd)
         return 0;
 }
 
-/*
- * Called with struct Scsi_Host->host_lock called.
- */
-static int pscsi_create_type_other(struct se_device *dev,
-                struct scsi_device *sd)
-        __releases(sh->host_lock)
-{
-        struct pscsi_hba_virt *phv = dev->se_hba->hba_ptr;
-        struct Scsi_Host *sh = sd->host;
-        int ret;
-
-        spin_unlock_irq(sh->host_lock);
-        ret = pscsi_add_device_to_list(dev, sd);
-        if (ret)
-                return ret;
-
-        pr_debug("CORE_PSCSI[%d] - Added Type: %s for %d:%d:%d:%llu\n",
-                phv->phv_host_id, scsi_device_type(sd->type), sh->host_no,
-                sd->channel, sd->id, sd->lun);
-        return 0;
-}
-
 static int pscsi_configure_device(struct se_device *dev)
 {
         struct se_hba *hba = dev->se_hba;
@@ -542,11 +524,8 @@ static int pscsi_configure_device(struct se_device *dev)
                 case TYPE_DISK:
                         ret = pscsi_create_type_disk(dev, sd);
                         break;
-                case TYPE_ROM:
-                        ret = pscsi_create_type_rom(dev, sd);
-                        break;
                 default:
-                        ret = pscsi_create_type_other(dev, sd);
+                        ret = pscsi_create_type_nondisk(dev, sd);
                         break;
                 }
 
@@ -611,8 +590,7 @@ static void pscsi_free_device(struct se_device *dev)
                 else if (pdv->pdv_lld_host)
                         scsi_host_put(pdv->pdv_lld_host);
 
-                if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM))
-                        scsi_device_put(sd);
+                scsi_device_put(sd);
 
                 pdv->pdv_sd = NULL;
         }
@@ -1064,7 +1042,6 @@ static sector_t pscsi_get_blocks(struct se_device *dev)
         if (pdv->pdv_bd && pdv->pdv_bd->bd_part)
                 return pdv->pdv_bd->bd_part->nr_sects;
 
-        dump_stack();
         return 0;
 }
 
@@ -1103,7 +1080,8 @@ static void pscsi_req_done(struct request *req, int uptodate)
 static const struct target_backend_ops pscsi_ops = {
         .name                   = "pscsi",
         .owner                  = THIS_MODULE,
-        .transport_flags        = TRANSPORT_FLAG_PASSTHROUGH,
+        .transport_flags        = TRANSPORT_FLAG_PASSTHROUGH |
+                                  TRANSPORT_FLAG_PASSTHROUGH_ALUA,
         .attach_hba             = pscsi_attach_hba,
         .detach_hba             = pscsi_detach_hba,
         .pmode_enable_hba       = pscsi_pmode_enable_hba,
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 68d8aef7ab78..c194063f169b 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -1105,9 +1105,15 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
                         return ret;
                 break;
         case VERIFY:
+        case VERIFY_16:
                 size = 0;
-                sectors = transport_get_sectors_10(cdb);
-                cmd->t_task_lba = transport_lba_32(cdb);
+                if (cdb[0] == VERIFY) {
+                        sectors = transport_get_sectors_10(cdb);
+                        cmd->t_task_lba = transport_lba_32(cdb);
+                } else {
+                        sectors = transport_get_sectors_16(cdb);
+                        cmd->t_task_lba = transport_lba_64(cdb);
+                }
                 cmd->execute_cmd = sbc_emulate_noop;
                 goto check_lba;
         case REZERO_UNIT:
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index c0dbfa016575..6fb191914f45 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -602,7 +602,8 @@ int core_tpg_add_lun(
         if (ret)
                 goto out_kill_ref;
 
-        if (!(dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH) &&
+        if (!(dev->transport->transport_flags &
+             TRANSPORT_FLAG_PASSTHROUGH_ALUA) &&
             !(dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE))
                 target_attach_tg_pt_gp(lun, dev->t10_alua.default_tg_pt_gp);
 
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 434d9d693989..b1a3cdb29468 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -636,8 +636,7 @@ static int transport_cmd_check_stop_to_fabric(struct se_cmd *cmd)
          * Fabric modules are expected to return '1' here if the se_cmd being
          * passed is released at this point, or zero if not being released.
          */
-        return cmd->se_tfo->check_stop_free ? cmd->se_tfo->check_stop_free(cmd)
-                : 0;
+        return cmd->se_tfo->check_stop_free(cmd);
 }
 
 static void transport_lun_remove_cmd(struct se_cmd *cmd)
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index c3adefe95e50..c6874c38a10b 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -28,6 +28,7 @@
 #include <linux/stringify.h>
 #include <linux/bitops.h>
 #include <linux/highmem.h>
+#include <linux/configfs.h>
 #include <net/genetlink.h>
 #include <scsi/scsi_common.h>
 #include <scsi/scsi_proto.h>
@@ -112,6 +113,7 @@ struct tcmu_dev {
         spinlock_t commands_lock;
 
         struct timer_list timeout;
+        unsigned int cmd_time_out;
 
         char dev_config[TCMU_CONFIG_LEN];
 };
@@ -172,7 +174,9 @@ static struct tcmu_cmd *tcmu_alloc_cmd(struct se_cmd *se_cmd)
 
         tcmu_cmd->se_cmd = se_cmd;
         tcmu_cmd->tcmu_dev = udev;
-        tcmu_cmd->deadline = jiffies + msecs_to_jiffies(TCMU_TIME_OUT);
+        if (udev->cmd_time_out)
+                tcmu_cmd->deadline = jiffies +
+                                        msecs_to_jiffies(udev->cmd_time_out);
 
         idr_preload(GFP_KERNEL);
         spin_lock_irq(&udev->commands_lock);
@@ -451,7 +455,11 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
 
                 pr_debug("sleeping for ring space\n");
                 spin_unlock_irq(&udev->cmdr_lock);
-                ret = schedule_timeout(msecs_to_jiffies(TCMU_TIME_OUT));
+                if (udev->cmd_time_out)
+                        ret = schedule_timeout(
+                                        msecs_to_jiffies(udev->cmd_time_out));
+                else
+                        ret = schedule_timeout(msecs_to_jiffies(TCMU_TIME_OUT));
                 finish_wait(&udev->wait_cmdr, &__wait);
                 if (!ret) {
                         pr_warn("tcmu: command timed out\n");
@@ -526,8 +534,9 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
         /* TODO: only if FLUSH and FUA? */
         uio_event_notify(&udev->uio_info);
 
-        mod_timer(&udev->timeout,
-                round_jiffies_up(jiffies + msecs_to_jiffies(TCMU_TIME_OUT)));
+        if (udev->cmd_time_out)
+                mod_timer(&udev->timeout, round_jiffies_up(jiffies +
+                          msecs_to_jiffies(udev->cmd_time_out)));
 
         return TCM_NO_SENSE;
 }
@@ -742,6 +751,7 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
         }
 
         udev->hba = hba;
+        udev->cmd_time_out = TCMU_TIME_OUT;
 
         init_waitqueue_head(&udev->wait_cmdr);
         spin_lock_init(&udev->cmdr_lock);
@@ -960,7 +970,8 @@ static int tcmu_configure_device(struct se_device *dev)
         if (dev->dev_attrib.hw_block_size == 0)
                 dev->dev_attrib.hw_block_size = 512;
         /* Other attributes can be configured in userspace */
-        dev->dev_attrib.hw_max_sectors = 128;
+        if (!dev->dev_attrib.hw_max_sectors)
+                dev->dev_attrib.hw_max_sectors = 128;
         dev->dev_attrib.hw_queue_depth = 128;
 
         ret = tcmu_netlink_event(TCMU_CMD_ADDED_DEVICE, udev->uio_info.name,
@@ -997,6 +1008,11 @@ static void tcmu_dev_call_rcu(struct rcu_head *p)
         kfree(udev);
 }
 
+static bool tcmu_dev_configured(struct tcmu_dev *udev)
+{
+        return udev->uio_info.uio_dev ? true : false;
+}
+
 static void tcmu_free_device(struct se_device *dev)
 {
         struct tcmu_dev *udev = TCMU_DEV(dev);
@@ -1018,8 +1034,7 @@ static void tcmu_free_device(struct se_device *dev)
         spin_unlock_irq(&udev->commands_lock);
         WARN_ON(!all_expired);
 
-        /* Device was configured */
-        if (udev->uio_info.uio_dev) {
+        if (tcmu_dev_configured(udev)) {
                 tcmu_netlink_event(TCMU_CMD_REMOVED_DEVICE, udev->uio_info.name,
                                    udev->uio_info.uio_dev->minor);
 
@@ -1031,16 +1046,42 @@ static void tcmu_free_device(struct se_device *dev)
 }
 
 enum {
-        Opt_dev_config, Opt_dev_size, Opt_hw_block_size, Opt_err,
+        Opt_dev_config, Opt_dev_size, Opt_hw_block_size, Opt_hw_max_sectors,
+        Opt_err,
 };
 
 static match_table_t tokens = {
         {Opt_dev_config, "dev_config=%s"},
         {Opt_dev_size, "dev_size=%u"},
         {Opt_hw_block_size, "hw_block_size=%u"},
+        {Opt_hw_max_sectors, "hw_max_sectors=%u"},
         {Opt_err, NULL}
 };
 
+static int tcmu_set_dev_attrib(substring_t *arg, u32 *dev_attrib)
+{
+        unsigned long tmp_ul;
+        char *arg_p;
+        int ret;
+
+        arg_p = match_strdup(arg);
+        if (!arg_p)
+                return -ENOMEM;
+
+        ret = kstrtoul(arg_p, 0, &tmp_ul);
+        kfree(arg_p);
+        if (ret < 0) {
+                pr_err("kstrtoul() failed for dev attrib\n");
+                return ret;
+        }
+        if (!tmp_ul) {
+                pr_err("dev attrib must be nonzero\n");
+                return -EINVAL;
+        }
+        *dev_attrib = tmp_ul;
+        return 0;
+}
+
 static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev,
                 const char *page, ssize_t count)
 {
@@ -1048,7 +1089,6 @@ static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev,
         char *orig, *ptr, *opts, *arg_p;
         substring_t args[MAX_OPT_ARGS];
         int ret = 0, token;
-        unsigned long tmp_ul;
 
         opts = kstrdup(page, GFP_KERNEL);
         if (!opts)
@@ -1082,26 +1122,19 @@ static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev,
                                 pr_err("kstrtoul() failed for dev_size=\n");
                         break;
                 case Opt_hw_block_size:
-                        arg_p = match_strdup(&args[0]);
-                        if (!arg_p) {
-                                ret = -ENOMEM;
-                                break;
-                        }
-                        ret = kstrtoul(arg_p, 0, &tmp_ul);
-                        kfree(arg_p);
-                        if (ret < 0) {
-                                pr_err("kstrtoul() failed for hw_block_size=\n");
-                                break;
-                        }
-                        if (!tmp_ul) {
-                                pr_err("hw_block_size must be nonzero\n");
-                                break;
-                        }
-                        dev->dev_attrib.hw_block_size = tmp_ul;
+                        ret = tcmu_set_dev_attrib(&args[0],
+                                        &(dev->dev_attrib.hw_block_size));
+                        break;
+                case Opt_hw_max_sectors:
+                        ret = tcmu_set_dev_attrib(&args[0],
+                                        &(dev->dev_attrib.hw_max_sectors));
                         break;
                 default:
                         break;
                 }
+
+                if (ret)
+                        break;
         }
 
         kfree(orig);
@@ -1134,7 +1167,48 @@ tcmu_parse_cdb(struct se_cmd *cmd)
         return passthrough_parse_cdb(cmd, tcmu_queue_cmd);
 }
 
-static const struct target_backend_ops tcmu_ops = {
+static ssize_t tcmu_cmd_time_out_show(struct config_item *item, char *page)
+{
+        struct se_dev_attrib *da = container_of(to_config_group(item),
+                                        struct se_dev_attrib, da_group);
+        struct tcmu_dev *udev = container_of(da->da_dev,
+                                        struct tcmu_dev, se_dev);
+
+        return snprintf(page, PAGE_SIZE, "%lu\n", udev->cmd_time_out / MSEC_PER_SEC);
+}
+
+static ssize_t tcmu_cmd_time_out_store(struct config_item *item, const char *page,
+                                       size_t count)
+{
+        struct se_dev_attrib *da = container_of(to_config_group(item),
+                                        struct se_dev_attrib, da_group);
+        struct tcmu_dev *udev = container_of(da->da_dev,
+                                        struct tcmu_dev, se_dev);
+        u32 val;
+        int ret;
+
+        if (da->da_dev->export_count) {
+                pr_err("Unable to set tcmu cmd_time_out while exports exist\n");
+                return -EINVAL;
+        }
+
+        ret = kstrtou32(page, 0, &val);
+        if (ret < 0)
+                return ret;
+
+        if (!val) {
+                pr_err("Illegal value for cmd_time_out\n");
+                return -EINVAL;
+        }
+
+        udev->cmd_time_out = val * MSEC_PER_SEC;
+        return count;
+}
+CONFIGFS_ATTR(tcmu_, cmd_time_out);
+
+static struct configfs_attribute **tcmu_attrs;
+
+static struct target_backend_ops tcmu_ops = {
         .name                   = "user",
         .owner                  = THIS_MODULE,
         .transport_flags        = TRANSPORT_FLAG_PASSTHROUGH,
@@ -1148,12 +1222,12 @@ static const struct target_backend_ops tcmu_ops = {
         .show_configfs_dev_params = tcmu_show_configfs_dev_params,
         .get_device_type        = sbc_get_device_type,
         .get_blocks             = tcmu_get_blocks,
-        .tb_dev_attrib_attrs    = passthrough_attrib_attrs,
+        .tb_dev_attrib_attrs    = NULL,
 };
 
 static int __init tcmu_module_init(void)
 {
-        int ret;
+        int ret, i, len = 0;
 
         BUILD_BUG_ON((sizeof(struct tcmu_cmd_entry) % TCMU_OP_ALIGN_SIZE) != 0);
 
@@ -1175,12 +1249,31 @@ static int __init tcmu_module_init(void)
                 goto out_unreg_device;
         }
 
+        for (i = 0; passthrough_attrib_attrs[i] != NULL; i++) {
+                len += sizeof(struct configfs_attribute *);
+        }
+        len += sizeof(struct configfs_attribute *) * 2;
+
+        tcmu_attrs = kzalloc(len, GFP_KERNEL);
+        if (!tcmu_attrs) {
+                ret = -ENOMEM;
+                goto out_unreg_genl;
+        }
+
+        for (i = 0; passthrough_attrib_attrs[i] != NULL; i++) {
+                tcmu_attrs[i] = passthrough_attrib_attrs[i];
+        }
+        tcmu_attrs[i] = &tcmu_attr_cmd_time_out;
+        tcmu_ops.tb_dev_attrib_attrs = tcmu_attrs;
+
         ret = transport_backend_register(&tcmu_ops);
         if (ret)
-                goto out_unreg_genl;
+                goto out_attrs;
 
         return 0;
 
+out_attrs:
+        kfree(tcmu_attrs);
 out_unreg_genl:
         genl_unregister_family(&tcmu_genl_family);
 out_unreg_device:
@@ -1194,6 +1287,7 @@ out_free_cache:
 static void __exit tcmu_module_exit(void)
 {
         target_backend_unregister(&tcmu_ops);
+        kfree(tcmu_attrs);
         genl_unregister_family(&tcmu_genl_family);
         root_device_unregister(tcmu_root_device);
         kmem_cache_destroy(tcmu_cmd_cache);
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index 91048eeca28b..69d0f430b2d1 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -107,8 +107,6 @@ struct cpufreq_cooling_device {
 };
 static DEFINE_IDA(cpufreq_ida);
 
-static unsigned int cpufreq_dev_count;
-
 static DEFINE_MUTEX(cooling_list_lock);
 static LIST_HEAD(cpufreq_dev_list);
 
@@ -395,13 +393,20 @@ static int get_static_power(struct cpufreq_cooling_device *cpufreq_device,
 
         opp = dev_pm_opp_find_freq_exact(cpufreq_device->cpu_dev, freq_hz,
                                          true);
+        if (IS_ERR(opp)) {
+                dev_warn_ratelimited(cpufreq_device->cpu_dev,
+                                     "Failed to find OPP for frequency %lu: %ld\n",
+                                     freq_hz, PTR_ERR(opp));
+                return -EINVAL;
+        }
+
         voltage = dev_pm_opp_get_voltage(opp);
         dev_pm_opp_put(opp);
 
         if (voltage == 0) {
-                dev_warn_ratelimited(cpufreq_device->cpu_dev,
-                                     "Failed to get voltage for frequency %lu: %ld\n",
-                                     freq_hz, IS_ERR(opp) ? PTR_ERR(opp) : 0);
+                dev_err_ratelimited(cpufreq_device->cpu_dev,
+                                    "Failed to get voltage for frequency %lu\n",
+                                    freq_hz);
                 return -EINVAL;
         }
 
@@ -693,9 +698,9 @@ static int cpufreq_power2state(struct thermal_cooling_device *cdev,
 
         *state = cpufreq_cooling_get_level(cpu, target_freq);
         if (*state == THERMAL_CSTATE_INVALID) {
-                dev_warn_ratelimited(&cdev->device,
-                                     "Failed to convert %dKHz for cpu %d into a cdev state\n",
-                                     target_freq, cpu);
+                dev_err_ratelimited(&cdev->device,
+                                    "Failed to convert %dKHz for cpu %d into a cdev state\n",
+                                    target_freq, cpu);
                 return -EINVAL;
         }
 
@@ -771,6 +776,7 @@ __cpufreq_cooling_register(struct device_node *np,
         unsigned int freq, i, num_cpus;
         int ret;
         struct thermal_cooling_device_ops *cooling_ops;
+        bool first;
 
         if (!alloc_cpumask_var(&temp_mask, GFP_KERNEL))
                 return ERR_PTR(-ENOMEM);
@@ -874,13 +880,14 @@ __cpufreq_cooling_register(struct device_node *np,
         cpufreq_dev->cool_dev = cool_dev;
 
         mutex_lock(&cooling_list_lock);
+        /* Register the notifier for first cpufreq cooling device */
+        first = list_empty(&cpufreq_dev_list);
         list_add(&cpufreq_dev->node, &cpufreq_dev_list);
+        mutex_unlock(&cooling_list_lock);
 
-        /* Register the notifier for first cpufreq cooling device */
-        if (!cpufreq_dev_count++)
+        if (first)
                 cpufreq_register_notifier(&thermal_cpufreq_notifier_block,
                                           CPUFREQ_POLICY_NOTIFIER);
-        mutex_unlock(&cooling_list_lock);
 
         goto put_policy;
 
@@ -1021,6 +1028,7 @@ EXPORT_SYMBOL(of_cpufreq_power_cooling_register);
 void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
 {
         struct cpufreq_cooling_device *cpufreq_dev;
+        bool last;
 
         if (!cdev)
                 return;
@@ -1028,14 +1036,15 @@ void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
         cpufreq_dev = cdev->devdata;
 
         mutex_lock(&cooling_list_lock);
+        list_del(&cpufreq_dev->node);
         /* Unregister the notifier for the last cpufreq cooling device */
-        if (!--cpufreq_dev_count)
+        last = list_empty(&cpufreq_dev_list);
+        mutex_unlock(&cooling_list_lock);
+
+        if (last)
                 cpufreq_unregister_notifier(&thermal_cpufreq_notifier_block,
                                             CPUFREQ_POLICY_NOTIFIER);
 
-        list_del(&cpufreq_dev->node);
-        mutex_unlock(&cooling_list_lock);
-
         thermal_cooling_device_unregister(cpufreq_dev->cool_dev);
         ida_simple_remove(&cpufreq_ida, cpufreq_dev->id);
         kfree(cpufreq_dev->dyn_power_table);
diff --git a/drivers/thermal/devfreq_cooling.c b/drivers/thermal/devfreq_cooling.c
index 7743a78d4723..4bf4ad58cffd 100644
--- a/drivers/thermal/devfreq_cooling.c
+++ b/drivers/thermal/devfreq_cooling.c
@@ -186,16 +186,22 @@ get_static_power(struct devfreq_cooling_device *dfc, unsigned long freq)
                 return 0;
 
         opp = dev_pm_opp_find_freq_exact(dev, freq, true);
-        if (IS_ERR(opp) && (PTR_ERR(opp) == -ERANGE))
+        if (PTR_ERR(opp) == -ERANGE)
                 opp = dev_pm_opp_find_freq_exact(dev, freq, false);
 
+        if (IS_ERR(opp)) {
+                dev_err_ratelimited(dev, "Failed to find OPP for frequency %lu: %ld\n",
+                                    freq, PTR_ERR(opp));
+                return 0;
+        }
+
         voltage = dev_pm_opp_get_voltage(opp) / 1000; /* mV */
         dev_pm_opp_put(opp);
 
         if (voltage == 0) {
-                dev_warn_ratelimited(dev,
-                                     "Failed to get voltage for frequency %lu: %ld\n",
-                                     freq, IS_ERR(opp) ? PTR_ERR(opp) : 0);
+                dev_err_ratelimited(dev,
+                                    "Failed to get voltage for frequency %lu\n",
+                                    freq);
                 return 0;
         }
 
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index 1bacbc3b19a0..e94aea8c0d05 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -114,7 +114,7 @@
 #define DEFAULT_TX_BUF_COUNT 3
 
 struct n_hdlc_buf {
-        struct n_hdlc_buf *link;
+        struct list_head  list_item;
         int               count;
         char              buf[1];
 };
@@ -122,8 +122,7 @@ struct n_hdlc_buf {
 #define N_HDLC_BUF_SIZE (sizeof(struct n_hdlc_buf) + maxframe)
 
 struct n_hdlc_buf_list {
-        struct n_hdlc_buf *head;
-        struct n_hdlc_buf *tail;
+        struct list_head  list;
         int               count;
         spinlock_t        spinlock;
 };
@@ -136,7 +135,6 @@ struct n_hdlc_buf_list {
  * @backup_tty - TTY to use if tty gets closed
  * @tbusy - reentrancy flag for tx wakeup code
  * @woke_up - FIXME: describe this field
- * @tbuf - currently transmitting tx buffer
  * @tx_buf_list - list of pending transmit frame buffers
  * @rx_buf_list - list of received frame buffers
  * @tx_free_buf_list - list unused transmit frame buffers
@@ -149,7 +147,6 @@ struct n_hdlc {
         struct tty_struct       *backup_tty;
         int                     tbusy;
         int                     woke_up;
-        struct n_hdlc_buf       *tbuf;
         struct n_hdlc_buf_list  tx_buf_list;
         struct n_hdlc_buf_list  rx_buf_list;
         struct n_hdlc_buf_list  tx_free_buf_list;
@@ -159,6 +156,8 @@ struct n_hdlc {
 /*
  * HDLC buffer list manipulation functions
  */
+static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
+                                                struct n_hdlc_buf *buf);
 static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
                            struct n_hdlc_buf *buf);
 static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *list);
@@ -208,16 +207,9 @@ static void flush_tx_queue(struct tty_struct *tty)
 {
         struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
         struct n_hdlc_buf *buf;
-        unsigned long flags;
 
         while ((buf = n_hdlc_buf_get(&n_hdlc->tx_buf_list)))
                 n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, buf);
-        spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock, flags);
-        if (n_hdlc->tbuf) {
-                n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, n_hdlc->tbuf);
-                n_hdlc->tbuf = NULL;
-        }
-        spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
 }
 
 static struct tty_ldisc_ops n_hdlc_ldisc = {
@@ -283,7 +275,6 @@ static void n_hdlc_release(struct n_hdlc *n_hdlc)
                 } else
                         break;
         }
-        kfree(n_hdlc->tbuf);
         kfree(n_hdlc);
         
 }       /* end of n_hdlc_release() */
@@ -402,13 +393,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
         n_hdlc->woke_up = 0;
         spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
 
-        /* get current transmit buffer or get new transmit */
-        /* buffer from list of pending transmit buffers */
-                
-        tbuf = n_hdlc->tbuf;
-        if (!tbuf)
-                tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
-                
+        tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
         while (tbuf) {
                 if (debuglevel >= DEBUG_LEVEL_INFO)     
                         printk("%s(%d)sending frame %p, count=%d\n",
@@ -420,7 +405,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
 
                 /* rollback was possible and has been done */
                 if (actual == -ERESTARTSYS) {
-                        n_hdlc->tbuf = tbuf;
+                        n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
                         break;
                 }
                 /* if transmit error, throw frame away by */
@@ -435,10 +420,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
                                         
                         /* free current transmit buffer */
                         n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, tbuf);
-                        
-                        /* this tx buffer is done */
-                        n_hdlc->tbuf = NULL;
-                        
+
                         /* wait up sleeping writers */
                         wake_up_interruptible(&tty->write_wait);
         
@@ -448,10 +430,12 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
                         if (debuglevel >= DEBUG_LEVEL_INFO)     
                                 printk("%s(%d)frame %p pending\n",
                                         __FILE__,__LINE__,tbuf);
-                                        
-                        /* buffer not accepted by driver */
-                        /* set this buffer as pending buffer */
-                        n_hdlc->tbuf = tbuf;
+
+                        /*
+                         * the buffer was not accepted by driver,
+                         * return it back into tx queue
+                         */
+                        n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
                         break;
                 }
         }
@@ -749,7 +733,8 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
         int error = 0;
         int count;
         unsigned long flags;
-        
+        struct n_hdlc_buf *buf = NULL;
+
         if (debuglevel >= DEBUG_LEVEL_INFO)     
                 printk("%s(%d)n_hdlc_tty_ioctl() called %d\n",
                         __FILE__,__LINE__,cmd);
@@ -763,8 +748,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
                 /* report count of read data available */
                 /* in next available frame (if any) */
                 spin_lock_irqsave(&n_hdlc->rx_buf_list.spinlock,flags);
-                if (n_hdlc->rx_buf_list.head)
-                        count = n_hdlc->rx_buf_list.head->count;
+                buf = list_first_entry_or_null(&n_hdlc->rx_buf_list.list,
+                                                struct n_hdlc_buf, list_item);
+                if (buf)
+                        count = buf->count;
                 else
                         count = 0;
                 spin_unlock_irqrestore(&n_hdlc->rx_buf_list.spinlock,flags);
@@ -776,8 +763,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
                 count = tty_chars_in_buffer(tty);
                 /* add size of next output frame in queue */
                 spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock,flags);
-                if (n_hdlc->tx_buf_list.head)
-                        count += n_hdlc->tx_buf_list.head->count;
+                buf = list_first_entry_or_null(&n_hdlc->tx_buf_list.list,
+                                                struct n_hdlc_buf, list_item);
+                if (buf)
+                        count += buf->count;
                 spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock,flags);
                 error = put_user(count, (int __user *)arg);
                 break;
@@ -825,14 +814,14 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp,
                 poll_wait(filp, &tty->write_wait, wait);
 
                 /* set bits for operations that won't block */
-                if (n_hdlc->rx_buf_list.head)
+                if (!list_empty(&n_hdlc->rx_buf_list.list))
                         mask |= POLLIN | POLLRDNORM;    /* readable */
                 if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
                         mask |= POLLHUP;
                 if (tty_hung_up_p(filp))
                         mask |= POLLHUP;
                 if (!tty_is_writelocked(tty) &&
-                                n_hdlc->tx_free_buf_list.head)
+                                !list_empty(&n_hdlc->tx_free_buf_list.list))
                         mask |= POLLOUT | POLLWRNORM;   /* writable */
         }
         return mask;
@@ -856,7 +845,12 @@ static struct n_hdlc *n_hdlc_alloc(void)
         spin_lock_init(&n_hdlc->tx_free_buf_list.spinlock);
         spin_lock_init(&n_hdlc->rx_buf_list.spinlock);
         spin_lock_init(&n_hdlc->tx_buf_list.spinlock);
-        
+
+        INIT_LIST_HEAD(&n_hdlc->rx_free_buf_list.list);
+        INIT_LIST_HEAD(&n_hdlc->tx_free_buf_list.list);
+        INIT_LIST_HEAD(&n_hdlc->rx_buf_list.list);
+        INIT_LIST_HEAD(&n_hdlc->tx_buf_list.list);
+
         /* allocate free rx buffer list */
         for(i=0;i<DEFAULT_RX_BUF_COUNT;i++) {
                 buf = kmalloc(N_HDLC_BUF_SIZE, GFP_KERNEL);
@@ -884,53 +878,65 @@ static struct n_hdlc *n_hdlc_alloc(void)
 }       /* end of n_hdlc_alloc() */
 
 /**
+ * n_hdlc_buf_return - put the HDLC buffer after the head of the specified list
+ * @buf_list - pointer to the buffer list
+ * @buf - pointer to the buffer
+ */
+static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
+                                                struct n_hdlc_buf *buf)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&buf_list->spinlock, flags);
+
+        list_add(&buf->list_item, &buf_list->list);
+        buf_list->count++;
+
+        spin_unlock_irqrestore(&buf_list->spinlock, flags);
+}
+
+/**
  * n_hdlc_buf_put - add specified HDLC buffer to tail of specified list
- * @list - pointer to buffer list
+ * @buf_list - pointer to buffer list
  * @buf - pointer to buffer
  */
-static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
+static void n_hdlc_buf_put(struct n_hdlc_buf_list *buf_list,
                            struct n_hdlc_buf *buf)
 {
         unsigned long flags;
-        spin_lock_irqsave(&list->spinlock,flags);
-        
-        buf->link=NULL;
-        if (list->tail)
-                list->tail->link = buf;
-        else
-                list->head = buf;
-        list->tail = buf;
-        (list->count)++;
-        
-        spin_unlock_irqrestore(&list->spinlock,flags);
-        
+
+        spin_lock_irqsave(&buf_list->spinlock, flags);
+
+        list_add_tail(&buf->list_item, &buf_list->list);
+        buf_list->count++;
+
+        spin_unlock_irqrestore(&buf_list->spinlock, flags);
 }       /* end of n_hdlc_buf_put() */
 
 /**
  * n_hdlc_buf_get - remove and return an HDLC buffer from list
- * @list - pointer to HDLC buffer list
+ * @buf_list - pointer to HDLC buffer list
  * 
  * Remove and return an HDLC buffer from the head of the specified HDLC buffer
  * list.
  * Returns a pointer to HDLC buffer if available, otherwise %NULL.
  */
-static struct n_hdlc_buf* n_hdlc_buf_get(struct n_hdlc_buf_list *list)
+static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *buf_list)
 {
         unsigned long flags;
         struct n_hdlc_buf *buf;
-        spin_lock_irqsave(&list->spinlock,flags);
-        
-        buf = list->head;
+
+        spin_lock_irqsave(&buf_list->spinlock, flags);
+
+        buf = list_first_entry_or_null(&buf_list->list,
+                                                struct n_hdlc_buf, list_item);
         if (buf) {
-                list->head = buf->link;
-                (list->count)--;
+                list_del(&buf->list_item);
+                buf_list->count--;
         }
-        if (!list->head)
-                list->tail = NULL;
-        
-        spin_unlock_irqrestore(&list->spinlock,flags);
+
+        spin_unlock_irqrestore(&buf_list->spinlock, flags);
         return buf;
-        
 }       /* end of n_hdlc_buf_get() */
 
 static char hdlc_banner[] __initdata =
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 6ee55a2d47bb..e65808c482f1 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -257,7 +257,7 @@ static void dw8250_set_termios(struct uart_port *p, struct ktermios *termios,
 {
         unsigned int baud = tty_termios_baud_rate(termios);
         struct dw8250_data *d = p->private_data;
-        unsigned int rate;
+        long rate;
         int ret;
 
         if (IS_ERR(d->clk) || !old)
@@ -265,7 +265,12 @@ static void dw8250_set_termios(struct uart_port *p, struct ktermios *termios,
 
         clk_disable_unprepare(d->clk);
         rate = clk_round_rate(d->clk, baud * 16);
-        ret = clk_set_rate(d->clk, rate);
+        if (rate < 0)
+                ret = rate;
+        else if (rate == 0)
+                ret = -ENOENT;
+        else
+                ret = clk_set_rate(d->clk, rate);
         clk_prepare_enable(d->clk);
 
         if (!ret)
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index a65fb8197aec..0e3f529d50e9 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -128,9 +128,13 @@ config SERIAL_8250_PCI
           by the parport_serial driver, enabled with CONFIG_PARPORT_SERIAL.
 
 config SERIAL_8250_EXAR
-        tristate "8250/16550 PCI device support"
-        depends on SERIAL_8250_PCI
+        tristate "8250/16550 Exar/Commtech PCI/PCIe device support"
+        depends on SERIAL_8250_PCI
         default SERIAL_8250
+        help
+          This builds support for XR17C1xx, XR17V3xx and some Commtech
+          422x PCIe serial cards that are not covered by the more generic
+          SERIAL_8250_PCI option.
 
 config SERIAL_8250_HP300
         tristate
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 8789ea423ccf..b0a377725d63 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2373,7 +2373,7 @@ static int __init pl011_console_match(struct console *co, char *name, int idx,
         if (strcmp(name, "qdf2400_e44") == 0) {
                 pr_info_once("UART: Working around QDF2400 SoC erratum 44");
                 qdf2400_e44_present = true;
-        } else if (strcmp(name, "pl011") != 0 || strcmp(name, "ttyAMA") != 0) {
+        } else if (strcmp(name, "pl011") != 0) {
                 return -ENODEV;
         }
 
@@ -2452,18 +2452,37 @@ static void pl011_early_write(struct console *con, const char *s, unsigned n)
         uart_console_write(&dev->port, s, n, pl011_putc);
 }
 
+/*
+ * On non-ACPI systems, earlycon is enabled by specifying
+ * "earlycon=pl011,<address>" on the kernel command line.
+ *
+ * On ACPI ARM64 systems, an "early" console is enabled via the SPCR table,
+ * by specifying only "earlycon" on the command line.  Because it requires
+ * SPCR, the console starts after ACPI is parsed, which is later than a
+ * traditional early console.
+ *
+ * To get the traditional early console that starts before ACPI is parsed,
+ * specify the full "earlycon=pl011,<address>" option.
+ */
 static int __init pl011_early_console_setup(struct earlycon_device *device,
                                             const char *opt)
 {
         if (!device->port.membase)
                 return -ENODEV;
 
-        device->con->write = qdf2400_e44_present ?
-                                qdf2400_e44_early_write : pl011_early_write;
+        /* On QDF2400 SOCs affected by Erratum 44, the "qdf2400_e44" must
+         * also be specified, e.g. "earlycon=pl011,<address>,qdf2400_e44".
+         */
+        if (!strcmp(device->options, "qdf2400_e44"))
+                device->con->write = qdf2400_e44_early_write;
+        else
+                device->con->write = pl011_early_write;
+
         return 0;
 }
 OF_EARLYCON_DECLARE(pl011, "arm,pl011", pl011_early_console_setup);
 OF_EARLYCON_DECLARE(pl011, "arm,sbsa-uart", pl011_early_console_setup);
+EARLYCON_DECLARE(qdf2400_e44, pl011_early_console_setup);
 
 #else
 #define AMBA_CONSOLE    NULL
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index dcebb28ffbc4..1f50a83ef958 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1951,6 +1951,11 @@ static void atmel_flush_buffer(struct uart_port *port)
                 atmel_uart_writel(port, ATMEL_PDC_TCR, 0);
                 atmel_port->pdc_tx.ofs = 0;
         }
+        /*
+         * in uart_flush_buffer(), the xmit circular buffer has just
+         * been cleared, so we have to reset tx_len accordingly.
+         */
+        atmel_port->tx_len = 0;
 }
 
 /*
@@ -2483,6 +2488,9 @@ static void atmel_console_write(struct console *co, const char *s, u_int count)
         pdc_tx = atmel_uart_readl(port, ATMEL_PDC_PTSR) & ATMEL_PDC_TXTEN;
         atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTDIS);
 
+        /* Make sure that tx path is actually able to send characters */
+        atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN);
+
         uart_console_write(port, s, count, atmel_console_putchar);
 
         /*
diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
index 6989b227d134..be94246b6fcc 100644
--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
@@ -1088,7 +1088,7 @@ static void mxs_auart_settermios(struct uart_port *u,
                                         AUART_LINECTRL_BAUD_DIV_MAX);
                 baud_max = u->uartclk * 32 / AUART_LINECTRL_BAUD_DIV_MIN;
                 baud = uart_get_baud_rate(u, termios, old, baud_min, baud_max);
-                div = u->uartclk * 32 / baud;
+                div = DIV_ROUND_CLOSEST(u->uartclk * 32, baud);
         }
 
         ctrl |= AUART_LINECTRL_BAUD_DIVFRAC(div & 0x3F);
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index b4f86c219db1..7a17aedbf902 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1031,8 +1031,10 @@ static int s3c64xx_serial_startup(struct uart_port *port)
         if (ourport->dma) {
                 ret = s3c24xx_serial_request_dma(ourport);
                 if (ret < 0) {
-                        dev_warn(port->dev, "DMA request failed\n");
-                        return ret;
+                        dev_warn(port->dev,
+                                 "DMA request failed, DMA will not be used\n");
+                        devm_kfree(port->dev, ourport->dma);
+                        ourport->dma = NULL;
                 }
         }
 
diff --git a/drivers/tty/serial/st-asc.c b/drivers/tty/serial/st-asc.c
index bcf1d33e6ffe..c334bcc59c64 100644
--- a/drivers/tty/serial/st-asc.c
+++ b/drivers/tty/serial/st-asc.c
@@ -575,12 +575,13 @@ static void asc_set_termios(struct uart_port *port, struct ktermios *termios,
                         pinctrl_select_state(ascport->pinctrl,
                                              ascport->states[NO_HW_FLOWCTRL]);
 
-                        gpiod = devm_get_gpiod_from_child(port->dev, "rts",
-                                                          &np->fwnode);
-                        if (!IS_ERR(gpiod)) {
-                                gpiod_direction_output(gpiod, 0);
+                        gpiod = devm_fwnode_get_gpiod_from_child(port->dev,
+                                                                 "rts",
+                                                                 &np->fwnode,
+                                                                 GPIOD_OUT_LOW,
+                                                                 np->name);
+                        if (!IS_ERR(gpiod))
                                 ascport->rts = gpiod;
-                        }
                 }
         }
 
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 68947f6de5ad..b0500a0a87b8 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -271,10 +271,13 @@ const struct file_operations tty_ldiscs_proc_fops = {
 
 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
 {
+        struct tty_ldisc *ld;
+
         ldsem_down_read(&tty->ldisc_sem, MAX_SCHEDULE_TIMEOUT);
-        if (!tty->ldisc)
+        ld = tty->ldisc;
+        if (!ld)
                 ldsem_up_read(&tty->ldisc_sem);
-        return tty->ldisc;
+        return ld;
 }
 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
 
@@ -489,41 +492,6 @@ static void tty_ldisc_close(struct tty_struct *tty, struct tty_ldisc *ld)
 }
 
 /**
- *      tty_ldisc_restore       -       helper for tty ldisc change
- *      @tty: tty to recover
- *      @old: previous ldisc
- *
- *      Restore the previous line discipline or N_TTY when a line discipline
- *      change fails due to an open error
- */
-
-static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
-{
-        struct tty_ldisc *new_ldisc;
-        int r;
-
-        /* There is an outstanding reference here so this is safe */
-        old = tty_ldisc_get(tty, old->ops->num);
-        WARN_ON(IS_ERR(old));
-        tty->ldisc = old;
-        tty_set_termios_ldisc(tty, old->ops->num);
-        if (tty_ldisc_open(tty, old) < 0) {
-                tty_ldisc_put(old);
-                /* This driver is always present */
-                new_ldisc = tty_ldisc_get(tty, N_TTY);
-                if (IS_ERR(new_ldisc))
-                        panic("n_tty: get");
-                tty->ldisc = new_ldisc;
-                tty_set_termios_ldisc(tty, N_TTY);
-                r = tty_ldisc_open(tty, new_ldisc);
-                if (r < 0)
-                        panic("Couldn't open N_TTY ldisc for "
-                              "%s --- error %d.",
-                              tty_name(tty), r);
-        }
-}
-
-/**
  *      tty_set_ldisc           -       set line discipline
  *      @tty: the terminal to set
  *      @ldisc: the line discipline
@@ -536,12 +504,7 @@ static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
 
 int tty_set_ldisc(struct tty_struct *tty, int disc)
 {
-        int retval;
-        struct tty_ldisc *old_ldisc, *new_ldisc;
-
-        new_ldisc = tty_ldisc_get(tty, disc);
-        if (IS_ERR(new_ldisc))
-                return PTR_ERR(new_ldisc);
+        int retval, old_disc;
 
         tty_lock(tty);
         retval = tty_ldisc_lock(tty, 5 * HZ);
@@ -554,7 +517,8 @@ int tty_set_ldisc(struct tty_struct *tty, int disc)
         }
 
         /* Check the no-op case */
-        if (tty->ldisc->ops->num == disc)
+        old_disc = tty->ldisc->ops->num;
+        if (old_disc == disc)
                 goto out;
 
         if (test_bit(TTY_HUPPED, &tty->flags)) {
@@ -563,34 +527,25 @@ int tty_set_ldisc(struct tty_struct *tty, int disc)
                 goto out;
         }
 
-        old_ldisc = tty->ldisc;
-
-        /* Shutdown the old discipline. */
-        tty_ldisc_close(tty, old_ldisc);
-
-        /* Now set up the new line discipline. */
-        tty->ldisc = new_ldisc;
-        tty_set_termios_ldisc(tty, disc);
-
-        retval = tty_ldisc_open(tty, new_ldisc);
+        retval = tty_ldisc_reinit(tty, disc);
         if (retval < 0) {
                 /* Back to the old one or N_TTY if we can't */
-                tty_ldisc_put(new_ldisc);
-                tty_ldisc_restore(tty, old_ldisc);
+                if (tty_ldisc_reinit(tty, old_disc) < 0) {
+                        pr_err("tty: TIOCSETD failed, reinitializing N_TTY\n");
+                        if (tty_ldisc_reinit(tty, N_TTY) < 0) {
+                                /* At this point we have tty->ldisc == NULL. */
+                                pr_err("tty: reinitializing N_TTY failed\n");
+                        }
+                }
         }
 
-        if (tty->ldisc->ops->num != old_ldisc->ops->num && tty->ops->set_ldisc) {
+        if (tty->ldisc && tty->ldisc->ops->num != old_disc &&
+            tty->ops->set_ldisc) {
                 down_read(&tty->termios_rwsem);
                 tty->ops->set_ldisc(tty);
                 up_read(&tty->termios_rwsem);
         }
 
-        /* At this point we hold a reference to the new ldisc and a
-           reference to the old ldisc, or we hold two references to
-           the old ldisc (if it was restored as part of error cleanup
-           above). In either case, releasing a single reference from
-           the old ldisc is correct. */
-        new_ldisc = old_ldisc;
 out:
         tty_ldisc_unlock(tty);
 
@@ -598,7 +553,6 @@ out:
            already running */
         tty_buffer_restart_work(tty->port);
 err:
-        tty_ldisc_put(new_ldisc);       /* drop the extra reference */
         tty_unlock(tty);
         return retval;
 }
@@ -659,10 +613,8 @@ int tty_ldisc_reinit(struct tty_struct *tty, int disc)
         int retval;
 
         ld = tty_ldisc_get(tty, disc);
-        if (IS_ERR(ld)) {
-                BUG_ON(disc == N_TTY);
+        if (IS_ERR(ld))
                 return PTR_ERR(ld);
-        }
 
         if (tty->ldisc) {
                 tty_ldisc_close(tty, tty->ldisc);
@@ -674,10 +626,8 @@ int tty_ldisc_reinit(struct tty_struct *tty, int disc)
         tty_set_termios_ldisc(tty, disc);
         retval = tty_ldisc_open(tty, tty->ldisc);
         if (retval) {
-                if (!WARN_ON(disc == N_TTY)) {
-                        tty_ldisc_put(tty->ldisc);
-                        tty->ldisc = NULL;
-                }
+                tty_ldisc_put(tty->ldisc);
+                tty->ldisc = NULL;
         }
         return retval;
 }
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index c5f0fc906136..8af8d9542663 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -28,7 +28,6 @@
 #include <linux/module.h>
 #include <linux/sched/signal.h>
 #include <linux/sched/debug.h>
-#include <linux/sched/debug.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
 #include <linux/mm.h>
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index f03692ec5520..8fb309a0ff6b 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1381,7 +1381,7 @@ static int usbtmc_probe(struct usb_interface *intf,
 
         dev_dbg(&intf->dev, "%s called\n", __func__);
 
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
 
@@ -1444,6 +1444,13 @@ static int usbtmc_probe(struct usb_interface *intf,
                         break;
                 }
         }
+
+        if (!data->bulk_out || !data->bulk_in) {
+                dev_err(&intf->dev, "bulk endpoints not found\n");
+                retcode = -ENODEV;
+                goto err_put;
+        }
+
         /* Find int endpoint */
         for (n = 0; n < iface_desc->desc.bNumEndpoints; n++) {
                 endpoint = &iface_desc->endpoint[n].desc;
@@ -1469,8 +1476,10 @@ static int usbtmc_probe(struct usb_interface *intf,
         if (data->iin_ep_present) {
                 /* allocate int urb */
                 data->iin_urb = usb_alloc_urb(0, GFP_KERNEL);
-                if (!data->iin_urb)
+                if (!data->iin_urb) {
+                        retcode = -ENOMEM;
                         goto error_register;
+                }
 
                 /* Protect interrupt in endpoint data until iin_urb is freed */
                 kref_get(&data->kref);
@@ -1478,8 +1487,10 @@ static int usbtmc_probe(struct usb_interface *intf,
                 /* allocate buffer for interrupt in */
                 data->iin_buffer = kmalloc(data->iin_wMaxPacketSize,
                                         GFP_KERNEL);
-                if (!data->iin_buffer)
+                if (!data->iin_buffer) {
+                        retcode = -ENOMEM;
                         goto error_register;
+                }
 
                 /* fill interrupt urb */
                 usb_fill_int_urb(data->iin_urb, data->usb_dev,
@@ -1512,6 +1523,7 @@ error_register:
         sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
         sysfs_remove_group(&intf->dev.kobj, &data_attr_grp);
         usbtmc_free_int(data);
+err_put:
         kref_put(&data->kref, usbtmc_delete);
         return retcode;
 }
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 25dbd8c7aec7..4be52c602e9b 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -280,6 +280,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
 
                         /*
                          * Adjust bInterval for quirked devices.
+                         */
+                        /*
+                         * This quirk fixes bIntervals reported in ms.
+                         */
+                        if (to_usb_device(ddev)->quirks &
+                                USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL) {
+                                n = clamp(fls(d->bInterval) + 3, i, j);
+                                i = j = n;
+                        }
+                        /*
                          * This quirk fixes bIntervals reported in
                          * linear microframes.
                          */
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 612fab6e54fb..79bdca5cb9c7 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -520,8 +520,10 @@ static int rh_call_control (struct usb_hcd *hcd, struct urb *urb)
          */
         tbuf_size =  max_t(u16, sizeof(struct usb_hub_descriptor), wLength);
         tbuf = kzalloc(tbuf_size, GFP_KERNEL);
-        if (!tbuf)
-                return -ENOMEM;
+        if (!tbuf) {
+                status = -ENOMEM;
+                goto err_alloc;
+        }
 
         bufp = tbuf;
 
@@ -734,6 +736,7 @@ error:
         }
 
         kfree(tbuf);
+ err_alloc:
 
         /* any errors get returned through the urb completion */
         spin_lock_irq(&hcd_root_hub_lock);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index f0dd08198d74..5286bf67869a 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4275,7 +4275,7 @@ static void hub_set_initial_usb2_lpm_policy(struct usb_device *udev)
         struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent);
         int connect_type = USB_PORT_CONNECT_TYPE_UNKNOWN;
 
-        if (!udev->usb2_hw_lpm_capable)
+        if (!udev->usb2_hw_lpm_capable || !udev->bos)
                 return;
 
         if (hub)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 24f9f98968a5..96b21b0dac1e 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -170,6 +170,14 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* M-Systems Flash Disk Pioneers */
         { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Baum Vario Ultra */
+        { USB_DEVICE(0x0904, 0x6101), .driver_info =
+                        USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
+        { USB_DEVICE(0x0904, 0x6102), .driver_info =
+                        USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
+        { USB_DEVICE(0x0904, 0x6103), .driver_info =
+                        USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
+
         /* Keytouch QWERTY Panel keyboard */
         { USB_DEVICE(0x0926, 0x3333), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index 2092e46b1380..f8d0747810e7 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -250,6 +250,7 @@ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap,
                 val = dwc3_omap_read_utmi_ctrl(omap);
                 val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG;
                 dwc3_omap_write_utmi_ctrl(omap, val);
+                break;
 
         case OMAP_DWC3_VBUS_OFF:
                 val = dwc3_omap_read_utmi_ctrl(omap);
@@ -392,7 +393,7 @@ static void dwc3_omap_set_utmi_mode(struct dwc3_omap *omap)
 {
         u32                     reg;
         struct device_node      *node = omap->dev->of_node;
-        int                     utmi_mode = 0;
+        u32                     utmi_mode = 0;
 
         reg = dwc3_omap_read_utmi_ctrl(omap);
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 4db97ecae885..79e7a3480d51 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -171,6 +171,7 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
                 int status)
 {
         struct dwc3                     *dwc = dep->dwc;
+        unsigned int                    unmap_after_complete = false;
 
         req->started = false;
         list_del(&req->list);
@@ -180,11 +181,19 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
         if (req->request.status == -EINPROGRESS)
                 req->request.status = status;
 
-        if (dwc->ep0_bounced && dep->number <= 1)
+        /*
+         * NOTICE we don't want to unmap before calling ->complete() if we're
+         * dealing with a bounced ep0 request. If we unmap it here, we would end
+         * up overwritting the contents of req->buf and this could confuse the
+         * gadget driver.
+         */
+        if (dwc->ep0_bounced && dep->number <= 1) {
                 dwc->ep0_bounced = false;
-
-        usb_gadget_unmap_request_by_dev(dwc->sysdev,
-                        &req->request, req->direction);
+                unmap_after_complete = true;
+        } else {
+                usb_gadget_unmap_request_by_dev(dwc->sysdev,
+                                &req->request, req->direction);
+        }
 
         trace_dwc3_gadget_giveback(req);
 
@@ -192,6 +201,10 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
         usb_gadget_giveback_request(&dep->endpoint, &req->request);
         spin_lock(&dwc->lock);
 
+        if (unmap_after_complete)
+                usb_gadget_unmap_request_by_dev(dwc->sysdev,
+                                &req->request, req->direction);
+
         if (dep->number > 1)
                 pm_runtime_put(dwc->dev);
 }
@@ -1342,6 +1355,68 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
                 if (r == req) {
                         /* wait until it is processed */
                         dwc3_stop_active_transfer(dwc, dep->number, true);
+
+                        /*
+                         * If request was already started, this means we had to
+                         * stop the transfer. With that we also need to ignore
+                         * all TRBs used by the request, however TRBs can only
+                         * be modified after completion of END_TRANSFER
+                         * command. So what we do here is that we wait for
+                         * END_TRANSFER completion and only after that, we jump
+                         * over TRBs by clearing HWO and incrementing dequeue
+                         * pointer.
+                         *
+                         * Note that we have 2 possible types of transfers here:
+                         *
+                         * i) Linear buffer request
+                         * ii) SG-list based request
+                         *
+                         * SG-list based requests will have r->num_pending_sgs
+                         * set to a valid number (> 0). Linear requests,
+                         * normally use a single TRB.
+                         *
+                         * For each of these two cases, if r->unaligned flag is
+                         * set, one extra TRB has been used to align transfer
+                         * size to wMaxPacketSize.
+                         *
+                         * All of these cases need to be taken into
+                         * consideration so we don't mess up our TRB ring
+                         * pointers.
+                         */
+                        wait_event_lock_irq(dep->wait_end_transfer,
+                                        !(dep->flags & DWC3_EP_END_TRANSFER_PENDING),
+                                        dwc->lock);
+
+                        if (!r->trb)
+                                goto out1;
+
+                        if (r->num_pending_sgs) {
+                                struct dwc3_trb *trb;
+                                int i = 0;
+
+                                for (i = 0; i < r->num_pending_sgs; i++) {
+                                        trb = r->trb + i;
+                                        trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                        dwc3_ep_inc_deq(dep);
+                                }
+
+                                if (r->unaligned) {
+                                        trb = r->trb + r->num_pending_sgs + 1;
+                                        trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                        dwc3_ep_inc_deq(dep);
+                                }
+                        } else {
+                                struct dwc3_trb *trb = r->trb;
+
+                                trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                dwc3_ep_inc_deq(dep);
+
+                                if (r->unaligned) {
+                                        trb = r->trb + 1;
+                                        trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                        dwc3_ep_inc_deq(dep);
+                                }
+                        }
                         goto out1;
                 }
                 dev_err(dwc->dev, "request %p was not queued to %s\n",
@@ -1352,6 +1427,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
 
 out1:
         /* giveback the request */
+        dep->queued_requests--;
         dwc3_gadget_giveback(dep, req, -ECONNRESET);
 
 out0:
@@ -2126,12 +2202,12 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
                 return 1;
         }
 
-        if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
-                return 1;
-
         count = trb->size & DWC3_TRB_SIZE_MASK;
         req->remaining += count;
 
+        if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
+                return 1;
+
         if (dep->direction) {
                 if (count) {
                         trb_status = DWC3_TRB_SIZE_TRBSTS(trb->size);
@@ -3228,15 +3304,10 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
 
 int dwc3_gadget_suspend(struct dwc3 *dwc)
 {
-        int ret;
-
         if (!dwc->gadget_driver)
                 return 0;
 
-        ret = dwc3_gadget_run_stop(dwc, false, false);
-        if (ret < 0)
-                return ret;
-
+        dwc3_gadget_run_stop(dwc, false, false);
         dwc3_disconnect_gadget(dwc);
         __dwc3_gadget_stop(dwc);
 
diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h
index 3129bcf74d7d..265e223ab645 100644
--- a/drivers/usb/dwc3/gadget.h
+++ b/drivers/usb/dwc3/gadget.h
@@ -28,23 +28,23 @@ struct dwc3;
 #define gadget_to_dwc(g)        (container_of(g, struct dwc3, gadget))
 
 /* DEPCFG parameter 1 */
-#define DWC3_DEPCFG_INT_NUM(n)          ((n) << 0)
+#define DWC3_DEPCFG_INT_NUM(n)          (((n) & 0x1f) << 0)
 #define DWC3_DEPCFG_XFER_COMPLETE_EN    (1 << 8)
 #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN (1 << 9)
 #define DWC3_DEPCFG_XFER_NOT_READY_EN   (1 << 10)
 #define DWC3_DEPCFG_FIFO_ERROR_EN       (1 << 11)
 #define DWC3_DEPCFG_STREAM_EVENT_EN     (1 << 13)
-#define DWC3_DEPCFG_BINTERVAL_M1(n)     ((n) << 16)
+#define DWC3_DEPCFG_BINTERVAL_M1(n)     (((n) & 0xff) << 16)
 #define DWC3_DEPCFG_STREAM_CAPABLE      (1 << 24)
-#define DWC3_DEPCFG_EP_NUMBER(n)        ((n) << 25)
+#define DWC3_DEPCFG_EP_NUMBER(n)        (((n) & 0x1f) << 25)
 #define DWC3_DEPCFG_BULK_BASED          (1 << 30)
 #define DWC3_DEPCFG_FIFO_BASED          (1 << 31)
 
 /* DEPCFG parameter 0 */
-#define DWC3_DEPCFG_EP_TYPE(n)          ((n) << 1)
-#define DWC3_DEPCFG_MAX_PACKET_SIZE(n)  ((n) << 3)
-#define DWC3_DEPCFG_FIFO_NUMBER(n)      ((n) << 17)
-#define DWC3_DEPCFG_BURST_SIZE(n)       ((n) << 22)
+#define DWC3_DEPCFG_EP_TYPE(n)          (((n) & 0x3) << 1)
+#define DWC3_DEPCFG_MAX_PACKET_SIZE(n)  (((n) & 0x7ff) << 3)
+#define DWC3_DEPCFG_FIFO_NUMBER(n)      (((n) & 0x1f) << 17)
+#define DWC3_DEPCFG_BURST_SIZE(n)       (((n) & 0xf) << 22)
 #define DWC3_DEPCFG_DATA_SEQ_NUM(n)     ((n) << 26)
 /* This applies for core versions earlier than 1.94a */
 #define DWC3_DEPCFG_IGN_SEQ_NUM         (1 << 31)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 78c44979dde3..cbff3b02840d 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -269,6 +269,7 @@ static ssize_t gadget_dev_desc_UDC_store(struct config_item *item,
                 ret = unregister_gadget(gi);
                 if (ret)
                         goto err;
+                kfree(name);
         } else {
                 if (gi->composite.gadget_driver.udc_name) {
                         ret = -EBUSY;
diff --git a/drivers/usb/gadget/function/f_acm.c b/drivers/usb/gadget/function/f_acm.c
index a30766ca4226..5e3828d9dac7 100644
--- a/drivers/usb/gadget/function/f_acm.c
+++ b/drivers/usb/gadget/function/f_acm.c
@@ -535,13 +535,15 @@ static int acm_notify_serial_state(struct f_acm *acm)
 {
         struct usb_composite_dev *cdev = acm->port.func.config->cdev;
         int                     status;
+        __le16                  serial_state;
 
         spin_lock(&acm->lock);
         if (acm->notify_req) {
                 dev_dbg(&cdev->gadget->dev, "acm ttyGS%d serial state %04x\n",
                         acm->port_num, acm->serial_state);
+                serial_state = cpu_to_le16(acm->serial_state);
                 status = acm_cdc_notify(acm, USB_CDC_NOTIFY_SERIAL_STATE,
-                                0, &acm->serial_state, sizeof(acm->serial_state));
+                                0, &serial_state, sizeof(acm->serial_state));
         } else {
                 acm->pending = true;
                 status = 0;
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index a5b7cd615698..a0085571824d 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1834,11 +1834,14 @@ static int ffs_func_eps_enable(struct ffs_function *func)
         spin_lock_irqsave(&func->ffs->eps_lock, flags);
         while(count--) {
                 struct usb_endpoint_descriptor *ds;
+                struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
+                int needs_comp_desc = false;
                 int desc_idx;
 
-                if (ffs->gadget->speed == USB_SPEED_SUPER)
+                if (ffs->gadget->speed == USB_SPEED_SUPER) {
                         desc_idx = 2;
-                else if (ffs->gadget->speed == USB_SPEED_HIGH)
+                        needs_comp_desc = true;
+                } else if (ffs->gadget->speed == USB_SPEED_HIGH)
                         desc_idx = 1;
                 else
                         desc_idx = 0;
@@ -1855,6 +1858,14 @@ static int ffs_func_eps_enable(struct ffs_function *func)
 
                 ep->ep->driver_data = ep;
                 ep->ep->desc = ds;
+
+                comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
+                                USB_DT_ENDPOINT_SIZE);
+                ep->ep->maxburst = comp_desc->bMaxBurst + 1;
+
+                if (needs_comp_desc)
+                        ep->ep->comp_desc = comp_desc;
+
                 ret = usb_ep_enable(ep->ep);
                 if (likely(!ret)) {
                         epfile->ep = ep;
@@ -2253,7 +2264,7 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
 
                 if (len < sizeof(*d) ||
                     d->bFirstInterfaceNumber >= ffs->interfaces_count ||
-                    d->Reserved1)
+                    !d->Reserved1)
                         return -EINVAL;
                 for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
                         if (d->Reserved2[i])
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 89b48bcc377a..5eea44823ca0 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -367,7 +367,7 @@ try_again:
         count  = min_t(unsigned, count, hidg->report_length);
 
         spin_unlock_irqrestore(&hidg->write_spinlock, flags);
-        status = copy_from_user(hidg->req->buf, buffer, count);
+        status = copy_from_user(req->buf, buffer, count);
 
         if (status != 0) {
                 ERROR(hidg->func.config->cdev,
@@ -378,9 +378,9 @@ try_again:
 
         spin_lock_irqsave(&hidg->write_spinlock, flags);
 
-        /* we our function has been disabled by host */
+        /* when our function has been disabled by host */
         if (!hidg->req) {
-                free_ep_req(hidg->in_ep, hidg->req);
+                free_ep_req(hidg->in_ep, req);
                 /*
                  * TODO
                  * Should we fail with error here?
@@ -394,7 +394,7 @@ try_again:
         req->complete = f_hidg_req_complete;
         req->context  = hidg;
 
-        status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC);
+        status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);
         if (status < 0) {
                 ERROR(hidg->func.config->cdev,
                         "usb_ep_queue error on int endpoint %zd\n", status);
diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
index 27ed51b5082f..f8a1881609a2 100644
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -258,13 +258,6 @@ uvc_function_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
         memcpy(&uvc_event->req, ctrl, sizeof(uvc_event->req));
         v4l2_event_queue(&uvc->vdev, &v4l2_event);
 
-        /* Pass additional setup data to userspace */
-        if (uvc->event_setup_out && uvc->event_length) {
-                uvc->control_req->length = uvc->event_length;
-                return usb_ep_queue(uvc->func.config->cdev->gadget->ep0,
-                        uvc->control_req, GFP_ATOMIC);
-        }
-
         return 0;
 }
 
@@ -601,6 +594,14 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
         opts->streaming_maxpacket = clamp(opts->streaming_maxpacket, 1U, 3072U);
         opts->streaming_maxburst = min(opts->streaming_maxburst, 15U);
 
+        /* For SS, wMaxPacketSize has to be 1024 if bMaxBurst is not 0 */
+        if (opts->streaming_maxburst &&
+            (opts->streaming_maxpacket % 1024) != 0) {
+                opts->streaming_maxpacket = roundup(opts->streaming_maxpacket, 1024);
+                INFO(cdev, "overriding streaming_maxpacket to %d\n",
+                     opts->streaming_maxpacket);
+        }
+
         /* Fill in the FS/HS/SS Video Streaming specific descriptors from the
          * module parameters.
          *
@@ -632,7 +633,7 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
         uvc_ss_streaming_comp.bMaxBurst = opts->streaming_maxburst;
         uvc_ss_streaming_comp.wBytesPerInterval =
                 cpu_to_le16(max_packet_size * max_packet_mult *
-                            opts->streaming_maxburst);
+                            (opts->streaming_maxburst + 1));
 
         /* Allocate endpoints. */
         ep = usb_ep_autoconfig(cdev->gadget, &uvc_control_ep);
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index a2615d64d07c..a2c916869293 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -84,8 +84,7 @@ static int ep_open(struct inode *, struct file *);
 
 /* /dev/gadget/$CHIP represents ep0 and the whole device */
 enum ep0_state {
-        /* DISBLED is the initial state.
-         */
+        /* DISABLED is the initial state. */
         STATE_DEV_DISABLED = 0,
 
         /* Only one open() of /dev/gadget/$CHIP; only one file tracks
@@ -1782,8 +1781,10 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 
         spin_lock_irq (&dev->lock);
         value = -EINVAL;
-        if (dev->buf)
+        if (dev->buf) {
+                kfree(kbuf);
                 goto fail;
+        }
         dev->buf = kbuf;
 
         /* full or low speed config */
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 11bbce28bc23..2035906b8ced 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -610,7 +610,7 @@ usba_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
 {
         struct usba_ep *ep = to_usba_ep(_ep);
         struct usba_udc *udc = ep->udc;
-        unsigned long flags, ept_cfg, maxpacket;
+        unsigned long flags, maxpacket;
         unsigned int nr_trans;
 
         DBG(DBG_GADGET, "%s: ep_enable: desc=%p\n", ep->ep.name, desc);
@@ -630,7 +630,7 @@ usba_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
         ep->is_in = 0;
 
         DBG(DBG_ERR, "%s: EPT_CFG = 0x%lx (maxpacket = %lu)\n",
-                        ep->ep.name, ept_cfg, maxpacket);
+                        ep->ep.name, ep->ept_cfg, maxpacket);
 
         if (usb_endpoint_dir_in(desc)) {
                 ep->is_in = 1;
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index c60abe3a68f9..8cabc5944d5f 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -1031,6 +1031,8 @@ static int dummy_udc_probe(struct platform_device *pdev)
         int             rc;
 
         dum = *((void **)dev_get_platdata(&pdev->dev));
+        /* Clear usb_gadget region for new registration to udc-core */
+        memzero_explicit(&dum->gadget, sizeof(struct usb_gadget));
         dum->gadget.name = gadget_name;
         dum->gadget.ops = &dummy_ops;
         dum->gadget.max_speed = USB_SPEED_SUPER;
diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index 85504419ab31..3828c2ec8623 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -1146,15 +1146,15 @@ static int scan_dma_completions(struct net2280_ep *ep)
          */
         while (!list_empty(&ep->queue)) {
                 struct net2280_request  *req;
-                u32                     tmp;
+                u32 req_dma_count;
 
                 req = list_entry(ep->queue.next,
                                 struct net2280_request, queue);
                 if (!req->valid)
                         break;
                 rmb();
-                tmp = le32_to_cpup(&req->td->dmacount);
-                if ((tmp & BIT(VALID_BIT)) != 0)
+                req_dma_count = le32_to_cpup(&req->td->dmacount);
+                if ((req_dma_count & BIT(VALID_BIT)) != 0)
                         break;
 
                 /* SHORT_PACKET_TRANSFERRED_INTERRUPT handles "usb-short"
@@ -1163,40 +1163,41 @@ static int scan_dma_completions(struct net2280_ep *ep)
                  */
                 if (unlikely(req->td->dmadesc == 0)) {
                         /* paranoia */
-                        tmp = readl(&ep->dma->dmacount);
-                        if (tmp & DMA_BYTE_COUNT_MASK)
+                        u32 const ep_dmacount = readl(&ep->dma->dmacount);
+
+                        if (ep_dmacount & DMA_BYTE_COUNT_MASK)
                                 break;
                         /* single transfer mode */
-                        dma_done(ep, req, tmp, 0);
+                        dma_done(ep, req, req_dma_count, 0);
                         num_completed++;
                         break;
                 } else if (!ep->is_in &&
                            (req->req.length % ep->ep.maxpacket) &&
                            !(ep->dev->quirks & PLX_PCIE)) {
 
-                        tmp = readl(&ep->regs->ep_stat);
+                        u32 const ep_stat = readl(&ep->regs->ep_stat);
                         /* AVOID TROUBLE HERE by not issuing short reads from
                          * your gadget driver.  That helps avoids errata 0121,
                          * 0122, and 0124; not all cases trigger the warning.
                          */
-                        if ((tmp & BIT(NAK_OUT_PACKETS)) == 0) {
+                        if ((ep_stat & BIT(NAK_OUT_PACKETS)) == 0) {
                                 ep_warn(ep->dev, "%s lost packet sync!\n",
                                                 ep->ep.name);
                                 req->req.status = -EOVERFLOW;
                         } else {
-                                tmp = readl(&ep->regs->ep_avail);
-                                if (tmp) {
+                                u32 const ep_avail = readl(&ep->regs->ep_avail);
+                                if (ep_avail) {
                                         /* fifo gets flushed later */
                                         ep->out_overflow = 1;
                                         ep_dbg(ep->dev,
                                                 "%s dma, discard %d len %d\n",
-                                                ep->ep.name, tmp,
+                                                ep->ep.name, ep_avail,
                                                 req->req.length);
                                         req->req.status = -EOVERFLOW;
                                 }
                         }
                 }
-                dma_done(ep, req, tmp, 0);
+                dma_done(ep, req, req_dma_count, 0);
                 num_completed++;
         }
 
diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index a97da645c1b9..8a365aad66fe 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev,
                 td = phys_to_virt(addr);
                 addr2 = (dma_addr_t)td->next;
                 pci_pool_free(dev->data_requests, td, addr);
-                td->next = 0x00;
                 addr = addr2;
         }
         req->chain_len = 1;
diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c
index e1335ad5bce9..832c4fdbe985 100644
--- a/drivers/usb/gadget/udc/pxa27x_udc.c
+++ b/drivers/usb/gadget/udc/pxa27x_udc.c
@@ -2534,9 +2534,10 @@ static int pxa_udc_remove(struct platform_device *_dev)
         usb_del_gadget_udc(&udc->gadget);
         pxa_cleanup_debugfs(udc);
 
-        if (!IS_ERR_OR_NULL(udc->transceiver))
+        if (!IS_ERR_OR_NULL(udc->transceiver)) {
                 usb_unregister_notifier(udc->transceiver, &pxa27x_udc_phy);
-        usb_put_phy(udc->transceiver);
+                usb_put_phy(udc->transceiver);
+        }
 
         udc->transceiver = NULL;
         the_controller = NULL;
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 414e3c376dbb..5302f988e7e6 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -350,7 +350,7 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 
                 case USB_PORT_FEAT_SUSPEND:
                         dev_dbg(hcd->self.controller, "SetPortFeat: SUSPEND\n");
-                        if (valid_port(wIndex)) {
+                        if (valid_port(wIndex) && ohci_at91->sfr_regmap) {
                                 ohci_at91_port_suspend(ohci_at91->sfr_regmap,
                                                        1);
                                 return 0;
@@ -393,7 +393,7 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 
                 case USB_PORT_FEAT_SUSPEND:
                         dev_dbg(hcd->self.controller, "ClearPortFeature: SUSPEND\n");
-                        if (valid_port(wIndex)) {
+                        if (valid_port(wIndex) && ohci_at91->sfr_regmap) {
                                 ohci_at91_port_suspend(ohci_at91->sfr_regmap,
                                                        0);
                                 return 0;
diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c
index 363d125300ea..2b4a00fa735d 100644
--- a/drivers/usb/host/xhci-dbg.c
+++ b/drivers/usb/host/xhci-dbg.c
@@ -109,7 +109,7 @@ static void xhci_print_cap_regs(struct xhci_hcd *xhci)
         xhci_dbg(xhci, "RTSOFF 0x%x:\n", temp & RTSOFF_MASK);
 
         /* xhci 1.1 controllers have the HCCPARAMS2 register */
-        if (hci_version > 100) {
+        if (hci_version > 0x100) {
                 temp = readl(&xhci->cap_regs->hcc_params2);
                 xhci_dbg(xhci, "HCC PARAMS2 0x%x:\n", (unsigned int) temp);
                 xhci_dbg(xhci, "  HC %s Force save context capability",
diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
index 9066ec9e0c2e..67d5dc79b6b5 100644
--- a/drivers/usb/host/xhci-mtk.c
+++ b/drivers/usb/host/xhci-mtk.c
@@ -382,7 +382,6 @@ static int usb_wakeup_of_property_parse(struct xhci_hcd_mtk *mtk,
 
 static int xhci_mtk_setup(struct usb_hcd *hcd);
 static const struct xhci_driver_overrides xhci_mtk_overrides __initconst = {
-        .extra_priv_size = sizeof(struct xhci_hcd),
         .reset = xhci_mtk_setup,
 };
 
@@ -678,13 +677,13 @@ static int xhci_mtk_probe(struct platform_device *pdev)
                 goto power_off_phys;
         }
 
-        if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
-                xhci->shared_hcd->can_do_streams = 1;
-
         ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
         if (ret)
                 goto put_usb3_hcd;
 
+        if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
+                xhci->shared_hcd->can_do_streams = 1;
+
         ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED);
         if (ret)
                 goto dealloc_usb2_hcd;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 6d33b42ffcf5..6ed468fa7d5e 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -286,6 +286,8 @@ static int xhci_plat_remove(struct platform_device *dev)
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         struct clk *clk = xhci->clk;
 
+        xhci->xhc_state |= XHCI_STATE_REMOVING;
+
         usb_remove_hcd(xhci->shared_hcd);
         usb_phy_shutdown(hcd->usb_phy);
 
@@ -342,6 +344,7 @@ MODULE_DEVICE_TABLE(acpi, usb_xhci_acpi_match);
 static struct platform_driver usb_xhci_driver = {
         .probe  = xhci_plat_probe,
         .remove = xhci_plat_remove,
+        .shutdown       = usb_hcd_platform_shutdown,
         .driver = {
                 .name = "xhci-hcd",
                 .pm = DEV_PM_OPS,
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index d9936c771fa0..a3309aa02993 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1989,6 +1989,9 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 case TRB_NORMAL:
                         td->urb->actual_length = requested - remaining;
                         goto finish_td;
+                case TRB_STATUS:
+                        td->urb->actual_length = requested;
+                        goto finish_td;
                 default:
                         xhci_warn(xhci, "WARN: unexpected TRB Type %d\n",
                                   trb_type);
diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
index a59fafb4b329..74436f8ca538 100644
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -1308,7 +1308,6 @@ static int tegra_xhci_setup(struct usb_hcd *hcd)
 }
 
 static const struct xhci_driver_overrides tegra_xhci_overrides __initconst = {
-        .extra_priv_size = sizeof(struct xhci_hcd),
         .reset = tegra_xhci_setup,
 };
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6d6c46000e56..953fd8f62df0 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -868,7 +868,7 @@ static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
 
         spin_lock_irqsave(&xhci->lock, flags);
 
-        /* disble usb3 ports Wake bits*/
+        /* disable usb3 ports Wake bits */
         port_index = xhci->num_usb3_ports;
         port_array = xhci->usb3_ports;
         while (port_index--) {
@@ -879,7 +879,7 @@ static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
                         writel(t2, port_array[port_index]);
         }
 
-        /* disble usb2 ports Wake bits*/
+        /* disable usb2 ports Wake bits */
         port_index = xhci->num_usb2_ports;
         port_array = xhci->usb2_ports;
         while (port_index--) {
@@ -1477,6 +1477,7 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
         struct xhci_ring *ep_ring;
         struct xhci_virt_ep *ep;
         struct xhci_command *command;
+        struct xhci_virt_device *vdev;
 
         xhci = hcd_to_xhci(hcd);
         spin_lock_irqsave(&xhci->lock, flags);
@@ -1485,15 +1486,27 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 
         /* Make sure the URB hasn't completed or been unlinked already */
         ret = usb_hcd_check_unlink_urb(hcd, urb, status);
-        if (ret || !urb->hcpriv)
+        if (ret)
                 goto done;
+
+        /* give back URB now if we can't queue it for cancel */
+        vdev = xhci->devs[urb->dev->slot_id];
+        urb_priv = urb->hcpriv;
+        if (!vdev || !urb_priv)
+                goto err_giveback;
+
+        ep_index = xhci_get_endpoint_index(&urb->ep->desc);
+        ep = &vdev->eps[ep_index];
+        ep_ring = xhci_urb_to_transfer_ring(xhci, urb);
+        if (!ep || !ep_ring)
+                goto err_giveback;
+
         temp = readl(&xhci->op_regs->status);
         if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_HALTED)) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                                 "HW died, freeing TD.");
-                urb_priv = urb->hcpriv;
                 for (i = urb_priv->num_tds_done;
-                     i < urb_priv->num_tds && xhci->devs[urb->dev->slot_id];
+                     i < urb_priv->num_tds;
                      i++) {
                         td = &urb_priv->td[i];
                         if (!list_empty(&td->td_list))
@@ -1501,23 +1514,9 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                         if (!list_empty(&td->cancelled_td_list))
                                 list_del_init(&td->cancelled_td_list);
                 }
-
-                usb_hcd_unlink_urb_from_ep(hcd, urb);
-                spin_unlock_irqrestore(&xhci->lock, flags);
-                usb_hcd_giveback_urb(hcd, urb, -ESHUTDOWN);
-                xhci_urb_free_priv(urb_priv);
-                return ret;
+                goto err_giveback;
         }
 
-        ep_index = xhci_get_endpoint_index(&urb->ep->desc);
-        ep = &xhci->devs[urb->dev->slot_id]->eps[ep_index];
-        ep_ring = xhci_urb_to_transfer_ring(xhci, urb);
-        if (!ep_ring) {
-                ret = -EINVAL;
-                goto done;
-        }
-
-        urb_priv = urb->hcpriv;
         i = urb_priv->num_tds_done;
         if (i < urb_priv->num_tds)
                 xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
@@ -1554,6 +1553,14 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 done:
         spin_unlock_irqrestore(&xhci->lock, flags);
         return ret;
+
+err_giveback:
+        if (urb_priv)
+                xhci_urb_free_priv(urb_priv);
+        usb_hcd_unlink_urb_from_ep(hcd, urb);
+        spin_unlock_irqrestore(&xhci->lock, flags);
+        usb_hcd_giveback_urb(hcd, urb, -ESHUTDOWN);
+        return ret;
 }
 
 /* Drop an endpoint from a new bandwidth configuration for this device.
diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c
index 8b9fd7534f69..502bfe30a077 100644
--- a/drivers/usb/misc/idmouse.c
+++ b/drivers/usb/misc/idmouse.c
@@ -347,6 +347,9 @@ static int idmouse_probe(struct usb_interface *interface,
         if (iface_desc->desc.bInterfaceClass != 0x0A)
                 return -ENODEV;
 
+        if (iface_desc->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         /* allocate memory for our device state and initialize it */
         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
         if (dev == NULL)
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 095778ff984d..37c63cb39714 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -781,12 +781,6 @@ static int iowarrior_probe(struct usb_interface *interface,
         iface_desc = interface->cur_altsetting;
         dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
 
-        if (iface_desc->desc.bNumEndpoints < 1) {
-                dev_err(&interface->dev, "Invalid number of endpoints\n");
-                retval = -EINVAL;
-                goto error;
-        }
-
         /* set up the endpoint information */
         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
                 endpoint = &iface_desc->endpoint[i].desc;
@@ -797,6 +791,21 @@ static int iowarrior_probe(struct usb_interface *interface,
                         /* this one will match for the IOWarrior56 only */
                         dev->int_out_endpoint = endpoint;
         }
+
+        if (!dev->int_in_endpoint) {
+                dev_err(&interface->dev, "no interrupt-in endpoint found\n");
+                retval = -ENODEV;
+                goto error;
+        }
+
+        if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) {
+                if (!dev->int_out_endpoint) {
+                        dev_err(&interface->dev, "no interrupt-out endpoint found\n");
+                        retval = -ENODEV;
+                        goto error;
+                }
+        }
+
         /* we have to check the report_size often, so remember it in the endianness suitable for our machine */
         dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);
         if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) &&
diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c
index 77176511658f..d3d124753266 100644
--- a/drivers/usb/misc/lvstest.c
+++ b/drivers/usb/misc/lvstest.c
@@ -366,6 +366,10 @@ static int lvs_rh_probe(struct usb_interface *intf,
 
         hdev = interface_to_usbdev(intf);
         desc = intf->cur_altsetting;
+
+        if (desc->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         endpoint = &desc->endpoint[0].desc;
 
         /* valid only for SS root hub */
diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
index 4e18600dc9b4..91f66d68bcb7 100644
--- a/drivers/usb/misc/usb251xb.c
+++ b/drivers/usb/misc/usb251xb.c
@@ -375,18 +375,24 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
         if (of_get_property(np, "dynamic-power-switching", NULL))
                 hub->conf_data2 |= BIT(7);
 
-        if (of_get_property(np, "oc-delay-100us", NULL)) {
-                hub->conf_data2 &= ~BIT(5);
-                hub->conf_data2 &= ~BIT(4);
-        } else if (of_get_property(np, "oc-delay-4ms", NULL)) {
-                hub->conf_data2 &= ~BIT(5);
-                hub->conf_data2 |= BIT(4);
-        } else if (of_get_property(np, "oc-delay-8ms", NULL)) {
-                hub->conf_data2 |= BIT(5);
-                hub->conf_data2 &= ~BIT(4);
-        } else if (of_get_property(np, "oc-delay-16ms", NULL)) {
-                hub->conf_data2 |= BIT(5);
-                hub->conf_data2 |= BIT(4);
+        if (!of_property_read_u32(np, "oc-delay-us", property_u32)) {
+                if (*property_u32 == 100) {
+                        /* 100 us*/
+                        hub->conf_data2 &= ~BIT(5);
+                        hub->conf_data2 &= ~BIT(4);
+                } else if (*property_u32 == 4000) {
+                        /* 4 ms */
+                        hub->conf_data2 &= ~BIT(5);
+                        hub->conf_data2 |= BIT(4);
+                } else if (*property_u32 == 16000) {
+                        /* 16 ms */
+                        hub->conf_data2 |= BIT(5);
+                        hub->conf_data2 |= BIT(4);
+                } else {
+                        /* 8 ms (DEFAULT) */
+                        hub->conf_data2 |= BIT(5);
+                        hub->conf_data2 &= ~BIT(4);
+                }
         }
 
         if (of_get_property(np, "compound-device", NULL))
@@ -432,30 +438,9 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
                 }
         }
 
-        hub->max_power_sp = USB251XB_DEF_MAX_POWER_SELF;
-        if (!of_property_read_u32(np, "max-sp-power", property_u32))
-                hub->max_power_sp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                          250);
-
-        hub->max_power_bp = USB251XB_DEF_MAX_POWER_BUS;
-        if (!of_property_read_u32(np, "max-bp-power", property_u32))
-                hub->max_power_bp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                          250);
-
-        hub->max_current_sp = USB251XB_DEF_MAX_CURRENT_SELF;
-        if (!of_property_read_u32(np, "max-sp-current", property_u32))
-                hub->max_current_sp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                            250);
-
-        hub->max_current_bp = USB251XB_DEF_MAX_CURRENT_BUS;
-        if (!of_property_read_u32(np, "max-bp-current", property_u32))
-                hub->max_current_bp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                            250);
-
         hub->power_on_time = USB251XB_DEF_POWER_ON_TIME;
-        if (!of_property_read_u32(np, "power-on-time", property_u32))
-                hub->power_on_time = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                           255);
+        if (!of_property_read_u32(np, "power-on-time-ms", property_u32))
+                hub->power_on_time = min_t(u8, *property_u32 / 2, 255);
 
         if (of_property_read_u16_array(np, "language-id", &hub->lang_id, 1))
                 hub->lang_id = USB251XB_DEF_LANGUAGE_ID;
@@ -492,6 +477,10 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
         /* The following parameters are currently not exposed to devicetree, but
          * may be as soon as needed.
          */
+        hub->max_power_sp = USB251XB_DEF_MAX_POWER_SELF;
+        hub->max_power_bp = USB251XB_DEF_MAX_POWER_BUS;
+        hub->max_current_sp = USB251XB_DEF_MAX_CURRENT_SELF;
+        hub->max_current_bp = USB251XB_DEF_MAX_CURRENT_BUS;
         hub->bat_charge_en = USB251XB_DEF_BATTERY_CHARGING_ENABLE;
         hub->boost_up = USB251XB_DEF_BOOST_UP;
         hub->boost_x = USB251XB_DEF_BOOST_X;
diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index e45a3a680db8..07014cad6dbe 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -709,6 +709,11 @@ static int uss720_probe(struct usb_interface *intf,
 
         interface = intf->cur_altsetting;
 
+        if (interface->desc.bNumEndpoints < 3) {
+                usb_put_dev(usbdev);
+                return -ENODEV;
+        }
+
         /*
          * Allocate parport interface 
          */
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index d8bae6ca8904..0c3664ab705e 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2490,8 +2490,8 @@ static int musb_remove(struct platform_device *pdev)
         musb_host_cleanup(musb);
         musb_gadget_cleanup(musb);
 
-        spin_lock_irqsave(&musb->lock, flags);
         musb_platform_disable(musb);
+        spin_lock_irqsave(&musb->lock, flags);
         musb_disable_interrupts(musb);
         musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
         spin_unlock_irqrestore(&musb->lock, flags);
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index 00e272bfee39..355655f8a3fb 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -238,8 +238,27 @@ static void cppi41_dma_callback(void *private_data,
                         transferred < cppi41_channel->packet_sz)
                 cppi41_channel->prog_len = 0;
 
-        if (cppi41_channel->is_tx)
-                empty = musb_is_tx_fifo_empty(hw_ep);
+        if (cppi41_channel->is_tx) {
+                u8 type;
+
+                if (is_host_active(musb))
+                        type = hw_ep->out_qh->type;
+                else
+                        type = hw_ep->ep_in.type;
+
+                if (type == USB_ENDPOINT_XFER_ISOC)
+                        /*
+                         * Don't use the early-TX-interrupt workaround below
+                         * for Isoch transfter. Since Isoch are periodic
+                         * transfer, by the time the next transfer is
+                         * scheduled, the current one should be done already.
+                         *
+                         * This avoids audio playback underrun issue.
+                         */
+                        empty = true;
+                else
+                        empty = musb_is_tx_fifo_empty(hw_ep);
+        }
 
         if (!cppi41_channel->is_tx || empty) {
                 cppi41_trans_done(cppi41_channel);
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 7c047c4a2565..9c7ee26ef388 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -933,7 +933,7 @@ static int dsps_probe(struct platform_device *pdev)
         if (usb_get_dr_mode(&pdev->dev) == USB_DR_MODE_PERIPHERAL) {
                 ret = dsps_setup_optional_vbus_irq(pdev, glue);
                 if (ret)
-                        return ret;
+                        goto err_iounmap;
         }
 
         platform_set_drvdata(pdev, glue);
@@ -946,6 +946,8 @@ static int dsps_probe(struct platform_device *pdev)
 
 err:
         pm_runtime_disable(&pdev->dev);
+err_iounmap:
+        iounmap(glue->usbss_base);
         return ret;
 }
 
@@ -956,6 +958,7 @@ static int dsps_remove(struct platform_device *pdev)
         platform_device_unregister(glue->musb);
 
         pm_runtime_disable(&pdev->dev);
+        iounmap(glue->usbss_base);
 
         return 0;
 }
diff --git a/drivers/usb/phy/phy-isp1301.c b/drivers/usb/phy/phy-isp1301.c
index db68156568e6..f333024660b4 100644
--- a/drivers/usb/phy/phy-isp1301.c
+++ b/drivers/usb/phy/phy-isp1301.c
@@ -33,6 +33,12 @@ static const struct i2c_device_id isp1301_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, isp1301_id);
 
+static const struct of_device_id isp1301_of_match[] = {
+        {.compatible = "nxp,isp1301" },
+        { },
+};
+MODULE_DEVICE_TABLE(of, isp1301_of_match);
+
 static struct i2c_client *isp1301_i2c_client;
 
 static int __isp1301_write(struct isp1301 *isp, u8 reg, u8 value, u8 clear)
@@ -130,6 +136,7 @@ static int isp1301_remove(struct i2c_client *client)
 static struct i2c_driver isp1301_driver = {
         .driver = {
                 .name = DRV_NAME,
+                .of_match_table = isp1301_of_match,
         },
         .probe = isp1301_probe,
         .remove = isp1301_remove,
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index ab78111e0968..6537d3ca2797 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -1500,7 +1500,7 @@ static int digi_read_oob_callback(struct urb *urb)
                 return -1;
 
         /* handle each oob command */
-        for (i = 0; i < urb->actual_length - 4; i += 4) {
+        for (i = 0; i < urb->actual_length - 3; i += 4) {
                 opcode = buf[i];
                 line = buf[i + 1];
                 status = buf[i + 2];
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index ceaeebaa6f90..a76b95d32157 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1674,6 +1674,12 @@ static void edge_interrupt_callback(struct urb *urb)
         function    = TIUMP_GET_FUNC_FROM_CODE(data[0]);
         dev_dbg(dev, "%s - port_number %d, function %d, info 0x%x\n", __func__,
                 port_number, function, data[1]);
+
+        if (port_number >= edge_serial->serial->num_ports) {
+                dev_err(dev, "bad port number %d\n", port_number);
+                goto exit;
+        }
+
         port = edge_serial->serial->port[port_number];
         edge_port = usb_get_serial_port_data(port);
         if (!edge_port) {
@@ -1755,7 +1761,7 @@ static void edge_bulk_in_callback(struct urb *urb)
 
         port_number = edge_port->port->port_number;
 
-        if (edge_port->lsr_event) {
+        if (urb->actual_length > 0 && edge_port->lsr_event) {
                 edge_port->lsr_event = 0;
                 dev_dbg(dev, "%s ===== Port %u LSR Status = %02x, Data = %02x ======\n",
                         __func__, port_number, edge_port->lsr_mask, *data);
diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
index a180b17d2432..dd706953b466 100644
--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -31,7 +31,6 @@
 #define BT_IGNITIONPRO_ID       0x2000
 
 /* function prototypes */
-static int  omninet_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void omninet_process_read_urb(struct urb *urb);
 static void omninet_write_bulk_callback(struct urb *urb);
 static int  omninet_write(struct tty_struct *tty, struct usb_serial_port *port,
@@ -60,7 +59,6 @@ static struct usb_serial_driver zyxel_omninet_device = {
         .attach =               omninet_attach,
         .port_probe =           omninet_port_probe,
         .port_remove =          omninet_port_remove,
-        .open =                 omninet_open,
         .write =                omninet_write,
         .write_room =           omninet_write_room,
         .write_bulk_callback =  omninet_write_bulk_callback,
@@ -140,17 +138,6 @@ static int omninet_port_remove(struct usb_serial_port *port)
         return 0;
 }
 
-static int omninet_open(struct tty_struct *tty, struct usb_serial_port *port)
-{
-        struct usb_serial       *serial = port->serial;
-        struct usb_serial_port  *wport;
-
-        wport = serial->port[1];
-        tty_port_tty_set(&wport->port, tty);
-
-        return usb_serial_generic_open(tty, port);
-}
-
 #define OMNINET_HEADERLEN       4
 #define OMNINET_BULKOUTSIZE     64
 #define OMNINET_PAYLOADSIZE     (OMNINET_BULKOUTSIZE - OMNINET_HEADERLEN)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 42cc72e54c05..af67a0de6b5d 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -233,6 +233,14 @@ static void option_instat_callback(struct urb *urb);
 #define BANDRICH_PRODUCT_1012                   0x1012
 
 #define QUALCOMM_VENDOR_ID                      0x05C6
+/* These Quectel products use Qualcomm's vendor ID */
+#define QUECTEL_PRODUCT_UC20                    0x9003
+#define QUECTEL_PRODUCT_UC15                    0x9090
+
+#define QUECTEL_VENDOR_ID                       0x2c7c
+/* These Quectel products use Quectel's vendor ID */
+#define QUECTEL_PRODUCT_EC21                    0x0121
+#define QUECTEL_PRODUCT_EC25                    0x0125
 
 #define CMOTECH_VENDOR_ID                       0x16d8
 #define CMOTECH_PRODUCT_6001                    0x6001
@@ -1161,7 +1169,14 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
-        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9003), /* Quectel UC20 */
+        /* Quectel products using Qualcomm vendor ID */
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        /* Quectel products using Quectel vendor ID */
+        { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 696458db7e3c..38b3f0d8cd58 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -169,6 +169,8 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_SWI(0x413c, 0x81a9)},   /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81b1)},   /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81b3)},   /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
+        {DEVICE_SWI(0x413c, 0x81b5)},   /* Dell Wireless 5811e QDL */
+        {DEVICE_SWI(0x413c, 0x81b6)},   /* Dell Wireless 5811e QDL */
 
         /* Huawei devices */
         {DEVICE_HWI(0x03f0, 0x581d)},   /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
diff --git a/drivers/usb/serial/safe_serial.c b/drivers/usb/serial/safe_serial.c
index 93c6c9b08daa..8a069aa154ed 100644
--- a/drivers/usb/serial/safe_serial.c
+++ b/drivers/usb/serial/safe_serial.c
@@ -200,6 +200,11 @@ static void safe_process_read_urb(struct urb *urb)
         if (!safe)
                 goto out;
 
+        if (length < 2) {
+                dev_err(&port->dev, "malformed packet\n");
+                return;
+        }
+
         fcs = fcs_compute10(data, length, CRC10_INITFCS);
         if (fcs) {
                 dev_err(&port->dev, "%s - bad CRC %x\n", __func__, fcs);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 16cc18369111..9129f6cb8230 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2071,6 +2071,20 @@ UNUSUAL_DEV(  0x1370, 0x6828, 0x0110, 0x0110,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
+/*
+ * Reported by Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
+ * The INIC-3619 bridge is used in the StarTech SLSODDU33B
+ * SATA-USB enclosure for slimline optical drives.
+ *
+ * The quirk enables MakeMKV to properly exchange keys with
+ * an installed BD drive.
+ */
+UNUSUAL_DEV(  0x13fd, 0x3609, 0x0209, 0x0209,
+                "Initio Corporation",
+                "INIC-3619",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE ),
+
 /* Reported by Qinglin Ye <yestyle@gmail.com> */
 UNUSUAL_DEV(  0x13fe, 0x3600, 0x0100, 0x0100,
                 "Kingston",
diff --git a/drivers/usb/wusbcore/wa-hc.c b/drivers/usb/wusbcore/wa-hc.c
index 252c7bd9218a..d01496fd27fe 100644
--- a/drivers/usb/wusbcore/wa-hc.c
+++ b/drivers/usb/wusbcore/wa-hc.c
@@ -39,6 +39,9 @@ int wa_create(struct wahc *wa, struct usb_interface *iface,
         int result;
         struct device *dev = &iface->dev;
 
+        if (iface->cur_altsetting->desc.bNumEndpoints < 3)
+                return -ENODEV;
+
         result = wa_rpipes_create(wa);
         if (result < 0)
                 goto error_rpipes_create;
diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
index 0aa6c3c29d17..35a1e777b449 100644
--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
@@ -823,6 +823,9 @@ static int hwarc_probe(struct usb_interface *iface,
         struct hwarc *hwarc;
         struct device *dev = &iface->dev;
 
+        if (iface->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         result = -ENOMEM;
         uwb_rc = uwb_rc_alloc();
         if (uwb_rc == NULL) {
diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c
index 2bfc846ac071..6345e85822a4 100644
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -362,6 +362,9 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
                                  result);
         }
 
+        if (iface->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         result = -ENOMEM;
         i1480_usb = kzalloc(sizeof(*i1480_usb), GFP_KERNEL);
         if (i1480_usb == NULL) {
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index 609f4f982c74..561084ab387f 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -403,6 +403,7 @@ static void vfio_group_release(struct kref *kref)
         struct iommu_group *iommu_group = group->iommu_group;
 
         WARN_ON(!list_empty(&group->device_list));
+        WARN_ON(group->notifier.head);
 
         list_for_each_entry_safe(unbound, tmp,
                                  &group->unbound_list, unbound_next) {
@@ -1573,6 +1574,10 @@ static int vfio_group_fops_open(struct inode *inode, struct file *filep)
                 return -EBUSY;
         }
 
+        /* Warn if previous user didn't cleanup and re-init to drop them */
+        if (WARN_ON(group->notifier.head))
+                BLOCKING_INIT_NOTIFIER_HEAD(&group->notifier);
+
         filep->private_data = group;
 
         return 0;
@@ -1584,9 +1589,6 @@ static int vfio_group_fops_release(struct inode *inode, struct file *filep)
 
         filep->private_data = NULL;
 
-        /* Any user didn't unregister? */
-        WARN_ON(group->notifier.head);
-
         vfio_group_try_dissolve_container(group);
 
         atomic_dec(&group->opened);
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index c26fa1f3ed86..32d2633092a3 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -1182,8 +1182,7 @@ static struct vfio_group *find_iommu_group(struct vfio_domain *domain,
         return NULL;
 }
 
-static bool vfio_iommu_has_resv_msi(struct iommu_group *group,
-                                    phys_addr_t *base)
+static bool vfio_iommu_has_sw_msi(struct iommu_group *group, phys_addr_t *base)
 {
         struct list_head group_resv_regions;
         struct iommu_resv_region *region, *next;
@@ -1192,7 +1191,7 @@ static bool vfio_iommu_has_resv_msi(struct iommu_group *group,
         INIT_LIST_HEAD(&group_resv_regions);
         iommu_get_group_resv_regions(group, &group_resv_regions);
         list_for_each_entry(region, &group_resv_regions, list) {
-                if (region->type & IOMMU_RESV_MSI) {
+                if (region->type == IOMMU_RESV_SW_MSI) {
                         *base = region->start;
                         ret = true;
                         goto out;
@@ -1283,7 +1282,7 @@ static int vfio_iommu_type1_attach_group(void *iommu_data,
         if (ret)
                 goto out_domain;
 
-        resv_msi = vfio_iommu_has_resv_msi(iommu_group, &resv_msi_base);
+        resv_msi = vfio_iommu_has_sw_msi(iommu_group, &resv_msi_base);
 
         INIT_LIST_HEAD(&domain->group_list);
         list_add(&group->next, &domain->group_list);
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index ce5e63d2c66a..44eed8eb0725 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -223,6 +223,46 @@ vhost_transport_send_pkt(struct virtio_vsock_pkt *pkt)
         return len;
 }
 
+static int
+vhost_transport_cancel_pkt(struct vsock_sock *vsk)
+{
+        struct vhost_vsock *vsock;
+        struct virtio_vsock_pkt *pkt, *n;
+        int cnt = 0;
+        LIST_HEAD(freeme);
+
+        /* Find the vhost_vsock according to guest context id  */
+        vsock = vhost_vsock_get(vsk->remote_addr.svm_cid);
+        if (!vsock)
+                return -ENODEV;
+
+        spin_lock_bh(&vsock->send_pkt_list_lock);
+        list_for_each_entry_safe(pkt, n, &vsock->send_pkt_list, list) {
+                if (pkt->vsk != vsk)
+                        continue;
+                list_move(&pkt->list, &freeme);
+        }
+        spin_unlock_bh(&vsock->send_pkt_list_lock);
+
+        list_for_each_entry_safe(pkt, n, &freeme, list) {
+                if (pkt->reply)
+                        cnt++;
+                list_del(&pkt->list);
+                virtio_transport_free_pkt(pkt);
+        }
+
+        if (cnt) {
+                struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX];
+                int new_cnt;
+
+                new_cnt = atomic_sub_return(cnt, &vsock->queued_replies);
+                if (new_cnt + cnt >= tx_vq->num && new_cnt < tx_vq->num)
+                        vhost_poll_queue(&tx_vq->poll);
+        }
+
+        return 0;
+}
+
 static struct virtio_vsock_pkt *
 vhost_vsock_alloc_pkt(struct vhost_virtqueue *vq,
                       unsigned int out, unsigned int in)
@@ -675,6 +715,7 @@ static struct virtio_transport vhost_transport = {
                 .release                  = virtio_transport_release,
                 .connect                  = virtio_transport_connect,
                 .shutdown                 = virtio_transport_shutdown,
+                .cancel_pkt               = vhost_transport_cancel_pkt,
 
                 .dgram_enqueue            = virtio_transport_dgram_enqueue,
                 .dgram_dequeue            = virtio_transport_dgram_dequeue,
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 4e1191508228..34adf9b9c053 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -242,11 +242,11 @@ static inline void update_stat(struct virtio_balloon *vb, int idx,
 
 #define pages_to_bytes(x) ((u64)(x) << PAGE_SHIFT)
 
-static void update_balloon_stats(struct virtio_balloon *vb)
+static unsigned int update_balloon_stats(struct virtio_balloon *vb)
 {
         unsigned long events[NR_VM_EVENT_ITEMS];
         struct sysinfo i;
-        int idx = 0;
+        unsigned int idx = 0;
         long available;
 
         all_vm_events(events);
@@ -254,18 +254,22 @@ static void update_balloon_stats(struct virtio_balloon *vb)
 
         available = si_mem_available();
 
+#ifdef CONFIG_VM_EVENT_COUNTERS
         update_stat(vb, idx++, VIRTIO_BALLOON_S_SWAP_IN,
                                 pages_to_bytes(events[PSWPIN]));
         update_stat(vb, idx++, VIRTIO_BALLOON_S_SWAP_OUT,
                                 pages_to_bytes(events[PSWPOUT]));
         update_stat(vb, idx++, VIRTIO_BALLOON_S_MAJFLT, events[PGMAJFAULT]);
         update_stat(vb, idx++, VIRTIO_BALLOON_S_MINFLT, events[PGFAULT]);
+#endif
         update_stat(vb, idx++, VIRTIO_BALLOON_S_MEMFREE,
                                 pages_to_bytes(i.freeram));
         update_stat(vb, idx++, VIRTIO_BALLOON_S_MEMTOT,
                                 pages_to_bytes(i.totalram));
         update_stat(vb, idx++, VIRTIO_BALLOON_S_AVAIL,
                                 pages_to_bytes(available));
+
+        return idx;
 }
 
 /*
@@ -291,14 +295,14 @@ static void stats_handle_request(struct virtio_balloon *vb)
 {
         struct virtqueue *vq;
         struct scatterlist sg;
-        unsigned int len;
+        unsigned int len, num_stats;
 
-        update_balloon_stats(vb);
+        num_stats = update_balloon_stats(vb);
 
         vq = vb->stats_vq;
         if (!virtqueue_get_buf(vq, &len))
                 return;
-        sg_init_one(&sg, vb->stats, sizeof(vb->stats));
+        sg_init_one(&sg, vb->stats, sizeof(vb->stats[0]) * num_stats);
         virtqueue_add_outbuf(vq, &sg, 1, vb, GFP_KERNEL);
         virtqueue_kick(vq);
 }
@@ -423,13 +427,16 @@ static int init_vqs(struct virtio_balloon *vb)
         vb->deflate_vq = vqs[1];
         if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_STATS_VQ)) {
                 struct scatterlist sg;
+                unsigned int num_stats;
                 vb->stats_vq = vqs[2];
 
                 /*
                  * Prime this virtqueue with one buffer so the hypervisor can
                  * use it to signal us later (it can't be broken yet!).
                  */
-                sg_init_one(&sg, vb->stats, sizeof vb->stats);
+                num_stats = update_balloon_stats(vb);
+
+                sg_init_one(&sg, vb->stats, sizeof(vb->stats[0]) * num_stats);
                 if (virtqueue_add_outbuf(vb->stats_vq, &sg, 1, vb, GFP_KERNEL)
                     < 0)
                         BUG();
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index df548a6fb844..590534910dc6 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -147,7 +147,7 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs,
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
         const char *name = dev_name(&vp_dev->vdev.dev);
-        int i, err = -ENOMEM, allocated_vectors, nvectors;
+        int i, j, err = -ENOMEM, allocated_vectors, nvectors;
         unsigned flags = PCI_IRQ_MSIX;
         bool shared = false;
         u16 msix_vec;
@@ -212,7 +212,7 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs,
         if (!vp_dev->msix_vector_map)
                 goto out_disable_config_irq;
 
-        allocated_vectors = 1; /* vector 0 is the config interrupt */
+        allocated_vectors = j = 1; /* vector 0 is the config interrupt */
         for (i = 0; i < nvqs; ++i) {
                 if (!names[i]) {
                         vqs[i] = NULL;
@@ -236,18 +236,19 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs,
                         continue;
                 }
 
-                snprintf(vp_dev->msix_names[i + 1],
+                snprintf(vp_dev->msix_names[j],
                          sizeof(*vp_dev->msix_names), "%s-%s",
                          dev_name(&vp_dev->vdev.dev), names[i]);
                 err = request_irq(pci_irq_vector(vp_dev->pci_dev, msix_vec),
                                   vring_interrupt, IRQF_SHARED,
-                                  vp_dev->msix_names[i + 1], vqs[i]);
+                                  vp_dev->msix_names[j], vqs[i]);
                 if (err) {
                         /* don't free this irq on error */
                         vp_dev->msix_vector_map[i] = VIRTIO_MSI_NO_VECTOR;
                         goto out_remove_vqs;
                 }
                 vp_dev->msix_vector_map[i] = msix_vec;
+                j++;
 
                 /*
                  * Use a different vector for each queue if they are available,
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index c77a0751a311..f3bf8f4e2d6c 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -36,6 +36,7 @@
 #include <linux/spinlock.h>
 #include <linux/slab.h>
 #include <linux/highmem.h>
+#include <linux/refcount.h>
 
 #include <xen/xen.h>
 #include <xen/grant_table.h>
@@ -86,7 +87,7 @@ struct grant_map {
         int index;
         int count;
         int flags;
-        atomic_t users;
+        refcount_t users;
         struct unmap_notify notify;
         struct ioctl_gntdev_grant_ref *grants;
         struct gnttab_map_grant_ref   *map_ops;
@@ -166,7 +167,7 @@ static struct grant_map *gntdev_alloc_map(struct gntdev_priv *priv, int count)
 
         add->index = 0;
         add->count = count;
-        atomic_set(&add->users, 1);
+        refcount_set(&add->users, 1);
 
         return add;
 
@@ -212,7 +213,7 @@ static void gntdev_put_map(struct gntdev_priv *priv, struct grant_map *map)
         if (!map)
                 return;
 
-        if (!atomic_dec_and_test(&map->users))
+        if (!refcount_dec_and_test(&map->users))
                 return;
 
         atomic_sub(map->count, &pages_mapped);
@@ -400,7 +401,7 @@ static void gntdev_vma_open(struct vm_area_struct *vma)
         struct grant_map *map = vma->vm_private_data;
 
         pr_debug("gntdev_vma_open %p\n", vma);
-        atomic_inc(&map->users);
+        refcount_inc(&map->users);
 }
 
 static void gntdev_vma_close(struct vm_area_struct *vma)
@@ -1004,7 +1005,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
                 goto unlock_out;
         }
 
-        atomic_inc(&map->users);
+        refcount_inc(&map->users);
 
         vma->vm_ops = &gntdev_vmops;
 
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index f8afc6dcc29f..e8cef1ad0fe3 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -681,3 +681,50 @@ xen_swiotlb_set_dma_mask(struct device *dev, u64 dma_mask)
         return 0;
 }
 EXPORT_SYMBOL_GPL(xen_swiotlb_set_dma_mask);
+
+/*
+ * Create userspace mapping for the DMA-coherent memory.
+ * This function should be called with the pages from the current domain only,
+ * passing pages mapped from other domains would lead to memory corruption.
+ */
+int
+xen_swiotlb_dma_mmap(struct device *dev, struct vm_area_struct *vma,
+                     void *cpu_addr, dma_addr_t dma_addr, size_t size,
+                     unsigned long attrs)
+{
+#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+        if (__generic_dma_ops(dev)->mmap)
+                return __generic_dma_ops(dev)->mmap(dev, vma, cpu_addr,
+                                                    dma_addr, size, attrs);
+#endif
+        return dma_common_mmap(dev, vma, cpu_addr, dma_addr, size);
+}
+EXPORT_SYMBOL_GPL(xen_swiotlb_dma_mmap);
+
+/*
+ * This function should be called with the pages from the current domain only,
+ * passing pages mapped from other domains would lead to memory corruption.
+ */
+int
+xen_swiotlb_get_sgtable(struct device *dev, struct sg_table *sgt,
+                        void *cpu_addr, dma_addr_t handle, size_t size,
+                        unsigned long attrs)
+{
+#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+        if (__generic_dma_ops(dev)->get_sgtable) {
+#if 0
+        /*
+         * This check verifies that the page belongs to the current domain and
+         * is not one mapped from another domain.
+         * This check is for debug only, and should not go to production build
+         */
+                unsigned long bfn = PHYS_PFN(dma_to_phys(dev, handle));
+                BUG_ON (!page_is_ram(bfn));
+#endif
+                return __generic_dma_ops(dev)->get_sgtable(dev, sgt, cpu_addr,
+                                                           handle, size, attrs);
+        }
+#endif
+        return dma_common_get_sgtable(dev, sgt, cpu_addr, handle, size);
+}
+EXPORT_SYMBOL_GPL(xen_swiotlb_get_sgtable);
diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
index 4ce10bcca18b..23e391d3ec01 100644
--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -27,10 +27,10 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/syscore_ops.h>
 #include <linux/acpi.h>
 #include <acpi/processor.h>
 #include <xen/xen.h>
-#include <xen/xen-ops.h>
 #include <xen/interface/platform.h>
 #include <asm/xen/hypercall.h>
 
@@ -408,7 +408,7 @@ static int check_acpi_ids(struct acpi_processor *pr_backup)
         acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
                             ACPI_UINT32_MAX,
                             read_acpi_id, NULL, NULL, NULL);
-        acpi_get_devices("ACPI0007", read_acpi_id, NULL, NULL);
+        acpi_get_devices(ACPI_PROCESSOR_DEVICE_HID, read_acpi_id, NULL, NULL);
 
 upload:
         if (!bitmap_equal(acpi_id_present, acpi_ids_done, nr_acpi_bits)) {
@@ -466,15 +466,33 @@ static int xen_upload_processor_pm_data(void)
         return rc;
 }
 
-static int xen_acpi_processor_resume(struct notifier_block *nb,
-                                     unsigned long action, void *data)
+static void xen_acpi_processor_resume_worker(struct work_struct *dummy)
 {
+        int rc;
+
         bitmap_zero(acpi_ids_done, nr_acpi_bits);
-        return xen_upload_processor_pm_data();
+
+        rc = xen_upload_processor_pm_data();
+        if (rc != 0)
+                pr_info("ACPI data upload failed, error = %d\n", rc);
+}
+
+static void xen_acpi_processor_resume(void)
+{
+        static DECLARE_WORK(wq, xen_acpi_processor_resume_worker);
+
+        /*
+         * xen_upload_processor_pm_data() calls non-atomic code.
+         * However, the context for xen_acpi_processor_resume is syscore
+         * with only the boot CPU online and in an atomic context.
+         *
+         * So defer the upload for some point safer.
+         */
+        schedule_work(&wq);
 }
 
-struct notifier_block xen_acpi_processor_resume_nb = {
-        .notifier_call = xen_acpi_processor_resume,
+static struct syscore_ops xap_syscore_ops = {
+        .resume = xen_acpi_processor_resume,
 };
 
 static int __init xen_acpi_processor_init(void)
@@ -527,7 +545,7 @@ static int __init xen_acpi_processor_init(void)
         if (rc)
                 goto err_unregister;
 
-        xen_resume_notifier_register(&xen_acpi_processor_resume_nb);
+        register_syscore_ops(&xap_syscore_ops);
 
         return 0;
 err_unregister:
@@ -544,7 +562,7 @@ static void __exit xen_acpi_processor_exit(void)
 {
         int i;
 
-        xen_resume_notifier_unregister(&xen_acpi_processor_resume_nb);
+        unregister_syscore_ops(&xap_syscore_ops);
         kfree(acpi_ids_done);
         kfree(acpi_id_present);
         kfree(acpi_id_cst_present);
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 4d343eed08f5..1f4733b80c87 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -55,7 +55,6 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/miscdevice.h>
-#include <linux/init.h>
 
 #include <xen/xenbus.h>
 #include <xen/xen.h>
diff --git a/fs/afs/callback.c b/fs/afs/callback.c
index b29447e03ede..25d404d22cae 100644
--- a/fs/afs/callback.c
+++ b/fs/afs/callback.c
@@ -362,7 +362,7 @@ static void afs_callback_updater(struct work_struct *work)
 {
         struct afs_server *server;
         struct afs_vnode *vnode, *xvnode;
-        time_t now;
+        time64_t now;
         long timeout;
         int ret;
 
@@ -370,7 +370,7 @@ static void afs_callback_updater(struct work_struct *work)
 
         _enter("");
 
-        now = get_seconds();
+        now = ktime_get_real_seconds();
 
         /* find the first vnode to update */
         spin_lock(&server->cb_lock);
@@ -424,7 +424,8 @@ static void afs_callback_updater(struct work_struct *work)
 
         /* and then reschedule */
         _debug("reschedule");
-        vnode->update_at = get_seconds() + afs_vnode_update_timeout;
+        vnode->update_at = ktime_get_real_seconds() +
+                        afs_vnode_update_timeout;
 
         spin_lock(&server->cb_lock);
 
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index 2edbdcbf6432..3062cceb5c2a 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -187,7 +187,6 @@ static int afs_deliver_cb_callback(struct afs_call *call)
         struct afs_callback *cb;
         struct afs_server *server;
         __be32 *bp;
-        u32 tmp;
         int ret, loop;
 
         _enter("{%u}", call->unmarshall);
@@ -249,9 +248,9 @@ static int afs_deliver_cb_callback(struct afs_call *call)
                 if (ret < 0)
                         return ret;
 
-                tmp = ntohl(call->tmp);
-                _debug("CB count: %u", tmp);
-                if (tmp != call->count && tmp != 0)
+                call->count2 = ntohl(call->tmp);
+                _debug("CB count: %u", call->count2);
+                if (call->count2 != call->count && call->count2 != 0)
                         return -EBADMSG;
                 call->offset = 0;
                 call->unmarshall++;
@@ -259,14 +258,14 @@ static int afs_deliver_cb_callback(struct afs_call *call)
         case 4:
                 _debug("extract CB array");
                 ret = afs_extract_data(call, call->buffer,
-                                       call->count * 3 * 4, false);
+                                       call->count2 * 3 * 4, false);
                 if (ret < 0)
                         return ret;
 
                 _debug("unmarshall CB array");
                 cb = call->request;
                 bp = call->buffer;
-                for (loop = call->count; loop > 0; loop--, cb++) {
+                for (loop = call->count2; loop > 0; loop--, cb++) {
                         cb->version     = ntohl(*bp++);
                         cb->expiry      = ntohl(*bp++);
                         cb->type        = ntohl(*bp++);
diff --git a/fs/afs/file.c b/fs/afs/file.c
index ba7b71fba34b..0d5b8508869b 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -30,6 +30,7 @@ static int afs_readpages(struct file *filp, struct address_space *mapping,
 
 const struct file_operations afs_file_operations = {
         .open           = afs_open,
+        .flush          = afs_flush,
         .release        = afs_release,
         .llseek         = generic_file_llseek,
         .read_iter      = generic_file_read_iter,
@@ -184,10 +185,13 @@ int afs_page_filler(void *data, struct page *page)
                 if (!req)
                         goto enomem;
 
+                /* We request a full page.  If the page is a partial one at the
+                 * end of the file, the server will return a short read and the
+                 * unmarshalling code will clear the unfilled space.
+                 */
                 atomic_set(&req->usage, 1);
                 req->pos = (loff_t)page->index << PAGE_SHIFT;
-                req->len = min_t(size_t, i_size_read(inode) - req->pos,
-                                 PAGE_SIZE);
+                req->len = PAGE_SIZE;
                 req->nr_pages = 1;
                 req->pages[0] = page;
                 get_page(page);
@@ -208,7 +212,13 @@ int afs_page_filler(void *data, struct page *page)
                         fscache_uncache_page(vnode->cache, page);
 #endif
                         BUG_ON(PageFsCache(page));
-                        goto error;
+
+                        if (ret == -EINTR ||
+                            ret == -ENOMEM ||
+                            ret == -ERESTARTSYS ||
+                            ret == -EAGAIN)
+                                goto error;
+                        goto io_error;
                 }
 
                 SetPageUptodate(page);
@@ -227,10 +237,12 @@ int afs_page_filler(void *data, struct page *page)
         _leave(" = 0");
         return 0;
 
+io_error:
+        SetPageError(page);
+        goto error;
 enomem:
         ret = -ENOMEM;
 error:
-        SetPageError(page);
         unlock_page(page);
         _leave(" = %d", ret);
         return ret;
diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
index ac8e766978dc..19f76ae36982 100644
--- a/fs/afs/fsclient.c
+++ b/fs/afs/fsclient.c
@@ -17,6 +17,12 @@
 #include "afs_fs.h"
 
 /*
+ * We need somewhere to discard into in case the server helpfully returns more
+ * than we asked for in FS.FetchData{,64}.
+ */
+static u8 afs_discard_buffer[64];
+
+/*
  * decode an AFSFid block
  */
 static void xdr_decode_AFSFid(const __be32 **_bp, struct afs_fid *fid)
@@ -105,7 +111,7 @@ static void xdr_decode_AFSFetchStatus(const __be32 **_bp,
                         vnode->vfs_inode.i_mode = mode;
                 }
 
-                vnode->vfs_inode.i_ctime.tv_sec = status->mtime_server;
+                vnode->vfs_inode.i_ctime.tv_sec = status->mtime_client;
                 vnode->vfs_inode.i_mtime        = vnode->vfs_inode.i_ctime;
                 vnode->vfs_inode.i_atime        = vnode->vfs_inode.i_ctime;
                 vnode->vfs_inode.i_version      = data_version;
@@ -139,7 +145,7 @@ static void xdr_decode_AFSCallBack(const __be32 **_bp, struct afs_vnode *vnode)
         vnode->cb_version       = ntohl(*bp++);
         vnode->cb_expiry        = ntohl(*bp++);
         vnode->cb_type          = ntohl(*bp++);
-        vnode->cb_expires       = vnode->cb_expiry + get_seconds();
+        vnode->cb_expires       = vnode->cb_expiry + ktime_get_real_seconds();
         *_bp = bp;
 }
 
@@ -315,7 +321,7 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
         void *buffer;
         int ret;
 
-        _enter("{%u,%zu/%u;%u/%llu}",
+        _enter("{%u,%zu/%u;%llu/%llu}",
                call->unmarshall, call->offset, call->count,
                req->remain, req->actual_len);
 
@@ -353,12 +359,6 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
 
                 req->actual_len |= ntohl(call->tmp);
                 _debug("DATA length: %llu", req->actual_len);
-                /* Check that the server didn't want to send us extra.  We
-                 * might want to just discard instead, but that requires
-                 * cooperation from AF_RXRPC.
-                 */
-                if (req->actual_len > req->len)
-                        return -EBADMSG;
 
                 req->remain = req->actual_len;
                 call->offset = req->pos & (PAGE_SIZE - 1);
@@ -368,6 +368,7 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
                 call->unmarshall++;
 
         begin_page:
+                ASSERTCMP(req->index, <, req->nr_pages);
                 if (req->remain > PAGE_SIZE - call->offset)
                         size = PAGE_SIZE - call->offset;
                 else
@@ -378,7 +379,7 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
 
                 /* extract the returned data */
         case 3:
-                _debug("extract data %u/%llu %zu/%u",
+                _debug("extract data %llu/%llu %zu/%u",
                        req->remain, req->actual_len, call->offset, call->count);
 
                 buffer = kmap(req->pages[req->index]);
@@ -389,19 +390,40 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
                 if (call->offset == PAGE_SIZE) {
                         if (req->page_done)
                                 req->page_done(call, req);
+                        req->index++;
                         if (req->remain > 0) {
-                                req->index++;
                                 call->offset = 0;
+                                if (req->index >= req->nr_pages) {
+                                        call->unmarshall = 4;
+                                        goto begin_discard;
+                                }
                                 goto begin_page;
                         }
                 }
+                goto no_more_data;
+
+                /* Discard any excess data the server gave us */
+        begin_discard:
+        case 4:
+                size = min_t(loff_t, sizeof(afs_discard_buffer), req->remain);
+                call->count = size;
+                _debug("extract discard %llu/%llu %zu/%u",
+                       req->remain, req->actual_len, call->offset, call->count);
+
+                call->offset = 0;
+                ret = afs_extract_data(call, afs_discard_buffer, call->count, true);
+                req->remain -= call->offset;
+                if (ret < 0)
+                        return ret;
+                if (req->remain > 0)
+                        goto begin_discard;
 
         no_more_data:
                 call->offset = 0;
-                call->unmarshall++;
+                call->unmarshall = 5;
 
                 /* extract the metadata */
-        case 4:
+        case 5:
                 ret = afs_extract_data(call, call->buffer,
                                        (21 + 3 + 6) * 4, false);
                 if (ret < 0)
@@ -416,16 +438,17 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
                 call->offset = 0;
                 call->unmarshall++;
 
-        case 5:
+        case 6:
                 break;
         }
 
-        if (call->count < PAGE_SIZE) {
-                buffer = kmap(req->pages[req->index]);
-                memset(buffer + call->count, 0, PAGE_SIZE - call->count);
-                kunmap(req->pages[req->index]);
+        for (; req->index < req->nr_pages; req->index++) {
+                if (call->count < PAGE_SIZE)
+                        zero_user_segment(req->pages[req->index],
+                                          call->count, PAGE_SIZE);
                 if (req->page_done)
                         req->page_done(call, req);
+                call->count = 0;
         }
 
         _leave(" = 0 [done]");
@@ -711,8 +734,8 @@ int afs_fs_create(struct afs_server *server,
                 memset(bp, 0, padsz);
                 bp = (void *) bp + padsz;
         }
-        *bp++ = htonl(AFS_SET_MODE);
-        *bp++ = 0; /* mtime */
+        *bp++ = htonl(AFS_SET_MODE | AFS_SET_MTIME);
+        *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */
         *bp++ = 0; /* owner */
         *bp++ = 0; /* group */
         *bp++ = htonl(mode & S_IALLUGO); /* unix mode */
@@ -980,8 +1003,8 @@ int afs_fs_symlink(struct afs_server *server,
                 memset(bp, 0, c_padsz);
                 bp = (void *) bp + c_padsz;
         }
-        *bp++ = htonl(AFS_SET_MODE);
-        *bp++ = 0; /* mtime */
+        *bp++ = htonl(AFS_SET_MODE | AFS_SET_MTIME);
+        *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */
         *bp++ = 0; /* owner */
         *bp++ = 0; /* group */
         *bp++ = htonl(S_IRWXUGO); /* unix mode */
@@ -1180,8 +1203,8 @@ static int afs_fs_store_data64(struct afs_server *server,
         *bp++ = htonl(vnode->fid.vnode);
         *bp++ = htonl(vnode->fid.unique);
 
-        *bp++ = 0; /* mask */
-        *bp++ = 0; /* mtime */
+        *bp++ = htonl(AFS_SET_MTIME); /* mask */
+        *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */
         *bp++ = 0; /* owner */
         *bp++ = 0; /* group */
         *bp++ = 0; /* unix mode */
@@ -1213,7 +1236,7 @@ int afs_fs_store_data(struct afs_server *server, struct afs_writeback *wb,
         _enter(",%x,{%x:%u},,",
                key_serial(wb->key), vnode->fid.vid, vnode->fid.vnode);
 
-        size = to - offset;
+        size = (loff_t)to - (loff_t)offset;
         if (first != last)
                 size += (loff_t)(last - first) << PAGE_SHIFT;
         pos = (loff_t)first << PAGE_SHIFT;
@@ -1257,8 +1280,8 @@ int afs_fs_store_data(struct afs_server *server, struct afs_writeback *wb,
         *bp++ = htonl(vnode->fid.vnode);
         *bp++ = htonl(vnode->fid.unique);
 
-        *bp++ = 0; /* mask */
-        *bp++ = 0; /* mtime */
+        *bp++ = htonl(AFS_SET_MTIME); /* mask */
+        *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */
         *bp++ = 0; /* owner */
         *bp++ = 0; /* group */
         *bp++ = 0; /* unix mode */
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index 1e4897a048d2..aae55dd15108 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -54,8 +54,21 @@ static int afs_inode_map_status(struct afs_vnode *vnode, struct key *key)
                 inode->i_fop    = &afs_dir_file_operations;
                 break;
         case AFS_FTYPE_SYMLINK:
-                inode->i_mode   = S_IFLNK | vnode->status.mode;
-                inode->i_op     = &page_symlink_inode_operations;
+                /* Symlinks with a mode of 0644 are actually mountpoints. */
+                if ((vnode->status.mode & 0777) == 0644) {
+                        inode->i_flags |= S_AUTOMOUNT;
+
+                        spin_lock(&vnode->lock);
+                        set_bit(AFS_VNODE_MOUNTPOINT, &vnode->flags);
+                        spin_unlock(&vnode->lock);
+
+                        inode->i_mode   = S_IFDIR | 0555;
+                        inode->i_op     = &afs_mntpt_inode_operations;
+                        inode->i_fop    = &afs_mntpt_file_operations;
+                } else {
+                        inode->i_mode   = S_IFLNK | vnode->status.mode;
+                        inode->i_op     = &page_symlink_inode_operations;
+                }
                 inode_nohighmem(inode);
                 break;
         default:
@@ -70,27 +83,15 @@ static int afs_inode_map_status(struct afs_vnode *vnode, struct key *key)
 
         set_nlink(inode, vnode->status.nlink);
         inode->i_uid            = vnode->status.owner;
-        inode->i_gid            = GLOBAL_ROOT_GID;
+        inode->i_gid            = vnode->status.group;
         inode->i_size           = vnode->status.size;
-        inode->i_ctime.tv_sec   = vnode->status.mtime_server;
+        inode->i_ctime.tv_sec   = vnode->status.mtime_client;
         inode->i_ctime.tv_nsec  = 0;
         inode->i_atime          = inode->i_mtime = inode->i_ctime;
         inode->i_blocks         = 0;
         inode->i_generation     = vnode->fid.unique;
         inode->i_version        = vnode->status.data_version;
         inode->i_mapping->a_ops = &afs_fs_aops;
-
-        /* check to see whether a symbolic link is really a mountpoint */
-        if (vnode->status.type == AFS_FTYPE_SYMLINK) {
-                afs_mntpt_check_symlink(vnode, key);
-
-                if (test_bit(AFS_VNODE_MOUNTPOINT, &vnode->flags)) {
-                        inode->i_mode   = S_IFDIR | vnode->status.mode;
-                        inode->i_op     = &afs_mntpt_inode_operations;
-                        inode->i_fop    = &afs_mntpt_file_operations;
-                }
-        }
-
         return 0;
 }
 
@@ -245,12 +246,13 @@ struct inode *afs_iget(struct super_block *sb, struct key *key,
                         vnode->cb_version = 0;
                         vnode->cb_expiry = 0;
                         vnode->cb_type = 0;
-                        vnode->cb_expires = get_seconds();
+                        vnode->cb_expires = ktime_get_real_seconds();
                 } else {
                         vnode->cb_version = cb->version;
                         vnode->cb_expiry = cb->expiry;
                         vnode->cb_type = cb->type;
-                        vnode->cb_expires = vnode->cb_expiry + get_seconds();
+                        vnode->cb_expires = vnode->cb_expiry +
+                                ktime_get_real_seconds();
                 }
         }
 
@@ -323,7 +325,7 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
             !test_bit(AFS_VNODE_CB_BROKEN, &vnode->flags) &&
             !test_bit(AFS_VNODE_MODIFIED, &vnode->flags) &&
             !test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags)) {
-                if (vnode->cb_expires < get_seconds() + 10) {
+                if (vnode->cb_expires < ktime_get_real_seconds() + 10) {
                         _debug("callback expired");
                         set_bit(AFS_VNODE_CB_BROKEN, &vnode->flags);
                 } else {
@@ -444,7 +446,7 @@ void afs_evict_inode(struct inode *inode)
 
         mutex_lock(&vnode->permits_lock);
         permits = vnode->permits;
-        rcu_assign_pointer(vnode->permits, NULL);
+        RCU_INIT_POINTER(vnode->permits, NULL);
         mutex_unlock(&vnode->permits_lock);
         if (permits)
                 call_rcu(&permits->rcu, afs_zap_permits);
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 5dfa56903a2d..a6901360fb81 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -11,6 +11,7 @@
 
 #include <linux/compiler.h>
 #include <linux/kernel.h>
+#include <linux/ktime.h>
 #include <linux/fs.h>
 #include <linux/pagemap.h>
 #include <linux/rxrpc.h>
@@ -90,7 +91,10 @@ struct afs_call {
         unsigned                request_size;   /* size of request data */
         unsigned                reply_max;      /* maximum size of reply */
         unsigned                first_offset;   /* offset into mapping[first] */
-        unsigned                last_to;        /* amount of mapping[last] */
+        union {
+                unsigned        last_to;        /* amount of mapping[last] */
+                unsigned        count2;         /* count used in unmarshalling */
+        };
         unsigned char           unmarshall;     /* unmarshalling phase */
         bool                    incoming;       /* T if incoming call */
         bool                    send_pages;     /* T if data from mapping should be sent */
@@ -127,12 +131,11 @@ struct afs_call_type {
  */
 struct afs_read {
         loff_t                  pos;            /* Where to start reading */
-        loff_t                  len;            /* How much to read */
+        loff_t                  len;            /* How much we're asking for */
         loff_t                  actual_len;     /* How much we're actually getting */
+        loff_t                  remain;         /* Amount remaining */
         atomic_t                usage;
-        unsigned int            remain;         /* Amount remaining */
         unsigned int            index;          /* Which page we're reading into */
-        unsigned int            pg_offset;      /* Offset in page we're at */
         unsigned int            nr_pages;
         void (*page_done)(struct afs_call *, struct afs_read *);
         struct page             *pages[];
@@ -247,7 +250,7 @@ struct afs_cache_vhash {
  */
 struct afs_vlocation {
         atomic_t                usage;
-        time_t                  time_of_death;  /* time at which put reduced usage to 0 */
+        time64_t                time_of_death;  /* time at which put reduced usage to 0 */
         struct list_head        link;           /* link in cell volume location list */
         struct list_head        grave;          /* link in master graveyard list */
         struct list_head        update;         /* link in master update list */
@@ -258,7 +261,7 @@ struct afs_vlocation {
         struct afs_cache_vlocation vldb;        /* volume information DB record */
         struct afs_volume       *vols[3];       /* volume access record pointer (index by type) */
         wait_queue_head_t       waitq;          /* status change waitqueue */
-        time_t                  update_at;      /* time at which record should be updated */
+        time64_t                update_at;      /* time at which record should be updated */
         spinlock_t              lock;           /* access lock */
         afs_vlocation_state_t   state;          /* volume location state */
         unsigned short          upd_rej_cnt;    /* ENOMEDIUM count during update */
@@ -271,7 +274,7 @@ struct afs_vlocation {
  */
 struct afs_server {
         atomic_t                usage;
-        time_t                  time_of_death;  /* time at which put reduced usage to 0 */
+        time64_t                time_of_death;  /* time at which put reduced usage to 0 */
         struct in_addr          addr;           /* server address */
         struct afs_cell         *cell;          /* cell in which server resides */
         struct list_head        link;           /* link in cell's server list */
@@ -374,8 +377,8 @@ struct afs_vnode {
         struct rb_node          server_rb;      /* link in server->fs_vnodes */
         struct rb_node          cb_promise;     /* link in server->cb_promises */
         struct work_struct      cb_broken_work; /* work to be done on callback break */
-        time_t                  cb_expires;     /* time at which callback expires */
-        time_t                  cb_expires_at;  /* time used to order cb_promise */
+        time64_t                cb_expires;     /* time at which callback expires */
+        time64_t                cb_expires_at;  /* time used to order cb_promise */
         unsigned                cb_version;     /* callback version */
         unsigned                cb_expiry;      /* callback expiry time */
         afs_callback_type_t     cb_type;        /* type of callback */
@@ -557,7 +560,6 @@ extern const struct inode_operations afs_autocell_inode_operations;
 extern const struct file_operations afs_mntpt_file_operations;
 
 extern struct vfsmount *afs_d_automount(struct path *);
-extern int afs_mntpt_check_symlink(struct afs_vnode *, struct key *);
 extern void afs_mntpt_kill_timer(void);
 
 /*
@@ -718,6 +720,7 @@ extern int afs_writepages(struct address_space *, struct writeback_control *);
 extern void afs_pages_written_back(struct afs_vnode *, struct afs_call *);
 extern ssize_t afs_file_write(struct kiocb *, struct iov_iter *);
 extern int afs_writeback_all(struct afs_vnode *);
+extern int afs_flush(struct file *, fl_owner_t);
 extern int afs_fsync(struct file *, loff_t, loff_t, int);
 
 
diff --git a/fs/afs/misc.c b/fs/afs/misc.c
index 91ea1aa0d8b3..100b207efc9e 100644
--- a/fs/afs/misc.c
+++ b/fs/afs/misc.c
@@ -84,6 +84,8 @@ int afs_abort_to_error(u32 abort_code)
         case RXKADDATALEN:      return -EKEYREJECTED;
         case RXKADILLEGALLEVEL: return -EKEYREJECTED;
 
+        case RXGEN_OPCODE:      return -ENOTSUPP;
+
         default:                return -EREMOTEIO;
         }
 }
diff --git a/fs/afs/mntpt.c b/fs/afs/mntpt.c
index d4fb0afc0097..bd3b65cde282 100644
--- a/fs/afs/mntpt.c
+++ b/fs/afs/mntpt.c
@@ -47,59 +47,6 @@ static DECLARE_DELAYED_WORK(afs_mntpt_expiry_timer, afs_mntpt_expiry_timed_out);
 static unsigned long afs_mntpt_expiry_timeout = 10 * 60;
 
 /*
- * check a symbolic link to see whether it actually encodes a mountpoint
- * - sets the AFS_VNODE_MOUNTPOINT flag on the vnode appropriately
- */
-int afs_mntpt_check_symlink(struct afs_vnode *vnode, struct key *key)
-{
-        struct page *page;
-        size_t size;
-        char *buf;
-        int ret;
-
-        _enter("{%x:%u,%u}",
-               vnode->fid.vid, vnode->fid.vnode, vnode->fid.unique);
-
-        /* read the contents of the symlink into the pagecache */
-        page = read_cache_page(AFS_VNODE_TO_I(vnode)->i_mapping, 0,
-                               afs_page_filler, key);
-        if (IS_ERR(page)) {
-                ret = PTR_ERR(page);
-                goto out;
-        }
-
-        ret = -EIO;
-        if (PageError(page))
-                goto out_free;
-
-        buf = kmap(page);
-
-        /* examine the symlink's contents */
-        size = vnode->status.size;
-        _debug("symlink to %*.*s", (int) size, (int) size, buf);
-
-        if (size > 2 &&
-            (buf[0] == '%' || buf[0] == '#') &&
-            buf[size - 1] == '.'
-            ) {
-                _debug("symlink is a mountpoint");
-                spin_lock(&vnode->lock);
-                set_bit(AFS_VNODE_MOUNTPOINT, &vnode->flags);
-                vnode->vfs_inode.i_flags |= S_AUTOMOUNT;
-                spin_unlock(&vnode->lock);
-        }
-
-        ret = 0;
-
-        kunmap(page);
-out_free:
-        put_page(page);
-out:
-        _leave(" = %d", ret);
-        return ret;
-}
-
-/*
  * no valid lookup procedure on this sort of dir
  */
 static struct dentry *afs_mntpt_lookup(struct inode *dir,
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 419ef05dcb5e..8f76b13d5549 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -259,67 +259,74 @@ void afs_flat_call_destructor(struct afs_call *call)
         call->buffer = NULL;
 }
 
+#define AFS_BVEC_MAX 8
+
+/*
+ * Load the given bvec with the next few pages.
+ */
+static void afs_load_bvec(struct afs_call *call, struct msghdr *msg,
+                          struct bio_vec *bv, pgoff_t first, pgoff_t last,
+                          unsigned offset)
+{
+        struct page *pages[AFS_BVEC_MAX];
+        unsigned int nr, n, i, to, bytes = 0;
+
+        nr = min_t(pgoff_t, last - first + 1, AFS_BVEC_MAX);
+        n = find_get_pages_contig(call->mapping, first, nr, pages);
+        ASSERTCMP(n, ==, nr);
+
+        msg->msg_flags |= MSG_MORE;
+        for (i = 0; i < nr; i++) {
+                to = PAGE_SIZE;
+                if (first + i >= last) {
+                        to = call->last_to;
+                        msg->msg_flags &= ~MSG_MORE;
+                }
+                bv[i].bv_page = pages[i];
+                bv[i].bv_len = to - offset;
+                bv[i].bv_offset = offset;
+                bytes += to - offset;
+                offset = 0;
+        }
+
+        iov_iter_bvec(&msg->msg_iter, WRITE | ITER_BVEC, bv, nr, bytes);
+}
+
 /*
  * attach the data from a bunch of pages on an inode to a call
  */
 static int afs_send_pages(struct afs_call *call, struct msghdr *msg)
 {
-        struct page *pages[8];
-        unsigned count, n, loop, offset, to;
+        struct bio_vec bv[AFS_BVEC_MAX];
+        unsigned int bytes, nr, loop, offset;
         pgoff_t first = call->first, last = call->last;
         int ret;
 
-        _enter("");
-
         offset = call->first_offset;
         call->first_offset = 0;
 
         do {
-                _debug("attach %lx-%lx", first, last);
-
-                count = last - first + 1;
-                if (count > ARRAY_SIZE(pages))
-                        count = ARRAY_SIZE(pages);
-                n = find_get_pages_contig(call->mapping, first, count, pages);
-                ASSERTCMP(n, ==, count);
-
-                loop = 0;
-                do {
-                        struct bio_vec bvec = {.bv_page = pages[loop],
-                                               .bv_offset = offset};
-                        msg->msg_flags = 0;
-                        to = PAGE_SIZE;
-                        if (first + loop >= last)
-                                to = call->last_to;
-                        else
-                                msg->msg_flags = MSG_MORE;
-                        bvec.bv_len = to - offset;
-                        offset = 0;
-
-                        _debug("- range %u-%u%s",
-                               offset, to, msg->msg_flags ? " [more]" : "");
-                        iov_iter_bvec(&msg->msg_iter, WRITE | ITER_BVEC,
-                                      &bvec, 1, to - offset);
-
-                        /* have to change the state *before* sending the last
-                         * packet as RxRPC might give us the reply before it
-                         * returns from sending the request */
-                        if (first + loop >= last)
-                                call->state = AFS_CALL_AWAIT_REPLY;
-                        ret = rxrpc_kernel_send_data(afs_socket, call->rxcall,
-                                                     msg, to - offset);
-                        if (ret < 0)
-                                break;
-                } while (++loop < count);
-                first += count;
-
-                for (loop = 0; loop < count; loop++)
-                        put_page(pages[loop]);
+                afs_load_bvec(call, msg, bv, first, last, offset);
+                offset = 0;
+                bytes = msg->msg_iter.count;
+                nr = msg->msg_iter.nr_segs;
+
+                /* Have to change the state *before* sending the last
+                 * packet as RxRPC might give us the reply before it
+                 * returns from sending the request.
+                 */
+                if (first + nr - 1 >= last)
+                        call->state = AFS_CALL_AWAIT_REPLY;
+                ret = rxrpc_kernel_send_data(afs_socket, call->rxcall,
+                                             msg, bytes);
+                for (loop = 0; loop < nr; loop++)
+                        put_page(bv[loop].bv_page);
                 if (ret < 0)
                         break;
+
+                first += nr;
         } while (first <= last);
 
-        _leave(" = %d", ret);
         return ret;
 }
 
@@ -333,6 +340,8 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
         struct rxrpc_call *rxcall;
         struct msghdr msg;
         struct kvec iov[1];
+        size_t offset;
+        u32 abort_code;
         int ret;
 
         _enter("%x,{%d},", addr->s_addr, ntohs(call->port));
@@ -381,9 +390,11 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
         msg.msg_controllen      = 0;
         msg.msg_flags           = (call->send_pages ? MSG_MORE : 0);
 
-        /* have to change the state *before* sending the last packet as RxRPC
-         * might give us the reply before it returns from sending the
-         * request */
+        /* We have to change the state *before* sending the last packet as
+         * rxrpc might give us the reply before it returns from sending the
+         * request.  Further, if the send fails, we may already have been given
+         * a notification and may have collected it.
+         */
         if (!call->send_pages)
                 call->state = AFS_CALL_AWAIT_REPLY;
         ret = rxrpc_kernel_send_data(afs_socket, rxcall,
@@ -405,7 +416,17 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
         return afs_wait_for_call_to_complete(call);
 
 error_do_abort:
-        rxrpc_kernel_abort_call(afs_socket, rxcall, RX_USER_ABORT, -ret, "KSD");
+        call->state = AFS_CALL_COMPLETE;
+        if (ret != -ECONNABORTED) {
+                rxrpc_kernel_abort_call(afs_socket, rxcall, RX_USER_ABORT,
+                                        -ret, "KSD");
+        } else {
+                abort_code = 0;
+                offset = 0;
+                rxrpc_kernel_recv_data(afs_socket, rxcall, NULL, 0, &offset,
+                                       false, &abort_code);
+                ret = call->type->abort_to_error(abort_code);
+        }
 error_kill_call:
         afs_put_call(call);
         _leave(" = %d", ret);
@@ -452,16 +473,18 @@ static void afs_deliver_to_call(struct afs_call *call)
                 case -EINPROGRESS:
                 case -EAGAIN:
                         goto out;
+                case -ECONNABORTED:
+                        goto call_complete;
                 case -ENOTCONN:
                         abort_code = RX_CALL_DEAD;
                         rxrpc_kernel_abort_call(afs_socket, call->rxcall,
                                                 abort_code, -ret, "KNC");
-                        goto do_abort;
+                        goto save_error;
                 case -ENOTSUPP:
-                        abort_code = RX_INVALID_OPERATION;
+                        abort_code = RXGEN_OPCODE;
                         rxrpc_kernel_abort_call(afs_socket, call->rxcall,
                                                 abort_code, -ret, "KIV");
-                        goto do_abort;
+                        goto save_error;
                 case -ENODATA:
                 case -EBADMSG:
                 case -EMSGSIZE:
@@ -471,7 +494,7 @@ static void afs_deliver_to_call(struct afs_call *call)
                                 abort_code = RXGEN_SS_UNMARSHAL;
                         rxrpc_kernel_abort_call(afs_socket, call->rxcall,
                                                 abort_code, EBADMSG, "KUM");
-                        goto do_abort;
+                        goto save_error;
                 }
         }
 
@@ -482,8 +505,9 @@ out:
         _leave("");
         return;
 
-do_abort:
+save_error:
         call->error = ret;
+call_complete:
         call->state = AFS_CALL_COMPLETE;
         goto done;
 }
@@ -493,7 +517,6 @@ do_abort:
  */
 static int afs_wait_for_call_to_complete(struct afs_call *call)
 {
-        const char *abort_why;
         int ret;
 
         DECLARE_WAITQUEUE(myself, current);
@@ -512,13 +535,8 @@ static int afs_wait_for_call_to_complete(struct afs_call *call)
                         continue;
                 }
 
-                abort_why = "KWC";
-                ret = call->error;
-                if (call->state == AFS_CALL_COMPLETE)
-                        break;
-                abort_why = "KWI";
-                ret = -EINTR;
-                if (signal_pending(current))
+                if (call->state == AFS_CALL_COMPLETE ||
+                    signal_pending(current))
                         break;
                 schedule();
         }
@@ -526,13 +544,14 @@ static int afs_wait_for_call_to_complete(struct afs_call *call)
         remove_wait_queue(&call->waitq, &myself);
         __set_current_state(TASK_RUNNING);
 
-        /* kill the call */
+        /* Kill off the call if it's still live. */
         if (call->state < AFS_CALL_COMPLETE) {
-                _debug("call incomplete");
+                _debug("call interrupted");
                 rxrpc_kernel_abort_call(afs_socket, call->rxcall,
-                                        RX_CALL_DEAD, -ret, abort_why);
+                                        RX_USER_ABORT, -EINTR, "KWI");
         }
 
+        ret = call->error;
         _debug("call complete");
         afs_put_call(call);
         _leave(" = %d", ret);
diff --git a/fs/afs/security.c b/fs/afs/security.c
index 8d010422dc89..ecb86a670180 100644
--- a/fs/afs/security.c
+++ b/fs/afs/security.c
@@ -114,7 +114,7 @@ void afs_clear_permits(struct afs_vnode *vnode)
 
         mutex_lock(&vnode->permits_lock);
         permits = vnode->permits;
-        rcu_assign_pointer(vnode->permits, NULL);
+        RCU_INIT_POINTER(vnode->permits, NULL);
         mutex_unlock(&vnode->permits_lock);
 
         if (permits)
@@ -340,17 +340,22 @@ int afs_permission(struct inode *inode, int mask)
         } else {
                 if (!(access & AFS_ACE_LOOKUP))
                         goto permission_denied;
+                if ((mask & MAY_EXEC) && !(inode->i_mode & S_IXUSR))
+                        goto permission_denied;
                 if (mask & (MAY_EXEC | MAY_READ)) {
                         if (!(access & AFS_ACE_READ))
                                 goto permission_denied;
+                        if (!(inode->i_mode & S_IRUSR))
+                                goto permission_denied;
                 } else if (mask & MAY_WRITE) {
                         if (!(access & AFS_ACE_WRITE))
                                 goto permission_denied;
+                        if (!(inode->i_mode & S_IWUSR))
+                                goto permission_denied;
                 }
         }
 
         key_put(key);
-        ret = generic_permission(inode, mask);
         _leave(" = %d", ret);
         return ret;
 
diff --git a/fs/afs/server.c b/fs/afs/server.c
index d4066ab7dd55..c001b1f2455f 100644
--- a/fs/afs/server.c
+++ b/fs/afs/server.c
@@ -242,7 +242,7 @@ void afs_put_server(struct afs_server *server)
         spin_lock(&afs_server_graveyard_lock);
         if (atomic_read(&server->usage) == 0) {
                 list_move_tail(&server->grave, &afs_server_graveyard);
-                server->time_of_death = get_seconds();
+                server->time_of_death = ktime_get_real_seconds();
                 queue_delayed_work(afs_wq, &afs_server_reaper,
                                    afs_server_timeout * HZ);
         }
@@ -277,9 +277,9 @@ static void afs_reap_server(struct work_struct *work)
         LIST_HEAD(corpses);
         struct afs_server *server;
         unsigned long delay, expiry;
-        time_t now;
+        time64_t now;
 
-        now = get_seconds();
+        now = ktime_get_real_seconds();
         spin_lock(&afs_server_graveyard_lock);
 
         while (!list_empty(&afs_server_graveyard)) {
diff --git a/fs/afs/vlocation.c b/fs/afs/vlocation.c
index d7d8dd8c0b31..37b7c3b342a6 100644
--- a/fs/afs/vlocation.c
+++ b/fs/afs/vlocation.c
@@ -340,7 +340,8 @@ static void afs_vlocation_queue_for_updates(struct afs_vlocation *vl)
         struct afs_vlocation *xvl;
 
         /* wait at least 10 minutes before updating... */
-        vl->update_at = get_seconds() + afs_vlocation_update_timeout;
+        vl->update_at = ktime_get_real_seconds() +
+                        afs_vlocation_update_timeout;
 
         spin_lock(&afs_vlocation_updates_lock);
 
@@ -506,7 +507,7 @@ void afs_put_vlocation(struct afs_vlocation *vl)
         if (atomic_read(&vl->usage) == 0) {
                 _debug("buried");
                 list_move_tail(&vl->grave, &afs_vlocation_graveyard);
-                vl->time_of_death = get_seconds();
+                vl->time_of_death = ktime_get_real_seconds();
                 queue_delayed_work(afs_wq, &afs_vlocation_reap,
                                    afs_vlocation_timeout * HZ);
 
@@ -543,11 +544,11 @@ static void afs_vlocation_reaper(struct work_struct *work)
         LIST_HEAD(corpses);
         struct afs_vlocation *vl;
         unsigned long delay, expiry;
-        time_t now;
+        time64_t now;
 
         _enter("");
 
-        now = get_seconds();
+        now = ktime_get_real_seconds();
         spin_lock(&afs_vlocation_graveyard_lock);
 
         while (!list_empty(&afs_vlocation_graveyard)) {
@@ -622,13 +623,13 @@ static void afs_vlocation_updater(struct work_struct *work)
 {
         struct afs_cache_vlocation vldb;
         struct afs_vlocation *vl, *xvl;
-        time_t now;
+        time64_t now;
         long timeout;
         int ret;
 
         _enter("");
 
-        now = get_seconds();
+        now = ktime_get_real_seconds();
 
         /* find a record to update */
         spin_lock(&afs_vlocation_updates_lock);
@@ -684,7 +685,8 @@ static void afs_vlocation_updater(struct work_struct *work)
 
         /* and then reschedule */
         _debug("reschedule");
-        vl->update_at = get_seconds() + afs_vlocation_update_timeout;
+        vl->update_at = ktime_get_real_seconds() +
+                        afs_vlocation_update_timeout;
 
         spin_lock(&afs_vlocation_updates_lock);
 
diff --git a/fs/afs/write.c b/fs/afs/write.c
index c83c1a0e851f..2d2fccd5044b 100644
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -84,10 +84,9 @@ void afs_put_writeback(struct afs_writeback *wb)
  * partly or wholly fill a page that's under preparation for writing
  */
 static int afs_fill_page(struct afs_vnode *vnode, struct key *key,
-                         loff_t pos, struct page *page)
+                         loff_t pos, unsigned int len, struct page *page)
 {
         struct afs_read *req;
-        loff_t i_size;
         int ret;
 
         _enter(",,%llu", (unsigned long long)pos);
@@ -99,14 +98,10 @@ static int afs_fill_page(struct afs_vnode *vnode, struct key *key,
 
         atomic_set(&req->usage, 1);
         req->pos = pos;
+        req->len = len;
         req->nr_pages = 1;
         req->pages[0] = page;
-
-        i_size = i_size_read(&vnode->vfs_inode);
-        if (pos + PAGE_SIZE > i_size)
-                req->len = i_size - pos;
-        else
-                req->len = PAGE_SIZE;
+        get_page(page);
 
         ret = afs_vnode_fetch_data(vnode, key, req);
         afs_put_read(req);
@@ -159,12 +154,12 @@ int afs_write_begin(struct file *file, struct address_space *mapping,
                 kfree(candidate);
                 return -ENOMEM;
         }
-        *pagep = page;
-        /* page won't leak in error case: it eventually gets cleaned off LRU */
 
         if (!PageUptodate(page) && len != PAGE_SIZE) {
-                ret = afs_fill_page(vnode, key, index << PAGE_SHIFT, page);
+                ret = afs_fill_page(vnode, key, pos & PAGE_MASK, PAGE_SIZE, page);
                 if (ret < 0) {
+                        unlock_page(page);
+                        put_page(page);
                         kfree(candidate);
                         _leave(" = %d [prep]", ret);
                         return ret;
@@ -172,6 +167,9 @@ int afs_write_begin(struct file *file, struct address_space *mapping,
                 SetPageUptodate(page);
         }
 
+        /* page won't leak in error case: it eventually gets cleaned off LRU */
+        *pagep = page;
+
 try_again:
         spin_lock(&vnode->writeback_lock);
 
@@ -233,7 +231,7 @@ flush_conflicting_wb:
         if (wb->state == AFS_WBACK_PENDING)
                 wb->state = AFS_WBACK_CONFLICTING;
         spin_unlock(&vnode->writeback_lock);
-        if (PageDirty(page)) {
+        if (clear_page_dirty_for_io(page)) {
                 ret = afs_write_back_from_locked_page(wb, page);
                 if (ret < 0) {
                         afs_put_writeback(candidate);
@@ -257,7 +255,9 @@ int afs_write_end(struct file *file, struct address_space *mapping,
                   struct page *page, void *fsdata)
 {
         struct afs_vnode *vnode = AFS_FS_I(file_inode(file));
+        struct key *key = file->private_data;
         loff_t i_size, maybe_i_size;
+        int ret;
 
         _enter("{%x:%u},{%lx}",
                vnode->fid.vid, vnode->fid.vnode, page->index);
@@ -273,6 +273,20 @@ int afs_write_end(struct file *file, struct address_space *mapping,
                 spin_unlock(&vnode->writeback_lock);
         }
 
+        if (!PageUptodate(page)) {
+                if (copied < len) {
+                        /* Try and load any missing data from the server.  The
+                         * unmarshalling routine will take care of clearing any
+                         * bits that are beyond the EOF.
+                         */
+                        ret = afs_fill_page(vnode, key, pos + copied,
+                                            len - copied, page);
+                        if (ret < 0)
+                                return ret;
+                }
+                SetPageUptodate(page);
+        }
+
         set_page_dirty(page);
         if (PageDirty(page))
                 _debug("dirtied");
@@ -307,10 +321,14 @@ static void afs_kill_pages(struct afs_vnode *vnode, bool error,
                 ASSERTCMP(pv.nr, ==, count);
 
                 for (loop = 0; loop < count; loop++) {
-                        ClearPageUptodate(pv.pages[loop]);
+                        struct page *page = pv.pages[loop];
+                        ClearPageUptodate(page);
                         if (error)
-                                SetPageError(pv.pages[loop]);
-                        end_page_writeback(pv.pages[loop]);
+                                SetPageError(page);
+                        if (PageWriteback(page))
+                                end_page_writeback(page);
+                        if (page->index >= first)
+                                first = page->index + 1;
                 }
 
                 __pagevec_release(&pv);
@@ -335,8 +353,6 @@ static int afs_write_back_from_locked_page(struct afs_writeback *wb,
         _enter(",%lx", primary_page->index);
 
         count = 1;
-        if (!clear_page_dirty_for_io(primary_page))
-                BUG();
         if (test_set_page_writeback(primary_page))
                 BUG();
 
@@ -502,17 +518,17 @@ static int afs_writepages_region(struct address_space *mapping,
                  */
                 lock_page(page);
 
-                if (page->mapping != mapping) {
+                if (page->mapping != mapping || !PageDirty(page)) {
                         unlock_page(page);
                         put_page(page);
                         continue;
                 }
 
-                if (wbc->sync_mode != WB_SYNC_NONE)
-                        wait_on_page_writeback(page);
-
-                if (PageWriteback(page) || !PageDirty(page)) {
+                if (PageWriteback(page)) {
                         unlock_page(page);
+                        if (wbc->sync_mode != WB_SYNC_NONE)
+                                wait_on_page_writeback(page);
+                        put_page(page);
                         continue;
                 }
 
@@ -523,6 +539,8 @@ static int afs_writepages_region(struct address_space *mapping,
                 wb->state = AFS_WBACK_WRITING;
                 spin_unlock(&wb->vnode->writeback_lock);
 
+                if (!clear_page_dirty_for_io(page))
+                        BUG();
                 ret = afs_write_back_from_locked_page(wb, page);
                 unlock_page(page);
                 put_page(page);
@@ -746,6 +764,20 @@ out:
 }
 
 /*
+ * Flush out all outstanding writes on a file opened for writing when it is
+ * closed.
+ */
+int afs_flush(struct file *file, fl_owner_t id)
+{
+        _enter("");
+
+        if ((file->f_mode & FMODE_WRITE) == 0)
+                return 0;
+
+        return vfs_fsync(file, 0);
+}
+
+/*
  * notification that a previously read-only page is about to become writable
  * - if it returns an error, the caller will deliver a bus error signal
  */
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 29b7fc28c607..c4115901d906 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1259,7 +1259,7 @@ struct btrfs_root {
         atomic_t will_be_snapshoted;
 
         /* For qgroup metadata space reserve */
-        atomic_t qgroup_meta_rsv;
+        atomic64_t qgroup_meta_rsv;
 };
 static inline u32 btrfs_inode_sectorsize(const struct inode *inode)
 {
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 08b74daf35d0..eb1ee7b6f532 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1342,7 +1342,7 @@ static void __setup_root(struct btrfs_root *root, struct btrfs_fs_info *fs_info,
         atomic_set(&root->orphan_inodes, 0);
         atomic_set(&root->refs, 1);
         atomic_set(&root->will_be_snapshoted, 0);
-        atomic_set(&root->qgroup_meta_rsv, 0);
+        atomic64_set(&root->qgroup_meta_rsv, 0);
         root->log_transid = 0;
         root->log_transid_committed = -1;
         root->last_log_commit = 0;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 28e81922a21c..27fdb250b446 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -1714,7 +1714,8 @@ static int __process_pages_contig(struct address_space *mapping,
                          * can we find nothing at @index.
                          */
                         ASSERT(page_ops & PAGE_LOCK);
-                        return ret;
+                        err = -EAGAIN;
+                        goto out;
                 }
 
                 for (i = 0; i < ret; i++) {
@@ -2583,26 +2584,36 @@ static void end_bio_extent_readpage(struct bio *bio)
 
                 if (tree->ops) {
                         ret = tree->ops->readpage_io_failed_hook(page, mirror);
-                        if (!ret && !bio->bi_error)
-                                uptodate = 1;
-                } else {
+                        if (ret == -EAGAIN) {
+                                /*
+                                 * Data inode's readpage_io_failed_hook() always
+                                 * returns -EAGAIN.
+                                 *
+                                 * The generic bio_readpage_error handles errors
+                                 * the following way: If possible, new read
+                                 * requests are created and submitted and will
+                                 * end up in end_bio_extent_readpage as well (if
+                                 * we're lucky, not in the !uptodate case). In
+                                 * that case it returns 0 and we just go on with
+                                 * the next page in our bio. If it can't handle
+                                 * the error it will return -EIO and we remain
+                                 * responsible for that page.
+                                 */
+                                ret = bio_readpage_error(bio, offset, page,
+                                                         start, end, mirror);
+                                if (ret == 0) {
+                                        uptodate = !bio->bi_error;
+                                        offset += len;
+                                        continue;
+                                }
+                        }
+
                         /*
-                         * The generic bio_readpage_error handles errors the
-                         * following way: If possible, new read requests are
-                         * created and submitted and will end up in
-                         * end_bio_extent_readpage as well (if we're lucky, not
-                         * in the !uptodate case). In that case it returns 0 and
-                         * we just go on with the next page in our bio. If it
-                         * can't handle the error it will return -EIO and we
-                         * remain responsible for that page.
+                         * metadata's readpage_io_failed_hook() always returns
+                         * -EIO and fixes nothing.  -EIO is also returned if
+                         * data inode error could not be fixed.
                          */
-                        ret = bio_readpage_error(bio, offset, page, start, end,
-                                                 mirror);
-                        if (ret == 0) {
-                                uptodate = !bio->bi_error;
-                                offset += len;
-                                continue;
-                        }
+                        ASSERT(ret == -EIO);
                 }
 readpage_ok:
                 if (likely(uptodate)) {
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index c40060cc481f..a18510be76c1 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6709,6 +6709,20 @@ static noinline int uncompress_inline(struct btrfs_path *path,
         max_size = min_t(unsigned long, PAGE_SIZE, max_size);
         ret = btrfs_decompress(compress_type, tmp, page,
                                extent_offset, inline_size, max_size);
+
+        /*
+         * decompression code contains a memset to fill in any space between the end
+         * of the uncompressed data and the end of max_size in case the decompressed
+         * data ends up shorter than ram_bytes.  That doesn't cover the hole between
+         * the end of an inline extent and the beginning of the next block, so we
+         * cover that region here.
+         */
+
+        if (max_size + pg_offset < PAGE_SIZE) {
+                char *map = kmap(page);
+                memset(map + pg_offset + max_size, 0, PAGE_SIZE - max_size - pg_offset);
+                kunmap(page);
+        }
         kfree(tmp);
         return ret;
 }
@@ -10509,9 +10523,9 @@ out_inode:
 }
 
 __attribute__((const))
-static int dummy_readpage_io_failed_hook(struct page *page, int failed_mirror)
+static int btrfs_readpage_io_failed_hook(struct page *page, int failed_mirror)
 {
-        return 0;
+        return -EAGAIN;
 }
 
 static const struct inode_operations btrfs_dir_inode_operations = {
@@ -10556,7 +10570,7 @@ static const struct extent_io_ops btrfs_extent_io_ops = {
         .submit_bio_hook = btrfs_submit_bio_hook,
         .readpage_end_io_hook = btrfs_readpage_end_io_hook,
         .merge_bio_hook = btrfs_merge_bio_hook,
-        .readpage_io_failed_hook = dummy_readpage_io_failed_hook,
+        .readpage_io_failed_hook = btrfs_readpage_io_failed_hook,
 
         /* optional callbacks */
         .fill_delalloc = run_delalloc_range,
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index a5da750c1087..a59801dc2a34 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2948,20 +2948,20 @@ int btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes,
         ret = qgroup_reserve(root, num_bytes, enforce);
         if (ret < 0)
                 return ret;
-        atomic_add(num_bytes, &root->qgroup_meta_rsv);
+        atomic64_add(num_bytes, &root->qgroup_meta_rsv);
         return ret;
 }
 
 void btrfs_qgroup_free_meta_all(struct btrfs_root *root)
 {
         struct btrfs_fs_info *fs_info = root->fs_info;
-        int reserved;
+        u64 reserved;
 
         if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags) ||
             !is_fstree(root->objectid))
                 return;
 
-        reserved = atomic_xchg(&root->qgroup_meta_rsv, 0);
+        reserved = atomic64_xchg(&root->qgroup_meta_rsv, 0);
         if (reserved == 0)
                 return;
         btrfs_qgroup_free_refroot(fs_info, root->objectid, reserved);
@@ -2976,8 +2976,8 @@ void btrfs_qgroup_free_meta(struct btrfs_root *root, int num_bytes)
                 return;
 
         BUG_ON(num_bytes != round_down(num_bytes, fs_info->nodesize));
-        WARN_ON(atomic_read(&root->qgroup_meta_rsv) < num_bytes);
-        atomic_sub(num_bytes, &root->qgroup_meta_rsv);
+        WARN_ON(atomic64_read(&root->qgroup_meta_rsv) < num_bytes);
+        atomic64_sub(num_bytes, &root->qgroup_meta_rsv);
         btrfs_qgroup_free_refroot(fs_info, root->objectid, num_bytes);
 }
 
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 456c8901489b..a60d5bfb8a49 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -6305,8 +6305,13 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
                 goto out;
         }
 
+        /*
+         * Check that we don't overflow at later allocations, we request
+         * clone_sources_count + 1 items, and compare to unsigned long inside
+         * access_ok.
+         */
         if (arg->clone_sources_count >
-            ULLONG_MAX / sizeof(*arg->clone_sources)) {
+            ULONG_MAX / sizeof(struct clone_root) - 1) {
                 ret = -EINVAL;
                 goto out;
         }
diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
index 02a7a9286449..6d6eca394d4d 100644
--- a/fs/crypto/crypto.c
+++ b/fs/crypto/crypto.c
@@ -327,7 +327,6 @@ EXPORT_SYMBOL(fscrypt_decrypt_page);
 static int fscrypt_d_revalidate(struct dentry *dentry, unsigned int flags)
 {
         struct dentry *dir;
-        struct fscrypt_info *ci;
         int dir_has_key, cached_with_key;
 
         if (flags & LOOKUP_RCU)
@@ -339,18 +338,11 @@ static int fscrypt_d_revalidate(struct dentry *dentry, unsigned int flags)
                 return 0;
         }
 
-        ci = d_inode(dir)->i_crypt_info;
-        if (ci && ci->ci_keyring_key &&
-            (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
-                                          (1 << KEY_FLAG_REVOKED) |
-                                          (1 << KEY_FLAG_DEAD))))
-                ci = NULL;
-
         /* this should eventually be an flag in d_flags */
         spin_lock(&dentry->d_lock);
         cached_with_key = dentry->d_flags & DCACHE_ENCRYPTED_WITH_KEY;
         spin_unlock(&dentry->d_lock);
-        dir_has_key = (ci != NULL);
+        dir_has_key = (d_inode(dir)->i_crypt_info != NULL);
         dput(dir);
 
         /*
diff --git a/fs/crypto/fname.c b/fs/crypto/fname.c
index 13052b85c393..37b49894c762 100644
--- a/fs/crypto/fname.c
+++ b/fs/crypto/fname.c
@@ -350,7 +350,7 @@ int fscrypt_setup_filename(struct inode *dir, const struct qstr *iname,
                 fname->disk_name.len = iname->len;
                 return 0;
         }
-        ret = fscrypt_get_crypt_info(dir);
+        ret = fscrypt_get_encryption_info(dir);
         if (ret && ret != -EOPNOTSUPP)
                 return ret;
 
diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h
index fdbb8af32eaf..e39696e64494 100644
--- a/fs/crypto/fscrypt_private.h
+++ b/fs/crypto/fscrypt_private.h
@@ -67,7 +67,6 @@ struct fscrypt_info {
         u8 ci_filename_mode;
         u8 ci_flags;
         struct crypto_skcipher *ci_ctfm;
-        struct key *ci_keyring_key;
         u8 ci_master_key[FS_KEY_DESCRIPTOR_SIZE];
 };
 
@@ -101,7 +100,4 @@ extern int fscrypt_do_page_crypto(const struct inode *inode,
 extern struct page *fscrypt_alloc_bounce_page(struct fscrypt_ctx *ctx,
                                               gfp_t gfp_flags);
 
-/* keyinfo.c */
-extern int fscrypt_get_crypt_info(struct inode *);
-
 #endif /* _FSCRYPT_PRIVATE_H */
diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c
index d5d896fa5a71..8cdfddce2b34 100644
--- a/fs/crypto/keyinfo.c
+++ b/fs/crypto/keyinfo.c
@@ -95,6 +95,7 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
         kfree(description);
         if (IS_ERR(keyring_key))
                 return PTR_ERR(keyring_key);
+        down_read(&keyring_key->sem);
 
         if (keyring_key->type != &key_type_logon) {
                 printk_once(KERN_WARNING
@@ -102,11 +103,9 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
                 res = -ENOKEY;
                 goto out;
         }
-        down_read(&keyring_key->sem);
         ukp = user_key_payload_locked(keyring_key);
         if (ukp->datalen != sizeof(struct fscrypt_key)) {
                 res = -EINVAL;
-                up_read(&keyring_key->sem);
                 goto out;
         }
         master_key = (struct fscrypt_key *)ukp->data;
@@ -117,17 +116,11 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
                                 "%s: key size incorrect: %d\n",
                                 __func__, master_key->size);
                 res = -ENOKEY;
-                up_read(&keyring_key->sem);
                 goto out;
         }
         res = derive_key_aes(ctx->nonce, master_key->raw, raw_key);
-        up_read(&keyring_key->sem);
-        if (res)
-                goto out;
-
-        crypt_info->ci_keyring_key = keyring_key;
-        return 0;
 out:
+        up_read(&keyring_key->sem);
         key_put(keyring_key);
         return res;
 }
@@ -169,12 +162,11 @@ static void put_crypt_info(struct fscrypt_info *ci)
         if (!ci)
                 return;
 
-        key_put(ci->ci_keyring_key);
         crypto_free_skcipher(ci->ci_ctfm);
         kmem_cache_free(fscrypt_info_cachep, ci);
 }
 
-int fscrypt_get_crypt_info(struct inode *inode)
+int fscrypt_get_encryption_info(struct inode *inode)
 {
         struct fscrypt_info *crypt_info;
         struct fscrypt_context ctx;
@@ -184,21 +176,15 @@ int fscrypt_get_crypt_info(struct inode *inode)
         u8 *raw_key = NULL;
         int res;
 
+        if (inode->i_crypt_info)
+                return 0;
+
         res = fscrypt_initialize(inode->i_sb->s_cop->flags);
         if (res)
                 return res;
 
         if (!inode->i_sb->s_cop->get_context)
                 return -EOPNOTSUPP;
-retry:
-        crypt_info = ACCESS_ONCE(inode->i_crypt_info);
-        if (crypt_info) {
-                if (!crypt_info->ci_keyring_key ||
-                                key_validate(crypt_info->ci_keyring_key) == 0)
-                        return 0;
-                fscrypt_put_encryption_info(inode, crypt_info);
-                goto retry;
-        }
 
         res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx));
         if (res < 0) {
@@ -229,7 +215,6 @@ retry:
         crypt_info->ci_data_mode = ctx.contents_encryption_mode;
         crypt_info->ci_filename_mode = ctx.filenames_encryption_mode;
         crypt_info->ci_ctfm = NULL;
-        crypt_info->ci_keyring_key = NULL;
         memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor,
                                 sizeof(crypt_info->ci_master_key));
 
@@ -273,14 +258,8 @@ retry:
         if (res)
                 goto out;
 
-        kzfree(raw_key);
-        raw_key = NULL;
-        if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) != NULL) {
-                put_crypt_info(crypt_info);
-                goto retry;
-        }
-        return 0;
-
+        if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) == NULL)
+                crypt_info = NULL;
 out:
         if (res == -ENOKEY)
                 res = 0;
@@ -288,6 +267,7 @@ out:
         kzfree(raw_key);
         return res;
 }
+EXPORT_SYMBOL(fscrypt_get_encryption_info);
 
 void fscrypt_put_encryption_info(struct inode *inode, struct fscrypt_info *ci)
 {
@@ -305,17 +285,3 @@ void fscrypt_put_encryption_info(struct inode *inode, struct fscrypt_info *ci)
         put_crypt_info(ci);
 }
 EXPORT_SYMBOL(fscrypt_put_encryption_info);
-
-int fscrypt_get_encryption_info(struct inode *inode)
-{
-        struct fscrypt_info *ci = inode->i_crypt_info;
-
-        if (!ci ||
-                (ci->ci_keyring_key &&
-                 (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
-                                               (1 << KEY_FLAG_REVOKED) |
-                                               (1 << KEY_FLAG_DEAD)))))
-                return fscrypt_get_crypt_info(inode);
-        return 0;
-}
-EXPORT_SYMBOL(fscrypt_get_encryption_info);
diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index 14b76da71269..4908906d54d5 100644
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -33,17 +33,10 @@ static int create_encryption_context_from_policy(struct inode *inode,
                                 const struct fscrypt_policy *policy)
 {
         struct fscrypt_context ctx;
-        int res;
 
         if (!inode->i_sb->s_cop->set_context)
                 return -EOPNOTSUPP;
 
-        if (inode->i_sb->s_cop->prepare_context) {
-                res = inode->i_sb->s_cop->prepare_context(inode);
-                if (res)
-                        return res;
-        }
-
         ctx.format = FS_ENCRYPTION_CONTEXT_FORMAT_V1;
         memcpy(ctx.master_key_descriptor, policy->master_key_descriptor,
                                         FS_KEY_DESCRIPTOR_SIZE);
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 7d398d300e97..9382db998ec9 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -743,7 +743,7 @@ static int tcp_accept_from_sock(struct connection *con)
         newsock->type = con->sock->type;
         newsock->ops = con->sock->ops;
 
-        result = con->sock->ops->accept(con->sock, newsock, O_NONBLOCK);
+        result = con->sock->ops->accept(con->sock, newsock, O_NONBLOCK, true);
         if (result < 0)
                 goto accept_err;
 
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index f493af666591..fb69ee2388db 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2466,6 +2466,7 @@ extern int  ext4_setattr(struct dentry *, struct iattr *);
 extern int  ext4_getattr(const struct path *, struct kstat *, u32, unsigned int);
 extern void ext4_evict_inode(struct inode *);
 extern void ext4_clear_inode(struct inode *);
+extern int  ext4_file_getattr(const struct path *, struct kstat *, u32, unsigned int);
 extern int  ext4_sync_inode(handle_t *, struct inode *);
 extern void ext4_dirty_inode(struct inode *, int);
 extern int ext4_change_inode_journal_flag(struct inode *, int);
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 8210c1f43556..cefa9835f275 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -744,7 +744,7 @@ const struct file_operations ext4_file_operations = {
 
 const struct inode_operations ext4_file_inode_operations = {
         .setattr        = ext4_setattr,
-        .getattr        = ext4_getattr,
+        .getattr        = ext4_file_getattr,
         .listxattr      = ext4_listxattr,
         .get_acl        = ext4_get_acl,
         .set_acl        = ext4_set_acl,
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 30a9f210d1e3..375fb1c05d49 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1169,10 +1169,9 @@ static int ext4_finish_convert_inline_dir(handle_t *handle,
         set_buffer_uptodate(dir_block);
         err = ext4_handle_dirty_dirent_node(handle, inode, dir_block);
         if (err)
-                goto out;
+                return err;
         set_buffer_verified(dir_block);
-out:
-        return err;
+        return ext4_mark_inode_dirty(handle, inode);
 }
 
 static int ext4_convert_inline_data_nolock(handle_t *handle,
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 7385e6a6b6cb..b9ffa9f4191f 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5390,17 +5390,52 @@ err_out:
 int ext4_getattr(const struct path *path, struct kstat *stat,
                  u32 request_mask, unsigned int query_flags)
 {
-        struct inode *inode;
-        unsigned long long delalloc_blocks;
+        struct inode *inode = d_inode(path->dentry);
+        struct ext4_inode *raw_inode;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        unsigned int flags;
+
+        if (EXT4_FITS_IN_INODE(raw_inode, ei, i_crtime)) {
+                stat->result_mask |= STATX_BTIME;
+                stat->btime.tv_sec = ei->i_crtime.tv_sec;
+                stat->btime.tv_nsec = ei->i_crtime.tv_nsec;
+        }
+
+        flags = ei->i_flags & EXT4_FL_USER_VISIBLE;
+        if (flags & EXT4_APPEND_FL)
+                stat->attributes |= STATX_ATTR_APPEND;
+        if (flags & EXT4_COMPR_FL)
+                stat->attributes |= STATX_ATTR_COMPRESSED;
+        if (flags & EXT4_ENCRYPT_FL)
+                stat->attributes |= STATX_ATTR_ENCRYPTED;
+        if (flags & EXT4_IMMUTABLE_FL)
+                stat->attributes |= STATX_ATTR_IMMUTABLE;
+        if (flags & EXT4_NODUMP_FL)
+                stat->attributes |= STATX_ATTR_NODUMP;
+
+        stat->attributes_mask |= (STATX_ATTR_APPEND |
+                                  STATX_ATTR_COMPRESSED |
+                                  STATX_ATTR_ENCRYPTED |
+                                  STATX_ATTR_IMMUTABLE |
+                                  STATX_ATTR_NODUMP);
 
-        inode = d_inode(path->dentry);
         generic_fillattr(inode, stat);
+        return 0;
+}
+
+int ext4_file_getattr(const struct path *path, struct kstat *stat,
+                      u32 request_mask, unsigned int query_flags)
+{
+        struct inode *inode = d_inode(path->dentry);
+        u64 delalloc_blocks;
+
+        ext4_getattr(path, stat, request_mask, query_flags);
 
         /*
          * If there is inline data in the inode, the inode will normally not
          * have data blocks allocated (it may have an external xattr block).
          * Report at least one sector for such files, so tools like tar, rsync,
-         * others doen't incorrectly think the file is completely sparse.
+         * others don't incorrectly think the file is completely sparse.
          */
         if (unlikely(ext4_has_inline_data(inode)))
                 stat->blocks += (stat->size + 511) >> 9;
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 578f8c33fb44..c992ef2c2f94 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -511,7 +511,7 @@ mext_check_arguments(struct inode *orig_inode,
         if ((orig_start & ~(PAGE_MASK >> orig_inode->i_blkbits)) !=
             (donor_start & ~(PAGE_MASK >> orig_inode->i_blkbits))) {
                 ext4_debug("ext4 move extent: orig and donor's start "
-                        "offset are not alligned [ino:orig %lu, donor %lu]\n",
+                        "offsets are not aligned [ino:orig %lu, donor %lu]\n",
                         orig_inode->i_ino, donor_inode->i_ino);
                 return -EINVAL;
         }
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 6ad612c576fc..07e5e1405771 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3912,6 +3912,7 @@ const struct inode_operations ext4_dir_inode_operations = {
         .tmpfile        = ext4_tmpfile,
         .rename         = ext4_rename2,
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
         .get_acl        = ext4_get_acl,
         .set_acl        = ext4_set_acl,
@@ -3920,6 +3921,7 @@ const struct inode_operations ext4_dir_inode_operations = {
 
 const struct inode_operations ext4_special_inode_operations = {
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
         .get_acl        = ext4_get_acl,
         .set_acl        = ext4_set_acl,
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 2e03a0a88d92..a9448db1cf7e 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1120,17 +1120,16 @@ static int ext4_get_context(struct inode *inode, void *ctx, size_t len)
                                  EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, ctx, len);
 }
 
-static int ext4_prepare_context(struct inode *inode)
-{
-        return ext4_convert_inline_data(inode);
-}
-
 static int ext4_set_context(struct inode *inode, const void *ctx, size_t len,
                                                         void *fs_data)
 {
         handle_t *handle = fs_data;
         int res, res2, retries = 0;
 
+        res = ext4_convert_inline_data(inode);
+        if (res)
+                return res;
+
         /*
          * If a journal handle was specified, then the encryption context is
          * being set on a new inode via inheritance and is part of a larger
@@ -1196,7 +1195,6 @@ static unsigned ext4_max_namelen(struct inode *inode)
 static const struct fscrypt_operations ext4_cryptops = {
         .key_prefix             = "ext4:",
         .get_context            = ext4_get_context,
-        .prepare_context        = ext4_prepare_context,
         .set_context            = ext4_set_context,
         .dummy_context          = ext4_dummy_context,
         .is_encrypted           = ext4_encrypted_inode,
diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c
index 73b184d161fc..5c8fc53cb0e5 100644
--- a/fs/ext4/symlink.c
+++ b/fs/ext4/symlink.c
@@ -85,17 +85,20 @@ errout:
 const struct inode_operations ext4_encrypted_symlink_inode_operations = {
         .get_link       = ext4_encrypted_get_link,
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
 };
 
 const struct inode_operations ext4_symlink_inode_operations = {
         .get_link       = page_get_link,
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
 };
 
 const struct inode_operations ext4_fast_symlink_inode_operations = {
         .get_link       = simple_get_link,
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
 };
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 67636acf7624..996e7900d4c8 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -131,31 +131,26 @@ static __le32 ext4_xattr_block_csum(struct inode *inode,
 }
 
 static int ext4_xattr_block_csum_verify(struct inode *inode,
-                                        sector_t block_nr,
-                                        struct ext4_xattr_header *hdr)
+                                        struct buffer_head *bh)
 {
-        if (ext4_has_metadata_csum(inode->i_sb) &&
-            (hdr->h_checksum != ext4_xattr_block_csum(inode, block_nr, hdr)))
-                return 0;
-        return 1;
-}
-
-static void ext4_xattr_block_csum_set(struct inode *inode,
-                                      sector_t block_nr,
-                                      struct ext4_xattr_header *hdr)
-{
-        if (!ext4_has_metadata_csum(inode->i_sb))
-                return;
+        struct ext4_xattr_header *hdr = BHDR(bh);
+        int ret = 1;
 
-        hdr->h_checksum = ext4_xattr_block_csum(inode, block_nr, hdr);
+        if (ext4_has_metadata_csum(inode->i_sb)) {
+                lock_buffer(bh);
+                ret = (hdr->h_checksum == ext4_xattr_block_csum(inode,
+                                                        bh->b_blocknr, hdr));
+                unlock_buffer(bh);
+        }
+        return ret;
 }
 
-static inline int ext4_handle_dirty_xattr_block(handle_t *handle,
-                                                struct inode *inode,
-                                                struct buffer_head *bh)
+static void ext4_xattr_block_csum_set(struct inode *inode,
+                                      struct buffer_head *bh)
 {
-        ext4_xattr_block_csum_set(inode, bh->b_blocknr, BHDR(bh));
-        return ext4_handle_dirty_metadata(handle, inode, bh);
+        if (ext4_has_metadata_csum(inode->i_sb))
+                BHDR(bh)->h_checksum = ext4_xattr_block_csum(inode,
+                                                bh->b_blocknr, BHDR(bh));
 }
 
 static inline const struct xattr_handler *
@@ -233,7 +228,7 @@ ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh)
         if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
             BHDR(bh)->h_blocks != cpu_to_le32(1))
                 return -EFSCORRUPTED;
-        if (!ext4_xattr_block_csum_verify(inode, bh->b_blocknr, BHDR(bh)))
+        if (!ext4_xattr_block_csum_verify(inode, bh))
                 return -EFSBADCRC;
         error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size,
                                        bh->b_data);
@@ -618,23 +613,22 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
                         }
                 }
 
+                ext4_xattr_block_csum_set(inode, bh);
                 /*
                  * Beware of this ugliness: Releasing of xattr block references
                  * from different inodes can race and so we have to protect
                  * from a race where someone else frees the block (and releases
                  * its journal_head) before we are done dirtying the buffer. In
                  * nojournal mode this race is harmless and we actually cannot
-                 * call ext4_handle_dirty_xattr_block() with locked buffer as
+                 * call ext4_handle_dirty_metadata() with locked buffer as
                  * that function can call sync_dirty_buffer() so for that case
                  * we handle the dirtying after unlocking the buffer.
                  */
                 if (ext4_handle_valid(handle))
-                        error = ext4_handle_dirty_xattr_block(handle, inode,
-                                                              bh);
+                        error = ext4_handle_dirty_metadata(handle, inode, bh);
                 unlock_buffer(bh);
                 if (!ext4_handle_valid(handle))
-                        error = ext4_handle_dirty_xattr_block(handle, inode,
-                                                              bh);
+                        error = ext4_handle_dirty_metadata(handle, inode, bh);
                 if (IS_SYNC(inode))
                         ext4_handle_sync(handle);
                 dquot_free_block(inode, EXT4_C2B(EXT4_SB(inode->i_sb), 1));
@@ -863,13 +857,14 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
                                 ext4_xattr_cache_insert(ext4_mb_cache,
                                         bs->bh);
                         }
+                        ext4_xattr_block_csum_set(inode, bs->bh);
                         unlock_buffer(bs->bh);
                         if (error == -EFSCORRUPTED)
                                 goto bad_block;
                         if (!error)
-                                error = ext4_handle_dirty_xattr_block(handle,
-                                                                      inode,
-                                                                      bs->bh);
+                                error = ext4_handle_dirty_metadata(handle,
+                                                                   inode,
+                                                                   bs->bh);
                         if (error)
                                 goto cleanup;
                         goto inserted;
@@ -967,10 +962,11 @@ inserted:
                                         ce->e_reusable = 0;
                                 ea_bdebug(new_bh, "reusing; refcount now=%d",
                                           ref);
+                                ext4_xattr_block_csum_set(inode, new_bh);
                                 unlock_buffer(new_bh);
-                                error = ext4_handle_dirty_xattr_block(handle,
-                                                                      inode,
-                                                                      new_bh);
+                                error = ext4_handle_dirty_metadata(handle,
+                                                                   inode,
+                                                                   new_bh);
                                 if (error)
                                         goto cleanup_dquot;
                         }
@@ -1020,11 +1016,12 @@ getblk_failed:
                                 goto getblk_failed;
                         }
                         memcpy(new_bh->b_data, s->base, new_bh->b_size);
+                        ext4_xattr_block_csum_set(inode, new_bh);
                         set_buffer_uptodate(new_bh);
                         unlock_buffer(new_bh);
                         ext4_xattr_cache_insert(ext4_mb_cache, new_bh);
-                        error = ext4_handle_dirty_xattr_block(handle,
-                                                              inode, new_bh);
+                        error = ext4_handle_dirty_metadata(handle, inode,
+                                                           new_bh);
                         if (error)
                                 goto cleanup;
                 }
diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c
index a77df377e2e8..ee2d0a485fc3 100644
--- a/fs/f2fs/debug.c
+++ b/fs/f2fs/debug.c
@@ -196,6 +196,7 @@ static void update_mem_info(struct f2fs_sb_info *sbi)
         si->base_mem += (NM_I(sbi)->nat_bits_blocks << F2FS_BLKSIZE_BITS);
         si->base_mem += NM_I(sbi)->nat_blocks * NAT_ENTRY_BITMAP_SIZE;
         si->base_mem += NM_I(sbi)->nat_blocks / 8;
+        si->base_mem += NM_I(sbi)->nat_blocks * sizeof(unsigned short);
 
 get_cache:
         si->cache_mem = 0;
diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index 4650c9b85de7..8d5c62b07b28 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -750,7 +750,7 @@ void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page,
         dentry_blk = page_address(page);
         bit_pos = dentry - dentry_blk->dentry;
         for (i = 0; i < slots; i++)
-                clear_bit_le(bit_pos + i, &dentry_blk->dentry_bitmap);
+                __clear_bit_le(bit_pos + i, &dentry_blk->dentry_bitmap);
 
         /* Let's check and deallocate this dentry page */
         bit_pos = find_next_bit_le(&dentry_blk->dentry_bitmap,
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index e849f83d6114..0a6e115562f6 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -561,6 +561,8 @@ struct f2fs_nm_info {
         struct mutex build_lock;        /* lock for build free nids */
         unsigned char (*free_nid_bitmap)[NAT_ENTRY_BITMAP_SIZE];
         unsigned char *nat_block_bitmap;
+        unsigned short *free_nid_count; /* free nid count of NAT block */
+        spinlock_t free_nid_lock;       /* protect updating of nid count */
 
         /* for checkpoint */
         char *nat_bitmap;               /* NAT bitmap pointer */
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 94967171dee8..481aa8dc79f4 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -338,9 +338,6 @@ static void set_node_addr(struct f2fs_sb_info *sbi, struct node_info *ni,
                 set_nat_flag(e, IS_CHECKPOINTED, false);
         __set_nat_cache_dirty(nm_i, e);
 
-        if (enabled_nat_bits(sbi, NULL) && new_blkaddr == NEW_ADDR)
-                clear_bit_le(NAT_BLOCK_OFFSET(ni->nid), nm_i->empty_nat_bits);
-
         /* update fsync_mark if its inode nat entry is still alive */
         if (ni->nid != ni->ino)
                 e = __lookup_nat_cache(nm_i, ni->ino);
@@ -1823,7 +1820,8 @@ static void remove_free_nid(struct f2fs_sb_info *sbi, nid_t nid)
                 kmem_cache_free(free_nid_slab, i);
 }
 
-void update_free_nid_bitmap(struct f2fs_sb_info *sbi, nid_t nid, bool set)
+static void update_free_nid_bitmap(struct f2fs_sb_info *sbi, nid_t nid,
+                        bool set, bool build, bool locked)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
         unsigned int nat_ofs = NAT_BLOCK_OFFSET(nid);
@@ -1833,9 +1831,18 @@ void update_free_nid_bitmap(struct f2fs_sb_info *sbi, nid_t nid, bool set)
                 return;
 
         if (set)
-                set_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
+                __set_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
         else
-                clear_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
+                __clear_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
+
+        if (!locked)
+                spin_lock(&nm_i->free_nid_lock);
+        if (set)
+                nm_i->free_nid_count[nat_ofs]++;
+        else if (!build)
+                nm_i->free_nid_count[nat_ofs]--;
+        if (!locked)
+                spin_unlock(&nm_i->free_nid_lock);
 }
 
 static void scan_nat_page(struct f2fs_sb_info *sbi,
@@ -1847,7 +1854,10 @@ static void scan_nat_page(struct f2fs_sb_info *sbi,
         unsigned int nat_ofs = NAT_BLOCK_OFFSET(start_nid);
         int i;
 
-        set_bit_le(nat_ofs, nm_i->nat_block_bitmap);
+        if (test_bit_le(nat_ofs, nm_i->nat_block_bitmap))
+                return;
+
+        __set_bit_le(nat_ofs, nm_i->nat_block_bitmap);
 
         i = start_nid % NAT_ENTRY_PER_BLOCK;
 
@@ -1861,7 +1871,7 @@ static void scan_nat_page(struct f2fs_sb_info *sbi,
                 f2fs_bug_on(sbi, blk_addr == NEW_ADDR);
                 if (blk_addr == NULL_ADDR)
                         freed = add_free_nid(sbi, start_nid, true);
-                update_free_nid_bitmap(sbi, start_nid, freed);
+                update_free_nid_bitmap(sbi, start_nid, freed, true, false);
         }
 }
 
@@ -1877,6 +1887,8 @@ static void scan_free_nid_bits(struct f2fs_sb_info *sbi)
         for (i = 0; i < nm_i->nat_blocks; i++) {
                 if (!test_bit_le(i, nm_i->nat_block_bitmap))
                         continue;
+                if (!nm_i->free_nid_count[i])
+                        continue;
                 for (idx = 0; idx < NAT_ENTRY_PER_BLOCK; idx++) {
                         nid_t nid;
 
@@ -1907,58 +1919,6 @@ out:
         up_read(&nm_i->nat_tree_lock);
 }
 
-static int scan_nat_bits(struct f2fs_sb_info *sbi)
-{
-        struct f2fs_nm_info *nm_i = NM_I(sbi);
-        struct page *page;
-        unsigned int i = 0;
-        nid_t nid;
-
-        if (!enabled_nat_bits(sbi, NULL))
-                return -EAGAIN;
-
-        down_read(&nm_i->nat_tree_lock);
-check_empty:
-        i = find_next_bit_le(nm_i->empty_nat_bits, nm_i->nat_blocks, i);
-        if (i >= nm_i->nat_blocks) {
-                i = 0;
-                goto check_partial;
-        }
-
-        for (nid = i * NAT_ENTRY_PER_BLOCK; nid < (i + 1) * NAT_ENTRY_PER_BLOCK;
-                                                                        nid++) {
-                if (unlikely(nid >= nm_i->max_nid))
-                        break;
-                add_free_nid(sbi, nid, true);
-        }
-
-        if (nm_i->nid_cnt[FREE_NID_LIST] >= MAX_FREE_NIDS)
-                goto out;
-        i++;
-        goto check_empty;
-
-check_partial:
-        i = find_next_zero_bit_le(nm_i->full_nat_bits, nm_i->nat_blocks, i);
-        if (i >= nm_i->nat_blocks) {
-                disable_nat_bits(sbi, true);
-                up_read(&nm_i->nat_tree_lock);
-                return -EINVAL;
-        }
-
-        nid = i * NAT_ENTRY_PER_BLOCK;
-        page = get_current_nat_page(sbi, nid);
-        scan_nat_page(sbi, page, nid);
-        f2fs_put_page(page, 1);
-
-        if (nm_i->nid_cnt[FREE_NID_LIST] < MAX_FREE_NIDS) {
-                i++;
-                goto check_partial;
-        }
-out:
-        up_read(&nm_i->nat_tree_lock);
-        return 0;
-}
-
 static void __build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
@@ -1980,21 +1940,6 @@ static void __build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount)
 
                 if (nm_i->nid_cnt[FREE_NID_LIST])
                         return;
-
-                /* try to find free nids with nat_bits */
-                if (!scan_nat_bits(sbi) && nm_i->nid_cnt[FREE_NID_LIST])
-                        return;
-        }
-
-        /* find next valid candidate */
-        if (enabled_nat_bits(sbi, NULL)) {
-                int idx = find_next_zero_bit_le(nm_i->full_nat_bits,
-                                        nm_i->nat_blocks, 0);
-
-                if (idx >= nm_i->nat_blocks)
-                        set_sbi_flag(sbi, SBI_NEED_FSCK);
-                else
-                        nid = idx * NAT_ENTRY_PER_BLOCK;
         }
 
         /* readahead nat pages to be scanned */
@@ -2081,7 +2026,7 @@ retry:
                 __insert_nid_to_list(sbi, i, ALLOC_NID_LIST, false);
                 nm_i->available_nids--;
 
-                update_free_nid_bitmap(sbi, *nid, false);
+                update_free_nid_bitmap(sbi, *nid, false, false, false);
 
                 spin_unlock(&nm_i->nid_list_lock);
                 return true;
@@ -2137,7 +2082,7 @@ void alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid)
 
         nm_i->available_nids++;
 
-        update_free_nid_bitmap(sbi, nid, true);
+        update_free_nid_bitmap(sbi, nid, true, false, false);
 
         spin_unlock(&nm_i->nid_list_lock);
 
@@ -2383,7 +2328,7 @@ add_out:
         list_add_tail(&nes->set_list, head);
 }
 
-void __update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid,
+static void __update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid,
                                                 struct page *page)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
@@ -2402,16 +2347,16 @@ void __update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid,
                         valid++;
         }
         if (valid == 0) {
-                set_bit_le(nat_index, nm_i->empty_nat_bits);
-                clear_bit_le(nat_index, nm_i->full_nat_bits);
+                __set_bit_le(nat_index, nm_i->empty_nat_bits);
+                __clear_bit_le(nat_index, nm_i->full_nat_bits);
                 return;
         }
 
-        clear_bit_le(nat_index, nm_i->empty_nat_bits);
+        __clear_bit_le(nat_index, nm_i->empty_nat_bits);
         if (valid == NAT_ENTRY_PER_BLOCK)
-                set_bit_le(nat_index, nm_i->full_nat_bits);
+                __set_bit_le(nat_index, nm_i->full_nat_bits);
         else
-                clear_bit_le(nat_index, nm_i->full_nat_bits);
+                __clear_bit_le(nat_index, nm_i->full_nat_bits);
 }
 
 static void __flush_nat_entry_set(struct f2fs_sb_info *sbi,
@@ -2467,11 +2412,11 @@ static void __flush_nat_entry_set(struct f2fs_sb_info *sbi,
                         add_free_nid(sbi, nid, false);
                         spin_lock(&NM_I(sbi)->nid_list_lock);
                         NM_I(sbi)->available_nids++;
-                        update_free_nid_bitmap(sbi, nid, true);
+                        update_free_nid_bitmap(sbi, nid, true, false, false);
                         spin_unlock(&NM_I(sbi)->nid_list_lock);
                 } else {
                         spin_lock(&NM_I(sbi)->nid_list_lock);
-                        update_free_nid_bitmap(sbi, nid, false);
+                        update_free_nid_bitmap(sbi, nid, false, false, false);
                         spin_unlock(&NM_I(sbi)->nid_list_lock);
                 }
         }
@@ -2577,6 +2522,40 @@ static int __get_nat_bitmaps(struct f2fs_sb_info *sbi)
         return 0;
 }
 
+inline void load_free_nid_bitmap(struct f2fs_sb_info *sbi)
+{
+        struct f2fs_nm_info *nm_i = NM_I(sbi);
+        unsigned int i = 0;
+        nid_t nid, last_nid;
+
+        if (!enabled_nat_bits(sbi, NULL))
+                return;
+
+        for (i = 0; i < nm_i->nat_blocks; i++) {
+                i = find_next_bit_le(nm_i->empty_nat_bits, nm_i->nat_blocks, i);
+                if (i >= nm_i->nat_blocks)
+                        break;
+
+                __set_bit_le(i, nm_i->nat_block_bitmap);
+
+                nid = i * NAT_ENTRY_PER_BLOCK;
+                last_nid = (i + 1) * NAT_ENTRY_PER_BLOCK;
+
+                spin_lock(&nm_i->free_nid_lock);
+                for (; nid < last_nid; nid++)
+                        update_free_nid_bitmap(sbi, nid, true, true, true);
+                spin_unlock(&nm_i->free_nid_lock);
+        }
+
+        for (i = 0; i < nm_i->nat_blocks; i++) {
+                i = find_next_bit_le(nm_i->full_nat_bits, nm_i->nat_blocks, i);
+                if (i >= nm_i->nat_blocks)
+                        break;
+
+                __set_bit_le(i, nm_i->nat_block_bitmap);
+        }
+}
+
 static int init_node_manager(struct f2fs_sb_info *sbi)
 {
         struct f2fs_super_block *sb_raw = F2FS_RAW_SUPER(sbi);
@@ -2638,7 +2617,7 @@ static int init_node_manager(struct f2fs_sb_info *sbi)
         return 0;
 }
 
-int init_free_nid_cache(struct f2fs_sb_info *sbi)
+static int init_free_nid_cache(struct f2fs_sb_info *sbi)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
 
@@ -2651,6 +2630,14 @@ int init_free_nid_cache(struct f2fs_sb_info *sbi)
                                                                 GFP_KERNEL);
         if (!nm_i->nat_block_bitmap)
                 return -ENOMEM;
+
+        nm_i->free_nid_count = f2fs_kvzalloc(nm_i->nat_blocks *
+                                        sizeof(unsigned short), GFP_KERNEL);
+        if (!nm_i->free_nid_count)
+                return -ENOMEM;
+
+        spin_lock_init(&nm_i->free_nid_lock);
+
         return 0;
 }
 
@@ -2670,6 +2657,9 @@ int build_node_manager(struct f2fs_sb_info *sbi)
         if (err)
                 return err;
 
+        /* load free nid status from nat_bits table */
+        load_free_nid_bitmap(sbi);
+
         build_free_nids(sbi, true, true);
         return 0;
 }
@@ -2730,6 +2720,7 @@ void destroy_node_manager(struct f2fs_sb_info *sbi)
 
         kvfree(nm_i->nat_block_bitmap);
         kvfree(nm_i->free_nid_bitmap);
+        kvfree(nm_i->free_nid_count);
 
         kfree(nm_i->nat_bitmap);
         kfree(nm_i->nat_bits);
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 4bd7a8b19332..29ef7088c558 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -1163,6 +1163,12 @@ static void update_sit_entry(struct f2fs_sb_info *sbi, block_t blkaddr, int del)
                 if (f2fs_discard_en(sbi) &&
                         !f2fs_test_and_set_bit(offset, se->discard_map))
                         sbi->discard_blks--;
+
+                /* don't overwrite by SSR to keep node chain */
+                if (se->type == CURSEG_WARM_NODE) {
+                        if (!f2fs_test_and_set_bit(offset, se->ckpt_valid_map))
+                                se->ckpt_valid_blocks++;
+                }
         } else {
                 if (!f2fs_test_and_clear_bit(offset, se->cur_valid_map)) {
 #ifdef CONFIG_F2FS_CHECK_FS
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 338d2f73eb29..a2c05f2ada6d 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -1359,6 +1359,16 @@ out:
         return 0;
 }
 
+static void fat_dummy_inode_init(struct inode *inode)
+{
+        /* Initialize this dummy inode to work as no-op. */
+        MSDOS_I(inode)->mmu_private = 0;
+        MSDOS_I(inode)->i_start = 0;
+        MSDOS_I(inode)->i_logstart = 0;
+        MSDOS_I(inode)->i_attrs = 0;
+        MSDOS_I(inode)->i_pos = 0;
+}
+
 static int fat_read_root(struct inode *inode)
 {
         struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb);
@@ -1803,12 +1813,13 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
         fat_inode = new_inode(sb);
         if (!fat_inode)
                 goto out_fail;
-        MSDOS_I(fat_inode)->i_pos = 0;
+        fat_dummy_inode_init(fat_inode);
         sbi->fat_inode = fat_inode;
 
         fsinfo_inode = new_inode(sb);
         if (!fsinfo_inode)
                 goto out_fail;
+        fat_dummy_inode_init(fsinfo_inode);
         fsinfo_inode->i_ino = MSDOS_FSINFO_INO;
         sbi->fsinfo_inode = fsinfo_inode;
         insert_inode_hash(fsinfo_inode);
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index ef600591d96f..63ee2940775c 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -173,19 +173,33 @@ static void wb_wakeup(struct bdi_writeback *wb)
         spin_unlock_bh(&wb->work_lock);
 }
 
+static void finish_writeback_work(struct bdi_writeback *wb,
+                                  struct wb_writeback_work *work)
+{
+        struct wb_completion *done = work->done;
+
+        if (work->auto_free)
+                kfree(work);
+        if (done && atomic_dec_and_test(&done->cnt))
+                wake_up_all(&wb->bdi->wb_waitq);
+}
+
 static void wb_queue_work(struct bdi_writeback *wb,
                           struct wb_writeback_work *work)
 {
         trace_writeback_queue(wb, work);
 
-        spin_lock_bh(&wb->work_lock);
-        if (!test_bit(WB_registered, &wb->state))
-                goto out_unlock;
         if (work->done)
                 atomic_inc(&work->done->cnt);
-        list_add_tail(&work->list, &wb->work_list);
-        mod_delayed_work(bdi_wq, &wb->dwork, 0);
-out_unlock:
+
+        spin_lock_bh(&wb->work_lock);
+
+        if (test_bit(WB_registered, &wb->state)) {
+                list_add_tail(&work->list, &wb->work_list);
+                mod_delayed_work(bdi_wq, &wb->dwork, 0);
+        } else
+                finish_writeback_work(wb, work);
+
         spin_unlock_bh(&wb->work_lock);
 }
 
@@ -1873,16 +1887,9 @@ static long wb_do_writeback(struct bdi_writeback *wb)
 
         set_bit(WB_writeback_running, &wb->state);
         while ((work = get_next_work_item(wb)) != NULL) {
-                struct wb_completion *done = work->done;
-
                 trace_writeback_exec(wb, work);
-
                 wrote += wb_writeback(wb, work);
-
-                if (work->auto_free)
-                        kfree(work);
-                if (done && atomic_dec_and_test(&done->cnt))
-                        wake_up_all(&wb->bdi->wb_waitq);
+                finish_writeback_work(wb, work);
         }
 
         /*
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index c45084ac642d..511e1ed7e2de 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -207,7 +207,7 @@ struct lm_lockname {
         struct gfs2_sbd *ln_sbd;
         u64 ln_number;
         unsigned int ln_type;
-};
+} __packed __aligned(sizeof(int));
 
 #define lm_name_equal(name1, name2) \
         (((name1)->ln_number == (name2)->ln_number) &&  \
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 8f96461236f6..7163fe014b57 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -695,14 +695,11 @@ static struct inode *hugetlbfs_get_root(struct super_block *sb,
 
         inode = new_inode(sb);
         if (inode) {
-                struct hugetlbfs_inode_info *info;
                 inode->i_ino = get_next_ino();
                 inode->i_mode = S_IFDIR | config->mode;
                 inode->i_uid = config->uid;
                 inode->i_gid = config->gid;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
-                info = HUGETLBFS_I(inode);
-                mpol_shared_policy_init(&info->policy, NULL);
                 inode->i_op = &hugetlbfs_dir_inode_operations;
                 inode->i_fop = &simple_dir_operations;
                 /* directory inodes start off with i_nlink == 2 (for "." entry) */
@@ -733,7 +730,6 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
 
         inode = new_inode(sb);
         if (inode) {
-                struct hugetlbfs_inode_info *info;
                 inode->i_ino = get_next_ino();
                 inode_init_owner(inode, dir, mode);
                 lockdep_set_class(&inode->i_mapping->i_mmap_rwsem,
@@ -741,15 +737,6 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                 inode->i_mapping->a_ops = &hugetlbfs_aops;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
                 inode->i_mapping->private_data = resv_map;
-                info = HUGETLBFS_I(inode);
-                /*
-                 * The policy is initialized here even if we are creating a
-                 * private inode because initialization simply creates an
-                 * an empty rb tree and calls rwlock_init(), later when we
-                 * call mpol_free_shared_policy() it will just return because
-                 * the rb tree will still be empty.
-                 */
-                mpol_shared_policy_init(&info->policy, NULL);
                 switch (mode & S_IFMT) {
                 default:
                         init_special_inode(inode, mode, dev);
@@ -937,6 +924,18 @@ static struct inode *hugetlbfs_alloc_inode(struct super_block *sb)
                 hugetlbfs_inc_free_inodes(sbinfo);
                 return NULL;
         }
+
+        /*
+         * Any time after allocation, hugetlbfs_destroy_inode can be called
+         * for the inode.  mpol_free_shared_policy is unconditionally called
+         * as part of hugetlbfs_destroy_inode.  So, initialize policy here
+         * in case of a quick call to destroy.
+         *
+         * Note that the policy is initialized even if we are creating a
+         * private inode.  This simplifies hugetlbfs_destroy_inode.
+         */
+        mpol_shared_policy_init(&p->policy, NULL);
+
         return &p->vfs_inode;
 }
 
diff --git a/fs/iomap.c b/fs/iomap.c
index 3ca1a8e44135..141c3cd55a8b 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -846,7 +846,8 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         struct address_space *mapping = iocb->ki_filp->f_mapping;
         struct inode *inode = file_inode(iocb->ki_filp);
         size_t count = iov_iter_count(iter);
-        loff_t pos = iocb->ki_pos, end = iocb->ki_pos + count - 1, ret = 0;
+        loff_t pos = iocb->ki_pos, start = pos;
+        loff_t end = iocb->ki_pos + count - 1, ret = 0;
         unsigned int flags = IOMAP_DIRECT;
         struct blk_plug plug;
         struct iomap_dio *dio;
@@ -887,12 +888,12 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         }
 
         if (mapping->nrpages) {
-                ret = filemap_write_and_wait_range(mapping, iocb->ki_pos, end);
+                ret = filemap_write_and_wait_range(mapping, start, end);
                 if (ret)
                         goto out_free_dio;
 
                 ret = invalidate_inode_pages2_range(mapping,
-                                iocb->ki_pos >> PAGE_SHIFT, end >> PAGE_SHIFT);
+                                start >> PAGE_SHIFT, end >> PAGE_SHIFT);
                 WARN_ON_ONCE(ret);
                 ret = 0;
         }
@@ -941,6 +942,8 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                 __set_current_state(TASK_RUNNING);
         }
 
+        ret = iomap_dio_complete(dio);
+
         /*
          * Try again to invalidate clean pages which might have been cached by
          * non-direct readahead, or faulted in by get_user_pages() if the source
@@ -949,12 +952,12 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
          * this invalidation fails, tough, the write still worked...
          */
         if (iov_iter_rw(iter) == WRITE && mapping->nrpages) {
-                ret = invalidate_inode_pages2_range(mapping,
-                                iocb->ki_pos >> PAGE_SHIFT, end >> PAGE_SHIFT);
-                WARN_ON_ONCE(ret);
+                int err = invalidate_inode_pages2_range(mapping,
+                                start >> PAGE_SHIFT, end >> PAGE_SHIFT);
+                WARN_ON_ONCE(err);
         }
 
-        return iomap_dio_complete(dio);
+        return ret;
 
 out_free_dio:
         kfree(dio);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index a1a359bfcc9c..5adc2fb62b0f 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1125,10 +1125,8 @@ static journal_t *journal_init_common(struct block_device *bdev,
 
         /* Set up a default-sized revoke table for the new mount. */
         err = jbd2_journal_init_revoke(journal, JOURNAL_REVOKE_DEFAULT_HASH);
-        if (err) {
-                kfree(journal);
-                return NULL;
-        }
+        if (err)
+                goto err_cleanup;
 
         spin_lock_init(&journal->j_history_lock);
 
@@ -1145,23 +1143,25 @@ static journal_t *journal_init_common(struct block_device *bdev,
         journal->j_wbufsize = n;
         journal->j_wbuf = kmalloc_array(n, sizeof(struct buffer_head *),
                                         GFP_KERNEL);
-        if (!journal->j_wbuf) {
-                kfree(journal);
-                return NULL;
-        }
+        if (!journal->j_wbuf)
+                goto err_cleanup;
 
         bh = getblk_unmovable(journal->j_dev, start, journal->j_blocksize);
         if (!bh) {
                 pr_err("%s: Cannot get buffer for journal superblock\n",
                         __func__);
-                kfree(journal->j_wbuf);
-                kfree(journal);
-                return NULL;
+                goto err_cleanup;
         }
         journal->j_sb_buffer = bh;
         journal->j_superblock = (journal_superblock_t *)bh->b_data;
 
         return journal;
+
+err_cleanup:
+        kfree(journal->j_wbuf);
+        jbd2_journal_destroy_revoke(journal);
+        kfree(journal);
+        return NULL;
 }
 
 /* jbd2_journal_init_dev and jbd2_journal_init_inode:
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index cfc38b552118..f9aefcda5854 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -280,6 +280,7 @@ int jbd2_journal_init_revoke(journal_t *journal, int hash_size)
 
 fail1:
         jbd2_journal_destroy_revoke_table(journal->j_revoke_table[0]);
+        journal->j_revoke_table[0] = NULL;
 fail0:
         return -ENOMEM;
 }
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index 8e4dc7ab584c..ac2dfe0c5a9c 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -809,7 +809,8 @@ void kernfs_drain_open_files(struct kernfs_node *kn)
                 if (kn->flags & KERNFS_HAS_MMAP)
                         unmap_mapping_range(inode->i_mapping, 0, 0, 1);
 
-                kernfs_release_file(kn, of);
+                if (kn->flags & KERNFS_HAS_RELEASE)
+                        kernfs_release_file(kn, of);
         }
 
         mutex_unlock(&kernfs_open_file_mutex);
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index bb79972dc638..773774531aff 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -232,12 +232,12 @@ static struct svc_serv_ops nfs41_cb_sv_ops = {
         .svo_module             = THIS_MODULE,
 };
 
-struct svc_serv_ops *nfs4_cb_sv_ops[] = {
+static struct svc_serv_ops *nfs4_cb_sv_ops[] = {
         [0] = &nfs40_cb_sv_ops,
         [1] = &nfs41_cb_sv_ops,
 };
 #else
-struct svc_serv_ops *nfs4_cb_sv_ops[] = {
+static struct svc_serv_ops *nfs4_cb_sv_ops[] = {
         [0] = &nfs40_cb_sv_ops,
         [1] = NULL,
 };
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 91a8d610ba0f..390ada8741bc 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -325,10 +325,33 @@ static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *dat
         return NULL;
 }
 
-static bool nfs_client_init_is_complete(const struct nfs_client *clp)
+/*
+ * Return true if @clp is done initializing, false if still working on it.
+ *
+ * Use nfs_client_init_status to check if it was successful.
+ */
+bool nfs_client_init_is_complete(const struct nfs_client *clp)
 {
         return clp->cl_cons_state <= NFS_CS_READY;
 }
+EXPORT_SYMBOL_GPL(nfs_client_init_is_complete);
+
+/*
+ * Return 0 if @clp was successfully initialized, -errno otherwise.
+ *
+ * This must be called *after* nfs_client_init_is_complete() returns true,
+ * otherwise it will pop WARN_ON_ONCE and return -EINVAL
+ */
+int nfs_client_init_status(const struct nfs_client *clp)
+{
+        /* called without checking nfs_client_init_is_complete */
+        if (clp->cl_cons_state > NFS_CS_READY) {
+                WARN_ON_ONCE(1);
+                return -EINVAL;
+        }
+        return clp->cl_cons_state;
+}
+EXPORT_SYMBOL_GPL(nfs_client_init_status);
 
 int nfs_wait_client_init_complete(const struct nfs_client *clp)
 {
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index fb499a3f21b5..f92ba8d6c556 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -2055,7 +2055,7 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 {
         struct inode *old_inode = d_inode(old_dentry);
         struct inode *new_inode = d_inode(new_dentry);
-        struct dentry *dentry = NULL, *rehash = NULL;
+        struct dentry *dentry = NULL;
         struct rpc_task *task;
         int error = -EBUSY;
 
@@ -2078,10 +2078,8 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                  * To prevent any new references to the target during the
                  * rename, we unhash the dentry in advance.
                  */
-                if (!d_unhashed(new_dentry)) {
+                if (!d_unhashed(new_dentry))
                         d_drop(new_dentry);
-                        rehash = new_dentry;
-                }
 
                 if (d_count(new_dentry) > 2) {
                         int err;
@@ -2098,7 +2096,6 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                                 goto out;
 
                         new_dentry = dentry;
-                        rehash = NULL;
                         new_inode = NULL;
                 }
         }
@@ -2119,8 +2116,6 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 error = task->tk_status;
         rpc_put_task(task);
 out:
-        if (rehash)
-                d_rehash(rehash);
         trace_nfs_rename_exit(old_dir, old_dentry,
                         new_dir, new_dentry, error);
         /* new dentry created? */
diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index 44347f4bdc15..acd30baca461 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -202,10 +202,10 @@ static int filelayout_async_handle_error(struct rpc_task *task,
                         task->tk_status);
                 nfs4_mark_deviceid_unavailable(devid);
                 pnfs_error_mark_layout_for_return(inode, lseg);
-                pnfs_set_lo_fail(lseg);
                 rpc_wake_up(&tbl->slot_tbl_waitq);
                 /* fall through */
         default:
+                pnfs_set_lo_fail(lseg);
 reset:
                 dprintk("%s Retry through MDS. Error %d\n", __func__,
                         task->tk_status);
@@ -560,6 +560,50 @@ filelayout_write_pagelist(struct nfs_pgio_header *hdr, int sync)
         return PNFS_ATTEMPTED;
 }
 
+static int
+filelayout_check_deviceid(struct pnfs_layout_hdr *lo,
+                          struct nfs4_filelayout_segment *fl,
+                          gfp_t gfp_flags)
+{
+        struct nfs4_deviceid_node *d;
+        struct nfs4_file_layout_dsaddr *dsaddr;
+        int status = -EINVAL;
+
+        /* find and reference the deviceid */
+        d = nfs4_find_get_deviceid(NFS_SERVER(lo->plh_inode), &fl->deviceid,
+                        lo->plh_lc_cred, gfp_flags);
+        if (d == NULL)
+                goto out;
+
+        dsaddr = container_of(d, struct nfs4_file_layout_dsaddr, id_node);
+        /* Found deviceid is unavailable */
+        if (filelayout_test_devid_unavailable(&dsaddr->id_node))
+                goto out_put;
+
+        fl->dsaddr = dsaddr;
+
+        if (fl->first_stripe_index >= dsaddr->stripe_count) {
+                dprintk("%s Bad first_stripe_index %u\n",
+                                __func__, fl->first_stripe_index);
+                goto out_put;
+        }
+
+        if ((fl->stripe_type == STRIPE_SPARSE &&
+            fl->num_fh > 1 && fl->num_fh != dsaddr->ds_num) ||
+            (fl->stripe_type == STRIPE_DENSE &&
+            fl->num_fh != dsaddr->stripe_count)) {
+                dprintk("%s num_fh %u not valid for given packing\n",
+                        __func__, fl->num_fh);
+                goto out_put;
+        }
+        status = 0;
+out:
+        return status;
+out_put:
+        nfs4_fl_put_deviceid(dsaddr);
+        goto out;
+}
+
 /*
  * filelayout_check_layout()
  *
@@ -572,11 +616,8 @@ static int
 filelayout_check_layout(struct pnfs_layout_hdr *lo,
                         struct nfs4_filelayout_segment *fl,
                         struct nfs4_layoutget_res *lgr,
-                        struct nfs4_deviceid *id,
                         gfp_t gfp_flags)
 {
-        struct nfs4_deviceid_node *d;
-        struct nfs4_file_layout_dsaddr *dsaddr;
         int status = -EINVAL;
 
         dprintk("--> %s\n", __func__);
@@ -601,41 +642,10 @@ filelayout_check_layout(struct pnfs_layout_hdr *lo,
                 goto out;
         }
 
-        /* find and reference the deviceid */
-        d = nfs4_find_get_deviceid(NFS_SERVER(lo->plh_inode), id,
-                        lo->plh_lc_cred, gfp_flags);
-        if (d == NULL)
-                goto out;
-
-        dsaddr = container_of(d, struct nfs4_file_layout_dsaddr, id_node);
-        /* Found deviceid is unavailable */
-        if (filelayout_test_devid_unavailable(&dsaddr->id_node))
-                goto out_put;
-
-        fl->dsaddr = dsaddr;
-
-        if (fl->first_stripe_index >= dsaddr->stripe_count) {
-                dprintk("%s Bad first_stripe_index %u\n",
-                                __func__, fl->first_stripe_index);
-                goto out_put;
-        }
-
-        if ((fl->stripe_type == STRIPE_SPARSE &&
-            fl->num_fh > 1 && fl->num_fh != dsaddr->ds_num) ||
-            (fl->stripe_type == STRIPE_DENSE &&
-            fl->num_fh != dsaddr->stripe_count)) {
-                dprintk("%s num_fh %u not valid for given packing\n",
-                        __func__, fl->num_fh);
-                goto out_put;
-        }
-
         status = 0;
 out:
         dprintk("--> %s returns %d\n", __func__, status);
         return status;
-out_put:
-        nfs4_fl_put_deviceid(dsaddr);
-        goto out;
 }
 
 static void _filelayout_free_lseg(struct nfs4_filelayout_segment *fl)
@@ -657,7 +667,6 @@ static int
 filelayout_decode_layout(struct pnfs_layout_hdr *flo,
                          struct nfs4_filelayout_segment *fl,
                          struct nfs4_layoutget_res *lgr,
-                         struct nfs4_deviceid *id,
                          gfp_t gfp_flags)
 {
         struct xdr_stream stream;
@@ -682,9 +691,9 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
         if (unlikely(!p))
                 goto out_err;
 
-        memcpy(id, p, sizeof(*id));
+        memcpy(&fl->deviceid, p, sizeof(fl->deviceid));
         p += XDR_QUADLEN(NFS4_DEVICEID4_SIZE);
-        nfs4_print_deviceid(id);
+        nfs4_print_deviceid(&fl->deviceid);
 
         nfl_util = be32_to_cpup(p++);
         if (nfl_util & NFL4_UFLG_COMMIT_THRU_MDS)
@@ -831,15 +840,14 @@ filelayout_alloc_lseg(struct pnfs_layout_hdr *layoutid,
 {
         struct nfs4_filelayout_segment *fl;
         int rc;
-        struct nfs4_deviceid id;
 
         dprintk("--> %s\n", __func__);
         fl = kzalloc(sizeof(*fl), gfp_flags);
         if (!fl)
                 return NULL;
 
-        rc = filelayout_decode_layout(layoutid, fl, lgr, &id, gfp_flags);
-        if (rc != 0 || filelayout_check_layout(layoutid, fl, lgr, &id, gfp_flags)) {
+        rc = filelayout_decode_layout(layoutid, fl, lgr, gfp_flags);
+        if (rc != 0 || filelayout_check_layout(layoutid, fl, lgr, gfp_flags)) {
                 _filelayout_free_lseg(fl);
                 return NULL;
         }
@@ -888,18 +896,51 @@ filelayout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
         return min(stripe_unit - (unsigned int)stripe_offset, size);
 }
 
+static struct pnfs_layout_segment *
+fl_pnfs_update_layout(struct inode *ino,
+                      struct nfs_open_context *ctx,
+                      loff_t pos,
+                      u64 count,
+                      enum pnfs_iomode iomode,
+                      bool strict_iomode,
+                      gfp_t gfp_flags)
+{
+        struct pnfs_layout_segment *lseg = NULL;
+        struct pnfs_layout_hdr *lo;
+        struct nfs4_filelayout_segment *fl;
+        int status;
+
+        lseg = pnfs_update_layout(ino, ctx, pos, count, iomode, strict_iomode,
+                                  gfp_flags);
+        if (!lseg)
+                lseg = ERR_PTR(-ENOMEM);
+        if (IS_ERR(lseg))
+                goto out;
+
+        lo = NFS_I(ino)->layout;
+        fl = FILELAYOUT_LSEG(lseg);
+
+        status = filelayout_check_deviceid(lo, fl, gfp_flags);
+        if (status)
+                lseg = ERR_PTR(status);
+out:
+        if (IS_ERR(lseg))
+                pnfs_put_lseg(lseg);
+        return lseg;
+}
+
 static void
 filelayout_pg_init_read(struct nfs_pageio_descriptor *pgio,
                         struct nfs_page *req)
 {
         if (!pgio->pg_lseg) {
-                pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
-                                           req->wb_context,
-                                           0,
-                                           NFS4_MAX_UINT64,
-                                           IOMODE_READ,
-                                           false,
-                                           GFP_KERNEL);
+                pgio->pg_lseg = fl_pnfs_update_layout(pgio->pg_inode,
+                                                      req->wb_context,
+                                                      0,
+                                                      NFS4_MAX_UINT64,
+                                                      IOMODE_READ,
+                                                      false,
+                                                      GFP_KERNEL);
                 if (IS_ERR(pgio->pg_lseg)) {
                         pgio->pg_error = PTR_ERR(pgio->pg_lseg);
                         pgio->pg_lseg = NULL;
@@ -919,13 +960,13 @@ filelayout_pg_init_write(struct nfs_pageio_descriptor *pgio,
         int status;
 
         if (!pgio->pg_lseg) {
-                pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
-                                           req->wb_context,
-                                           0,
-                                           NFS4_MAX_UINT64,
-                                           IOMODE_RW,
-                                           false,
-                                           GFP_NOFS);
+                pgio->pg_lseg = fl_pnfs_update_layout(pgio->pg_inode,
+                                                      req->wb_context,
+                                                      0,
+                                                      NFS4_MAX_UINT64,
+                                                      IOMODE_RW,
+                                                      false,
+                                                      GFP_NOFS);
                 if (IS_ERR(pgio->pg_lseg)) {
                         pgio->pg_error = PTR_ERR(pgio->pg_lseg);
                         pgio->pg_lseg = NULL;
diff --git a/fs/nfs/filelayout/filelayout.h b/fs/nfs/filelayout/filelayout.h
index 2896cb833a11..79323b5dab0c 100644
--- a/fs/nfs/filelayout/filelayout.h
+++ b/fs/nfs/filelayout/filelayout.h
@@ -55,15 +55,16 @@ struct nfs4_file_layout_dsaddr {
 };
 
 struct nfs4_filelayout_segment {
-        struct pnfs_layout_segment generic_hdr;
-        u32 stripe_type;
-        u32 commit_through_mds;
-        u32 stripe_unit;
-        u32 first_stripe_index;
-        u64 pattern_offset;
-        struct nfs4_file_layout_dsaddr *dsaddr; /* Point to GETDEVINFO data */
-        unsigned int num_fh;
-        struct nfs_fh **fh_array;
+        struct pnfs_layout_segment      generic_hdr;
+        u32                             stripe_type;
+        u32                             commit_through_mds;
+        u32                             stripe_unit;
+        u32                             first_stripe_index;
+        u64                             pattern_offset;
+        struct nfs4_deviceid            deviceid;
+        struct nfs4_file_layout_dsaddr  *dsaddr; /* Point to GETDEVINFO data */
+        unsigned int                    num_fh;
+        struct nfs_fh                   **fh_array;
 };
 
 struct nfs4_filelayout {
diff --git a/fs/nfs/filelayout/filelayoutdev.c b/fs/nfs/filelayout/filelayoutdev.c
index f956ca20a8a3..d913e818858f 100644
--- a/fs/nfs/filelayout/filelayoutdev.c
+++ b/fs/nfs/filelayout/filelayoutdev.c
@@ -266,6 +266,7 @@ nfs4_fl_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx)
         struct nfs4_deviceid_node *devid = FILELAYOUT_DEVID_NODE(lseg);
         struct nfs4_pnfs_ds *ret = ds;
         struct nfs_server *s = NFS_SERVER(lseg->pls_layout->plh_inode);
+        int status;
 
         if (ds == NULL) {
                 printk(KERN_ERR "NFS: %s: No data server for offset index %d\n",
@@ -277,9 +278,14 @@ nfs4_fl_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx)
         if (ds->ds_clp)
                 goto out_test_devid;
 
-        nfs4_pnfs_ds_connect(s, ds, devid, dataserver_timeo,
+        status = nfs4_pnfs_ds_connect(s, ds, devid, dataserver_timeo,
                              dataserver_retrans, 4,
                              s->nfs_client->cl_minorversion);
+        if (status) {
+                nfs4_mark_deviceid_unavailable(devid);
+                ret = NULL;
+                goto out;
+        }
 
 out_test_devid:
         if (ret->ds_clp == NULL ||
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index f4f39b0ab09b..98b34c9b0564 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -175,7 +175,19 @@ ff_layout_no_read_on_rw(struct pnfs_layout_segment *lseg)
 static inline bool
 ff_layout_test_devid_unavailable(struct nfs4_deviceid_node *node)
 {
-        return nfs4_test_deviceid_unavailable(node);
+        /*
+         * Flexfiles should never mark a DS unavailable, but if it does
+         * print a (ratelimited) warning as this can affect performance.
+         */
+        if (nfs4_test_deviceid_unavailable(node)) {
+                u32 *p = (u32 *)node->deviceid.data;
+
+                pr_warn_ratelimited("NFS: flexfiles layout referencing an "
+                                "unavailable device [%x%x%x%x]\n",
+                                p[0], p[1], p[2], p[3]);
+                return true;
+        }
+        return false;
 }
 
 static inline int
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index e5a6f248697b..457cfeb1d5c1 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -208,6 +208,10 @@ static bool ff_layout_mirror_valid(struct pnfs_layout_segment *lseg,
                 } else
                         goto outerr;
         }
+
+        if (IS_ERR(mirror->mirror_ds))
+                goto outerr;
+
         if (mirror->mirror_ds->ds == NULL) {
                 struct nfs4_deviceid_node *devid;
                 devid = &mirror->mirror_ds->id_node;
@@ -384,6 +388,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
         struct inode *ino = lseg->pls_layout->plh_inode;
         struct nfs_server *s = NFS_SERVER(ino);
         unsigned int max_payload;
+        int status;
 
         if (!ff_layout_mirror_valid(lseg, mirror, true)) {
                 pr_err_ratelimited("NFS: %s: No data server for offset index %d\n",
@@ -404,7 +409,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
         /* FIXME: For now we assume the server sent only one version of NFS
          * to use for the DS.
          */
-        nfs4_pnfs_ds_connect(s, ds, devid, dataserver_timeo,
+        status = nfs4_pnfs_ds_connect(s, ds, devid, dataserver_timeo,
                              dataserver_retrans,
                              mirror->mirror_ds->ds_versions[0].version,
                              mirror->mirror_ds->ds_versions[0].minor_version);
@@ -420,11 +425,11 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
                         mirror->mirror_ds->ds_versions[0].wsize = max_payload;
                 goto out;
         }
+out_fail:
         ff_layout_track_ds_error(FF_LAYOUT_FROM_HDR(lseg->pls_layout),
                                  mirror, lseg->pls_range.offset,
                                  lseg->pls_range.length, NFS4ERR_NXIO,
                                  OP_ILLEGAL, GFP_NOIO);
-out_fail:
         if (fail_return || !ff_layout_has_available_ds(lseg))
                 pnfs_error_mark_layout_for_return(ino, lseg);
         ds = NULL;
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 09ca5095c04e..7b38fedb7e03 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -186,6 +186,8 @@ extern struct nfs_server *nfs_clone_server(struct nfs_server *,
                                            struct nfs_fh *,
                                            struct nfs_fattr *,
                                            rpc_authflavor_t);
+extern bool nfs_client_init_is_complete(const struct nfs_client *clp);
+extern int nfs_client_init_status(const struct nfs_client *clp);
 extern int nfs_wait_client_init_complete(const struct nfs_client *clp);
 extern void nfs_mark_client_ready(struct nfs_client *clp, int state);
 extern struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 5ae9d64ea08b..8346ccbf2d52 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -1023,9 +1023,9 @@ static void nfs4_session_set_rwsize(struct nfs_server *server)
         server_resp_sz = sess->fc_attrs.max_resp_sz - nfs41_maxread_overhead;
         server_rqst_sz = sess->fc_attrs.max_rqst_sz - nfs41_maxwrite_overhead;
 
-        if (server->rsize > server_resp_sz)
+        if (!server->rsize || server->rsize > server_resp_sz)
                 server->rsize = server_resp_sz;
-        if (server->wsize > server_rqst_sz)
+        if (!server->wsize || server->wsize > server_rqst_sz)
                 server->wsize = server_rqst_sz;
 #endif /* CONFIG_NFS_V4_1 */
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 1b183686c6d4..201ca3f2c4ba 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2258,8 +2258,6 @@ static int nfs4_opendata_access(struct rpc_cred *cred,
         if ((mask & ~cache.mask & (MAY_READ | MAY_EXEC)) == 0)
                 return 0;
 
-        /* even though OPEN succeeded, access is denied. Close the file */
-        nfs4_close_state(state, fmode);
         return -EACCES;
 }
 
@@ -2444,17 +2442,14 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state)
         }
 
         nfs4_stateid_copy(&stateid, &delegation->stateid);
-        if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags)) {
+        if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags) ||
+                !test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED,
+                        &delegation->flags)) {
                 rcu_read_unlock();
                 nfs_finish_clear_delegation_stateid(state, &stateid);
                 return;
         }
 
-        if (!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED, &delegation->flags)) {
-                rcu_read_unlock();
-                return;
-        }
-
         cred = get_rpccred(delegation->cred);
         rcu_read_unlock();
         status = nfs41_test_and_free_expired_stateid(server, &stateid, cred);
@@ -7427,11 +7422,11 @@ static void nfs4_exchange_id_release(void *data)
         struct nfs41_exchange_id_data *cdata =
                                         (struct nfs41_exchange_id_data *)data;
 
-        nfs_put_client(cdata->args.client);
         if (cdata->xprt) {
                 xprt_put(cdata->xprt);
                 rpc_clnt_xprt_switch_put(cdata->args.client->cl_rpcclient);
         }
+        nfs_put_client(cdata->args.client);
         kfree(cdata->res.impl_id);
         kfree(cdata->res.server_scope);
         kfree(cdata->res.server_owner);
@@ -7538,10 +7533,8 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
         task_setup_data.callback_data = calldata;
 
         task = rpc_run_task(&task_setup_data);
-        if (IS_ERR(task)) {
-        status = PTR_ERR(task);
-                goto out_impl_id;
-        }
+        if (IS_ERR(task))
+                return PTR_ERR(task);
 
         if (!xprt) {
                 status = rpc_wait_for_completion_task(task);
@@ -7569,6 +7562,7 @@ out_server_owner:
         kfree(calldata->res.server_owner);
 out_calldata:
         kfree(calldata);
+        nfs_put_client(clp);
         goto out;
 }
 
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index f0369e362753..80ce289eea05 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -3942,7 +3942,7 @@ static int decode_attr_group(struct xdr_stream *xdr, uint32_t *bitmap,
                 if (len <= 0)
                         goto out;
                 dprintk("%s: name=%s\n", __func__, group_name->data);
-                return NFS_ATTR_FATTR_OWNER_NAME;
+                return NFS_ATTR_FATTR_GROUP_NAME;
         } else {
                 len = xdr_stream_decode_opaque_inline(xdr, (void **)&p,
                                 XDR_MAX_NETOBJ);
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 63f77b49a586..590e1e35781f 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -367,7 +367,7 @@ void nfs4_pnfs_ds_put(struct nfs4_pnfs_ds *ds);
 struct nfs4_pnfs_ds *nfs4_pnfs_ds_add(struct list_head *dsaddrs,
                                       gfp_t gfp_flags);
 void nfs4_pnfs_v3_ds_connect_unload(void);
-void nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,
+int nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,
                           struct nfs4_deviceid_node *devid, unsigned int timeo,
                           unsigned int retrans, u32 version, u32 minor_version);
 struct nfs4_pnfs_ds_addr *nfs4_decode_mp_ds_addr(struct net *net,
diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
index 9414b492439f..7250b95549ec 100644
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -745,15 +745,17 @@ out:
 /*
  * Create an rpc connection to the nfs4_pnfs_ds data server.
  * Currently only supports IPv4 and IPv6 addresses.
- * If connection fails, make devid unavailable.
+ * If connection fails, make devid unavailable and return a -errno.
  */
-void nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,
+int nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,
                           struct nfs4_deviceid_node *devid, unsigned int timeo,
                           unsigned int retrans, u32 version, u32 minor_version)
 {
-        if (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) == 0) {
-                int err = 0;
+        int err;
 
+again:
+        err = 0;
+        if (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) == 0) {
                 if (version == 3) {
                         err = _nfs4_pnfs_v3_ds_connect(mds_srv, ds, timeo,
                                                        retrans);
@@ -766,12 +768,29 @@ void nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,
                         err = -EPROTONOSUPPORT;
                 }
 
-                if (err)
-                        nfs4_mark_deviceid_unavailable(devid);
                 nfs4_clear_ds_conn_bit(ds);
         } else {
                 nfs4_wait_ds_connect(ds);
+
+                /* what was waited on didn't connect AND didn't mark unavail */
+                if (!ds->ds_clp && !nfs4_test_deviceid_unavailable(devid))
+                        goto again;
         }
+
+        /*
+         * At this point the ds->ds_clp should be ready, but it might have
+         * hit an error.
+         */
+        if (!err) {
+                if (!ds->ds_clp || !nfs_client_init_is_complete(ds->ds_clp)) {
+                        WARN_ON_ONCE(ds->ds_clp ||
+                                !nfs4_test_deviceid_unavailable(devid));
+                        return -EINVAL;
+                }
+                err = nfs_client_init_status(ds->ds_clp);
+        }
+
+        return err;
 }
 EXPORT_SYMBOL_GPL(nfs4_pnfs_ds_connect);
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index e75b056f46f4..abb2c8a3be42 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1784,7 +1784,8 @@ static void nfs_commit_release_pages(struct nfs_commit_data *data)
                         (long long)req_offset(req));
                 if (status < 0) {
                         nfs_context_set_write_error(req->wb_context, status);
-                        nfs_inode_remove_request(req);
+                        if (req->wb_page)
+                                nfs_inode_remove_request(req);
                         dprintk_cont(", error = %d\n", status);
                         goto next;
                 }
@@ -1793,7 +1794,8 @@ static void nfs_commit_release_pages(struct nfs_commit_data *data)
                  * returned by the server against all stored verfs. */
                 if (!nfs_write_verifier_cmp(&req->wb_verf, &data->verf.verifier)) {
                         /* We have a match */
-                        nfs_inode_remove_request(req);
+                        if (req->wb_page)
+                                nfs_inode_remove_request(req);
                         dprintk_cont(" OK\n");
                         goto next;
                 }
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 73e75ac90525..8bf8f667a8cf 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -538,13 +538,21 @@ out_free:
 
 static ssize_t
 nfsd_print_version_support(char *buf, int remaining, const char *sep,
-                unsigned vers, unsigned minor)
+                unsigned vers, int minor)
 {
-        const char *format = (minor == 0) ? "%s%c%u" : "%s%c%u.%u";
+        const char *format = minor < 0 ? "%s%c%u" : "%s%c%u.%u";
         bool supported = !!nfsd_vers(vers, NFSD_TEST);
 
-        if (vers == 4 && !nfsd_minorversion(minor, NFSD_TEST))
+        if (vers == 4 && minor >= 0 &&
+            !nfsd_minorversion(minor, NFSD_TEST))
                 supported = false;
+        if (minor == 0 && supported)
+                /*
+                 * special case for backward compatability.
+                 * +4.0 is never reported, it is implied by
+                 * +4, unless -4.0 is present.
+                 */
+                return 0;
         return snprintf(buf, remaining, format, sep,
                         supported ? '+' : '-', vers, minor);
 }
@@ -554,7 +562,6 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
         char *mesg = buf;
         char *vers, *minorp, sign;
         int len, num, remaining;
-        unsigned minor;
         ssize_t tlen = 0;
         char *sep;
         struct nfsd_net *nn = net_generic(netns(file), nfsd_net_id);
@@ -575,6 +582,7 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
                 if (len <= 0) return -EINVAL;
                 do {
                         enum vers_op cmd;
+                        unsigned minor;
                         sign = *vers;
                         if (sign == '+' || sign == '-')
                                 num = simple_strtol((vers+1), &minorp, 0);
@@ -585,8 +593,8 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
                                         return -EINVAL;
                                 if (kstrtouint(minorp+1, 0, &minor) < 0)
                                         return -EINVAL;
-                        } else
-                                minor = 0;
+                        }
+
                         cmd = sign == '-' ? NFSD_CLEAR : NFSD_SET;
                         switch(num) {
                         case 2:
@@ -594,8 +602,20 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
                                 nfsd_vers(num, cmd);
                                 break;
                         case 4:
-                                if (nfsd_minorversion(minor, cmd) >= 0)
-                                        break;
+                                if (*minorp == '.') {
+                                        if (nfsd_minorversion(minor, cmd) < 0)
+                                                return -EINVAL;
+                                } else if ((cmd == NFSD_SET) != nfsd_vers(num, NFSD_TEST)) {
+                                        /*
+                                         * Either we have +4 and no minors are enabled,
+                                         * or we have -4 and at least one minor is enabled.
+                                         * In either case, propagate 'cmd' to all minors.
+                                         */
+                                        minor = 0;
+                                        while (nfsd_minorversion(minor, cmd) >= 0)
+                                                minor++;
+                                }
+                                break;
                         default:
                                 return -EINVAL;
                         }
@@ -612,9 +632,11 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
         sep = "";
         remaining = SIMPLE_TRANSACTION_LIMIT;
         for (num=2 ; num <= 4 ; num++) {
+                int minor;
                 if (!nfsd_vers(num, NFSD_AVAIL))
                         continue;
-                minor = 0;
+
+                minor = -1;
                 do {
                         len = nfsd_print_version_support(buf, remaining,
                                         sep, num, minor);
@@ -624,7 +646,8 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
                         buf += len;
                         tlen += len;
                         minor++;
-                        sep = " ";
+                        if (len)
+                                sep = " ";
                 } while (num == 4 && minor <= NFSD_SUPPORTED_MINOR_VERSION);
         }
 out:
diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
index fa82b7707e85..03a7e9da4da0 100644
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -786,6 +786,7 @@ nfserrno (int errno)
                 { nfserr_serverfault, -ESERVERFAULT },
                 { nfserr_serverfault, -ENFILE },
                 { nfserr_io, -EUCLEAN },
+                { nfserr_perm, -ENOKEY },
         };
         int     i;
 
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 786a4a2cb2d7..31e1f9593457 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -167,7 +167,8 @@ nfsd_adjust_nfsd_versions4(void)
 
 int nfsd_minorversion(u32 minorversion, enum vers_op change)
 {
-        if (minorversion > NFSD_SUPPORTED_MINOR_VERSION)
+        if (minorversion > NFSD_SUPPORTED_MINOR_VERSION &&
+            change != NFSD_AVAIL)
                 return -1;
         switch(change) {
         case NFSD_SET:
@@ -415,23 +416,20 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
 
 void nfsd_reset_versions(void)
 {
-        int found_one = 0;
         int i;
 
-        for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++) {
-                if (nfsd_program.pg_vers[i])
-                        found_one = 1;
-        }
+        for (i = 0; i < NFSD_NRVERS; i++)
+                if (nfsd_vers(i, NFSD_TEST))
+                        return;
 
-        if (!found_one) {
-                for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++)
-                        nfsd_program.pg_vers[i] = nfsd_version[i];
-#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
-                for (i = NFSD_ACL_MINVERS; i < NFSD_ACL_NRVERS; i++)
-                        nfsd_acl_program.pg_vers[i] =
-                                nfsd_acl_version[i];
-#endif
-        }
+        for (i = 0; i < NFSD_NRVERS; i++)
+                if (i != 4)
+                        nfsd_vers(i, NFSD_SET);
+                else {
+                        int minor = 0;
+                        while (nfsd_minorversion(minor, NFSD_SET) >= 0)
+                                minor++;
+                }
 }
 
 /*
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 4348027384f5..d0ab7e56d0b4 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -1863,7 +1863,7 @@ static int o2net_accept_one(struct socket *sock, int *more)
 
         new_sock->type = sock->type;
         new_sock->ops = sock->ops;
-        ret = sock->ops->accept(sock, new_sock, O_NONBLOCK);
+        ret = sock->ops->accept(sock, new_sock, O_NONBLOCK, false);
         if (ret < 0)
                 goto out;
 
diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index 1953986ee6bc..6e610a205e15 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -12,7 +12,6 @@
 #include <linux/slab.h>
 #include <linux/cred.h>
 #include <linux/xattr.h>
-#include <linux/sched/signal.h>
 #include "overlayfs.h"
 #include "ovl_entry.h"
 
diff --git a/fs/stat.c b/fs/stat.c
index fa0be59340cc..c6c963b2546b 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -130,9 +130,13 @@ EXPORT_SYMBOL(vfs_getattr);
 int vfs_statx_fd(unsigned int fd, struct kstat *stat,
                  u32 request_mask, unsigned int query_flags)
 {
-        struct fd f = fdget_raw(fd);
+        struct fd f;
         int error = -EBADF;
 
+        if (query_flags & ~KSTAT_QUERY_FLAGS)
+                return -EINVAL;
+
+        f = fdget_raw(fd);
         if (f.file) {
                 error = vfs_getattr(&f.file->f_path, stat,
                                     request_mask, query_flags);
@@ -155,9 +159,6 @@ EXPORT_SYMBOL(vfs_statx_fd);
  * Additionally, the use of AT_SYMLINK_NOFOLLOW in flags will prevent a symlink
  * at the given name from being referenced.
  *
- * The caller must have preset stat->request_mask as for vfs_getattr().  The
- * flags are also used to load up stat->query_flags.
- *
  * 0 will be returned on success, and a -ve error code if unsuccessful.
  */
 int vfs_statx(int dfd, const char __user *filename, int flags,
@@ -509,46 +510,38 @@ SYSCALL_DEFINE4(fstatat64, int, dfd, const char __user *, filename,
 }
 #endif /* __ARCH_WANT_STAT64 || __ARCH_WANT_COMPAT_STAT64 */
 
-static inline int __put_timestamp(struct timespec *kts,
-                                  struct statx_timestamp __user *uts)
-{
-        return (__put_user(kts->tv_sec,         &uts->tv_sec            ) ||
-                __put_user(kts->tv_nsec,        &uts->tv_nsec           ) ||
-                __put_user(0,                   &uts->__reserved        ));
-}
-
-/*
- * Set the statx results.
- */
-static long statx_set_result(struct kstat *stat, struct statx __user *buffer)
+static noinline_for_stack int
+cp_statx(const struct kstat *stat, struct statx __user *buffer)
 {
-        uid_t uid = from_kuid_munged(current_user_ns(), stat->uid);
-        gid_t gid = from_kgid_munged(current_user_ns(), stat->gid);
-
-        if (__put_user(stat->result_mask,       &buffer->stx_mask       ) ||
-            __put_user(stat->mode,              &buffer->stx_mode       ) ||
-            __clear_user(&buffer->__spare0, sizeof(buffer->__spare0))     ||
-            __put_user(stat->nlink,             &buffer->stx_nlink      ) ||
-            __put_user(uid,                     &buffer->stx_uid        ) ||
-            __put_user(gid,                     &buffer->stx_gid        ) ||
-            __put_user(stat->attributes,        &buffer->stx_attributes ) ||
-            __put_user(stat->blksize,           &buffer->stx_blksize    ) ||
-            __put_user(MAJOR(stat->rdev),       &buffer->stx_rdev_major ) ||
-            __put_user(MINOR(stat->rdev),       &buffer->stx_rdev_minor ) ||
-            __put_user(MAJOR(stat->dev),        &buffer->stx_dev_major  ) ||
-            __put_user(MINOR(stat->dev),        &buffer->stx_dev_minor  ) ||
-            __put_timestamp(&stat->atime,       &buffer->stx_atime      ) ||
-            __put_timestamp(&stat->btime,       &buffer->stx_btime      ) ||
-            __put_timestamp(&stat->ctime,       &buffer->stx_ctime      ) ||
-            __put_timestamp(&stat->mtime,       &buffer->stx_mtime      ) ||
-            __put_user(stat->ino,               &buffer->stx_ino        ) ||
-            __put_user(stat->size,              &buffer->stx_size       ) ||
-            __put_user(stat->blocks,            &buffer->stx_blocks     ) ||
-            __clear_user(&buffer->__spare1, sizeof(buffer->__spare1))     ||
-            __clear_user(&buffer->__spare2, sizeof(buffer->__spare2)))
-                return -EFAULT;
-
-        return 0;
+        struct statx tmp;
+
+        memset(&tmp, 0, sizeof(tmp));
+
+        tmp.stx_mask = stat->result_mask;
+        tmp.stx_blksize = stat->blksize;
+        tmp.stx_attributes = stat->attributes;
+        tmp.stx_nlink = stat->nlink;
+        tmp.stx_uid = from_kuid_munged(current_user_ns(), stat->uid);
+        tmp.stx_gid = from_kgid_munged(current_user_ns(), stat->gid);
+        tmp.stx_mode = stat->mode;
+        tmp.stx_ino = stat->ino;
+        tmp.stx_size = stat->size;
+        tmp.stx_blocks = stat->blocks;
+        tmp.stx_attributes_mask = stat->attributes_mask;
+        tmp.stx_atime.tv_sec = stat->atime.tv_sec;
+        tmp.stx_atime.tv_nsec = stat->atime.tv_nsec;
+        tmp.stx_btime.tv_sec = stat->btime.tv_sec;
+        tmp.stx_btime.tv_nsec = stat->btime.tv_nsec;
+        tmp.stx_ctime.tv_sec = stat->ctime.tv_sec;
+        tmp.stx_ctime.tv_nsec = stat->ctime.tv_nsec;
+        tmp.stx_mtime.tv_sec = stat->mtime.tv_sec;
+        tmp.stx_mtime.tv_nsec = stat->mtime.tv_nsec;
+        tmp.stx_rdev_major = MAJOR(stat->rdev);
+        tmp.stx_rdev_minor = MINOR(stat->rdev);
+        tmp.stx_dev_major = MAJOR(stat->dev);
+        tmp.stx_dev_minor = MINOR(stat->dev);
+
+        return copy_to_user(buffer, &tmp, sizeof(tmp)) ? -EFAULT : 0;
 }
 
 /**
@@ -570,10 +563,10 @@ SYSCALL_DEFINE5(statx,
         struct kstat stat;
         int error;
 
+        if (mask & STATX__RESERVED)
+                return -EINVAL;
         if ((flags & AT_STATX_SYNC_TYPE) == AT_STATX_SYNC_TYPE)
                 return -EINVAL;
-        if (!access_ok(VERIFY_WRITE, buffer, sizeof(*buffer)))
-                return -EFAULT;
 
         if (filename)
                 error = vfs_statx(dfd, filename, flags, &stat, mask);
@@ -581,7 +574,8 @@ SYSCALL_DEFINE5(statx,
                 error = vfs_statx_fd(dfd, &stat, mask, flags);
         if (error)
                 return error;
-        return statx_set_result(&stat, buffer);
+
+        return cp_statx(&stat, buffer);
 }
 
 /* Caller is here responsible for sufficient locking (ie. inode->i_lock) */
diff --git a/fs/timerfd.c b/fs/timerfd.c
index 384fa759a563..c543cdb5f8ed 100644
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -400,9 +400,9 @@ SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
              clockid != CLOCK_BOOTTIME_ALARM))
                 return -EINVAL;
 
-        if (!capable(CAP_WAKE_ALARM) &&
-            (clockid == CLOCK_REALTIME_ALARM ||
-             clockid == CLOCK_BOOTTIME_ALARM))
+        if ((clockid == CLOCK_REALTIME_ALARM ||
+             clockid == CLOCK_BOOTTIME_ALARM) &&
+            !capable(CAP_WAKE_ALARM))
                 return -EPERM;
 
         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
@@ -449,7 +449,7 @@ static int do_timerfd_settime(int ufd, int flags,
                 return ret;
         ctx = f.file->private_data;
 
-        if (!capable(CAP_WAKE_ALARM) && isalarm(ctx)) {
+        if (isalarm(ctx) && !capable(CAP_WAKE_ALARM)) {
                 fdput(f);
                 return -EPERM;
         }
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 973607df579d..1d227b0fcf49 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -138,8 +138,6 @@ out:
  * userfaultfd_ctx_get - Acquires a reference to the internal userfaultfd
  * context.
  * @ctx: [in] Pointer to the userfaultfd context.
- *
- * Returns: In case of success, returns not zero.
  */
 static void userfaultfd_ctx_get(struct userfaultfd_ctx *ctx)
 {
@@ -267,6 +265,7 @@ static inline bool userfaultfd_must_wait(struct userfaultfd_ctx *ctx,
 {
         struct mm_struct *mm = ctx->mm;
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd, _pmd;
         pte_t *pte;
@@ -277,7 +276,10 @@ static inline bool userfaultfd_must_wait(struct userfaultfd_ctx *ctx,
         pgd = pgd_offset(mm, address);
         if (!pgd_present(*pgd))
                 goto out;
-        pud = pud_offset(pgd, address);
+        p4d = p4d_offset(pgd, address);
+        if (!p4d_present(*p4d))
+                goto out;
+        pud = pud_offset(p4d, address);
         if (!pud_present(*pud))
                 goto out;
         pmd = pmd_offset(pud, address);
@@ -490,7 +492,7 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
                          * in such case.
                          */
                         down_read(&mm->mmap_sem);
-                        ret = 0;
+                        ret = VM_FAULT_NOPAGE;
                 }
         }
 
@@ -527,10 +529,11 @@ out:
         return ret;
 }
 
-static int userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
-                                             struct userfaultfd_wait_queue *ewq)
+static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
+                                              struct userfaultfd_wait_queue *ewq)
 {
-        int ret = 0;
+        if (WARN_ON_ONCE(current->flags & PF_EXITING))
+                goto out;
 
         ewq->ctx = ctx;
         init_waitqueue_entry(&ewq->wq, current);
@@ -547,8 +550,16 @@ static int userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
                         break;
                 if (ACCESS_ONCE(ctx->released) ||
                     fatal_signal_pending(current)) {
-                        ret = -1;
                         __remove_wait_queue(&ctx->event_wqh, &ewq->wq);
+                        if (ewq->msg.event == UFFD_EVENT_FORK) {
+                                struct userfaultfd_ctx *new;
+
+                                new = (struct userfaultfd_ctx *)
+                                        (unsigned long)
+                                        ewq->msg.arg.reserved.reserved1;
+
+                                userfaultfd_ctx_put(new);
+                        }
                         break;
                 }
 
@@ -566,9 +577,8 @@ static int userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
          * ctx may go away after this if the userfault pseudo fd is
          * already released.
          */
-
+out:
         userfaultfd_ctx_put(ctx);
-        return ret;
 }
 
 static void userfaultfd_event_complete(struct userfaultfd_ctx *ctx,
@@ -626,7 +636,7 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct list_head *fcs)
         return 0;
 }
 
-static int dup_fctx(struct userfaultfd_fork_ctx *fctx)
+static void dup_fctx(struct userfaultfd_fork_ctx *fctx)
 {
         struct userfaultfd_ctx *ctx = fctx->orig;
         struct userfaultfd_wait_queue ewq;
@@ -636,17 +646,15 @@ static int dup_fctx(struct userfaultfd_fork_ctx *fctx)
         ewq.msg.event = UFFD_EVENT_FORK;
         ewq.msg.arg.reserved.reserved1 = (unsigned long)fctx->new;
 
-        return userfaultfd_event_wait_completion(ctx, &ewq);
+        userfaultfd_event_wait_completion(ctx, &ewq);
 }
 
 void dup_userfaultfd_complete(struct list_head *fcs)
 {
-        int ret = 0;
         struct userfaultfd_fork_ctx *fctx, *n;
 
         list_for_each_entry_safe(fctx, n, fcs, list) {
-                if (!ret)
-                        ret = dup_fctx(fctx);
+                dup_fctx(fctx);
                 list_del(&fctx->list);
                 kfree(fctx);
         }
@@ -689,8 +697,7 @@ void mremap_userfaultfd_complete(struct vm_userfaultfd_ctx *vm_ctx,
         userfaultfd_event_wait_completion(ctx, &ewq);
 }
 
-void userfaultfd_remove(struct vm_area_struct *vma,
-                        struct vm_area_struct **prev,
+bool userfaultfd_remove(struct vm_area_struct *vma,
                         unsigned long start, unsigned long end)
 {
         struct mm_struct *mm = vma->vm_mm;
@@ -699,13 +706,11 @@ void userfaultfd_remove(struct vm_area_struct *vma,
 
         ctx = vma->vm_userfaultfd_ctx.ctx;
         if (!ctx || !(ctx->features & UFFD_FEATURE_EVENT_REMOVE))
-                return;
+                return true;
 
         userfaultfd_ctx_get(ctx);
         up_read(&mm->mmap_sem);
 
-        *prev = NULL; /* We wait for ACK w/o the mmap semaphore */
-
         msg_init(&ewq.msg);
 
         ewq.msg.event = UFFD_EVENT_REMOVE;
@@ -714,7 +719,7 @@ void userfaultfd_remove(struct vm_area_struct *vma,
 
         userfaultfd_event_wait_completion(ctx, &ewq);
 
-        down_read(&mm->mmap_sem);
+        return false;
 }
 
 static bool has_unmap_ctx(struct userfaultfd_ctx *ctx, struct list_head *unmaps,
@@ -775,34 +780,6 @@ void userfaultfd_unmap_complete(struct mm_struct *mm, struct list_head *uf)
         }
 }
 
-void userfaultfd_exit(struct mm_struct *mm)
-{
-        struct vm_area_struct *vma = mm->mmap;
-
-        /*
-         * We can do the vma walk without locking because the caller
-         * (exit_mm) knows it now has exclusive access
-         */
-        while (vma) {
-                struct userfaultfd_ctx *ctx = vma->vm_userfaultfd_ctx.ctx;
-
-                if (ctx && (ctx->features & UFFD_FEATURE_EVENT_EXIT)) {
-                        struct userfaultfd_wait_queue ewq;
-
-                        userfaultfd_ctx_get(ctx);
-
-                        msg_init(&ewq.msg);
-                        ewq.msg.event = UFFD_EVENT_EXIT;
-
-                        userfaultfd_event_wait_completion(ctx, &ewq);
-
-                        ctx->features &= ~UFFD_FEATURE_EVENT_EXIT;
-                }
-
-                vma = vma->vm_next;
-        }
-}
-
 static int userfaultfd_release(struct inode *inode, struct file *file)
 {
         struct userfaultfd_ctx *ctx = file->private_data;
diff --git a/fs/xfs/kmem.c b/fs/xfs/kmem.c
index 2dfdc62f795e..70a5b55e0870 100644
--- a/fs/xfs/kmem.c
+++ b/fs/xfs/kmem.c
@@ -25,24 +25,6 @@
 #include "kmem.h"
 #include "xfs_message.h"
 
-/*
- * Greedy allocation.  May fail and may return vmalloced memory.
- */
-void *
-kmem_zalloc_greedy(size_t *size, size_t minsize, size_t maxsize)
-{
-        void            *ptr;
-        size_t          kmsize = maxsize;
-
-        while (!(ptr = vzalloc(kmsize))) {
-                if ((kmsize >>= 1) <= minsize)
-                        kmsize = minsize;
-        }
-        if (ptr)
-                *size = kmsize;
-        return ptr;
-}
-
 void *
 kmem_alloc(size_t size, xfs_km_flags_t flags)
 {
diff --git a/fs/xfs/kmem.h b/fs/xfs/kmem.h
index 689f746224e7..f0fc84fcaac2 100644
--- a/fs/xfs/kmem.h
+++ b/fs/xfs/kmem.h
@@ -69,8 +69,6 @@ static inline void  kmem_free(const void *ptr)
 }
 
 
-extern void *kmem_zalloc_greedy(size_t *, size_t, size_t);
-
 static inline void *
 kmem_zalloc(size_t size, xfs_km_flags_t flags)
 {
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index a9c66d47757a..9bd104f32908 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -763,8 +763,8 @@ xfs_bmap_extents_to_btree(
                 args.type = XFS_ALLOCTYPE_START_BNO;
                 args.fsbno = XFS_INO_TO_FSB(mp, ip->i_ino);
         } else if (dfops->dop_low) {
-try_another_ag:
                 args.type = XFS_ALLOCTYPE_START_BNO;
+try_another_ag:
                 args.fsbno = *firstblock;
         } else {
                 args.type = XFS_ALLOCTYPE_NEAR_BNO;
@@ -790,13 +790,17 @@ try_another_ag:
         if (xfs_sb_version_hasreflink(&cur->bc_mp->m_sb) &&
             args.fsbno == NULLFSBLOCK &&
             args.type == XFS_ALLOCTYPE_NEAR_BNO) {
-                dfops->dop_low = true;
+                args.type = XFS_ALLOCTYPE_FIRST_AG;
                 goto try_another_ag;
         }
+        if (WARN_ON_ONCE(args.fsbno == NULLFSBLOCK)) {
+                xfs_iroot_realloc(ip, -1, whichfork);
+                xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
+                return -ENOSPC;
+        }
         /*
          * Allocation can't fail, the space was reserved.
          */
-        ASSERT(args.fsbno != NULLFSBLOCK);
         ASSERT(*firstblock == NULLFSBLOCK ||
                args.agno >= XFS_FSB_TO_AGNO(mp, *firstblock));
         *firstblock = cur->bc_private.b.firstblock = args.fsbno;
@@ -4150,6 +4154,19 @@ xfs_bmapi_read(
         return 0;
 }
 
+/*
+ * Add a delayed allocation extent to an inode. Blocks are reserved from the
+ * global pool and the extent inserted into the inode in-core extent tree.
+ *
+ * On entry, got refers to the first extent beyond the offset of the extent to
+ * allocate or eof is specified if no such extent exists. On return, got refers
+ * to the extent record that was inserted to the inode fork.
+ *
+ * Note that the allocated extent may have been merged with contiguous extents
+ * during insertion into the inode fork. Thus, got does not reflect the current
+ * state of the inode fork on return. If necessary, the caller can use lastx to
+ * look up the updated record in the inode fork.
+ */
 int
 xfs_bmapi_reserve_delalloc(
         struct xfs_inode        *ip,
@@ -4236,13 +4253,8 @@ xfs_bmapi_reserve_delalloc(
         got->br_startblock = nullstartblock(indlen);
         got->br_blockcount = alen;
         got->br_state = XFS_EXT_NORM;
-        xfs_bmap_add_extent_hole_delay(ip, whichfork, lastx, got);
 
-        /*
-         * Update our extent pointer, given that xfs_bmap_add_extent_hole_delay
-         * might have merged it into one of the neighbouring ones.
-         */
-        xfs_bmbt_get_all(xfs_iext_get_ext(ifp, *lastx), got);
+        xfs_bmap_add_extent_hole_delay(ip, whichfork, lastx, got);
 
         /*
          * Tag the inode if blocks were preallocated. Note that COW fork
@@ -4254,10 +4266,6 @@ xfs_bmapi_reserve_delalloc(
         if (whichfork == XFS_COW_FORK && (prealloc || aoff < off || alen > len))
                 xfs_inode_set_cowblocks_tag(ip);
 
-        ASSERT(got->br_startoff <= aoff);
-        ASSERT(got->br_startoff + got->br_blockcount >= aoff + alen);
-        ASSERT(isnullstartblock(got->br_startblock));
-        ASSERT(got->br_state == XFS_EXT_NORM);
         return 0;
 
 out_unreserve_blocks:
diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c
index f93072b58a58..fd55db479385 100644
--- a/fs/xfs/libxfs/xfs_bmap_btree.c
+++ b/fs/xfs/libxfs/xfs_bmap_btree.c
@@ -447,8 +447,8 @@ xfs_bmbt_alloc_block(
 
         if (args.fsbno == NULLFSBLOCK) {
                 args.fsbno = be64_to_cpu(start->l);
-try_another_ag:
                 args.type = XFS_ALLOCTYPE_START_BNO;
+try_another_ag:
                 /*
                  * Make sure there is sufficient room left in the AG to
                  * complete a full tree split for an extent insert.  If
@@ -488,8 +488,8 @@ try_another_ag:
         if (xfs_sb_version_hasreflink(&cur->bc_mp->m_sb) &&
             args.fsbno == NULLFSBLOCK &&
             args.type == XFS_ALLOCTYPE_NEAR_BNO) {
-                cur->bc_private.b.dfops->dop_low = true;
                 args.fsbno = cur->bc_private.b.firstblock;
+                args.type = XFS_ALLOCTYPE_FIRST_AG;
                 goto try_another_ag;
         }
 
@@ -506,7 +506,7 @@ try_another_ag:
                         goto error0;
                 cur->bc_private.b.dfops->dop_low = true;
         }
-        if (args.fsbno == NULLFSBLOCK) {
+        if (WARN_ON_ONCE(args.fsbno == NULLFSBLOCK)) {
                 XFS_BTREE_TRACE_CURSOR(cur, XBT_EXIT);
                 *stat = 0;
                 return 0;
diff --git a/fs/xfs/libxfs/xfs_dir2_priv.h b/fs/xfs/libxfs/xfs_dir2_priv.h
index d04547fcf274..eb00bc133bca 100644
--- a/fs/xfs/libxfs/xfs_dir2_priv.h
+++ b/fs/xfs/libxfs/xfs_dir2_priv.h
@@ -125,6 +125,8 @@ extern int xfs_dir2_sf_create(struct xfs_da_args *args, xfs_ino_t pino);
 extern int xfs_dir2_sf_lookup(struct xfs_da_args *args);
 extern int xfs_dir2_sf_removename(struct xfs_da_args *args);
 extern int xfs_dir2_sf_replace(struct xfs_da_args *args);
+extern int xfs_dir2_sf_verify(struct xfs_mount *mp, struct xfs_dir2_sf_hdr *sfp,
+                int size);
 
 /* xfs_dir2_readdir.c */
 extern int xfs_readdir(struct xfs_inode *dp, struct dir_context *ctx,
diff --git a/fs/xfs/libxfs/xfs_dir2_sf.c b/fs/xfs/libxfs/xfs_dir2_sf.c
index c6809ff41197..96b45cd6c63f 100644
--- a/fs/xfs/libxfs/xfs_dir2_sf.c
+++ b/fs/xfs/libxfs/xfs_dir2_sf.c
@@ -629,6 +629,93 @@ xfs_dir2_sf_check(
 }
 #endif  /* DEBUG */
 
+/* Verify the consistency of an inline directory. */
+int
+xfs_dir2_sf_verify(
+        struct xfs_mount                *mp,
+        struct xfs_dir2_sf_hdr          *sfp,
+        int                             size)
+{
+        struct xfs_dir2_sf_entry        *sfep;
+        struct xfs_dir2_sf_entry        *next_sfep;
+        char                            *endp;
+        const struct xfs_dir_ops        *dops;
+        xfs_ino_t                       ino;
+        int                             i;
+        int                             i8count;
+        int                             offset;
+        __uint8_t                       filetype;
+
+        dops = xfs_dir_get_ops(mp, NULL);
+
+        /*
+         * Give up if the directory is way too short.
+         */
+        XFS_WANT_CORRUPTED_RETURN(mp, size >
+                        offsetof(struct xfs_dir2_sf_hdr, parent));
+        XFS_WANT_CORRUPTED_RETURN(mp, size >=
+                        xfs_dir2_sf_hdr_size(sfp->i8count));
+
+        endp = (char *)sfp + size;
+
+        /* Check .. entry */
+        ino = dops->sf_get_parent_ino(sfp);
+        i8count = ino > XFS_DIR2_MAX_SHORT_INUM;
+        XFS_WANT_CORRUPTED_RETURN(mp, !xfs_dir_ino_validate(mp, ino));
+        offset = dops->data_first_offset;
+
+        /* Check all reported entries */
+        sfep = xfs_dir2_sf_firstentry(sfp);
+        for (i = 0; i < sfp->count; i++) {
+                /*
+                 * struct xfs_dir2_sf_entry has a variable length.
+                 * Check the fixed-offset parts of the structure are
+                 * within the data buffer.
+                 */
+                XFS_WANT_CORRUPTED_RETURN(mp,
+                                ((char *)sfep + sizeof(*sfep)) < endp);
+
+                /* Don't allow names with known bad length. */
+                XFS_WANT_CORRUPTED_RETURN(mp, sfep->namelen > 0);
+                XFS_WANT_CORRUPTED_RETURN(mp, sfep->namelen < MAXNAMELEN);
+
+                /*
+                 * Check that the variable-length part of the structure is
+                 * within the data buffer.  The next entry starts after the
+                 * name component, so nextentry is an acceptable test.
+                 */
+                next_sfep = dops->sf_nextentry(sfp, sfep);
+                XFS_WANT_CORRUPTED_RETURN(mp, endp >= (char *)next_sfep);
+
+                /* Check that the offsets always increase. */
+                XFS_WANT_CORRUPTED_RETURN(mp,
+                                xfs_dir2_sf_get_offset(sfep) >= offset);
+
+                /* Check the inode number. */
+                ino = dops->sf_get_ino(sfp, sfep);
+                i8count += ino > XFS_DIR2_MAX_SHORT_INUM;
+                XFS_WANT_CORRUPTED_RETURN(mp, !xfs_dir_ino_validate(mp, ino));
+
+                /* Check the file type. */
+                filetype = dops->sf_get_ftype(sfep);
+                XFS_WANT_CORRUPTED_RETURN(mp, filetype < XFS_DIR3_FT_MAX);
+
+                offset = xfs_dir2_sf_get_offset(sfep) +
+                                dops->data_entsize(sfep->namelen);
+
+                sfep = next_sfep;
+        }
+        XFS_WANT_CORRUPTED_RETURN(mp, i8count == sfp->i8count);
+        XFS_WANT_CORRUPTED_RETURN(mp, (void *)sfep == (void *)endp);
+
+        /* Make sure this whole thing ought to be in local format. */
+        XFS_WANT_CORRUPTED_RETURN(mp, offset +
+               (sfp->count + 2) * (uint)sizeof(xfs_dir2_leaf_entry_t) +
+               (uint)sizeof(xfs_dir2_block_tail_t) <= mp->m_dir_geo->blksize);
+
+        return 0;
+}
+
 /*
  * Create a new (shortform) directory.
  */
diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c
index 25c1e078aef6..9653e964eda4 100644
--- a/fs/xfs/libxfs/xfs_inode_fork.c
+++ b/fs/xfs/libxfs/xfs_inode_fork.c
@@ -33,6 +33,8 @@
 #include "xfs_trace.h"
 #include "xfs_attr_sf.h"
 #include "xfs_da_format.h"
+#include "xfs_da_btree.h"
+#include "xfs_dir2_priv.h"
 
 kmem_zone_t *xfs_ifork_zone;
 
@@ -320,6 +322,7 @@ xfs_iformat_local(
         int             whichfork,
         int             size)
 {
+        int             error;
 
         /*
          * If the size is unreasonable, then something
@@ -336,6 +339,14 @@ xfs_iformat_local(
                 return -EFSCORRUPTED;
         }
 
+        if (S_ISDIR(VFS_I(ip)->i_mode) && whichfork == XFS_DATA_FORK) {
+                error = xfs_dir2_sf_verify(ip->i_mount,
+                                (struct xfs_dir2_sf_hdr *)XFS_DFORK_DPTR(dip),
+                                size);
+                if (error)
+                        return error;
+        }
+
         xfs_init_local_fork(ip, whichfork, XFS_DFORK_PTR(dip, whichfork), size);
         return 0;
 }
@@ -856,7 +867,7 @@ xfs_iextents_copy(
  * In these cases, the format always takes precedence, because the
  * format indicates the current state of the fork.
  */
-void
+int
 xfs_iflush_fork(
         xfs_inode_t             *ip,
         xfs_dinode_t            *dip,
@@ -866,6 +877,7 @@ xfs_iflush_fork(
         char                    *cp;
         xfs_ifork_t             *ifp;
         xfs_mount_t             *mp;
+        int                     error;
         static const short      brootflag[2] =
                 { XFS_ILOG_DBROOT, XFS_ILOG_ABROOT };
         static const short      dataflag[2] =
@@ -874,7 +886,7 @@ xfs_iflush_fork(
                 { XFS_ILOG_DEXT, XFS_ILOG_AEXT };
 
         if (!iip)
-                return;
+                return 0;
         ifp = XFS_IFORK_PTR(ip, whichfork);
         /*
          * This can happen if we gave up in iformat in an error path,
@@ -882,12 +894,19 @@ xfs_iflush_fork(
          */
         if (!ifp) {
                 ASSERT(whichfork == XFS_ATTR_FORK);
-                return;
+                return 0;
         }
         cp = XFS_DFORK_PTR(dip, whichfork);
         mp = ip->i_mount;
         switch (XFS_IFORK_FORMAT(ip, whichfork)) {
         case XFS_DINODE_FMT_LOCAL:
+                if (S_ISDIR(VFS_I(ip)->i_mode) && whichfork == XFS_DATA_FORK) {
+                        error = xfs_dir2_sf_verify(mp,
+                                        (struct xfs_dir2_sf_hdr *)ifp->if_u1.if_data,
+                                        ifp->if_bytes);
+                        if (error)
+                                return error;
+                }
                 if ((iip->ili_fields & dataflag[whichfork]) &&
                     (ifp->if_bytes > 0)) {
                         ASSERT(ifp->if_u1.if_data != NULL);
@@ -940,6 +959,7 @@ xfs_iflush_fork(
                 ASSERT(0);
                 break;
         }
+        return 0;
 }
 
 /*
diff --git a/fs/xfs/libxfs/xfs_inode_fork.h b/fs/xfs/libxfs/xfs_inode_fork.h
index 7fb8365326d1..132dc59fdde6 100644
--- a/fs/xfs/libxfs/xfs_inode_fork.h
+++ b/fs/xfs/libxfs/xfs_inode_fork.h
@@ -140,7 +140,7 @@ typedef struct xfs_ifork {
 struct xfs_ifork *xfs_iext_state_to_fork(struct xfs_inode *ip, int state);
 
 int             xfs_iformat_fork(struct xfs_inode *, struct xfs_dinode *);
-void            xfs_iflush_fork(struct xfs_inode *, struct xfs_dinode *,
+int             xfs_iflush_fork(struct xfs_inode *, struct xfs_dinode *,
                                 struct xfs_inode_log_item *, int);
 void            xfs_idestroy_fork(struct xfs_inode *, int);
 void            xfs_idata_realloc(struct xfs_inode *, int, int);
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index bf65a9ea8642..61494295d92f 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -274,54 +274,49 @@ xfs_end_io(
         struct xfs_ioend        *ioend =
                 container_of(work, struct xfs_ioend, io_work);
         struct xfs_inode        *ip = XFS_I(ioend->io_inode);
+        xfs_off_t               offset = ioend->io_offset;
+        size_t                  size = ioend->io_size;
         int                     error = ioend->io_bio->bi_error;
 
         /*
-         * Set an error if the mount has shut down and proceed with end I/O
-         * processing so it can perform whatever cleanups are necessary.
+         * Just clean up the in-memory strutures if the fs has been shut down.
          */
-        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+        if (XFS_FORCED_SHUTDOWN(ip->i_mount)) {
                 error = -EIO;
+                goto done;
+        }
 
         /*
-         * For a CoW extent, we need to move the mapping from the CoW fork
-         * to the data fork.  If instead an error happened, just dump the
-         * new blocks.
+         * Clean up any COW blocks on an I/O error.
          */
-        if (ioend->io_type == XFS_IO_COW) {
-                if (error)
-                        goto done;
-                if (ioend->io_bio->bi_error) {
-                        error = xfs_reflink_cancel_cow_range(ip,
-                                        ioend->io_offset, ioend->io_size);
-                        goto done;
+        if (unlikely(error)) {
+                switch (ioend->io_type) {
+                case XFS_IO_COW:
+                        xfs_reflink_cancel_cow_range(ip, offset, size, true);
+                        break;
                 }
-                error = xfs_reflink_end_cow(ip, ioend->io_offset,
-                                ioend->io_size);
-                if (error)
-                        goto done;
+
+                goto done;
         }
 
         /*
-         * For unwritten extents we need to issue transactions to convert a
-         * range to normal written extens after the data I/O has finished.
-         * Detecting and handling completion IO errors is done individually
-         * for each case as different cleanup operations need to be performed
-         * on error.
+         * Success:  commit the COW or unwritten blocks if needed.
          */
-        if (ioend->io_type == XFS_IO_UNWRITTEN) {
-                if (error)
-                        goto done;
-                error = xfs_iomap_write_unwritten(ip, ioend->io_offset,
-                                                  ioend->io_size);
-        } else if (ioend->io_append_trans) {
-                error = xfs_setfilesize_ioend(ioend, error);
-        } else {
-                ASSERT(!xfs_ioend_is_append(ioend) ||
-                       ioend->io_type == XFS_IO_COW);
+        switch (ioend->io_type) {
+        case XFS_IO_COW:
+                error = xfs_reflink_end_cow(ip, offset, size);
+                break;
+        case XFS_IO_UNWRITTEN:
+                error = xfs_iomap_write_unwritten(ip, offset, size);
+                break;
+        default:
+                ASSERT(!xfs_ioend_is_append(ioend) || ioend->io_append_trans);
+                break;
         }
 
 done:
+        if (ioend->io_append_trans)
+                error = xfs_setfilesize_ioend(ioend, error);
         xfs_destroy_ioend(ioend, error);
 }
 
diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c
index 003a99b83bd8..ad9396e516f6 100644
--- a/fs/xfs/xfs_dir2_readdir.c
+++ b/fs/xfs/xfs_dir2_readdir.c
@@ -71,22 +71,11 @@ xfs_dir2_sf_getdents(
         struct xfs_da_geometry  *geo = args->geo;
 
         ASSERT(dp->i_df.if_flags & XFS_IFINLINE);
-        /*
-         * Give up if the directory is way too short.
-         */
-        if (dp->i_d.di_size < offsetof(xfs_dir2_sf_hdr_t, parent)) {
-                ASSERT(XFS_FORCED_SHUTDOWN(dp->i_mount));
-                return -EIO;
-        }
-
         ASSERT(dp->i_df.if_bytes == dp->i_d.di_size);
         ASSERT(dp->i_df.if_u1.if_data != NULL);
 
         sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
 
-        if (dp->i_d.di_size < xfs_dir2_sf_hdr_size(sfp->i8count))
-                return -EFSCORRUPTED;
-
         /*
          * If the block number in the offset is out of range, we're done.
          */
diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index 7234b9748c36..3531f8f72fa5 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -1608,7 +1608,7 @@ xfs_inode_free_cowblocks(
         xfs_ilock(ip, XFS_IOLOCK_EXCL);
         xfs_ilock(ip, XFS_MMAPLOCK_EXCL);
 
-        ret = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF);
+        ret = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF, false);
 
         xfs_iunlock(ip, XFS_MMAPLOCK_EXCL);
         xfs_iunlock(ip, XFS_IOLOCK_EXCL);
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index edfa6a55b064..c7fe2c2123ab 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1615,7 +1615,7 @@ xfs_itruncate_extents(
 
         /* Remove all pending CoW reservations. */
         error = xfs_reflink_cancel_cow_blocks(ip, &tp, first_unmap_block,
-                        last_block);
+                        last_block, true);
         if (error)
                 goto out;
 
@@ -3475,6 +3475,7 @@ xfs_iflush_int(
         struct xfs_inode_log_item *iip = ip->i_itemp;
         struct xfs_dinode       *dip;
         struct xfs_mount        *mp = ip->i_mount;
+        int                     error;
 
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_ILOCK_SHARED));
         ASSERT(xfs_isiflocked(ip));
@@ -3557,9 +3558,14 @@ xfs_iflush_int(
         if (ip->i_d.di_flushiter == DI_MAX_FLUSH)
                 ip->i_d.di_flushiter = 0;
 
-        xfs_iflush_fork(ip, dip, iip, XFS_DATA_FORK);
-        if (XFS_IFORK_Q(ip))
-                xfs_iflush_fork(ip, dip, iip, XFS_ATTR_FORK);
+        error = xfs_iflush_fork(ip, dip, iip, XFS_DATA_FORK);
+        if (error)
+                return error;
+        if (XFS_IFORK_Q(ip)) {
+                error = xfs_iflush_fork(ip, dip, iip, XFS_ATTR_FORK);
+                if (error)
+                        return error;
+        }
         xfs_inobp_check(mp, bp);
 
         /*
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 41662fb14e87..288ee5b840d7 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -630,6 +630,11 @@ retry:
                 goto out_unlock;
         }
 
+        /*
+         * Flag newly allocated delalloc blocks with IOMAP_F_NEW so we punch
+         * them out if the write happens to fail.
+         */
+        iomap->flags = IOMAP_F_NEW;
         trace_xfs_iomap_alloc(ip, offset, count, 0, &got);
 done:
         if (isnullstartblock(got.br_startblock))
@@ -1071,16 +1076,22 @@ xfs_file_iomap_end_delalloc(
         struct xfs_inode        *ip,
         loff_t                  offset,
         loff_t                  length,
-        ssize_t                 written)
+        ssize_t                 written,
+        struct iomap            *iomap)
 {
         struct xfs_mount        *mp = ip->i_mount;
         xfs_fileoff_t           start_fsb;
         xfs_fileoff_t           end_fsb;
         int                     error = 0;
 
-        /* behave as if the write failed if drop writes is enabled */
-        if (xfs_mp_drop_writes(mp))
+        /*
+         * Behave as if the write failed if drop writes is enabled. Set the NEW
+         * flag to force delalloc cleanup.
+         */
+        if (xfs_mp_drop_writes(mp)) {
+                iomap->flags |= IOMAP_F_NEW;
                 written = 0;
+        }
 
         /*
          * start_fsb refers to the first unused block after a short write. If
@@ -1094,14 +1105,14 @@ xfs_file_iomap_end_delalloc(
         end_fsb = XFS_B_TO_FSB(mp, offset + length);
 
         /*
-         * Trim back delalloc blocks if we didn't manage to write the whole
-         * range reserved.
+         * Trim delalloc blocks if they were allocated by this write and we
+         * didn't manage to write the whole range.
          *
          * We don't need to care about racing delalloc as we hold i_mutex
          * across the reserve/allocate/unreserve calls. If there are delalloc
          * blocks in the range, they are ours.
          */
-        if (start_fsb < end_fsb) {
+        if ((iomap->flags & IOMAP_F_NEW) && start_fsb < end_fsb) {
                 truncate_pagecache_range(VFS_I(ip), XFS_FSB_TO_B(mp, start_fsb),
                                          XFS_FSB_TO_B(mp, end_fsb) - 1);
 
@@ -1131,7 +1142,7 @@ xfs_file_iomap_end(
 {
         if ((flags & IOMAP_WRITE) && iomap->type == IOMAP_DELALLOC)
                 return xfs_file_iomap_end_delalloc(XFS_I(inode), offset,
-                                length, written);
+                                length, written, iomap);
         return 0;
 }
 
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 229cc6a6d8ef..ebfc13350f9a 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -516,6 +516,20 @@ xfs_vn_getattr(
         stat->blocks =
                 XFS_FSB_TO_BB(mp, ip->i_d.di_nblocks + ip->i_delayed_blks);
 
+        if (ip->i_d.di_version == 3) {
+                if (request_mask & STATX_BTIME) {
+                        stat->result_mask |= STATX_BTIME;
+                        stat->btime.tv_sec = ip->i_d.di_crtime.t_sec;
+                        stat->btime.tv_nsec = ip->i_d.di_crtime.t_nsec;
+                }
+        }
+
+        if (ip->i_d.di_flags & XFS_DIFLAG_IMMUTABLE)
+                stat->attributes |= STATX_ATTR_IMMUTABLE;
+        if (ip->i_d.di_flags & XFS_DIFLAG_APPEND)
+                stat->attributes |= STATX_ATTR_APPEND;
+        if (ip->i_d.di_flags & XFS_DIFLAG_NODUMP)
+                stat->attributes |= STATX_ATTR_NODUMP;
 
         switch (inode->i_mode & S_IFMT) {
         case S_IFBLK:
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index 66e881790c17..2a6d9b1558e0 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -361,7 +361,6 @@ xfs_bulkstat(
         xfs_agino_t             agino;  /* inode # in allocation group */
         xfs_agnumber_t          agno;   /* allocation group number */
         xfs_btree_cur_t         *cur;   /* btree cursor for ialloc btree */
-        size_t                  irbsize; /* size of irec buffer in bytes */
         xfs_inobt_rec_incore_t  *irbuf; /* start of irec buffer */
         int                     nirbuf; /* size of irbuf */
         int                     ubcount; /* size of user's buffer */
@@ -388,11 +387,10 @@ xfs_bulkstat(
         *ubcountp = 0;
         *done = 0;
 
-        irbuf = kmem_zalloc_greedy(&irbsize, PAGE_SIZE, PAGE_SIZE * 4);
+        irbuf = kmem_zalloc_large(PAGE_SIZE * 4, KM_SLEEP);
         if (!irbuf)
                 return -ENOMEM;
-
-        nirbuf = irbsize / sizeof(*irbuf);
+        nirbuf = (PAGE_SIZE * 4) / sizeof(*irbuf);
 
         /*
          * Loop over the allocation groups, starting from the last
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 450bde68bb75..688ebff1f663 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -513,8 +513,7 @@ STATIC void
 xfs_set_inoalignment(xfs_mount_t *mp)
 {
         if (xfs_sb_version_hasalign(&mp->m_sb) &&
-            mp->m_sb.sb_inoalignmt >=
-            XFS_B_TO_FSBT(mp, mp->m_inode_cluster_size))
+                mp->m_sb.sb_inoalignmt >= xfs_icluster_size_fsb(mp))
                 mp->m_inoalign_mask = mp->m_sb.sb_inoalignmt - 1;
         else
                 mp->m_inoalign_mask = 0;
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index da6d08fb359c..4a84c5ea266d 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -548,14 +548,18 @@ xfs_reflink_trim_irec_to_next_cow(
 }
 
 /*
- * Cancel all pending CoW reservations for some block range of an inode.
+ * Cancel CoW reservations for some block range of an inode.
+ *
+ * If cancel_real is true this function cancels all COW fork extents for the
+ * inode; if cancel_real is false, real extents are not cleared.
  */
 int
 xfs_reflink_cancel_cow_blocks(
         struct xfs_inode                *ip,
         struct xfs_trans                **tpp,
         xfs_fileoff_t                   offset_fsb,
-        xfs_fileoff_t                   end_fsb)
+        xfs_fileoff_t                   end_fsb,
+        bool                            cancel_real)
 {
         struct xfs_ifork                *ifp = XFS_IFORK_PTR(ip, XFS_COW_FORK);
         struct xfs_bmbt_irec            got, del;
@@ -579,7 +583,7 @@ xfs_reflink_cancel_cow_blocks(
                                         &idx, &got, &del);
                         if (error)
                                 break;
-                } else {
+                } else if (del.br_state == XFS_EXT_UNWRITTEN || cancel_real) {
                         xfs_trans_ijoin(*tpp, ip, 0);
                         xfs_defer_init(&dfops, &firstfsb);
 
@@ -621,13 +625,17 @@ xfs_reflink_cancel_cow_blocks(
 }
 
 /*
- * Cancel all pending CoW reservations for some byte range of an inode.
+ * Cancel CoW reservations for some byte range of an inode.
+ *
+ * If cancel_real is true this function cancels all COW fork extents for the
+ * inode; if cancel_real is false, real extents are not cleared.
  */
 int
 xfs_reflink_cancel_cow_range(
         struct xfs_inode        *ip,
         xfs_off_t               offset,
-        xfs_off_t               count)
+        xfs_off_t               count,
+        bool                    cancel_real)
 {
         struct xfs_trans        *tp;
         xfs_fileoff_t           offset_fsb;
@@ -653,7 +661,8 @@ xfs_reflink_cancel_cow_range(
         xfs_trans_ijoin(tp, ip, 0);
 
         /* Scrape out the old CoW reservations */
-        error = xfs_reflink_cancel_cow_blocks(ip, &tp, offset_fsb, end_fsb);
+        error = xfs_reflink_cancel_cow_blocks(ip, &tp, offset_fsb, end_fsb,
+                        cancel_real);
         if (error)
                 goto out_cancel;
 
@@ -1450,7 +1459,7 @@ next:
          * We didn't find any shared blocks so turn off the reflink flag.
          * First, get rid of any leftover CoW mappings.
          */
-        error = xfs_reflink_cancel_cow_blocks(ip, tpp, 0, NULLFILEOFF);
+        error = xfs_reflink_cancel_cow_blocks(ip, tpp, 0, NULLFILEOFF, true);
         if (error)
                 return error;
 
diff --git a/fs/xfs/xfs_reflink.h b/fs/xfs/xfs_reflink.h
index 33ac9b8db683..d29a7967f029 100644
--- a/fs/xfs/xfs_reflink.h
+++ b/fs/xfs/xfs_reflink.h
@@ -39,9 +39,9 @@ extern void xfs_reflink_trim_irec_to_next_cow(struct xfs_inode *ip,
 
 extern int xfs_reflink_cancel_cow_blocks(struct xfs_inode *ip,
                 struct xfs_trans **tpp, xfs_fileoff_t offset_fsb,
-                xfs_fileoff_t end_fsb);
+                xfs_fileoff_t end_fsb, bool cancel_real);
 extern int xfs_reflink_cancel_cow_range(struct xfs_inode *ip, xfs_off_t offset,
-                xfs_off_t count);
+                xfs_off_t count, bool cancel_real);
 extern int xfs_reflink_end_cow(struct xfs_inode *ip, xfs_off_t offset,
                 xfs_off_t count);
 extern int xfs_reflink_recover_cow(struct xfs_mount *mp);
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 890862f2447c..685c042a120f 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -953,7 +953,7 @@ xfs_fs_destroy_inode(
         XFS_STATS_INC(ip->i_mount, vn_remove);
 
         if (xfs_is_reflink_inode(ip)) {
-                error = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF);
+                error = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF, true);
                 if (error && !XFS_FORCED_SHUTDOWN(ip->i_mount))
                         xfs_warn(ip->i_mount,
 "Error %d while evicting CoW blocks for inode %llu.",
diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
index 5bdab6bffd23..928fd66b1271 100644
--- a/include/asm-generic/4level-fixup.h
+++ b/include/asm-generic/4level-fixup.h
@@ -15,7 +15,6 @@
         ((unlikely(pgd_none(*(pud))) && __pmd_alloc(mm, pud, address))? \
                 NULL: pmd_offset(pud, address))
 
-#define pud_alloc(mm, pgd, address)     (pgd)
 #define pud_offset(pgd, start)          (pgd)
 #define pud_none(pud)                   0
 #define pud_bad(pud)                    0
@@ -35,4 +34,6 @@
 #undef  pud_addr_end
 #define pud_addr_end(addr, end)         (end)
 
+#include <asm-generic/5level-fixup.h>
+
 #endif
diff --git a/include/asm-generic/5level-fixup.h b/include/asm-generic/5level-fixup.h
new file mode 100644
index 000000000000..b5ca82dc4175
--- /dev/null
+++ b/include/asm-generic/5level-fixup.h
@@ -0,0 +1,41 @@
+#ifndef _5LEVEL_FIXUP_H
+#define _5LEVEL_FIXUP_H
+
+#define __ARCH_HAS_5LEVEL_HACK
+#define __PAGETABLE_P4D_FOLDED
+
+#define P4D_SHIFT                       PGDIR_SHIFT
+#define P4D_SIZE                        PGDIR_SIZE
+#define P4D_MASK                        PGDIR_MASK
+#define PTRS_PER_P4D                    1
+
+#define p4d_t                           pgd_t
+
+#define pud_alloc(mm, p4d, address) \
+        ((unlikely(pgd_none(*(p4d))) && __pud_alloc(mm, p4d, address)) ? \
+                NULL : pud_offset(p4d, address))
+
+#define p4d_alloc(mm, pgd, address)     (pgd)
+#define p4d_offset(pgd, start)          (pgd)
+#define p4d_none(p4d)                   0
+#define p4d_bad(p4d)                    0
+#define p4d_present(p4d)                1
+#define p4d_ERROR(p4d)                  do { } while (0)
+#define p4d_clear(p4d)                  pgd_clear(p4d)
+#define p4d_val(p4d)                    pgd_val(p4d)
+#define p4d_populate(mm, p4d, pud)      pgd_populate(mm, p4d, pud)
+#define p4d_page(p4d)                   pgd_page(p4d)
+#define p4d_page_vaddr(p4d)             pgd_page_vaddr(p4d)
+
+#define __p4d(x)                        __pgd(x)
+#define set_p4d(p4dp, p4d)              set_pgd(p4dp, p4d)
+
+#undef p4d_free_tlb
+#define p4d_free_tlb(tlb, x, addr)      do { } while (0)
+#define p4d_free(mm, x)                 do { } while (0)
+#define __p4d_free_tlb(tlb, x, addr)    do { } while (0)
+
+#undef  p4d_addr_end
+#define p4d_addr_end(addr, end)         (end)
+
+#endif
diff --git a/include/asm-generic/pgtable-nop4d-hack.h b/include/asm-generic/pgtable-nop4d-hack.h
new file mode 100644
index 000000000000..752fb7511750
--- /dev/null
+++ b/include/asm-generic/pgtable-nop4d-hack.h
@@ -0,0 +1,62 @@
+#ifndef _PGTABLE_NOP4D_HACK_H
+#define _PGTABLE_NOP4D_HACK_H
+
+#ifndef __ASSEMBLY__
+#include <asm-generic/5level-fixup.h>
+
+#define __PAGETABLE_PUD_FOLDED
+
+/*
+ * Having the pud type consist of a pgd gets the size right, and allows
+ * us to conceptually access the pgd entry that this pud is folded into
+ * without casting.
+ */
+typedef struct { pgd_t pgd; } pud_t;
+
+#define PUD_SHIFT       PGDIR_SHIFT
+#define PTRS_PER_PUD    1
+#define PUD_SIZE        (1UL << PUD_SHIFT)
+#define PUD_MASK        (~(PUD_SIZE-1))
+
+/*
+ * The "pgd_xxx()" functions here are trivial for a folded two-level
+ * setup: the pud is never bad, and a pud always exists (as it's folded
+ * into the pgd entry)
+ */
+static inline int pgd_none(pgd_t pgd)           { return 0; }
+static inline int pgd_bad(pgd_t pgd)            { return 0; }
+static inline int pgd_present(pgd_t pgd)        { return 1; }
+static inline void pgd_clear(pgd_t *pgd)        { }
+#define pud_ERROR(pud)                          (pgd_ERROR((pud).pgd))
+
+#define pgd_populate(mm, pgd, pud)              do { } while (0)
+/*
+ * (puds are folded into pgds so this doesn't get actually called,
+ * but the define is needed for a generic inline function.)
+ */
+#define set_pgd(pgdptr, pgdval) set_pud((pud_t *)(pgdptr), (pud_t) { pgdval })
+
+static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
+{
+        return (pud_t *)pgd;
+}
+
+#define pud_val(x)                              (pgd_val((x).pgd))
+#define __pud(x)                                ((pud_t) { __pgd(x) })
+
+#define pgd_page(pgd)                           (pud_page((pud_t){ pgd }))
+#define pgd_page_vaddr(pgd)                     (pud_page_vaddr((pud_t){ pgd }))
+
+/*
+ * allocating and freeing a pud is trivial: the 1-entry pud is
+ * inside the pgd, so has no extra memory associated with it.
+ */
+#define pud_alloc_one(mm, address)              NULL
+#define pud_free(mm, x)                         do { } while (0)
+#define __pud_free_tlb(tlb, x, a)               do { } while (0)
+
+#undef  pud_addr_end
+#define pud_addr_end(addr, end)                 (end)
+
+#endif /* __ASSEMBLY__ */
+#endif /* _PGTABLE_NOP4D_HACK_H */
diff --git a/include/asm-generic/pgtable-nop4d.h b/include/asm-generic/pgtable-nop4d.h
new file mode 100644
index 000000000000..de364ecb8df6
--- /dev/null
+++ b/include/asm-generic/pgtable-nop4d.h
@@ -0,0 +1,56 @@
+#ifndef _PGTABLE_NOP4D_H
+#define _PGTABLE_NOP4D_H
+
+#ifndef __ASSEMBLY__
+
+#define __PAGETABLE_P4D_FOLDED
+
+typedef struct { pgd_t pgd; } p4d_t;
+
+#define P4D_SHIFT       PGDIR_SHIFT
+#define PTRS_PER_P4D    1
+#define P4D_SIZE        (1UL << P4D_SHIFT)
+#define P4D_MASK        (~(P4D_SIZE-1))
+
+/*
+ * The "pgd_xxx()" functions here are trivial for a folded two-level
+ * setup: the p4d is never bad, and a p4d always exists (as it's folded
+ * into the pgd entry)
+ */
+static inline int pgd_none(pgd_t pgd)           { return 0; }
+static inline int pgd_bad(pgd_t pgd)            { return 0; }
+static inline int pgd_present(pgd_t pgd)        { return 1; }
+static inline void pgd_clear(pgd_t *pgd)        { }
+#define p4d_ERROR(p4d)                          (pgd_ERROR((p4d).pgd))
+
+#define pgd_populate(mm, pgd, p4d)              do { } while (0)
+/*
+ * (p4ds are folded into pgds so this doesn't get actually called,
+ * but the define is needed for a generic inline function.)
+ */
+#define set_pgd(pgdptr, pgdval) set_p4d((p4d_t *)(pgdptr), (p4d_t) { pgdval })
+
+static inline p4d_t *p4d_offset(pgd_t *pgd, unsigned long address)
+{
+        return (p4d_t *)pgd;
+}
+
+#define p4d_val(x)                              (pgd_val((x).pgd))
+#define __p4d(x)                                ((p4d_t) { __pgd(x) })
+
+#define pgd_page(pgd)                           (p4d_page((p4d_t){ pgd }))
+#define pgd_page_vaddr(pgd)                     (p4d_page_vaddr((p4d_t){ pgd }))
+
+/*
+ * allocating and freeing a p4d is trivial: the 1-entry p4d is
+ * inside the pgd, so has no extra memory associated with it.
+ */
+#define p4d_alloc_one(mm, address)              NULL
+#define p4d_free(mm, x)                         do { } while (0)
+#define __p4d_free_tlb(tlb, x, a)               do { } while (0)
+
+#undef  p4d_addr_end
+#define p4d_addr_end(addr, end)                 (end)
+
+#endif /* __ASSEMBLY__ */
+#endif /* _PGTABLE_NOP4D_H */
diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
index 810431d8351b..c2b9b96d6268 100644
--- a/include/asm-generic/pgtable-nopud.h
+++ b/include/asm-generic/pgtable-nopud.h
@@ -3,52 +3,57 @@
 
 #ifndef __ASSEMBLY__
 
+#ifdef __ARCH_USE_5LEVEL_HACK
+#include <asm-generic/pgtable-nop4d-hack.h>
+#else
+#include <asm-generic/pgtable-nop4d.h>
+
 #define __PAGETABLE_PUD_FOLDED
 
 /*
- * Having the pud type consist of a pgd gets the size right, and allows
- * us to conceptually access the pgd entry that this pud is folded into
+ * Having the pud type consist of a p4d gets the size right, and allows
+ * us to conceptually access the p4d entry that this pud is folded into
  * without casting.
  */
-typedef struct { pgd_t pgd; } pud_t;
+typedef struct { p4d_t p4d; } pud_t;
 
-#define PUD_SHIFT       PGDIR_SHIFT
+#define PUD_SHIFT       P4D_SHIFT
 #define PTRS_PER_PUD    1
 #define PUD_SIZE        (1UL << PUD_SHIFT)
 #define PUD_MASK        (~(PUD_SIZE-1))
 
 /*
- * The "pgd_xxx()" functions here are trivial for a folded two-level
+ * The "p4d_xxx()" functions here are trivial for a folded two-level
  * setup: the pud is never bad, and a pud always exists (as it's folded
- * into the pgd entry)
+ * into the p4d entry)
  */
-static inline int pgd_none(pgd_t pgd)           { return 0; }
-static inline int pgd_bad(pgd_t pgd)            { return 0; }
-static inline int pgd_present(pgd_t pgd)        { return 1; }
-static inline void pgd_clear(pgd_t *pgd)        { }
-#define pud_ERROR(pud)                          (pgd_ERROR((pud).pgd))
+static inline int p4d_none(p4d_t p4d)           { return 0; }
+static inline int p4d_bad(p4d_t p4d)            { return 0; }
+static inline int p4d_present(p4d_t p4d)        { return 1; }
+static inline void p4d_clear(p4d_t *p4d)        { }
+#define pud_ERROR(pud)                          (p4d_ERROR((pud).p4d))
 
-#define pgd_populate(mm, pgd, pud)              do { } while (0)
+#define p4d_populate(mm, p4d, pud)              do { } while (0)
 /*
- * (puds are folded into pgds so this doesn't get actually called,
+ * (puds are folded into p4ds so this doesn't get actually called,
  * but the define is needed for a generic inline function.)
  */
-#define set_pgd(pgdptr, pgdval)                 set_pud((pud_t *)(pgdptr), (pud_t) { pgdval })
+#define set_p4d(p4dptr, p4dval) set_pud((pud_t *)(p4dptr), (pud_t) { p4dval })
 
-static inline pud_t * pud_offset(pgd_t * pgd, unsigned long address)
+static inline pud_t *pud_offset(p4d_t *p4d, unsigned long address)
 {
-        return (pud_t *)pgd;
+        return (pud_t *)p4d;
 }
 
-#define pud_val(x)                              (pgd_val((x).pgd))
-#define __pud(x)                                ((pud_t) { __pgd(x) } )
+#define pud_val(x)                              (p4d_val((x).p4d))
+#define __pud(x)                                ((pud_t) { __p4d(x) })
 
-#define pgd_page(pgd)                           (pud_page((pud_t){ pgd }))
-#define pgd_page_vaddr(pgd)                     (pud_page_vaddr((pud_t){ pgd }))
+#define p4d_page(p4d)                           (pud_page((pud_t){ p4d }))
+#define p4d_page_vaddr(p4d)                     (pud_page_vaddr((pud_t){ p4d }))
 
 /*
  * allocating and freeing a pud is trivial: the 1-entry pud is
- * inside the pgd, so has no extra memory associated with it.
+ * inside the p4d, so has no extra memory associated with it.
  */
 #define pud_alloc_one(mm, address)              NULL
 #define pud_free(mm, x)                         do { } while (0)
@@ -58,4 +63,5 @@ static inline pud_t * pud_offset(pgd_t * pgd, unsigned long address)
 #define pud_addr_end(addr, end)                 (end)
 
 #endif /* __ASSEMBLY__ */
+#endif /* !__ARCH_USE_5LEVEL_HACK */
 #endif /* _PGTABLE_NOPUD_H */
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index f4ca23b158b3..1fad160f35de 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -10,9 +10,9 @@
 #include <linux/bug.h>
 #include <linux/errno.h>
 
-#if 4 - defined(__PAGETABLE_PUD_FOLDED) - defined(__PAGETABLE_PMD_FOLDED) != \
-        CONFIG_PGTABLE_LEVELS
-#error CONFIG_PGTABLE_LEVELS is not consistent with __PAGETABLE_{PUD,PMD}_FOLDED
+#if 5 - defined(__PAGETABLE_P4D_FOLDED) - defined(__PAGETABLE_PUD_FOLDED) - \
+        defined(__PAGETABLE_PMD_FOLDED) != CONFIG_PGTABLE_LEVELS
+#error CONFIG_PGTABLE_LEVELS is not consistent with __PAGETABLE_{P4D,PUD,PMD}_FOLDED
 #endif
 
 /*
@@ -424,6 +424,13 @@ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
         (__boundary - 1 < (end) - 1)? __boundary: (end);                \
 })
 
+#ifndef p4d_addr_end
+#define p4d_addr_end(addr, end)                                         \
+({      unsigned long __boundary = ((addr) + P4D_SIZE) & P4D_MASK;      \
+        (__boundary - 1 < (end) - 1)? __boundary: (end);                \
+})
+#endif
+
 #ifndef pud_addr_end
 #define pud_addr_end(addr, end)                                         \
 ({      unsigned long __boundary = ((addr) + PUD_SIZE) & PUD_MASK;      \
@@ -444,6 +451,7 @@ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
  * Do the tests inline, but report and clear the bad entry in mm/memory.c.
  */
 void pgd_clear_bad(pgd_t *);
+void p4d_clear_bad(p4d_t *);
 void pud_clear_bad(pud_t *);
 void pmd_clear_bad(pmd_t *);
 
@@ -458,6 +466,17 @@ static inline int pgd_none_or_clear_bad(pgd_t *pgd)
         return 0;
 }
 
+static inline int p4d_none_or_clear_bad(p4d_t *p4d)
+{
+        if (p4d_none(*p4d))
+                return 1;
+        if (unlikely(p4d_bad(*p4d))) {
+                p4d_clear_bad(p4d);
+                return 1;
+        }
+        return 0;
+}
+
 static inline int pud_none_or_clear_bad(pud_t *pud)
 {
         if (pud_none(*pud))
@@ -844,11 +863,30 @@ static inline int pmd_protnone(pmd_t pmd)
 #endif /* CONFIG_MMU */
 
 #ifdef CONFIG_HAVE_ARCH_HUGE_VMAP
+
+#ifndef __PAGETABLE_P4D_FOLDED
+int p4d_set_huge(p4d_t *p4d, phys_addr_t addr, pgprot_t prot);
+int p4d_clear_huge(p4d_t *p4d);
+#else
+static inline int p4d_set_huge(p4d_t *p4d, phys_addr_t addr, pgprot_t prot)
+{
+        return 0;
+}
+static inline int p4d_clear_huge(p4d_t *p4d)
+{
+        return 0;
+}
+#endif /* !__PAGETABLE_P4D_FOLDED */
+
 int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot);
 int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot);
 int pud_clear_huge(pud_t *pud);
 int pmd_clear_huge(pmd_t *pmd);
 #else   /* !CONFIG_HAVE_ARCH_HUGE_VMAP */
+static inline int p4d_set_huge(p4d_t *p4d, phys_addr_t addr, pgprot_t prot)
+{
+        return 0;
+}
 static inline int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot)
 {
         return 0;
@@ -857,6 +895,10 @@ static inline int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot)
 {
         return 0;
 }
+static inline int p4d_clear_huge(p4d_t *p4d)
+{
+        return 0;
+}
 static inline int pud_clear_huge(pud_t *pud)
 {
         return 0;
diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
index 4df64a1fc09e..532372c6cf15 100644
--- a/include/asm-generic/sections.h
+++ b/include/asm-generic/sections.h
@@ -14,8 +14,8 @@
  * [_sdata, _edata]: contains .data.* sections, may also contain .rodata.*
  *                   and/or .init.* sections.
  * [__start_rodata, __end_rodata]: contains .rodata.* sections
- * [__start_data_ro_after_init, __end_data_ro_after_init]:
- *                   contains data.ro_after_init section
+ * [__start_ro_after_init, __end_ro_after_init]:
+ *                   contains .data..ro_after_init section
  * [__init_begin, __init_end]: contains .init.* sections, but .init.text.*
  *                   may be out of this range on some architectures.
  * [_sinittext, _einittext]: contains .init.text.* sections
@@ -33,7 +33,7 @@ extern char _data[], _sdata[], _edata[];
 extern char __bss_start[], __bss_stop[];
 extern char __init_begin[], __init_end[];
 extern char _sinittext[], _einittext[];
-extern char __start_data_ro_after_init[], __end_data_ro_after_init[];
+extern char __start_ro_after_init[], __end_ro_after_init[];
 extern char _end[];
 extern char __per_cpu_load[], __per_cpu_start[], __per_cpu_end[];
 extern char __kprobes_text_start[], __kprobes_text_end[];
diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
index 4329bc6ef04b..8afa4335e5b2 100644
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -270,6 +270,12 @@ static inline void tlb_remove_check_page_size_change(struct mmu_gather *tlb,
                 __pte_free_tlb(tlb, ptep, address);             \
         } while (0)
 
+#define pmd_free_tlb(tlb, pmdp, address)                        \
+        do {                                                    \
+                __tlb_adjust_range(tlb, address, PAGE_SIZE);            \
+                __pmd_free_tlb(tlb, pmdp, address);             \
+        } while (0)
+
 #ifndef __ARCH_HAS_4LEVEL_HACK
 #define pud_free_tlb(tlb, pudp, address)                        \
         do {                                                    \
@@ -278,11 +284,13 @@ static inline void tlb_remove_check_page_size_change(struct mmu_gather *tlb,
         } while (0)
 #endif
 
-#define pmd_free_tlb(tlb, pmdp, address)                        \
+#ifndef __ARCH_HAS_5LEVEL_HACK
+#define p4d_free_tlb(tlb, pudp, address)                        \
         do {                                                    \
-                __tlb_adjust_range(tlb, address, PAGE_SIZE);    \
-                __pmd_free_tlb(tlb, pmdp, address);             \
+                __tlb_adjust_range(tlb, address, PAGE_SIZE);            \
+                __p4d_free_tlb(tlb, pudp, address);             \
         } while (0)
+#endif
 
 #define tlb_migrate_finish(mm) do {} while (0)
 
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 0968d13b3885..7cdfe167074f 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -173,6 +173,7 @@
         KEEP(*(__##name##_of_table_end))
 
 #define CLKSRC_OF_TABLES()      OF_TABLE(CONFIG_CLKSRC_OF, clksrc)
+#define CLKEVT_OF_TABLES()      OF_TABLE(CONFIG_CLKEVT_OF, clkevt)
 #define IRQCHIP_OF_MATCH_TABLE() OF_TABLE(CONFIG_IRQCHIP, irqchip)
 #define CLK_OF_TABLES()         OF_TABLE(CONFIG_COMMON_CLK, clk)
 #define IOMMU_OF_TABLES()       OF_TABLE(CONFIG_OF_IOMMU, iommu)
@@ -260,9 +261,9 @@
  */
 #ifndef RO_AFTER_INIT_DATA
 #define RO_AFTER_INIT_DATA                                              \
-        __start_data_ro_after_init = .;                                 \
+        __start_ro_after_init = .;                                      \
         *(.data..ro_after_init)                                         \
-        __end_data_ro_after_init = .;
+        __end_ro_after_init = .;
 #endif
 
 /*
@@ -559,6 +560,7 @@
         CLK_OF_TABLES()                                                 \
         RESERVEDMEM_OF_TABLES()                                         \
         CLKSRC_OF_TABLES()                                              \
+        CLKEVT_OF_TABLES()                                              \
         IOMMU_OF_TABLES()                                               \
         CPU_METHOD_OF_TABLES()                                          \
         CPUIDLE_METHOD_OF_TABLES()                                      \
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index a2bfd7843f18..e2b9c6fe2714 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -73,7 +73,7 @@ int af_alg_unregister_type(const struct af_alg_type *type);
 
 int af_alg_release(struct socket *sock);
 void af_alg_release_parent(struct sock *sk);
-int af_alg_accept(struct sock *sk, struct socket *newsock);
+int af_alg_accept(struct sock *sk, struct socket *newsock, bool kern);
 
 int af_alg_make_sg(struct af_alg_sgl *sgl, struct iov_iter *iter, int len);
 void af_alg_free_sg(struct af_alg_sgl *sgl);
diff --git a/include/dt-bindings/sound/cs42l42.h b/include/dt-bindings/sound/cs42l42.h
index 399a123aed58..db69d84ed7d1 100644
--- a/include/dt-bindings/sound/cs42l42.h
+++ b/include/dt-bindings/sound/cs42l42.h
@@ -20,7 +20,7 @@
 #define CS42L42_HPOUT_LOAD_1NF          0
 #define CS42L42_HPOUT_LOAD_10NF         1
 
-/* HPOUT Clamp to GND Overide */
+/* HPOUT Clamp to GND Override */
 #define CS42L42_HPOUT_CLAMP_EN          0
 #define CS42L42_HPOUT_CLAMP_DIS         1
 
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 673acda012af..9b05886f9773 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -287,18 +287,15 @@ static inline bool invalid_phys_cpuid(phys_cpuid_t phys_id)
 }
 
 /* Validate the processor object's proc_id */
-bool acpi_processor_validate_proc_id(int proc_id);
+bool acpi_duplicate_processor_id(int proc_id);
 
 #ifdef CONFIG_ACPI_HOTPLUG_CPU
 /* Arch dependent functions for cpu hotplug support */
 int acpi_map_cpu(acpi_handle handle, phys_cpuid_t physid, u32 acpi_id,
                  int *pcpu);
 int acpi_unmap_cpu(int cpu);
-int acpi_map_cpu2node(acpi_handle handle, int cpu, int physid);
 #endif /* CONFIG_ACPI_HOTPLUG_CPU */
 
-void acpi_set_processor_mapping(void);
-
 #ifdef CONFIG_ACPI_HOTPLUG_IOAPIC
 int acpi_get_ioapic_id(acpi_handle handle, u32 gsi_base, u64 *phys_addr);
 #endif
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 796016e63c1d..5a7da607ca04 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -435,7 +435,6 @@ struct request_queue {
         struct delayed_work     delay_work;
 
         struct backing_dev_info *backing_dev_info;
-        struct disk_devt        *disk_devt;
 
         /*
          * The queue owner gets to use this for whatever they like.
diff --git a/include/linux/ccp.h b/include/linux/ccp.h
index c71dd8fa5764..c41b8d99dd0e 100644
--- a/include/linux/ccp.h
+++ b/include/linux/ccp.h
@@ -556,7 +556,7 @@ enum ccp_engine {
  * struct ccp_cmd - CCP operation request
  * @entry: list element (ccp driver use only)
  * @work: work element used for callbacks (ccp driver use only)
- * @ccp: CCP device to be run on (ccp driver use only)
+ * @ccp: CCP device to be run on
  * @ret: operation return code (ccp driver use only)
  * @flags: cmd processing flags
  * @engine: CCP operation to perform
diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h
index 1816c5e26581..88cd5dc8e238 100644
--- a/include/linux/ceph/libceph.h
+++ b/include/linux/ceph/libceph.h
@@ -48,6 +48,7 @@ struct ceph_options {
         unsigned long mount_timeout;            /* jiffies */
         unsigned long osd_idle_ttl;             /* jiffies */
         unsigned long osd_keepalive_timeout;    /* jiffies */
+        unsigned long osd_request_timeout;      /* jiffies */
 
         /*
          * any type that can't be simply compared or doesn't need need
@@ -68,6 +69,7 @@ struct ceph_options {
 #define CEPH_MOUNT_TIMEOUT_DEFAULT      msecs_to_jiffies(60 * 1000)
 #define CEPH_OSD_KEEPALIVE_DEFAULT      msecs_to_jiffies(5 * 1000)
 #define CEPH_OSD_IDLE_TTL_DEFAULT       msecs_to_jiffies(60 * 1000)
+#define CEPH_OSD_REQUEST_TIMEOUT_DEFAULT 0  /* no timeout */
 
 #define CEPH_MONC_HUNT_INTERVAL         msecs_to_jiffies(3 * 1000)
 #define CEPH_MONC_PING_INTERVAL         msecs_to_jiffies(10 * 1000)
diff --git a/include/linux/ceph/osd_client.h b/include/linux/ceph/osd_client.h
index 2ea0c282f3dc..c125b5d9e13c 100644
--- a/include/linux/ceph/osd_client.h
+++ b/include/linux/ceph/osd_client.h
@@ -189,6 +189,7 @@ struct ceph_osd_request {
 
         /* internal */
         unsigned long r_stamp;                /* jiffies, send or check time */
+        unsigned long r_start_stamp;          /* jiffies */
         int r_attempts;
         struct ceph_eversion r_replay_version; /* aka reassert_version */
         u32 r_last_force_resend;
diff --git a/include/linux/clockchips.h b/include/linux/clockchips.h
index 5d3053c34fb3..6d7edc3082f9 100644
--- a/include/linux/clockchips.h
+++ b/include/linux/clockchips.h
@@ -229,7 +229,7 @@ static inline void tick_setup_hrtimer_broadcast(void) { }
 
 #ifdef CONFIG_CLKEVT_PROBE
 extern int clockevent_probe(void);
-#els
+#else
 static inline int clockevent_probe(void) { return 0; }
 #endif
 
diff --git a/include/linux/dccp.h b/include/linux/dccp.h
index 61d042bbbf60..68449293c4b6 100644
--- a/include/linux/dccp.h
+++ b/include/linux/dccp.h
@@ -163,6 +163,7 @@ struct dccp_request_sock {
         __u64                    dreq_isr;
         __u64                    dreq_gsr;
         __be32                   dreq_service;
+        spinlock_t               dreq_lock;
         struct list_head         dreq_featneg;
         __u32                    dreq_timestamp_echo;
         __u32                    dreq_timestamp_time;
diff --git a/include/linux/device.h b/include/linux/device.h
index 30c4570e928d..9ef518af5515 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -1140,7 +1140,6 @@ static inline bool device_supports_offline(struct device *dev)
 extern void lock_device_hotplug(void);
 extern void unlock_device_hotplug(void);
 extern int lock_device_hotplug_sysfs(void);
-void assert_held_device_hotplug(void);
 extern int device_offline(struct device *dev);
 extern int device_online(struct device *dev);
 extern void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode);
diff --git a/include/linux/errqueue.h b/include/linux/errqueue.h
index 9ca23fcfb5d7..6fdfc884fdeb 100644
--- a/include/linux/errqueue.h
+++ b/include/linux/errqueue.h
@@ -20,6 +20,8 @@ struct sock_exterr_skb {
         struct sock_extended_err        ee;
         u16                             addr_offset;
         __be16                          port;
+        u8                              opt_stats:1,
+                                        unused:7;
 };
 
 #endif
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 0c167fdee5f7..fbf7b39e8103 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -409,6 +409,7 @@ struct bpf_prog {
         u16                     pages;          /* Number of allocated pages */
         kmemcheck_bitfield_begin(meta);
         u16                     jited:1,        /* Is our filter JIT'ed? */
+                                locked:1,       /* Program image locked? */
                                 gpl_compatible:1, /* Is filter GPL compatible? */
                                 cb_access:1,    /* Is control block accessed? */
                                 dst_needed:1,   /* Do we need dst entry? */
@@ -554,22 +555,29 @@ static inline bool bpf_prog_was_classic(const struct bpf_prog *prog)
 #ifdef CONFIG_ARCH_HAS_SET_MEMORY
 static inline void bpf_prog_lock_ro(struct bpf_prog *fp)
 {
-        set_memory_ro((unsigned long)fp, fp->pages);
+        fp->locked = 1;
+        WARN_ON_ONCE(set_memory_ro((unsigned long)fp, fp->pages));
 }
 
 static inline void bpf_prog_unlock_ro(struct bpf_prog *fp)
 {
-        set_memory_rw((unsigned long)fp, fp->pages);
+        if (fp->locked) {
+                WARN_ON_ONCE(set_memory_rw((unsigned long)fp, fp->pages));
+                /* In case set_memory_rw() fails, we want to be the first
+                 * to crash here instead of some random place later on.
+                 */
+                fp->locked = 0;
+        }
 }
 
 static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
 {
-        set_memory_ro((unsigned long)hdr, hdr->pages);
+        WARN_ON_ONCE(set_memory_ro((unsigned long)hdr, hdr->pages));
 }
 
 static inline void bpf_jit_binary_unlock_ro(struct bpf_binary_header *hdr)
 {
-        set_memory_rw((unsigned long)hdr, hdr->pages);
+        WARN_ON_ONCE(set_memory_rw((unsigned long)hdr, hdr->pages));
 }
 #else
 static inline void bpf_prog_lock_ro(struct bpf_prog *fp)
diff --git a/include/linux/fs.h b/include/linux/fs.h
index aad3fd0ff5f8..7251f7bb45e8 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2678,7 +2678,7 @@ static const char * const kernel_read_file_str[] = {
 
 static inline const char *kernel_read_file_id_str(enum kernel_read_file_id id)
 {
-        if (id < 0 || id >= READING_MAX_ID)
+        if ((unsigned)id >= READING_MAX_ID)
                 return kernel_read_file_str[READING_UNKNOWN];
 
         return kernel_read_file_str[id];
diff --git a/include/linux/fscrypt_common.h b/include/linux/fscrypt_common.h
index 547f81592ba1..10c1abfbac6c 100644
--- a/include/linux/fscrypt_common.h
+++ b/include/linux/fscrypt_common.h
@@ -87,7 +87,6 @@ struct fscrypt_operations {
         unsigned int flags;
         const char *key_prefix;
         int (*get_context)(struct inode *, void *, size_t);
-        int (*prepare_context)(struct inode *);
         int (*set_context)(struct inode *, const void *, size_t, void *);
         int (*dummy_context)(struct inode *);
         bool (*is_encrypted)(struct inode *);
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index a999d281a2f1..76f39754e7b0 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -167,13 +167,6 @@ struct blk_integrity {
 };
 
 #endif  /* CONFIG_BLK_DEV_INTEGRITY */
-struct disk_devt {
-        atomic_t count;
-        void (*release)(struct disk_devt *disk_devt);
-};
-
-void put_disk_devt(struct disk_devt *disk_devt);
-void get_disk_devt(struct disk_devt *disk_devt);
 
 struct gendisk {
         /* major, first_minor and minors are input parameters only,
@@ -183,7 +176,6 @@ struct gendisk {
         int first_minor;
         int minors;                     /* maximum number of minors, =1 for
                                          * disks that can't be partitioned. */
-        struct disk_devt *disk_devt;
 
         char disk_name[DISK_NAME_LEN];  /* name of major driver */
         char *(*devnode)(struct gendisk *gd, umode_t *mode);
diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
index 2484b2fcc6eb..933d93656605 100644
--- a/include/linux/gpio/consumer.h
+++ b/include/linux/gpio/consumer.h
@@ -143,15 +143,6 @@ struct gpio_desc *devm_fwnode_get_index_gpiod_from_child(struct device *dev,
                                                 struct fwnode_handle *child,
                                                 enum gpiod_flags flags,
                                                 const char *label);
-/* FIXME: delete this helper when users are switched over */
-static inline struct gpio_desc *devm_get_gpiod_from_child(struct device *dev,
-                          const char *con_id, struct fwnode_handle *child)
-{
-        return devm_fwnode_get_index_gpiod_from_child(dev, con_id,
-                                                      0, child,
-                                                      GPIOD_ASIS,
-                                                      "?");
-}
 
 #else /* CONFIG_GPIOLIB */
 
@@ -444,13 +435,6 @@ struct gpio_desc *devm_fwnode_get_index_gpiod_from_child(struct device *dev,
         return ERR_PTR(-ENOSYS);
 }
 
-/* FIXME: delete this when all users are switched over */
-static inline struct gpio_desc *devm_get_gpiod_from_child(struct device *dev,
-                          const char *con_id, struct fwnode_handle *child)
-{
-        return ERR_PTR(-ENOSYS);
-}
-
 #endif /* CONFIG_GPIOLIB */
 
 static inline
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 503099d8aada..b857fc8cc2ec 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -122,7 +122,7 @@ struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
 struct page *follow_huge_pud(struct mm_struct *mm, unsigned long address,
                                 pud_t *pud, int flags);
 int pmd_huge(pmd_t pmd);
-int pud_huge(pud_t pmd);
+int pud_huge(pud_t pud);
 unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
                 unsigned long address, unsigned long end, pgprot_t newprot);
 
@@ -197,6 +197,9 @@ static inline void __unmap_hugepage_range(struct mmu_gather *tlb,
 #ifndef pgd_huge
 #define pgd_huge(x)     0
 #endif
+#ifndef p4d_huge
+#define p4d_huge(x)     0
+#endif
 
 #ifndef pgd_write
 static inline int pgd_write(pgd_t pgd)
diff --git a/include/linux/hwmon.h b/include/linux/hwmon.h
index 78d59dba563e..88b673749121 100644
--- a/include/linux/hwmon.h
+++ b/include/linux/hwmon.h
@@ -88,6 +88,7 @@ enum hwmon_temp_attributes {
 #define HWMON_T_CRIT_HYST       BIT(hwmon_temp_crit_hyst)
 #define HWMON_T_EMERGENCY       BIT(hwmon_temp_emergency)
 #define HWMON_T_EMERGENCY_HYST  BIT(hwmon_temp_emergency_hyst)
+#define HWMON_T_ALARM           BIT(hwmon_temp_alarm)
 #define HWMON_T_MIN_ALARM       BIT(hwmon_temp_min_alarm)
 #define HWMON_T_MAX_ALARM       BIT(hwmon_temp_max_alarm)
 #define HWMON_T_CRIT_ALARM      BIT(hwmon_temp_crit_alarm)
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index 62bbf3c1aa4a..970771a5f739 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -845,6 +845,13 @@ struct vmbus_channel {
          * link up channels based on their CPU affinity.
          */
         struct list_head percpu_list;
+
+        /*
+         * Defer freeing channel until after all cpu's have
+         * gone through grace period.
+         */
+        struct rcu_head rcu;
+
         /*
          * For performance critical channels (storage, networking
          * etc,), Hyper-V has a mechanism to enhance the throughput
@@ -1430,9 +1437,6 @@ extern bool vmbus_prep_negotiate_resp(struct icmsg_hdr *icmsghdrp, u8 *buf,
                                 const int *srv_version, int srv_vercnt,
                                 int *nego_fw_version, int *nego_srv_version);
 
-void hv_event_tasklet_disable(struct vmbus_channel *channel);
-void hv_event_tasklet_enable(struct vmbus_channel *channel);
-
 void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid);
 
 void vmbus_setevent(struct vmbus_channel *channel);
diff --git a/include/linux/iio/sw_device.h b/include/linux/iio/sw_device.h
index 23ca41515527..fa7931933067 100644
--- a/include/linux/iio/sw_device.h
+++ b/include/linux/iio/sw_device.h
@@ -62,7 +62,7 @@ void iio_swd_group_init_type_name(struct iio_sw_device *d,
                                   const char *name,
                                   struct config_item_type *type)
 {
-#ifdef CONFIG_CONFIGFS_FS
+#if IS_ENABLED(CONFIG_CONFIGFS_FS)
         config_group_init_type_name(&d->group, name, type);
 #endif
 }
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index 6a6de187ddc0..2e4de0deee53 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -125,9 +125,16 @@ enum iommu_attr {
 };
 
 /* These are the possible reserved region types */
-#define IOMMU_RESV_DIRECT       (1 << 0)
-#define IOMMU_RESV_RESERVED     (1 << 1)
-#define IOMMU_RESV_MSI          (1 << 2)
+enum iommu_resv_type {
+        /* Memory regions which must be mapped 1:1 at all times */
+        IOMMU_RESV_DIRECT,
+        /* Arbitrary "never map this or give it to a device" address ranges */
+        IOMMU_RESV_RESERVED,
+        /* Hardware MSI region (untranslated) */
+        IOMMU_RESV_MSI,
+        /* Software-managed MSI translation window */
+        IOMMU_RESV_SW_MSI,
+};
 
 /**
  * struct iommu_resv_region - descriptor for a reserved memory region
@@ -142,7 +149,7 @@ struct iommu_resv_region {
         phys_addr_t             start;
         size_t                  length;
         int                     prot;
-        int                     type;
+        enum iommu_resv_type    type;
 };
 
 #ifdef CONFIG_IOMMU_API
@@ -288,7 +295,8 @@ extern void iommu_get_resv_regions(struct device *dev, struct list_head *list);
 extern void iommu_put_resv_regions(struct device *dev, struct list_head *list);
 extern int iommu_request_dm_for_dev(struct device *dev);
 extern struct iommu_resv_region *
-iommu_alloc_resv_region(phys_addr_t start, size_t length, int prot, int type);
+iommu_alloc_resv_region(phys_addr_t start, size_t length, int prot,
+                        enum iommu_resv_type type);
 extern int iommu_get_group_resv_regions(struct iommu_group *group,
                                         struct list_head *head);
 
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index 672cfef72fc8..97cbca19430d 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -373,6 +373,8 @@
 #define ICC_IGRPEN0_EL1_MASK            (1 << ICC_IGRPEN0_EL1_SHIFT)
 #define ICC_IGRPEN1_EL1_SHIFT           0
 #define ICC_IGRPEN1_EL1_MASK            (1 << ICC_IGRPEN1_EL1_SHIFT)
+#define ICC_SRE_EL1_DIB                 (1U << 2)
+#define ICC_SRE_EL1_DFB                 (1U << 1)
 #define ICC_SRE_EL1_SRE                 (1U << 0)
 
 /*
diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h
index 188eced6813e..9f3616085423 100644
--- a/include/linux/irqdomain.h
+++ b/include/linux/irqdomain.h
@@ -524,6 +524,10 @@ static inline struct irq_domain *irq_find_matching_fwnode(
 {
         return NULL;
 }
+static inline bool irq_domain_check_msi_remap(void)
+{
+        return false;
+}
 #endif /* !CONFIG_IRQ_DOMAIN */
 
 #endif /* _LINUX_IRQDOMAIN_H */
diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
index 8e06d758ee48..2afd74b9d844 100644
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -90,6 +90,13 @@ extern bool static_key_initialized;
 struct static_key {
         atomic_t enabled;
 /*
+ * Note:
+ *   To make anonymous unions work with old compilers, the static
+ *   initialization of them requires brackets. This creates a dependency
+ *   on the order of the struct with the initializers. If any fields
+ *   are added, STATIC_KEY_INIT_TRUE and STATIC_KEY_INIT_FALSE may need
+ *   to be modified.
+ *
  * bit 0 => 1 if key is initially true
  *          0 if initially false
  * bit 1 => 1 if points to struct static_key_mod
@@ -166,10 +173,10 @@ extern void static_key_disable(struct static_key *key);
  */
 #define STATIC_KEY_INIT_TRUE                                    \
         { .enabled = { 1 },                                     \
-          .entries = (void *)JUMP_TYPE_TRUE }
+          { .entries = (void *)JUMP_TYPE_TRUE } }
 #define STATIC_KEY_INIT_FALSE                                   \
         { .enabled = { 0 },                                     \
-          .entries = (void *)JUMP_TYPE_FALSE }
+          { .entries = (void *)JUMP_TYPE_FALSE } }
 
 #else  /* !HAVE_JUMP_LABEL */
 
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index ceb3fe78a0d3..a5c7046f26b4 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -6,6 +6,7 @@
 struct kmem_cache;
 struct page;
 struct vm_struct;
+struct task_struct;
 
 #ifdef CONFIG_KASAN
 
@@ -18,6 +19,7 @@ extern unsigned char kasan_zero_page[PAGE_SIZE];
 extern pte_t kasan_zero_pte[PTRS_PER_PTE];
 extern pmd_t kasan_zero_pmd[PTRS_PER_PMD];
 extern pud_t kasan_zero_pud[PTRS_PER_PUD];
+extern p4d_t kasan_zero_p4d[PTRS_PER_P4D];
 
 void kasan_populate_zero_shadow(const void *shadow_start,
                                 const void *shadow_end);
@@ -74,6 +76,9 @@ size_t ksize(const void *);
 static inline void kasan_unpoison_slab(const void *ptr) { ksize(ptr); }
 size_t kasan_metadata_size(struct kmem_cache *cache);
 
+bool kasan_save_enable_multi_shot(void);
+void kasan_restore_multi_shot(bool enabled);
+
 #else /* CONFIG_KASAN */
 
 static inline void kasan_unpoison_shadow(const void *address, size_t size) {}
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 2c14ad9809da..d0250744507a 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -162,8 +162,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
                     int len, void *val);
 int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
                             int len, struct kvm_io_device *dev);
-int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
-                              struct kvm_io_device *dev);
+void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+                               struct kvm_io_device *dev);
 struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
                                          gpa_t addr);
 
diff --git a/include/linux/list_nulls.h b/include/linux/list_nulls.h
index b01fe1009084..87ff4f58a2f0 100644
--- a/include/linux/list_nulls.h
+++ b/include/linux/list_nulls.h
@@ -29,6 +29,11 @@ struct hlist_nulls_node {
         ((ptr)->first = (struct hlist_nulls_node *) NULLS_MARKER(nulls))
 
 #define hlist_nulls_entry(ptr, type, member) container_of(ptr,type,member)
+
+#define hlist_nulls_entry_safe(ptr, type, member) \
+        ({ typeof(ptr) ____ptr = (ptr); \
+           !is_a_nulls(____ptr) ? hlist_nulls_entry(____ptr, type, member) : NULL; \
+        })
 /**
  * ptr_is_a_nulls - Test if a ptr is a nulls
  * @ptr: ptr to be tested
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 5af377303880..bb7250c45cb8 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -740,6 +740,12 @@ static inline bool mem_cgroup_oom_synchronize(bool wait)
         return false;
 }
 
+static inline void mem_cgroup_update_page_stat(struct page *page,
+                                               enum mem_cgroup_stat_index idx,
+                                               int nr)
+{
+}
+
 static inline void mem_cgroup_inc_page_stat(struct page *page,
                                             enum mem_cgroup_stat_index idx)
 {
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 7e66e4f62858..1beb1ec2fbdf 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -476,6 +476,7 @@ enum {
 enum {
         MLX4_INTERFACE_STATE_UP         = 1 << 0,
         MLX4_INTERFACE_STATE_DELETION   = 1 << 1,
+        MLX4_INTERFACE_STATE_NOWAIT     = 1 << 2,
 };
 
 #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 0d65dd72c0f4..00a8fa7e366a 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -32,6 +32,8 @@ struct user_struct;
 struct writeback_control;
 struct bdi_writeback;
 
+void init_mm_internals(void);
+
 #ifndef CONFIG_NEED_MULTIPLE_NODES      /* Don't use mapnrs, do it properly */
 extern unsigned long max_mapnr;
 
@@ -1560,14 +1562,24 @@ static inline pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr,
         return ptep;
 }
 
+#ifdef __PAGETABLE_P4D_FOLDED
+static inline int __p4d_alloc(struct mm_struct *mm, pgd_t *pgd,
+                                                unsigned long address)
+{
+        return 0;
+}
+#else
+int __p4d_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
+#endif
+
 #ifdef __PAGETABLE_PUD_FOLDED
-static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
+static inline int __pud_alloc(struct mm_struct *mm, p4d_t *p4d,
                                                 unsigned long address)
 {
         return 0;
 }
 #else
-int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
+int __pud_alloc(struct mm_struct *mm, p4d_t *p4d, unsigned long address);
 #endif
 
 #if defined(__PAGETABLE_PMD_FOLDED) || !defined(CONFIG_MMU)
@@ -1619,11 +1631,22 @@ int __pte_alloc_kernel(pmd_t *pmd, unsigned long address);
  * Remove it when 4level-fixup.h has been removed.
  */
 #if defined(CONFIG_MMU) && !defined(__ARCH_HAS_4LEVEL_HACK)
-static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+
+#ifndef __ARCH_HAS_5LEVEL_HACK
+static inline p4d_t *p4d_alloc(struct mm_struct *mm, pgd_t *pgd,
+                unsigned long address)
+{
+        return (unlikely(pgd_none(*pgd)) && __p4d_alloc(mm, pgd, address)) ?
+                NULL : p4d_offset(pgd, address);
+}
+
+static inline pud_t *pud_alloc(struct mm_struct *mm, p4d_t *p4d,
+                unsigned long address)
 {
-        return (unlikely(pgd_none(*pgd)) && __pud_alloc(mm, pgd, address))?
-                NULL: pud_offset(pgd, address);
+        return (unlikely(p4d_none(*p4d)) && __pud_alloc(mm, p4d, address)) ?
+                NULL : pud_offset(p4d, address);
 }
+#endif /* !__ARCH_HAS_5LEVEL_HACK */
 
 static inline pmd_t *pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
 {
@@ -2385,7 +2408,8 @@ void sparse_mem_maps_populate_node(struct page **map_map,
 
 struct page *sparse_mem_map_populate(unsigned long pnum, int nid);
 pgd_t *vmemmap_pgd_populate(unsigned long addr, int node);
-pud_t *vmemmap_pud_populate(pgd_t *pgd, unsigned long addr, int node);
+p4d_t *vmemmap_p4d_populate(pgd_t *pgd, unsigned long addr, int node);
+pud_t *vmemmap_pud_populate(p4d_t *p4d, unsigned long addr, int node);
 pmd_t *vmemmap_pmd_populate(pud_t *pud, unsigned long addr, int node);
 pte_t *vmemmap_pte_populate(pmd_t *pmd, unsigned long addr, int node);
 void *vmemmap_alloc_block(unsigned long size, int node);
diff --git a/include/linux/net.h b/include/linux/net.h
index cd0c8bd0a1de..0620f5e18c96 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -146,7 +146,7 @@ struct proto_ops {
         int             (*socketpair)(struct socket *sock1,
                                       struct socket *sock2);
         int             (*accept)    (struct socket *sock,
-                                      struct socket *newsock, int flags);
+                                      struct socket *newsock, int flags, bool kern);
         int             (*getname)   (struct socket *sock,
                                       struct sockaddr *addr,
                                       int *sockaddr_len, int peer);
diff --git a/include/linux/omap-gpmc.h b/include/linux/omap-gpmc.h
index 35d0fd7a4948..fd0de00c0d77 100644
--- a/include/linux/omap-gpmc.h
+++ b/include/linux/omap-gpmc.h
@@ -76,22 +76,12 @@ struct gpmc_timings;
 struct omap_nand_platform_data;
 struct omap_onenand_platform_data;
 
-#if IS_ENABLED(CONFIG_MTD_NAND_OMAP2)
-extern int gpmc_nand_init(struct omap_nand_platform_data *d,
-                          struct gpmc_timings *gpmc_t);
-#else
-static inline int gpmc_nand_init(struct omap_nand_platform_data *d,
-                                 struct gpmc_timings *gpmc_t)
-{
-        return 0;
-}
-#endif
-
 #if IS_ENABLED(CONFIG_MTD_ONENAND_OMAP2)
-extern void gpmc_onenand_init(struct omap_onenand_platform_data *d);
+extern int gpmc_onenand_init(struct omap_onenand_platform_data *d);
 #else
 #define board_onenand_data      NULL
-static inline void gpmc_onenand_init(struct omap_onenand_platform_data *d)
+static inline int gpmc_onenand_init(struct omap_onenand_platform_data *d)
 {
+        return 0;
 }
 #endif
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 772476028a65..43a774873aa9 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -837,6 +837,10 @@ int genphy_read_status(struct phy_device *phydev);
 int genphy_suspend(struct phy_device *phydev);
 int genphy_resume(struct phy_device *phydev);
 int genphy_soft_reset(struct phy_device *phydev);
+static inline int genphy_no_soft_reset(struct phy_device *phydev)
+{
+        return 0;
+}
 void phy_driver_unregister(struct phy_driver *drv);
 void phy_drivers_unregister(struct phy_driver *drv, int n);
 int phy_driver_register(struct phy_driver *new_driver, struct module *owner);
diff --git a/include/linux/purgatory.h b/include/linux/purgatory.h
new file mode 100644
index 000000000000..d60d4e278609
--- /dev/null
+++ b/include/linux/purgatory.h
@@ -0,0 +1,23 @@
+#ifndef _LINUX_PURGATORY_H
+#define _LINUX_PURGATORY_H
+
+#include <linux/types.h>
+#include <crypto/sha.h>
+#include <uapi/linux/kexec.h>
+
+struct kexec_sha_region {
+        unsigned long start;
+        unsigned long len;
+};
+
+/*
+ * These forward declarations serve two purposes:
+ *
+ * 1) Make sparse happy when checking arch/purgatory
+ * 2) Document that these are required to be global so the symbol
+ *    lookup in kexec works
+ */
+extern struct kexec_sha_region purgatory_sha_regions[KEXEC_SEGMENT_MAX];
+extern u8 purgatory_sha256_digest[SHA256_DIGEST_SIZE];
+
+#endif
diff --git a/include/linux/random.h b/include/linux/random.h
index 7bd2403e4fef..ed5c3838780d 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -37,14 +37,26 @@ extern void get_random_bytes(void *buf, int nbytes);
 extern int add_random_ready_callback(struct random_ready_callback *rdy);
 extern void del_random_ready_callback(struct random_ready_callback *rdy);
 extern void get_random_bytes_arch(void *buf, int nbytes);
-extern int random_int_secret_init(void);
 
 #ifndef MODULE
 extern const struct file_operations random_fops, urandom_fops;
 #endif
 
-unsigned int get_random_int(void);
-unsigned long get_random_long(void);
+u32 get_random_u32(void);
+u64 get_random_u64(void);
+static inline unsigned int get_random_int(void)
+{
+        return get_random_u32();
+}
+static inline unsigned long get_random_long(void)
+{
+#if BITS_PER_LONG == 64
+        return get_random_u64();
+#else
+        return get_random_u32();
+#endif
+}
+
 unsigned long randomize_page(unsigned long start, unsigned long range);
 
 u32 prandom_u32(void);
diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
index 4ae95f7e8597..a23a33153180 100644
--- a/include/linux/rculist_nulls.h
+++ b/include/linux/rculist_nulls.h
@@ -156,5 +156,19 @@ static inline void hlist_nulls_add_tail_rcu(struct hlist_nulls_node *n,
                 ({ tpos = hlist_nulls_entry(pos, typeof(*tpos), member); 1; }); \
                 pos = rcu_dereference_raw(hlist_nulls_next_rcu(pos)))
 
+/**
+ * hlist_nulls_for_each_entry_safe -
+ *   iterate over list of given type safe against removal of list entry
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct hlist_nulls_node to use as a loop cursor.
+ * @head:       the head for your list.
+ * @member:     the name of the hlist_nulls_node within the struct.
+ */
+#define hlist_nulls_for_each_entry_safe(tpos, pos, head, member)                \
+        for (({barrier();}),                                                    \
+             pos = rcu_dereference_raw(hlist_nulls_first_rcu(head));            \
+                (!is_a_nulls(pos)) &&                                           \
+                ({ tpos = hlist_nulls_entry(pos, typeof(*tpos), member);        \
+                   pos = rcu_dereference_raw(hlist_nulls_next_rcu(pos)); 1; });)
 #endif
 #endif
diff --git a/include/linux/regulator/machine.h b/include/linux/regulator/machine.h
index ad3e5158e586..c9f795e9a2ee 100644
--- a/include/linux/regulator/machine.h
+++ b/include/linux/regulator/machine.h
@@ -65,7 +65,7 @@ struct regulator_state {
         int uV; /* suspend voltage */
         unsigned int mode; /* suspend regulator operating mode */
         int enabled; /* is regulator enabled in this suspend state */
-        int disabled; /* is the regulator disbled in this suspend state */
+        int disabled; /* is the regulator disabled in this suspend state */
 };
 
 /**
diff --git a/include/linux/reset.h b/include/linux/reset.h
index 86b4ed75359e..96fb139bdd08 100644
--- a/include/linux/reset.h
+++ b/include/linux/reset.h
@@ -31,31 +31,26 @@ static inline int device_reset_optional(struct device *dev)
 
 static inline int reset_control_reset(struct reset_control *rstc)
 {
-        WARN_ON(1);
         return 0;
 }
 
 static inline int reset_control_assert(struct reset_control *rstc)
 {
-        WARN_ON(1);
         return 0;
 }
 
 static inline int reset_control_deassert(struct reset_control *rstc)
 {
-        WARN_ON(1);
         return 0;
 }
 
 static inline int reset_control_status(struct reset_control *rstc)
 {
-        WARN_ON(1);
         return 0;
 }
 
 static inline void reset_control_put(struct reset_control *rstc)
 {
-        WARN_ON(1);
 }
 
 static inline int __must_check device_reset(struct device *dev)
@@ -74,14 +69,14 @@ static inline struct reset_control *__of_reset_control_get(
                                         const char *id, int index, bool shared,
                                         bool optional)
 {
-        return ERR_PTR(-ENOTSUPP);
+        return optional ? NULL : ERR_PTR(-ENOTSUPP);
 }
 
 static inline struct reset_control *__devm_reset_control_get(
                                         struct device *dev, const char *id,
                                         int index, bool shared, bool optional)
 {
-        return ERR_PTR(-ENOTSUPP);
+        return optional ? NULL : ERR_PTR(-ENOTSUPP);
 }
 
 #endif /* CONFIG_RESET_CONTROLLER */
diff --git a/include/linux/sched/clock.h b/include/linux/sched/clock.h
index 4a68c6791207..34fe92ce1ebd 100644
--- a/include/linux/sched/clock.h
+++ b/include/linux/sched/clock.h
@@ -54,15 +54,16 @@ static inline u64 local_clock(void)
 }
 #else
 extern void sched_clock_init_late(void);
-/*
- * Architectures can set this to 1 if they have specified
- * CONFIG_HAVE_UNSTABLE_SCHED_CLOCK in their arch Kconfig,
- * but then during bootup it turns out that sched_clock()
- * is reliable after all:
- */
 extern int sched_clock_stable(void);
 extern void clear_sched_clock_stable(void);
 
+/*
+ * When sched_clock_stable(), __sched_clock_offset provides the offset
+ * between local_clock() and sched_clock().
+ */
+extern u64 __sched_clock_offset;
+
+
 extern void sched_clock_tick(void);
 extern void sched_clock_idle_sleep_event(void);
 extern void sched_clock_idle_wakeup_event(u64 delta_ns);
diff --git a/include/linux/stat.h b/include/linux/stat.h
index c76e524fb34b..64b6b3aece21 100644
--- a/include/linux/stat.h
+++ b/include/linux/stat.h
@@ -26,6 +26,7 @@ struct kstat {
         unsigned int    nlink;
         uint32_t        blksize;        /* Preferred I/O size */
         u64             attributes;
+        u64             attributes_mask;
 #define KSTAT_ATTR_FS_IOC_FLAGS                         \
         (STATX_ATTR_COMPRESSED |                        \
          STATX_ATTR_IMMUTABLE |                         \
diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
index 1d0043dc34e4..de2a722fe3cf 100644
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -50,4 +50,10 @@
 /* device can't handle Link Power Management */
 #define USB_QUIRK_NO_LPM                        BIT(10)
 
+/*
+ * Device reports its bInterval as linear frames instead of the
+ * USB 2.0 calculation.
+ */
+#define USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL   BIT(11)
+
 #endif /* __LINUX_USB_QUIRKS_H */
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index be765234c0a2..32354b4b4b2b 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -72,7 +72,7 @@ struct ucounts {
         struct hlist_node node;
         struct user_namespace *ns;
         kuid_t uid;
-        atomic_t count;
+        int count;
         atomic_t ucount[UCOUNT_COUNTS];
 };
 
diff --git a/include/linux/userfaultfd_k.h b/include/linux/userfaultfd_k.h
index 0468548acebf..48a3483dccb1 100644
--- a/include/linux/userfaultfd_k.h
+++ b/include/linux/userfaultfd_k.h
@@ -61,8 +61,7 @@ extern void mremap_userfaultfd_complete(struct vm_userfaultfd_ctx *,
                                         unsigned long from, unsigned long to,
                                         unsigned long len);
 
-extern void userfaultfd_remove(struct vm_area_struct *vma,
-                               struct vm_area_struct **prev,
+extern bool userfaultfd_remove(struct vm_area_struct *vma,
                                unsigned long start,
                                unsigned long end);
 
@@ -72,8 +71,6 @@ extern int userfaultfd_unmap_prep(struct vm_area_struct *vma,
 extern void userfaultfd_unmap_complete(struct mm_struct *mm,
                                        struct list_head *uf);
 
-extern void userfaultfd_exit(struct mm_struct *mm);
-
 #else /* CONFIG_USERFAULTFD */
 
 /* mm helpers */
@@ -120,11 +117,11 @@ static inline void mremap_userfaultfd_complete(struct vm_userfaultfd_ctx *ctx,
 {
 }
 
-static inline void userfaultfd_remove(struct vm_area_struct *vma,
-                                      struct vm_area_struct **prev,
+static inline bool userfaultfd_remove(struct vm_area_struct *vma,
                                       unsigned long start,
                                       unsigned long end)
 {
+        return true;
 }
 
 static inline int userfaultfd_unmap_prep(struct vm_area_struct *vma,
@@ -139,10 +136,6 @@ static inline void userfaultfd_unmap_complete(struct mm_struct *mm,
 {
 }
 
-static inline void userfaultfd_exit(struct mm_struct *mm)
-{
-}
-
 #endif /* CONFIG_USERFAULTFD */
 
 #endif /* _LINUX_USERFAULTFD_K_H */
diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h
index 9638bfeb0d1f..584f9a647ad4 100644
--- a/include/linux/virtio_vsock.h
+++ b/include/linux/virtio_vsock.h
@@ -48,6 +48,8 @@ struct virtio_vsock_pkt {
         struct virtio_vsock_hdr hdr;
         struct work_struct work;
         struct list_head list;
+        /* socket refcnt not held, only use for cancellation */
+        struct vsock_sock *vsk;
         void *buf;
         u32 len;
         u32 off;
@@ -56,6 +58,7 @@ struct virtio_vsock_pkt {
 
 struct virtio_vsock_pkt_info {
         u32 remote_cid, remote_port;
+        struct vsock_sock *vsk;
         struct msghdr *msg;
         u32 pkt_len;
         u16 type;
diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h
index 6aa1b6cb5828..a80b7b59cf33 100644
--- a/include/linux/vm_event_item.h
+++ b/include/linux/vm_event_item.h
@@ -79,6 +79,9 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT,
                 THP_SPLIT_PAGE_FAILED,
                 THP_DEFERRED_SPLIT_PAGE,
                 THP_SPLIT_PMD,
+#ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
+                THP_SPLIT_PUD,
+#endif
                 THP_ZERO_PAGE_ALLOC,
                 THP_ZERO_PAGE_ALLOC_FAILED,
 #endif
diff --git a/include/linux/wait.h b/include/linux/wait.h
index aacb1282d19a..db076ca7f11d 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -620,30 +620,19 @@ do {									\
         __ret;                                                          \
 })
 
+extern int do_wait_intr(wait_queue_head_t *, wait_queue_t *);
+extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_t *);
 
-#define __wait_event_interruptible_locked(wq, condition, exclusive, irq) \
+#define __wait_event_interruptible_locked(wq, condition, exclusive, fn) \
 ({                                                                      \
-        int __ret = 0;                                                  \
+        int __ret;                                                      \
         DEFINE_WAIT(__wait);                                            \
         if (exclusive)                                                  \
                 __wait.flags |= WQ_FLAG_EXCLUSIVE;                      \
         do {                                                            \
-                if (likely(list_empty(&__wait.task_list)))              \
-                        __add_wait_queue_tail(&(wq), &__wait);          \
-                set_current_state(TASK_INTERRUPTIBLE);                  \
-                if (signal_pending(current)) {                          \
-                        __ret = -ERESTARTSYS;                           \
+                __ret = fn(&(wq), &__wait);                             \
+                if (__ret)                                              \
                         break;                                          \
-                }                                                       \
-                if (irq)                                                \
-                        spin_unlock_irq(&(wq).lock);                    \
-                else                                                    \
-                        spin_unlock(&(wq).lock);                        \
-                schedule();                                             \
-                if (irq)                                                \
-                        spin_lock_irq(&(wq).lock);                      \
-                else                                                    \
-                        spin_lock(&(wq).lock);                          \
         } while (!(condition));                                         \
         __remove_wait_queue(&(wq), &__wait);                            \
         __set_current_state(TASK_RUNNING);                              \
@@ -676,7 +665,7 @@ do {									\
  */
 #define wait_event_interruptible_locked(wq, condition)                  \
         ((condition)                                                    \
-         ? 0 : __wait_event_interruptible_locked(wq, condition, 0, 0))
+         ? 0 : __wait_event_interruptible_locked(wq, condition, 0, do_wait_intr))
 
 /**
  * wait_event_interruptible_locked_irq - sleep until a condition gets true
@@ -703,7 +692,7 @@ do {									\
  */
 #define wait_event_interruptible_locked_irq(wq, condition)              \
         ((condition)                                                    \
-         ? 0 : __wait_event_interruptible_locked(wq, condition, 0, 1))
+         ? 0 : __wait_event_interruptible_locked(wq, condition, 0, do_wait_intr_irq))
 
 /**
  * wait_event_interruptible_exclusive_locked - sleep exclusively until a condition gets true
@@ -734,7 +723,7 @@ do {									\
  */
 #define wait_event_interruptible_exclusive_locked(wq, condition)        \
         ((condition)                                                    \
-         ? 0 : __wait_event_interruptible_locked(wq, condition, 1, 0))
+         ? 0 : __wait_event_interruptible_locked(wq, condition, 1, do_wait_intr))
 
 /**
  * wait_event_interruptible_exclusive_locked_irq - sleep until a condition gets true
@@ -765,7 +754,7 @@ do {									\
  */
 #define wait_event_interruptible_exclusive_locked_irq(wq, condition)    \
         ((condition)                                                    \
-         ? 0 : __wait_event_interruptible_locked(wq, condition, 1, 1))
+         ? 0 : __wait_event_interruptible_locked(wq, condition, 1, do_wait_intr_irq))
 
 
 #define __wait_event_killable(wq, condition)                            \
diff --git a/include/media/vsp1.h b/include/media/vsp1.h
index 458b400373d4..38aac554dbba 100644
--- a/include/media/vsp1.h
+++ b/include/media/vsp1.h
@@ -20,8 +20,17 @@ struct device;
 
 int vsp1_du_init(struct device *dev);
 
-int vsp1_du_setup_lif(struct device *dev, unsigned int width,
-                      unsigned int height);
+/**
+ * struct vsp1_du_lif_config - VSP LIF configuration
+ * @width: output frame width
+ * @height: output frame height
+ */
+struct vsp1_du_lif_config {
+        unsigned int width;
+        unsigned int height;
+};
+
+int vsp1_du_setup_lif(struct device *dev, const struct vsp1_du_lif_config *cfg);
 
 struct vsp1_du_atomic_config {
         u32 pixelformat;
diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h
index f2758964ce6f..f32ed9ac181a 100644
--- a/include/net/af_vsock.h
+++ b/include/net/af_vsock.h
@@ -100,6 +100,9 @@ struct vsock_transport {
         void (*destruct)(struct vsock_sock *);
         void (*release)(struct vsock_sock *);
 
+        /* Cancel all pending packets sent on vsock. */
+        int (*cancel_pkt)(struct vsock_sock *vsk);
+
         /* Connections. */
         int (*connect)(struct vsock_sock *);
 
diff --git a/include/net/inet_common.h b/include/net/inet_common.h
index b7952d55b9c0..f39ae697347f 100644
--- a/include/net/inet_common.h
+++ b/include/net/inet_common.h
@@ -20,7 +20,8 @@ int __inet_stream_connect(struct socket *sock, struct sockaddr *uaddr,
                           int addr_len, int flags, int is_sendmsg);
 int inet_dgram_connect(struct socket *sock, struct sockaddr *uaddr,
                        int addr_len, int flags);
-int inet_accept(struct socket *sock, struct socket *newsock, int flags);
+int inet_accept(struct socket *sock, struct socket *newsock, int flags,
+                bool kern);
 int inet_sendmsg(struct socket *sock, struct msghdr *msg, size_t size);
 ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset,
                       size_t size, int flags);
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 826f198374f8..c7a577976bec 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -258,7 +258,7 @@ inet_csk_rto_backoff(const struct inet_connection_sock *icsk,
         return (unsigned long)min_t(u64, when, max_when);
 }
 
-struct sock *inet_csk_accept(struct sock *sk, int flags, int *err);
+struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern);
 
 int inet_csk_get_port(struct sock *sk, unsigned short snum);
 
diff --git a/include/net/irda/timer.h b/include/net/irda/timer.h
index cb2615ccf761..d784f242cf7b 100644
--- a/include/net/irda/timer.h
+++ b/include/net/irda/timer.h
@@ -59,7 +59,7 @@ struct lap_cb;
  *  Slot timer must never exceed 85 ms, and must always be at least 25 ms, 
  *  suggested to  75-85 msec by IrDA lite. This doesn't work with a lot of
  *  devices, and other stackes uses a lot more, so it's best we do it as well
- *  (Note : this is the default value and sysctl overides it - Jean II)
+ *  (Note : this is the default value and sysctl overrides it - Jean II)
  */
 #define SLOT_TIMEOUT            (90*HZ/1000)
 
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index f540f9ad2af4..19605878da47 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -244,7 +244,7 @@ extern s32 (*nf_ct_nat_offset)(const struct nf_conn *ct,
                                u32 seq);
 
 /* Fake conntrack entry for untracked connections */
-DECLARE_PER_CPU(struct nf_conn, nf_conntrack_untracked);
+DECLARE_PER_CPU_ALIGNED(struct nf_conn, nf_conntrack_untracked);
 static inline struct nf_conn *nf_ct_untracked_get(void)
 {
         return raw_cpu_ptr(&nf_conntrack_untracked);
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 2aa8a9d80fbe..0136028652bd 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -103,6 +103,35 @@ struct nft_regs {
         };
 };
 
+/* Store/load an u16 or u8 integer to/from the u32 data register.
+ *
+ * Note, when using concatenations, register allocation happens at 32-bit
+ * level. So for store instruction, pad the rest part with zero to avoid
+ * garbage values.
+ */
+
+static inline void nft_reg_store16(u32 *dreg, u16 val)
+{
+        *dreg = 0;
+        *(u16 *)dreg = val;
+}
+
+static inline void nft_reg_store8(u32 *dreg, u8 val)
+{
+        *dreg = 0;
+        *(u8 *)dreg = val;
+}
+
+static inline u16 nft_reg_load16(u32 *sreg)
+{
+        return *(u16 *)sreg;
+}
+
+static inline u8 nft_reg_load8(u32 *sreg)
+{
+        return *(u8 *)sreg;
+}
+
 static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
                                  unsigned int len)
 {
@@ -203,7 +232,6 @@ struct nft_set_elem {
 struct nft_set;
 struct nft_set_iter {
         u8              genmask;
-        bool            flush;
         unsigned int    count;
         unsigned int    skip;
         int             err;
diff --git a/include/net/netfilter/nf_tables_ipv6.h b/include/net/netfilter/nf_tables_ipv6.h
index d150b5066201..97983d1c05e4 100644
--- a/include/net/netfilter/nf_tables_ipv6.h
+++ b/include/net/netfilter/nf_tables_ipv6.h
@@ -9,12 +9,13 @@ nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
                      struct sk_buff *skb,
                      const struct nf_hook_state *state)
 {
+        unsigned int flags = IP6_FH_F_AUTH;
         int protohdr, thoff = 0;
         unsigned short frag_off;
 
         nft_set_pktinfo(pkt, skb, state);
 
-        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
+        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
         if (protohdr < 0) {
                 nft_set_pktinfo_proto_unspec(pkt, skb);
                 return;
@@ -32,6 +33,7 @@ __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
                                 const struct nf_hook_state *state)
 {
 #if IS_ENABLED(CONFIG_IPV6)
+        unsigned int flags = IP6_FH_F_AUTH;
         struct ipv6hdr *ip6h, _ip6h;
         unsigned int thoff = 0;
         unsigned short frag_off;
@@ -50,7 +52,7 @@ __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
         if (pkt_len + sizeof(*ip6h) > skb->len)
                 return -1;
 
-        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
+        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
         if (protohdr < 0)
                 return -1;
 
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index a244db5e5ff7..592decebac75 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -83,6 +83,7 @@ struct sctp_bind_addr;
 struct sctp_ulpq;
 struct sctp_ep_common;
 struct crypto_shash;
+struct sctp_stream;
 
 
 #include <net/sctp/tsnmap.h>
@@ -476,7 +477,8 @@ struct sctp_pf {
         int  (*send_verify) (struct sctp_sock *, union sctp_addr *);
         int  (*supported_addrs)(const struct sctp_sock *, __be16 *);
         struct sock *(*create_accept_sk) (struct sock *sk,
-                                          struct sctp_association *asoc);
+                                          struct sctp_association *asoc,
+                                          bool kern);
         int (*addr_to_user)(struct sctp_sock *sk, union sctp_addr *addr);
         void (*to_sk_saddr)(union sctp_addr *, struct sock *sk);
         void (*to_sk_daddr)(union sctp_addr *, struct sock *sk);
@@ -752,6 +754,8 @@ struct sctp_transport {
                 /* Is the Path MTU update pending on this tranport */
                 pmtu_pending:1,
 
+                dst_pending_confirm:1,  /* need to confirm neighbour */
+
                 /* Has this transport moved the ctsn since we last sacked */
                 sack_generation:1;
         u32 dst_cookie;
@@ -805,8 +809,6 @@ struct sctp_transport {
 
         __u32 burst_limited;    /* Holds old cwnd when max.burst is applied */
 
-        __u32 dst_pending_confirm;      /* need to confirm neighbour */
-
         /* Destination */
         struct dst_entry *dst;
         /* Source address. */
diff --git a/include/net/sock.h b/include/net/sock.h
index 5e5997654db6..03252d53975d 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -236,6 +236,7 @@ struct sock_common {
   *     @sk_shutdown: mask of %SEND_SHUTDOWN and/or %RCV_SHUTDOWN
   *     @sk_userlocks: %SO_SNDBUF and %SO_RCVBUF settings
   *     @sk_lock:       synchronizer
+  *     @sk_kern_sock: True if sock is using kernel lock classes
   *     @sk_rcvbuf: size of receive buffer in bytes
   *     @sk_wq: sock wait queue and async head
   *     @sk_rx_dst: receive input route used by early demux
@@ -430,7 +431,8 @@ struct sock {
 #endif
 
         kmemcheck_bitfield_begin(flags);
-        unsigned int            sk_padding : 2,
+        unsigned int            sk_padding : 1,
+                                sk_kern_sock : 1,
                                 sk_no_check_tx : 1,
                                 sk_no_check_rx : 1,
                                 sk_userlocks : 4,
@@ -1015,7 +1017,8 @@ struct proto {
                                         int addr_len);
         int                     (*disconnect)(struct sock *sk, int flags);
 
-        struct sock *           (*accept)(struct sock *sk, int flags, int *err);
+        struct sock *           (*accept)(struct sock *sk, int flags, int *err,
+                                          bool kern);
 
         int                     (*ioctl)(struct sock *sk, int cmd,
                                          unsigned long arg);
@@ -1573,7 +1576,7 @@ int sock_cmsg_send(struct sock *sk, struct msghdr *msg,
 int sock_no_bind(struct socket *, struct sockaddr *, int);
 int sock_no_connect(struct socket *, struct sockaddr *, int, int);
 int sock_no_socketpair(struct socket *, struct socket *);
-int sock_no_accept(struct socket *, struct socket *, int);
+int sock_no_accept(struct socket *, struct socket *, int, bool);
 int sock_no_getname(struct socket *, struct sockaddr *, int *, int);
 unsigned int sock_no_poll(struct file *, struct socket *,
                           struct poll_table_struct *);
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 0f1813c13687..99e4423eb2b8 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1863,6 +1863,9 @@ struct ib_port_immutable {
 };
 
 struct ib_device {
+        /* Do not access @dma_device directly from ULP nor from HW drivers. */
+        struct device                *dma_device;
+
         char                          name[IB_DEVICE_NAME_MAX];
 
         struct list_head              event_handler_list;
@@ -3007,7 +3010,7 @@ static inline int ib_req_ncomp_notif(struct ib_cq *cq, int wc_cnt)
  */
 static inline int ib_dma_mapping_error(struct ib_device *dev, u64 dma_addr)
 {
-        return dma_mapping_error(&dev->dev, dma_addr);
+        return dma_mapping_error(dev->dma_device, dma_addr);
 }
 
 /**
@@ -3021,7 +3024,7 @@ static inline u64 ib_dma_map_single(struct ib_device *dev,
                                     void *cpu_addr, size_t size,
                                     enum dma_data_direction direction)
 {
-        return dma_map_single(&dev->dev, cpu_addr, size, direction);
+        return dma_map_single(dev->dma_device, cpu_addr, size, direction);
 }
 
 /**
@@ -3035,7 +3038,7 @@ static inline void ib_dma_unmap_single(struct ib_device *dev,
                                        u64 addr, size_t size,
                                        enum dma_data_direction direction)
 {
-        dma_unmap_single(&dev->dev, addr, size, direction);
+        dma_unmap_single(dev->dma_device, addr, size, direction);
 }
 
 /**
@@ -3052,7 +3055,7 @@ static inline u64 ib_dma_map_page(struct ib_device *dev,
                                   size_t size,
                                          enum dma_data_direction direction)
 {
-        return dma_map_page(&dev->dev, page, offset, size, direction);
+        return dma_map_page(dev->dma_device, page, offset, size, direction);
 }
 
 /**
@@ -3066,7 +3069,7 @@ static inline void ib_dma_unmap_page(struct ib_device *dev,
                                      u64 addr, size_t size,
                                      enum dma_data_direction direction)
 {
-        dma_unmap_page(&dev->dev, addr, size, direction);
+        dma_unmap_page(dev->dma_device, addr, size, direction);
 }
 
 /**
@@ -3080,7 +3083,7 @@ static inline int ib_dma_map_sg(struct ib_device *dev,
                                 struct scatterlist *sg, int nents,
                                 enum dma_data_direction direction)
 {
-        return dma_map_sg(&dev->dev, sg, nents, direction);
+        return dma_map_sg(dev->dma_device, sg, nents, direction);
 }
 
 /**
@@ -3094,7 +3097,7 @@ static inline void ib_dma_unmap_sg(struct ib_device *dev,
                                    struct scatterlist *sg, int nents,
                                    enum dma_data_direction direction)
 {
-        dma_unmap_sg(&dev->dev, sg, nents, direction);
+        dma_unmap_sg(dev->dma_device, sg, nents, direction);
 }
 
 static inline int ib_dma_map_sg_attrs(struct ib_device *dev,
@@ -3102,7 +3105,8 @@ static inline int ib_dma_map_sg_attrs(struct ib_device *dev,
                                       enum dma_data_direction direction,
                                       unsigned long dma_attrs)
 {
-        return dma_map_sg_attrs(&dev->dev, sg, nents, direction, dma_attrs);
+        return dma_map_sg_attrs(dev->dma_device, sg, nents, direction,
+                                dma_attrs);
 }
 
 static inline void ib_dma_unmap_sg_attrs(struct ib_device *dev,
@@ -3110,7 +3114,7 @@ static inline void ib_dma_unmap_sg_attrs(struct ib_device *dev,
                                          enum dma_data_direction direction,
                                          unsigned long dma_attrs)
 {
-        dma_unmap_sg_attrs(&dev->dev, sg, nents, direction, dma_attrs);
+        dma_unmap_sg_attrs(dev->dma_device, sg, nents, direction, dma_attrs);
 }
 /**
  * ib_sg_dma_address - Return the DMA address from a scatter/gather entry
@@ -3152,7 +3156,7 @@ static inline void ib_dma_sync_single_for_cpu(struct ib_device *dev,
                                               size_t size,
                                               enum dma_data_direction dir)
 {
-        dma_sync_single_for_cpu(&dev->dev, addr, size, dir);
+        dma_sync_single_for_cpu(dev->dma_device, addr, size, dir);
 }
 
 /**
@@ -3167,7 +3171,7 @@ static inline void ib_dma_sync_single_for_device(struct ib_device *dev,
                                                  size_t size,
                                                  enum dma_data_direction dir)
 {
-        dma_sync_single_for_device(&dev->dev, addr, size, dir);
+        dma_sync_single_for_device(dev->dma_device, addr, size, dir);
 }
 
 /**
@@ -3182,7 +3186,7 @@ static inline void *ib_dma_alloc_coherent(struct ib_device *dev,
                                            dma_addr_t *dma_handle,
                                            gfp_t flag)
 {
-        return dma_alloc_coherent(&dev->dev, size, dma_handle, flag);
+        return dma_alloc_coherent(dev->dma_device, size, dma_handle, flag);
 }
 
 /**
@@ -3196,7 +3200,7 @@ static inline void ib_dma_free_coherent(struct ib_device *dev,
                                         size_t size, void *cpu_addr,
                                         dma_addr_t dma_handle)
 {
-        dma_free_coherent(&dev->dev, size, cpu_addr, dma_handle);
+        dma_free_coherent(dev->dma_device, size, cpu_addr, dma_handle);
 }
 
 /**
diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
index b0e275de6dec..583875ea136a 100644
--- a/include/scsi/libiscsi.h
+++ b/include/scsi/libiscsi.h
@@ -196,6 +196,7 @@ struct iscsi_conn {
         struct iscsi_task       *task;          /* xmit task in progress */
 
         /* xmit */
+        spinlock_t              taskqueuelock;  /* protects the next three lists */
         struct list_head        mgmtqueue;      /* mgmt (control) xmit queue */
         struct list_head        cmdqueue;       /* data-path cmd queue */
         struct list_head        requeue;        /* tasks needing another run */
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 6f22b39f1b0c..080c7ce9bae8 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -472,6 +472,10 @@ static inline int scsi_device_created(struct scsi_device *sdev)
                 sdev->sdev_state == SDEV_CREATED_BLOCK;
 }
 
+int scsi_internal_device_block(struct scsi_device *sdev, bool wait);
+int scsi_internal_device_unblock(struct scsi_device *sdev,
+                                 enum scsi_device_state new_state);
+
 /* accessor functions for the SCSI parameters */
 static inline int scsi_device_sync(struct scsi_device *sdev)
 {
diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
index b54b98dc2d4a..1b0f447ce850 100644
--- a/include/target/target_core_backend.h
+++ b/include/target/target_core_backend.h
@@ -4,7 +4,12 @@
 #include <linux/types.h>
 #include <target/target_core_base.h>
 
-#define TRANSPORT_FLAG_PASSTHROUGH              1
+#define TRANSPORT_FLAG_PASSTHROUGH              0x1
+/*
+ * ALUA commands, state checks and setup operations are handled by the
+ * backend module.
+ */
+#define TRANSPORT_FLAG_PASSTHROUGH_ALUA         0x2
 
 struct request_queue;
 struct scatterlist;
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 37c274e61acc..4b784b6e21c0 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -299,7 +299,7 @@ struct t10_alua_tg_pt_gp {
         struct list_head tg_pt_gp_lun_list;
         struct se_lun *tg_pt_gp_alua_lun;
         struct se_node_acl *tg_pt_gp_alua_nacl;
-        struct delayed_work tg_pt_gp_transition_work;
+        struct work_struct tg_pt_gp_transition_work;
         struct completion *tg_pt_gp_transition_complete;
 };
 
diff --git a/include/trace/events/syscalls.h b/include/trace/events/syscalls.h
index 14e49c798135..b35533b94277 100644
--- a/include/trace/events/syscalls.h
+++ b/include/trace/events/syscalls.h
@@ -1,5 +1,6 @@
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM raw_syscalls
+#undef TRACE_INCLUDE_FILE
 #define TRACE_INCLUDE_FILE syscalls
 
 #if !defined(_TRACE_EVENTS_SYSCALLS_H) || defined(TRACE_HEADER_MULTI_READ)
diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h
index 9b1462e38b82..a076cf1a3a23 100644
--- a/include/uapi/asm-generic/unistd.h
+++ b/include/uapi/asm-generic/unistd.h
@@ -730,9 +730,11 @@ __SYSCALL(__NR_pkey_mprotect, sys_pkey_mprotect)
 __SYSCALL(__NR_pkey_alloc,    sys_pkey_alloc)
 #define __NR_pkey_free 290
 __SYSCALL(__NR_pkey_free,     sys_pkey_free)
+#define __NR_statx 291
+__SYSCALL(__NR_statx,     sys_statx)
 
 #undef __NR_syscalls
-#define __NR_syscalls 291
+#define __NR_syscalls 292
 
 /*
  * All syscalls below here should go away really,
diff --git a/include/uapi/drm/omap_drm.h b/include/uapi/drm/omap_drm.h
index 407cb55df6ac..7fb97863c945 100644
--- a/include/uapi/drm/omap_drm.h
+++ b/include/uapi/drm/omap_drm.h
@@ -33,8 +33,8 @@ extern "C" {
 #define OMAP_PARAM_CHIPSET_ID   1       /* ie. 0x3430, 0x4430, etc */
 
 struct drm_omap_param {
-        uint64_t param;                 /* in */
-        uint64_t value;                 /* in (set_param), out (get_param) */
+        __u64 param;                    /* in */
+        __u64 value;                    /* in (set_param), out (get_param) */
 };
 
 #define OMAP_BO_SCANOUT         0x00000001      /* scanout capable (phys contiguous) */
@@ -53,18 +53,18 @@ struct drm_omap_param {
 #define OMAP_BO_TILED           (OMAP_BO_TILED_8 | OMAP_BO_TILED_16 | OMAP_BO_TILED_32)
 
 union omap_gem_size {
-        uint32_t bytes;         /* (for non-tiled formats) */
+        __u32 bytes;            /* (for non-tiled formats) */
         struct {
-                uint16_t width;
-                uint16_t height;
+                __u16 width;
+                __u16 height;
         } tiled;                /* (for tiled formats) */
 };
 
 struct drm_omap_gem_new {
         union omap_gem_size size;       /* in */
-        uint32_t flags;                 /* in */
-        uint32_t handle;                /* out */
-        uint32_t __pad;
+        __u32 flags;                    /* in */
+        __u32 handle;                   /* out */
+        __u32 __pad;
 };
 
 /* mask of operations: */
@@ -74,33 +74,33 @@ enum omap_gem_op {
 };
 
 struct drm_omap_gem_cpu_prep {
-        uint32_t handle;                /* buffer handle (in) */
-        uint32_t op;                    /* mask of omap_gem_op (in) */
+        __u32 handle;                   /* buffer handle (in) */
+        __u32 op;                       /* mask of omap_gem_op (in) */
 };
 
 struct drm_omap_gem_cpu_fini {
-        uint32_t handle;                /* buffer handle (in) */
-        uint32_t op;                    /* mask of omap_gem_op (in) */
+        __u32 handle;                   /* buffer handle (in) */
+        __u32 op;                       /* mask of omap_gem_op (in) */
         /* TODO maybe here we pass down info about what regions are touched
          * by sw so we can be clever about cache ops?  For now a placeholder,
          * set to zero and we just do full buffer flush..
          */
-        uint32_t nregions;
-        uint32_t __pad;
+        __u32 nregions;
+        __u32 __pad;
 };
 
 struct drm_omap_gem_info {
-        uint32_t handle;                /* buffer handle (in) */
-        uint32_t pad;
-        uint64_t offset;                /* mmap offset (out) */
+        __u32 handle;                   /* buffer handle (in) */
+        __u32 pad;
+        __u64 offset;                   /* mmap offset (out) */
         /* note: in case of tiled buffers, the user virtual size can be
          * different from the physical size (ie. how many pages are needed
          * to back the object) which is returned in DRM_IOCTL_GEM_OPEN..
          * This size here is the one that should be used if you want to
          * mmap() the buffer:
          */
-        uint32_t size;                  /* virtual size for mmap'ing (out) */
-        uint32_t __pad;
+        __u32 size;                     /* virtual size for mmap'ing (out) */
+        __u32 __pad;
 };
 
 #define DRM_OMAP_GET_PARAM              0x00
diff --git a/include/uapi/linux/btrfs.h b/include/uapi/linux/btrfs.h
index db4c253f8011..dcfc3a5a9cb1 100644
--- a/include/uapi/linux/btrfs.h
+++ b/include/uapi/linux/btrfs.h
@@ -713,33 +713,6 @@ enum btrfs_err_code {
         BTRFS_ERROR_DEV_ONLY_WRITABLE,
         BTRFS_ERROR_DEV_EXCL_RUN_IN_PROGRESS
 };
-/* An error code to error string mapping for the kernel
-*  error codes
-*/
-static inline char *btrfs_err_str(enum btrfs_err_code err_code)
-{
-        switch (err_code) {
-                case BTRFS_ERROR_DEV_RAID1_MIN_NOT_MET:
-                        return "unable to go below two devices on raid1";
-                case BTRFS_ERROR_DEV_RAID10_MIN_NOT_MET:
-                        return "unable to go below four devices on raid10";
-                case BTRFS_ERROR_DEV_RAID5_MIN_NOT_MET:
-                        return "unable to go below two devices on raid5";
-                case BTRFS_ERROR_DEV_RAID6_MIN_NOT_MET:
-                        return "unable to go below three devices on raid6";
-                case BTRFS_ERROR_DEV_TGT_REPLACE:
-                        return "unable to remove the dev_replace target dev";
-                case BTRFS_ERROR_DEV_MISSING_NOT_FOUND:
-                        return "no missing devices found to remove";
-                case BTRFS_ERROR_DEV_ONLY_WRITABLE:
-                        return "unable to remove the only writeable device";
-                case BTRFS_ERROR_DEV_EXCL_RUN_IN_PROGRESS:
-                        return "add/delete/balance/replace/resize operation "\
-                                "in progress";
-                default:
-                        return NULL;
-        }
-}
 
 #define BTRFS_IOC_SNAP_CREATE _IOW(BTRFS_IOCTL_MAGIC, 1, \
                                    struct btrfs_ioctl_vol_args)
diff --git a/include/uapi/linux/packet_diag.h b/include/uapi/linux/packet_diag.h
index d08c63f3dd6f..0c5d5dd61b6a 100644
--- a/include/uapi/linux/packet_diag.h
+++ b/include/uapi/linux/packet_diag.h
@@ -64,7 +64,7 @@ struct packet_diag_mclist {
         __u32   pdmc_count;
         __u16   pdmc_type;
         __u16   pdmc_alen;
-        __u8    pdmc_addr[MAX_ADDR_LEN];
+        __u8    pdmc_addr[32]; /* MAX_ADDR_LEN */
 };
 
 struct packet_diag_ring {
diff --git a/include/uapi/linux/stat.h b/include/uapi/linux/stat.h
index 51a6b86e3700..d538897b8e08 100644
--- a/include/uapi/linux/stat.h
+++ b/include/uapi/linux/stat.h
@@ -114,7 +114,7 @@ struct statx {
         __u64   stx_ino;        /* Inode number */
         __u64   stx_size;       /* File size */
         __u64   stx_blocks;     /* Number of 512-byte blocks allocated */
-        __u64   __spare1[1];
+        __u64   stx_attributes_mask; /* Mask to show what's supported in stx_attributes */
         /* 0x40 */
         struct statx_timestamp  stx_atime;      /* Last access time */
         struct statx_timestamp  stx_btime;      /* File creation time */
@@ -152,9 +152,10 @@ struct statx {
 #define STATX_BASIC_STATS       0x000007ffU     /* The stuff in the normal stat struct */
 #define STATX_BTIME             0x00000800U     /* Want/got stx_btime */
 #define STATX_ALL               0x00000fffU     /* All currently supported flags */
+#define STATX__RESERVED         0x80000000U     /* Reserved for future struct statx expansion */
 
 /*
- * Attributes to be found in stx_attributes
+ * Attributes to be found in stx_attributes and masked in stx_attributes_mask.
  *
  * These give information about the features or the state of a file that might
  * be of use to ordinary userspace programs such as GUIs or ls rather than
diff --git a/include/uapi/linux/userfaultfd.h b/include/uapi/linux/userfaultfd.h
index c055947c5c98..3b059530dac9 100644
--- a/include/uapi/linux/userfaultfd.h
+++ b/include/uapi/linux/userfaultfd.h
@@ -18,8 +18,7 @@
  * means the userland is reading).
  */
 #define UFFD_API ((__u64)0xAA)
-#define UFFD_API_FEATURES (UFFD_FEATURE_EVENT_EXIT |            \
-                           UFFD_FEATURE_EVENT_FORK |            \
+#define UFFD_API_FEATURES (UFFD_FEATURE_EVENT_FORK |            \
                            UFFD_FEATURE_EVENT_REMAP |           \
                            UFFD_FEATURE_EVENT_REMOVE |  \
                            UFFD_FEATURE_EVENT_UNMAP |           \
@@ -113,7 +112,6 @@ struct uffd_msg {
 #define UFFD_EVENT_REMAP        0x14
 #define UFFD_EVENT_REMOVE       0x15
 #define UFFD_EVENT_UNMAP        0x16
-#define UFFD_EVENT_EXIT         0x17
 
 /* flags for UFFD_EVENT_PAGEFAULT */
 #define UFFD_PAGEFAULT_FLAG_WRITE       (1<<0)  /* If this was a write fault */
@@ -163,7 +161,6 @@ struct uffdio_api {
 #define UFFD_FEATURE_MISSING_HUGETLBFS          (1<<4)
 #define UFFD_FEATURE_MISSING_SHMEM              (1<<5)
 #define UFFD_FEATURE_EVENT_UNMAP                (1<<6)
-#define UFFD_FEATURE_EVENT_EXIT                 (1<<7)
         __u64 features;
 
         __u64 ioctls;
diff --git a/include/uapi/rdma/mlx5-abi.h b/include/uapi/rdma/mlx5-abi.h
index da7cd62bace7..0b3d30837a9f 100644
--- a/include/uapi/rdma/mlx5-abi.h
+++ b/include/uapi/rdma/mlx5-abi.h
@@ -34,6 +34,7 @@
 #define MLX5_ABI_USER_H
 
 #include <linux/types.h>
+#include <linux/if_ether.h>     /* For ETH_ALEN. */
 
 enum {
         MLX5_QP_FLAG_SIGNATURE          = 1 << 0,
@@ -66,7 +67,7 @@ struct mlx5_ib_alloc_ucontext_req {
 };
 
 enum mlx5_lib_caps {
-        MLX5_LIB_CAP_4K_UAR     = (u64)1 << 0,
+        MLX5_LIB_CAP_4K_UAR     = (__u64)1 << 0,
 };
 
 struct mlx5_ib_alloc_ucontext_req_v2 {
diff --git a/include/video/exynos5433_decon.h b/include/video/exynos5433_decon.h
index ef8e2a8ad0af..6b083d327e98 100644
--- a/include/video/exynos5433_decon.h
+++ b/include/video/exynos5433_decon.h
@@ -46,6 +46,7 @@
 #define DECON_FRAMEFIFO_STATUS          0x0524
 #define DECON_CMU                       0x1404
 #define DECON_UPDATE                    0x1410
+#define DECON_CRFMID                    0x1414
 #define DECON_UPDATE_SCHEME             0x1438
 #define DECON_VIDCON1                   0x2000
 #define DECON_VIDCON2                   0x2004
@@ -126,6 +127,10 @@
 
 /* VIDINTCON0 */
 #define VIDINTCON0_FRAMEDONE            (1 << 17)
+#define VIDINTCON0_FRAMESEL_BP          (0 << 15)
+#define VIDINTCON0_FRAMESEL_VS          (1 << 15)
+#define VIDINTCON0_FRAMESEL_AC          (2 << 15)
+#define VIDINTCON0_FRAMESEL_FP          (3 << 15)
 #define VIDINTCON0_INTFRMEN             (1 << 12)
 #define VIDINTCON0_INTEN                (1 << 0)
 
@@ -142,6 +147,13 @@
 #define STANDALONE_UPDATE_F             (1 << 0)
 
 /* DECON_VIDCON1 */
+#define VIDCON1_LINECNT_MASK            (0x0fff << 16)
+#define VIDCON1_I80_ACTIVE              (1 << 15)
+#define VIDCON1_VSTATUS_MASK            (0x3 << 13)
+#define VIDCON1_VSTATUS_VS              (0 << 13)
+#define VIDCON1_VSTATUS_BP              (1 << 13)
+#define VIDCON1_VSTATUS_AC              (2 << 13)
+#define VIDCON1_VSTATUS_FP              (3 << 13)
 #define VIDCON1_VCLK_MASK               (0x3 << 9)
 #define VIDCON1_VCLK_RUN_VDEN_DISABLE   (0x3 << 9)
 #define VIDCON1_VCLK_HOLD               (0x0 << 9)
diff --git a/include/xen/swiotlb-xen.h b/include/xen/swiotlb-xen.h
index a0083be5d529..1f6d78f044b6 100644
--- a/include/xen/swiotlb-xen.h
+++ b/include/xen/swiotlb-xen.h
@@ -2,6 +2,7 @@
 #define __LINUX_SWIOTLB_XEN_H
 
 #include <linux/dma-direction.h>
+#include <linux/scatterlist.h>
 #include <linux/swiotlb.h>
 
 extern int xen_swiotlb_init(int verbose, bool early);
@@ -55,4 +56,14 @@ xen_swiotlb_dma_supported(struct device *hwdev, u64 mask);
 
 extern int
 xen_swiotlb_set_dma_mask(struct device *dev, u64 dma_mask);
+
+extern int
+xen_swiotlb_dma_mmap(struct device *dev, struct vm_area_struct *vma,
+                     void *cpu_addr, dma_addr_t dma_addr, size_t size,
+                     unsigned long attrs);
+
+extern int
+xen_swiotlb_get_sgtable(struct device *dev, struct sg_table *sgt,
+                        void *cpu_addr, dma_addr_t handle, size_t size,
+                        unsigned long attrs);
 #endif /* __LINUX_SWIOTLB_XEN_H */
diff --git a/init/main.c b/init/main.c
index eae2f15657c6..b0c11cbf5ddf 100644
--- a/init/main.c
+++ b/init/main.c
@@ -882,7 +882,6 @@ static void __init do_basic_setup(void)
         do_ctors();
         usermodehelper_enable();
         do_initcalls();
-        random_int_secret_init();
 }
 
 static void __init do_pre_smp_initcalls(void)
@@ -1023,6 +1022,8 @@ static noinline void __init kernel_init_freeable(void)
 
         workqueue_init();
 
+        init_mm_internals();
+
         do_pre_smp_initcalls();
         lockup_detector_init();
 
diff --git a/kernel/audit.c b/kernel/audit.c
index e794544f5e63..2f4964cfde0b 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -54,6 +54,10 @@
 #include <linux/kthread.h>
 #include <linux/kernel.h>
 #include <linux/syscalls.h>
+#include <linux/spinlock.h>
+#include <linux/rcupdate.h>
+#include <linux/mutex.h>
+#include <linux/gfp.h>
 
 #include <linux/audit.h>
 
@@ -90,13 +94,34 @@ static u32	audit_default;
 /* If auditing cannot proceed, audit_failure selects what happens. */
 static u32      audit_failure = AUDIT_FAIL_PRINTK;
 
-/*
- * If audit records are to be written to the netlink socket, audit_pid
- * contains the pid of the auditd process and audit_nlk_portid contains
- * the portid to use to send netlink messages to that process.
+/* private audit network namespace index */
+static unsigned int audit_net_id;
+
+/**
+ * struct audit_net - audit private network namespace data
+ * @sk: communication socket
+ */
+struct audit_net {
+        struct sock *sk;
+};
+
+/**
+ * struct auditd_connection - kernel/auditd connection state
+ * @pid: auditd PID
+ * @portid: netlink portid
+ * @net: the associated network namespace
+ * @lock: spinlock to protect write access
+ *
+ * Description:
+ * This struct is RCU protected; you must either hold the RCU lock for reading
+ * or the included spinlock for writing.
  */
-int             audit_pid;
-static __u32    audit_nlk_portid;
+static struct auditd_connection {
+        int pid;
+        u32 portid;
+        struct net *net;
+        spinlock_t lock;
+} auditd_conn;
 
 /* If audit_rate_limit is non-zero, limit the rate of sending audit records
  * to that number per second.  This prevents DoS attacks, but results in
@@ -123,10 +148,6 @@ u32		audit_sig_sid = 0;
 */
 static atomic_t audit_lost = ATOMIC_INIT(0);
 
-/* The netlink socket. */
-static struct sock *audit_sock;
-static unsigned int audit_net_id;
-
 /* Hash for inode-based rules */
 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
 
@@ -139,6 +160,7 @@ static LIST_HEAD(audit_freelist);
 
 /* queue msgs to send via kauditd_task */
 static struct sk_buff_head audit_queue;
+static void kauditd_hold_skb(struct sk_buff *skb);
 /* queue msgs due to temporary unicast send problems */
 static struct sk_buff_head audit_retry_queue;
 /* queue msgs waiting for new auditd connection */
@@ -192,6 +214,43 @@ struct audit_reply {
         struct sk_buff *skb;
 };
 
+/**
+ * auditd_test_task - Check to see if a given task is an audit daemon
+ * @task: the task to check
+ *
+ * Description:
+ * Return 1 if the task is a registered audit daemon, 0 otherwise.
+ */
+int auditd_test_task(const struct task_struct *task)
+{
+        int rc;
+
+        rcu_read_lock();
+        rc = (auditd_conn.pid && task->tgid == auditd_conn.pid ? 1 : 0);
+        rcu_read_unlock();
+
+        return rc;
+}
+
+/**
+ * audit_get_sk - Return the audit socket for the given network namespace
+ * @net: the destination network namespace
+ *
+ * Description:
+ * Returns the sock pointer if valid, NULL otherwise.  The caller must ensure
+ * that a reference is held for the network namespace while the sock is in use.
+ */
+static struct sock *audit_get_sk(const struct net *net)
+{
+        struct audit_net *aunet;
+
+        if (!net)
+                return NULL;
+
+        aunet = net_generic(net, audit_net_id);
+        return aunet->sk;
+}
+
 static void audit_set_portid(struct audit_buffer *ab, __u32 portid)
 {
         if (ab) {
@@ -210,9 +269,7 @@ void audit_panic(const char *message)
                         pr_err("%s\n", message);
                 break;
         case AUDIT_FAIL_PANIC:
-                /* test audit_pid since printk is always losey, why bother? */
-                if (audit_pid)
-                        panic("audit: %s\n", message);
+                panic("audit: %s\n", message);
                 break;
         }
 }
@@ -370,21 +427,87 @@ static int audit_set_failure(u32 state)
         return audit_do_config_change("audit_failure", &audit_failure, state);
 }
 
-/*
- * For one reason or another this nlh isn't getting delivered to the userspace
- * audit daemon, just send it to printk.
+/**
+ * auditd_set - Set/Reset the auditd connection state
+ * @pid: auditd PID
+ * @portid: auditd netlink portid
+ * @net: auditd network namespace pointer
+ *
+ * Description:
+ * This function will obtain and drop network namespace references as
+ * necessary.
+ */
+static void auditd_set(int pid, u32 portid, struct net *net)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&auditd_conn.lock, flags);
+        auditd_conn.pid = pid;
+        auditd_conn.portid = portid;
+        if (auditd_conn.net)
+                put_net(auditd_conn.net);
+        if (net)
+                auditd_conn.net = get_net(net);
+        else
+                auditd_conn.net = NULL;
+        spin_unlock_irqrestore(&auditd_conn.lock, flags);
+}
+
+/**
+ * auditd_reset - Disconnect the auditd connection
+ *
+ * Description:
+ * Break the auditd/kauditd connection and move all the queued records into the
+ * hold queue in case auditd reconnects.
+ */
+static void auditd_reset(void)
+{
+        struct sk_buff *skb;
+
+        /* if it isn't already broken, break the connection */
+        rcu_read_lock();
+        if (auditd_conn.pid)
+                auditd_set(0, 0, NULL);
+        rcu_read_unlock();
+
+        /* flush all of the main and retry queues to the hold queue */
+        while ((skb = skb_dequeue(&audit_retry_queue)))
+                kauditd_hold_skb(skb);
+        while ((skb = skb_dequeue(&audit_queue)))
+                kauditd_hold_skb(skb);
+}
+
+/**
+ * kauditd_print_skb - Print the audit record to the ring buffer
+ * @skb: audit record
+ *
+ * Whatever the reason, this packet may not make it to the auditd connection
+ * so write it via printk so the information isn't completely lost.
  */
 static void kauditd_printk_skb(struct sk_buff *skb)
 {
         struct nlmsghdr *nlh = nlmsg_hdr(skb);
         char *data = nlmsg_data(nlh);
 
-        if (nlh->nlmsg_type != AUDIT_EOE) {
-                if (printk_ratelimit())
-                        pr_notice("type=%d %s\n", nlh->nlmsg_type, data);
-                else
-                        audit_log_lost("printk limit exceeded");
-        }
+        if (nlh->nlmsg_type != AUDIT_EOE && printk_ratelimit())
+                pr_notice("type=%d %s\n", nlh->nlmsg_type, data);
+}
+
+/**
+ * kauditd_rehold_skb - Handle a audit record send failure in the hold queue
+ * @skb: audit record
+ *
+ * Description:
+ * This should only be used by the kauditd_thread when it fails to flush the
+ * hold queue.
+ */
+static void kauditd_rehold_skb(struct sk_buff *skb)
+{
+        /* put the record back in the queue at the same place */
+        skb_queue_head(&audit_hold_queue, skb);
+
+        /* fail the auditd connection */
+        auditd_reset();
 }
 
 /**
@@ -421,6 +544,9 @@ static void kauditd_hold_skb(struct sk_buff *skb)
         /* we have no other options - drop the message */
         audit_log_lost("kauditd hold queue overflow");
         kfree_skb(skb);
+
+        /* fail the auditd connection */
+        auditd_reset();
 }
 
 /**
@@ -441,51 +567,122 @@ static void kauditd_retry_skb(struct sk_buff *skb)
 }
 
 /**
- * auditd_reset - Disconnect the auditd connection
+ * auditd_send_unicast_skb - Send a record via unicast to auditd
+ * @skb: audit record
  *
  * Description:
- * Break the auditd/kauditd connection and move all the records in the retry
- * queue into the hold queue in case auditd reconnects.  The audit_cmd_mutex
- * must be held when calling this function.
+ * Send a skb to the audit daemon, returns positive/zero values on success and
+ * negative values on failure; in all cases the skb will be consumed by this
+ * function.  If the send results in -ECONNREFUSED the connection with auditd
+ * will be reset.  This function may sleep so callers should not hold any locks
+ * where this would cause a problem.
  */
-static void auditd_reset(void)
+static int auditd_send_unicast_skb(struct sk_buff *skb)
 {
-        struct sk_buff *skb;
-
-        /* break the connection */
-        if (audit_sock) {
-                sock_put(audit_sock);
-                audit_sock = NULL;
+        int rc;
+        u32 portid;
+        struct net *net;
+        struct sock *sk;
+
+        /* NOTE: we can't call netlink_unicast while in the RCU section so
+         *       take a reference to the network namespace and grab local
+         *       copies of the namespace, the sock, and the portid; the
+         *       namespace and sock aren't going to go away while we hold a
+         *       reference and if the portid does become invalid after the RCU
+         *       section netlink_unicast() should safely return an error */
+
+        rcu_read_lock();
+        if (!auditd_conn.pid) {
+                rcu_read_unlock();
+                rc = -ECONNREFUSED;
+                goto err;
         }
-        audit_pid = 0;
-        audit_nlk_portid = 0;
+        net = auditd_conn.net;
+        get_net(net);
+        sk = audit_get_sk(net);
+        portid = auditd_conn.portid;
+        rcu_read_unlock();
 
-        /* flush all of the retry queue to the hold queue */
-        while ((skb = skb_dequeue(&audit_retry_queue)))
-                kauditd_hold_skb(skb);
+        rc = netlink_unicast(sk, skb, portid, 0);
+        put_net(net);
+        if (rc < 0)
+                goto err;
+
+        return rc;
+
+err:
+        if (rc == -ECONNREFUSED)
+                auditd_reset();
+        return rc;
 }
 
 /**
- * kauditd_send_unicast_skb - Send a record via unicast to auditd
- * @skb: audit record
+ * kauditd_send_queue - Helper for kauditd_thread to flush skb queues
+ * @sk: the sending sock
+ * @portid: the netlink destination
+ * @queue: the skb queue to process
+ * @retry_limit: limit on number of netlink unicast failures
+ * @skb_hook: per-skb hook for additional processing
+ * @err_hook: hook called if the skb fails the netlink unicast send
+ *
+ * Description:
+ * Run through the given queue and attempt to send the audit records to auditd,
+ * returns zero on success, negative values on failure.  It is up to the caller
+ * to ensure that the @sk is valid for the duration of this function.
+ *
  */
-static int kauditd_send_unicast_skb(struct sk_buff *skb)
+static int kauditd_send_queue(struct sock *sk, u32 portid,
+                              struct sk_buff_head *queue,
+                              unsigned int retry_limit,
+                              void (*skb_hook)(struct sk_buff *skb),
+                              void (*err_hook)(struct sk_buff *skb))
 {
-        int rc;
+        int rc = 0;
+        struct sk_buff *skb;
+        static unsigned int failed = 0;
 
-        /* if we know nothing is connected, don't even try the netlink call */
-        if (!audit_pid)
-                return -ECONNREFUSED;
+        /* NOTE: kauditd_thread takes care of all our locking, we just use
+         *       the netlink info passed to us (e.g. sk and portid) */
+
+        while ((skb = skb_dequeue(queue))) {
+                /* call the skb_hook for each skb we touch */
+                if (skb_hook)
+                        (*skb_hook)(skb);
+
+                /* can we send to anyone via unicast? */
+                if (!sk) {
+                        if (err_hook)
+                                (*err_hook)(skb);
+                        continue;
+                }
 
-        /* get an extra skb reference in case we fail to send */
-        skb_get(skb);
-        rc = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
-        if (rc >= 0) {
-                consume_skb(skb);
-                rc = 0;
+                /* grab an extra skb reference in case of error */
+                skb_get(skb);
+                rc = netlink_unicast(sk, skb, portid, 0);
+                if (rc < 0) {
+                        /* fatal failure for our queue flush attempt? */
+                        if (++failed >= retry_limit ||
+                            rc == -ECONNREFUSED || rc == -EPERM) {
+                                /* yes - error processing for the queue */
+                                sk = NULL;
+                                if (err_hook)
+                                        (*err_hook)(skb);
+                                if (!skb_hook)
+                                        goto out;
+                                /* keep processing with the skb_hook */
+                                continue;
+                        } else
+                                /* no - requeue to preserve ordering */
+                                skb_queue_head(queue, skb);
+                } else {
+                        /* it worked - drop the extra reference and continue */
+                        consume_skb(skb);
+                        failed = 0;
+                }
         }
 
-        return rc;
+out:
+        return (rc >= 0 ? 0 : rc);
 }
 
 /*
@@ -493,16 +690,19 @@ static int kauditd_send_unicast_skb(struct sk_buff *skb)
  * @skb: audit record
  *
  * Description:
- * This function doesn't consume an skb as might be expected since it has to
- * copy it anyways.
+ * Write a multicast message to anyone listening in the initial network
+ * namespace.  This function doesn't consume an skb as might be expected since
+ * it has to copy it anyways.
  */
 static void kauditd_send_multicast_skb(struct sk_buff *skb)
 {
         struct sk_buff *copy;
-        struct audit_net *aunet = net_generic(&init_net, audit_net_id);
-        struct sock *sock = aunet->nlsk;
+        struct sock *sock = audit_get_sk(&init_net);
         struct nlmsghdr *nlh;
 
+        /* NOTE: we are not taking an additional reference for init_net since
+         *       we don't have to worry about it going away */
+
         if (!netlink_has_listeners(sock, AUDIT_NLGRP_READLOG))
                 return;
 
@@ -526,149 +726,75 @@ static void kauditd_send_multicast_skb(struct sk_buff *skb)
 }
 
 /**
- * kauditd_wake_condition - Return true when it is time to wake kauditd_thread
- *
- * Description:
- * This function is for use by the wait_event_freezable() call in
- * kauditd_thread().
+ * kauditd_thread - Worker thread to send audit records to userspace
+ * @dummy: unused
  */
-static int kauditd_wake_condition(void)
-{
-        static int pid_last = 0;
-        int rc;
-        int pid = audit_pid;
-
-        /* wake on new messages or a change in the connected auditd */
-        rc = skb_queue_len(&audit_queue) || (pid && pid != pid_last);
-        if (rc)
-                pid_last = pid;
-
-        return rc;
-}
-
 static int kauditd_thread(void *dummy)
 {
         int rc;
-        int auditd = 0;
-        int reschedule = 0;
-        struct sk_buff *skb;
-        struct nlmsghdr *nlh;
+        u32 portid = 0;
+        struct net *net = NULL;
+        struct sock *sk = NULL;
 
 #define UNICAST_RETRIES 5
-#define AUDITD_BAD(x,y) \
-        ((x) == -ECONNREFUSED || (x) == -EPERM || ++(y) >= UNICAST_RETRIES)
-
-        /* NOTE: we do invalidate the auditd connection flag on any sending
-         * errors, but we only "restore" the connection flag at specific places
-         * in the loop in order to help ensure proper ordering of audit
-         * records */
 
         set_freezable();
         while (!kthread_should_stop()) {
-                /* NOTE: possible area for future improvement is to look at
-                 *       the hold and retry queues, since only this thread
-                 *       has access to these queues we might be able to do
-                 *       our own queuing and skip some/all of the locking */
-
-                /* NOTE: it might be a fun experiment to split the hold and
-                 *       retry queue handling to another thread, but the
-                 *       synchronization issues and other overhead might kill
-                 *       any performance gains */
+                /* NOTE: see the lock comments in auditd_send_unicast_skb() */
+                rcu_read_lock();
+                if (!auditd_conn.pid) {
+                        rcu_read_unlock();
+                        goto main_queue;
+                }
+                net = auditd_conn.net;
+                get_net(net);
+                sk = audit_get_sk(net);
+                portid = auditd_conn.portid;
+                rcu_read_unlock();
 
                 /* attempt to flush the hold queue */
-                while (auditd && (skb = skb_dequeue(&audit_hold_queue))) {
-                        rc = kauditd_send_unicast_skb(skb);
-                        if (rc) {
-                                /* requeue to the same spot */
-                                skb_queue_head(&audit_hold_queue, skb);
-
-                                auditd = 0;
-                                if (AUDITD_BAD(rc, reschedule)) {
-                                        mutex_lock(&audit_cmd_mutex);
-                                        auditd_reset();
-                                        mutex_unlock(&audit_cmd_mutex);
-                                        reschedule = 0;
-                                }
-                        } else
-                                /* we were able to send successfully */
-                                reschedule = 0;
+                rc = kauditd_send_queue(sk, portid,
+                                        &audit_hold_queue, UNICAST_RETRIES,
+                                        NULL, kauditd_rehold_skb);
+                if (rc < 0) {
+                        sk = NULL;
+                        goto main_queue;
                 }
 
                 /* attempt to flush the retry queue */
-                while (auditd && (skb = skb_dequeue(&audit_retry_queue))) {
-                        rc = kauditd_send_unicast_skb(skb);
-                        if (rc) {
-                                auditd = 0;
-                                if (AUDITD_BAD(rc, reschedule)) {
-                                        kauditd_hold_skb(skb);
-                                        mutex_lock(&audit_cmd_mutex);
-                                        auditd_reset();
-                                        mutex_unlock(&audit_cmd_mutex);
-                                        reschedule = 0;
-                                } else
-                                        /* temporary problem (we hope), queue
-                                         * to the same spot and retry */
-                                        skb_queue_head(&audit_retry_queue, skb);
-                        } else
-                                /* we were able to send successfully */
-                                reschedule = 0;
+                rc = kauditd_send_queue(sk, portid,
+                                        &audit_retry_queue, UNICAST_RETRIES,
+                                        NULL, kauditd_hold_skb);
+                if (rc < 0) {
+                        sk = NULL;
+                        goto main_queue;
                 }
 
-                /* standard queue processing, try to be as quick as possible */
-quick_loop:
-                skb = skb_dequeue(&audit_queue);
-                if (skb) {
-                        /* setup the netlink header, see the comments in
-                         * kauditd_send_multicast_skb() for length quirks */
-                        nlh = nlmsg_hdr(skb);
-                        nlh->nlmsg_len = skb->len - NLMSG_HDRLEN;
-
-                        /* attempt to send to any multicast listeners */
-                        kauditd_send_multicast_skb(skb);
-
-                        /* attempt to send to auditd, queue on failure */
-                        if (auditd) {
-                                rc = kauditd_send_unicast_skb(skb);
-                                if (rc) {
-                                        auditd = 0;
-                                        if (AUDITD_BAD(rc, reschedule)) {
-                                                mutex_lock(&audit_cmd_mutex);
-                                                auditd_reset();
-                                                mutex_unlock(&audit_cmd_mutex);
-                                                reschedule = 0;
-                                        }
-
-                                        /* move to the retry queue */
-                                        kauditd_retry_skb(skb);
-                                } else
-                                        /* everything is working so go fast! */
-                                        goto quick_loop;
-                        } else if (reschedule)
-                                /* we are currently having problems, move to
-                                 * the retry queue */
-                                kauditd_retry_skb(skb);
-                        else
-                                /* dump the message via printk and hold it */
-                                kauditd_hold_skb(skb);
-                } else {
-                        /* we have flushed the backlog so wake everyone */
-                        wake_up(&audit_backlog_wait);
-
-                        /* if everything is okay with auditd (if present), go
-                         * to sleep until there is something new in the queue
-                         * or we have a change in the connected auditd;
-                         * otherwise simply reschedule to give things a chance
-                         * to recover */
-                        if (reschedule) {
-                                set_current_state(TASK_INTERRUPTIBLE);
-                                schedule();
-                        } else
-                                wait_event_freezable(kauditd_wait,
-                                                     kauditd_wake_condition());
-
-                        /* update the auditd connection status */
-                        auditd = (audit_pid ? 1 : 0);
+main_queue:
+                /* process the main queue - do the multicast send and attempt
+                 * unicast, dump failed record sends to the retry queue; if
+                 * sk == NULL due to previous failures we will just do the
+                 * multicast send and move the record to the retry queue */
+                kauditd_send_queue(sk, portid, &audit_queue, 1,
+                                   kauditd_send_multicast_skb,
+                                   kauditd_retry_skb);
+
+                /* drop our netns reference, no auditd sends past this line */
+                if (net) {
+                        put_net(net);
+                        net = NULL;
                 }
+                sk = NULL;
+
+                /* we have processed all the queues so wake everyone */
+                wake_up(&audit_backlog_wait);
+
+                /* NOTE: we want to wake up if there is anything on the queue,
+                 *       regardless of if an auditd is connected, as we need to
+                 *       do the multicast send and rotate records from the
+                 *       main queue to the retry/hold queues */
+                wait_event_freezable(kauditd_wait,
+                                     (skb_queue_len(&audit_queue) ? 1 : 0));
         }
 
         return 0;
@@ -678,17 +804,16 @@ int audit_send_list(void *_dest)
 {
         struct audit_netlink_list *dest = _dest;
         struct sk_buff *skb;
-        struct net *net = dest->net;
-        struct audit_net *aunet = net_generic(net, audit_net_id);
+        struct sock *sk = audit_get_sk(dest->net);
 
         /* wait for parent to finish and send an ACK */
         mutex_lock(&audit_cmd_mutex);
         mutex_unlock(&audit_cmd_mutex);
 
         while ((skb = __skb_dequeue(&dest->q)) != NULL)
-                netlink_unicast(aunet->nlsk, skb, dest->portid, 0);
+                netlink_unicast(sk, skb, dest->portid, 0);
 
-        put_net(net);
+        put_net(dest->net);
         kfree(dest);
 
         return 0;
@@ -722,16 +847,15 @@ out_kfree_skb:
 static int audit_send_reply_thread(void *arg)
 {
         struct audit_reply *reply = (struct audit_reply *)arg;
-        struct net *net = reply->net;
-        struct audit_net *aunet = net_generic(net, audit_net_id);
+        struct sock *sk = audit_get_sk(reply->net);
 
         mutex_lock(&audit_cmd_mutex);
         mutex_unlock(&audit_cmd_mutex);
 
         /* Ignore failure. It'll only happen if the sender goes away,
            because our timeout is set to infinite. */
-        netlink_unicast(aunet->nlsk , reply->skb, reply->portid, 0);
-        put_net(net);
+        netlink_unicast(sk, reply->skb, reply->portid, 0);
+        put_net(reply->net);
         kfree(reply);
         return 0;
 }
@@ -949,12 +1073,12 @@ static int audit_set_feature(struct sk_buff *skb)
 
 static int audit_replace(pid_t pid)
 {
-        struct sk_buff *skb = audit_make_reply(0, 0, AUDIT_REPLACE, 0, 0,
-                                               &pid, sizeof(pid));
+        struct sk_buff *skb;
 
+        skb = audit_make_reply(0, 0, AUDIT_REPLACE, 0, 0, &pid, sizeof(pid));
         if (!skb)
                 return -ENOMEM;
-        return netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
+        return auditd_send_unicast_skb(skb);
 }
 
 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
@@ -981,7 +1105,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 memset(&s, 0, sizeof(s));
                 s.enabled               = audit_enabled;
                 s.failure               = audit_failure;
-                s.pid                   = audit_pid;
+                rcu_read_lock();
+                s.pid                   = auditd_conn.pid;
+                rcu_read_unlock();
                 s.rate_limit            = audit_rate_limit;
                 s.backlog_limit         = audit_backlog_limit;
                 s.lost                  = atomic_read(&audit_lost);
@@ -1014,30 +1140,44 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                          *       from the initial pid namespace, but something
                          *       to keep in mind if this changes */
                         int new_pid = s.pid;
+                        pid_t auditd_pid;
                         pid_t requesting_pid = task_tgid_vnr(current);
 
-                        if ((!new_pid) && (requesting_pid != audit_pid)) {
-                                audit_log_config_change("audit_pid", new_pid, audit_pid, 0);
+                        /* test the auditd connection */
+                        audit_replace(requesting_pid);
+
+                        rcu_read_lock();
+                        auditd_pid = auditd_conn.pid;
+                        /* only the current auditd can unregister itself */
+                        if ((!new_pid) && (requesting_pid != auditd_pid)) {
+                                rcu_read_unlock();
+                                audit_log_config_change("audit_pid", new_pid,
+                                                        auditd_pid, 0);
                                 return -EACCES;
                         }
-                        if (audit_pid && new_pid &&
-                            audit_replace(requesting_pid) != -ECONNREFUSED) {
-                                audit_log_config_change("audit_pid", new_pid, audit_pid, 0);
+                        /* replacing a healthy auditd is not allowed */
+                        if (auditd_pid && new_pid) {
+                                rcu_read_unlock();
+                                audit_log_config_change("audit_pid", new_pid,
+                                                        auditd_pid, 0);
                                 return -EEXIST;
                         }
+                        rcu_read_unlock();
+
                         if (audit_enabled != AUDIT_OFF)
-                                audit_log_config_change("audit_pid", new_pid, audit_pid, 1);
+                                audit_log_config_change("audit_pid", new_pid,
+                                                        auditd_pid, 1);
+
                         if (new_pid) {
-                                if (audit_sock)
-                                        sock_put(audit_sock);
-                                audit_pid = new_pid;
-                                audit_nlk_portid = NETLINK_CB(skb).portid;
-                                sock_hold(skb->sk);
-                                audit_sock = skb->sk;
-                        } else {
+                                /* register a new auditd connection */
+                                auditd_set(new_pid,
+                                           NETLINK_CB(skb).portid,
+                                           sock_net(NETLINK_CB(skb).sk));
+                                /* try to process any backlog */
+                                wake_up_interruptible(&kauditd_wait);
+                        } else
+                                /* unregister the auditd connection */
                                 auditd_reset();
-                        }
-                        wake_up_interruptible(&kauditd_wait);
                 }
                 if (s.mask & AUDIT_STATUS_RATE_LIMIT) {
                         err = audit_set_rate_limit(s.rate_limit);
@@ -1090,7 +1230,6 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                 if (err)
                                         break;
                         }
-                        mutex_unlock(&audit_cmd_mutex);
                         audit_log_common_recv_msg(&ab, msg_type);
                         if (msg_type != AUDIT_USER_TTY)
                                 audit_log_format(ab, " msg='%.*s'",
@@ -1108,7 +1247,6 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                         }
                         audit_set_portid(ab, NETLINK_CB(skb).portid);
                         audit_log_end(ab);
-                        mutex_lock(&audit_cmd_mutex);
                 }
                 break;
         case AUDIT_ADD_RULE:
@@ -1298,26 +1436,26 @@ static int __net_init audit_net_init(struct net *net)
 
         struct audit_net *aunet = net_generic(net, audit_net_id);
 
-        aunet->nlsk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg);
-        if (aunet->nlsk == NULL) {
+        aunet->sk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg);
+        if (aunet->sk == NULL) {
                 audit_panic("cannot initialize netlink socket in namespace");
                 return -ENOMEM;
         }
-        aunet->nlsk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
+        aunet->sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
+
         return 0;
 }
 
 static void __net_exit audit_net_exit(struct net *net)
 {
         struct audit_net *aunet = net_generic(net, audit_net_id);
-        struct sock *sock = aunet->nlsk;
-        mutex_lock(&audit_cmd_mutex);
-        if (sock == audit_sock)
+
+        rcu_read_lock();
+        if (net == auditd_conn.net)
                 auditd_reset();
-        mutex_unlock(&audit_cmd_mutex);
+        rcu_read_unlock();
 
-        netlink_kernel_release(sock);
-        aunet->nlsk = NULL;
+        netlink_kernel_release(aunet->sk);
 }
 
 static struct pernet_operations audit_net_ops __net_initdata = {
@@ -1335,20 +1473,24 @@ static int __init audit_init(void)
         if (audit_initialized == AUDIT_DISABLED)
                 return 0;
 
-        pr_info("initializing netlink subsys (%s)\n",
-                audit_default ? "enabled" : "disabled");
-        register_pernet_subsys(&audit_net_ops);
+        memset(&auditd_conn, 0, sizeof(auditd_conn));
+        spin_lock_init(&auditd_conn.lock);
 
         skb_queue_head_init(&audit_queue);
         skb_queue_head_init(&audit_retry_queue);
         skb_queue_head_init(&audit_hold_queue);
-        audit_initialized = AUDIT_INITIALIZED;
-        audit_enabled = audit_default;
-        audit_ever_enabled |= !!audit_default;
 
         for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
                 INIT_LIST_HEAD(&audit_inode_hash[i]);
 
+        pr_info("initializing netlink subsys (%s)\n",
+                audit_default ? "enabled" : "disabled");
+        register_pernet_subsys(&audit_net_ops);
+
+        audit_initialized = AUDIT_INITIALIZED;
+        audit_enabled = audit_default;
+        audit_ever_enabled |= !!audit_default;
+
         kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
         if (IS_ERR(kauditd_task)) {
                 int err = PTR_ERR(kauditd_task);
@@ -1519,20 +1661,16 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
         if (unlikely(!audit_filter(type, AUDIT_FILTER_TYPE)))
                 return NULL;
 
-        /* don't ever fail/sleep on these two conditions:
+        /* NOTE: don't ever fail/sleep on these two conditions:
          * 1. auditd generated record - since we need auditd to drain the
          *    queue; also, when we are checking for auditd, compare PIDs using
          *    task_tgid_vnr() since auditd_pid is set in audit_receive_msg()
          *    using a PID anchored in the caller's namespace
-         * 2. audit command message - record types 1000 through 1099 inclusive
-         *    are command messages/records used to manage the kernel subsystem
-         *    and the audit userspace, blocking on these messages could cause
-         *    problems under load so don't do it (note: not all of these
-         *    command types are valid as record types, but it is quicker to
-         *    just check two ints than a series of ints in a if/switch stmt) */
-        if (!((audit_pid && audit_pid == task_tgid_vnr(current)) ||
-              (type >= 1000 && type <= 1099))) {
-                long sleep_time = audit_backlog_wait_time;
+         * 2. generator holding the audit_cmd_mutex - we don't want to block
+         *    while holding the mutex */
+        if (!(auditd_test_task(current) ||
+              (current == __mutex_owner(&audit_cmd_mutex)))) {
+                long stime = audit_backlog_wait_time;
 
                 while (audit_backlog_limit &&
                        (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
@@ -1541,14 +1679,13 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
 
                         /* sleep if we are allowed and we haven't exhausted our
                          * backlog wait limit */
-                        if ((gfp_mask & __GFP_DIRECT_RECLAIM) &&
-                            (sleep_time > 0)) {
+                        if (gfpflags_allow_blocking(gfp_mask) && (stime > 0)) {
                                 DECLARE_WAITQUEUE(wait, current);
 
                                 add_wait_queue_exclusive(&audit_backlog_wait,
                                                          &wait);
                                 set_current_state(TASK_UNINTERRUPTIBLE);
-                                sleep_time = schedule_timeout(sleep_time);
+                                stime = schedule_timeout(stime);
                                 remove_wait_queue(&audit_backlog_wait, &wait);
                         } else {
                                 if (audit_rate_check() && printk_ratelimit())
@@ -2127,15 +2264,27 @@ out:
  */
 void audit_log_end(struct audit_buffer *ab)
 {
+        struct sk_buff *skb;
+        struct nlmsghdr *nlh;
+
         if (!ab)
                 return;
-        if (!audit_rate_check()) {
-                audit_log_lost("rate limit exceeded");
-        } else {
-                skb_queue_tail(&audit_queue, ab->skb);
-                wake_up_interruptible(&kauditd_wait);
+
+        if (audit_rate_check()) {
+                skb = ab->skb;
                 ab->skb = NULL;
-        }
+
+                /* setup the netlink header, see the comments in
+                 * kauditd_send_multicast_skb() for length quirks */
+                nlh = nlmsg_hdr(skb);
+                nlh->nlmsg_len = skb->len - NLMSG_HDRLEN;
+
+                /* queue the netlink packet and poke the kauditd thread */
+                skb_queue_tail(&audit_queue, skb);
+                wake_up_interruptible(&kauditd_wait);
+        } else
+                audit_log_lost("rate limit exceeded");
+
         audit_buffer_free(ab);
 }
 
diff --git a/kernel/audit.h b/kernel/audit.h
index ca579880303a..0f1cf6d1878a 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -218,7 +218,7 @@ extern void audit_log_name(struct audit_context *context,
                            struct audit_names *n, const struct path *path,
                            int record_num, int *call_panic);
 
-extern int audit_pid;
+extern int auditd_test_task(const struct task_struct *task);
 
 #define AUDIT_INODE_BUCKETS     32
 extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
@@ -250,10 +250,6 @@ struct audit_netlink_list {
 
 int audit_send_list(void *);
 
-struct audit_net {
-        struct sock *nlsk;
-};
-
 extern int selinux_audit_rule_update(void);
 
 extern struct mutex audit_filter_mutex;
@@ -340,8 +336,7 @@ extern int audit_filter(int msgtype, unsigned int listtype);
 extern int __audit_signal_info(int sig, struct task_struct *t);
 static inline int audit_signal_info(int sig, struct task_struct *t)
 {
-        if (unlikely((audit_pid && t->tgid == audit_pid) ||
-                     (audit_signals && !audit_dummy_context())))
+        if (auditd_test_task(t) || (audit_signals && !audit_dummy_context()))
                 return __audit_signal_info(sig, t);
         return 0;
 }
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index d6a8de5f8fa3..e59ffc7fc522 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -762,7 +762,7 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
         struct audit_entry *e;
         enum audit_state state;
 
-        if (audit_pid && tsk->tgid == audit_pid)
+        if (auditd_test_task(tsk))
                 return AUDIT_DISABLED;
 
         rcu_read_lock();
@@ -816,7 +816,7 @@ void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx)
 {
         struct audit_names *n;
 
-        if (audit_pid && tsk->tgid == audit_pid)
+        if (auditd_test_task(tsk))
                 return;
 
         rcu_read_lock();
@@ -2256,7 +2256,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
         struct audit_context *ctx = tsk->audit_context;
         kuid_t uid = current_uid(), t_uid = task_uid(t);
 
-        if (audit_pid && t->tgid == audit_pid) {
+        if (auditd_test_task(t)) {
                 if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1 || sig == SIGUSR2) {
                         audit_sig_pid = task_tgid_nr(tsk);
                         if (uid_valid(tsk->loginuid))
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 3ea87fb19a94..361a69dfe543 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -13,11 +13,12 @@
 #include <linux/bpf.h>
 #include <linux/jhash.h>
 #include <linux/filter.h>
+#include <linux/rculist_nulls.h>
 #include "percpu_freelist.h"
 #include "bpf_lru_list.h"
 
 struct bucket {
-        struct hlist_head head;
+        struct hlist_nulls_head head;
         raw_spinlock_t lock;
 };
 
@@ -29,28 +30,26 @@ struct bpf_htab {
                 struct pcpu_freelist freelist;
                 struct bpf_lru lru;
         };
-        void __percpu *extra_elems;
+        struct htab_elem *__percpu *extra_elems;
         atomic_t count; /* number of elements in this hashtable */
         u32 n_buckets;  /* number of hash buckets */
         u32 elem_size;  /* size of each element in bytes */
 };
 
-enum extra_elem_state {
-        HTAB_NOT_AN_EXTRA_ELEM = 0,
-        HTAB_EXTRA_ELEM_FREE,
-        HTAB_EXTRA_ELEM_USED
-};
-
 /* each htab element is struct htab_elem + key + value */
 struct htab_elem {
         union {
-                struct hlist_node hash_node;
-                struct bpf_htab *htab;
-                struct pcpu_freelist_node fnode;
+                struct hlist_nulls_node hash_node;
+                struct {
+                        void *padding;
+                        union {
+                                struct bpf_htab *htab;
+                                struct pcpu_freelist_node fnode;
+                        };
+                };
         };
         union {
                 struct rcu_head rcu;
-                enum extra_elem_state state;
                 struct bpf_lru_node lru_node;
         };
         u32 hash;
@@ -71,6 +70,11 @@ static bool htab_is_percpu(const struct bpf_htab *htab)
                 htab->map.map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH;
 }
 
+static bool htab_is_prealloc(const struct bpf_htab *htab)
+{
+        return !(htab->map.map_flags & BPF_F_NO_PREALLOC);
+}
+
 static inline void htab_elem_set_ptr(struct htab_elem *l, u32 key_size,
                                      void __percpu *pptr)
 {
@@ -122,17 +126,20 @@ static struct htab_elem *prealloc_lru_pop(struct bpf_htab *htab, void *key,
 
 static int prealloc_init(struct bpf_htab *htab)
 {
+        u32 num_entries = htab->map.max_entries;
         int err = -ENOMEM, i;
 
-        htab->elems = bpf_map_area_alloc(htab->elem_size *
-                                         htab->map.max_entries);
+        if (!htab_is_percpu(htab) && !htab_is_lru(htab))
+                num_entries += num_possible_cpus();
+
+        htab->elems = bpf_map_area_alloc(htab->elem_size * num_entries);
         if (!htab->elems)
                 return -ENOMEM;
 
         if (!htab_is_percpu(htab))
                 goto skip_percpu_elems;
 
-        for (i = 0; i < htab->map.max_entries; i++) {
+        for (i = 0; i < num_entries; i++) {
                 u32 size = round_up(htab->map.value_size, 8);
                 void __percpu *pptr;
 
@@ -160,10 +167,11 @@ skip_percpu_elems:
         if (htab_is_lru(htab))
                 bpf_lru_populate(&htab->lru, htab->elems,
                                  offsetof(struct htab_elem, lru_node),
-                                 htab->elem_size, htab->map.max_entries);
+                                 htab->elem_size, num_entries);
         else
-                pcpu_freelist_populate(&htab->freelist, htab->elems,
-                                       htab->elem_size, htab->map.max_entries);
+                pcpu_freelist_populate(&htab->freelist,
+                                       htab->elems + offsetof(struct htab_elem, fnode),
+                                       htab->elem_size, num_entries);
 
         return 0;
 
@@ -184,16 +192,22 @@ static void prealloc_destroy(struct bpf_htab *htab)
 
 static int alloc_extra_elems(struct bpf_htab *htab)
 {
-        void __percpu *pptr;
+        struct htab_elem *__percpu *pptr, *l_new;
+        struct pcpu_freelist_node *l;
         int cpu;
 
-        pptr = __alloc_percpu_gfp(htab->elem_size, 8, GFP_USER | __GFP_NOWARN);
+        pptr = __alloc_percpu_gfp(sizeof(struct htab_elem *), 8,
+                                  GFP_USER | __GFP_NOWARN);
         if (!pptr)
                 return -ENOMEM;
 
         for_each_possible_cpu(cpu) {
-                ((struct htab_elem *)per_cpu_ptr(pptr, cpu))->state =
-                        HTAB_EXTRA_ELEM_FREE;
+                l = pcpu_freelist_pop(&htab->freelist);
+                /* pop will succeed, since prealloc_init()
+                 * preallocated extra num_possible_cpus elements
+                 */
+                l_new = container_of(l, struct htab_elem, fnode);
+                *per_cpu_ptr(pptr, cpu) = l_new;
         }
         htab->extra_elems = pptr;
         return 0;
@@ -217,6 +231,11 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
         int err, i;
         u64 cost;
 
+        BUILD_BUG_ON(offsetof(struct htab_elem, htab) !=
+                     offsetof(struct htab_elem, hash_node.pprev));
+        BUILD_BUG_ON(offsetof(struct htab_elem, fnode.next) !=
+                     offsetof(struct htab_elem, hash_node.pprev));
+
         if (lru && !capable(CAP_SYS_ADMIN))
                 /* LRU implementation is much complicated than other
                  * maps.  Hence, limit to CAP_SYS_ADMIN for now.
@@ -326,29 +345,29 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
                 goto free_htab;
 
         for (i = 0; i < htab->n_buckets; i++) {
-                INIT_HLIST_HEAD(&htab->buckets[i].head);
+                INIT_HLIST_NULLS_HEAD(&htab->buckets[i].head, i);
                 raw_spin_lock_init(&htab->buckets[i].lock);
         }
 
-        if (!percpu && !lru) {
-                /* lru itself can remove the least used element, so
-                 * there is no need for an extra elem during map_update.
-                 */
-                err = alloc_extra_elems(htab);
-                if (err)
-                        goto free_buckets;
-        }
-
         if (prealloc) {
                 err = prealloc_init(htab);
                 if (err)
-                        goto free_extra_elems;
+                        goto free_buckets;
+
+                if (!percpu && !lru) {
+                        /* lru itself can remove the least used element, so
+                         * there is no need for an extra elem during map_update.
+                         */
+                        err = alloc_extra_elems(htab);
+                        if (err)
+                                goto free_prealloc;
+                }
         }
 
         return &htab->map;
 
-free_extra_elems:
-        free_percpu(htab->extra_elems);
+free_prealloc:
+        prealloc_destroy(htab);
 free_buckets:
         bpf_map_area_free(htab->buckets);
 free_htab:
@@ -366,20 +385,44 @@ static inline struct bucket *__select_bucket(struct bpf_htab *htab, u32 hash)
         return &htab->buckets[hash & (htab->n_buckets - 1)];
 }
 
-static inline struct hlist_head *select_bucket(struct bpf_htab *htab, u32 hash)
+static inline struct hlist_nulls_head *select_bucket(struct bpf_htab *htab, u32 hash)
 {
         return &__select_bucket(htab, hash)->head;
 }
 
-static struct htab_elem *lookup_elem_raw(struct hlist_head *head, u32 hash,
+/* this lookup function can only be called with bucket lock taken */
+static struct htab_elem *lookup_elem_raw(struct hlist_nulls_head *head, u32 hash,
                                          void *key, u32 key_size)
 {
+        struct hlist_nulls_node *n;
+        struct htab_elem *l;
+
+        hlist_nulls_for_each_entry_rcu(l, n, head, hash_node)
+                if (l->hash == hash && !memcmp(&l->key, key, key_size))
+                        return l;
+
+        return NULL;
+}
+
+/* can be called without bucket lock. it will repeat the loop in
+ * the unlikely event when elements moved from one bucket into another
+ * while link list is being walked
+ */
+static struct htab_elem *lookup_nulls_elem_raw(struct hlist_nulls_head *head,
+                                               u32 hash, void *key,
+                                               u32 key_size, u32 n_buckets)
+{
+        struct hlist_nulls_node *n;
         struct htab_elem *l;
 
-        hlist_for_each_entry_rcu(l, head, hash_node)
+again:
+        hlist_nulls_for_each_entry_rcu(l, n, head, hash_node)
                 if (l->hash == hash && !memcmp(&l->key, key, key_size))
                         return l;
 
+        if (unlikely(get_nulls_value(n) != (hash & (n_buckets - 1))))
+                goto again;
+
         return NULL;
 }
 
@@ -387,7 +430,7 @@ static struct htab_elem *lookup_elem_raw(struct hlist_head *head, u32 hash,
 static void *__htab_map_lookup_elem(struct bpf_map *map, void *key)
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         struct htab_elem *l;
         u32 hash, key_size;
 
@@ -400,7 +443,7 @@ static void *__htab_map_lookup_elem(struct bpf_map *map, void *key)
 
         head = select_bucket(htab, hash);
 
-        l = lookup_elem_raw(head, hash, key, key_size);
+        l = lookup_nulls_elem_raw(head, hash, key, key_size, htab->n_buckets);
 
         return l;
 }
@@ -433,8 +476,9 @@ static void *htab_lru_map_lookup_elem(struct bpf_map *map, void *key)
 static bool htab_lru_map_delete_node(void *arg, struct bpf_lru_node *node)
 {
         struct bpf_htab *htab = (struct bpf_htab *)arg;
-        struct htab_elem *l, *tgt_l;
-        struct hlist_head *head;
+        struct htab_elem *l = NULL, *tgt_l;
+        struct hlist_nulls_head *head;
+        struct hlist_nulls_node *n;
         unsigned long flags;
         struct bucket *b;
 
@@ -444,9 +488,9 @@ static bool htab_lru_map_delete_node(void *arg, struct bpf_lru_node *node)
 
         raw_spin_lock_irqsave(&b->lock, flags);
 
-        hlist_for_each_entry_rcu(l, head, hash_node)
+        hlist_nulls_for_each_entry_rcu(l, n, head, hash_node)
                 if (l == tgt_l) {
-                        hlist_del_rcu(&l->hash_node);
+                        hlist_nulls_del_rcu(&l->hash_node);
                         break;
                 }
 
@@ -459,7 +503,7 @@ static bool htab_lru_map_delete_node(void *arg, struct bpf_lru_node *node)
 static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         struct htab_elem *l, *next_l;
         u32 hash, key_size;
         int i;
@@ -473,7 +517,7 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
         head = select_bucket(htab, hash);
 
         /* lookup the key */
-        l = lookup_elem_raw(head, hash, key, key_size);
+        l = lookup_nulls_elem_raw(head, hash, key, key_size, htab->n_buckets);
 
         if (!l) {
                 i = 0;
@@ -481,7 +525,7 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
         }
 
         /* key was found, get next key in the same bucket */
-        next_l = hlist_entry_safe(rcu_dereference_raw(hlist_next_rcu(&l->hash_node)),
+        next_l = hlist_nulls_entry_safe(rcu_dereference_raw(hlist_nulls_next_rcu(&l->hash_node)),
                                   struct htab_elem, hash_node);
 
         if (next_l) {
@@ -500,7 +544,7 @@ find_first_elem:
                 head = select_bucket(htab, i);
 
                 /* pick first element in the bucket */
-                next_l = hlist_entry_safe(rcu_dereference_raw(hlist_first_rcu(head)),
+                next_l = hlist_nulls_entry_safe(rcu_dereference_raw(hlist_nulls_first_rcu(head)),
                                           struct htab_elem, hash_node);
                 if (next_l) {
                         /* if it's not empty, just return it */
@@ -538,12 +582,7 @@ static void htab_elem_free_rcu(struct rcu_head *head)
 
 static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
 {
-        if (l->state == HTAB_EXTRA_ELEM_USED) {
-                l->state = HTAB_EXTRA_ELEM_FREE;
-                return;
-        }
-
-        if (!(htab->map.map_flags & BPF_F_NO_PREALLOC)) {
+        if (htab_is_prealloc(htab)) {
                 pcpu_freelist_push(&htab->freelist, &l->fnode);
         } else {
                 atomic_dec(&htab->count);
@@ -573,43 +612,43 @@ static void pcpu_copy_value(struct bpf_htab *htab, void __percpu *pptr,
 static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
                                          void *value, u32 key_size, u32 hash,
                                          bool percpu, bool onallcpus,
-                                         bool old_elem_exists)
+                                         struct htab_elem *old_elem)
 {
         u32 size = htab->map.value_size;
-        bool prealloc = !(htab->map.map_flags & BPF_F_NO_PREALLOC);
-        struct htab_elem *l_new;
+        bool prealloc = htab_is_prealloc(htab);
+        struct htab_elem *l_new, **pl_new;
         void __percpu *pptr;
-        int err = 0;
 
         if (prealloc) {
-                l_new = (struct htab_elem *)pcpu_freelist_pop(&htab->freelist);
-                if (!l_new)
-                        err = -E2BIG;
-        } else {
-                if (atomic_inc_return(&htab->count) > htab->map.max_entries) {
-                        atomic_dec(&htab->count);
-                        err = -E2BIG;
+                if (old_elem) {
+                        /* if we're updating the existing element,
+                         * use per-cpu extra elems to avoid freelist_pop/push
+                         */
+                        pl_new = this_cpu_ptr(htab->extra_elems);
+                        l_new = *pl_new;
+                        *pl_new = old_elem;
                 } else {
-                        l_new = kmalloc(htab->elem_size,
-                                        GFP_ATOMIC | __GFP_NOWARN);
-                        if (!l_new)
-                                return ERR_PTR(-ENOMEM);
-                }
-        }
+                        struct pcpu_freelist_node *l;
 
-        if (err) {
-                if (!old_elem_exists)
-                        return ERR_PTR(err);
-
-                /* if we're updating the existing element and the hash table
-                 * is full, use per-cpu extra elems
-                 */
-                l_new = this_cpu_ptr(htab->extra_elems);
-                if (l_new->state != HTAB_EXTRA_ELEM_FREE)
-                        return ERR_PTR(-E2BIG);
-                l_new->state = HTAB_EXTRA_ELEM_USED;
+                        l = pcpu_freelist_pop(&htab->freelist);
+                        if (!l)
+                                return ERR_PTR(-E2BIG);
+                        l_new = container_of(l, struct htab_elem, fnode);
+                }
         } else {
-                l_new->state = HTAB_NOT_AN_EXTRA_ELEM;
+                if (atomic_inc_return(&htab->count) > htab->map.max_entries)
+                        if (!old_elem) {
+                                /* when map is full and update() is replacing
+                                 * old element, it's ok to allocate, since
+                                 * old element will be freed immediately.
+                                 * Otherwise return an error
+                                 */
+                                atomic_dec(&htab->count);
+                                return ERR_PTR(-E2BIG);
+                        }
+                l_new = kmalloc(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN);
+                if (!l_new)
+                        return ERR_PTR(-ENOMEM);
         }
 
         memcpy(l_new->key, key, key_size);
@@ -661,7 +700,7 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
         struct htab_elem *l_new = NULL, *l_old;
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         unsigned long flags;
         struct bucket *b;
         u32 key_size, hash;
@@ -690,7 +729,7 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
                 goto err;
 
         l_new = alloc_htab_elem(htab, key, value, key_size, hash, false, false,
-                                !!l_old);
+                                l_old);
         if (IS_ERR(l_new)) {
                 /* all pre-allocated elements are in use or memory exhausted */
                 ret = PTR_ERR(l_new);
@@ -700,10 +739,11 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
         /* add new element to the head of the list, so that
          * concurrent search will find it before old elem
          */
-        hlist_add_head_rcu(&l_new->hash_node, head);
+        hlist_nulls_add_head_rcu(&l_new->hash_node, head);
         if (l_old) {
-                hlist_del_rcu(&l_old->hash_node);
-                free_htab_elem(htab, l_old);
+                hlist_nulls_del_rcu(&l_old->hash_node);
+                if (!htab_is_prealloc(htab))
+                        free_htab_elem(htab, l_old);
         }
         ret = 0;
 err:
@@ -716,7 +756,7 @@ static int htab_lru_map_update_elem(struct bpf_map *map, void *key, void *value,
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
         struct htab_elem *l_new, *l_old = NULL;
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         unsigned long flags;
         struct bucket *b;
         u32 key_size, hash;
@@ -757,10 +797,10 @@ static int htab_lru_map_update_elem(struct bpf_map *map, void *key, void *value,
         /* add new element to the head of the list, so that
          * concurrent search will find it before old elem
          */
-        hlist_add_head_rcu(&l_new->hash_node, head);
+        hlist_nulls_add_head_rcu(&l_new->hash_node, head);
         if (l_old) {
                 bpf_lru_node_set_ref(&l_new->lru_node);
-                hlist_del_rcu(&l_old->hash_node);
+                hlist_nulls_del_rcu(&l_old->hash_node);
         }
         ret = 0;
 
@@ -781,7 +821,7 @@ static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key,
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
         struct htab_elem *l_new = NULL, *l_old;
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         unsigned long flags;
         struct bucket *b;
         u32 key_size, hash;
@@ -815,12 +855,12 @@ static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key,
                                 value, onallcpus);
         } else {
                 l_new = alloc_htab_elem(htab, key, value, key_size,
-                                        hash, true, onallcpus, false);
+                                        hash, true, onallcpus, NULL);
                 if (IS_ERR(l_new)) {
                         ret = PTR_ERR(l_new);
                         goto err;
                 }
-                hlist_add_head_rcu(&l_new->hash_node, head);
+                hlist_nulls_add_head_rcu(&l_new->hash_node, head);
         }
         ret = 0;
 err:
@@ -834,7 +874,7 @@ static int __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
         struct htab_elem *l_new = NULL, *l_old;
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         unsigned long flags;
         struct bucket *b;
         u32 key_size, hash;
@@ -882,7 +922,7 @@ static int __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
         } else {
                 pcpu_copy_value(htab, htab_elem_get_ptr(l_new, key_size),
                                 value, onallcpus);
-                hlist_add_head_rcu(&l_new->hash_node, head);
+                hlist_nulls_add_head_rcu(&l_new->hash_node, head);
                 l_new = NULL;
         }
         ret = 0;
@@ -910,7 +950,7 @@ static int htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
 static int htab_map_delete_elem(struct bpf_map *map, void *key)
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         struct bucket *b;
         struct htab_elem *l;
         unsigned long flags;
@@ -930,7 +970,7 @@ static int htab_map_delete_elem(struct bpf_map *map, void *key)
         l = lookup_elem_raw(head, hash, key, key_size);
 
         if (l) {
-                hlist_del_rcu(&l->hash_node);
+                hlist_nulls_del_rcu(&l->hash_node);
                 free_htab_elem(htab, l);
                 ret = 0;
         }
@@ -942,7 +982,7 @@ static int htab_map_delete_elem(struct bpf_map *map, void *key)
 static int htab_lru_map_delete_elem(struct bpf_map *map, void *key)
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         struct bucket *b;
         struct htab_elem *l;
         unsigned long flags;
@@ -962,7 +1002,7 @@ static int htab_lru_map_delete_elem(struct bpf_map *map, void *key)
         l = lookup_elem_raw(head, hash, key, key_size);
 
         if (l) {
-                hlist_del_rcu(&l->hash_node);
+                hlist_nulls_del_rcu(&l->hash_node);
                 ret = 0;
         }
 
@@ -977,14 +1017,13 @@ static void delete_all_elements(struct bpf_htab *htab)
         int i;
 
         for (i = 0; i < htab->n_buckets; i++) {
-                struct hlist_head *head = select_bucket(htab, i);
-                struct hlist_node *n;
+                struct hlist_nulls_head *head = select_bucket(htab, i);
+                struct hlist_nulls_node *n;
                 struct htab_elem *l;
 
-                hlist_for_each_entry_safe(l, n, head, hash_node) {
-                        hlist_del_rcu(&l->hash_node);
-                        if (l->state != HTAB_EXTRA_ELEM_USED)
-                                htab_elem_free(htab, l);
+                hlist_nulls_for_each_entry_safe(l, n, head, hash_node) {
+                        hlist_nulls_del_rcu(&l->hash_node);
+                        htab_elem_free(htab, l);
                 }
         }
 }
@@ -1004,7 +1043,7 @@ static void htab_map_free(struct bpf_map *map)
          * not have executed. Wait for them.
          */
         rcu_barrier();
-        if (htab->map.map_flags & BPF_F_NO_PREALLOC)
+        if (!htab_is_prealloc(htab))
                 delete_all_elements(htab);
         else
                 prealloc_destroy(htab);
diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
index 8bfe0afaee10..b37bd9ab7f57 100644
--- a/kernel/bpf/lpm_trie.c
+++ b/kernel/bpf/lpm_trie.c
@@ -500,9 +500,15 @@ unlock:
         raw_spin_unlock(&trie->lock);
 }
 
+static int trie_get_next_key(struct bpf_map *map, void *key, void *next_key)
+{
+        return -ENOTSUPP;
+}
+
 static const struct bpf_map_ops trie_ops = {
         .map_alloc = trie_alloc,
         .map_free = trie_free,
+        .map_get_next_key = trie_get_next_key,
         .map_lookup_elem = trie_lookup_elem,
         .map_update_elem = trie_update_elem,
         .map_delete_elem = trie_delete_elem,
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index 56eba9caa632..1dc22f6b49f5 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -1329,7 +1329,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
                 struct task_struct *task;
                 int count = 0;
 
-                seq_printf(seq, "css_set %p\n", cset);
+                seq_printf(seq, "css_set %pK\n", cset);
 
                 list_for_each_entry(task, &cset->tasks, cg_list) {
                         if (count++ > MAX_TASKS_SHOWN_PER_CSS)
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 0125589c7428..48851327a15e 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -2669,7 +2669,7 @@ static bool css_visible(struct cgroup_subsys_state *css)
  *
  * Returns 0 on success, -errno on failure.  On failure, csses which have
  * been processed already aren't cleaned up.  The caller is responsible for
- * cleaning up with cgroup_apply_control_disble().
+ * cleaning up with cgroup_apply_control_disable().
  */
 static int cgroup_apply_control_enable(struct cgroup *cgrp)
 {
diff --git a/kernel/cgroup/pids.c b/kernel/cgroup/pids.c
index e756dae49300..2237201d66d5 100644
--- a/kernel/cgroup/pids.c
+++ b/kernel/cgroup/pids.c
@@ -229,7 +229,7 @@ static int pids_can_fork(struct task_struct *task)
                 /* Only log the first time events_limit is incremented. */
                 if (atomic64_inc_return(&pids->events_limit) == 1) {
                         pr_info("cgroup: fork rejected by pids controller in ");
-                        pr_cont_cgroup_path(task_cgroup(current, pids_cgrp_id));
+                        pr_cont_cgroup_path(css->cgroup);
                         pr_cont("\n");
                 }
                 cgroup_file_notify(&pids->events_file);
diff --git a/kernel/cpu.c b/kernel/cpu.c
index f7c063239fa5..37b223e4fc05 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1335,26 +1335,21 @@ static int cpuhp_store_callbacks(enum cpuhp_state state, const char *name,
         struct cpuhp_step *sp;
         int ret = 0;
 
-        mutex_lock(&cpuhp_state_mutex);
-
         if (state == CPUHP_AP_ONLINE_DYN || state == CPUHP_BP_PREPARE_DYN) {
                 ret = cpuhp_reserve_state(state);
                 if (ret < 0)
-                        goto out;
+                        return ret;
                 state = ret;
         }
         sp = cpuhp_get_step(state);
-        if (name && sp->name) {
-                ret = -EBUSY;
-                goto out;
-        }
+        if (name && sp->name)
+                return -EBUSY;
+
         sp->startup.single = startup;
         sp->teardown.single = teardown;
         sp->name = name;
         sp->multi_instance = multi_instance;
         INIT_HLIST_HEAD(&sp->list);
-out:
-        mutex_unlock(&cpuhp_state_mutex);
         return ret;
 }
 
@@ -1428,6 +1423,7 @@ int __cpuhp_state_add_instance(enum cpuhp_state state, struct hlist_node *node,
                 return -EINVAL;
 
         get_online_cpus();
+        mutex_lock(&cpuhp_state_mutex);
 
         if (!invoke || !sp->startup.multi)
                 goto add_node;
@@ -1447,16 +1443,14 @@ int __cpuhp_state_add_instance(enum cpuhp_state state, struct hlist_node *node,
                 if (ret) {
                         if (sp->teardown.multi)
                                 cpuhp_rollback_install(cpu, state, node);
-                        goto err;
+                        goto unlock;
                 }
         }
 add_node:
         ret = 0;
-        mutex_lock(&cpuhp_state_mutex);
         hlist_add_head(node, &sp->list);
+unlock:
         mutex_unlock(&cpuhp_state_mutex);
-
-err:
         put_online_cpus();
         return ret;
 }
@@ -1491,6 +1485,7 @@ int __cpuhp_setup_state(enum cpuhp_state state,
                 return -EINVAL;
 
         get_online_cpus();
+        mutex_lock(&cpuhp_state_mutex);
 
         ret = cpuhp_store_callbacks(state, name, startup, teardown,
                                     multi_instance);
@@ -1524,6 +1519,7 @@ int __cpuhp_setup_state(enum cpuhp_state state,
                 }
         }
 out:
+        mutex_unlock(&cpuhp_state_mutex);
         put_online_cpus();
         /*
          * If the requested state is CPUHP_AP_ONLINE_DYN, return the
@@ -1547,6 +1543,8 @@ int __cpuhp_state_remove_instance(enum cpuhp_state state,
                 return -EINVAL;
 
         get_online_cpus();
+        mutex_lock(&cpuhp_state_mutex);
+
         if (!invoke || !cpuhp_get_teardown_cb(state))
                 goto remove;
         /*
@@ -1563,7 +1561,6 @@ int __cpuhp_state_remove_instance(enum cpuhp_state state,
         }
 
 remove:
-        mutex_lock(&cpuhp_state_mutex);
         hlist_del(node);
         mutex_unlock(&cpuhp_state_mutex);
         put_online_cpus();
@@ -1571,6 +1568,7 @@ remove:
         return 0;
 }
 EXPORT_SYMBOL_GPL(__cpuhp_state_remove_instance);
+
 /**
  * __cpuhp_remove_state - Remove the callbacks for an hotplug machine state
  * @state:      The state to remove
@@ -1589,6 +1587,7 @@ void __cpuhp_remove_state(enum cpuhp_state state, bool invoke)
 
         get_online_cpus();
 
+        mutex_lock(&cpuhp_state_mutex);
         if (sp->multi_instance) {
                 WARN(!hlist_empty(&sp->list),
                      "Error: Removing state %d which has instances left.\n",
@@ -1613,6 +1612,7 @@ void __cpuhp_remove_state(enum cpuhp_state state, bool invoke)
         }
 remove:
         cpuhp_store_callbacks(state, NULL, NULL, NULL, false);
+        mutex_unlock(&cpuhp_state_mutex);
         put_online_cpus();
 }
 EXPORT_SYMBOL(__cpuhp_remove_state);
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 6f41548f2e32..ff01cba86f43 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -998,7 +998,7 @@ list_update_cgroup_event(struct perf_event *event,
  */
 #define PERF_CPU_HRTIMER (1000 / HZ)
 /*
- * function must be called with interrupts disbled
+ * function must be called with interrupts disabled
  */
 static enum hrtimer_restart perf_mux_hrtimer_handler(struct hrtimer *hr)
 {
@@ -4256,7 +4256,7 @@ int perf_event_release_kernel(struct perf_event *event)
 
         raw_spin_lock_irq(&ctx->lock);
         /*
-         * Mark this even as STATE_DEAD, there is no external reference to it
+         * Mark this event as STATE_DEAD, there is no external reference to it
          * anymore.
          *
          * Anybody acquiring event->child_mutex after the below loop _must_
@@ -10417,21 +10417,22 @@ void perf_event_free_task(struct task_struct *task)
                         continue;
 
                 mutex_lock(&ctx->mutex);
-again:
-                list_for_each_entry_safe(event, tmp, &ctx->pinned_groups,
-                                group_entry)
-                        perf_free_event(event, ctx);
+                raw_spin_lock_irq(&ctx->lock);
+                /*
+                 * Destroy the task <-> ctx relation and mark the context dead.
+                 *
+                 * This is important because even though the task hasn't been
+                 * exposed yet the context has been (through child_list).
+                 */
+                RCU_INIT_POINTER(task->perf_event_ctxp[ctxn], NULL);
+                WRITE_ONCE(ctx->task, TASK_TOMBSTONE);
+                put_task_struct(task); /* cannot be last */
+                raw_spin_unlock_irq(&ctx->lock);
 
-                list_for_each_entry_safe(event, tmp, &ctx->flexible_groups,
-                                group_entry)
+                list_for_each_entry_safe(event, tmp, &ctx->event_list, event_entry)
                         perf_free_event(event, ctx);
 
-                if (!list_empty(&ctx->pinned_groups) ||
-                                !list_empty(&ctx->flexible_groups))
-                        goto again;
-
                 mutex_unlock(&ctx->mutex);
-
                 put_ctx(ctx);
         }
 }
@@ -10469,7 +10470,12 @@ const struct perf_event_attr *perf_event_attrs(struct perf_event *event)
 }
 
 /*
- * inherit a event from parent task to child task:
+ * Inherit a event from parent task to child task.
+ *
+ * Returns:
+ *  - valid pointer on success
+ *  - NULL for orphaned events
+ *  - IS_ERR() on error
  */
 static struct perf_event *
 inherit_event(struct perf_event *parent_event,
@@ -10563,6 +10569,16 @@ inherit_event(struct perf_event *parent_event,
         return child_event;
 }
 
+/*
+ * Inherits an event group.
+ *
+ * This will quietly suppress orphaned events; !inherit_event() is not an error.
+ * This matches with perf_event_release_kernel() removing all child events.
+ *
+ * Returns:
+ *  - 0 on success
+ *  - <0 on error
+ */
 static int inherit_group(struct perf_event *parent_event,
               struct task_struct *parent,
               struct perf_event_context *parent_ctx,
@@ -10577,6 +10593,11 @@ static int inherit_group(struct perf_event *parent_event,
                                  child, NULL, child_ctx);
         if (IS_ERR(leader))
                 return PTR_ERR(leader);
+        /*
+         * @leader can be NULL here because of is_orphaned_event(). In this
+         * case inherit_event() will create individual events, similar to what
+         * perf_group_detach() would do anyway.
+         */
         list_for_each_entry(sub, &parent_event->sibling_list, group_entry) {
                 child_ctr = inherit_event(sub, parent, parent_ctx,
                                             child, leader, child_ctx);
@@ -10586,6 +10607,17 @@ static int inherit_group(struct perf_event *parent_event,
         return 0;
 }
 
+/*
+ * Creates the child task context and tries to inherit the event-group.
+ *
+ * Clears @inherited_all on !attr.inherited or error. Note that we'll leave
+ * inherited_all set when we 'fail' to inherit an orphaned event; this is
+ * consistent with perf_event_release_kernel() removing all child events.
+ *
+ * Returns:
+ *  - 0 on success
+ *  - <0 on error
+ */
 static int
 inherit_task_group(struct perf_event *event, struct task_struct *parent,
                    struct perf_event_context *parent_ctx,
@@ -10608,7 +10640,6 @@ inherit_task_group(struct perf_event *event, struct task_struct *parent,
                  * First allocate and initialize a context for the
                  * child.
                  */
-
                 child_ctx = alloc_perf_context(parent_ctx->pmu, child);
                 if (!child_ctx)
                         return -ENOMEM;
@@ -10670,7 +10701,7 @@ static int perf_event_init_context(struct task_struct *child, int ctxn)
                 ret = inherit_task_group(event, parent, parent_ctx,
                                          child, ctxn, &inherited_all);
                 if (ret)
-                        break;
+                        goto out_unlock;
         }
 
         /*
@@ -10686,7 +10717,7 @@ static int perf_event_init_context(struct task_struct *child, int ctxn)
                 ret = inherit_task_group(event, parent, parent_ctx,
                                          child, ctxn, &inherited_all);
                 if (ret)
-                        break;
+                        goto out_unlock;
         }
 
         raw_spin_lock_irqsave(&parent_ctx->lock, flags);
@@ -10714,6 +10745,7 @@ static int perf_event_init_context(struct task_struct *child, int ctxn)
         }
 
         raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
+out_unlock:
         mutex_unlock(&parent_ctx->mutex);
 
         perf_unpin_context(parent_ctx);
diff --git a/kernel/exit.c b/kernel/exit.c
index e126ebf2400c..516acdb0e0ec 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -554,7 +554,6 @@ static void exit_mm(void)
         enter_lazy_tlb(mm, current);
         task_unlock(current);
         mm_update_next_owner(mm);
-        userfaultfd_exit(mm);
         mmput(mm);
         if (test_thread_flag(TIF_MEMDIE))
                 exit_oom_victim();
diff --git a/kernel/futex.c b/kernel/futex.c
index 229a744b1781..45858ec73941 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2815,7 +2815,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
 {
         struct hrtimer_sleeper timeout, *to = NULL;
         struct rt_mutex_waiter rt_waiter;
-        struct rt_mutex *pi_mutex = NULL;
         struct futex_hash_bucket *hb;
         union futex_key key2 = FUTEX_KEY_INIT;
         struct futex_q q = futex_q_init;
@@ -2899,6 +2898,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
                 if (q.pi_state && (q.pi_state->owner != current)) {
                         spin_lock(q.lock_ptr);
                         ret = fixup_pi_state_owner(uaddr2, &q, current);
+                        if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current)
+                                rt_mutex_unlock(&q.pi_state->pi_mutex);
                         /*
                          * Drop the reference to the pi state which
                          * the requeue_pi() code acquired for us.
@@ -2907,6 +2908,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
                         spin_unlock(q.lock_ptr);
                 }
         } else {
+                struct rt_mutex *pi_mutex;
+
                 /*
                  * We have been woken up by futex_unlock_pi(), a timeout, or a
                  * signal.  futex_unlock_pi() will not destroy the lock_ptr nor
@@ -2930,18 +2933,19 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
                 if (res)
                         ret = (res < 0) ? res : 0;
 
+                /*
+                 * If fixup_pi_state_owner() faulted and was unable to handle
+                 * the fault, unlock the rt_mutex and return the fault to
+                 * userspace.
+                 */
+                if (ret && rt_mutex_owner(pi_mutex) == current)
+                        rt_mutex_unlock(pi_mutex);
+
                 /* Unqueue and drop the lock. */
                 unqueue_me_pi(&q);
         }
 
-        /*
-         * If fixup_pi_state_owner() faulted and was unable to handle the
-         * fault, unlock the rt_mutex and return the fault to userspace.
-         */
-        if (ret == -EFAULT) {
-                if (pi_mutex && rt_mutex_owner(pi_mutex) == current)
-                        rt_mutex_unlock(pi_mutex);
-        } else if (ret == -EINTR) {
+        if (ret == -EINTR) {
                 /*
                  * We've already been requeued, but cannot restart by calling
                  * futex_lock_pi() directly. We could restart this syscall, but
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index b56a558e406d..b118735fea9d 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -614,13 +614,13 @@ static int kexec_calculate_store_digests(struct kimage *image)
                 ret = crypto_shash_final(desc, digest);
                 if (ret)
                         goto out_free_digest;
-                ret = kexec_purgatory_get_set_symbol(image, "sha_regions",
-                                                sha_regions, sha_region_sz, 0);
+                ret = kexec_purgatory_get_set_symbol(image, "purgatory_sha_regions",
+                                                     sha_regions, sha_region_sz, 0);
                 if (ret)
                         goto out_free_digest;
 
-                ret = kexec_purgatory_get_set_symbol(image, "sha256_digest",
-                                                digest, SHA256_DIGEST_SIZE, 0);
+                ret = kexec_purgatory_get_set_symbol(image, "purgatory_sha256_digest",
+                                                     digest, SHA256_DIGEST_SIZE, 0);
                 if (ret)
                         goto out_free_digest;
         }
diff --git a/kernel/kexec_internal.h b/kernel/kexec_internal.h
index 4cef7e4706b0..799a8a452187 100644
--- a/kernel/kexec_internal.h
+++ b/kernel/kexec_internal.h
@@ -15,11 +15,7 @@ int kimage_is_destination_range(struct kimage *image,
 extern struct mutex kexec_mutex;
 
 #ifdef CONFIG_KEXEC_FILE
-struct kexec_sha_region {
-        unsigned long start;
-        unsigned long len;
-};
-
+#include <linux/purgatory.h>
 void kimage_file_post_load_cleanup(struct kimage *image);
 #else /* CONFIG_KEXEC_FILE */
 static inline void kimage_file_post_load_cleanup(struct kimage *image) { }
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 12e38c213b70..a95e5d1f4a9c 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -3262,10 +3262,17 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
         if (depth) {
                 hlock = curr->held_locks + depth - 1;
                 if (hlock->class_idx == class_idx && nest_lock) {
-                        if (hlock->references)
+                        if (hlock->references) {
+                                /*
+                                 * Check: unsigned int references:12, overflow.
+                                 */
+                                if (DEBUG_LOCKS_WARN_ON(hlock->references == (1 << 12)-1))
+                                        return 0;
+
                                 hlock->references++;
-                        else
+                        } else {
                                 hlock->references = 2;
+                        }
 
                         return 1;
                 }
diff --git a/kernel/locking/rwsem-spinlock.c b/kernel/locking/rwsem-spinlock.c
index 7bc24d477805..c65f7989f850 100644
--- a/kernel/locking/rwsem-spinlock.c
+++ b/kernel/locking/rwsem-spinlock.c
@@ -213,10 +213,9 @@ int __sched __down_write_common(struct rw_semaphore *sem, int state)
                  */
                 if (sem->count == 0)
                         break;
-                if (signal_pending_state(state, current)) {
-                        ret = -EINTR;
-                        goto out;
-                }
+                if (signal_pending_state(state, current))
+                        goto out_nolock;
+
                 set_current_state(state);
                 raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
                 schedule();
@@ -224,12 +223,19 @@ int __sched __down_write_common(struct rw_semaphore *sem, int state)
         }
         /* got the lock */
         sem->count = -1;
-out:
         list_del(&waiter.list);
 
         raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
 
         return ret;
+
+out_nolock:
+        list_del(&waiter.list);
+        if (!list_empty(&sem->wait_list))
+                __rwsem_do_wake(sem, 1);
+        raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
+
+        return -EINTR;
 }
 
 void __sched __down_write(struct rw_semaphore *sem)
diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c
index da6c9a34f62f..6b7abb334ca6 100644
--- a/kernel/locking/test-ww_mutex.c
+++ b/kernel/locking/test-ww_mutex.c
@@ -50,7 +50,7 @@ static void test_mutex_work(struct work_struct *work)
 
         if (mtx->flags & TEST_MTX_TRY) {
                 while (!ww_mutex_trylock(&mtx->mutex))
-                        cpu_relax();
+                        cond_resched();
         } else {
                 ww_mutex_lock(&mtx->mutex, NULL);
         }
@@ -88,7 +88,7 @@ static int __test_mutex(unsigned int flags)
                                 ret = -EINVAL;
                                 break;
                         }
-                        cpu_relax();
+                        cond_resched();
                 } while (time_before(jiffies, timeout));
         } else {
                 ret = wait_for_completion_timeout(&mtx.done, TIMEOUT);
@@ -627,7 +627,7 @@ static int __init test_ww_mutex_init(void)
         if (ret)
                 return ret;
 
-        ret = stress(4096, hweight32(STRESS_ALL)*ncpus, 1<<12, STRESS_ALL);
+        ret = stress(4095, hweight32(STRESS_ALL)*ncpus, 1<<12, STRESS_ALL);
         if (ret)
                 return ret;
 
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 06123234f118..07e85e5229da 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -247,11 +247,9 @@ static void devm_memremap_pages_release(struct device *dev, void *data)
         align_start = res->start & ~(SECTION_SIZE - 1);
         align_size = ALIGN(resource_size(res), SECTION_SIZE);
 
-        lock_device_hotplug();
         mem_hotplug_begin();
         arch_remove_memory(align_start, align_size);
         mem_hotplug_done();
-        unlock_device_hotplug();
 
         untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
         pgmap_radix_release(res);
@@ -364,11 +362,9 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
         if (error)
                 goto err_pfn_remap;
 
-        lock_device_hotplug();
         mem_hotplug_begin();
         error = arch_add_memory(nid, align_start, align_size, true);
         mem_hotplug_done();
-        unlock_device_hotplug();
         if (error)
                 goto err_add_memory;
 
diff --git a/kernel/padata.c b/kernel/padata.c
index 05316c9f32da..3202aa17492c 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -186,19 +186,20 @@ static struct padata_priv *padata_get_next(struct parallel_data *pd)
 
         reorder = &next_queue->reorder;
 
+        spin_lock(&reorder->lock);
         if (!list_empty(&reorder->list)) {
                 padata = list_entry(reorder->list.next,
                                     struct padata_priv, list);
 
-                spin_lock(&reorder->lock);
                 list_del_init(&padata->list);
                 atomic_dec(&pd->reorder_objects);
-                spin_unlock(&reorder->lock);
 
                 pd->processed++;
 
+                spin_unlock(&reorder->lock);
                 goto out;
         }
+        spin_unlock(&reorder->lock);
 
         if (__this_cpu_read(pd->pqueue->cpu_index) == next_queue->cpu_index) {
                 padata = ERR_PTR(-ENODATA);
diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
index a08795e21628..00a45c45beca 100644
--- a/kernel/sched/clock.c
+++ b/kernel/sched/clock.c
@@ -96,10 +96,10 @@ static DEFINE_STATIC_KEY_FALSE(__sched_clock_stable);
 static int __sched_clock_stable_early = 1;
 
 /*
- * We want: ktime_get_ns() + gtod_offset == sched_clock() + raw_offset
+ * We want: ktime_get_ns() + __gtod_offset == sched_clock() + __sched_clock_offset
  */
-static __read_mostly u64 raw_offset;
-static __read_mostly u64 gtod_offset;
+__read_mostly u64 __sched_clock_offset;
+static __read_mostly u64 __gtod_offset;
 
 struct sched_clock_data {
         u64                     tick_raw;
@@ -131,17 +131,24 @@ static void __set_sched_clock_stable(void)
         /*
          * Attempt to make the (initial) unstable->stable transition continuous.
          */
-        raw_offset = (scd->tick_gtod + gtod_offset) - (scd->tick_raw);
+        __sched_clock_offset = (scd->tick_gtod + __gtod_offset) - (scd->tick_raw);
 
         printk(KERN_INFO "sched_clock: Marking stable (%lld, %lld)->(%lld, %lld)\n",
-                        scd->tick_gtod, gtod_offset,
-                        scd->tick_raw,  raw_offset);
+                        scd->tick_gtod, __gtod_offset,
+                        scd->tick_raw,  __sched_clock_offset);
 
         static_branch_enable(&__sched_clock_stable);
         tick_dep_clear(TICK_DEP_BIT_CLOCK_UNSTABLE);
 }
 
-static void __clear_sched_clock_stable(struct work_struct *work)
+static void __sched_clock_work(struct work_struct *work)
+{
+        static_branch_disable(&__sched_clock_stable);
+}
+
+static DECLARE_WORK(sched_clock_work, __sched_clock_work);
+
+static void __clear_sched_clock_stable(void)
 {
         struct sched_clock_data *scd = this_scd();
 
@@ -154,17 +161,17 @@ static void __clear_sched_clock_stable(struct work_struct *work)
          *
          * Still do what we can.
          */
-        gtod_offset = (scd->tick_raw + raw_offset) - (scd->tick_gtod);
+        __gtod_offset = (scd->tick_raw + __sched_clock_offset) - (scd->tick_gtod);
 
         printk(KERN_INFO "sched_clock: Marking unstable (%lld, %lld)<-(%lld, %lld)\n",
-                        scd->tick_gtod, gtod_offset,
-                        scd->tick_raw,  raw_offset);
+                        scd->tick_gtod, __gtod_offset,
+                        scd->tick_raw,  __sched_clock_offset);
 
-        static_branch_disable(&__sched_clock_stable);
         tick_dep_set(TICK_DEP_BIT_CLOCK_UNSTABLE);
-}
 
-static DECLARE_WORK(sched_clock_work, __clear_sched_clock_stable);
+        if (sched_clock_stable())
+                schedule_work(&sched_clock_work);
+}
 
 void clear_sched_clock_stable(void)
 {
@@ -173,7 +180,7 @@ void clear_sched_clock_stable(void)
         smp_mb(); /* matches sched_clock_init_late() */
 
         if (sched_clock_running == 2)
-                schedule_work(&sched_clock_work);
+                __clear_sched_clock_stable();
 }
 
 void sched_clock_init_late(void)
@@ -214,7 +221,7 @@ static inline u64 wrap_max(u64 x, u64 y)
  */
 static u64 sched_clock_local(struct sched_clock_data *scd)
 {
-        u64 now, clock, old_clock, min_clock, max_clock;
+        u64 now, clock, old_clock, min_clock, max_clock, gtod;
         s64 delta;
 
 again:
@@ -231,9 +238,10 @@ again:
          *                    scd->tick_gtod + TICK_NSEC);
          */
 
-        clock = scd->tick_gtod + gtod_offset + delta;
-        min_clock = wrap_max(scd->tick_gtod, old_clock);
-        max_clock = wrap_max(old_clock, scd->tick_gtod + TICK_NSEC);
+        gtod = scd->tick_gtod + __gtod_offset;
+        clock = gtod + delta;
+        min_clock = wrap_max(gtod, old_clock);
+        max_clock = wrap_max(old_clock, gtod + TICK_NSEC);
 
         clock = wrap_max(clock, min_clock);
         clock = wrap_min(clock, max_clock);
@@ -317,7 +325,7 @@ u64 sched_clock_cpu(int cpu)
         u64 clock;
 
         if (sched_clock_stable())
-                return sched_clock() + raw_offset;
+                return sched_clock() + __sched_clock_offset;
 
         if (unlikely(!sched_clock_running))
                 return 0ull;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 956383844116..3b31fc05a0f1 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3287,10 +3287,15 @@ pick_next_task(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
         struct task_struct *p;
 
         /*
-         * Optimization: we know that if all tasks are in
-         * the fair class we can call that function directly:
+         * Optimization: we know that if all tasks are in the fair class we can
+         * call that function directly, but only if the @prev task wasn't of a
+         * higher scheduling class, because otherwise those loose the
+         * opportunity to pull in more work from other CPUs.
          */
-        if (likely(rq->nr_running == rq->cfs.h_nr_running)) {
+        if (likely((prev->sched_class == &idle_sched_class ||
+                    prev->sched_class == &fair_sched_class) &&
+                   rq->nr_running == rq->cfs.h_nr_running)) {
+
                 p = fair_sched_class.pick_next_task(rq, prev, rf);
                 if (unlikely(p == RETRY_TASK))
                         goto again;
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 8f8de3d4d6b7..54c577578da6 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -36,6 +36,7 @@ struct sugov_policy {
         u64 last_freq_update_time;
         s64 freq_update_delay_ns;
         unsigned int next_freq;
+        unsigned int cached_raw_freq;
 
         /* The next fields are only needed if fast switch cannot be used. */
         struct irq_work irq_work;
@@ -52,7 +53,6 @@ struct sugov_cpu {
         struct update_util_data update_util;
         struct sugov_policy *sg_policy;
 
-        unsigned int cached_raw_freq;
         unsigned long iowait_boost;
         unsigned long iowait_boost_max;
         u64 last_update;
@@ -116,7 +116,7 @@ static void sugov_update_commit(struct sugov_policy *sg_policy, u64 time,
 
 /**
  * get_next_freq - Compute a new frequency for a given cpufreq policy.
- * @sg_cpu: schedutil cpu object to compute the new frequency for.
+ * @sg_policy: schedutil policy object to compute the new frequency for.
  * @util: Current CPU utilization.
  * @max: CPU capacity.
  *
@@ -136,19 +136,18 @@ static void sugov_update_commit(struct sugov_policy *sg_policy, u64 time,
  * next_freq (as calculated above) is returned, subject to policy min/max and
  * cpufreq driver limitations.
  */
-static unsigned int get_next_freq(struct sugov_cpu *sg_cpu, unsigned long util,
-                                  unsigned long max)
+static unsigned int get_next_freq(struct sugov_policy *sg_policy,
+                                  unsigned long util, unsigned long max)
 {
-        struct sugov_policy *sg_policy = sg_cpu->sg_policy;
         struct cpufreq_policy *policy = sg_policy->policy;
         unsigned int freq = arch_scale_freq_invariant() ?
                                 policy->cpuinfo.max_freq : policy->cur;
 
         freq = (freq + (freq >> 2)) * util / max;
 
-        if (freq == sg_cpu->cached_raw_freq && sg_policy->next_freq != UINT_MAX)
+        if (freq == sg_policy->cached_raw_freq && sg_policy->next_freq != UINT_MAX)
                 return sg_policy->next_freq;
-        sg_cpu->cached_raw_freq = freq;
+        sg_policy->cached_raw_freq = freq;
         return cpufreq_driver_resolve_freq(policy, freq);
 }
 
@@ -213,7 +212,7 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
         } else {
                 sugov_get_util(&util, &max);
                 sugov_iowait_boost(sg_cpu, &util, &max);
-                next_f = get_next_freq(sg_cpu, util, max);
+                next_f = get_next_freq(sg_policy, util, max);
         }
         sugov_update_commit(sg_policy, time, next_f);
 }
@@ -267,7 +266,7 @@ static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu,
                 sugov_iowait_boost(j_sg_cpu, &util, &max);
         }
 
-        return get_next_freq(sg_cpu, util, max);
+        return get_next_freq(sg_policy, util, max);
 }
 
 static void sugov_update_shared(struct update_util_data *hook, u64 time,
@@ -580,25 +579,19 @@ static int sugov_start(struct cpufreq_policy *policy)
         sg_policy->next_freq = UINT_MAX;
         sg_policy->work_in_progress = false;
         sg_policy->need_freq_update = false;
+        sg_policy->cached_raw_freq = 0;
 
         for_each_cpu(cpu, policy->cpus) {
                 struct sugov_cpu *sg_cpu = &per_cpu(sugov_cpu, cpu);
 
+                memset(sg_cpu, 0, sizeof(*sg_cpu));
                 sg_cpu->sg_policy = sg_policy;
-                if (policy_is_shared(policy)) {
-                        sg_cpu->util = 0;
-                        sg_cpu->max = 0;
-                        sg_cpu->flags = SCHED_CPUFREQ_RT;
-                        sg_cpu->last_update = 0;
-                        sg_cpu->cached_raw_freq = 0;
-                        sg_cpu->iowait_boost = 0;
-                        sg_cpu->iowait_boost_max = policy->cpuinfo.max_freq;
-                        cpufreq_add_update_util_hook(cpu, &sg_cpu->update_util,
-                                                     sugov_update_shared);
-                } else {
-                        cpufreq_add_update_util_hook(cpu, &sg_cpu->update_util,
-                                                     sugov_update_single);
-                }
+                sg_cpu->flags = SCHED_CPUFREQ_RT;
+                sg_cpu->iowait_boost_max = policy->cpuinfo.max_freq;
+                cpufreq_add_update_util_hook(cpu, &sg_cpu->update_util,
+                                             policy_is_shared(policy) ?
+                                                        sugov_update_shared :
+                                                        sugov_update_single);
         }
         return 0;
 }
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 99b2c33a9fbc..a2ce59015642 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -445,13 +445,13 @@ static void replenish_dl_entity(struct sched_dl_entity *dl_se,
  *
  * This function returns true if:
  *
- *   runtime / (deadline - t) > dl_runtime / dl_period ,
+ *   runtime / (deadline - t) > dl_runtime / dl_deadline ,
  *
  * IOW we can't recycle current parameters.
  *
- * Notice that the bandwidth check is done against the period. For
+ * Notice that the bandwidth check is done against the deadline. For
  * task with deadline equal to period this is the same of using
- * dl_deadline instead of dl_period in the equation above.
+ * dl_period instead of dl_deadline in the equation above.
  */
 static bool dl_entity_overflow(struct sched_dl_entity *dl_se,
                                struct sched_dl_entity *pi_se, u64 t)
@@ -476,7 +476,7 @@ static bool dl_entity_overflow(struct sched_dl_entity *dl_se,
          * of anything below microseconds resolution is actually fiction
          * (but still we want to give the user that illusion >;).
          */
-        left = (pi_se->dl_period >> DL_SCALE) * (dl_se->runtime >> DL_SCALE);
+        left = (pi_se->dl_deadline >> DL_SCALE) * (dl_se->runtime >> DL_SCALE);
         right = ((dl_se->deadline - t) >> DL_SCALE) *
                 (pi_se->dl_runtime >> DL_SCALE);
 
@@ -505,10 +505,15 @@ static void update_dl_entity(struct sched_dl_entity *dl_se,
         }
 }
 
+static inline u64 dl_next_period(struct sched_dl_entity *dl_se)
+{
+        return dl_se->deadline - dl_se->dl_deadline + dl_se->dl_period;
+}
+
 /*
  * If the entity depleted all its runtime, and if we want it to sleep
  * while waiting for some new execution time to become available, we
- * set the bandwidth enforcement timer to the replenishment instant
+ * set the bandwidth replenishment timer to the replenishment instant
  * and try to activate it.
  *
  * Notice that it is important for the caller to know if the timer
@@ -530,7 +535,7 @@ static int start_dl_timer(struct task_struct *p)
          * that it is actually coming from rq->clock and not from
          * hrtimer's time base reading.
          */
-        act = ns_to_ktime(dl_se->deadline);
+        act = ns_to_ktime(dl_next_period(dl_se));
         now = hrtimer_cb_get_time(timer);
         delta = ktime_to_ns(now) - rq_clock(rq);
         act = ktime_add_ns(act, delta);
@@ -638,6 +643,7 @@ static enum hrtimer_restart dl_task_timer(struct hrtimer *timer)
                 lockdep_unpin_lock(&rq->lock, rf.cookie);
                 rq = dl_task_offline_migration(rq, p);
                 rf.cookie = lockdep_pin_lock(&rq->lock);
+                update_rq_clock(rq);
 
                 /*
                  * Now that the task has been migrated to the new RQ and we
@@ -689,6 +695,37 @@ void init_dl_task_timer(struct sched_dl_entity *dl_se)
         timer->function = dl_task_timer;
 }
 
+/*
+ * During the activation, CBS checks if it can reuse the current task's
+ * runtime and period. If the deadline of the task is in the past, CBS
+ * cannot use the runtime, and so it replenishes the task. This rule
+ * works fine for implicit deadline tasks (deadline == period), and the
+ * CBS was designed for implicit deadline tasks. However, a task with
+ * constrained deadline (deadine < period) might be awakened after the
+ * deadline, but before the next period. In this case, replenishing the
+ * task would allow it to run for runtime / deadline. As in this case
+ * deadline < period, CBS enables a task to run for more than the
+ * runtime / period. In a very loaded system, this can cause a domino
+ * effect, making other tasks miss their deadlines.
+ *
+ * To avoid this problem, in the activation of a constrained deadline
+ * task after the deadline but before the next period, throttle the
+ * task and set the replenishing timer to the begin of the next period,
+ * unless it is boosted.
+ */
+static inline void dl_check_constrained_dl(struct sched_dl_entity *dl_se)
+{
+        struct task_struct *p = dl_task_of(dl_se);
+        struct rq *rq = rq_of_dl_rq(dl_rq_of_se(dl_se));
+
+        if (dl_time_before(dl_se->deadline, rq_clock(rq)) &&
+            dl_time_before(rq_clock(rq), dl_next_period(dl_se))) {
+                if (unlikely(dl_se->dl_boosted || !start_dl_timer(p)))
+                        return;
+                dl_se->dl_throttled = 1;
+        }
+}
+
 static
 int dl_runtime_exceeded(struct sched_dl_entity *dl_se)
 {
@@ -922,6 +959,11 @@ static void dequeue_dl_entity(struct sched_dl_entity *dl_se)
         __dequeue_dl_entity(dl_se);
 }
 
+static inline bool dl_is_constrained(struct sched_dl_entity *dl_se)
+{
+        return dl_se->dl_deadline < dl_se->dl_period;
+}
+
 static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
 {
         struct task_struct *pi_task = rt_mutex_get_top_task(p);
@@ -948,6 +990,15 @@ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
         }
 
         /*
+         * Check if a constrained deadline task was activated
+         * after the deadline but before the next period.
+         * If that is the case, the task will be throttled and
+         * the replenishment timer will be set to the next period.
+         */
+        if (!p->dl.dl_throttled && dl_is_constrained(&p->dl))
+                dl_check_constrained_dl(&p->dl);
+
+        /*
          * If p is throttled, we do nothing. In fact, if it exhausted
          * its budget it needs a replenishment and, since it now is on
          * its rq, the bandwidth timer callback (which clearly has not
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 3e88b35ac157..dea138964b91 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5799,7 +5799,7 @@ static int select_idle_cpu(struct task_struct *p, struct sched_domain *sd, int t
          * Due to large variance we need a large fuzz factor; hackbench in
          * particularly is sensitive here.
          */
-        if ((avg_idle / 512) < avg_cost)
+        if (sched_feat(SIS_AVG_CPU) && (avg_idle / 512) < avg_cost)
                 return -1;
 
         time = local_clock();
diff --git a/kernel/sched/features.h b/kernel/sched/features.h
index 69631fa46c2f..1b3c8189b286 100644
--- a/kernel/sched/features.h
+++ b/kernel/sched/features.h
@@ -51,6 +51,11 @@ SCHED_FEAT(NONTASK_CAPACITY, true)
  */
 SCHED_FEAT(TTWU_QUEUE, true)
 
+/*
+ * When doing wakeups, attempt to limit superfluous scans of the LLC domain.
+ */
+SCHED_FEAT(SIS_AVG_CPU, false)
+
 #ifdef HAVE_RT_PUSH_IPI
 /*
  * In order to avoid a thundering herd attack of CPUs that are
diff --git a/kernel/sched/loadavg.c b/kernel/sched/loadavg.c
index 7296b7308eca..f15fb2bdbc0d 100644
--- a/kernel/sched/loadavg.c
+++ b/kernel/sched/loadavg.c
@@ -169,7 +169,7 @@ static inline int calc_load_write_idx(void)
          * If the folding window started, make sure we start writing in the
          * next idle-delta.
          */
-        if (!time_before(jiffies, calc_load_update))
+        if (!time_before(jiffies, READ_ONCE(calc_load_update)))
                 idx++;
 
         return idx & 1;
@@ -202,8 +202,9 @@ void calc_load_exit_idle(void)
         struct rq *this_rq = this_rq();
 
         /*
-         * If we're still before the sample window, we're done.
+         * If we're still before the pending sample window, we're done.
          */
+        this_rq->calc_load_update = READ_ONCE(calc_load_update);
         if (time_before(jiffies, this_rq->calc_load_update))
                 return;
 
@@ -212,7 +213,6 @@ void calc_load_exit_idle(void)
          * accounted through the nohz accounting, so skip the entire deal and
          * sync up for the next window.
          */
-        this_rq->calc_load_update = calc_load_update;
         if (time_before(jiffies, this_rq->calc_load_update + 10))
                 this_rq->calc_load_update += LOAD_FREQ;
 }
@@ -308,13 +308,15 @@ calc_load_n(unsigned long load, unsigned long exp,
  */
 static void calc_global_nohz(void)
 {
+        unsigned long sample_window;
         long delta, active, n;
 
-        if (!time_before(jiffies, calc_load_update + 10)) {
+        sample_window = READ_ONCE(calc_load_update);
+        if (!time_before(jiffies, sample_window + 10)) {
                 /*
                  * Catch-up, fold however many we are behind still
                  */
-                delta = jiffies - calc_load_update - 10;
+                delta = jiffies - sample_window - 10;
                 n = 1 + (delta / LOAD_FREQ);
 
                 active = atomic_long_read(&calc_load_tasks);
@@ -324,7 +326,7 @@ static void calc_global_nohz(void)
                 avenrun[1] = calc_load_n(avenrun[1], EXP_5, active, n);
                 avenrun[2] = calc_load_n(avenrun[2], EXP_15, active, n);
 
-                calc_load_update += n * LOAD_FREQ;
+                WRITE_ONCE(calc_load_update, sample_window + n * LOAD_FREQ);
         }
 
         /*
@@ -352,9 +354,11 @@ static inline void calc_global_nohz(void) { }
  */
 void calc_global_load(unsigned long ticks)
 {
+        unsigned long sample_window;
         long active, delta;
 
-        if (time_before(jiffies, calc_load_update + 10))
+        sample_window = READ_ONCE(calc_load_update);
+        if (time_before(jiffies, sample_window + 10))
                 return;
 
         /*
@@ -371,7 +375,7 @@ void calc_global_load(unsigned long ticks)
         avenrun[1] = calc_load(avenrun[1], EXP_5, active);
         avenrun[2] = calc_load(avenrun[2], EXP_15, active);
 
-        calc_load_update += LOAD_FREQ;
+        WRITE_ONCE(calc_load_update, sample_window + LOAD_FREQ);
 
         /*
          * In case we idled for multiple LOAD_FREQ intervals, catch up in bulk.
diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
index 4d2ea6f25568..b8c84c6dee64 100644
--- a/kernel/sched/wait.c
+++ b/kernel/sched/wait.c
@@ -242,6 +242,45 @@ long prepare_to_wait_event(wait_queue_head_t *q, wait_queue_t *wait, int state)
 }
 EXPORT_SYMBOL(prepare_to_wait_event);
 
+/*
+ * Note! These two wait functions are entered with the
+ * wait-queue lock held (and interrupts off in the _irq
+ * case), so there is no race with testing the wakeup
+ * condition in the caller before they add the wait
+ * entry to the wake queue.
+ */
+int do_wait_intr(wait_queue_head_t *wq, wait_queue_t *wait)
+{
+        if (likely(list_empty(&wait->task_list)))
+                __add_wait_queue_tail(wq, wait);
+
+        set_current_state(TASK_INTERRUPTIBLE);
+        if (signal_pending(current))
+                return -ERESTARTSYS;
+
+        spin_unlock(&wq->lock);
+        schedule();
+        spin_lock(&wq->lock);
+        return 0;
+}
+EXPORT_SYMBOL(do_wait_intr);
+
+int do_wait_intr_irq(wait_queue_head_t *wq, wait_queue_t *wait)
+{
+        if (likely(list_empty(&wait->task_list)))
+                __add_wait_queue_tail(wq, wait);
+
+        set_current_state(TASK_INTERRUPTIBLE);
+        if (signal_pending(current))
+                return -ERESTARTSYS;
+
+        spin_unlock_irq(&wq->lock);
+        schedule();
+        spin_lock_irq(&wq->lock);
+        return 0;
+}
+EXPORT_SYMBOL(do_wait_intr_irq);
+
 /**
  * finish_wait - clean up after waiting in a queue
  * @q: waitqueue waited on
diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
index 7906b3f0c41a..497719127bf9 100644
--- a/kernel/time/jiffies.c
+++ b/kernel/time/jiffies.c
@@ -125,7 +125,7 @@ int register_refined_jiffies(long cycles_per_second)
         shift_hz += cycles_per_tick/2;
         do_div(shift_hz, cycles_per_tick);
         /* Calculate nsec_per_tick using shift_hz */
-        nsec_per_tick = (u64)TICK_NSEC << 8;
+        nsec_per_tick = (u64)NSEC_PER_SEC << 8;
         nsec_per_tick += (u32)shift_hz/2;
         do_div(nsec_per_tick, (u32)shift_hz);
 
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index d5038005eb5d..d4a06e714645 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -429,7 +429,7 @@ config BLK_DEV_IO_TRACE
 
           If unsure, say N.
 
-config KPROBE_EVENT
+config KPROBE_EVENTS
         depends on KPROBES
         depends on HAVE_REGS_AND_STACK_ACCESS_API
         bool "Enable kprobes-based dynamic events"
@@ -447,7 +447,7 @@ config KPROBE_EVENT
           This option is also required by perf-probe subcommand of perf tools.
           If you want to use perf tools, this option is strongly recommended.
 
-config UPROBE_EVENT
+config UPROBE_EVENTS
         bool "Enable uprobes-based dynamic events"
         depends on ARCH_SUPPORTS_UPROBES
         depends on MMU
@@ -466,7 +466,7 @@ config UPROBE_EVENT
 
 config BPF_EVENTS
         depends on BPF_SYSCALL
-        depends on (KPROBE_EVENT || UPROBE_EVENT) && PERF_EVENTS
+        depends on (KPROBE_EVENTS || UPROBE_EVENTS) && PERF_EVENTS
         bool
         default y
         help
diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
index e57980845549..90f2701d92a7 100644
--- a/kernel/trace/Makefile
+++ b/kernel/trace/Makefile
@@ -57,7 +57,7 @@ obj-$(CONFIG_EVENT_TRACING) += trace_events_filter.o
 obj-$(CONFIG_EVENT_TRACING) += trace_events_trigger.o
 obj-$(CONFIG_HIST_TRIGGERS) += trace_events_hist.o
 obj-$(CONFIG_BPF_EVENTS) += bpf_trace.o
-obj-$(CONFIG_KPROBE_EVENT) += trace_kprobe.o
+obj-$(CONFIG_KPROBE_EVENTS) += trace_kprobe.o
 obj-$(CONFIG_TRACEPOINTS) += power-traces.o
 ifeq ($(CONFIG_PM),y)
 obj-$(CONFIG_TRACEPOINTS) += rpm-traces.o
@@ -66,7 +66,7 @@ ifeq ($(CONFIG_TRACING),y)
 obj-$(CONFIG_KGDB_KDB) += trace_kdb.o
 endif
 obj-$(CONFIG_PROBE_EVENTS) += trace_probe.o
-obj-$(CONFIG_UPROBE_EVENT) += trace_uprobe.o
+obj-$(CONFIG_UPROBE_EVENTS) += trace_uprobe.o
 
 obj-$(CONFIG_TRACEPOINT_BENCHMARK) += trace_benchmark.o
 
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 0d1597c9ee30..b9691ee8f6c1 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4416,16 +4416,24 @@ static int __init set_graph_notrace_function(char *str)
 }
 __setup("ftrace_graph_notrace=", set_graph_notrace_function);
 
+static int __init set_graph_max_depth_function(char *str)
+{
+        if (!str)
+                return 0;
+        fgraph_max_depth = simple_strtoul(str, NULL, 0);
+        return 1;
+}
+__setup("ftrace_graph_max_depth=", set_graph_max_depth_function);
+
 static void __init set_ftrace_early_graph(char *buf, int enable)
 {
         int ret;
         char *func;
         struct ftrace_hash *hash;
 
-        if (enable)
-                hash = ftrace_graph_hash;
-        else
-                hash = ftrace_graph_notrace_hash;
+        hash = alloc_ftrace_hash(FTRACE_HASH_DEFAULT_BITS);
+        if (WARN_ON(!hash))
+                return;
 
         while (buf) {
                 func = strsep(&buf, ",");
@@ -4435,6 +4443,11 @@ static void __init set_ftrace_early_graph(char *buf, int enable)
                         printk(KERN_DEBUG "ftrace: function %s not "
                                           "traceable\n", func);
         }
+
+        if (enable)
+                ftrace_graph_hash = hash;
+        else
+                ftrace_graph_notrace_hash = hash;
 }
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
 
@@ -5488,7 +5501,7 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip,
  * Normally the mcount trampoline will call the ops->func, but there
  * are times that it should not. For example, if the ops does not
  * have its own recursion protection, then it should call the
- * ftrace_ops_recurs_func() instead.
+ * ftrace_ops_assist_func() instead.
  *
  * Returns the function that the trampoline should call for @ops.
  */
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 707445ceb7ef..f35109514a01 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4341,22 +4341,22 @@ static const char readme_msg[] =
         "\t\t\t  traces\n"
 #endif
 #endif /* CONFIG_STACK_TRACER */
-#ifdef CONFIG_KPROBE_EVENT
+#ifdef CONFIG_KPROBE_EVENTS
         "  kprobe_events\t\t- Add/remove/show the kernel dynamic events\n"
         "\t\t\t  Write into this file to define/undefine new trace events.\n"
 #endif
-#ifdef CONFIG_UPROBE_EVENT
+#ifdef CONFIG_UPROBE_EVENTS
         "  uprobe_events\t\t- Add/remove/show the userspace dynamic events\n"
         "\t\t\t  Write into this file to define/undefine new trace events.\n"
 #endif
-#if defined(CONFIG_KPROBE_EVENT) || defined(CONFIG_UPROBE_EVENT)
+#if defined(CONFIG_KPROBE_EVENTS) || defined(CONFIG_UPROBE_EVENTS)
         "\t  accepts: event-definitions (one definition per line)\n"
         "\t   Format: p|r[:[<group>/]<event>] <place> [<args>]\n"
         "\t           -:[<group>/]<event>\n"
-#ifdef CONFIG_KPROBE_EVENT
+#ifdef CONFIG_KPROBE_EVENTS
         "\t    place: [<module>:]<symbol>[+<offset>]|<memaddr>\n"
 #endif
-#ifdef CONFIG_UPROBE_EVENT
+#ifdef CONFIG_UPROBE_EVENTS
         "\t    place: <path>:<offset>\n"
 #endif
         "\t     args: <name>=fetcharg[:type]\n"
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index 0c0ae54d44c6..903273c93e61 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -248,7 +248,7 @@ ASSIGN_FETCH_FUNC(file_offset, ftype),			\
 #define FETCH_TYPE_STRING       0
 #define FETCH_TYPE_STRSIZE      1
 
-#ifdef CONFIG_KPROBE_EVENT
+#ifdef CONFIG_KPROBE_EVENTS
 struct symbol_cache;
 unsigned long update_symbol_cache(struct symbol_cache *sc);
 void free_symbol_cache(struct symbol_cache *sc);
@@ -278,7 +278,7 @@ alloc_symbol_cache(const char *sym, long offset)
 {
         return NULL;
 }
-#endif /* CONFIG_KPROBE_EVENT */
+#endif /* CONFIG_KPROBE_EVENTS */
 
 struct probe_arg {
         struct fetch_param      fetch;
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 1d68b5b7ad41..5fb1f2c87e6b 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -65,7 +65,7 @@ void stack_trace_print(void)
 }
 
 /*
- * When arch-specific code overides this function, the following
+ * When arch-specific code overrides this function, the following
  * data should be filled up, assuming stack_trace_max_lock is held to
  * prevent concurrent updates.
  *     stack_trace_index[]
diff --git a/kernel/ucount.c b/kernel/ucount.c
index 62630a40ab3a..b4eeee03934f 100644
--- a/kernel/ucount.c
+++ b/kernel/ucount.c
@@ -144,7 +144,7 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
 
                 new->ns = ns;
                 new->uid = uid;
-                atomic_set(&new->count, 0);
+                new->count = 0;
 
                 spin_lock_irq(&ucounts_lock);
                 ucounts = find_ucounts(ns, uid, hashent);
@@ -155,8 +155,10 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
                         ucounts = new;
                 }
         }
-        if (!atomic_add_unless(&ucounts->count, 1, INT_MAX))
+        if (ucounts->count == INT_MAX)
                 ucounts = NULL;
+        else
+                ucounts->count += 1;
         spin_unlock_irq(&ucounts_lock);
         return ucounts;
 }
@@ -165,13 +167,15 @@ static void put_ucounts(struct ucounts *ucounts)
 {
         unsigned long flags;
 
-        if (atomic_dec_and_test(&ucounts->count)) {
-                spin_lock_irqsave(&ucounts_lock, flags);
+        spin_lock_irqsave(&ucounts_lock, flags);
+        ucounts->count -= 1;
+        if (!ucounts->count)
                 hlist_del_init(&ucounts->node);
-                spin_unlock_irqrestore(&ucounts_lock, flags);
+        else
+                ucounts = NULL;
+        spin_unlock_irqrestore(&ucounts_lock, flags);
 
-                kfree(ucounts);
-        }
+        kfree(ucounts);
 }
 
 static inline bool atomic_inc_below(atomic_t *v, int u)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 072cbc9b175d..c0168b7da1ea 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1507,6 +1507,7 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq,
         struct timer_list *timer = &dwork->timer;
         struct work_struct *work = &dwork->work;
 
+        WARN_ON_ONCE(!wq);
         WARN_ON_ONCE(timer->function != delayed_work_timer_fn ||
                      timer->data != (unsigned long)dwork);
         WARN_ON_ONCE(timer_pending(timer));
diff --git a/lib/ioremap.c b/lib/ioremap.c
index a3e14ce92a56..4bb30206b942 100644
--- a/lib/ioremap.c
+++ b/lib/ioremap.c
@@ -14,6 +14,7 @@
 #include <asm/pgtable.h>
 
 #ifdef CONFIG_HAVE_ARCH_HUGE_VMAP
+static int __read_mostly ioremap_p4d_capable;
 static int __read_mostly ioremap_pud_capable;
 static int __read_mostly ioremap_pmd_capable;
 static int __read_mostly ioremap_huge_disabled;
@@ -35,6 +36,11 @@ void __init ioremap_huge_init(void)
         }
 }
 
+static inline int ioremap_p4d_enabled(void)
+{
+        return ioremap_p4d_capable;
+}
+
 static inline int ioremap_pud_enabled(void)
 {
         return ioremap_pud_capable;
@@ -46,6 +52,7 @@ static inline int ioremap_pmd_enabled(void)
 }
 
 #else   /* !CONFIG_HAVE_ARCH_HUGE_VMAP */
+static inline int ioremap_p4d_enabled(void) { return 0; }
 static inline int ioremap_pud_enabled(void) { return 0; }
 static inline int ioremap_pmd_enabled(void) { return 0; }
 #endif  /* CONFIG_HAVE_ARCH_HUGE_VMAP */
@@ -94,14 +101,14 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr,
         return 0;
 }
 
-static inline int ioremap_pud_range(pgd_t *pgd, unsigned long addr,
+static inline int ioremap_pud_range(p4d_t *p4d, unsigned long addr,
                 unsigned long end, phys_addr_t phys_addr, pgprot_t prot)
 {
         pud_t *pud;
         unsigned long next;
 
         phys_addr -= addr;
-        pud = pud_alloc(&init_mm, pgd, addr);
+        pud = pud_alloc(&init_mm, p4d, addr);
         if (!pud)
                 return -ENOMEM;
         do {
@@ -120,6 +127,32 @@ static inline int ioremap_pud_range(pgd_t *pgd, unsigned long addr,
         return 0;
 }
 
+static inline int ioremap_p4d_range(pgd_t *pgd, unsigned long addr,
+                unsigned long end, phys_addr_t phys_addr, pgprot_t prot)
+{
+        p4d_t *p4d;
+        unsigned long next;
+
+        phys_addr -= addr;
+        p4d = p4d_alloc(&init_mm, pgd, addr);
+        if (!p4d)
+                return -ENOMEM;
+        do {
+                next = p4d_addr_end(addr, end);
+
+                if (ioremap_p4d_enabled() &&
+                    ((next - addr) == P4D_SIZE) &&
+                    IS_ALIGNED(phys_addr + addr, P4D_SIZE)) {
+                        if (p4d_set_huge(p4d, phys_addr + addr, prot))
+                                continue;
+                }
+
+                if (ioremap_pud_range(p4d, addr, next, phys_addr + addr, prot))
+                        return -ENOMEM;
+        } while (p4d++, addr = next, addr != end);
+        return 0;
+}
+
 int ioremap_page_range(unsigned long addr,
                        unsigned long end, phys_addr_t phys_addr, pgprot_t prot)
 {
@@ -135,7 +168,7 @@ int ioremap_page_range(unsigned long addr,
         pgd = pgd_offset_k(addr);
         do {
                 next = pgd_addr_end(addr, end);
-                err = ioremap_pud_range(pgd, addr, next, phys_addr+addr, prot);
+                err = ioremap_p4d_range(pgd, addr, next, phys_addr+addr, prot);
                 if (err)
                         break;
         } while (pgd++, addr = next, addr != end);
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 5ed506d648c4..691a9ad48497 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -2129,8 +2129,8 @@ int ida_pre_get(struct ida *ida, gfp_t gfp)
                 struct ida_bitmap *bitmap = kmalloc(sizeof(*bitmap), gfp);
                 if (!bitmap)
                         return 0;
-                bitmap = this_cpu_cmpxchg(ida_bitmap, NULL, bitmap);
-                kfree(bitmap);
+                if (this_cpu_cmpxchg(ida_bitmap, NULL, bitmap))
+                        kfree(bitmap);
         }
 
         return 1;
diff --git a/lib/refcount.c b/lib/refcount.c
index 1d33366189d1..aa09ad3c30b0 100644
--- a/lib/refcount.c
+++ b/lib/refcount.c
@@ -58,7 +58,7 @@ bool refcount_add_not_zero(unsigned int i, refcount_t *r)
                 val = old;
         }
 
-        WARN(new == UINT_MAX, "refcount_t: saturated; leaking memory.\n");
+        WARN_ONCE(new == UINT_MAX, "refcount_t: saturated; leaking memory.\n");
 
         return true;
 }
@@ -66,7 +66,7 @@ EXPORT_SYMBOL_GPL(refcount_add_not_zero);
 
 void refcount_add(unsigned int i, refcount_t *r)
 {
-        WARN(!refcount_add_not_zero(i, r), "refcount_t: addition on 0; use-after-free.\n");
+        WARN_ONCE(!refcount_add_not_zero(i, r), "refcount_t: addition on 0; use-after-free.\n");
 }
 EXPORT_SYMBOL_GPL(refcount_add);
 
@@ -97,7 +97,7 @@ bool refcount_inc_not_zero(refcount_t *r)
                 val = old;
         }
 
-        WARN(new == UINT_MAX, "refcount_t: saturated; leaking memory.\n");
+        WARN_ONCE(new == UINT_MAX, "refcount_t: saturated; leaking memory.\n");
 
         return true;
 }
@@ -111,7 +111,7 @@ EXPORT_SYMBOL_GPL(refcount_inc_not_zero);
  */
 void refcount_inc(refcount_t *r)
 {
-        WARN(!refcount_inc_not_zero(r), "refcount_t: increment on 0; use-after-free.\n");
+        WARN_ONCE(!refcount_inc_not_zero(r), "refcount_t: increment on 0; use-after-free.\n");
 }
 EXPORT_SYMBOL_GPL(refcount_inc);
 
@@ -125,7 +125,7 @@ bool refcount_sub_and_test(unsigned int i, refcount_t *r)
 
                 new = val - i;
                 if (new > val) {
-                        WARN(new > val, "refcount_t: underflow; use-after-free.\n");
+                        WARN_ONCE(new > val, "refcount_t: underflow; use-after-free.\n");
                         return false;
                 }
 
@@ -164,7 +164,7 @@ EXPORT_SYMBOL_GPL(refcount_dec_and_test);
 
 void refcount_dec(refcount_t *r)
 {
-        WARN(refcount_dec_and_test(r), "refcount_t: decrement hit 0; leaking memory.\n");
+        WARN_ONCE(refcount_dec_and_test(r), "refcount_t: decrement hit 0; leaking memory.\n");
 }
 EXPORT_SYMBOL_GPL(refcount_dec);
 
@@ -204,7 +204,7 @@ bool refcount_dec_not_one(refcount_t *r)
 
                 new = val - 1;
                 if (new > val) {
-                        WARN(new > val, "refcount_t: underflow; use-after-free.\n");
+                        WARN_ONCE(new > val, "refcount_t: underflow; use-after-free.\n");
                         return true;
                 }
 
diff --git a/lib/syscall.c b/lib/syscall.c
index 17d5ff5fa6a3..2c6cd1b5c3ea 100644
--- a/lib/syscall.c
+++ b/lib/syscall.c
@@ -12,6 +12,7 @@ static int collect_syscall(struct task_struct *target, long *callno,
 
         if (!try_get_task_stack(target)) {
                 /* Task has no stack, so the task isn't in a syscall. */
+                *sp = *pc = 0;
                 *callno = -1;
                 return 0;
         }
diff --git a/lib/test_kasan.c b/lib/test_kasan.c
index 0b1d3140fbb8..a25c9763fce1 100644
--- a/lib/test_kasan.c
+++ b/lib/test_kasan.c
@@ -20,6 +20,7 @@
 #include <linux/string.h>
 #include <linux/uaccess.h>
 #include <linux/module.h>
+#include <linux/kasan.h>
 
 /*
  * Note: test functions are marked noinline so that their names appear in
@@ -474,6 +475,12 @@ static noinline void __init use_after_scope_test(void)
 
 static int __init kmalloc_tests_init(void)
 {
+        /*
+         * Temporarily enable multi-shot mode. Otherwise, we'd only get a
+         * report for the first case.
+         */
+        bool multishot = kasan_save_enable_multi_shot();
+
         kmalloc_oob_right();
         kmalloc_oob_left();
         kmalloc_node_oob_right();
@@ -499,6 +506,9 @@ static int __init kmalloc_tests_init(void)
         ksize_unpoisons_memory();
         copy_user_test();
         use_after_scope_test();
+
+        kasan_restore_multi_shot(multishot);
+
         return -EAGAIN;
 }
 
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 6d861d090e9f..c6f2a37028c2 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -683,33 +683,26 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi)
 static void cgwb_bdi_destroy(struct backing_dev_info *bdi)
 {
         struct radix_tree_iter iter;
-        struct rb_node *rbn;
         void **slot;
 
         WARN_ON(test_bit(WB_registered, &bdi->wb.state));
 
         spin_lock_irq(&cgwb_lock);
-
         radix_tree_for_each_slot(slot, &bdi->cgwb_tree, &iter, 0)
                 cgwb_kill(*slot);
-
-        while ((rbn = rb_first(&bdi->cgwb_congested_tree))) {
-                struct bdi_writeback_congested *congested =
-                        rb_entry(rbn, struct bdi_writeback_congested, rb_node);
-
-                rb_erase(rbn, &bdi->cgwb_congested_tree);
-                congested->bdi = NULL;  /* mark @congested unlinked */
-        }
-
         spin_unlock_irq(&cgwb_lock);
 
         /*
-         * All cgwb's and their congested states must be shutdown and
-         * released before returning.  Drain the usage counter to wait for
-         * all cgwb's and cgwb_congested's ever created on @bdi.
+         * All cgwb's must be shutdown and released before returning.  Drain
+         * the usage counter to wait for all cgwb's ever created on @bdi.
          */
         atomic_dec(&bdi->usage_cnt);
         wait_event(cgwb_release_wait, !atomic_read(&bdi->usage_cnt));
+        /*
+         * Grab back our reference so that we hold it when @bdi gets
+         * re-registered.
+         */
+        atomic_inc(&bdi->usage_cnt);
 }
 
 /**
@@ -749,6 +742,21 @@ void wb_blkcg_offline(struct blkcg *blkcg)
         spin_unlock_irq(&cgwb_lock);
 }
 
+static void cgwb_bdi_exit(struct backing_dev_info *bdi)
+{
+        struct rb_node *rbn;
+
+        spin_lock_irq(&cgwb_lock);
+        while ((rbn = rb_first(&bdi->cgwb_congested_tree))) {
+                struct bdi_writeback_congested *congested =
+                        rb_entry(rbn, struct bdi_writeback_congested, rb_node);
+
+                rb_erase(rbn, &bdi->cgwb_congested_tree);
+                congested->bdi = NULL;  /* mark @congested unlinked */
+        }
+        spin_unlock_irq(&cgwb_lock);
+}
+
 #else   /* CONFIG_CGROUP_WRITEBACK */
 
 static int cgwb_bdi_init(struct backing_dev_info *bdi)
@@ -769,7 +777,9 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi)
         return 0;
 }
 
-static void cgwb_bdi_destroy(struct backing_dev_info *bdi)
+static void cgwb_bdi_destroy(struct backing_dev_info *bdi) { }
+
+static void cgwb_bdi_exit(struct backing_dev_info *bdi)
 {
         wb_congested_put(bdi->wb_congested);
 }
@@ -857,6 +867,8 @@ int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner)
                         MINOR(owner->devt));
         if (rc)
                 return rc;
+        /* Leaking owner reference... */
+        WARN_ON(bdi->owner);
         bdi->owner = owner;
         get_device(owner);
         return 0;
@@ -898,6 +910,7 @@ static void bdi_exit(struct backing_dev_info *bdi)
 {
         WARN_ON_ONCE(bdi->dev);
         wb_exit(&bdi->wb);
+        cgwb_bdi_exit(bdi);
 }
 
 static void release_bdi(struct kref *ref)
diff --git a/mm/gup.c b/mm/gup.c
index 9c047e951aa3..04aa405350dc 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -226,6 +226,7 @@ struct page *follow_page_mask(struct vm_area_struct *vma,
                               unsigned int *page_mask)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
         spinlock_t *ptl;
@@ -243,8 +244,13 @@ struct page *follow_page_mask(struct vm_area_struct *vma,
         pgd = pgd_offset(mm, address);
         if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd)))
                 return no_page_table(vma, flags);
-
-        pud = pud_offset(pgd, address);
+        p4d = p4d_offset(pgd, address);
+        if (p4d_none(*p4d))
+                return no_page_table(vma, flags);
+        BUILD_BUG_ON(p4d_huge(*p4d));
+        if (unlikely(p4d_bad(*p4d)))
+                return no_page_table(vma, flags);
+        pud = pud_offset(p4d, address);
         if (pud_none(*pud))
                 return no_page_table(vma, flags);
         if (pud_huge(*pud) && vma->vm_flags & VM_HUGETLB) {
@@ -325,6 +331,7 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
                 struct page **page)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
         pte_t *pte;
@@ -338,7 +345,9 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
         else
                 pgd = pgd_offset_gate(mm, address);
         BUG_ON(pgd_none(*pgd));
-        pud = pud_offset(pgd, address);
+        p4d = p4d_offset(pgd, address);
+        BUG_ON(p4d_none(*p4d));
+        pud = pud_offset(p4d, address);
         BUG_ON(pud_none(*pud));
         pmd = pmd_offset(pud, address);
         if (pmd_none(*pmd))
@@ -1400,13 +1409,13 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
         return 1;
 }
 
-static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end,
+static int gup_pud_range(p4d_t p4d, unsigned long addr, unsigned long end,
                          int write, struct page **pages, int *nr)
 {
         unsigned long next;
         pud_t *pudp;
 
-        pudp = pud_offset(&pgd, addr);
+        pudp = pud_offset(&p4d, addr);
         do {
                 pud_t pud = READ_ONCE(*pudp);
 
@@ -1428,6 +1437,31 @@ static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end,
         return 1;
 }
 
+static int gup_p4d_range(pgd_t pgd, unsigned long addr, unsigned long end,
+                         int write, struct page **pages, int *nr)
+{
+        unsigned long next;
+        p4d_t *p4dp;
+
+        p4dp = p4d_offset(&pgd, addr);
+        do {
+                p4d_t p4d = READ_ONCE(*p4dp);
+
+                next = p4d_addr_end(addr, end);
+                if (p4d_none(p4d))
+                        return 0;
+                BUILD_BUG_ON(p4d_huge(p4d));
+                if (unlikely(is_hugepd(__hugepd(p4d_val(p4d))))) {
+                        if (!gup_huge_pd(__hugepd(p4d_val(p4d)), addr,
+                                         P4D_SHIFT, next, write, pages, nr))
+                                return 0;
+                } else if (!gup_pud_range(p4d, addr, next, write, pages, nr))
+                        return 0;
+        } while (p4dp++, addr = next, addr != end);
+
+        return 1;
+}
+
 /*
  * Like get_user_pages_fast() except it's IRQ-safe in that it won't fall back to
  * the regular GUP. It will only return non-negative values.
@@ -1478,7 +1512,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
                         if (!gup_huge_pd(__hugepd(pgd_val(pgd)), addr,
                                          PGDIR_SHIFT, next, write, pages, &nr))
                                 break;
-                } else if (!gup_pud_range(pgd, addr, next, write, pages, &nr))
+                } else if (!gup_p4d_range(pgd, addr, next, write, pages, &nr))
                         break;
         } while (pgdp++, addr = next, addr != end);
         local_irq_restore(flags);
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index d36b2af4d1bf..1ebc93e179f3 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1828,7 +1828,7 @@ static void __split_huge_pud_locked(struct vm_area_struct *vma, pud_t *pud,
         VM_BUG_ON_VMA(vma->vm_end < haddr + HPAGE_PUD_SIZE, vma);
         VM_BUG_ON(!pud_trans_huge(*pud) && !pud_devmap(*pud));
 
-        count_vm_event(THP_SPLIT_PMD);
+        count_vm_event(THP_SPLIT_PUD);
 
         pudp_huge_clear_flush_notify(vma, haddr, pud);
 }
@@ -2048,6 +2048,7 @@ void split_huge_pmd_address(struct vm_area_struct *vma, unsigned long address,
                 bool freeze, struct page *page)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
 
@@ -2055,7 +2056,11 @@ void split_huge_pmd_address(struct vm_area_struct *vma, unsigned long address,
         if (!pgd_present(*pgd))
                 return;
 
-        pud = pud_offset(pgd, address);
+        p4d = p4d_offset(pgd, address);
+        if (!p4d_present(*p4d))
+                return;
+
+        pud = pud_offset(p4d, address);
         if (!pud_present(*pud))
                 return;
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index a7aa811b7d14..e5828875f7bb 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4403,7 +4403,9 @@ int hugetlb_reserve_pages(struct inode *inode,
         return 0;
 out_err:
         if (!vma || vma->vm_flags & VM_MAYSHARE)
-                region_abort(resv_map, from, to);
+                /* Don't call region_abort if region_chg failed */
+                if (chg >= 0)
+                        region_abort(resv_map, from, to);
         if (vma && is_vma_resv_set(vma, HPAGE_RESV_OWNER))
                 kref_put(&resv_map->refs, resv_map_release);
         return ret;
@@ -4555,7 +4557,8 @@ out:
 int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
 {
         pgd_t *pgd = pgd_offset(mm, *addr);
-        pud_t *pud = pud_offset(pgd, *addr);
+        p4d_t *p4d = p4d_offset(pgd, *addr);
+        pud_t *pud = pud_offset(p4d, *addr);
 
         BUG_ON(page_count(virt_to_page(ptep)) == 0);
         if (page_count(virt_to_page(ptep)) == 1)
@@ -4586,11 +4589,13 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                         unsigned long addr, unsigned long sz)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pte_t *pte = NULL;
 
         pgd = pgd_offset(mm, addr);
-        pud = pud_alloc(mm, pgd, addr);
+        p4d = p4d_offset(pgd, addr);
+        pud = pud_alloc(mm, p4d, addr);
         if (pud) {
                 if (sz == PUD_SIZE) {
                         pte = (pte_t *)pud;
@@ -4610,18 +4615,22 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
 pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
-        pmd_t *pmd = NULL;
+        pmd_t *pmd;
 
         pgd = pgd_offset(mm, addr);
-        if (pgd_present(*pgd)) {
-                pud = pud_offset(pgd, addr);
-                if (pud_present(*pud)) {
-                        if (pud_huge(*pud))
-                                return (pte_t *)pud;
-                        pmd = pmd_offset(pud, addr);
-                }
-        }
+        if (!pgd_present(*pgd))
+                return NULL;
+        p4d = p4d_offset(pgd, addr);
+        if (!p4d_present(*p4d))
+                return NULL;
+        pud = pud_offset(p4d, addr);
+        if (!pud_present(*pud))
+                return NULL;
+        if (pud_huge(*pud))
+                return (pte_t *)pud;
+        pmd = pmd_offset(pud, addr);
         return (pte_t *) pmd;
 }
 
@@ -4644,6 +4653,7 @@ follow_huge_pmd(struct mm_struct *mm, unsigned long address,
 {
         struct page *page = NULL;
         spinlock_t *ptl;
+        pte_t pte;
 retry:
         ptl = pmd_lockptr(mm, pmd);
         spin_lock(ptl);
@@ -4653,12 +4663,13 @@ retry:
          */
         if (!pmd_huge(*pmd))
                 goto out;
-        if (pmd_present(*pmd)) {
+        pte = huge_ptep_get((pte_t *)pmd);
+        if (pte_present(pte)) {
                 page = pmd_page(*pmd) + ((address & ~PMD_MASK) >> PAGE_SHIFT);
                 if (flags & FOLL_GET)
                         get_page(page);
         } else {
-                if (is_hugetlb_entry_migration(huge_ptep_get((pte_t *)pmd))) {
+                if (is_hugetlb_entry_migration(pte)) {
                         spin_unlock(ptl);
                         __migration_entry_wait(mm, (pte_t *)pmd, ptl);
                         goto retry;
diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
index 1c260e6b3b3c..dd2dea8eb077 100644
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -96,11 +96,6 @@ static inline const void *kasan_shadow_to_mem(const void *shadow_addr)
                 << KASAN_SHADOW_SCALE_SHIFT);
 }
 
-static inline bool kasan_report_enabled(void)
-{
-        return !current->kasan_depth;
-}
-
 void kasan_report(unsigned long addr, size_t size,
                 bool is_write, unsigned long ip);
 void kasan_report_double_free(struct kmem_cache *cache, void *object,
diff --git a/mm/kasan/kasan_init.c b/mm/kasan/kasan_init.c
index 31238dad85fb..b96a5f773d88 100644
--- a/mm/kasan/kasan_init.c
+++ b/mm/kasan/kasan_init.c
@@ -30,6 +30,9 @@
  */
 unsigned char kasan_zero_page[PAGE_SIZE] __page_aligned_bss;
 
+#if CONFIG_PGTABLE_LEVELS > 4
+p4d_t kasan_zero_p4d[PTRS_PER_P4D] __page_aligned_bss;
+#endif
 #if CONFIG_PGTABLE_LEVELS > 3
 pud_t kasan_zero_pud[PTRS_PER_PUD] __page_aligned_bss;
 #endif
@@ -82,10 +85,10 @@ static void __init zero_pmd_populate(pud_t *pud, unsigned long addr,
         } while (pmd++, addr = next, addr != end);
 }
 
-static void __init zero_pud_populate(pgd_t *pgd, unsigned long addr,
+static void __init zero_pud_populate(p4d_t *p4d, unsigned long addr,
                                 unsigned long end)
 {
-        pud_t *pud = pud_offset(pgd, addr);
+        pud_t *pud = pud_offset(p4d, addr);
         unsigned long next;
 
         do {
@@ -107,6 +110,23 @@ static void __init zero_pud_populate(pgd_t *pgd, unsigned long addr,
         } while (pud++, addr = next, addr != end);
 }
 
+static void __init zero_p4d_populate(pgd_t *pgd, unsigned long addr,
+                                unsigned long end)
+{
+        p4d_t *p4d = p4d_offset(pgd, addr);
+        unsigned long next;
+
+        do {
+                next = p4d_addr_end(addr, end);
+
+                if (p4d_none(*p4d)) {
+                        p4d_populate(&init_mm, p4d,
+                                early_alloc(PAGE_SIZE, NUMA_NO_NODE));
+                }
+                zero_pud_populate(p4d, addr, next);
+        } while (p4d++, addr = next, addr != end);
+}
+
 /**
  * kasan_populate_zero_shadow - populate shadow memory region with
  *                               kasan_zero_page
@@ -125,6 +145,7 @@ void __init kasan_populate_zero_shadow(const void *shadow_start,
                 next = pgd_addr_end(addr, end);
 
                 if (IS_ALIGNED(addr, PGDIR_SIZE) && end - addr >= PGDIR_SIZE) {
+                        p4d_t *p4d;
                         pud_t *pud;
                         pmd_t *pmd;
 
@@ -135,9 +156,22 @@ void __init kasan_populate_zero_shadow(const void *shadow_start,
                          * 3,2 - level page tables where we don't have
                          * puds,pmds, so pgd_populate(), pud_populate()
                          * is noops.
+                         *
+                         * The ifndef is required to avoid build breakage.
+                         *
+                         * With 5level-fixup.h, pgd_populate() is not nop and
+                         * we reference kasan_zero_p4d. It's not defined
+                         * unless 5-level paging enabled.
+                         *
+                         * The ifndef can be dropped once all KASAN-enabled
+                         * architectures will switch to pgtable-nop4d.h.
                          */
-                        pgd_populate(&init_mm, pgd, lm_alias(kasan_zero_pud));
-                        pud = pud_offset(pgd, addr);
+#ifndef __ARCH_HAS_5LEVEL_HACK
+                        pgd_populate(&init_mm, pgd, lm_alias(kasan_zero_p4d));
+#endif
+                        p4d = p4d_offset(pgd, addr);
+                        p4d_populate(&init_mm, p4d, lm_alias(kasan_zero_pud));
+                        pud = pud_offset(p4d, addr);
                         pud_populate(&init_mm, pud, lm_alias(kasan_zero_pmd));
                         pmd = pmd_offset(pud, addr);
                         pmd_populate_kernel(&init_mm, pmd, lm_alias(kasan_zero_pte));
@@ -148,6 +182,6 @@ void __init kasan_populate_zero_shadow(const void *shadow_start,
                         pgd_populate(&init_mm, pgd,
                                 early_alloc(PAGE_SIZE, NUMA_NO_NODE));
                 }
-                zero_pud_populate(pgd, addr, next);
+                zero_p4d_populate(pgd, addr, next);
         } while (pgd++, addr = next, addr != end);
 }
diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
index 6f1ed1630873..3a8ddf8baf7d 100644
--- a/mm/kasan/quarantine.c
+++ b/mm/kasan/quarantine.c
@@ -25,6 +25,7 @@
 #include <linux/printk.h>
 #include <linux/shrinker.h>
 #include <linux/slab.h>
+#include <linux/srcu.h>
 #include <linux/string.h>
 #include <linux/types.h>
 
@@ -103,6 +104,7 @@ static int quarantine_tail;
 /* Total size of all objects in global_quarantine across all batches. */
 static unsigned long quarantine_size;
 static DEFINE_SPINLOCK(quarantine_lock);
+DEFINE_STATIC_SRCU(remove_cache_srcu);
 
 /* Maximum size of the global queue. */
 static unsigned long quarantine_max_size;
@@ -173,17 +175,22 @@ void quarantine_put(struct kasan_free_meta *info, struct kmem_cache *cache)
         struct qlist_head *q;
         struct qlist_head temp = QLIST_INIT;
 
+        /*
+         * Note: irq must be disabled until after we move the batch to the
+         * global quarantine. Otherwise quarantine_remove_cache() can miss
+         * some objects belonging to the cache if they are in our local temp
+         * list. quarantine_remove_cache() executes on_each_cpu() at the
+         * beginning which ensures that it either sees the objects in per-cpu
+         * lists or in the global quarantine.
+         */
         local_irq_save(flags);
 
         q = this_cpu_ptr(&cpu_quarantine);
         qlist_put(q, &info->quarantine_link, cache->size);
-        if (unlikely(q->bytes > QUARANTINE_PERCPU_SIZE))
+        if (unlikely(q->bytes > QUARANTINE_PERCPU_SIZE)) {
                 qlist_move_all(q, &temp);
 
-        local_irq_restore(flags);
-
-        if (unlikely(!qlist_empty(&temp))) {
-                spin_lock_irqsave(&quarantine_lock, flags);
+                spin_lock(&quarantine_lock);
                 WRITE_ONCE(quarantine_size, quarantine_size + temp.bytes);
                 qlist_move_all(&temp, &global_quarantine[quarantine_tail]);
                 if (global_quarantine[quarantine_tail].bytes >=
@@ -196,20 +203,33 @@ void quarantine_put(struct kasan_free_meta *info, struct kmem_cache *cache)
                         if (new_tail != quarantine_head)
                                 quarantine_tail = new_tail;
                 }
-                spin_unlock_irqrestore(&quarantine_lock, flags);
+                spin_unlock(&quarantine_lock);
         }
+
+        local_irq_restore(flags);
 }
 
 void quarantine_reduce(void)
 {
         size_t total_size, new_quarantine_size, percpu_quarantines;
         unsigned long flags;
+        int srcu_idx;
         struct qlist_head to_free = QLIST_INIT;
 
         if (likely(READ_ONCE(quarantine_size) <=
                    READ_ONCE(quarantine_max_size)))
                 return;
 
+        /*
+         * srcu critical section ensures that quarantine_remove_cache()
+         * will not miss objects belonging to the cache while they are in our
+         * local to_free list. srcu is chosen because (1) it gives us private
+         * grace period domain that does not interfere with anything else,
+         * and (2) it allows synchronize_srcu() to return without waiting
+         * if there are no pending read critical sections (which is the
+         * expected case).
+         */
+        srcu_idx = srcu_read_lock(&remove_cache_srcu);
         spin_lock_irqsave(&quarantine_lock, flags);
 
         /*
@@ -237,6 +257,7 @@ void quarantine_reduce(void)
         spin_unlock_irqrestore(&quarantine_lock, flags);
 
         qlist_free_all(&to_free, NULL);
+        srcu_read_unlock(&remove_cache_srcu, srcu_idx);
 }
 
 static void qlist_move_cache(struct qlist_head *from,
@@ -280,12 +301,28 @@ void quarantine_remove_cache(struct kmem_cache *cache)
         unsigned long flags, i;
         struct qlist_head to_free = QLIST_INIT;
 
+        /*
+         * Must be careful to not miss any objects that are being moved from
+         * per-cpu list to the global quarantine in quarantine_put(),
+         * nor objects being freed in quarantine_reduce(). on_each_cpu()
+         * achieves the first goal, while synchronize_srcu() achieves the
+         * second.
+         */
         on_each_cpu(per_cpu_remove_cache, cache, 1);
 
         spin_lock_irqsave(&quarantine_lock, flags);
-        for (i = 0; i < QUARANTINE_BATCHES; i++)
+        for (i = 0; i < QUARANTINE_BATCHES; i++) {
+                if (qlist_empty(&global_quarantine[i]))
+                        continue;
                 qlist_move_cache(&global_quarantine[i], &to_free, cache);
+                /* Scanning whole quarantine can take a while. */
+                spin_unlock_irqrestore(&quarantine_lock, flags);
+                cond_resched();
+                spin_lock_irqsave(&quarantine_lock, flags);
+        }
         spin_unlock_irqrestore(&quarantine_lock, flags);
 
         qlist_free_all(&to_free, cache);
+
+        synchronize_srcu(&remove_cache_srcu);
 }
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index f479365530b6..ab42a0803f16 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -13,7 +13,9 @@
  *
  */
 
+#include <linux/bitops.h>
 #include <linux/ftrace.h>
+#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/printk.h>
@@ -293,6 +295,40 @@ static void kasan_report_error(struct kasan_access_info *info)
         kasan_end_report(&flags);
 }
 
+static unsigned long kasan_flags;
+
+#define KASAN_BIT_REPORTED      0
+#define KASAN_BIT_MULTI_SHOT    1
+
+bool kasan_save_enable_multi_shot(void)
+{
+        return test_and_set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
+}
+EXPORT_SYMBOL_GPL(kasan_save_enable_multi_shot);
+
+void kasan_restore_multi_shot(bool enabled)
+{
+        if (!enabled)
+                clear_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
+}
+EXPORT_SYMBOL_GPL(kasan_restore_multi_shot);
+
+static int __init kasan_set_multi_shot(char *str)
+{
+        set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
+        return 1;
+}
+__setup("kasan_multi_shot", kasan_set_multi_shot);
+
+static inline bool kasan_report_enabled(void)
+{
+        if (current->kasan_depth)
+                return false;
+        if (test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
+                return true;
+        return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags);
+}
+
 void kasan_report(unsigned long addr, size_t size,
                 bool is_write, unsigned long ip)
 {
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 26c874e90b12..20036d4f9f13 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1416,7 +1416,7 @@ static void kmemleak_scan(void)
         /* data/bss scanning */
         scan_large_block(_sdata, _edata);
         scan_large_block(__bss_start, __bss_stop);
-        scan_large_block(__start_data_ro_after_init, __end_data_ro_after_init);
+        scan_large_block(__start_ro_after_init, __end_ro_after_init);
 
 #ifdef CONFIG_SMP
         /* per-cpu sections scanning */
diff --git a/mm/madvise.c b/mm/madvise.c
index dc5927c812d3..7a2abf0127ae 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -513,7 +513,43 @@ static long madvise_dontneed(struct vm_area_struct *vma,
         if (!can_madv_dontneed_vma(vma))
                 return -EINVAL;
 
-        userfaultfd_remove(vma, prev, start, end);
+        if (!userfaultfd_remove(vma, start, end)) {
+                *prev = NULL; /* mmap_sem has been dropped, prev is stale */
+
+                down_read(&current->mm->mmap_sem);
+                vma = find_vma(current->mm, start);
+                if (!vma)
+                        return -ENOMEM;
+                if (start < vma->vm_start) {
+                        /*
+                         * This "vma" under revalidation is the one
+                         * with the lowest vma->vm_start where start
+                         * is also < vma->vm_end. If start <
+                         * vma->vm_start it means an hole materialized
+                         * in the user address space within the
+                         * virtual range passed to MADV_DONTNEED.
+                         */
+                        return -ENOMEM;
+                }
+                if (!can_madv_dontneed_vma(vma))
+                        return -EINVAL;
+                if (end > vma->vm_end) {
+                        /*
+                         * Don't fail if end > vma->vm_end. If the old
+                         * vma was splitted while the mmap_sem was
+                         * released the effect of the concurrent
+                         * operation may not cause MADV_DONTNEED to
+                         * have an undefined result. There may be an
+                         * adjacent next vma that we'll walk
+                         * next. userfaultfd_remove() will generate an
+                         * UFFD_EVENT_REMOVE repetition on the
+                         * end-vma->vm_end range, but the manager can
+                         * handle a repetition fine.
+                         */
+                        end = vma->vm_end;
+                }
+                VM_WARN_ON(start >= end);
+        }
         zap_page_range(vma, start, end - start);
         return 0;
 }
@@ -554,8 +590,10 @@ static long madvise_remove(struct vm_area_struct *vma,
          * mmap_sem.
          */
         get_file(f);
-        userfaultfd_remove(vma, prev, start, end);
-        up_read(&current->mm->mmap_sem);
+        if (userfaultfd_remove(vma, start, end)) {
+                /* mmap_sem was not released by userfaultfd_remove() */
+                up_read(&current->mm->mmap_sem);
+        }
         error = vfs_fallocate(f,
                                 FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
                                 offset, end - start);
diff --git a/mm/memblock.c b/mm/memblock.c
index b64b47803e52..696f06d17c4e 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -1118,7 +1118,10 @@ unsigned long __init_memblock memblock_next_valid_pfn(unsigned long pfn,
                 }
         } while (left < right);
 
-        return min(PHYS_PFN(type->regions[right].base), max_pfn);
+        if (right == type->cnt)
+                return max_pfn;
+        else
+                return min(PHYS_PFN(type->regions[right].base), max_pfn);
 }
 
 /**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index c52ec893e241..2bd7541d7c11 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -466,6 +466,8 @@ static void mem_cgroup_update_tree(struct mem_cgroup *memcg, struct page *page)
         struct mem_cgroup_tree_per_node *mctz;
 
         mctz = soft_limit_tree_from_page(page);
+        if (!mctz)
+                return;
         /*
          * Necessary to update all ancestors when hierarchy is used.
          * because their event counter is not touched.
@@ -503,7 +505,8 @@ static void mem_cgroup_remove_from_trees(struct mem_cgroup *memcg)
         for_each_node(nid) {
                 mz = mem_cgroup_nodeinfo(memcg, nid);
                 mctz = soft_limit_tree_node(nid);
-                mem_cgroup_remove_exceeded(mz, mctz);
+                if (mctz)
+                        mem_cgroup_remove_exceeded(mz, mctz);
         }
 }
 
@@ -2558,7 +2561,7 @@ unsigned long mem_cgroup_soft_limit_reclaim(pg_data_t *pgdat, int order,
          * is empty. Do it lockless to prevent lock bouncing. Races
          * are acceptable as soft limit is best effort anyway.
          */
-        if (RB_EMPTY_ROOT(&mctz->rb_root))
+        if (!mctz || RB_EMPTY_ROOT(&mctz->rb_root))
                 return 0;
 
         /*
@@ -4135,17 +4138,22 @@ static void free_mem_cgroup_per_node_info(struct mem_cgroup *memcg, int node)
         kfree(memcg->nodeinfo[node]);
 }
 
-static void mem_cgroup_free(struct mem_cgroup *memcg)
+static void __mem_cgroup_free(struct mem_cgroup *memcg)
 {
         int node;
 
-        memcg_wb_domain_exit(memcg);
         for_each_node(node)
                 free_mem_cgroup_per_node_info(memcg, node);
         free_percpu(memcg->stat);
         kfree(memcg);
 }
 
+static void mem_cgroup_free(struct mem_cgroup *memcg)
+{
+        memcg_wb_domain_exit(memcg);
+        __mem_cgroup_free(memcg);
+}
+
 static struct mem_cgroup *mem_cgroup_alloc(void)
 {
         struct mem_cgroup *memcg;
@@ -4196,7 +4204,7 @@ static struct mem_cgroup *mem_cgroup_alloc(void)
 fail:
         if (memcg->id.id > 0)
                 idr_remove(&mem_cgroup_idr, memcg->id.id);
-        mem_cgroup_free(memcg);
+        __mem_cgroup_free(memcg);
         return NULL;
 }
 
diff --git a/mm/memory.c b/mm/memory.c
index a97a4cec2e1f..235ba51b2fbf 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -445,7 +445,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
         mm_dec_nr_pmds(tlb->mm);
 }
 
-static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
+static inline void free_pud_range(struct mmu_gather *tlb, p4d_t *p4d,
                                 unsigned long addr, unsigned long end,
                                 unsigned long floor, unsigned long ceiling)
 {
@@ -454,7 +454,7 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
         unsigned long start;
 
         start = addr;
-        pud = pud_offset(pgd, addr);
+        pud = pud_offset(p4d, addr);
         do {
                 next = pud_addr_end(addr, end);
                 if (pud_none_or_clear_bad(pud))
@@ -462,6 +462,39 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
                 free_pmd_range(tlb, pud, addr, next, floor, ceiling);
         } while (pud++, addr = next, addr != end);
 
+        start &= P4D_MASK;
+        if (start < floor)
+                return;
+        if (ceiling) {
+                ceiling &= P4D_MASK;
+                if (!ceiling)
+                        return;
+        }
+        if (end - 1 > ceiling - 1)
+                return;
+
+        pud = pud_offset(p4d, start);
+        p4d_clear(p4d);
+        pud_free_tlb(tlb, pud, start);
+}
+
+static inline void free_p4d_range(struct mmu_gather *tlb, pgd_t *pgd,
+                                unsigned long addr, unsigned long end,
+                                unsigned long floor, unsigned long ceiling)
+{
+        p4d_t *p4d;
+        unsigned long next;
+        unsigned long start;
+
+        start = addr;
+        p4d = p4d_offset(pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_none_or_clear_bad(p4d))
+                        continue;
+                free_pud_range(tlb, p4d, addr, next, floor, ceiling);
+        } while (p4d++, addr = next, addr != end);
+
         start &= PGDIR_MASK;
         if (start < floor)
                 return;
@@ -473,9 +506,9 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
         if (end - 1 > ceiling - 1)
                 return;
 
-        pud = pud_offset(pgd, start);
+        p4d = p4d_offset(pgd, start);
         pgd_clear(pgd);
-        pud_free_tlb(tlb, pud, start);
+        p4d_free_tlb(tlb, p4d, start);
 }
 
 /*
@@ -539,7 +572,7 @@ void free_pgd_range(struct mmu_gather *tlb,
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(pgd))
                         continue;
-                free_pud_range(tlb, pgd, addr, next, floor, ceiling);
+                free_p4d_range(tlb, pgd, addr, next, floor, ceiling);
         } while (pgd++, addr = next, addr != end);
 }
 
@@ -658,7 +691,8 @@ static void print_bad_pte(struct vm_area_struct *vma, unsigned long addr,
                           pte_t pte, struct page *page)
 {
         pgd_t *pgd = pgd_offset(vma->vm_mm, addr);
-        pud_t *pud = pud_offset(pgd, addr);
+        p4d_t *p4d = p4d_offset(pgd, addr);
+        pud_t *pud = pud_offset(p4d, addr);
         pmd_t *pmd = pmd_offset(pud, addr);
         struct address_space *mapping;
         pgoff_t index;
@@ -1023,16 +1057,16 @@ static inline int copy_pmd_range(struct mm_struct *dst_mm, struct mm_struct *src
 }
 
 static inline int copy_pud_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
-                pgd_t *dst_pgd, pgd_t *src_pgd, struct vm_area_struct *vma,
+                p4d_t *dst_p4d, p4d_t *src_p4d, struct vm_area_struct *vma,
                 unsigned long addr, unsigned long end)
 {
         pud_t *src_pud, *dst_pud;
         unsigned long next;
 
-        dst_pud = pud_alloc(dst_mm, dst_pgd, addr);
+        dst_pud = pud_alloc(dst_mm, dst_p4d, addr);
         if (!dst_pud)
                 return -ENOMEM;
-        src_pud = pud_offset(src_pgd, addr);
+        src_pud = pud_offset(src_p4d, addr);
         do {
                 next = pud_addr_end(addr, end);
                 if (pud_trans_huge(*src_pud) || pud_devmap(*src_pud)) {
@@ -1056,6 +1090,28 @@ static inline int copy_pud_range(struct mm_struct *dst_mm, struct mm_struct *src
         return 0;
 }
 
+static inline int copy_p4d_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
+                pgd_t *dst_pgd, pgd_t *src_pgd, struct vm_area_struct *vma,
+                unsigned long addr, unsigned long end)
+{
+        p4d_t *src_p4d, *dst_p4d;
+        unsigned long next;
+
+        dst_p4d = p4d_alloc(dst_mm, dst_pgd, addr);
+        if (!dst_p4d)
+                return -ENOMEM;
+        src_p4d = p4d_offset(src_pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_none_or_clear_bad(src_p4d))
+                        continue;
+                if (copy_pud_range(dst_mm, src_mm, dst_p4d, src_p4d,
+                                                vma, addr, next))
+                        return -ENOMEM;
+        } while (dst_p4d++, src_p4d++, addr = next, addr != end);
+        return 0;
+}
+
 int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                 struct vm_area_struct *vma)
 {
@@ -1111,7 +1167,7 @@ int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(src_pgd))
                         continue;
-                if (unlikely(copy_pud_range(dst_mm, src_mm, dst_pgd, src_pgd,
+                if (unlikely(copy_p4d_range(dst_mm, src_mm, dst_pgd, src_pgd,
                                             vma, addr, next))) {
                         ret = -ENOMEM;
                         break;
@@ -1267,14 +1323,14 @@ next:
 }
 
 static inline unsigned long zap_pud_range(struct mmu_gather *tlb,
-                                struct vm_area_struct *vma, pgd_t *pgd,
+                                struct vm_area_struct *vma, p4d_t *p4d,
                                 unsigned long addr, unsigned long end,
                                 struct zap_details *details)
 {
         pud_t *pud;
         unsigned long next;
 
-        pud = pud_offset(pgd, addr);
+        pud = pud_offset(p4d, addr);
         do {
                 next = pud_addr_end(addr, end);
                 if (pud_trans_huge(*pud) || pud_devmap(*pud)) {
@@ -1295,6 +1351,25 @@ next:
         return addr;
 }
 
+static inline unsigned long zap_p4d_range(struct mmu_gather *tlb,
+                                struct vm_area_struct *vma, pgd_t *pgd,
+                                unsigned long addr, unsigned long end,
+                                struct zap_details *details)
+{
+        p4d_t *p4d;
+        unsigned long next;
+
+        p4d = p4d_offset(pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_none_or_clear_bad(p4d))
+                        continue;
+                next = zap_pud_range(tlb, vma, p4d, addr, next, details);
+        } while (p4d++, addr = next, addr != end);
+
+        return addr;
+}
+
 void unmap_page_range(struct mmu_gather *tlb,
                              struct vm_area_struct *vma,
                              unsigned long addr, unsigned long end,
@@ -1310,7 +1385,7 @@ void unmap_page_range(struct mmu_gather *tlb,
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(pgd))
                         continue;
-                next = zap_pud_range(tlb, vma, pgd, addr, next, details);
+                next = zap_p4d_range(tlb, vma, pgd, addr, next, details);
         } while (pgd++, addr = next, addr != end);
         tlb_end_vma(tlb, vma);
 }
@@ -1465,16 +1540,24 @@ EXPORT_SYMBOL_GPL(zap_vma_ptes);
 pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
                         spinlock_t **ptl)
 {
-        pgd_t *pgd = pgd_offset(mm, addr);
-        pud_t *pud = pud_alloc(mm, pgd, addr);
-        if (pud) {
-                pmd_t *pmd = pmd_alloc(mm, pud, addr);
-                if (pmd) {
-                        VM_BUG_ON(pmd_trans_huge(*pmd));
-                        return pte_alloc_map_lock(mm, pmd, addr, ptl);
-                }
-        }
-        return NULL;
+        pgd_t *pgd;
+        p4d_t *p4d;
+        pud_t *pud;
+        pmd_t *pmd;
+
+        pgd = pgd_offset(mm, addr);
+        p4d = p4d_alloc(mm, pgd, addr);
+        if (!p4d)
+                return NULL;
+        pud = pud_alloc(mm, p4d, addr);
+        if (!pud)
+                return NULL;
+        pmd = pmd_alloc(mm, pud, addr);
+        if (!pmd)
+                return NULL;
+
+        VM_BUG_ON(pmd_trans_huge(*pmd));
+        return pte_alloc_map_lock(mm, pmd, addr, ptl);
 }
 
 /*
@@ -1740,7 +1823,7 @@ static inline int remap_pmd_range(struct mm_struct *mm, pud_t *pud,
         return 0;
 }
 
-static inline int remap_pud_range(struct mm_struct *mm, pgd_t *pgd,
+static inline int remap_pud_range(struct mm_struct *mm, p4d_t *p4d,
                         unsigned long addr, unsigned long end,
                         unsigned long pfn, pgprot_t prot)
 {
@@ -1748,7 +1831,7 @@ static inline int remap_pud_range(struct mm_struct *mm, pgd_t *pgd,
         unsigned long next;
 
         pfn -= addr >> PAGE_SHIFT;
-        pud = pud_alloc(mm, pgd, addr);
+        pud = pud_alloc(mm, p4d, addr);
         if (!pud)
                 return -ENOMEM;
         do {
@@ -1760,6 +1843,26 @@ static inline int remap_pud_range(struct mm_struct *mm, pgd_t *pgd,
         return 0;
 }
 
+static inline int remap_p4d_range(struct mm_struct *mm, pgd_t *pgd,
+                        unsigned long addr, unsigned long end,
+                        unsigned long pfn, pgprot_t prot)
+{
+        p4d_t *p4d;
+        unsigned long next;
+
+        pfn -= addr >> PAGE_SHIFT;
+        p4d = p4d_alloc(mm, pgd, addr);
+        if (!p4d)
+                return -ENOMEM;
+        do {
+                next = p4d_addr_end(addr, end);
+                if (remap_pud_range(mm, p4d, addr, next,
+                                pfn + (addr >> PAGE_SHIFT), prot))
+                        return -ENOMEM;
+        } while (p4d++, addr = next, addr != end);
+        return 0;
+}
+
 /**
  * remap_pfn_range - remap kernel memory to userspace
  * @vma: user vma to map to
@@ -1816,7 +1919,7 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
         flush_cache_range(vma, addr, end);
         do {
                 next = pgd_addr_end(addr, end);
-                err = remap_pud_range(mm, pgd, addr, next,
+                err = remap_p4d_range(mm, pgd, addr, next,
                                 pfn + (addr >> PAGE_SHIFT), prot);
                 if (err)
                         break;
@@ -1932,7 +2035,7 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
         return err;
 }
 
-static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
+static int apply_to_pud_range(struct mm_struct *mm, p4d_t *p4d,
                                      unsigned long addr, unsigned long end,
                                      pte_fn_t fn, void *data)
 {
@@ -1940,7 +2043,7 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
         unsigned long next;
         int err;
 
-        pud = pud_alloc(mm, pgd, addr);
+        pud = pud_alloc(mm, p4d, addr);
         if (!pud)
                 return -ENOMEM;
         do {
@@ -1952,6 +2055,26 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
         return err;
 }
 
+static int apply_to_p4d_range(struct mm_struct *mm, pgd_t *pgd,
+                                     unsigned long addr, unsigned long end,
+                                     pte_fn_t fn, void *data)
+{
+        p4d_t *p4d;
+        unsigned long next;
+        int err;
+
+        p4d = p4d_alloc(mm, pgd, addr);
+        if (!p4d)
+                return -ENOMEM;
+        do {
+                next = p4d_addr_end(addr, end);
+                err = apply_to_pud_range(mm, p4d, addr, next, fn, data);
+                if (err)
+                        break;
+        } while (p4d++, addr = next, addr != end);
+        return err;
+}
+
 /*
  * Scan a region of virtual memory, filling in page tables as necessary
  * and calling a provided function on each leaf page table.
@@ -1970,7 +2093,7 @@ int apply_to_page_range(struct mm_struct *mm, unsigned long addr,
         pgd = pgd_offset(mm, addr);
         do {
                 next = pgd_addr_end(addr, end);
-                err = apply_to_pud_range(mm, pgd, addr, next, fn, data);
+                err = apply_to_p4d_range(mm, pgd, addr, next, fn, data);
                 if (err)
                         break;
         } while (pgd++, addr = next, addr != end);
@@ -3653,11 +3776,15 @@ static int __handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
         };
         struct mm_struct *mm = vma->vm_mm;
         pgd_t *pgd;
+        p4d_t *p4d;
         int ret;
 
         pgd = pgd_offset(mm, address);
+        p4d = p4d_alloc(mm, pgd, address);
+        if (!p4d)
+                return VM_FAULT_OOM;
 
-        vmf.pud = pud_alloc(mm, pgd, address);
+        vmf.pud = pud_alloc(mm, p4d, address);
         if (!vmf.pud)
                 return VM_FAULT_OOM;
         if (pud_none(*vmf.pud) && transparent_hugepage_enabled(vma)) {
@@ -3779,12 +3906,35 @@ int handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
 }
 EXPORT_SYMBOL_GPL(handle_mm_fault);
 
+#ifndef __PAGETABLE_P4D_FOLDED
+/*
+ * Allocate p4d page table.
+ * We've already handled the fast-path in-line.
+ */
+int __p4d_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+{
+        p4d_t *new = p4d_alloc_one(mm, address);
+        if (!new)
+                return -ENOMEM;
+
+        smp_wmb(); /* See comment in __pte_alloc */
+
+        spin_lock(&mm->page_table_lock);
+        if (pgd_present(*pgd))          /* Another has populated it */
+                p4d_free(mm, new);
+        else
+                pgd_populate(mm, pgd, new);
+        spin_unlock(&mm->page_table_lock);
+        return 0;
+}
+#endif /* __PAGETABLE_P4D_FOLDED */
+
 #ifndef __PAGETABLE_PUD_FOLDED
 /*
  * Allocate page upper directory.
  * We've already handled the fast-path in-line.
  */
-int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+int __pud_alloc(struct mm_struct *mm, p4d_t *p4d, unsigned long address)
 {
         pud_t *new = pud_alloc_one(mm, address);
         if (!new)
@@ -3793,10 +3943,17 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
         smp_wmb(); /* See comment in __pte_alloc */
 
         spin_lock(&mm->page_table_lock);
-        if (pgd_present(*pgd))          /* Another has populated it */
+#ifndef __ARCH_HAS_5LEVEL_HACK
+        if (p4d_present(*p4d))          /* Another has populated it */
                 pud_free(mm, new);
         else
-                pgd_populate(mm, pgd, new);
+                p4d_populate(mm, p4d, new);
+#else
+        if (pgd_present(*p4d))          /* Another has populated it */
+                pud_free(mm, new);
+        else
+                pgd_populate(mm, p4d, new);
+#endif /* __ARCH_HAS_5LEVEL_HACK */
         spin_unlock(&mm->page_table_lock);
         return 0;
 }
@@ -3839,6 +3996,7 @@ static int __follow_pte_pmd(struct mm_struct *mm, unsigned long address,
                 pte_t **ptepp, pmd_t **pmdpp, spinlock_t **ptlp)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
         pte_t *ptep;
@@ -3847,7 +4005,11 @@ static int __follow_pte_pmd(struct mm_struct *mm, unsigned long address,
         if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd)))
                 goto out;
 
-        pud = pud_offset(pgd, address);
+        p4d = p4d_offset(pgd, address);
+        if (p4d_none(*p4d) || unlikely(p4d_bad(*p4d)))
+                goto out;
+
+        pud = pud_offset(p4d, address);
         if (pud_none(*pud) || unlikely(pud_bad(*pud)))
                 goto out;
 
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 295479b792ec..6fa7208bcd56 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -125,9 +125,12 @@ void put_online_mems(void)
 
 }
 
+/* Serializes write accesses to mem_hotplug.active_writer. */
+static DEFINE_MUTEX(memory_add_remove_lock);
+
 void mem_hotplug_begin(void)
 {
-        assert_held_device_hotplug();
+        mutex_lock(&memory_add_remove_lock);
 
         mem_hotplug.active_writer = current;
 
@@ -147,6 +150,7 @@ void mem_hotplug_done(void)
         mem_hotplug.active_writer = NULL;
         mutex_unlock(&mem_hotplug.lock);
         memhp_lock_release();
+        mutex_unlock(&memory_add_remove_lock);
 }
 
 /* add this memory to iomem resource */
diff --git a/mm/migrate.c b/mm/migrate.c
index 9a0897a14d37..ed97c2c14fa8 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -209,8 +209,11 @@ static int remove_migration_pte(struct page *page, struct vm_area_struct *vma,
 
         VM_BUG_ON_PAGE(PageTail(page), page);
         while (page_vma_mapped_walk(&pvmw)) {
-                new = page - pvmw.page->index +
-                        linear_page_index(vma, pvmw.address);
+                if (PageKsm(page))
+                        new = page;
+                else
+                        new = page - pvmw.page->index +
+                                linear_page_index(vma, pvmw.address);
 
                 get_page(new);
                 pte = pte_mkold(mk_pte(new, READ_ONCE(vma->vm_page_prot)));
diff --git a/mm/mlock.c b/mm/mlock.c
index 1050511f8b2b..0dd9ca18e19e 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -380,6 +380,7 @@ static unsigned long __munlock_pagevec_fill(struct pagevec *pvec,
         pte = get_locked_pte(vma->vm_mm, start, &ptl);
         /* Make sure we do not cross the page table boundary */
         end = pgd_addr_end(start, end);
+        end = p4d_addr_end(start, end);
         end = pud_addr_end(start, end);
         end = pmd_addr_end(start, end);
 
@@ -442,7 +443,7 @@ void munlock_vma_pages_range(struct vm_area_struct *vma,
 
         while (start < end) {
                 struct page *page;
-                unsigned int page_mask;
+                unsigned int page_mask = 0;
                 unsigned long page_increm;
                 struct pagevec pvec;
                 struct zone *zone;
@@ -456,8 +457,7 @@ void munlock_vma_pages_range(struct vm_area_struct *vma,
                  * suits munlock very well (and if somehow an abnormal page
                  * has sneaked into the range, we won't oops here: great).
                  */
-                page = follow_page_mask(vma, start, FOLL_GET | FOLL_DUMP,
-                                &page_mask);
+                page = follow_page(vma, start, FOLL_GET | FOLL_DUMP);
 
                 if (page && !IS_ERR(page)) {
                         if (PageTransTail(page)) {
@@ -468,8 +468,8 @@ void munlock_vma_pages_range(struct vm_area_struct *vma,
                                 /*
                                  * Any THP page found by follow_page_mask() may
                                  * have gotten split before reaching
-                                 * munlock_vma_page(), so we need to recompute
-                                 * the page_mask here.
+                                 * munlock_vma_page(), so we need to compute
+                                 * the page_mask here instead.
                                  */
                                 page_mask = munlock_vma_page(page);
                                 unlock_page(page);
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 848e946b08e5..8edd0d576254 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -193,14 +193,14 @@ static inline unsigned long change_pmd_range(struct vm_area_struct *vma,
 }
 
 static inline unsigned long change_pud_range(struct vm_area_struct *vma,
-                pgd_t *pgd, unsigned long addr, unsigned long end,
+                p4d_t *p4d, unsigned long addr, unsigned long end,
                 pgprot_t newprot, int dirty_accountable, int prot_numa)
 {
         pud_t *pud;
         unsigned long next;
         unsigned long pages = 0;
 
-        pud = pud_offset(pgd, addr);
+        pud = pud_offset(p4d, addr);
         do {
                 next = pud_addr_end(addr, end);
                 if (pud_none_or_clear_bad(pud))
@@ -212,6 +212,26 @@ static inline unsigned long change_pud_range(struct vm_area_struct *vma,
         return pages;
 }
 
+static inline unsigned long change_p4d_range(struct vm_area_struct *vma,
+                pgd_t *pgd, unsigned long addr, unsigned long end,
+                pgprot_t newprot, int dirty_accountable, int prot_numa)
+{
+        p4d_t *p4d;
+        unsigned long next;
+        unsigned long pages = 0;
+
+        p4d = p4d_offset(pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_none_or_clear_bad(p4d))
+                        continue;
+                pages += change_pud_range(vma, p4d, addr, next, newprot,
+                                 dirty_accountable, prot_numa);
+        } while (p4d++, addr = next, addr != end);
+
+        return pages;
+}
+
 static unsigned long change_protection_range(struct vm_area_struct *vma,
                 unsigned long addr, unsigned long end, pgprot_t newprot,
                 int dirty_accountable, int prot_numa)
@@ -230,7 +250,7 @@ static unsigned long change_protection_range(struct vm_area_struct *vma,
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(pgd))
                         continue;
-                pages += change_pud_range(vma, pgd, addr, next, newprot,
+                pages += change_p4d_range(vma, pgd, addr, next, newprot,
                                  dirty_accountable, prot_numa);
         } while (pgd++, addr = next, addr != end);
 
diff --git a/mm/mremap.c b/mm/mremap.c
index 8233b0105c82..cd8a1b199ef9 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -32,6 +32,7 @@
 static pmd_t *get_old_pmd(struct mm_struct *mm, unsigned long addr)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
 
@@ -39,7 +40,11 @@ static pmd_t *get_old_pmd(struct mm_struct *mm, unsigned long addr)
         if (pgd_none_or_clear_bad(pgd))
                 return NULL;
 
-        pud = pud_offset(pgd, addr);
+        p4d = p4d_offset(pgd, addr);
+        if (p4d_none_or_clear_bad(p4d))
+                return NULL;
+
+        pud = pud_offset(p4d, addr);
         if (pud_none_or_clear_bad(pud))
                 return NULL;
 
@@ -54,11 +59,15 @@ static pmd_t *alloc_new_pmd(struct mm_struct *mm, struct vm_area_struct *vma,
                             unsigned long addr)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
 
         pgd = pgd_offset(mm, addr);
-        pud = pud_alloc(mm, pgd, addr);
+        p4d = p4d_alloc(mm, pgd, addr);
+        if (!p4d)
+                return NULL;
+        pud = pud_alloc(mm, p4d, addr);
         if (!pud)
                 return NULL;
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index eaa64d2ffdc5..6cbde310abed 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -873,7 +873,8 @@ done_merging:
                 higher_page = page + (combined_pfn - pfn);
                 buddy_pfn = __find_buddy_pfn(combined_pfn, order + 1);
                 higher_buddy = higher_page + (buddy_pfn - combined_pfn);
-                if (page_is_buddy(higher_page, higher_buddy, order + 1)) {
+                if (pfn_valid_within(buddy_pfn) &&
+                    page_is_buddy(higher_page, higher_buddy, order + 1)) {
                         list_add_tail(&page->lru,
                                 &zone->free_area[order].free_list[migratetype]);
                         goto out;
diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
index a23001a22c15..c4c9def8ffea 100644
--- a/mm/page_vma_mapped.c
+++ b/mm/page_vma_mapped.c
@@ -104,6 +104,7 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw)
         struct mm_struct *mm = pvmw->vma->vm_mm;
         struct page *page = pvmw->page;
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
 
         /* The only possible pmd mapping has been handled on last iteration */
@@ -133,7 +134,10 @@ restart:
         pgd = pgd_offset(mm, pvmw->address);
         if (!pgd_present(*pgd))
                 return false;
-        pud = pud_offset(pgd, pvmw->address);
+        p4d = p4d_offset(pgd, pvmw->address);
+        if (!p4d_present(*p4d))
+                return false;
+        pud = pud_offset(p4d, pvmw->address);
         if (!pud_present(*pud))
                 return false;
         pvmw->pmd = pmd_offset(pud, pvmw->address);
diff --git a/mm/pagewalk.c b/mm/pagewalk.c
index 03761577ae86..60f7856e508f 100644
--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -69,14 +69,14 @@ again:
         return err;
 }
 
-static int walk_pud_range(pgd_t *pgd, unsigned long addr, unsigned long end,
+static int walk_pud_range(p4d_t *p4d, unsigned long addr, unsigned long end,
                           struct mm_walk *walk)
 {
         pud_t *pud;
         unsigned long next;
         int err = 0;
 
-        pud = pud_offset(pgd, addr);
+        pud = pud_offset(p4d, addr);
         do {
  again:
                 next = pud_addr_end(addr, end);
@@ -113,6 +113,32 @@ static int walk_pud_range(pgd_t *pgd, unsigned long addr, unsigned long end,
         return err;
 }
 
+static int walk_p4d_range(pgd_t *pgd, unsigned long addr, unsigned long end,
+                          struct mm_walk *walk)
+{
+        p4d_t *p4d;
+        unsigned long next;
+        int err = 0;
+
+        p4d = p4d_offset(pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_none_or_clear_bad(p4d)) {
+                        if (walk->pte_hole)
+                                err = walk->pte_hole(addr, next, walk);
+                        if (err)
+                                break;
+                        continue;
+                }
+                if (walk->pmd_entry || walk->pte_entry)
+                        err = walk_pud_range(p4d, addr, next, walk);
+                if (err)
+                        break;
+        } while (p4d++, addr = next, addr != end);
+
+        return err;
+}
+
 static int walk_pgd_range(unsigned long addr, unsigned long end,
                           struct mm_walk *walk)
 {
@@ -131,7 +157,7 @@ static int walk_pgd_range(unsigned long addr, unsigned long end,
                         continue;
                 }
                 if (walk->pmd_entry || walk->pte_entry)
-                        err = walk_pud_range(pgd, addr, next, walk);
+                        err = walk_p4d_range(pgd, addr, next, walk);
                 if (err)
                         break;
         } while (pgd++, addr = next, addr != end);
diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
index 538998a137d2..9ac639499bd1 100644
--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -21,7 +21,6 @@ static struct page *pcpu_chunk_page(struct pcpu_chunk *chunk,
 
 /**
  * pcpu_get_pages - get temp pages array
- * @chunk: chunk of interest
  *
  * Returns pointer to array of pointers to struct page which can be indexed
  * with pcpu_page_idx().  Note that there is only one array and accesses
@@ -30,7 +29,7 @@ static struct page *pcpu_chunk_page(struct pcpu_chunk *chunk,
  * RETURNS:
  * Pointer to temp pages array on success.
  */
-static struct page **pcpu_get_pages(struct pcpu_chunk *chunk_alloc)
+static struct page **pcpu_get_pages(void)
 {
         static struct page **pages;
         size_t pages_size = pcpu_nr_units * pcpu_unit_pages * sizeof(pages[0]);
@@ -275,7 +274,7 @@ static int pcpu_populate_chunk(struct pcpu_chunk *chunk,
 {
         struct page **pages;
 
-        pages = pcpu_get_pages(chunk);
+        pages = pcpu_get_pages();
         if (!pages)
                 return -ENOMEM;
 
@@ -313,7 +312,7 @@ static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk,
          * successful population attempt so the temp pages array must
          * be available now.
          */
-        pages = pcpu_get_pages(chunk);
+        pages = pcpu_get_pages();
         BUG_ON(!pages);
 
         /* unmap and free */
diff --git a/mm/percpu.c b/mm/percpu.c
index 5696039b5c07..60a6488e9e6d 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1011,8 +1011,11 @@ area_found:
                 mutex_unlock(&pcpu_alloc_mutex);
         }
 
-        if (chunk != pcpu_reserved_chunk)
+        if (chunk != pcpu_reserved_chunk) {
+                spin_lock_irqsave(&pcpu_lock, flags);
                 pcpu_nr_empty_pop_pages -= occ_pages;
+                spin_unlock_irqrestore(&pcpu_lock, flags);
+        }
 
         if (pcpu_nr_empty_pop_pages < PCPU_EMPTY_POP_PAGES_LOW)
                 pcpu_schedule_balance_work();
diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c
index 4ed5908c65b0..c99d9512a45b 100644
--- a/mm/pgtable-generic.c
+++ b/mm/pgtable-generic.c
@@ -22,6 +22,12 @@ void pgd_clear_bad(pgd_t *pgd)
         pgd_clear(pgd);
 }
 
+void p4d_clear_bad(p4d_t *p4d)
+{
+        p4d_ERROR(*p4d);
+        p4d_clear(p4d);
+}
+
 void pud_clear_bad(pud_t *pud)
 {
         pud_ERROR(*pud);
diff --git a/mm/rmap.c b/mm/rmap.c
index 2da487d6cea8..f6838015810f 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -684,6 +684,7 @@ unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
 pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd = NULL;
         pmd_t pmde;
@@ -692,7 +693,11 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
         if (!pgd_present(*pgd))
                 goto out;
 
-        pud = pud_offset(pgd, address);
+        p4d = p4d_offset(pgd, address);
+        if (!p4d_present(*p4d))
+                goto out;
+
+        pud = pud_offset(p4d, address);
         if (!pud_present(*pud))
                 goto out;
 
@@ -1154,7 +1159,7 @@ void page_add_file_rmap(struct page *page, bool compound)
                         goto out;
         }
         __mod_node_page_state(page_pgdat(page), NR_FILE_MAPPED, nr);
-        mem_cgroup_inc_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED);
+        mem_cgroup_update_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED, nr);
 out:
         unlock_page_memcg(page);
 }
@@ -1194,7 +1199,7 @@ static void page_remove_file_rmap(struct page *page, bool compound)
          * pte lock(a spinlock) is held, which implies preemption disabled.
          */
         __mod_node_page_state(page_pgdat(page), NR_FILE_MAPPED, -nr);
-        mem_cgroup_dec_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED);
+        mem_cgroup_update_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED, -nr);
 
         if (unlikely(PageMlocked(page)))
                 clear_page_mlock(page);
@@ -1316,12 +1321,6 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
         }
 
         while (page_vma_mapped_walk(&pvmw)) {
-                subpage = page - page_to_pfn(page) + pte_pfn(*pvmw.pte);
-                address = pvmw.address;
-
-                /* Unexpected PMD-mapped THP? */
-                VM_BUG_ON_PAGE(!pvmw.pte, page);
-
                 /*
                  * If the page is mlock()d, we cannot swap it out.
                  * If it's recently referenced (perhaps page_referenced
@@ -1345,6 +1344,13 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                                 continue;
                 }
 
+                /* Unexpected PMD-mapped THP? */
+                VM_BUG_ON_PAGE(!pvmw.pte, page);
+
+                subpage = page - page_to_pfn(page) + pte_pfn(*pvmw.pte);
+                address = pvmw.address;
+
+
                 if (!(flags & TTU_IGNORE_ACCESS)) {
                         if (ptep_clear_flush_young_notify(vma, address,
                                                 pvmw.pte)) {
diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
index 574c67b663fe..a56c3989f773 100644
--- a/mm/sparse-vmemmap.c
+++ b/mm/sparse-vmemmap.c
@@ -196,9 +196,9 @@ pmd_t * __meminit vmemmap_pmd_populate(pud_t *pud, unsigned long addr, int node)
         return pmd;
 }
 
-pud_t * __meminit vmemmap_pud_populate(pgd_t *pgd, unsigned long addr, int node)
+pud_t * __meminit vmemmap_pud_populate(p4d_t *p4d, unsigned long addr, int node)
 {
-        pud_t *pud = pud_offset(pgd, addr);
+        pud_t *pud = pud_offset(p4d, addr);
         if (pud_none(*pud)) {
                 void *p = vmemmap_alloc_block(PAGE_SIZE, node);
                 if (!p)
@@ -208,6 +208,18 @@ pud_t * __meminit vmemmap_pud_populate(pgd_t *pgd, unsigned long addr, int node)
         return pud;
 }
 
+p4d_t * __meminit vmemmap_p4d_populate(pgd_t *pgd, unsigned long addr, int node)
+{
+        p4d_t *p4d = p4d_offset(pgd, addr);
+        if (p4d_none(*p4d)) {
+                void *p = vmemmap_alloc_block(PAGE_SIZE, node);
+                if (!p)
+                        return NULL;
+                p4d_populate(&init_mm, p4d, p);
+        }
+        return p4d;
+}
+
 pgd_t * __meminit vmemmap_pgd_populate(unsigned long addr, int node)
 {
         pgd_t *pgd = pgd_offset_k(addr);
@@ -225,6 +237,7 @@ int __meminit vmemmap_populate_basepages(unsigned long start,
 {
         unsigned long addr = start;
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
         pte_t *pte;
@@ -233,7 +246,10 @@ int __meminit vmemmap_populate_basepages(unsigned long start,
                 pgd = vmemmap_pgd_populate(addr, node);
                 if (!pgd)
                         return -ENOMEM;
-                pud = vmemmap_pud_populate(pgd, addr, node);
+                p4d = vmemmap_p4d_populate(pgd, addr, node);
+                if (!p4d)
+                        return -ENOMEM;
+                pud = vmemmap_pud_populate(p4d, addr, node);
                 if (!pud)
                         return -ENOMEM;
                 pmd = vmemmap_pmd_populate(pud, addr, node);
diff --git a/mm/swap_slots.c b/mm/swap_slots.c
index 9b5bc86f96ad..b1ccb58ad397 100644
--- a/mm/swap_slots.c
+++ b/mm/swap_slots.c
@@ -267,8 +267,6 @@ int free_swap_slot(swp_entry_t entry)
 {
         struct swap_slots_cache *cache;
 
-        BUG_ON(!swap_slot_cache_initialized);
-
         cache = &get_cpu_var(swp_slots);
         if (use_swap_slot_cache && cache->slots_ret) {
                 spin_lock_irq(&cache->free_lock);
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 521ef9b6064f..178130880b90 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1517,7 +1517,7 @@ static inline int unuse_pmd_range(struct vm_area_struct *vma, pud_t *pud,
         return 0;
 }
 
-static inline int unuse_pud_range(struct vm_area_struct *vma, pgd_t *pgd,
+static inline int unuse_pud_range(struct vm_area_struct *vma, p4d_t *p4d,
                                 unsigned long addr, unsigned long end,
                                 swp_entry_t entry, struct page *page)
 {
@@ -1525,7 +1525,7 @@ static inline int unuse_pud_range(struct vm_area_struct *vma, pgd_t *pgd,
         unsigned long next;
         int ret;
 
-        pud = pud_offset(pgd, addr);
+        pud = pud_offset(p4d, addr);
         do {
                 next = pud_addr_end(addr, end);
                 if (pud_none_or_clear_bad(pud))
@@ -1537,6 +1537,26 @@ static inline int unuse_pud_range(struct vm_area_struct *vma, pgd_t *pgd,
         return 0;
 }
 
+static inline int unuse_p4d_range(struct vm_area_struct *vma, pgd_t *pgd,
+                                unsigned long addr, unsigned long end,
+                                swp_entry_t entry, struct page *page)
+{
+        p4d_t *p4d;
+        unsigned long next;
+        int ret;
+
+        p4d = p4d_offset(pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_none_or_clear_bad(p4d))
+                        continue;
+                ret = unuse_pud_range(vma, p4d, addr, next, entry, page);
+                if (ret)
+                        return ret;
+        } while (p4d++, addr = next, addr != end);
+        return 0;
+}
+
 static int unuse_vma(struct vm_area_struct *vma,
                                 swp_entry_t entry, struct page *page)
 {
@@ -1560,7 +1580,7 @@ static int unuse_vma(struct vm_area_struct *vma,
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(pgd))
                         continue;
-                ret = unuse_pud_range(vma, pgd, addr, next, entry, page);
+                ret = unuse_p4d_range(vma, pgd, addr, next, entry, page);
                 if (ret)
                         return ret;
         } while (pgd++, addr = next, addr != end);
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 479e631d43c2..8bcb501bce60 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -128,19 +128,22 @@ out_unlock:
 static pmd_t *mm_alloc_pmd(struct mm_struct *mm, unsigned long address)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
-        pmd_t *pmd = NULL;
 
         pgd = pgd_offset(mm, address);
-        pud = pud_alloc(mm, pgd, address);
-        if (pud)
-                /*
-                 * Note that we didn't run this because the pmd was
-                 * missing, the *pmd may be already established and in
-                 * turn it may also be a trans_huge_pmd.
-                 */
-                pmd = pmd_alloc(mm, pud, address);
-        return pmd;
+        p4d = p4d_alloc(mm, pgd, address);
+        if (!p4d)
+                return NULL;
+        pud = pud_alloc(mm, p4d, address);
+        if (!pud)
+                return NULL;
+        /*
+         * Note that we didn't run this because the pmd was
+         * missing, the *pmd may be already established and in
+         * turn it may also be a trans_huge_pmd.
+         */
+        return pmd_alloc(mm, pud, address);
 }
 
 #ifdef CONFIG_HUGETLB_PAGE
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index b4024d688f38..0b057628a7ba 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -86,12 +86,12 @@ static void vunmap_pmd_range(pud_t *pud, unsigned long addr, unsigned long end)
         } while (pmd++, addr = next, addr != end);
 }
 
-static void vunmap_pud_range(pgd_t *pgd, unsigned long addr, unsigned long end)
+static void vunmap_pud_range(p4d_t *p4d, unsigned long addr, unsigned long end)
 {
         pud_t *pud;
         unsigned long next;
 
-        pud = pud_offset(pgd, addr);
+        pud = pud_offset(p4d, addr);
         do {
                 next = pud_addr_end(addr, end);
                 if (pud_clear_huge(pud))
@@ -102,6 +102,22 @@ static void vunmap_pud_range(pgd_t *pgd, unsigned long addr, unsigned long end)
         } while (pud++, addr = next, addr != end);
 }
 
+static void vunmap_p4d_range(pgd_t *pgd, unsigned long addr, unsigned long end)
+{
+        p4d_t *p4d;
+        unsigned long next;
+
+        p4d = p4d_offset(pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_clear_huge(p4d))
+                        continue;
+                if (p4d_none_or_clear_bad(p4d))
+                        continue;
+                vunmap_pud_range(p4d, addr, next);
+        } while (p4d++, addr = next, addr != end);
+}
+
 static void vunmap_page_range(unsigned long addr, unsigned long end)
 {
         pgd_t *pgd;
@@ -113,7 +129,7 @@ static void vunmap_page_range(unsigned long addr, unsigned long end)
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(pgd))
                         continue;
-                vunmap_pud_range(pgd, addr, next);
+                vunmap_p4d_range(pgd, addr, next);
         } while (pgd++, addr = next, addr != end);
 }
 
@@ -160,13 +176,13 @@ static int vmap_pmd_range(pud_t *pud, unsigned long addr,
         return 0;
 }
 
-static int vmap_pud_range(pgd_t *pgd, unsigned long addr,
+static int vmap_pud_range(p4d_t *p4d, unsigned long addr,
                 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
 {
         pud_t *pud;
         unsigned long next;
 
-        pud = pud_alloc(&init_mm, pgd, addr);
+        pud = pud_alloc(&init_mm, p4d, addr);
         if (!pud)
                 return -ENOMEM;
         do {
@@ -177,6 +193,23 @@ static int vmap_pud_range(pgd_t *pgd, unsigned long addr,
         return 0;
 }
 
+static int vmap_p4d_range(pgd_t *pgd, unsigned long addr,
+                unsigned long end, pgprot_t prot, struct page **pages, int *nr)
+{
+        p4d_t *p4d;
+        unsigned long next;
+
+        p4d = p4d_alloc(&init_mm, pgd, addr);
+        if (!p4d)
+                return -ENOMEM;
+        do {
+                next = p4d_addr_end(addr, end);
+                if (vmap_pud_range(p4d, addr, next, prot, pages, nr))
+                        return -ENOMEM;
+        } while (p4d++, addr = next, addr != end);
+        return 0;
+}
+
 /*
  * Set up page tables in kva (addr, end). The ptes shall have prot "prot", and
  * will have pfns corresponding to the "pages" array.
@@ -196,7 +229,7 @@ static int vmap_page_range_noflush(unsigned long start, unsigned long end,
         pgd = pgd_offset_k(addr);
         do {
                 next = pgd_addr_end(addr, end);
-                err = vmap_pud_range(pgd, addr, next, prot, pages, &nr);
+                err = vmap_p4d_range(pgd, addr, next, prot, pages, &nr);
                 if (err)
                         return err;
         } while (pgd++, addr = next, addr != end);
@@ -237,6 +270,10 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
         unsigned long addr = (unsigned long) vmalloc_addr;
         struct page *page = NULL;
         pgd_t *pgd = pgd_offset_k(addr);
+        p4d_t *p4d;
+        pud_t *pud;
+        pmd_t *pmd;
+        pte_t *ptep, pte;
 
         /*
          * XXX we might need to change this if we add VIRTUAL_BUG_ON for
@@ -244,21 +281,23 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
          */
         VIRTUAL_BUG_ON(!is_vmalloc_or_module_addr(vmalloc_addr));
 
-        if (!pgd_none(*pgd)) {
-                pud_t *pud = pud_offset(pgd, addr);
-                if (!pud_none(*pud)) {
-                        pmd_t *pmd = pmd_offset(pud, addr);
-                        if (!pmd_none(*pmd)) {
-                                pte_t *ptep, pte;
-
-                                ptep = pte_offset_map(pmd, addr);
-                                pte = *ptep;
-                                if (pte_present(pte))
-                                        page = pte_page(pte);
-                                pte_unmap(ptep);
-                        }
-                }
-        }
+        if (pgd_none(*pgd))
+                return NULL;
+        p4d = p4d_offset(pgd, addr);
+        if (p4d_none(*p4d))
+                return NULL;
+        pud = pud_offset(p4d, addr);
+        if (pud_none(*pud))
+                return NULL;
+        pmd = pmd_offset(pud, addr);
+        if (pmd_none(*pmd))
+                return NULL;
+
+        ptep = pte_offset_map(pmd, addr);
+        pte = *ptep;
+        if (pte_present(pte))
+                page = pte_page(pte);
+        pte_unmap(ptep);
         return page;
 }
 EXPORT_SYMBOL(vmalloc_to_page);
@@ -1644,7 +1683,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
 
                 if (fatal_signal_pending(current)) {
                         area->nr_pages = i;
-                        goto fail;
+                        goto fail_no_warn;
                 }
 
                 if (node == NUMA_NO_NODE)
@@ -1670,6 +1709,7 @@ fail:
         warn_alloc(gfp_mask, NULL,
                           "vmalloc: allocation failure, allocated %ld of %ld bytes",
                           (area->nr_pages*PAGE_SIZE), area->size);
+fail_no_warn:
         vfree(area->addr);
         return NULL;
 }
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 69f9aff39a2e..89f95396ec46 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1065,6 +1065,9 @@ const char * const vmstat_text[] = {
         "thp_split_page_failed",
         "thp_deferred_split_page",
         "thp_split_pmd",
+#ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
+        "thp_split_pud",
+#endif
         "thp_zero_page_alloc",
         "thp_zero_page_alloc_failed",
 #endif
@@ -1761,7 +1764,7 @@ static int vmstat_cpu_dead(unsigned int cpu)
 
 #endif
 
-static int __init setup_vmstat(void)
+void __init init_mm_internals(void)
 {
 #ifdef CONFIG_SMP
         int ret;
@@ -1789,9 +1792,7 @@ static int __init setup_vmstat(void)
         proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
         proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
 #endif
-        return 0;
 }
-module_init(setup_vmstat)
 
 #if defined(CONFIG_DEBUG_FS) && defined(CONFIG_COMPACTION)
 
diff --git a/mm/workingset.c b/mm/workingset.c
index ac839fca0e76..eda05c71fa49 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -532,7 +532,7 @@ static int __init workingset_init(void)
         pr_info("workingset: timestamp_bits=%d max_order=%d bucket_order=%u\n",
                timestamp_bits, max_order, bucket_order);
 
-        ret = list_lru_init_key(&shadow_nodes, &shadow_nodes_key);
+        ret = __list_lru_init(&shadow_nodes, true, &shadow_nodes_key);
         if (ret)
                 goto err;
         ret = register_shrinker(&workingset_shadow_shrinker);
diff --git a/mm/z3fold.c b/mm/z3fold.c
index 8970a2fd3b1a..f9492bccfd79 100644
--- a/mm/z3fold.c
+++ b/mm/z3fold.c
@@ -667,6 +667,7 @@ next:
                         z3fold_page_unlock(zhdr);
                         spin_lock(&pool->lock);
                         if (kref_put(&zhdr->refcount, release_z3fold_page)) {
+                                spin_unlock(&pool->lock);
                                 atomic64_dec(&pool->pages_nr);
                                 return 0;
                         }
diff --git a/net/atm/svc.c b/net/atm/svc.c
index db9794ec61d8..5589de7086af 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -318,7 +318,8 @@ out:
         return error;
 }
 
-static int svc_accept(struct socket *sock, struct socket *newsock, int flags)
+static int svc_accept(struct socket *sock, struct socket *newsock, int flags,
+                      bool kern)
 {
         struct sock *sk = sock->sk;
         struct sk_buff *skb;
@@ -329,7 +330,7 @@ static int svc_accept(struct socket *sock, struct socket *newsock, int flags)
 
         lock_sock(sk);
 
-        error = svc_create(sock_net(sk), newsock, 0, 0);
+        error = svc_create(sock_net(sk), newsock, 0, kern);
         if (error)
                 goto out;
 
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index a8e42cedf1db..b7c486752b3a 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1320,7 +1320,8 @@ out_release:
         return err;
 }
 
-static int ax25_accept(struct socket *sock, struct socket *newsock, int flags)
+static int ax25_accept(struct socket *sock, struct socket *newsock, int flags,
+                       bool kern)
 {
         struct sk_buff *skb;
         struct sock *newsk;
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 7c3d994e90d8..71343d0fec94 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -2477,6 +2477,16 @@ static void batadv_iv_iface_activate(struct batadv_hard_iface *hard_iface)
         batadv_iv_ogm_schedule(hard_iface);
 }
 
+/**
+ * batadv_iv_init_sel_class - initialize GW selection class
+ * @bat_priv: the bat priv with all the soft interface information
+ */
+static void batadv_iv_init_sel_class(struct batadv_priv *bat_priv)
+{
+        /* set default TQ difference threshold to 20 */
+        atomic_set(&bat_priv->gw.sel_class, 20);
+}
+
 static struct batadv_gw_node *
 batadv_iv_gw_get_best_gw_node(struct batadv_priv *bat_priv)
 {
@@ -2823,6 +2833,7 @@ static struct batadv_algo_ops batadv_batman_iv __read_mostly = {
                 .del_if = batadv_iv_ogm_orig_del_if,
         },
         .gw = {
+                .init_sel_class = batadv_iv_init_sel_class,
                 .get_best_gw_node = batadv_iv_gw_get_best_gw_node,
                 .is_eligible = batadv_iv_gw_is_eligible,
 #ifdef CONFIG_BATMAN_ADV_DEBUGFS
diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
index 0acd081dd286..a36c8e7291d6 100644
--- a/net/batman-adv/bat_v.c
+++ b/net/batman-adv/bat_v.c
@@ -668,6 +668,16 @@ err_ifinfo1:
         return ret;
 }
 
+/**
+ * batadv_v_init_sel_class - initialize GW selection class
+ * @bat_priv: the bat priv with all the soft interface information
+ */
+static void batadv_v_init_sel_class(struct batadv_priv *bat_priv)
+{
+        /* set default throughput difference threshold to 5Mbps */
+        atomic_set(&bat_priv->gw.sel_class, 50);
+}
+
 static ssize_t batadv_v_store_sel_class(struct batadv_priv *bat_priv,
                                         char *buff, size_t count)
 {
@@ -1052,6 +1062,7 @@ static struct batadv_algo_ops batadv_batman_v __read_mostly = {
                 .dump = batadv_v_orig_dump,
         },
         .gw = {
+                .init_sel_class = batadv_v_init_sel_class,
                 .store_sel_class = batadv_v_store_sel_class,
                 .show_sel_class = batadv_v_show_sel_class,
                 .get_best_gw_node = batadv_v_gw_get_best_gw_node,
@@ -1092,9 +1103,6 @@ int batadv_v_mesh_init(struct batadv_priv *bat_priv)
         if (ret < 0)
                 return ret;
 
-        /* set default throughput difference threshold to 5Mbps */
-        atomic_set(&bat_priv->gw.sel_class, 50);
-
         return 0;
 }
 
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 11a23fd6e1a0..8f964beaac28 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -404,7 +404,7 @@ out:
  * batadv_frag_create - create a fragment from skb
  * @skb: skb to create fragment from
  * @frag_head: header to use in new fragment
- * @mtu: size of new fragment
+ * @fragment_size: size of new fragment
  *
  * Split the passed skb into two fragments: A new one with size matching the
  * passed mtu and the old one with the rest. The new skb contains data from the
@@ -414,11 +414,11 @@ out:
  */
 static struct sk_buff *batadv_frag_create(struct sk_buff *skb,
                                           struct batadv_frag_packet *frag_head,
-                                          unsigned int mtu)
+                                          unsigned int fragment_size)
 {
         struct sk_buff *skb_fragment;
         unsigned int header_size = sizeof(*frag_head);
-        unsigned int fragment_size = mtu - header_size;
+        unsigned int mtu = fragment_size + header_size;
 
         skb_fragment = netdev_alloc_skb(NULL, mtu + ETH_HLEN);
         if (!skb_fragment)
@@ -456,7 +456,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
         struct sk_buff *skb_fragment;
         unsigned int mtu = neigh_node->if_incoming->net_dev->mtu;
         unsigned int header_size = sizeof(frag_header);
-        unsigned int max_fragment_size, max_packet_size;
+        unsigned int max_fragment_size, num_fragments;
         int ret;
 
         /* To avoid merge and refragmentation at next-hops we never send
@@ -464,10 +464,15 @@ int batadv_frag_send_packet(struct sk_buff *skb,
          */
         mtu = min_t(unsigned int, mtu, BATADV_FRAG_MAX_FRAG_SIZE);
         max_fragment_size = mtu - header_size;
-        max_packet_size = max_fragment_size * BATADV_FRAG_MAX_FRAGMENTS;
+
+        if (skb->len == 0 || max_fragment_size == 0)
+                return -EINVAL;
+
+        num_fragments = (skb->len - 1) / max_fragment_size + 1;
+        max_fragment_size = (skb->len - 1) / num_fragments + 1;
 
         /* Don't even try to fragment, if we need more than 16 fragments */
-        if (skb->len > max_packet_size) {
+        if (num_fragments > BATADV_FRAG_MAX_FRAGMENTS) {
                 ret = -EAGAIN;
                 goto free_skb;
         }
@@ -507,7 +512,8 @@ int batadv_frag_send_packet(struct sk_buff *skb,
                         goto put_primary_if;
                 }
 
-                skb_fragment = batadv_frag_create(skb, &frag_header, mtu);
+                skb_fragment = batadv_frag_create(skb, &frag_header,
+                                                  max_fragment_size);
                 if (!skb_fragment) {
                         ret = -ENOMEM;
                         goto put_primary_if;
diff --git a/net/batman-adv/gateway_common.c b/net/batman-adv/gateway_common.c
index 5db2e43e3775..33940c5c74a8 100644
--- a/net/batman-adv/gateway_common.c
+++ b/net/batman-adv/gateway_common.c
@@ -253,6 +253,11 @@ static void batadv_gw_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
  */
 void batadv_gw_init(struct batadv_priv *bat_priv)
 {
+        if (bat_priv->algo_ops->gw.init_sel_class)
+                bat_priv->algo_ops->gw.init_sel_class(bat_priv);
+        else
+                atomic_set(&bat_priv->gw.sel_class, 1);
+
         batadv_tvlv_handler_register(bat_priv, batadv_gw_tvlv_ogm_handler_v1,
                                      NULL, BATADV_TVLV_GW, 1,
                                      BATADV_TVLV_HANDLER_OGM_CIFNOTFND);
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 5d099b2e6cfc..d042c99af028 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -819,7 +819,6 @@ static int batadv_softif_init_late(struct net_device *dev)
         atomic_set(&bat_priv->mcast.num_want_all_ipv6, 0);
 #endif
         atomic_set(&bat_priv->gw.mode, BATADV_GW_MODE_OFF);
-        atomic_set(&bat_priv->gw.sel_class, 20);
         atomic_set(&bat_priv->gw.bandwidth_down, 100);
         atomic_set(&bat_priv->gw.bandwidth_up, 20);
         atomic_set(&bat_priv->orig_interval, 1000);
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 66b25e410a41..246f21b4973b 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -1489,6 +1489,7 @@ struct batadv_algo_orig_ops {
 
 /**
  * struct batadv_algo_gw_ops - mesh algorithm callbacks (GW specific)
+ * @init_sel_class: initialize GW selection class (optional)
  * @store_sel_class: parse and stores a new GW selection class (optional)
  * @show_sel_class: prints the current GW selection class (optional)
  * @get_best_gw_node: select the best GW from the list of available nodes
@@ -1499,6 +1500,7 @@ struct batadv_algo_orig_ops {
  * @dump: dump gateways to a netlink socket (optional)
  */
 struct batadv_algo_gw_ops {
+        void (*init_sel_class)(struct batadv_priv *bat_priv);
         ssize_t (*store_sel_class)(struct batadv_priv *bat_priv, char *buff,
                                    size_t count);
         ssize_t (*show_sel_class)(struct batadv_priv *bat_priv, char *buff);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index f307b145ea54..507b80d59dec 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -301,7 +301,7 @@ done:
 }
 
 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
-                             int flags)
+                             int flags, bool kern)
 {
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
         struct sock *sk = sock->sk, *nsk;
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index aa1a814ceddc..ac3c650cb234 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -471,7 +471,8 @@ done:
         return err;
 }
 
-static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
+static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags,
+                              bool kern)
 {
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
         struct sock *sk = sock->sk, *nsk;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index e4e9a2da1e7e..728e0c8dc8e7 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -627,7 +627,7 @@ done:
 }
 
 static int sco_sock_accept(struct socket *sock, struct socket *newsock,
-                           int flags)
+                           int flags, bool kern)
 {
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
         struct sock *sk = sock->sk, *ch;
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 4f598dc2d916..6e08b7199dd7 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -106,7 +106,7 @@ static struct net_bridge_fdb_entry *br_fdb_find(struct net_bridge *br,
         struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
         struct net_bridge_fdb_entry *fdb;
 
-        WARN_ON_ONCE(!br_hash_lock_held(br));
+        lockdep_assert_held_once(&br->hash_lock);
 
         rcu_read_lock();
         fdb = fdb_find_rcu(head, addr, vid);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 236f34244dbe..013f2290bfa5 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -30,6 +30,7 @@ EXPORT_SYMBOL(br_should_route_hook);
 static int
 br_netif_receive_skb(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
+        br_drop_fake_rtable(skb);
         return netif_receive_skb(skb);
 }
 
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 95087e6e8258..1f1e62095464 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -521,21 +521,6 @@ static unsigned int br_nf_pre_routing(void *priv,
 }
 
 
-/* PF_BRIDGE/LOCAL_IN ************************************************/
-/* The packet is locally destined, which requires a real
- * dst_entry, so detach the fake one.  On the way up, the
- * packet would pass through PRE_ROUTING again (which already
- * took place when the packet entered the bridge), but we
- * register an IPv4 PRE_ROUTING 'sabotage' hook that will
- * prevent this from happening. */
-static unsigned int br_nf_local_in(void *priv,
-                                   struct sk_buff *skb,
-                                   const struct nf_hook_state *state)
-{
-        br_drop_fake_rtable(skb);
-        return NF_ACCEPT;
-}
-
 /* PF_BRIDGE/FORWARD *************************************************/
 static int br_nf_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
@@ -721,18 +706,20 @@ static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb)
 
 static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
-        struct nf_bridge_info *nf_bridge;
-        unsigned int mtu_reserved;
+        struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
+        unsigned int mtu, mtu_reserved;
 
         mtu_reserved = nf_bridge_mtu_reduction(skb);
+        mtu = skb->dev->mtu;
 
-        if (skb_is_gso(skb) || skb->len + mtu_reserved <= skb->dev->mtu) {
+        if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
+                mtu = nf_bridge->frag_max_size;
+
+        if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) {
                 nf_bridge_info_free(skb);
                 return br_dev_queue_push_xmit(net, sk, skb);
         }
 
-        nf_bridge = nf_bridge_info_get(skb);
-
         /* This is wrong! We should preserve the original fragment
          * boundaries by preserving frag_list rather than refragmenting.
          */
@@ -908,12 +895,6 @@ static struct nf_hook_ops br_nf_ops[] __read_mostly = {
                 .priority = NF_BR_PRI_BRNF,
         },
         {
-                .hook = br_nf_local_in,
-                .pf = NFPROTO_BRIDGE,
-                .hooknum = NF_BR_LOCAL_IN,
-                .priority = NF_BR_PRI_BRNF,
-        },
-        {
                 .hook = br_nf_forward_ip,
                 .pf = NFPROTO_BRIDGE,
                 .hooknum = NF_BR_FORWARD,
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 2288fca7756c..61368186edea 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -531,15 +531,6 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
 int br_fdb_external_learn_del(struct net_bridge *br, struct net_bridge_port *p,
                               const unsigned char *addr, u16 vid);
 
-static inline bool br_hash_lock_held(struct net_bridge *br)
-{
-#ifdef CONFIG_LOCKDEP
-        return lockdep_is_held(&br->hash_lock);
-#else
-        return true;
-#endif
-}
-
 /* br_forward.c */
 enum br_pkt_type {
         BR_PKT_UNICAST,
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 464e88599b9d..108533859a53 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -230,6 +230,7 @@ enum {
         Opt_osdkeepalivetimeout,
         Opt_mount_timeout,
         Opt_osd_idle_ttl,
+        Opt_osd_request_timeout,
         Opt_last_int,
         /* int args above */
         Opt_fsid,
@@ -256,6 +257,7 @@ static match_table_t opt_tokens = {
         {Opt_osdkeepalivetimeout, "osdkeepalive=%d"},
         {Opt_mount_timeout, "mount_timeout=%d"},
         {Opt_osd_idle_ttl, "osd_idle_ttl=%d"},
+        {Opt_osd_request_timeout, "osd_request_timeout=%d"},
         /* int args above */
         {Opt_fsid, "fsid=%s"},
         {Opt_name, "name=%s"},
@@ -361,6 +363,7 @@ ceph_parse_options(char *options, const char *dev_name,
         opt->osd_keepalive_timeout = CEPH_OSD_KEEPALIVE_DEFAULT;
         opt->mount_timeout = CEPH_MOUNT_TIMEOUT_DEFAULT;
         opt->osd_idle_ttl = CEPH_OSD_IDLE_TTL_DEFAULT;
+        opt->osd_request_timeout = CEPH_OSD_REQUEST_TIMEOUT_DEFAULT;
 
         /* get mon ip(s) */
         /* ip1[:port1][,ip2[:port2]...] */
@@ -473,6 +476,15 @@ ceph_parse_options(char *options, const char *dev_name,
                         }
                         opt->mount_timeout = msecs_to_jiffies(intval * 1000);
                         break;
+                case Opt_osd_request_timeout:
+                        /* 0 is "wait forever" (i.e. infinite timeout) */
+                        if (intval < 0 || intval > INT_MAX / 1000) {
+                                pr_err("osd_request_timeout out of range\n");
+                                err = -EINVAL;
+                                goto out;
+                        }
+                        opt->osd_request_timeout = msecs_to_jiffies(intval * 1000);
+                        break;
 
                 case Opt_share:
                         opt->flags &= ~CEPH_OPT_NOSHARE;
@@ -557,6 +569,9 @@ int ceph_print_client_options(struct seq_file *m, struct ceph_client *client)
         if (opt->osd_keepalive_timeout != CEPH_OSD_KEEPALIVE_DEFAULT)
                 seq_printf(m, "osdkeepalivetimeout=%d,",
                     jiffies_to_msecs(opt->osd_keepalive_timeout) / 1000);
+        if (opt->osd_request_timeout != CEPH_OSD_REQUEST_TIMEOUT_DEFAULT)
+                seq_printf(m, "osd_request_timeout=%d,",
+                           jiffies_to_msecs(opt->osd_request_timeout) / 1000);
 
         /* drop redundant comma */
         if (m->count != pos)
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 38dcf1eb427d..f76bb3332613 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -7,6 +7,7 @@
 #include <linux/kthread.h>
 #include <linux/net.h>
 #include <linux/nsproxy.h>
+#include <linux/sched/mm.h>
 #include <linux/slab.h>
 #include <linux/socket.h>
 #include <linux/string.h>
@@ -469,11 +470,16 @@ static int ceph_tcp_connect(struct ceph_connection *con)
 {
         struct sockaddr_storage *paddr = &con->peer_addr.in_addr;
         struct socket *sock;
+        unsigned int noio_flag;
         int ret;
 
         BUG_ON(con->sock);
+
+        /* sock_create_kern() allocates with GFP_KERNEL */
+        noio_flag = memalloc_noio_save();
         ret = sock_create_kern(read_pnet(&con->msgr->net), paddr->ss_family,
                                SOCK_STREAM, IPPROTO_TCP, &sock);
+        memalloc_noio_restore(noio_flag);
         if (ret)
                 return ret;
         sock->sk->sk_allocation = GFP_NOFS;
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index b65bbf9f45eb..e15ea9e4c495 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1709,6 +1709,8 @@ static void account_request(struct ceph_osd_request *req)
 
         req->r_flags |= CEPH_OSD_FLAG_ONDISK;
         atomic_inc(&req->r_osdc->num_requests);
+
+        req->r_start_stamp = jiffies;
 }
 
 static void submit_request(struct ceph_osd_request *req, bool wrlocked)
@@ -1789,6 +1791,14 @@ static void cancel_request(struct ceph_osd_request *req)
         ceph_osdc_put_request(req);
 }
 
+static void abort_request(struct ceph_osd_request *req, int err)
+{
+        dout("%s req %p tid %llu err %d\n", __func__, req, req->r_tid, err);
+
+        cancel_map_check(req);
+        complete_request(req, err);
+}
+
 static void check_pool_dne(struct ceph_osd_request *req)
 {
         struct ceph_osd_client *osdc = req->r_osdc;
@@ -2487,6 +2497,7 @@ static void handle_timeout(struct work_struct *work)
                 container_of(work, struct ceph_osd_client, timeout_work.work);
         struct ceph_options *opts = osdc->client->options;
         unsigned long cutoff = jiffies - opts->osd_keepalive_timeout;
+        unsigned long expiry_cutoff = jiffies - opts->osd_request_timeout;
         LIST_HEAD(slow_osds);
         struct rb_node *n, *p;
 
@@ -2502,15 +2513,23 @@ static void handle_timeout(struct work_struct *work)
                 struct ceph_osd *osd = rb_entry(n, struct ceph_osd, o_node);
                 bool found = false;
 
-                for (p = rb_first(&osd->o_requests); p; p = rb_next(p)) {
+                for (p = rb_first(&osd->o_requests); p; ) {
                         struct ceph_osd_request *req =
                             rb_entry(p, struct ceph_osd_request, r_node);
 
+                        p = rb_next(p); /* abort_request() */
+
                         if (time_before(req->r_stamp, cutoff)) {
                                 dout(" req %p tid %llu on osd%d is laggy\n",
                                      req, req->r_tid, osd->o_osd);
                                 found = true;
                         }
+                        if (opts->osd_request_timeout &&
+                            time_before(req->r_start_stamp, expiry_cutoff)) {
+                                pr_err_ratelimited("tid %llu on osd%d timeout\n",
+                                       req->r_tid, osd->o_osd);
+                                abort_request(req, -ETIMEDOUT);
+                        }
                 }
                 for (p = rb_first(&osd->o_linger_requests); p; p = rb_next(p)) {
                         struct ceph_osd_linger_request *lreq =
@@ -2530,6 +2549,21 @@ static void handle_timeout(struct work_struct *work)
                         list_move_tail(&osd->o_keepalive_item, &slow_osds);
         }
 
+        if (opts->osd_request_timeout) {
+                for (p = rb_first(&osdc->homeless_osd.o_requests); p; ) {
+                        struct ceph_osd_request *req =
+                            rb_entry(p, struct ceph_osd_request, r_node);
+
+                        p = rb_next(p); /* abort_request() */
+
+                        if (time_before(req->r_start_stamp, expiry_cutoff)) {
+                                pr_err_ratelimited("tid %llu on osd%d timeout\n",
+                                       req->r_tid, osdc->homeless_osd.o_osd);
+                                abort_request(req, -ETIMEDOUT);
+                        }
+                }
+        }
+
         if (atomic_read(&osdc->num_homeless) || !list_empty(&slow_osds))
                 maybe_request_map(osdc);
 
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 6824c0ec8373..ffe9e904d4d1 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -390,9 +390,8 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
         dout("crush decode tunable chooseleaf_stable = %d\n",
              c->chooseleaf_stable);
 
-        crush_finalize(c);
-
 done:
+        crush_finalize(c);
         dout("crush_decode success\n");
         return c;
 
@@ -1380,7 +1379,6 @@ static int decode_new_up_state_weight(void **p, void *end,
                 if ((map->osd_state[osd] & CEPH_OSD_EXISTS) &&
                     (xorstate & CEPH_OSD_EXISTS)) {
                         pr_info("osd%d does not exist\n", osd);
-                        map->osd_weight[osd] = CEPH_OSD_IN;
                         ret = set_primary_affinity(map, osd,
                                                    CEPH_OSD_DEFAULT_PRIMARY_AFFINITY);
                         if (ret)
diff --git a/net/core/dev.c b/net/core/dev.c
index 8637b2b71f3d..7869ae3837ca 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1304,6 +1304,7 @@ void netdev_notify_peers(struct net_device *dev)
 {
         rtnl_lock();
         call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, dev);
+        call_netdevice_notifiers(NETDEV_RESEND_IGMP, dev);
         rtnl_unlock();
 }
 EXPORT_SYMBOL(netdev_notify_peers);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 3945821e9c1f..65ea0ff4017c 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -953,7 +953,7 @@ net_rx_queue_update_kobjects(struct net_device *dev, int old_num, int new_num)
         while (--i >= new_num) {
                 struct kobject *kobj = &dev->_rx[i].kobj;
 
-                if (!list_empty(&dev_net(dev)->exit_list))
+                if (!atomic_read(&dev_net(dev)->count))
                         kobj->uevent_suppress = 1;
                 if (dev->sysfs_rx_queue_group)
                         sysfs_remove_group(kobj, dev->sysfs_rx_queue_group);
@@ -1371,7 +1371,7 @@ netdev_queue_update_kobjects(struct net_device *dev, int old_num, int new_num)
         while (--i >= new_num) {
                 struct netdev_queue *queue = dev->_tx + i;
 
-                if (!list_empty(&dev_net(dev)->exit_list))
+                if (!atomic_read(&dev_net(dev)->count))
                         queue->kobj.uevent_suppress = 1;
 #ifdef CONFIG_BQL
                 sysfs_remove_group(&queue->kobj, &dql_group);
@@ -1558,7 +1558,7 @@ void netdev_unregister_kobject(struct net_device *ndev)
 {
         struct device *dev = &(ndev->dev);
 
-        if (!list_empty(&dev_net(ndev)->exit_list))
+        if (!atomic_read(&dev_net(ndev)->count))
                 dev_set_uevent_suppress(dev, 1);
 
         kobject_get(&dev->kobj);
diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c
index 6ae56037bb13..029a61ac6cdd 100644
--- a/net/core/netclassid_cgroup.c
+++ b/net/core/netclassid_cgroup.c
@@ -71,27 +71,17 @@ static int update_classid_sock(const void *v, struct file *file, unsigned n)
         return 0;
 }
 
-static void update_classid(struct cgroup_subsys_state *css, void *v)
+static void cgrp_attach(struct cgroup_taskset *tset)
 {
-        struct css_task_iter it;
+        struct cgroup_subsys_state *css;
         struct task_struct *p;
 
-        css_task_iter_start(css, &it);
-        while ((p = css_task_iter_next(&it))) {
+        cgroup_taskset_for_each(p, css, tset) {
                 task_lock(p);
-                iterate_fd(p->files, 0, update_classid_sock, v);
+                iterate_fd(p->files, 0, update_classid_sock,
+                           (void *)(unsigned long)css_cls_state(css)->classid);
                 task_unlock(p);
         }
-        css_task_iter_end(&it);
-}
-
-static void cgrp_attach(struct cgroup_taskset *tset)
-{
-        struct cgroup_subsys_state *css;
-
-        cgroup_taskset_first(tset, &css);
-        update_classid(css,
-                       (void *)(unsigned long)css_cls_state(css)->classid);
 }
 
 static u64 read_classid(struct cgroup_subsys_state *css, struct cftype *cft)
@@ -103,12 +93,22 @@ static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft,
                          u64 value)
 {
         struct cgroup_cls_state *cs = css_cls_state(css);
+        struct css_task_iter it;
+        struct task_struct *p;
 
         cgroup_sk_alloc_disable();
 
         cs->classid = (u32)value;
 
-        update_classid(css, (void *)(unsigned long)cs->classid);
+        css_task_iter_start(css, &it);
+        while ((p = css_task_iter_next(&it))) {
+                task_lock(p);
+                iterate_fd(p->files, 0, update_classid_sock,
+                           (void *)(unsigned long)cs->classid);
+                task_unlock(p);
+        }
+        css_task_iter_end(&it);
+
         return 0;
 }
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f3557958e9bf..9f781092fda9 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3694,6 +3694,15 @@ static void sock_rmem_free(struct sk_buff *skb)
         atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
 }
 
+static void skb_set_err_queue(struct sk_buff *skb)
+{
+        /* pkt_type of skbs received on local sockets is never PACKET_OUTGOING.
+         * So, it is safe to (mis)use it to mark skbs on the error queue.
+         */
+        skb->pkt_type = PACKET_OUTGOING;
+        BUILD_BUG_ON(PACKET_OUTGOING == 0);
+}
+
 /*
  * Note: We dont mem charge error packets (no sk_forward_alloc changes)
  */
@@ -3707,6 +3716,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
         skb->sk = sk;
         skb->destructor = sock_rmem_free;
         atomic_add(skb->truesize, &sk->sk_rmem_alloc);
+        skb_set_err_queue(skb);
 
         /* before exiting rcu section, make sure dst is refcounted */
         skb_dst_force(skb);
@@ -3783,16 +3793,20 @@ EXPORT_SYMBOL(skb_clone_sk);
 
 static void __skb_complete_tx_timestamp(struct sk_buff *skb,
                                         struct sock *sk,
-                                        int tstype)
+                                        int tstype,
+                                        bool opt_stats)
 {
         struct sock_exterr_skb *serr;
         int err;
 
+        BUILD_BUG_ON(sizeof(struct sock_exterr_skb) > sizeof(skb->cb));
+
         serr = SKB_EXT_ERR(skb);
         memset(serr, 0, sizeof(*serr));
         serr->ee.ee_errno = ENOMSG;
         serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
         serr->ee.ee_info = tstype;
+        serr->opt_stats = opt_stats;
         if (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) {
                 serr->ee.ee_data = skb_shinfo(skb)->tskey;
                 if (sk->sk_protocol == IPPROTO_TCP &&
@@ -3828,13 +3842,14 @@ void skb_complete_tx_timestamp(struct sk_buff *skb,
         if (!skb_may_tx_timestamp(sk, false))
                 return;
 
-        /* take a reference to prevent skb_orphan() from freeing the socket */
-        sock_hold(sk);
-
-        *skb_hwtstamps(skb) = *hwtstamps;
-        __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND);
-
-        sock_put(sk);
+        /* Take a reference to prevent skb_orphan() from freeing the socket,
+         * but only if the socket refcount is not zero.
+         */
+        if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
+                *skb_hwtstamps(skb) = *hwtstamps;
+                __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND, false);
+                sock_put(sk);
+        }
 }
 EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp);
 
@@ -3843,7 +3858,7 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
                      struct sock *sk, int tstype)
 {
         struct sk_buff *skb;
-        bool tsonly;
+        bool tsonly, opt_stats = false;
 
         if (!sk)
                 return;
@@ -3856,9 +3871,10 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
 #ifdef CONFIG_INET
                 if ((sk->sk_tsflags & SOF_TIMESTAMPING_OPT_STATS) &&
                     sk->sk_protocol == IPPROTO_TCP &&
-                    sk->sk_type == SOCK_STREAM)
+                    sk->sk_type == SOCK_STREAM) {
                         skb = tcp_get_timestamping_opt_stats(sk);
-                else
+                        opt_stats = true;
+                } else
 #endif
                         skb = alloc_skb(0, GFP_ATOMIC);
         } else {
@@ -3877,7 +3893,7 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
         else
                 skb->tstamp = ktime_get_real();
 
-        __skb_complete_tx_timestamp(skb, sk, tstype);
+        __skb_complete_tx_timestamp(skb, sk, tstype, opt_stats);
 }
 EXPORT_SYMBOL_GPL(__skb_tstamp_tx);
 
@@ -3893,7 +3909,7 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked)
 {
         struct sock *sk = skb->sk;
         struct sock_exterr_skb *serr;
-        int err;
+        int err = 1;
 
         skb->wifi_acked_valid = 1;
         skb->wifi_acked = acked;
@@ -3903,14 +3919,15 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked)
         serr->ee.ee_errno = ENOMSG;
         serr->ee.ee_origin = SO_EE_ORIGIN_TXSTATUS;
 
-        /* take a reference to prevent skb_orphan() from freeing the socket */
-        sock_hold(sk);
-
-        err = sock_queue_err_skb(sk, skb);
+        /* Take a reference to prevent skb_orphan() from freeing the socket,
+         * but only if the socket refcount is not zero.
+         */
+        if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
+                err = sock_queue_err_skb(sk, skb);
+                sock_put(sk);
+        }
         if (err)
                 kfree_skb(skb);
-
-        sock_put(sk);
 }
 EXPORT_SYMBOL_GPL(skb_complete_wifi_ack);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index f6fd79f33097..2c4f574168fb 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -197,66 +197,55 @@ EXPORT_SYMBOL(sk_net_capable);
 
 /*
  * Each address family might have different locking rules, so we have
- * one slock key per address family:
+ * one slock key per address family and separate keys for internal and
+ * userspace sockets.
  */
 static struct lock_class_key af_family_keys[AF_MAX];
+static struct lock_class_key af_family_kern_keys[AF_MAX];
 static struct lock_class_key af_family_slock_keys[AF_MAX];
+static struct lock_class_key af_family_kern_slock_keys[AF_MAX];
 
 /*
  * Make lock validator output more readable. (we pre-construct these
  * strings build-time, so that runtime initialization of socket
  * locks is fast):
  */
+
+#define _sock_locks(x)                                            \
+  x "AF_UNSPEC",        x "AF_UNIX"     ,       x "AF_INET"     , \
+  x "AF_AX25"  ,        x "AF_IPX"      ,       x "AF_APPLETALK", \
+  x "AF_NETROM",        x "AF_BRIDGE"   ,       x "AF_ATMPVC"   , \
+  x "AF_X25"   ,        x "AF_INET6"    ,       x "AF_ROSE"     , \
+  x "AF_DECnet",        x "AF_NETBEUI"  ,       x "AF_SECURITY" , \
+  x "AF_KEY"   ,        x "AF_NETLINK"  ,       x "AF_PACKET"   , \
+  x "AF_ASH"   ,        x "AF_ECONET"   ,       x "AF_ATMSVC"   , \
+  x "AF_RDS"   ,        x "AF_SNA"      ,       x "AF_IRDA"     , \
+  x "AF_PPPOX" ,        x "AF_WANPIPE"  ,       x "AF_LLC"      , \
+  x "27"       ,        x "28"          ,       x "AF_CAN"      , \
+  x "AF_TIPC"  ,        x "AF_BLUETOOTH",       x "IUCV"        , \
+  x "AF_RXRPC" ,        x "AF_ISDN"     ,       x "AF_PHONET"   , \
+  x "AF_IEEE802154",    x "AF_CAIF"     ,       x "AF_ALG"      , \
+  x "AF_NFC"   ,        x "AF_VSOCK"    ,       x "AF_KCM"      , \
+  x "AF_QIPCRTR",       x "AF_SMC"      ,       x "AF_MAX"
+
 static const char *const af_family_key_strings[AF_MAX+1] = {
-  "sk_lock-AF_UNSPEC", "sk_lock-AF_UNIX"     , "sk_lock-AF_INET"     ,
-  "sk_lock-AF_AX25"  , "sk_lock-AF_IPX"      , "sk_lock-AF_APPLETALK",
-  "sk_lock-AF_NETROM", "sk_lock-AF_BRIDGE"   , "sk_lock-AF_ATMPVC"   ,
-  "sk_lock-AF_X25"   , "sk_lock-AF_INET6"    , "sk_lock-AF_ROSE"     ,
-  "sk_lock-AF_DECnet", "sk_lock-AF_NETBEUI"  , "sk_lock-AF_SECURITY" ,
-  "sk_lock-AF_KEY"   , "sk_lock-AF_NETLINK"  , "sk_lock-AF_PACKET"   ,
-  "sk_lock-AF_ASH"   , "sk_lock-AF_ECONET"   , "sk_lock-AF_ATMSVC"   ,
-  "sk_lock-AF_RDS"   , "sk_lock-AF_SNA"      , "sk_lock-AF_IRDA"     ,
-  "sk_lock-AF_PPPOX" , "sk_lock-AF_WANPIPE"  , "sk_lock-AF_LLC"      ,
-  "sk_lock-27"       , "sk_lock-28"          , "sk_lock-AF_CAN"      ,
-  "sk_lock-AF_TIPC"  , "sk_lock-AF_BLUETOOTH", "sk_lock-IUCV"        ,
-  "sk_lock-AF_RXRPC" , "sk_lock-AF_ISDN"     , "sk_lock-AF_PHONET"   ,
-  "sk_lock-AF_IEEE802154", "sk_lock-AF_CAIF" , "sk_lock-AF_ALG"      ,
-  "sk_lock-AF_NFC"   , "sk_lock-AF_VSOCK"    , "sk_lock-AF_KCM"      ,
-  "sk_lock-AF_QIPCRTR", "sk_lock-AF_SMC"     , "sk_lock-AF_MAX"
+        _sock_locks("sk_lock-")
 };
 static const char *const af_family_slock_key_strings[AF_MAX+1] = {
-  "slock-AF_UNSPEC", "slock-AF_UNIX"     , "slock-AF_INET"     ,
-  "slock-AF_AX25"  , "slock-AF_IPX"      , "slock-AF_APPLETALK",
-  "slock-AF_NETROM", "slock-AF_BRIDGE"   , "slock-AF_ATMPVC"   ,
-  "slock-AF_X25"   , "slock-AF_INET6"    , "slock-AF_ROSE"     ,
-  "slock-AF_DECnet", "slock-AF_NETBEUI"  , "slock-AF_SECURITY" ,
-  "slock-AF_KEY"   , "slock-AF_NETLINK"  , "slock-AF_PACKET"   ,
-  "slock-AF_ASH"   , "slock-AF_ECONET"   , "slock-AF_ATMSVC"   ,
-  "slock-AF_RDS"   , "slock-AF_SNA"      , "slock-AF_IRDA"     ,
-  "slock-AF_PPPOX" , "slock-AF_WANPIPE"  , "slock-AF_LLC"      ,
-  "slock-27"       , "slock-28"          , "slock-AF_CAN"      ,
-  "slock-AF_TIPC"  , "slock-AF_BLUETOOTH", "slock-AF_IUCV"     ,
-  "slock-AF_RXRPC" , "slock-AF_ISDN"     , "slock-AF_PHONET"   ,
-  "slock-AF_IEEE802154", "slock-AF_CAIF" , "slock-AF_ALG"      ,
-  "slock-AF_NFC"   , "slock-AF_VSOCK"    ,"slock-AF_KCM"       ,
-  "slock-AF_QIPCRTR", "slock-AF_SMC"     , "slock-AF_MAX"
+        _sock_locks("slock-")
 };
 static const char *const af_family_clock_key_strings[AF_MAX+1] = {
-  "clock-AF_UNSPEC", "clock-AF_UNIX"     , "clock-AF_INET"     ,
-  "clock-AF_AX25"  , "clock-AF_IPX"      , "clock-AF_APPLETALK",
-  "clock-AF_NETROM", "clock-AF_BRIDGE"   , "clock-AF_ATMPVC"   ,
-  "clock-AF_X25"   , "clock-AF_INET6"    , "clock-AF_ROSE"     ,
-  "clock-AF_DECnet", "clock-AF_NETBEUI"  , "clock-AF_SECURITY" ,
-  "clock-AF_KEY"   , "clock-AF_NETLINK"  , "clock-AF_PACKET"   ,
-  "clock-AF_ASH"   , "clock-AF_ECONET"   , "clock-AF_ATMSVC"   ,
-  "clock-AF_RDS"   , "clock-AF_SNA"      , "clock-AF_IRDA"     ,
-  "clock-AF_PPPOX" , "clock-AF_WANPIPE"  , "clock-AF_LLC"      ,
-  "clock-27"       , "clock-28"          , "clock-AF_CAN"      ,
-  "clock-AF_TIPC"  , "clock-AF_BLUETOOTH", "clock-AF_IUCV"     ,
-  "clock-AF_RXRPC" , "clock-AF_ISDN"     , "clock-AF_PHONET"   ,
-  "clock-AF_IEEE802154", "clock-AF_CAIF" , "clock-AF_ALG"      ,
-  "clock-AF_NFC"   , "clock-AF_VSOCK"    , "clock-AF_KCM"      ,
-  "clock-AF_QIPCRTR", "clock-AF_SMC"     , "clock-AF_MAX"
+        _sock_locks("clock-")
+};
+
+static const char *const af_family_kern_key_strings[AF_MAX+1] = {
+        _sock_locks("k-sk_lock-")
+};
+static const char *const af_family_kern_slock_key_strings[AF_MAX+1] = {
+        _sock_locks("k-slock-")
+};
+static const char *const af_family_kern_clock_key_strings[AF_MAX+1] = {
+        _sock_locks("k-clock-")
 };
 
 /*
@@ -264,6 +253,7 @@ static const char *const af_family_clock_key_strings[AF_MAX+1] = {
  * so split the lock classes by using a per-AF key:
  */
 static struct lock_class_key af_callback_keys[AF_MAX];
+static struct lock_class_key af_kern_callback_keys[AF_MAX];
 
 /* Take into consideration the size of the struct sk_buff overhead in the
  * determination of these values, since that is non-constant across
@@ -1293,7 +1283,16 @@ lenout:
  */
 static inline void sock_lock_init(struct sock *sk)
 {
-        sock_lock_init_class_and_name(sk,
+        if (sk->sk_kern_sock)
+                sock_lock_init_class_and_name(
+                        sk,
+                        af_family_kern_slock_key_strings[sk->sk_family],
+                        af_family_kern_slock_keys + sk->sk_family,
+                        af_family_kern_key_strings[sk->sk_family],
+                        af_family_kern_keys + sk->sk_family);
+        else
+                sock_lock_init_class_and_name(
+                        sk,
                         af_family_slock_key_strings[sk->sk_family],
                         af_family_slock_keys + sk->sk_family,
                         af_family_key_strings[sk->sk_family],
@@ -1399,6 +1398,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
                  * why we need sk_prot_creator -acme
                  */
                 sk->sk_prot = sk->sk_prot_creator = prot;
+                sk->sk_kern_sock = kern;
                 sock_lock_init(sk);
                 sk->sk_net_refcnt = kern ? 0 : 1;
                 if (likely(sk->sk_net_refcnt))
@@ -1442,6 +1442,11 @@ static void __sk_destruct(struct rcu_head *head)
                 pr_debug("%s: optmem leakage (%d bytes) detected\n",
                          __func__, atomic_read(&sk->sk_omem_alloc));
 
+        if (sk->sk_frag.page) {
+                put_page(sk->sk_frag.page);
+                sk->sk_frag.page = NULL;
+        }
+
         if (sk->sk_peer_cred)
                 put_cred(sk->sk_peer_cred);
         put_pid(sk->sk_peer_pid);
@@ -1539,6 +1544,12 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                         is_charged = sk_filter_charge(newsk, filter);
 
                 if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) {
+                        /* We need to make sure that we don't uncharge the new
+                         * socket if we couldn't charge it in the first place
+                         * as otherwise we uncharge the parent's filter.
+                         */
+                        if (!is_charged)
+                                RCU_INIT_POINTER(newsk->sk_filter, NULL);
                         sk_free_unlock_clone(newsk);
                         newsk = NULL;
                         goto out;
@@ -2277,7 +2288,8 @@ int sock_no_socketpair(struct socket *sock1, struct socket *sock2)
 }
 EXPORT_SYMBOL(sock_no_socketpair);
 
-int sock_no_accept(struct socket *sock, struct socket *newsock, int flags)
+int sock_no_accept(struct socket *sock, struct socket *newsock, int flags,
+                   bool kern)
 {
         return -EOPNOTSUPP;
 }
@@ -2481,7 +2493,14 @@ void sock_init_data(struct socket *sock, struct sock *sk)
         }
 
         rwlock_init(&sk->sk_callback_lock);
-        lockdep_set_class_and_name(&sk->sk_callback_lock,
+        if (sk->sk_kern_sock)
+                lockdep_set_class_and_name(
+                        &sk->sk_callback_lock,
+                        af_kern_callback_keys + sk->sk_family,
+                        af_family_kern_clock_key_strings[sk->sk_family]);
+        else
+                lockdep_set_class_and_name(
+                        &sk->sk_callback_lock,
                         af_callback_keys + sk->sk_family,
                         af_family_clock_key_strings[sk->sk_family]);
 
@@ -2779,11 +2798,6 @@ void sk_common_release(struct sock *sk)
 
         sk_refcnt_debug_release(sk);
 
-        if (sk->sk_frag.page) {
-                put_page(sk->sk_frag.page);
-                sk->sk_frag.page = NULL;
-        }
-
         sock_put(sk);
 }
 EXPORT_SYMBOL(sk_common_release);
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index f053198e730c..5e3a7302f774 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -749,6 +749,7 @@ static void ccid2_hc_tx_exit(struct sock *sk)
         for (i = 0; i < hc->tx_seqbufc; i++)
                 kfree(hc->tx_seqbuf[i]);
         hc->tx_seqbufc = 0;
+        dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks);
 }
 
 static void ccid2_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 409d0cfd3447..b99168b0fabf 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -289,7 +289,8 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
 
         switch (type) {
         case ICMP_REDIRECT:
-                dccp_do_redirect(skb, sk);
+                if (!sock_owned_by_user(sk))
+                        dccp_do_redirect(skb, sk);
                 goto out;
         case ICMP_SOURCE_QUENCH:
                 /* Just silently ignore these. */
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 233b57367758..d9b6a4e403e7 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -122,10 +122,12 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         np = inet6_sk(sk);
 
         if (type == NDISC_REDIRECT) {
-                struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
+                if (!sock_owned_by_user(sk)) {
+                        struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 
-                if (dst)
-                        dst->ops->redirect(dst, sk, skb);
+                        if (dst)
+                                dst->ops->redirect(dst, sk, skb);
+                }
                 goto out;
         }
 
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index e267e6f4c9a5..abd07a443219 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -142,6 +142,13 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
         struct dccp_request_sock *dreq = dccp_rsk(req);
         bool own_req;
 
+        /* TCP/DCCP listeners became lockless.
+         * DCCP stores complex state in its request_sock, so we need
+         * a protection for them, now this code runs without being protected
+         * by the parent (listener) lock.
+         */
+        spin_lock_bh(&dreq->dreq_lock);
+
         /* Check for retransmitted REQUEST */
         if (dccp_hdr(skb)->dccph_type == DCCP_PKT_REQUEST) {
 
@@ -156,7 +163,7 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
                         inet_rtx_syn_ack(sk, req);
                 }
                 /* Network Duplicate, discard packet */
-                return NULL;
+                goto out;
         }
 
         DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_PACKET_ERROR;
@@ -182,20 +189,20 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
 
         child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
                                                          req, &own_req);
-        if (!child)
-                goto listen_overflow;
-
-        return inet_csk_complete_hashdance(sk, child, req, own_req);
+        if (child) {
+                child = inet_csk_complete_hashdance(sk, child, req, own_req);
+                goto out;
+        }
 
-listen_overflow:
-        dccp_pr_debug("listen_overflow!\n");
         DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_TOO_BUSY;
 drop:
         if (dccp_hdr(skb)->dccph_type != DCCP_PKT_RESET)
                 req->rsk_ops->send_reset(sk, skb);
 
         inet_csk_reqsk_queue_drop(sk, req);
-        return NULL;
+out:
+        spin_unlock_bh(&dreq->dreq_lock);
+        return child;
 }
 
 EXPORT_SYMBOL_GPL(dccp_check_req);
@@ -246,6 +253,7 @@ int dccp_reqsk_init(struct request_sock *req,
 {
         struct dccp_request_sock *dreq = dccp_rsk(req);
 
+        spin_lock_init(&dreq->dreq_lock);
         inet_rsk(req)->ir_rmt_port = dccp_hdr(skb)->dccph_sport;
         inet_rsk(req)->ir_num      = ntohs(dccp_hdr(skb)->dccph_dport);
         inet_rsk(req)->acked       = 0;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index e6e79eda9763..7de5b40a5d0d 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1070,7 +1070,8 @@ static struct sk_buff *dn_wait_for_connect(struct sock *sk, long *timeo)
         return skb == NULL ? ERR_PTR(err) : skb;
 }
 
-static int dn_accept(struct socket *sock, struct socket *newsock, int flags)
+static int dn_accept(struct socket *sock, struct socket *newsock, int flags,
+                     bool kern)
 {
         struct sock *sk = sock->sk, *newsk;
         struct sk_buff *skb = NULL;
@@ -1099,7 +1100,7 @@ static int dn_accept(struct socket *sock, struct socket *newsock, int flags)
 
         cb = DN_SKB_CB(skb);
         sk->sk_ack_backlog--;
-        newsk = dn_alloc_sock(sock_net(sk), newsock, sk->sk_allocation, 0);
+        newsk = dn_alloc_sock(sock_net(sk), newsock, sk->sk_allocation, kern);
         if (newsk == NULL) {
                 release_sock(sk);
                 kfree_skb(skb);
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 602d40f43687..6b1fc6e4278e 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -689,11 +689,12 @@ EXPORT_SYMBOL(inet_stream_connect);
  *      Accept a pending connection. The TCP layer now gives BSD semantics.
  */
 
-int inet_accept(struct socket *sock, struct socket *newsock, int flags)
+int inet_accept(struct socket *sock, struct socket *newsock, int flags,
+                bool kern)
 {
         struct sock *sk1 = sock->sk;
         int err = -EINVAL;
-        struct sock *sk2 = sk1->sk_prot->accept(sk1, flags, &err);
+        struct sock *sk2 = sk1->sk_prot->accept(sk1, flags, &err, kern);
 
         if (!sk2)
                 goto do_err;
@@ -1487,8 +1488,10 @@ int inet_gro_complete(struct sk_buff *skb, int nhoff)
         int proto = iph->protocol;
         int err = -ENOSYS;
 
-        if (skb->encapsulation)
+        if (skb->encapsulation) {
+                skb_set_inner_protocol(skb, cpu_to_be16(ETH_P_IP));
                 skb_set_inner_network_header(skb, nhoff);
+        }
 
         csum_replace2(&iph->check, iph->tot_len, newlen);
         iph->tot_len = newlen;
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 42bfd08109dd..8f2133ffc2ff 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1083,7 +1083,8 @@ static void nl_fib_input(struct sk_buff *skb)
 
         net = sock_net(skb->sk);
         nlh = nlmsg_hdr(skb);
-        if (skb->len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len ||
+        if (skb->len < nlmsg_total_size(sizeof(*frn)) ||
+            skb->len < nlh->nlmsg_len ||
             nlmsg_len(nlh) < sizeof(*frn))
                 return;
 
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index b4d5980ade3b..5e313c1ac94f 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -424,7 +424,7 @@ static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
 /*
  * This will accept the next outstanding connection.
  */
-struct sock *inet_csk_accept(struct sock *sk, int flags, int *err)
+struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct request_sock_queue *queue = &icsk->icsk_accept_queue;
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index bbe7f72db9c1..b3cdeec85f1f 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -198,6 +198,7 @@ static void ip_expire(unsigned long arg)
         qp = container_of((struct inet_frag_queue *) arg, struct ipq, q);
         net = container_of(qp->q.net, struct net, ipv4.frags);
 
+        rcu_read_lock();
         spin_lock(&qp->q.lock);
 
         if (qp->q.flags & INET_FRAG_COMPLETE)
@@ -207,7 +208,7 @@ static void ip_expire(unsigned long arg)
         __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS);
 
         if (!inet_frag_evicting(&qp->q)) {
-                struct sk_buff *head = qp->q.fragments;
+                struct sk_buff *clone, *head = qp->q.fragments;
                 const struct iphdr *iph;
                 int err;
 
@@ -216,32 +217,40 @@ static void ip_expire(unsigned long arg)
                 if (!(qp->q.flags & INET_FRAG_FIRST_IN) || !qp->q.fragments)
                         goto out;
 
-                rcu_read_lock();
                 head->dev = dev_get_by_index_rcu(net, qp->iif);
                 if (!head->dev)
-                        goto out_rcu_unlock;
+                        goto out;
+
 
                 /* skb has no dst, perform route lookup again */
                 iph = ip_hdr(head);
                 err = ip_route_input_noref(head, iph->daddr, iph->saddr,
                                            iph->tos, head->dev);
                 if (err)
-                        goto out_rcu_unlock;
+                        goto out;
 
                 /* Only an end host needs to send an ICMP
                  * "Fragment Reassembly Timeout" message, per RFC792.
                  */
                 if (frag_expire_skip_icmp(qp->user) &&
                     (skb_rtable(head)->rt_type != RTN_LOCAL))
-                        goto out_rcu_unlock;
+                        goto out;
+
+                clone = skb_clone(head, GFP_ATOMIC);
 
                 /* Send an ICMP "Fragment Reassembly Timeout" message. */
-                icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
-out_rcu_unlock:
-                rcu_read_unlock();
+                if (clone) {
+                        spin_unlock(&qp->q.lock);
+                        icmp_send(clone, ICMP_TIME_EXCEEDED,
+                                  ICMP_EXC_FRAGTIME, 0);
+                        consume_skb(clone);
+                        goto out_rcu_unlock;
+                }
         }
 out:
         spin_unlock(&qp->q.lock);
+out_rcu_unlock:
+        rcu_read_unlock();
         ipq_put(qp);
 }
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 737ce826d7ec..7a3fd25e8913 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -966,7 +966,7 @@ static int __ip_append_data(struct sock *sk,
         cork->length += length;
         if ((((length + fragheaderlen) > mtu) || (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+            (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
             (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
                 err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, transhdrlen,
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index bc1486f2c064..2e14ed11a35c 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -165,6 +165,10 @@ static unsigned int ipv4_conntrack_local(void *priv,
         if (skb->len < sizeof(struct iphdr) ||
             ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
+
+        if (ip_is_fragment(ip_hdr(skb))) /* IP_NODEFRAG setsockopt set */
+                return NF_ACCEPT;
+
         return nf_conntrack_in(state->net, PF_INET, state->hook, skb);
 }
 
diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
index f8aad03d674b..6f5e8d01b876 100644
--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
@@ -255,11 +255,6 @@ nf_nat_ipv4_fn(void *priv, struct sk_buff *skb,
         /* maniptype == SRC for postrouting. */
         enum nf_nat_manip_type maniptype = HOOK2MANIP(state->hook);
 
-        /* We never see fragments: conntrack defrags on pre-routing
-         * and local-out, and nf_nat_out protects post-routing.
-         */
-        NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb)));
-
         ct = nf_ct_get(skb, &ctinfo);
         /* Can't track?  It's not due to stress, or conntrack would
          * have dropped it.  Hence it's the user's responsibilty to
diff --git a/net/ipv4/netfilter/nft_masq_ipv4.c b/net/ipv4/netfilter/nft_masq_ipv4.c
index a0ea8aad1bf1..f18677277119 100644
--- a/net/ipv4/netfilter/nft_masq_ipv4.c
+++ b/net/ipv4/netfilter/nft_masq_ipv4.c
@@ -26,10 +26,10 @@ static void nft_masq_ipv4_eval(const struct nft_expr *expr,
         memset(&range, 0, sizeof(range));
         range.flags = priv->flags;
         if (priv->sreg_proto_min) {
-                range.min_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min];
-                range.max_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max];
+                range.min_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                range.max_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
         }
         regs->verdict.code = nf_nat_masquerade_ipv4(pkt->skb, nft_hook(pkt),
                                                     &range, nft_out(pkt));
diff --git a/net/ipv4/netfilter/nft_redir_ipv4.c b/net/ipv4/netfilter/nft_redir_ipv4.c
index 1650ed23c15d..5120be1d3118 100644
--- a/net/ipv4/netfilter/nft_redir_ipv4.c
+++ b/net/ipv4/netfilter/nft_redir_ipv4.c
@@ -26,10 +26,10 @@ static void nft_redir_ipv4_eval(const struct nft_expr *expr,
 
         memset(&mr, 0, sizeof(mr));
         if (priv->sreg_proto_min) {
-                mr.range[0].min.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min];
-                mr.range[0].max.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max];
+                mr.range[0].min.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                mr.range[0].max.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
                 mr.range[0].flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
         }
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index cf4555581282..1e319a525d51 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2770,7 +2770,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
 {
         const struct tcp_sock *tp = tcp_sk(sk); /* iff sk_type == SOCK_STREAM */
         const struct inet_connection_sock *icsk = inet_csk(sk);
-        u32 now = tcp_time_stamp, intv;
+        u32 now, intv;
         u64 rate64;
         bool slow;
         u32 rate;
@@ -2839,6 +2839,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
         info->tcpi_retrans = tp->retrans_out;
         info->tcpi_fackets = tp->fackets_out;
 
+        now = tcp_time_stamp;
         info->tcpi_last_data_sent = jiffies_to_msecs(now - tp->lsndtime);
         info->tcpi_last_data_recv = jiffies_to_msecs(now - icsk->icsk_ack.lrcvtime);
         info->tcpi_last_ack_recv = jiffies_to_msecs(now - tp->rcv_tstamp);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 39c393cc0fd3..c43119726a62 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5541,6 +5541,7 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb)
         struct inet_connection_sock *icsk = inet_csk(sk);
 
         tcp_set_state(sk, TCP_ESTABLISHED);
+        icsk->icsk_ack.lrcvtime = tcp_time_stamp;
 
         if (skb) {
                 icsk->icsk_af_ops->sk_rx_dst_set(sk, skb);
@@ -5759,7 +5760,6 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                          * to stand against the temptation 8)     --ANK
                          */
                         inet_csk_schedule_ack(sk);
-                        icsk->icsk_ack.lrcvtime = tcp_time_stamp;
                         tcp_enter_quickack_mode(sk);
                         inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
                                                   TCP_DELACK_MAX, TCP_RTO_MAX);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 9a89b8deafae..575e19dcc017 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -279,10 +279,13 @@ EXPORT_SYMBOL(tcp_v4_connect);
  */
 void tcp_v4_mtu_reduced(struct sock *sk)
 {
-        struct dst_entry *dst;
         struct inet_sock *inet = inet_sk(sk);
-        u32 mtu = tcp_sk(sk)->mtu_info;
+        struct dst_entry *dst;
+        u32 mtu;
 
+        if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
+                return;
+        mtu = tcp_sk(sk)->mtu_info;
         dst = inet_csk_update_pmtu(sk, mtu);
         if (!dst)
                 return;
@@ -428,7 +431,8 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 
         switch (type) {
         case ICMP_REDIRECT:
-                do_redirect(icmp_skb, sk);
+                if (!sock_owned_by_user(sk))
+                        do_redirect(icmp_skb, sk);
                 goto out;
         case ICMP_SOURCE_QUENCH:
                 /* Just silently ignore these. */
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 7e16243cdb58..65c0f3d13eca 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -460,6 +460,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
                 newtp->mdev_us = jiffies_to_usecs(TCP_TIMEOUT_INIT);
                 minmax_reset(&newtp->rtt_min, tcp_time_stamp, ~0U);
                 newicsk->icsk_rto = TCP_TIMEOUT_INIT;
+                newicsk->icsk_ack.lrcvtime = tcp_time_stamp;
 
                 newtp->packets_out = 0;
                 newtp->retrans_out = 0;
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 40d893556e67..b2ab411c6d37 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -249,7 +249,8 @@ void tcp_delack_timer_handler(struct sock *sk)
 
         sk_mem_reclaim_partial(sk);
 
-        if (sk->sk_state == TCP_CLOSE || !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
+        if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
+            !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
                 goto out;
 
         if (time_after(icsk->icsk_ack.timeout, jiffies)) {
@@ -552,7 +553,8 @@ void tcp_write_timer_handler(struct sock *sk)
         struct inet_connection_sock *icsk = inet_csk(sk);
         int event;
 
-        if (sk->sk_state == TCP_CLOSE || !icsk->icsk_pending)
+        if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
+            !icsk->icsk_pending)
                 goto out;
 
         if (time_after(icsk->icsk_timeout, jiffies)) {
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 04db40620ea6..a9a9553ee63d 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -920,12 +920,12 @@ static int __init inet6_init(void)
         err = register_pernet_subsys(&inet6_net_ops);
         if (err)
                 goto register_pernet_fail;
-        err = icmpv6_init();
-        if (err)
-                goto icmp_fail;
         err = ip6_mr_init();
         if (err)
                 goto ipmr_fail;
+        err = icmpv6_init();
+        if (err)
+                goto icmp_fail;
         err = ndisc_init();
         if (err)
                 goto ndisc_fail;
@@ -1061,10 +1061,10 @@ igmp_fail:
         ndisc_cleanup();
 ndisc_fail:
         ip6_mr_cleanup();
-ipmr_fail:
-        icmpv6_cleanup();
 icmp_fail:
         unregister_pernet_subsys(&inet6_net_ops);
+ipmr_fail:
+        icmpv6_cleanup();
 register_pernet_fail:
         sock_unregister(PF_INET6);
         rtnl_unregister_all(PF_INET6);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index e4266746e4a2..d4bf2c68a545 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -923,6 +923,8 @@ add:
                         ins = &rt->dst.rt6_next;
                         iter = *ins;
                         while (iter) {
+                                if (iter->rt6i_metric > rt->rt6i_metric)
+                                        break;
                                 if (rt6_qualify_for_ecmp(iter)) {
                                         *ins = iter->dst.rt6_next;
                                         fib6_purge_rt(iter, fn, info->nl_net);
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 0838e6d01d2e..93e58a5e1837 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -294,8 +294,10 @@ static int ipv6_gro_complete(struct sk_buff *skb, int nhoff)
         struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + nhoff);
         int err = -ENOSYS;
 
-        if (skb->encapsulation)
+        if (skb->encapsulation) {
+                skb_set_inner_protocol(skb, cpu_to_be16(ETH_P_IPV6));
                 skb_set_inner_network_header(skb, nhoff);
+        }
 
         iph->payload_len = htons(skb->len - nhoff - sizeof(*iph));
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 528b3c1f3fde..58f6288e9ba5 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -768,13 +768,14 @@ slow_path:
          *      Fragment the datagram.
          */
 
-        *prevhdr = NEXTHDR_FRAGMENT;
         troom = rt->dst.dev->needed_tailroom;
 
         /*
          *      Keep copying data until we run out.
          */
         while (left > 0)        {
+                u8 *fragnexthdr_offset;
+
                 len = left;
                 /* IF: it doesn't fit, use 'mtu' - the data space left */
                 if (len > mtu)
@@ -819,6 +820,10 @@ slow_path:
                  */
                 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
 
+                fragnexthdr_offset = skb_network_header(frag);
+                fragnexthdr_offset += prevhdr - skb_network_header(skb);
+                *fragnexthdr_offset = NEXTHDR_FRAGMENT;
+
                 /*
                  *      Build fragment header.
                  */
@@ -1385,7 +1390,7 @@ emsgsize:
         if ((((length + fragheaderlen) > mtu) ||
              (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+            (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
             (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
                 err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                           hh_len, fragheaderlen, exthdrlen,
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 644ba59fbd9d..3d8a3b63b4fd 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -485,11 +485,15 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
         if (!skb->ignore_df && skb->len > mtu) {
                 skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu);
 
-                if (skb->protocol == htons(ETH_P_IPV6))
+                if (skb->protocol == htons(ETH_P_IPV6)) {
+                        if (mtu < IPV6_MIN_MTU)
+                                mtu = IPV6_MIN_MTU;
+
                         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
-                else
+                } else {
                         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
                                   htonl(mtu));
+                }
 
                 return -EMSGSIZE;
         }
diff --git a/net/ipv6/netfilter/nft_masq_ipv6.c b/net/ipv6/netfilter/nft_masq_ipv6.c
index 6c5b5b1830a7..4146536e9c15 100644
--- a/net/ipv6/netfilter/nft_masq_ipv6.c
+++ b/net/ipv6/netfilter/nft_masq_ipv6.c
@@ -27,10 +27,10 @@ static void nft_masq_ipv6_eval(const struct nft_expr *expr,
         memset(&range, 0, sizeof(range));
         range.flags = priv->flags;
         if (priv->sreg_proto_min) {
-                range.min_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min];
-                range.max_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max];
+                range.min_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                range.max_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
         }
         regs->verdict.code = nf_nat_masquerade_ipv6(pkt->skb, &range,
                                                     nft_out(pkt));
diff --git a/net/ipv6/netfilter/nft_redir_ipv6.c b/net/ipv6/netfilter/nft_redir_ipv6.c
index f5ac080fc084..a27e424f690d 100644
--- a/net/ipv6/netfilter/nft_redir_ipv6.c
+++ b/net/ipv6/netfilter/nft_redir_ipv6.c
@@ -26,10 +26,10 @@ static void nft_redir_ipv6_eval(const struct nft_expr *expr,
 
         memset(&range, 0, sizeof(range));
         if (priv->sreg_proto_min) {
-                range.min_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min],
-                range.max_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max],
+                range.min_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                range.max_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
                 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
         }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 229bfcc451ef..9db1418993f2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3299,7 +3299,6 @@ static size_t rt6_nlmsg_size(struct rt6_info *rt)
                 nexthop_len = nla_total_size(0)  /* RTA_MULTIPATH */
                             + NLA_ALIGN(sizeof(struct rtnexthop))
                             + nla_total_size(16) /* RTA_GATEWAY */
-                            + nla_total_size(4)  /* RTA_OIF */
                             + lwtunnel_get_encap_size(rt->dst.lwtstate);
 
                 nexthop_len *= rt->rt6i_nsiblings;
@@ -3323,7 +3322,7 @@ static size_t rt6_nlmsg_size(struct rt6_info *rt)
 }
 
 static int rt6_nexthop_info(struct sk_buff *skb, struct rt6_info *rt,
-                            unsigned int *flags)
+                            unsigned int *flags, bool skip_oif)
 {
         if (!netif_running(rt->dst.dev) || !netif_carrier_ok(rt->dst.dev)) {
                 *flags |= RTNH_F_LINKDOWN;
@@ -3336,7 +3335,8 @@ static int rt6_nexthop_info(struct sk_buff *skb, struct rt6_info *rt,
                         goto nla_put_failure;
         }
 
-        if (rt->dst.dev &&
+        /* not needed for multipath encoding b/c it has a rtnexthop struct */
+        if (!skip_oif && rt->dst.dev &&
             nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
                 goto nla_put_failure;
 
@@ -3350,6 +3350,7 @@ nla_put_failure:
         return -EMSGSIZE;
 }
 
+/* add multipath next hop */
 static int rt6_add_nexthop(struct sk_buff *skb, struct rt6_info *rt)
 {
         struct rtnexthop *rtnh;
@@ -3362,7 +3363,7 @@ static int rt6_add_nexthop(struct sk_buff *skb, struct rt6_info *rt)
         rtnh->rtnh_hops = 0;
         rtnh->rtnh_ifindex = rt->dst.dev ? rt->dst.dev->ifindex : 0;
 
-        if (rt6_nexthop_info(skb, rt, &flags) < 0)
+        if (rt6_nexthop_info(skb, rt, &flags, true) < 0)
                 goto nla_put_failure;
 
         rtnh->rtnh_flags = flags;
@@ -3422,6 +3423,8 @@ static int rt6_fill_node(struct net *net,
         }
         else if (rt->rt6i_flags & RTF_LOCAL)
                 rtm->rtm_type = RTN_LOCAL;
+        else if (rt->rt6i_flags & RTF_ANYCAST)
+                rtm->rtm_type = RTN_ANYCAST;
         else if (rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK))
                 rtm->rtm_type = RTN_LOCAL;
         else
@@ -3515,7 +3518,7 @@ static int rt6_fill_node(struct net *net,
 
                 nla_nest_end(skb, mp);
         } else {
-                if (rt6_nexthop_info(skb, rt, &rtm->rtm_flags) < 0)
+                if (rt6_nexthop_info(skb, rt, &rtm->rtm_flags, false) < 0)
                         goto nla_put_failure;
         }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 60a5295a7de6..49fa2e8c3fa9 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -391,10 +391,12 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         np = inet6_sk(sk);
 
         if (type == NDISC_REDIRECT) {
-                struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
+                if (!sock_owned_by_user(sk)) {
+                        struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 
-                if (dst)
-                        dst->ops->redirect(dst, sk, skb);
+                        if (dst)
+                                dst->ops->redirect(dst, sk, skb);
+                }
                 goto out;
         }
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 4e4c401e3bc6..e28082f0a307 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1035,6 +1035,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         ipc6.hlimit = -1;
         ipc6.tclass = -1;
         ipc6.dontfrag = -1;
+        sockc.tsflags = sk->sk_tsflags;
 
         /* destination address check */
         if (sin6) {
@@ -1159,7 +1160,6 @@ do_udp_sendmsg:
 
         fl6.flowi6_mark = sk->sk_mark;
         fl6.flowi6_uid = sk->sk_uid;
-        sockc.tsflags = sk->sk_tsflags;
 
         if (msg->msg_controllen) {
                 opt = &opt_space;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 81adc29a448d..8d77ad5cadaf 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -828,7 +828,8 @@ out:
  *    Wait for incoming connection
  *
  */
-static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
+static int irda_accept(struct socket *sock, struct socket *newsock, int flags,
+                       bool kern)
 {
         struct sock *sk = sock->sk;
         struct irda_sock *new, *self = irda_sk(sk);
@@ -836,7 +837,7 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
         struct sk_buff *skb = NULL;
         int err;
 
-        err = irda_create(sock_net(sk), newsock, sk->sk_protocol, 0);
+        err = irda_create(sock_net(sk), newsock, sk->sk_protocol, kern);
         if (err)
                 return err;
 
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 89bbde1081ce..84de7b6326dc 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -938,7 +938,7 @@ done:
 
 /* Accept a pending connection */
 static int iucv_sock_accept(struct socket *sock, struct socket *newsock,
-                            int flags)
+                            int flags, bool kern)
 {
         DECLARE_WAITQUEUE(wait, current);
         struct sock *sk = sock->sk, *nsk;
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 06186d608a27..cb4fff785cbf 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -641,11 +641,13 @@ static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb)
  *      @sock: Socket which connections arrive on.
  *      @newsock: Socket to move incoming connection to.
  *      @flags: User specified operational flags.
+ *      @kern: If the socket is kernel internal
  *
  *      Accept a new incoming connection.
  *      Returns 0 upon success, negative otherwise.
  */
-static int llc_ui_accept(struct socket *sock, struct socket *newsock, int flags)
+static int llc_ui_accept(struct socket *sock, struct socket *newsock, int flags,
+                         bool kern)
 {
         struct sock *sk = sock->sk, *newsk;
         struct llc_sock *llc, *newllc;
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 3818686182b2..6414079aa729 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -1269,6 +1269,8 @@ static void mpls_ifdown(struct net_device *dev, int event)
 {
         struct mpls_route __rcu **platform_label;
         struct net *net = dev_net(dev);
+        unsigned int nh_flags = RTNH_F_DEAD | RTNH_F_LINKDOWN;
+        unsigned int alive;
         unsigned index;
 
         platform_label = rtnl_dereference(net->mpls.platform_label);
@@ -1278,9 +1280,11 @@ static void mpls_ifdown(struct net_device *dev, int event)
                 if (!rt)
                         continue;
 
+                alive = 0;
                 change_nexthops(rt) {
                         if (rtnl_dereference(nh->nh_dev) != dev)
-                                continue;
+                                goto next;
+
                         switch (event) {
                         case NETDEV_DOWN:
                         case NETDEV_UNREGISTER:
@@ -1288,12 +1292,16 @@ static void mpls_ifdown(struct net_device *dev, int event)
                                 /* fall through */
                         case NETDEV_CHANGE:
                                 nh->nh_flags |= RTNH_F_LINKDOWN;
-                                ACCESS_ONCE(rt->rt_nhn_alive) = rt->rt_nhn_alive - 1;
                                 break;
                         }
                         if (event == NETDEV_UNREGISTER)
                                 RCU_INIT_POINTER(nh->nh_dev, NULL);
+next:
+                        if (!(nh->nh_flags & nh_flags))
+                                alive++;
                 } endfor_nexthops(rt);
+
+                WRITE_ONCE(rt->rt_nhn_alive, alive);
         }
 }
 
@@ -2028,6 +2036,7 @@ static void mpls_net_exit(struct net *net)
         for (index = 0; index < platform_labels; index++) {
                 struct mpls_route *rt = rtnl_dereference(platform_label[index]);
                 RCU_INIT_POINTER(platform_label[index], NULL);
+                mpls_notify_route(net, index, rt, NULL, NULL);
                 mpls_rt_free(rt);
         }
         rtnl_unlock();
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 071b97fcbefb..ffb78e5f7b70 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -181,7 +181,11 @@ EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
 unsigned int nf_conntrack_max __read_mostly;
 seqcount_t nf_conntrack_generation __read_mostly;
 
-DEFINE_PER_CPU(struct nf_conn, nf_conntrack_untracked);
+/* nf_conn must be 8 bytes aligned, as the 3 LSB bits are used
+ * for the nfctinfo. We cheat by (ab)using the PER CPU cache line
+ * alignment to enforce this.
+ */
+DEFINE_PER_CPU_ALIGNED(struct nf_conn, nf_conntrack_untracked);
 EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked);
 
 static unsigned int nf_conntrack_hash_rnd __read_mostly;
diff --git a/net/netfilter/nf_nat_proto_sctp.c b/net/netfilter/nf_nat_proto_sctp.c
index 31d358691af0..804e8a0ab36e 100644
--- a/net/netfilter/nf_nat_proto_sctp.c
+++ b/net/netfilter/nf_nat_proto_sctp.c
@@ -33,8 +33,16 @@ sctp_manip_pkt(struct sk_buff *skb,
                enum nf_nat_manip_type maniptype)
 {
         sctp_sctphdr_t *hdr;
+        int hdrsize = 8;
 
-        if (!skb_make_writable(skb, hdroff + sizeof(*hdr)))
+        /* This could be an inner header returned in imcp packet; in such
+         * cases we cannot update the checksum field since it is outside
+         * of the 8 bytes of transport layer headers we are guaranteed.
+         */
+        if (skb->len >= hdroff + sizeof(*hdr))
+                hdrsize = sizeof(*hdr);
+
+        if (!skb_make_writable(skb, hdroff + hdrsize))
                 return false;
 
         hdr = (struct sctphdr *)(skb->data + hdroff);
@@ -47,6 +55,9 @@ sctp_manip_pkt(struct sk_buff *skb,
                 hdr->dest = tuple->dst.u.sctp.port;
         }
 
+        if (hdrsize < sizeof(*hdr))
+                return true;
+
         if (skb->ip_summed != CHECKSUM_PARTIAL) {
                 hdr->checksum = sctp_compute_cksum(skb, hdroff);
                 skb->ip_summed = CHECKSUM_NONE;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 5e0ccfd5bb37..434c739dfeca 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3145,7 +3145,6 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
                 iter.count      = 0;
                 iter.err        = 0;
                 iter.fn         = nf_tables_bind_check_setelem;
-                iter.flush      = false;
 
                 set->ops->walk(ctx, set, &iter);
                 if (iter.err < 0)
@@ -3399,7 +3398,6 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
         args.iter.count         = 0;
         args.iter.err           = 0;
         args.iter.fn            = nf_tables_dump_setelem;
-        args.iter.flush         = false;
         set->ops->walk(&ctx, set, &args.iter);
 
         nla_nest_end(skb, nest);
@@ -3963,7 +3961,6 @@ static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
                 struct nft_set_iter iter = {
                         .genmask        = genmask,
                         .fn             = nft_flush_set,
-                        .flush          = true,
                 };
                 set->ops->walk(&ctx, set, &iter);
 
@@ -5114,7 +5111,6 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
                         iter.count      = 0;
                         iter.err        = 0;
                         iter.fn         = nf_tables_loop_check_setelem;
-                        iter.flush      = false;
 
                         set->ops->walk(ctx, set, &iter);
                         if (iter.err < 0)
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index bf548a7a71ec..0264258c46fe 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -83,7 +83,7 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
 
         switch (priv->key) {
         case NFT_CT_DIRECTION:
-                *dest = CTINFO2DIR(ctinfo);
+                nft_reg_store8(dest, CTINFO2DIR(ctinfo));
                 return;
         case NFT_CT_STATUS:
                 *dest = ct->status;
@@ -151,20 +151,22 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
                 return;
         }
         case NFT_CT_L3PROTOCOL:
-                *dest = nf_ct_l3num(ct);
+                nft_reg_store8(dest, nf_ct_l3num(ct));
                 return;
         case NFT_CT_PROTOCOL:
-                *dest = nf_ct_protonum(ct);
+                nft_reg_store8(dest, nf_ct_protonum(ct));
                 return;
 #ifdef CONFIG_NF_CONNTRACK_ZONES
         case NFT_CT_ZONE: {
                 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
+                u16 zoneid;
 
                 if (priv->dir < IP_CT_DIR_MAX)
-                        *dest = nf_ct_zone_id(zone, priv->dir);
+                        zoneid = nf_ct_zone_id(zone, priv->dir);
                 else
-                        *dest = zone->id;
+                        zoneid = zone->id;
 
+                nft_reg_store16(dest, zoneid);
                 return;
         }
 #endif
@@ -183,10 +185,10 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
                 return;
         case NFT_CT_PROTO_SRC:
-                *dest = (__force __u16)tuple->src.u.all;
+                nft_reg_store16(dest, (__force u16)tuple->src.u.all);
                 return;
         case NFT_CT_PROTO_DST:
-                *dest = (__force __u16)tuple->dst.u.all;
+                nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
                 return;
         default:
                 break;
@@ -205,7 +207,7 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr,
         const struct nft_ct *priv = nft_expr_priv(expr);
         struct sk_buff *skb = pkt->skb;
         enum ip_conntrack_info ctinfo;
-        u16 value = regs->data[priv->sreg];
+        u16 value = nft_reg_load16(&regs->data[priv->sreg]);
         struct nf_conn *ct;
 
         ct = nf_ct_get(skb, &ctinfo);
@@ -542,7 +544,8 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
                 case IP_CT_DIR_REPLY:
                         break;
                 default:
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto err1;
                 }
         }
 
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index e1f5ca9b423b..7b60e01f38ff 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -45,16 +45,15 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                 *dest = skb->len;
                 break;
         case NFT_META_PROTOCOL:
-                *dest = 0;
-                *(__be16 *)dest = skb->protocol;
+                nft_reg_store16(dest, (__force u16)skb->protocol);
                 break;
         case NFT_META_NFPROTO:
-                *dest = nft_pf(pkt);
+                nft_reg_store8(dest, nft_pf(pkt));
                 break;
         case NFT_META_L4PROTO:
                 if (!pkt->tprot_set)
                         goto err;
-                *dest = pkt->tprot;
+                nft_reg_store8(dest, pkt->tprot);
                 break;
         case NFT_META_PRIORITY:
                 *dest = skb->priority;
@@ -85,14 +84,12 @@ void nft_meta_get_eval(const struct nft_expr *expr,
         case NFT_META_IIFTYPE:
                 if (in == NULL)
                         goto err;
-                *dest = 0;
-                *(u16 *)dest = in->type;
+                nft_reg_store16(dest, in->type);
                 break;
         case NFT_META_OIFTYPE:
                 if (out == NULL)
                         goto err;
-                *dest = 0;
-                *(u16 *)dest = out->type;
+                nft_reg_store16(dest, out->type);
                 break;
         case NFT_META_SKUID:
                 sk = skb_to_full_sk(skb);
@@ -142,19 +139,19 @@ void nft_meta_get_eval(const struct nft_expr *expr,
 #endif
         case NFT_META_PKTTYPE:
                 if (skb->pkt_type != PACKET_LOOPBACK) {
-                        *dest = skb->pkt_type;
+                        nft_reg_store8(dest, skb->pkt_type);
                         break;
                 }
 
                 switch (nft_pf(pkt)) {
                 case NFPROTO_IPV4:
                         if (ipv4_is_multicast(ip_hdr(skb)->daddr))
-                                *dest = PACKET_MULTICAST;
+                                nft_reg_store8(dest, PACKET_MULTICAST);
                         else
-                                *dest = PACKET_BROADCAST;
+                                nft_reg_store8(dest, PACKET_BROADCAST);
                         break;
                 case NFPROTO_IPV6:
-                        *dest = PACKET_MULTICAST;
+                        nft_reg_store8(dest, PACKET_MULTICAST);
                         break;
                 case NFPROTO_NETDEV:
                         switch (skb->protocol) {
@@ -168,14 +165,14 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                                         goto err;
 
                                 if (ipv4_is_multicast(iph->daddr))
-                                        *dest = PACKET_MULTICAST;
+                                        nft_reg_store8(dest, PACKET_MULTICAST);
                                 else
-                                        *dest = PACKET_BROADCAST;
+                                        nft_reg_store8(dest, PACKET_BROADCAST);
 
                                 break;
                         }
                         case htons(ETH_P_IPV6):
-                                *dest = PACKET_MULTICAST;
+                                nft_reg_store8(dest, PACKET_MULTICAST);
                                 break;
                         default:
                                 WARN_ON_ONCE(1);
@@ -230,7 +227,9 @@ void nft_meta_set_eval(const struct nft_expr *expr,
 {
         const struct nft_meta *meta = nft_expr_priv(expr);
         struct sk_buff *skb = pkt->skb;
-        u32 value = regs->data[meta->sreg];
+        u32 *sreg = &regs->data[meta->sreg];
+        u32 value = *sreg;
+        u8 pkt_type;
 
         switch (meta->key) {
         case NFT_META_MARK:
@@ -240,9 +239,12 @@ void nft_meta_set_eval(const struct nft_expr *expr,
                 skb->priority = value;
                 break;
         case NFT_META_PKTTYPE:
-                if (skb->pkt_type != value &&
-                    skb_pkt_type_ok(value) && skb_pkt_type_ok(skb->pkt_type))
-                        skb->pkt_type = value;
+                pkt_type = nft_reg_load8(sreg);
+
+                if (skb->pkt_type != pkt_type &&
+                    skb_pkt_type_ok(pkt_type) &&
+                    skb_pkt_type_ok(skb->pkt_type))
+                        skb->pkt_type = pkt_type;
                 break;
         case NFT_META_NFTRACE:
                 skb->nf_trace = !!value;
diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index 19a7bf3236f9..439e0bd152a0 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -65,10 +65,10 @@ static void nft_nat_eval(const struct nft_expr *expr,
         }
 
         if (priv->sreg_proto_min) {
-                range.min_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min];
-                range.max_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max];
+                range.min_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                range.max_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
                 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
         }
 
diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c
index 152d226552c1..8ebbc2940f4c 100644
--- a/net/netfilter/nft_set_bitmap.c
+++ b/net/netfilter/nft_set_bitmap.c
@@ -15,6 +15,11 @@
 #include <linux/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables.h>
 
+struct nft_bitmap_elem {
+        struct list_head        head;
+        struct nft_set_ext      ext;
+};
+
 /* This bitmap uses two bits to represent one element. These two bits determine
  * the element state in the current and the future generation.
  *
@@ -41,13 +46,22 @@
  *      restore its previous state.
  */
 struct nft_bitmap {
-        u16     bitmap_size;
-        u8      bitmap[];
+        struct  list_head       list;
+        u16                     bitmap_size;
+        u8                      bitmap[];
 };
 
-static inline void nft_bitmap_location(u32 key, u32 *idx, u32 *off)
+static inline void nft_bitmap_location(const struct nft_set *set,
+                                       const void *key,
+                                       u32 *idx, u32 *off)
 {
-        u32 k = (key << 1);
+        u32 k;
+
+        if (set->klen == 2)
+                k = *(u16 *)key;
+        else
+                k = *(u8 *)key;
+        k <<= 1;
 
         *idx = k / BITS_PER_BYTE;
         *off = k % BITS_PER_BYTE;
@@ -69,26 +83,48 @@ static bool nft_bitmap_lookup(const struct net *net, const struct nft_set *set,
         u8 genmask = nft_genmask_cur(net);
         u32 idx, off;
 
-        nft_bitmap_location(*key, &idx, &off);
+        nft_bitmap_location(set, key, &idx, &off);
 
         return nft_bitmap_active(priv->bitmap, idx, off, genmask);
 }
 
+static struct nft_bitmap_elem *
+nft_bitmap_elem_find(const struct nft_set *set, struct nft_bitmap_elem *this,
+                     u8 genmask)
+{
+        const struct nft_bitmap *priv = nft_set_priv(set);
+        struct nft_bitmap_elem *be;
+
+        list_for_each_entry_rcu(be, &priv->list, head) {
+                if (memcmp(nft_set_ext_key(&be->ext),
+                           nft_set_ext_key(&this->ext), set->klen) ||
+                    !nft_set_elem_active(&be->ext, genmask))
+                        continue;
+
+                return be;
+        }
+        return NULL;
+}
+
 static int nft_bitmap_insert(const struct net *net, const struct nft_set *set,
                              const struct nft_set_elem *elem,
-                             struct nft_set_ext **_ext)
+                             struct nft_set_ext **ext)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
-        struct nft_set_ext *ext = elem->priv;
+        struct nft_bitmap_elem *new = elem->priv, *be;
         u8 genmask = nft_genmask_next(net);
         u32 idx, off;
 
-        nft_bitmap_location(nft_set_ext_key(ext)->data[0], &idx, &off);
-        if (nft_bitmap_active(priv->bitmap, idx, off, genmask))
+        be = nft_bitmap_elem_find(set, new, genmask);
+        if (be) {
+                *ext = &be->ext;
                 return -EEXIST;
+        }
 
+        nft_bitmap_location(set, nft_set_ext_key(&new->ext), &idx, &off);
         /* Enter 01 state. */
         priv->bitmap[idx] |= (genmask << off);
+        list_add_tail_rcu(&new->head, &priv->list);
 
         return 0;
 }
@@ -98,13 +134,14 @@ static void nft_bitmap_remove(const struct net *net,
                               const struct nft_set_elem *elem)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
-        struct nft_set_ext *ext = elem->priv;
+        struct nft_bitmap_elem *be = elem->priv;
         u8 genmask = nft_genmask_next(net);
         u32 idx, off;
 
-        nft_bitmap_location(nft_set_ext_key(ext)->data[0], &idx, &off);
+        nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
         /* Enter 00 state. */
         priv->bitmap[idx] &= ~(genmask << off);
+        list_del_rcu(&be->head);
 }
 
 static void nft_bitmap_activate(const struct net *net,
@@ -112,74 +149,52 @@ static void nft_bitmap_activate(const struct net *net,
                                 const struct nft_set_elem *elem)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
-        struct nft_set_ext *ext = elem->priv;
+        struct nft_bitmap_elem *be = elem->priv;
         u8 genmask = nft_genmask_next(net);
         u32 idx, off;
 
-        nft_bitmap_location(nft_set_ext_key(ext)->data[0], &idx, &off);
+        nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
         /* Enter 11 state. */
         priv->bitmap[idx] |= (genmask << off);
+        nft_set_elem_change_active(net, set, &be->ext);
 }
 
 static bool nft_bitmap_flush(const struct net *net,
-                             const struct nft_set *set, void *ext)
+                             const struct nft_set *set, void *_be)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
         u8 genmask = nft_genmask_next(net);
+        struct nft_bitmap_elem *be = _be;
         u32 idx, off;
 
-        nft_bitmap_location(nft_set_ext_key(ext)->data[0], &idx, &off);
+        nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
         /* Enter 10 state, similar to deactivation. */
         priv->bitmap[idx] &= ~(genmask << off);
+        nft_set_elem_change_active(net, set, &be->ext);
 
         return true;
 }
 
-static struct nft_set_ext *nft_bitmap_ext_alloc(const struct nft_set *set,
-                                                const struct nft_set_elem *elem)
-{
-        struct nft_set_ext_tmpl tmpl;
-        struct nft_set_ext *ext;
-
-        nft_set_ext_prepare(&tmpl);
-        nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
-
-        ext = kzalloc(tmpl.len, GFP_KERNEL);
-        if (!ext)
-                return NULL;
-
-        nft_set_ext_init(ext, &tmpl);
-        memcpy(nft_set_ext_key(ext), elem->key.val.data, set->klen);
-
-        return ext;
-}
-
 static void *nft_bitmap_deactivate(const struct net *net,
                                    const struct nft_set *set,
                                    const struct nft_set_elem *elem)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
+        struct nft_bitmap_elem *this = elem->priv, *be;
         u8 genmask = nft_genmask_next(net);
-        struct nft_set_ext *ext;
-        u32 idx, off, key = 0;
-
-        memcpy(&key, elem->key.val.data, set->klen);
-        nft_bitmap_location(key, &idx, &off);
+        u32 idx, off;
 
-        if (!nft_bitmap_active(priv->bitmap, idx, off, genmask))
-                return NULL;
+        nft_bitmap_location(set, elem->key.val.data, &idx, &off);
 
-        /* We have no real set extension since this is a bitmap, allocate this
-         * dummy object that is released from the commit/abort path.
-         */
-        ext = nft_bitmap_ext_alloc(set, elem);
-        if (!ext)
+        be = nft_bitmap_elem_find(set, this, genmask);
+        if (!be)
                 return NULL;
 
         /* Enter 10 state. */
         priv->bitmap[idx] &= ~(genmask << off);
+        nft_set_elem_change_active(net, set, &be->ext);
 
-        return ext;
+        return be;
 }
 
 static void nft_bitmap_walk(const struct nft_ctx *ctx,
@@ -187,47 +202,23 @@ static void nft_bitmap_walk(const struct nft_ctx *ctx,
                             struct nft_set_iter *iter)
 {
         const struct nft_bitmap *priv = nft_set_priv(set);
-        struct nft_set_ext_tmpl tmpl;
+        struct nft_bitmap_elem *be;
         struct nft_set_elem elem;
-        struct nft_set_ext *ext;
-        int idx, off;
-        u16 key;
-
-        nft_set_ext_prepare(&tmpl);
-        nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
-
-        for (idx = 0; idx < priv->bitmap_size; idx++) {
-                for (off = 0; off < BITS_PER_BYTE; off += 2) {
-                        if (iter->count < iter->skip)
-                                goto cont;
-
-                        if (!nft_bitmap_active(priv->bitmap, idx, off,
-                                               iter->genmask))
-                                goto cont;
-
-                        ext = kzalloc(tmpl.len, GFP_KERNEL);
-                        if (!ext) {
-                                iter->err = -ENOMEM;
-                                return;
-                        }
-                        nft_set_ext_init(ext, &tmpl);
-                        key = ((idx * BITS_PER_BYTE) + off) >> 1;
-                        memcpy(nft_set_ext_key(ext), &key, set->klen);
-
-                        elem.priv = ext;
-                        iter->err = iter->fn(ctx, set, iter, &elem);
-
-                        /* On set flush, this dummy extension object is released
-                         * from the commit/abort path.
-                         */
-                        if (!iter->flush)
-                                kfree(ext);
-
-                        if (iter->err < 0)
-                                return;
+
+        list_for_each_entry_rcu(be, &priv->list, head) {
+                if (iter->count < iter->skip)
+                        goto cont;
+                if (!nft_set_elem_active(&be->ext, iter->genmask))
+                        goto cont;
+
+                elem.priv = be;
+
+                iter->err = iter->fn(ctx, set, iter, &elem);
+
+                if (iter->err < 0)
+                        return;
 cont:
-                        iter->count++;
-                }
+                iter->count++;
         }
 }
 
@@ -258,6 +249,7 @@ static int nft_bitmap_init(const struct nft_set *set,
 {
         struct nft_bitmap *priv = nft_set_priv(set);
 
+        INIT_LIST_HEAD(&priv->list);
         priv->bitmap_size = nft_bitmap_size(set->klen);
 
         return 0;
@@ -283,6 +275,7 @@ static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,
 
 static struct nft_set_ops nft_bitmap_ops __read_mostly = {
         .privsize       = nft_bitmap_privsize,
+        .elemsize       = offsetof(struct nft_bitmap_elem, ext),
         .estimate       = nft_bitmap_estimate,
         .init           = nft_bitmap_init,
         .destroy        = nft_bitmap_destroy,
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 7b73c7c161a9..596eaff66649 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -96,6 +96,44 @@ EXPORT_SYMBOL_GPL(nl_table);
 
 static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);
 
+static struct lock_class_key nlk_cb_mutex_keys[MAX_LINKS];
+
+static const char *const nlk_cb_mutex_key_strings[MAX_LINKS + 1] = {
+        "nlk_cb_mutex-ROUTE",
+        "nlk_cb_mutex-1",
+        "nlk_cb_mutex-USERSOCK",
+        "nlk_cb_mutex-FIREWALL",
+        "nlk_cb_mutex-SOCK_DIAG",
+        "nlk_cb_mutex-NFLOG",
+        "nlk_cb_mutex-XFRM",
+        "nlk_cb_mutex-SELINUX",
+        "nlk_cb_mutex-ISCSI",
+        "nlk_cb_mutex-AUDIT",
+        "nlk_cb_mutex-FIB_LOOKUP",
+        "nlk_cb_mutex-CONNECTOR",
+        "nlk_cb_mutex-NETFILTER",
+        "nlk_cb_mutex-IP6_FW",
+        "nlk_cb_mutex-DNRTMSG",
+        "nlk_cb_mutex-KOBJECT_UEVENT",
+        "nlk_cb_mutex-GENERIC",
+        "nlk_cb_mutex-17",
+        "nlk_cb_mutex-SCSITRANSPORT",
+        "nlk_cb_mutex-ECRYPTFS",
+        "nlk_cb_mutex-RDMA",
+        "nlk_cb_mutex-CRYPTO",
+        "nlk_cb_mutex-SMC",
+        "nlk_cb_mutex-23",
+        "nlk_cb_mutex-24",
+        "nlk_cb_mutex-25",
+        "nlk_cb_mutex-26",
+        "nlk_cb_mutex-27",
+        "nlk_cb_mutex-28",
+        "nlk_cb_mutex-29",
+        "nlk_cb_mutex-30",
+        "nlk_cb_mutex-31",
+        "nlk_cb_mutex-MAX_LINKS"
+};
+
 static int netlink_dump(struct sock *sk);
 static void netlink_skb_destructor(struct sk_buff *skb);
 
@@ -585,6 +623,9 @@ static int __netlink_create(struct net *net, struct socket *sock,
         } else {
                 nlk->cb_mutex = &nlk->cb_def_mutex;
                 mutex_init(nlk->cb_mutex);
+                lockdep_set_class_and_name(nlk->cb_mutex,
+                                           nlk_cb_mutex_keys + protocol,
+                                           nlk_cb_mutex_key_strings[protocol]);
         }
         init_waitqueue_head(&nlk->wait);
 
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index fb6e10fdb217..92e0981f7404 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -783,8 +783,10 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
 
                 if (ctrl_fill_info(rt, NETLINK_CB(cb->skb).portid,
                                    cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                   skb, CTRL_CMD_NEWFAMILY) < 0)
+                                   skb, CTRL_CMD_NEWFAMILY) < 0) {
+                        n--;
                         break;
+                }
         }
 
         cb->args[0] = n;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 4bbf4526b885..ebf16f7f9089 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -765,7 +765,8 @@ out_release:
         return err;
 }
 
-static int nr_accept(struct socket *sock, struct socket *newsock, int flags)
+static int nr_accept(struct socket *sock, struct socket *newsock, int flags,
+                     bool kern)
 {
         struct sk_buff *skb;
         struct sock *newsk;
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 879885b31cce..2ffb18e73df6 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -441,7 +441,7 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *parent,
 }
 
 static int llcp_sock_accept(struct socket *sock, struct socket *newsock,
-                            int flags)
+                            int flags, bool kern)
 {
         DECLARE_WAITQUEUE(wait, current);
         struct sock *sk = sock->sk, *new_sk;
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 6f5fa50f716d..1105a838bab8 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -604,7 +604,7 @@ static int ip_tun_from_nlattr(const struct nlattr *attr,
                         ipv4 = true;
                         break;
                 case OVS_TUNNEL_KEY_ATTR_IPV6_SRC:
-                        SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.dst,
+                        SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.src,
                                         nla_get_in6_addr(a), is_mask);
                         ipv6 = true;
                         break;
@@ -665,6 +665,8 @@ static int ip_tun_from_nlattr(const struct nlattr *attr,
                         tun_flags |= TUNNEL_VXLAN_OPT;
                         opts_type = type;
                         break;
+                case OVS_TUNNEL_KEY_ATTR_PAD:
+                        break;
                 default:
                         OVS_NLERR(log, "Unknown IP tunnel attribute %d",
                                   type);
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 222bedcd9575..e81537991ddf 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -772,7 +772,8 @@ static void pep_sock_close(struct sock *sk, long timeout)
         sock_put(sk);
 }
 
-static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp)
+static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp,
+                                    bool kern)
 {
         struct pep_sock *pn = pep_sk(sk), *newpn;
         struct sock *newsk = NULL;
@@ -846,7 +847,8 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp)
         }
 
         /* Create a new to-be-accepted sock */
-        newsk = sk_alloc(sock_net(sk), PF_PHONET, GFP_KERNEL, sk->sk_prot, 0);
+        newsk = sk_alloc(sock_net(sk), PF_PHONET, GFP_KERNEL, sk->sk_prot,
+                         kern);
         if (!newsk) {
                 pep_reject_conn(sk, skb, PN_PIPE_ERR_OVERLOAD, GFP_KERNEL);
                 err = -ENOBUFS;
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index a6c8da3ee893..64634e3ec2fc 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -305,7 +305,7 @@ out:
 }
 
 static int pn_socket_accept(struct socket *sock, struct socket *newsock,
-                                int flags)
+                            int flags, bool kern)
 {
         struct sock *sk = sock->sk;
         struct sock *newsk;
@@ -314,7 +314,7 @@ static int pn_socket_accept(struct socket *sock, struct socket *newsock,
         if (unlikely(sk->sk_state != TCP_LISTEN))
                 return -EINVAL;
 
-        newsk = sk->sk_prot->accept(sk, flags, &err);
+        newsk = sk->sk_prot->accept(sk, flags, &err, kern);
         if (!newsk)
                 return err;
 
diff --git a/net/rds/connection.c b/net/rds/connection.c
index 0e04dcceb1d4..1fa75ab7b733 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -429,6 +429,7 @@ void rds_conn_destroy(struct rds_connection *conn)
          */
         rds_cong_remove_conn(conn);
 
+        put_net(conn->c_net);
         kmem_cache_free(rds_conn_slab, conn);
 
         spin_lock_irqsave(&rds_conn_lock, flags);
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index ce3775abc6e7..1c38d2c7caa8 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -442,7 +442,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                 ic->i_send_cq = NULL;
                 ibdev_put_vector(rds_ibdev, ic->i_scq_vector);
                 rdsdebug("ib_create_cq send failed: %d\n", ret);
-                goto out;
+                goto rds_ibdev_out;
         }
 
         ic->i_rcq_vector = ibdev_get_unused_vector(rds_ibdev);
@@ -456,19 +456,19 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                 ic->i_recv_cq = NULL;
                 ibdev_put_vector(rds_ibdev, ic->i_rcq_vector);
                 rdsdebug("ib_create_cq recv failed: %d\n", ret);
-                goto out;
+                goto send_cq_out;
         }
 
         ret = ib_req_notify_cq(ic->i_send_cq, IB_CQ_NEXT_COMP);
         if (ret) {
                 rdsdebug("ib_req_notify_cq send failed: %d\n", ret);
-                goto out;
+                goto recv_cq_out;
         }
 
         ret = ib_req_notify_cq(ic->i_recv_cq, IB_CQ_SOLICITED);
         if (ret) {
                 rdsdebug("ib_req_notify_cq recv failed: %d\n", ret);
-                goto out;
+                goto recv_cq_out;
         }
 
         /* XXX negotiate max send/recv with remote? */
@@ -494,7 +494,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         ret = rdma_create_qp(ic->i_cm_id, ic->i_pd, &attr);
         if (ret) {
                 rdsdebug("rdma_create_qp failed: %d\n", ret);
-                goto out;
+                goto recv_cq_out;
         }
 
         ic->i_send_hdrs = ib_dma_alloc_coherent(dev,
@@ -504,7 +504,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         if (!ic->i_send_hdrs) {
                 ret = -ENOMEM;
                 rdsdebug("ib_dma_alloc_coherent send failed\n");
-                goto out;
+                goto qp_out;
         }
 
         ic->i_recv_hdrs = ib_dma_alloc_coherent(dev,
@@ -514,7 +514,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         if (!ic->i_recv_hdrs) {
                 ret = -ENOMEM;
                 rdsdebug("ib_dma_alloc_coherent recv failed\n");
-                goto out;
+                goto send_hdrs_dma_out;
         }
 
         ic->i_ack = ib_dma_alloc_coherent(dev, sizeof(struct rds_header),
@@ -522,7 +522,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         if (!ic->i_ack) {
                 ret = -ENOMEM;
                 rdsdebug("ib_dma_alloc_coherent ack failed\n");
-                goto out;
+                goto recv_hdrs_dma_out;
         }
 
         ic->i_sends = vzalloc_node(ic->i_send_ring.w_nr * sizeof(struct rds_ib_send_work),
@@ -530,7 +530,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         if (!ic->i_sends) {
                 ret = -ENOMEM;
                 rdsdebug("send allocation failed\n");
-                goto out;
+                goto ack_dma_out;
         }
 
         ic->i_recvs = vzalloc_node(ic->i_recv_ring.w_nr * sizeof(struct rds_ib_recv_work),
@@ -538,7 +538,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         if (!ic->i_recvs) {
                 ret = -ENOMEM;
                 rdsdebug("recv allocation failed\n");
-                goto out;
+                goto sends_out;
         }
 
         rds_ib_recv_init_ack(ic);
@@ -546,8 +546,33 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         rdsdebug("conn %p pd %p cq %p %p\n", conn, ic->i_pd,
                  ic->i_send_cq, ic->i_recv_cq);
 
-out:
+        return ret;
+
+sends_out:
+        vfree(ic->i_sends);
+ack_dma_out:
+        ib_dma_free_coherent(dev, sizeof(struct rds_header),
+                             ic->i_ack, ic->i_ack_dma);
+recv_hdrs_dma_out:
+        ib_dma_free_coherent(dev, ic->i_recv_ring.w_nr *
+                                        sizeof(struct rds_header),
+                                        ic->i_recv_hdrs, ic->i_recv_hdrs_dma);
+send_hdrs_dma_out:
+        ib_dma_free_coherent(dev, ic->i_send_ring.w_nr *
+                                        sizeof(struct rds_header),
+                                        ic->i_send_hdrs, ic->i_send_hdrs_dma);
+qp_out:
+        rdma_destroy_qp(ic->i_cm_id);
+recv_cq_out:
+        if (!ib_destroy_cq(ic->i_recv_cq))
+                ic->i_recv_cq = NULL;
+send_cq_out:
+        if (!ib_destroy_cq(ic->i_send_cq))
+                ic->i_send_cq = NULL;
+rds_ibdev_out:
+        rds_ib_remove_conn(rds_ibdev, conn);
         rds_ib_dev_put(rds_ibdev);
+
         return ret;
 }
 
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 39518ef7af4d..82d38ccf5e8b 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -147,7 +147,7 @@ struct rds_connection {
 
         /* Protocol version */
         unsigned int            c_version;
-        possible_net_t          c_net;
+        struct net              *c_net;
 
         struct list_head        c_map_item;
         unsigned long           c_map_queued;
@@ -162,13 +162,13 @@ struct rds_connection {
 static inline
 struct net *rds_conn_net(struct rds_connection *conn)
 {
-        return read_pnet(&conn->c_net);
+        return conn->c_net;
 }
 
 static inline
 void rds_conn_net_set(struct rds_connection *conn, struct net *net)
 {
-        write_pnet(&conn->c_net, net);
+        conn->c_net = get_net(net);
 }
 
 #define RDS_FLAG_CONG_BITMAP    0x01
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index a973d3b4dff0..225690076773 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -484,9 +484,10 @@ static void __net_exit rds_tcp_exit_net(struct net *net)
          * we do need to clean up the listen socket here.
          */
         if (rtn->rds_tcp_listen_sock) {
-                rds_tcp_listen_stop(rtn->rds_tcp_listen_sock);
+                struct socket *lsock = rtn->rds_tcp_listen_sock;
+
                 rtn->rds_tcp_listen_sock = NULL;
-                flush_work(&rtn->rds_tcp_accept_w);
+                rds_tcp_listen_stop(lsock, &rtn->rds_tcp_accept_w);
         }
 }
 
@@ -523,13 +524,13 @@ static void rds_tcp_kill_sock(struct net *net)
         struct rds_tcp_connection *tc, *_tc;
         LIST_HEAD(tmp_list);
         struct rds_tcp_net *rtn = net_generic(net, rds_tcp_netid);
+        struct socket *lsock = rtn->rds_tcp_listen_sock;
 
-        rds_tcp_listen_stop(rtn->rds_tcp_listen_sock);
         rtn->rds_tcp_listen_sock = NULL;
-        flush_work(&rtn->rds_tcp_accept_w);
+        rds_tcp_listen_stop(lsock, &rtn->rds_tcp_accept_w);
         spin_lock_irq(&rds_tcp_conn_lock);
         list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
-                struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
+                struct net *c_net = tc->t_cpath->cp_conn->c_net;
 
                 if (net != c_net || !tc->t_sock)
                         continue;
@@ -546,8 +547,12 @@ static void rds_tcp_kill_sock(struct net *net)
 void *rds_tcp_listen_sock_def_readable(struct net *net)
 {
         struct rds_tcp_net *rtn = net_generic(net, rds_tcp_netid);
+        struct socket *lsock = rtn->rds_tcp_listen_sock;
+
+        if (!lsock)
+                return NULL;
 
-        return rtn->rds_tcp_listen_sock->sk->sk_user_data;
+        return lsock->sk->sk_user_data;
 }
 
 static int rds_tcp_dev_event(struct notifier_block *this,
@@ -584,7 +589,7 @@ static void rds_tcp_sysctl_reset(struct net *net)
 
         spin_lock_irq(&rds_tcp_conn_lock);
         list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
-                struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
+                struct net *c_net = tc->t_cpath->cp_conn->c_net;
 
                 if (net != c_net || !tc->t_sock)
                         continue;
@@ -638,19 +643,19 @@ static int rds_tcp_init(void)
                 goto out;
         }
 
-        ret = register_netdevice_notifier(&rds_tcp_dev_notifier);
-        if (ret) {
-                pr_warn("could not register rds_tcp_dev_notifier\n");
+        ret = rds_tcp_recv_init();
+        if (ret)
                 goto out_slab;
-        }
 
         ret = register_pernet_subsys(&rds_tcp_net_ops);
         if (ret)
-                goto out_notifier;
+                goto out_recv;
 
-        ret = rds_tcp_recv_init();
-        if (ret)
+        ret = register_netdevice_notifier(&rds_tcp_dev_notifier);
+        if (ret) {
+                pr_warn("could not register rds_tcp_dev_notifier\n");
                 goto out_pernet;
+        }
 
         rds_trans_register(&rds_tcp_transport);
 
@@ -660,9 +665,8 @@ static int rds_tcp_init(void)
 
 out_pernet:
         unregister_pernet_subsys(&rds_tcp_net_ops);
-out_notifier:
-        if (unregister_netdevice_notifier(&rds_tcp_dev_notifier))
-                pr_warn("could not unregister rds_tcp_dev_notifier\n");
+out_recv:
+        rds_tcp_recv_exit();
 out_slab:
         kmem_cache_destroy(rds_tcp_conn_slab);
 out:
diff --git a/net/rds/tcp.h b/net/rds/tcp.h
index 9a1cc8906576..56ea6620fcf9 100644
--- a/net/rds/tcp.h
+++ b/net/rds/tcp.h
@@ -66,7 +66,7 @@ void rds_tcp_state_change(struct sock *sk);
 
 /* tcp_listen.c */
 struct socket *rds_tcp_listen_init(struct net *);
-void rds_tcp_listen_stop(struct socket *);
+void rds_tcp_listen_stop(struct socket *sock, struct work_struct *acceptor);
 void rds_tcp_listen_data_ready(struct sock *sk);
 int rds_tcp_accept_one(struct socket *sock);
 int rds_tcp_keepalive(struct socket *sock);
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 67d0929c7d3d..507678853e6c 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -133,7 +133,7 @@ int rds_tcp_accept_one(struct socket *sock)
 
         new_sock->type = sock->type;
         new_sock->ops = sock->ops;
-        ret = sock->ops->accept(sock, new_sock, O_NONBLOCK);
+        ret = sock->ops->accept(sock, new_sock, O_NONBLOCK, true);
         if (ret < 0)
                 goto out;
 
@@ -223,6 +223,9 @@ void rds_tcp_listen_data_ready(struct sock *sk)
          * before it has been accepted and the accepter has set up their
          * data_ready.. we only want to queue listen work for our listening
          * socket
+         *
+         * (*ready)() may be null if we are racing with netns delete, and
+         * the listen socket is being torn down.
          */
         if (sk->sk_state == TCP_LISTEN)
                 rds_tcp_accept_work(sk);
@@ -231,7 +234,8 @@ void rds_tcp_listen_data_ready(struct sock *sk)
 
 out:
         read_unlock_bh(&sk->sk_callback_lock);
-        ready(sk);
+        if (ready)
+                ready(sk);
 }
 
 struct socket *rds_tcp_listen_init(struct net *net)
@@ -271,7 +275,7 @@ out:
         return NULL;
 }
 
-void rds_tcp_listen_stop(struct socket *sock)
+void rds_tcp_listen_stop(struct socket *sock, struct work_struct *acceptor)
 {
         struct sock *sk;
 
@@ -292,5 +296,6 @@ void rds_tcp_listen_stop(struct socket *sock)
 
         /* wait for accepts to stop and close the socket */
         flush_workqueue(rds_wq);
+        flush_work(acceptor);
         sock_release(sock);
 }
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index b8a1df2c9785..4a9729257023 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -871,7 +871,8 @@ out_release:
         return err;
 }
 
-static int rose_accept(struct socket *sock, struct socket *newsock, int flags)
+static int rose_accept(struct socket *sock, struct socket *newsock, int flags,
+                       bool kern)
 {
         struct sk_buff *skb;
         struct sock *newsk;
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index 3f9d8d7ec632..b099b64366f3 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -275,6 +275,10 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
                 rxrpc_conn_retransmit_call(conn, skb);
                 return 0;
 
+        case RXRPC_PACKET_TYPE_BUSY:
+                /* Just ignore BUSY packets for now. */
+                return 0;
+
         case RXRPC_PACKET_TYPE_ABORT:
                 if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
                                   &wtmp, sizeof(wtmp)) < 0)
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 9f4cfa25af7c..18b2ad8be8e2 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -420,6 +420,7 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb,
                              u16 skew)
 {
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
+        enum rxrpc_call_state state;
         unsigned int offset = sizeof(struct rxrpc_wire_header);
         unsigned int ix;
         rxrpc_serial_t serial = sp->hdr.serial, ack_serial = 0;
@@ -434,14 +435,15 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb,
         _proto("Rx DATA %%%u { #%u f=%02x }",
                sp->hdr.serial, seq, sp->hdr.flags);
 
-        if (call->state >= RXRPC_CALL_COMPLETE)
+        state = READ_ONCE(call->state);
+        if (state >= RXRPC_CALL_COMPLETE)
                 return;
 
         /* Received data implicitly ACKs all of the request packets we sent
          * when we're acting as a client.
          */
-        if ((call->state == RXRPC_CALL_CLIENT_SEND_REQUEST ||
-             call->state == RXRPC_CALL_CLIENT_AWAIT_REPLY) &&
+        if ((state == RXRPC_CALL_CLIENT_SEND_REQUEST ||
+             state == RXRPC_CALL_CLIENT_AWAIT_REPLY) &&
             !rxrpc_receiving_reply(call))
                 return;
 
@@ -650,6 +652,7 @@ static void rxrpc_input_ackinfo(struct rxrpc_call *call, struct sk_buff *skb,
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
         struct rxrpc_peer *peer;
         unsigned int mtu;
+        bool wake = false;
         u32 rwind = ntohl(ackinfo->rwind);
 
         _proto("Rx ACK %%%u Info { rx=%u max=%u rwin=%u jm=%u }",
@@ -657,9 +660,14 @@ static void rxrpc_input_ackinfo(struct rxrpc_call *call, struct sk_buff *skb,
                ntohl(ackinfo->rxMTU), ntohl(ackinfo->maxMTU),
                rwind, ntohl(ackinfo->jumbo_max));
 
-        if (rwind > RXRPC_RXTX_BUFF_SIZE - 1)
-                rwind = RXRPC_RXTX_BUFF_SIZE - 1;
-        call->tx_winsize = rwind;
+        if (call->tx_winsize != rwind) {
+                if (rwind > RXRPC_RXTX_BUFF_SIZE - 1)
+                        rwind = RXRPC_RXTX_BUFF_SIZE - 1;
+                if (rwind > call->tx_winsize)
+                        wake = true;
+                call->tx_winsize = rwind;
+        }
+
         if (call->cong_ssthresh > rwind)
                 call->cong_ssthresh = rwind;
 
@@ -673,6 +681,9 @@ static void rxrpc_input_ackinfo(struct rxrpc_call *call, struct sk_buff *skb,
                 spin_unlock_bh(&peer->lock);
                 _net("Net MTU %u (maxdata %u)", peer->mtu, peer->maxdata);
         }
+
+        if (wake)
+                wake_up(&call->waitq);
 }
 
 /*
@@ -799,7 +810,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
                 return rxrpc_proto_abort("AK0", call, 0);
 
         /* Ignore ACKs unless we are or have just been transmitting. */
-        switch (call->state) {
+        switch (READ_ONCE(call->state)) {
         case RXRPC_CALL_CLIENT_SEND_REQUEST:
         case RXRPC_CALL_CLIENT_AWAIT_REPLY:
         case RXRPC_CALL_SERVER_SEND_REPLY:
@@ -940,7 +951,7 @@ static void rxrpc_input_call_packet(struct rxrpc_call *call,
 static void rxrpc_input_implicit_end_call(struct rxrpc_connection *conn,
                                           struct rxrpc_call *call)
 {
-        switch (call->state) {
+        switch (READ_ONCE(call->state)) {
         case RXRPC_CALL_SERVER_AWAIT_ACK:
                 rxrpc_call_completed(call);
                 break;
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index 6491ca46a03f..3e2f1a8e9c5b 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -527,7 +527,7 @@ try_again:
                 msg->msg_namelen = len;
         }
 
-        switch (call->state) {
+        switch (READ_ONCE(call->state)) {
         case RXRPC_CALL_SERVER_ACCEPTING:
                 ret = rxrpc_recvmsg_new_call(rx, call, msg, flags);
                 break;
@@ -640,7 +640,7 @@ int rxrpc_kernel_recv_data(struct socket *sock, struct rxrpc_call *call,
 
         mutex_lock(&call->user_mutex);
 
-        switch (call->state) {
+        switch (READ_ONCE(call->state)) {
         case RXRPC_CALL_CLIENT_RECV_REPLY:
         case RXRPC_CALL_SERVER_RECV_REQUEST:
         case RXRPC_CALL_SERVER_ACK_REQUEST:
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index bc2d3dcff9de..97ab214ca411 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -488,6 +488,7 @@ rxrpc_new_client_call_for_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg,
 int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
         __releases(&rx->sk.sk_lock.slock)
 {
+        enum rxrpc_call_state state;
         enum rxrpc_command cmd;
         struct rxrpc_call *call;
         unsigned long user_call_ID = 0;
@@ -526,13 +527,17 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
                         return PTR_ERR(call);
                 /* ... and we have the call lock. */
         } else {
-                ret = -EBUSY;
-                if (call->state == RXRPC_CALL_UNINITIALISED ||
-                    call->state == RXRPC_CALL_CLIENT_AWAIT_CONN ||
-                    call->state == RXRPC_CALL_SERVER_PREALLOC ||
-                    call->state == RXRPC_CALL_SERVER_SECURING ||
-                    call->state == RXRPC_CALL_SERVER_ACCEPTING)
+                switch (READ_ONCE(call->state)) {
+                case RXRPC_CALL_UNINITIALISED:
+                case RXRPC_CALL_CLIENT_AWAIT_CONN:
+                case RXRPC_CALL_SERVER_PREALLOC:
+                case RXRPC_CALL_SERVER_SECURING:
+                case RXRPC_CALL_SERVER_ACCEPTING:
+                        ret = -EBUSY;
                         goto error_release_sock;
+                default:
+                        break;
+                }
 
                 ret = mutex_lock_interruptible(&call->user_mutex);
                 release_sock(&rx->sk);
@@ -542,10 +547,11 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
                 }
         }
 
+        state = READ_ONCE(call->state);
         _debug("CALL %d USR %lx ST %d on CONN %p",
-               call->debug_id, call->user_call_ID, call->state, call->conn);
+               call->debug_id, call->user_call_ID, state, call->conn);
 
-        if (call->state >= RXRPC_CALL_COMPLETE) {
+        if (state >= RXRPC_CALL_COMPLETE) {
                 /* it's too late for this call */
                 ret = -ESHUTDOWN;
         } else if (cmd == RXRPC_CMD_SEND_ABORT) {
@@ -555,12 +561,12 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
         } else if (cmd != RXRPC_CMD_SEND_DATA) {
                 ret = -EINVAL;
         } else if (rxrpc_is_client_call(call) &&
-                   call->state != RXRPC_CALL_CLIENT_SEND_REQUEST) {
+                   state != RXRPC_CALL_CLIENT_SEND_REQUEST) {
                 /* request phase complete for this client call */
                 ret = -EPROTO;
         } else if (rxrpc_is_service_call(call) &&
-                   call->state != RXRPC_CALL_SERVER_ACK_REQUEST &&
-                   call->state != RXRPC_CALL_SERVER_SEND_REPLY) {
+                   state != RXRPC_CALL_SERVER_ACK_REQUEST &&
+                   state != RXRPC_CALL_SERVER_SEND_REPLY) {
                 /* Reply phase not begun or not complete for service call. */
                 ret = -EPROTO;
         } else {
@@ -605,14 +611,21 @@ int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call,
         _debug("CALL %d USR %lx ST %d on CONN %p",
                call->debug_id, call->user_call_ID, call->state, call->conn);
 
-        if (call->state >= RXRPC_CALL_COMPLETE) {
-                ret = -ESHUTDOWN; /* it's too late for this call */
-        } else if (call->state != RXRPC_CALL_CLIENT_SEND_REQUEST &&
-                   call->state != RXRPC_CALL_SERVER_ACK_REQUEST &&
-                   call->state != RXRPC_CALL_SERVER_SEND_REPLY) {
-                ret = -EPROTO; /* request phase complete for this client call */
-        } else {
+        switch (READ_ONCE(call->state)) {
+        case RXRPC_CALL_CLIENT_SEND_REQUEST:
+        case RXRPC_CALL_SERVER_ACK_REQUEST:
+        case RXRPC_CALL_SERVER_SEND_REPLY:
                 ret = rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, len);
+                break;
+        case RXRPC_CALL_COMPLETE:
+                read_lock_bh(&call->state_lock);
+                ret = -call->error;
+                read_unlock_bh(&call->state_lock);
+                break;
+        default:
+                 /* Request phase complete for this client call */
+                ret = -EPROTO;
+                break;
         }
 
         mutex_unlock(&call->user_mutex);
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index ab8062909962..f9bb43c25697 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -113,6 +113,9 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,
         if (ret < 0)
                 return ret;
 
+        if (!tb[TCA_CONNMARK_PARMS])
+                return -EINVAL;
+
         parm = nla_data(tb[TCA_CONNMARK_PARMS]);
 
         if (!tcf_hash_check(tn, parm->index, a, bind)) {
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index 3b7074e23024..c736627f8f4a 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -228,7 +228,6 @@ static int tcf_skbmod_dump(struct sk_buff *skb, struct tc_action *a,
 
         return skb->len;
 nla_put_failure:
-        rcu_read_unlock();
         nlmsg_trim(skb, b);
         return -1;
 }
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 802ac7c2e5e8..5334e309f17f 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -201,9 +201,13 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch,
         pr_debug("%s(skb %p,sch %p,[qdisc %p])\n", __func__, skb, sch, p);
 
         if (p->set_tc_index) {
+                int wlen = skb_network_offset(skb);
+
                 switch (tc_skb_protocol(skb)) {
                 case htons(ETH_P_IP):
-                        if (skb_cow_head(skb, sizeof(struct iphdr)))
+                        wlen += sizeof(struct iphdr);
+                        if (!pskb_may_pull(skb, wlen) ||
+                            skb_try_make_writable(skb, wlen))
                                 goto drop;
 
                         skb->tc_index = ipv4_get_dsfield(ip_hdr(skb))
@@ -211,7 +215,9 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                         break;
 
                 case htons(ETH_P_IPV6):
-                        if (skb_cow_head(skb, sizeof(struct ipv6hdr)))
+                        wlen += sizeof(struct ipv6hdr);
+                        if (!pskb_may_pull(skb, wlen) ||
+                            skb_try_make_writable(skb, wlen))
                                 goto drop;
 
                         skb->tc_index = ipv6_get_dsfield(ipv6_hdr(skb))
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 2a6835b4562b..0439a1a68367 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -71,9 +71,8 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
 {
         struct net *net = sock_net(sk);
         struct sctp_sock *sp;
-        int i;
         sctp_paramhdr_t *p;
-        int err;
+        int i;
 
         /* Retrieve the SCTP per socket area.  */
         sp = sctp_sk((struct sock *)sk);
@@ -264,8 +263,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
 
         /* AUTH related initializations */
         INIT_LIST_HEAD(&asoc->endpoint_shared_keys);
-        err = sctp_auth_asoc_copy_shkeys(ep, asoc, gfp);
-        if (err)
+        if (sctp_auth_asoc_copy_shkeys(ep, asoc, gfp))
                 goto fail_init;
 
         asoc->active_key_id = ep->active_key_id;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 063baac5b9fe..961ee59f696a 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -640,14 +640,15 @@ static sctp_scope_t sctp_v6_scope(union sctp_addr *addr)
 
 /* Create and initialize a new sk for the socket to be returned by accept(). */
 static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
-                                             struct sctp_association *asoc)
+                                             struct sctp_association *asoc,
+                                             bool kern)
 {
         struct sock *newsk;
         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
         struct sctp6_sock *newsctp6sk;
         struct ipv6_txoptions *opt;
 
-        newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot, 0);
+        newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot, kern);
         if (!newsk)
                 goto out;
 
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 71ce6b945dcb..1224421036b3 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -546,7 +546,6 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
         struct sctp_association *asoc = tp->asoc;
         struct sctp_chunk *chunk, *tmp;
         int pkt_count, gso = 0;
-        int confirm;
         struct dst_entry *dst;
         struct sk_buff *head;
         struct sctphdr *sh;
@@ -625,13 +624,13 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
                         asoc->peer.last_sent_to = tp;
         }
         head->ignore_df = packet->ipfragok;
-        confirm = tp->dst_pending_confirm;
-        if (confirm)
+        if (tp->dst_pending_confirm)
                 skb_set_dst_pending_confirm(head, 1);
         /* neighbour should be confirmed on successful transmission or
          * positive error
          */
-        if (tp->af_specific->sctp_xmit(head, tp) >= 0 && confirm)
+        if (tp->af_specific->sctp_xmit(head, tp) >= 0 &&
+            tp->dst_pending_confirm)
                 tp->dst_pending_confirm = 0;
 
 out:
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index db352e5d61f8..025ccff67072 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -382,17 +382,18 @@ static int sctp_prsctp_prune_sent(struct sctp_association *asoc,
 }
 
 static int sctp_prsctp_prune_unsent(struct sctp_association *asoc,
-                                    struct sctp_sndrcvinfo *sinfo,
-                                    struct list_head *queue, int msg_len)
+                                    struct sctp_sndrcvinfo *sinfo, int msg_len)
 {
+        struct sctp_outq *q = &asoc->outqueue;
         struct sctp_chunk *chk, *temp;
 
-        list_for_each_entry_safe(chk, temp, queue, list) {
+        list_for_each_entry_safe(chk, temp, &q->out_chunk_list, list) {
                 if (!SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
                     chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive)
                         continue;
 
                 list_del_init(&chk->list);
+                q->out_qlen -= chk->skb->len;
                 asoc->sent_cnt_removable--;
                 asoc->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
 
@@ -431,9 +432,7 @@ void sctp_prsctp_prune(struct sctp_association *asoc,
                         return;
         }
 
-        sctp_prsctp_prune_unsent(asoc, sinfo,
-                                 &asoc->outqueue.out_chunk_list,
-                                 msg_len);
+        sctp_prsctp_prune_unsent(asoc, sinfo, msg_len);
 }
 
 /* Mark all the eligible packets on a transport for retransmission.  */
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 1b6d4574d2b0..989a900383b5 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -575,10 +575,11 @@ static int sctp_v4_is_ce(const struct sk_buff *skb)
 
 /* Create and initialize a new sk for the socket returned by accept(). */
 static struct sock *sctp_v4_create_accept_sk(struct sock *sk,
-                                             struct sctp_association *asoc)
+                                             struct sctp_association *asoc,
+                                             bool kern)
 {
         struct sock *newsk = sk_alloc(sock_net(sk), PF_INET, GFP_KERNEL,
-                        sk->sk_prot, 0);
+                        sk->sk_prot, kern);
         struct inet_sock *newinet;
 
         if (!newsk)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 6f0a9be50f50..0f378ea2ae38 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4116,7 +4116,7 @@ static int sctp_disconnect(struct sock *sk, int flags)
  * descriptor will be returned from accept() to represent the newly
  * formed association.
  */
-static struct sock *sctp_accept(struct sock *sk, int flags, int *err)
+static struct sock *sctp_accept(struct sock *sk, int flags, int *err, bool kern)
 {
         struct sctp_sock *sp;
         struct sctp_endpoint *ep;
@@ -4151,7 +4151,7 @@ static struct sock *sctp_accept(struct sock *sk, int flags, int *err)
          */
         asoc = list_entry(ep->asocs.next, struct sctp_association, asocs);
 
-        newsk = sp->pf->create_accept_sk(sk, asoc);
+        newsk = sp->pf->create_accept_sk(sk, asoc, kern);
         if (!newsk) {
                 error = -ENOMEM;
                 goto out;
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 85837ab90e89..093803786eac 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -944,7 +944,7 @@ out:
 }
 
 static int smc_accept(struct socket *sock, struct socket *new_sock,
-                      int flags)
+                      int flags, bool kern)
 {
         struct sock *sk = sock->sk, *nsk;
         DECLARE_WAITQUEUE(wait, current);
diff --git a/net/socket.c b/net/socket.c
index 2c1e8677ff2d..985ef06792d6 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -652,6 +652,16 @@ int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
 }
 EXPORT_SYMBOL(kernel_sendmsg);
 
+static bool skb_is_err_queue(const struct sk_buff *skb)
+{
+        /* pkt_type of skbs enqueued on the error queue are set to
+         * PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do
+         * in recvmsg, since skbs received on a local socket will never
+         * have a pkt_type of PACKET_OUTGOING.
+         */
+        return skb->pkt_type == PACKET_OUTGOING;
+}
+
 /*
  * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
  */
@@ -695,7 +705,8 @@ void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
                 put_cmsg(msg, SOL_SOCKET,
                          SCM_TIMESTAMPING, sizeof(tss), &tss);
 
-                if (skb->len && (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_STATS))
+                if (skb_is_err_queue(skb) && skb->len &&
+                    SKB_EXT_ERR(skb)->opt_stats)
                         put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_OPT_STATS,
                                  skb->len, skb->data);
         }
@@ -1506,7 +1517,7 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
         if (err)
                 goto out_fd;
 
-        err = sock->ops->accept(sock, newsock, sock->file->f_flags);
+        err = sock->ops->accept(sock, newsock, sock->file->f_flags, false);
         if (err < 0)
                 goto out_fd;
 
@@ -1731,6 +1742,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
         /* We assume all kernel code knows the size of sockaddr_storage */
         msg.msg_namelen = 0;
         msg.msg_iocb = NULL;
+        msg.msg_flags = 0;
         if (sock->file->f_flags & O_NONBLOCK)
                 flags |= MSG_DONTWAIT;
         err = sock_recvmsg(sock, &msg, flags);
@@ -3238,7 +3250,7 @@ int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
         if (err < 0)
                 goto done;
 
-        err = sock->ops->accept(sock, *newsock, flags);
+        err = sock->ops->accept(sock, *newsock, flags, true);
         if (err < 0) {
                 sock_release(*newsock);
                 *newsock = NULL;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 8931e33b6541..2b720fa35c4f 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1635,6 +1635,7 @@ static struct svc_xprt *svc_bc_create_socket(struct svc_serv *serv,
 
         xprt = &svsk->sk_xprt;
         svc_xprt_init(net, &svc_tcp_bc_class, xprt, serv);
+        set_bit(XPT_CONG_CTRL, &svsk->sk_xprt.xpt_flags);
 
         serv->sv_bc_xprt = xprt;
 
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index c13a5c35ce14..fc8f14c7bfec 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -127,6 +127,7 @@ static struct svc_xprt *svc_rdma_bc_create(struct svc_serv *serv,
         xprt = &cma_xprt->sc_xprt;
 
         svc_xprt_init(net, &svc_rdma_bc_class, xprt, serv);
+        set_bit(XPT_CONG_CTRL, &xprt->xpt_flags);
         serv->sv_bc_xprt = xprt;
 
         dprintk("svcrdma: %s(%p)\n", __func__, xprt);
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 81cd31acf690..3b332b395045 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -503,7 +503,8 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
         struct ib_cq *sendcq, *recvcq;
         int rc;
 
-        max_sge = min(ia->ri_device->attrs.max_sge, RPCRDMA_MAX_SEND_SGES);
+        max_sge = min_t(unsigned int, ia->ri_device->attrs.max_sge,
+                        RPCRDMA_MAX_SEND_SGES);
         if (max_sge < RPCRDMA_MIN_SEND_SGES) {
                 pr_warn("rpcrdma: HCA provides only %d send SGEs\n", max_sge);
                 return -ENOMEM;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 43e4045e72bc..7130e73bd42c 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -115,7 +115,8 @@ static void tipc_data_ready(struct sock *sk);
 static void tipc_write_space(struct sock *sk);
 static void tipc_sock_destruct(struct sock *sk);
 static int tipc_release(struct socket *sock);
-static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags);
+static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags,
+                       bool kern);
 static void tipc_sk_timeout(unsigned long data);
 static int tipc_sk_publish(struct tipc_sock *tsk, uint scope,
                            struct tipc_name_seq const *seq);
@@ -2029,7 +2030,8 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo)
  *
  * Returns 0 on success, errno otherwise
  */
-static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags)
+static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags,
+                       bool kern)
 {
         struct sock *new_sk, *sk = sock->sk;
         struct sk_buff *buf;
@@ -2051,7 +2053,7 @@ static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags)
 
         buf = skb_peek(&sk->sk_receive_queue);
 
-        res = tipc_sk_create(sock_net(sock->sk), new_sock, 0, 0);
+        res = tipc_sk_create(sock_net(sock->sk), new_sock, 0, kern);
         if (res)
                 goto exit;
         security_sk_clone(sock->sk, new_sock->sk);
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 9d94e65d0894..271cd66e4b3b 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -141,6 +141,11 @@ void tipc_subscrp_report_overlap(struct tipc_subscription *sub, u32 found_lower,
 static void tipc_subscrp_timeout(unsigned long data)
 {
         struct tipc_subscription *sub = (struct tipc_subscription *)data;
+        struct tipc_subscriber *subscriber = sub->subscriber;
+
+        spin_lock_bh(&subscriber->lock);
+        tipc_nametbl_unsubscribe(sub);
+        spin_unlock_bh(&subscriber->lock);
 
         /* Notify subscriber of timeout */
         tipc_subscrp_send_event(sub, sub->evt.s.seq.lower, sub->evt.s.seq.upper,
@@ -173,7 +178,6 @@ static void tipc_subscrp_kref_release(struct kref *kref)
         struct tipc_subscriber *subscriber = sub->subscriber;
 
         spin_lock_bh(&subscriber->lock);
-        tipc_nametbl_unsubscribe(sub);
         list_del(&sub->subscrp_list);
         atomic_dec(&tn->subscription_count);
         spin_unlock_bh(&subscriber->lock);
@@ -205,6 +209,7 @@ static void tipc_subscrb_subscrp_delete(struct tipc_subscriber *subscriber,
                 if (s && memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr)))
                         continue;
 
+                tipc_nametbl_unsubscribe(sub);
                 tipc_subscrp_get(sub);
                 spin_unlock_bh(&subscriber->lock);
                 tipc_subscrp_delete(sub);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index ee37b390260a..928691c43408 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -636,7 +636,7 @@ static int unix_bind(struct socket *, struct sockaddr *, int);
 static int unix_stream_connect(struct socket *, struct sockaddr *,
                                int addr_len, int flags);
 static int unix_socketpair(struct socket *, struct socket *);
-static int unix_accept(struct socket *, struct socket *, int);
+static int unix_accept(struct socket *, struct socket *, int, bool);
 static int unix_getname(struct socket *, struct sockaddr *, int *, int);
 static unsigned int unix_poll(struct file *, struct socket *, poll_table *);
 static unsigned int unix_dgram_poll(struct file *, struct socket *,
@@ -1402,7 +1402,8 @@ static void unix_sock_inherit_flags(const struct socket *old,
                 set_bit(SOCK_PASSSEC, &new->flags);
 }
 
-static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
+static int unix_accept(struct socket *sock, struct socket *newsock, int flags,
+                       bool kern)
 {
         struct sock *sk = sock->sk;
         struct sock *tsk;
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 6a0d48525fcf..c36757e72844 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -146,6 +146,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp)
         if (s) {
                 struct unix_sock *u = unix_sk(s);
 
+                BUG_ON(!atomic_long_read(&u->inflight));
                 BUG_ON(list_empty(&u->link));
 
                 if (atomic_long_dec_and_test(&u->inflight))
@@ -341,6 +342,14 @@ void unix_gc(void)
         }
         list_del(&cursor);
 
+        /* Now gc_candidates contains only garbage.  Restore original
+         * inflight counters for these as well, and remove the skbuffs
+         * which are creating the cycle(s).
+         */
+        skb_queue_head_init(&hitlist);
+        list_for_each_entry(u, &gc_candidates, link)
+                scan_children(&u->sk, inc_inflight, &hitlist);
+
         /* not_cycle_list contains those sockets which do not make up a
          * cycle.  Restore these to the inflight list.
          */
@@ -350,14 +359,6 @@ void unix_gc(void)
                 list_move_tail(&u->link, &gc_inflight_list);
         }
 
-        /* Now gc_candidates contains only garbage.  Restore original
-         * inflight counters for these as well, and remove the skbuffs
-         * which are creating the cycle(s).
-         */
-        skb_queue_head_init(&hitlist);
-        list_for_each_entry(u, &gc_candidates, link)
-        scan_children(&u->sk, inc_inflight, &hitlist);
-
         spin_unlock(&unix_gc_lock);
 
         /* Here we are. Hitlist is filled. Die. */
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 9192ead66751..6f7f6757ceef 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1102,10 +1102,19 @@ static const struct proto_ops vsock_dgram_ops = {
         .sendpage = sock_no_sendpage,
 };
 
+static int vsock_transport_cancel_pkt(struct vsock_sock *vsk)
+{
+        if (!transport->cancel_pkt)
+                return -EOPNOTSUPP;
+
+        return transport->cancel_pkt(vsk);
+}
+
 static void vsock_connect_timeout(struct work_struct *work)
 {
         struct sock *sk;
         struct vsock_sock *vsk;
+        int cancel = 0;
 
         vsk = container_of(work, struct vsock_sock, dwork.work);
         sk = sk_vsock(vsk);
@@ -1116,8 +1125,11 @@ static void vsock_connect_timeout(struct work_struct *work)
                 sk->sk_state = SS_UNCONNECTED;
                 sk->sk_err = ETIMEDOUT;
                 sk->sk_error_report(sk);
+                cancel = 1;
         }
         release_sock(sk);
+        if (cancel)
+                vsock_transport_cancel_pkt(vsk);
 
         sock_put(sk);
 }
@@ -1224,11 +1236,13 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
                         err = sock_intr_errno(timeout);
                         sk->sk_state = SS_UNCONNECTED;
                         sock->state = SS_UNCONNECTED;
+                        vsock_transport_cancel_pkt(vsk);
                         goto out_wait;
                 } else if (timeout == 0) {
                         err = -ETIMEDOUT;
                         sk->sk_state = SS_UNCONNECTED;
                         sock->state = SS_UNCONNECTED;
+                        vsock_transport_cancel_pkt(vsk);
                         goto out_wait;
                 }
 
@@ -1250,7 +1264,8 @@ out:
         return err;
 }
 
-static int vsock_accept(struct socket *sock, struct socket *newsock, int flags)
+static int vsock_accept(struct socket *sock, struct socket *newsock, int flags,
+                        bool kern)
 {
         struct sock *listener;
         int err;
diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
index 9d24c0e958b1..68675a151f22 100644
--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
@@ -213,6 +213,47 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt)
         return len;
 }
 
+static int
+virtio_transport_cancel_pkt(struct vsock_sock *vsk)
+{
+        struct virtio_vsock *vsock;
+        struct virtio_vsock_pkt *pkt, *n;
+        int cnt = 0;
+        LIST_HEAD(freeme);
+
+        vsock = virtio_vsock_get();
+        if (!vsock) {
+                return -ENODEV;
+        }
+
+        spin_lock_bh(&vsock->send_pkt_list_lock);
+        list_for_each_entry_safe(pkt, n, &vsock->send_pkt_list, list) {
+                if (pkt->vsk != vsk)
+                        continue;
+                list_move(&pkt->list, &freeme);
+        }
+        spin_unlock_bh(&vsock->send_pkt_list_lock);
+
+        list_for_each_entry_safe(pkt, n, &freeme, list) {
+                if (pkt->reply)
+                        cnt++;
+                list_del(&pkt->list);
+                virtio_transport_free_pkt(pkt);
+        }
+
+        if (cnt) {
+                struct virtqueue *rx_vq = vsock->vqs[VSOCK_VQ_RX];
+                int new_cnt;
+
+                new_cnt = atomic_sub_return(cnt, &vsock->queued_replies);
+                if (new_cnt + cnt >= virtqueue_get_vring_size(rx_vq) &&
+                    new_cnt < virtqueue_get_vring_size(rx_vq))
+                        queue_work(virtio_vsock_workqueue, &vsock->rx_work);
+        }
+
+        return 0;
+}
+
 static void virtio_vsock_rx_fill(struct virtio_vsock *vsock)
 {
         int buf_len = VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE;
@@ -462,6 +503,7 @@ static struct virtio_transport virtio_transport = {
                 .release                  = virtio_transport_release,
                 .connect                  = virtio_transport_connect,
                 .shutdown                 = virtio_transport_shutdown,
+                .cancel_pkt               = virtio_transport_cancel_pkt,
 
                 .dgram_bind               = virtio_transport_dgram_bind,
                 .dgram_dequeue            = virtio_transport_dgram_dequeue,
diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index 8d592a45b597..af087b44ceea 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -58,6 +58,7 @@ virtio_transport_alloc_pkt(struct virtio_vsock_pkt_info *info,
         pkt->len                = len;
         pkt->hdr.len            = cpu_to_le32(len);
         pkt->reply              = info->reply;
+        pkt->vsk                = info->vsk;
 
         if (info->msg && len > 0) {
                 pkt->buf = kmalloc(len, GFP_KERNEL);
@@ -180,6 +181,7 @@ static int virtio_transport_send_credit_update(struct vsock_sock *vsk,
         struct virtio_vsock_pkt_info info = {
                 .op = VIRTIO_VSOCK_OP_CREDIT_UPDATE,
                 .type = type,
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
@@ -519,6 +521,7 @@ int virtio_transport_connect(struct vsock_sock *vsk)
         struct virtio_vsock_pkt_info info = {
                 .op = VIRTIO_VSOCK_OP_REQUEST,
                 .type = VIRTIO_VSOCK_TYPE_STREAM,
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
@@ -534,6 +537,7 @@ int virtio_transport_shutdown(struct vsock_sock *vsk, int mode)
                           VIRTIO_VSOCK_SHUTDOWN_RCV : 0) |
                          (mode & SEND_SHUTDOWN ?
                           VIRTIO_VSOCK_SHUTDOWN_SEND : 0),
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
@@ -560,6 +564,7 @@ virtio_transport_stream_enqueue(struct vsock_sock *vsk,
                 .type = VIRTIO_VSOCK_TYPE_STREAM,
                 .msg = msg,
                 .pkt_len = len,
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
@@ -581,6 +586,7 @@ static int virtio_transport_reset(struct vsock_sock *vsk,
                 .op = VIRTIO_VSOCK_OP_RST,
                 .type = VIRTIO_VSOCK_TYPE_STREAM,
                 .reply = !!pkt,
+                .vsk = vsk,
         };
 
         /* Send RST only if the original pkt is not a RST pkt */
@@ -826,6 +832,7 @@ virtio_transport_send_response(struct vsock_sock *vsk,
                 .remote_cid = le64_to_cpu(pkt->hdr.src_cid),
                 .remote_port = le32_to_cpu(pkt->hdr.src_port),
                 .reply = true,
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d7f8be4e321a..2312dc2ffdb9 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -545,22 +545,18 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 {
         int err;
 
-        rtnl_lock();
-
         if (!cb->args[0]) {
                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
                                   genl_family_attrbuf(&nl80211_fam),
                                   nl80211_fam.maxattr, nl80211_policy);
                 if (err)
-                        goto out_unlock;
+                        return err;
 
                 *wdev = __cfg80211_wdev_from_attrs(
                                         sock_net(skb->sk),
                                         genl_family_attrbuf(&nl80211_fam));
-                if (IS_ERR(*wdev)) {
-                        err = PTR_ERR(*wdev);
-                        goto out_unlock;
-                }
+                if (IS_ERR(*wdev))
+                        return PTR_ERR(*wdev);
                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
                 /* 0 is the first index - add 1 to parse only once */
                 cb->args[0] = (*rdev)->wiphy_idx + 1;
@@ -570,10 +566,8 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
                 struct wireless_dev *tmp;
 
-                if (!wiphy) {
-                        err = -ENODEV;
-                        goto out_unlock;
-                }
+                if (!wiphy)
+                        return -ENODEV;
                 *rdev = wiphy_to_rdev(wiphy);
                 *wdev = NULL;
 
@@ -584,21 +578,11 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                         }
                 }
 
-                if (!*wdev) {
-                        err = -ENODEV;
-                        goto out_unlock;
-                }
+                if (!*wdev)
+                        return -ENODEV;
         }
 
         return 0;
- out_unlock:
-        rtnl_unlock();
-        return err;
-}
-
-static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
-{
-        rtnl_unlock();
 }
 
 /* IE validation */
@@ -2608,17 +2592,17 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
         int filter_wiphy = -1;
         struct cfg80211_registered_device *rdev;
         struct wireless_dev *wdev;
+        int ret;
 
         rtnl_lock();
         if (!cb->args[2]) {
                 struct nl80211_dump_wiphy_state state = {
                         .filter_wiphy = -1,
                 };
-                int ret;
 
                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
                 if (ret)
-                        return ret;
+                        goto out_unlock;
 
                 filter_wiphy = state.filter_wiphy;
 
@@ -2663,12 +2647,14 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
                 wp_idx++;
         }
  out:
-        rtnl_unlock();
-
         cb->args[0] = wp_idx;
         cb->args[1] = if_idx;
 
-        return skb->len;
+        ret = skb->len;
+ out_unlock:
+        rtnl_unlock();
+
+        return ret;
 }
 
 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
@@ -4452,9 +4438,10 @@ static int nl80211_dump_station(struct sk_buff *skb,
         int sta_idx = cb->args[2];
         int err;
 
+        rtnl_lock();
         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (err)
-                return err;
+                goto out_err;
 
         if (!wdev->netdev) {
                 err = -EINVAL;
@@ -4489,7 +4476,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
         cb->args[2] = sta_idx;
         err = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
 
         return err;
 }
@@ -5275,9 +5262,10 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
         int path_idx = cb->args[2];
         int err;
 
+        rtnl_lock();
         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (err)
-                return err;
+                goto out_err;
 
         if (!rdev->ops->dump_mpath) {
                 err = -EOPNOTSUPP;
@@ -5310,7 +5298,7 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
         cb->args[2] = path_idx;
         err = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
         return err;
 }
 
@@ -5470,9 +5458,10 @@ static int nl80211_dump_mpp(struct sk_buff *skb,
         int path_idx = cb->args[2];
         int err;
 
+        rtnl_lock();
         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (err)
-                return err;
+                goto out_err;
 
         if (!rdev->ops->dump_mpp) {
                 err = -EOPNOTSUPP;
@@ -5505,7 +5494,7 @@ static int nl80211_dump_mpp(struct sk_buff *skb,
         cb->args[2] = path_idx;
         err = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
         return err;
 }
 
@@ -7674,9 +7663,12 @@ static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
         int start = cb->args[2], idx = 0;
         int err;
 
+        rtnl_lock();
         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
-        if (err)
+        if (err) {
+                rtnl_unlock();
                 return err;
+        }
 
         wdev_lock(wdev);
         spin_lock_bh(&rdev->bss_lock);
@@ -7699,7 +7691,7 @@ static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
         wdev_unlock(wdev);
 
         cb->args[2] = idx;
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
 
         return skb->len;
 }
@@ -7784,9 +7776,10 @@ static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
         int res;
         bool radio_stats;
 
+        rtnl_lock();
         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (res)
-                return res;
+                goto out_err;
 
         /* prepare_wdev_dump parsed the attributes */
         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
@@ -7827,7 +7820,7 @@ static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
         cb->args[2] = survey_idx;
         res = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
         return res;
 }
 
@@ -11508,17 +11501,13 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
         void *data = NULL;
         unsigned int data_len = 0;
 
-        rtnl_lock();
-
         if (cb->args[0]) {
                 /* subtract the 1 again here */
                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
                 struct wireless_dev *tmp;
 
-                if (!wiphy) {
-                        err = -ENODEV;
-                        goto out_unlock;
-                }
+                if (!wiphy)
+                        return -ENODEV;
                 *rdev = wiphy_to_rdev(wiphy);
                 *wdev = NULL;
 
@@ -11538,23 +11527,19 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
                           attrbuf, nl80211_fam.maxattr, nl80211_policy);
         if (err)
-                goto out_unlock;
+                return err;
 
         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
-            !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
-                err = -EINVAL;
-                goto out_unlock;
-        }
+            !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
+                return -EINVAL;
 
         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
         if (IS_ERR(*wdev))
                 *wdev = NULL;
 
         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
-        if (IS_ERR(*rdev)) {
-                err = PTR_ERR(*rdev);
-                goto out_unlock;
-        }
+        if (IS_ERR(*rdev))
+                return PTR_ERR(*rdev);
 
         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
@@ -11567,19 +11552,15 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
                         continue;
 
-                if (!vcmd->dumpit) {
-                        err = -EOPNOTSUPP;
-                        goto out_unlock;
-                }
+                if (!vcmd->dumpit)
+                        return -EOPNOTSUPP;
 
                 vcmd_idx = i;
                 break;
         }
 
-        if (vcmd_idx < 0) {
-                err = -EOPNOTSUPP;
-                goto out_unlock;
-        }
+        if (vcmd_idx < 0)
+                return -EOPNOTSUPP;
 
         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
@@ -11596,9 +11577,6 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
 
         /* keep rtnl locked in successful case */
         return 0;
- out_unlock:
-        rtnl_unlock();
-        return err;
 }
 
 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
@@ -11613,9 +11591,10 @@ static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
         int err;
         struct nlattr *vendor_data;
 
+        rtnl_lock();
         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
         if (err)
-                return err;
+                goto out;
 
         vcmd_idx = cb->args[2];
         data = (void *)cb->args[3];
@@ -11624,15 +11603,21 @@ static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
 
         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
-                if (!wdev)
-                        return -EINVAL;
+                if (!wdev) {
+                        err = -EINVAL;
+                        goto out;
+                }
                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
-                    !wdev->netdev)
-                        return -EINVAL;
+                    !wdev->netdev) {
+                        err = -EINVAL;
+                        goto out;
+                }
 
                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
-                        if (!wdev_running(wdev))
-                                return -ENETDOWN;
+                        if (!wdev_running(wdev)) {
+                                err = -ENETDOWN;
+                                goto out;
+                        }
                 }
         }
 
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index fd28a49dbe8f..8b911c29860e 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -852,7 +852,8 @@ static int x25_wait_for_data(struct sock *sk, long timeout)
         return rc;
 }
 
-static int x25_accept(struct socket *sock, struct socket *newsock, int flags)
+static int x25_accept(struct socket *sock, struct socket *newsock, int flags,
+                      bool kern)
 {
         struct sock *sk = sock->sk;
         struct sock *newsk;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 0806dccdf507..236cbbc0ab9c 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1243,7 +1243,7 @@ static inline int policy_to_flow_dir(int dir)
 }
 
 static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
-                                                 const struct flowi *fl)
+                                                 const struct flowi *fl, u16 family)
 {
         struct xfrm_policy *pol;
 
@@ -1251,8 +1251,7 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
  again:
         pol = rcu_dereference(sk->sk_policy[dir]);
         if (pol != NULL) {
-                bool match = xfrm_selector_match(&pol->selector, fl,
-                                                 sk->sk_family);
+                bool match = xfrm_selector_match(&pol->selector, fl, family);
                 int err = 0;
 
                 if (match) {
@@ -2239,7 +2238,7 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
         sk = sk_const_to_full_sk(sk);
         if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
                 num_pols = 1;
-                pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
+                pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, family);
                 err = xfrm_expand_policies(fl, family, pols,
                                            &num_pols, &num_xfrms);
                 if (err < 0)
@@ -2518,7 +2517,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
         pol = NULL;
         sk = sk_to_full_sk(sk);
         if (sk && sk->sk_policy[dir]) {
-                pol = xfrm_sk_policy_lookup(sk, dir, &fl);
+                pol = xfrm_sk_policy_lookup(sk, dir, &fl, family);
                 if (IS_ERR(pol)) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
                         return 0;
@@ -3069,6 +3068,11 @@ static int __net_init xfrm_net_init(struct net *net)
 {
         int rv;
 
+        /* Initialize the per-net locks here */
+        spin_lock_init(&net->xfrm.xfrm_state_lock);
+        spin_lock_init(&net->xfrm.xfrm_policy_lock);
+        mutex_init(&net->xfrm.xfrm_cfg_mutex);
+
         rv = xfrm_statistics_init(net);
         if (rv < 0)
                 goto out_statistics;
@@ -3085,11 +3089,6 @@ static int __net_init xfrm_net_init(struct net *net)
         if (rv < 0)
                 goto out;
 
-        /* Initialize the per-net locks here */
-        spin_lock_init(&net->xfrm.xfrm_state_lock);
-        spin_lock_init(&net->xfrm.xfrm_policy_lock);
-        mutex_init(&net->xfrm.xfrm_cfg_mutex);
-
         return 0;
 
 out:
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 9705c279494b..40a8aa39220d 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -412,7 +412,14 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es
         up = nla_data(rp);
         ulen = xfrm_replay_state_esn_len(up);
 
-        if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen)
+        /* Check the overall length and the internal bitmap length to avoid
+         * potential overflow. */
+        if (nla_len(rp) < ulen ||
+            xfrm_replay_state_esn_len(replay_esn) != ulen ||
+            replay_esn->bmp_len != up->bmp_len)
+                return -EINVAL;
+
+        if (up->replay_window > up->bmp_len * sizeof(__u32) * 8)
                 return -EINVAL;
 
         return 0;
diff --git a/samples/statx/test-statx.c b/samples/statx/test-statx.c
index 8571d766331d..d4d77b09412c 100644
--- a/samples/statx/test-statx.c
+++ b/samples/statx/test-statx.c
@@ -141,8 +141,8 @@ static void dump_statx(struct statx *stx)
         if (stx->stx_mask & STATX_BTIME)
                 print_time(" Birth: ", &stx->stx_btime);
 
-        if (stx->stx_attributes) {
-                unsigned char bits;
+        if (stx->stx_attributes_mask) {
+                unsigned char bits, mbits;
                 int loop, byte;
 
                 static char attr_representation[64 + 1] =
@@ -160,14 +160,18 @@ static void dump_statx(struct statx *stx)
                 printf("Attributes: %016llx (", stx->stx_attributes);
                 for (byte = 64 - 8; byte >= 0; byte -= 8) {
                         bits = stx->stx_attributes >> byte;
+                        mbits = stx->stx_attributes_mask >> byte;
                         for (loop = 7; loop >= 0; loop--) {
                                 int bit = byte + loop;
 
-                                if (bits & 0x80)
+                                if (!(mbits & 0x80))
+                                        putchar('.');   /* Not supported */
+                                else if (bits & 0x80)
                                         putchar(attr_representation[63 - bit]);
                                 else
-                                        putchar('-');
+                                        putchar('-');   /* Not set */
                                 bits <<= 1;
+                                mbits <<= 1;
                         }
                         if (byte)
                                 putchar(' ');
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index d6ca649cb0e9..afe3fd3af1e4 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -148,6 +148,10 @@ cc-fullversion = $(shell $(CONFIG_SHELL) \
 # Usage:  EXTRA_CFLAGS += $(call cc-ifversion, -lt, 0402, -O1)
 cc-ifversion = $(shell [ $(cc-version) $(1) $(2) ] && echo $(3) || echo $(4))
 
+# cc-if-fullversion
+# Usage:  EXTRA_CFLAGS += $(call cc-if-fullversion, -lt, 040502, -O1)
+cc-if-fullversion = $(shell [ $(cc-fullversion) $(1) $(2) ] && echo $(3) || echo $(4))
+
 # cc-ldoption
 # Usage: ldflags += $(call cc-ldoption, -Wl$(comma)--hash-style=both)
 cc-ldoption = $(call try-run,\
diff --git a/scripts/gcc-plugins/sancov_plugin.c b/scripts/gcc-plugins/sancov_plugin.c
index 9b0b5cbc5b89..0f98634c20a0 100644
--- a/scripts/gcc-plugins/sancov_plugin.c
+++ b/scripts/gcc-plugins/sancov_plugin.c
@@ -133,7 +133,7 @@ __visible int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gc
 #if BUILDING_GCC_VERSION < 6000
         register_callback(plugin_name, PLUGIN_START_UNIT, &sancov_start_unit, NULL);
         register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_sancov);
-        register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &sancov_plugin_pass_info);
+        register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &sancov_pass_info);
 #endif
 
         return 0;
diff --git a/scripts/module-common.lds b/scripts/module-common.lds
index cf7e52e4781b..9b6e246a45d0 100644
--- a/scripts/module-common.lds
+++ b/scripts/module-common.lds
@@ -22,4 +22,6 @@ SECTIONS {
 
         . = ALIGN(8);
         .init_array             0 : { *(SORT(.init_array.*)) *(.init_array) }
+
+        __jump_table            0 : ALIGN(8) { KEEP(*(__jump_table)) }
 }
diff --git a/scripts/spelling.txt b/scripts/spelling.txt
index 0458b037c8a1..0545f5a8cabe 100644
--- a/scripts/spelling.txt
+++ b/scripts/spelling.txt
@@ -372,6 +372,8 @@ disassocation||disassociation
 disapear||disappear
 disapeared||disappeared
 disappared||disappeared
+disble||disable
+disbled||disabled
 disconnet||disconnect
 discontinous||discontinuous
 dispertion||dispersion
@@ -732,6 +734,7 @@ oustanding||outstanding
 overaall||overall
 overhread||overhead
 overlaping||overlapping
+overide||override
 overrided||overridden
 overriden||overridden
 overun||overrun
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 4c935202ce23..f3b1d7f50b81 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1832,6 +1832,7 @@ static int snd_seq_ioctl_set_client_pool(struct snd_seq_client *client,
              info->output_pool != client->pool->size)) {
                 if (snd_seq_write_pool_allocated(client)) {
                         /* remove all existing cells */
+                        snd_seq_pool_mark_closing(client->pool);
                         snd_seq_queue_client_leave_cells(client->number);
                         snd_seq_pool_done(client->pool);
                 }
diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
index 448efd4e980e..01c4cfe30c9f 100644
--- a/sound/core/seq/seq_fifo.c
+++ b/sound/core/seq/seq_fifo.c
@@ -72,6 +72,9 @@ void snd_seq_fifo_delete(struct snd_seq_fifo **fifo)
                 return;
         *fifo = NULL;
 
+        if (f->pool)
+                snd_seq_pool_mark_closing(f->pool);
+
         snd_seq_fifo_clear(f);
 
         /* wake up clients if any */
@@ -264,6 +267,10 @@ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize)
         /* NOTE: overflow flag is not cleared */
         spin_unlock_irqrestore(&f->lock, flags);
 
+        /* close the old pool and wait until all users are gone */
+        snd_seq_pool_mark_closing(oldpool);
+        snd_use_lock_sync(&f->use_lock);
+
         /* release cells in old pool */
         for (cell = oldhead; cell; cell = next) {
                 next = cell->next;
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index 1a1acf3ddda4..d4c61ec9be13 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -415,6 +415,18 @@ int snd_seq_pool_init(struct snd_seq_pool *pool)
         return 0;
 }
 
+/* refuse the further insertion to the pool */
+void snd_seq_pool_mark_closing(struct snd_seq_pool *pool)
+{
+        unsigned long flags;
+
+        if (snd_BUG_ON(!pool))
+                return;
+        spin_lock_irqsave(&pool->lock, flags);
+        pool->closing = 1;
+        spin_unlock_irqrestore(&pool->lock, flags);
+}
+
 /* remove events */
 int snd_seq_pool_done(struct snd_seq_pool *pool)
 {
@@ -425,10 +437,6 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)
                 return -EINVAL;
 
         /* wait for closing all threads */
-        spin_lock_irqsave(&pool->lock, flags);
-        pool->closing = 1;
-        spin_unlock_irqrestore(&pool->lock, flags);
-
         if (waitqueue_active(&pool->output_sleep))
                 wake_up(&pool->output_sleep);
 
@@ -485,6 +493,7 @@ int snd_seq_pool_delete(struct snd_seq_pool **ppool)
         *ppool = NULL;
         if (pool == NULL)
                 return 0;
+        snd_seq_pool_mark_closing(pool);
         snd_seq_pool_done(pool);
         kfree(pool);
         return 0;
diff --git a/sound/core/seq/seq_memory.h b/sound/core/seq/seq_memory.h
index 4a2ec779b8a7..32f959c17786 100644
--- a/sound/core/seq/seq_memory.h
+++ b/sound/core/seq/seq_memory.h
@@ -84,6 +84,7 @@ static inline int snd_seq_total_cells(struct snd_seq_pool *pool)
 int snd_seq_pool_init(struct snd_seq_pool *pool);
 
 /* done pool - free events */
+void snd_seq_pool_mark_closing(struct snd_seq_pool *pool);
 int snd_seq_pool_done(struct snd_seq_pool *pool);
 
 /* create pool */
diff --git a/sound/pci/ctxfi/cthw20k1.c b/sound/pci/ctxfi/cthw20k1.c
index ab4cdab5cfa5..79edd88d5cd0 100644
--- a/sound/pci/ctxfi/cthw20k1.c
+++ b/sound/pci/ctxfi/cthw20k1.c
@@ -1905,7 +1905,7 @@ static int hw_card_start(struct hw *hw)
                 return err;
 
         /* Set DMA transfer mask */
-        if (dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
+        if (!dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
                 dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits));
         } else {
                 dma_set_mask(&pci->dev, DMA_BIT_MASK(32));
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index c15c51bea26d..69266b8ea2ad 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -261,6 +261,7 @@ enum {
         CXT_FIXUP_HP_530,
         CXT_FIXUP_CAP_MIX_AMP_5047,
         CXT_FIXUP_MUTE_LED_EAPD,
+        CXT_FIXUP_HP_DOCK,
         CXT_FIXUP_HP_SPECTRE,
         CXT_FIXUP_HP_GATE_MIC,
 };
@@ -778,6 +779,14 @@ static const struct hda_fixup cxt_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = cxt_fixup_mute_led_eapd,
         },
+        [CXT_FIXUP_HP_DOCK] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x16, 0x21011020 }, /* line-out */
+                        { 0x18, 0x2181103f }, /* line-in */
+                        { }
+                }
+        },
         [CXT_FIXUP_HP_SPECTRE] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
@@ -839,6 +848,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
         SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
+        SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
         SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
         SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
@@ -871,6 +881,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = {
         { .id = CXT_PINCFG_LEMOTE_A1205, .name = "lemote-a1205" },
         { .id = CXT_FIXUP_OLPC_XO, .name = "olpc-xo" },
         { .id = CXT_FIXUP_MUTE_LED_EAPD, .name = "mute-led-eapd" },
+        { .id = CXT_FIXUP_HP_DOCK, .name = "hp-dock" },
         {}
 };
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 4e112221d825..299835d1fbaa 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4847,6 +4847,7 @@ enum {
         ALC286_FIXUP_HP_GPIO_LED,
         ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY,
         ALC280_FIXUP_HP_DOCK_PINS,
+        ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED,
         ALC280_FIXUP_HP_9480M,
         ALC288_FIXUP_DELL_HEADSET_MODE,
         ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -4857,6 +4858,7 @@ enum {
         ALC292_FIXUP_DISABLE_AAMIX,
         ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK,
         ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+        ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE,
         ALC275_FIXUP_DELL_XPS,
         ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE,
         ALC293_FIXUP_LENOVO_SPK_NOISE,
@@ -5388,6 +5390,16 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC280_FIXUP_HP_GPIO4
         },
+        [ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x1b, 0x21011020 }, /* line-out */
+                        { 0x18, 0x2181103f }, /* line-in */
+                        { },
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HP_GPIO_MIC1_LED
+        },
         [ALC280_FIXUP_HP_9480M] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc280_fixup_hp_9480m,
@@ -5459,6 +5471,15 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC269_FIXUP_HEADSET_MODE
         },
+        [ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MODE
+        },
         [ALC275_FIXUP_DELL_XPS] = {
                 .type = HDA_FIXUP_VERBS,
                 .v.verbs = (const struct hda_verb[]) {
@@ -5531,7 +5552,7 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc298_fixup_speaker_volume,
                 .chained = true,
-                .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+                .chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE,
         },
         [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
                 .type = HDA_FIXUP_PINS,
@@ -5647,7 +5668,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x2256, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2257, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2259, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
-        SND_PCI_QUIRK(0x103c, 0x225a, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+        SND_PCI_QUIRK(0x103c, 0x225a, "HP", ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2260, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x2263, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x2264, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
@@ -5816,6 +5837,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {.id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, .name = "headset-mode-no-hp-mic"},
         {.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"},
         {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"},
+        {.id = ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, .name = "hp-dock-gpio-mic1-led"},
         {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
         {.id = ALC269_FIXUP_DELL2_MIC_NO_PRESENCE, .name = "dell-headset-dock"},
         {.id = ALC283_FIXUP_CHROME_BOOK, .name = "alc283-dac-wcaps"},
@@ -6090,6 +6112,8 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 ALC295_STANDARD_PINS,
                 {0x17, 0x21014040},
                 {0x18, 0x21a19050}),
+        SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+                ALC295_STANDARD_PINS),
         SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC298_STANDARD_PINS,
                 {0x17, 0x90170110}),
diff --git a/sound/soc/amd/acp-pcm-dma.c b/sound/soc/amd/acp-pcm-dma.c
index ec1067a679da..08b1399d1da2 100644
--- a/sound/soc/amd/acp-pcm-dma.c
+++ b/sound/soc/amd/acp-pcm-dma.c
@@ -89,7 +89,7 @@ static void acp_reg_write(u32 val, void __iomem *acp_mmio, u32 reg)
         writel(val, acp_mmio + (reg * 4));
 }
 
-/* Configure a given dma channel parameters - enable/disble,
+/* Configure a given dma channel parameters - enable/disable,
  * number of descriptors, priority
  */
 static void config_acp_dma_channel(void __iomem *acp_mmio, u8 ch_num,
diff --git a/sound/soc/atmel/atmel-classd.c b/sound/soc/atmel/atmel-classd.c
index 89ac5f5a93eb..7ae46c2647d4 100644
--- a/sound/soc/atmel/atmel-classd.c
+++ b/sound/soc/atmel/atmel-classd.c
@@ -349,7 +349,7 @@ static int atmel_classd_codec_dai_digital_mute(struct snd_soc_dai *codec_dai,
 }
 
 #define CLASSD_ACLK_RATE_11M2896_MPY_8 (112896 * 100 * 8)
-#define CLASSD_ACLK_RATE_12M288_MPY_8  (12228 * 1000 * 8)
+#define CLASSD_ACLK_RATE_12M288_MPY_8  (12288 * 1000 * 8)
 
 static struct {
         int rate;
diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
index 78fca8acd3ec..fd272a40485b 100644
--- a/sound/soc/codecs/hdac_hdmi.c
+++ b/sound/soc/codecs/hdac_hdmi.c
@@ -1534,21 +1534,20 @@ static void hdac_hdmi_eld_notify_cb(void *aptr, int port, int pipe)
                         pin->mst_capable = false;
                         /* if not MST, default is port[0] */
                         hport = &pin->ports[0];
-                        goto out;
                 } else {
                         for (i = 0; i < pin->num_ports; i++) {
                                 pin->mst_capable = true;
                                 if (pin->ports[i].id == pipe) {
                                         hport = &pin->ports[i];
-                                        goto out;
+                                        break;
                                 }
                         }
                 }
+
+                if (hport)
+                        hdac_hdmi_present_sense(pin, hport);
         }
 
-out:
-        if (pin && hport)
-                hdac_hdmi_present_sense(pin, hport);
 }
 
 static struct i915_audio_component_audio_ops aops = {
@@ -1998,7 +1997,7 @@ static int hdac_hdmi_dev_remove(struct hdac_ext_device *edev)
         struct hdac_hdmi_pin *pin, *pin_next;
         struct hdac_hdmi_cvt *cvt, *cvt_next;
         struct hdac_hdmi_pcm *pcm, *pcm_next;
-        struct hdac_hdmi_port *port;
+        struct hdac_hdmi_port *port, *port_next;
         int i;
 
         snd_soc_unregister_codec(&edev->hdac.dev);
@@ -2008,8 +2007,9 @@ static int hdac_hdmi_dev_remove(struct hdac_ext_device *edev)
                 if (list_empty(&pcm->port_list))
                         continue;
 
-                list_for_each_entry(port, &pcm->port_list, head)
-                        port = NULL;
+                list_for_each_entry_safe(port, port_next,
+                                        &pcm->port_list, head)
+                        list_del(&port->head);
 
                 list_del(&pcm->head);
                 kfree(pcm);
diff --git a/sound/soc/codecs/rt5665.c b/sound/soc/codecs/rt5665.c
index 324461e985b3..476135ec5726 100644
--- a/sound/soc/codecs/rt5665.c
+++ b/sound/soc/codecs/rt5665.c
@@ -1241,7 +1241,7 @@ static irqreturn_t rt5665_irq(int irq, void *data)
 static void rt5665_jd_check_handler(struct work_struct *work)
 {
         struct rt5665_priv *rt5665 = container_of(work, struct rt5665_priv,
-                calibrate_work.work);
+                jd_check_work.work);
 
         if (snd_soc_read(rt5665->codec, RT5665_AJD1_CTRL) & 0x0010) {
                 /* jack out */
@@ -2252,7 +2252,7 @@ static const char * const rt5665_if2_1_adc_in_src[] = {
 
 static const SOC_ENUM_SINGLE_DECL(
         rt5665_if2_1_adc_in_enum, RT5665_DIG_INF2_DATA,
-        RT5665_IF3_ADC_IN_SFT, rt5665_if2_1_adc_in_src);
+        RT5665_IF2_1_ADC_IN_SFT, rt5665_if2_1_adc_in_src);
 
 static const struct snd_kcontrol_new rt5665_if2_1_adc_in_mux =
         SOC_DAPM_ENUM("IF2_1 ADC IN Source", rt5665_if2_1_adc_in_enum);
@@ -3178,6 +3178,9 @@ static const struct snd_soc_dapm_route rt5665_dapm_routes[] = {
         {"DAC Mono Right Filter", NULL, "DAC Mono R ASRC", is_using_asrc},
         {"DAC Stereo1 Filter", NULL, "DAC STO1 ASRC", is_using_asrc},
         {"DAC Stereo2 Filter", NULL, "DAC STO2 ASRC", is_using_asrc},
+        {"I2S1 ASRC", NULL, "CLKDET"},
+        {"I2S2 ASRC", NULL, "CLKDET"},
+        {"I2S3 ASRC", NULL, "CLKDET"},
 
         /*Vref*/
         {"Mic Det Power", NULL, "Vref2"},
@@ -3912,6 +3915,7 @@ static const struct snd_soc_dapm_route rt5665_dapm_routes[] = {
         {"Mono MIX", "MONOVOL Switch", "MONOVOL"},
         {"Mono Amp", NULL, "Mono MIX"},
         {"Mono Amp", NULL, "Vref2"},
+        {"Mono Amp", NULL, "Vref3"},
         {"Mono Amp", NULL, "CLKDET SYS"},
         {"Mono Amp", NULL, "CLKDET MONO"},
         {"Mono Playback", "Switch", "Mono Amp"},
@@ -4798,7 +4802,7 @@ static int rt5665_i2c_probe(struct i2c_client *i2c,
         /* Enhance performance*/
         regmap_update_bits(rt5665->regmap, RT5665_PWR_ANLG_1,
                 RT5665_HP_DRIVER_MASK | RT5665_LDO1_DVO_MASK,
-                RT5665_HP_DRIVER_5X | RT5665_LDO1_DVO_09);
+                RT5665_HP_DRIVER_5X | RT5665_LDO1_DVO_12);
 
         INIT_DELAYED_WORK(&rt5665->jack_detect_work,
                                 rt5665_jack_detect_handler);
diff --git a/sound/soc/codecs/rt5665.h b/sound/soc/codecs/rt5665.h
index 12f7080a0d3c..a30f5e6d0628 100644
--- a/sound/soc/codecs/rt5665.h
+++ b/sound/soc/codecs/rt5665.h
@@ -1106,7 +1106,7 @@
 #define RT5665_HP_DRIVER_MASK                   (0x3 << 2)
 #define RT5665_HP_DRIVER_1X                     (0x0 << 2)
 #define RT5665_HP_DRIVER_3X                     (0x1 << 2)
-#define RT5665_HP_DRIVER_5X                     (0x2 << 2)
+#define RT5665_HP_DRIVER_5X                     (0x3 << 2)
 #define RT5665_LDO1_DVO_MASK                    (0x3)
 #define RT5665_LDO1_DVO_09                      (0x0)
 #define RT5665_LDO1_DVO_10                      (0x1)
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index d151224ffcca..bbdb72f73df1 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -899,7 +899,10 @@ static int wm_coeff_put(struct snd_kcontrol *kctl,
 
         mutex_lock(&ctl->dsp->pwr_lock);
 
-        memcpy(ctl->cache, p, ctl->len);
+        if (ctl->flags & WMFW_CTL_FLAG_VOLATILE)
+                ret = -EPERM;
+        else
+                memcpy(ctl->cache, p, ctl->len);
 
         ctl->set = 1;
         if (ctl->enabled && ctl->dsp->running)
@@ -926,6 +929,8 @@ static int wm_coeff_tlv_put(struct snd_kcontrol *kctl,
                 ctl->set = 1;
                 if (ctl->enabled && ctl->dsp->running)
                         ret = wm_coeff_write_control(ctl, ctl->cache, size);
+                else if (ctl->flags & WMFW_CTL_FLAG_VOLATILE)
+                        ret = -EPERM;
         }
 
         mutex_unlock(&ctl->dsp->pwr_lock);
@@ -947,7 +952,7 @@ static int wm_coeff_put_acked(struct snd_kcontrol *kctl,
 
         mutex_lock(&ctl->dsp->pwr_lock);
 
-        if (ctl->enabled)
+        if (ctl->enabled && ctl->dsp->running)
                 ret = wm_coeff_write_acked_control(ctl, val);
         else
                 ret = -EPERM;
diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c
index 4924575d2e95..343b291fc372 100644
--- a/sound/soc/generic/simple-card-utils.c
+++ b/sound/soc/generic/simple-card-utils.c
@@ -115,6 +115,7 @@ int asoc_simple_card_parse_clk(struct device *dev,
         clk = devm_get_clk_from_child(dev, node, NULL);
         if (!IS_ERR(clk)) {
                 simple_dai->sysclk = clk_get_rate(clk);
+                simple_dai->clk = clk;
         } else if (!of_property_read_u32(node, "system-clock-frequency", &val)) {
                 simple_dai->sysclk = val;
         } else {
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index ed58b5b3555a..2dbfb1b24ef4 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -512,7 +512,7 @@ static int skl_tplg_set_module_init_data(struct snd_soc_dapm_widget *w)
                         if (bc->set_params != SKL_PARAM_INIT)
                                 continue;
 
-                        mconfig->formats_config.caps = (u32 *)&bc->params;
+                        mconfig->formats_config.caps = (u32 *)bc->params;
                         mconfig->formats_config.caps_size = bc->size;
 
                         break;
diff --git a/sound/soc/mediatek/Kconfig b/sound/soc/mediatek/Kconfig
index 05cf809cf9e1..d7013bde6f45 100644
--- a/sound/soc/mediatek/Kconfig
+++ b/sound/soc/mediatek/Kconfig
@@ -13,7 +13,7 @@ config SND_SOC_MT2701
 
 config SND_SOC_MT2701_CS42448
         tristate "ASoc Audio driver for MT2701 with CS42448 codec"
-        depends on SND_SOC_MT2701
+        depends on SND_SOC_MT2701 && I2C
         select SND_SOC_CS42XX8_I2C
         select SND_SOC_BT_SCO
         help
diff --git a/sound/soc/sh/rcar/cmd.c b/sound/soc/sh/rcar/cmd.c
index abb5eaac854a..7d92a24b7cfa 100644
--- a/sound/soc/sh/rcar/cmd.c
+++ b/sound/soc/sh/rcar/cmd.c
@@ -31,23 +31,24 @@ static int rsnd_cmd_init(struct rsnd_mod *mod,
         struct rsnd_mod *mix = rsnd_io_to_mod_mix(io);
         struct device *dev = rsnd_priv_to_dev(priv);
         u32 data;
+        u32 path[] = {
+                [1] = 1 << 0,
+                [5] = 1 << 8,
+                [6] = 1 << 12,
+                [9] = 1 << 15,
+        };
 
         if (!mix && !dvc)
                 return 0;
 
+        if (ARRAY_SIZE(path) < rsnd_mod_id(mod) + 1)
+                return -ENXIO;
+
         if (mix) {
                 struct rsnd_dai *rdai;
                 struct rsnd_mod *src;
                 struct rsnd_dai_stream *tio;
                 int i;
-                u32 path[] = {
-                        [0] = 0,
-                        [1] = 1 << 0,
-                        [2] = 0,
-                        [3] = 0,
-                        [4] = 0,
-                        [5] = 1 << 8
-                };
 
                 /*
                  * it is assuming that integrater is well understanding about
@@ -70,16 +71,19 @@ static int rsnd_cmd_init(struct rsnd_mod *mod,
         } else {
                 struct rsnd_mod *src = rsnd_io_to_mod_src(io);
 
-                u32 path[] = {
-                        [0] = 0x30000,
-                        [1] = 0x30001,
-                        [2] = 0x40000,
-                        [3] = 0x10000,
-                        [4] = 0x20000,
-                        [5] = 0x40100
+                u8 cmd_case[] = {
+                        [0] = 0x3,
+                        [1] = 0x3,
+                        [2] = 0x4,
+                        [3] = 0x1,
+                        [4] = 0x2,
+                        [5] = 0x4,
+                        [6] = 0x1,
+                        [9] = 0x2,
                 };
 
-                data = path[rsnd_mod_id(src)];
+                data = path[rsnd_mod_id(src)] |
+                        cmd_case[rsnd_mod_id(src)] << 16;
         }
 
         dev_dbg(dev, "ctu/mix path = 0x%08x", data);
diff --git a/sound/soc/sh/rcar/dma.c b/sound/soc/sh/rcar/dma.c
index 1f405c833867..241cb3b08a07 100644
--- a/sound/soc/sh/rcar/dma.c
+++ b/sound/soc/sh/rcar/dma.c
@@ -454,6 +454,20 @@ static u32 rsnd_dmapp_read(struct rsnd_dma *dma, u32 reg)
         return ioread32(rsnd_dmapp_addr(dmac, dma, reg));
 }
 
+static void rsnd_dmapp_bset(struct rsnd_dma *dma, u32 data, u32 mask, u32 reg)
+{
+        struct rsnd_mod *mod = rsnd_mod_get(dma);
+        struct rsnd_priv *priv = rsnd_mod_to_priv(mod);
+        struct rsnd_dma_ctrl *dmac = rsnd_priv_to_dmac(priv);
+        void __iomem *addr = rsnd_dmapp_addr(dmac, dma, reg);
+        u32 val = ioread32(addr);
+
+        val &= ~mask;
+        val |= (data & mask);
+
+        iowrite32(val, addr);
+}
+
 static int rsnd_dmapp_stop(struct rsnd_mod *mod,
                            struct rsnd_dai_stream *io,
                            struct rsnd_priv *priv)
@@ -461,10 +475,10 @@ static int rsnd_dmapp_stop(struct rsnd_mod *mod,
         struct rsnd_dma *dma = rsnd_mod_to_dma(mod);
         int i;
 
-        rsnd_dmapp_write(dma, 0, PDMACHCR);
+        rsnd_dmapp_bset(dma, 0,  PDMACHCR_DE, PDMACHCR);
 
         for (i = 0; i < 1024; i++) {
-                if (0 == rsnd_dmapp_read(dma, PDMACHCR))
+                if (0 == (rsnd_dmapp_read(dma, PDMACHCR) & PDMACHCR_DE))
                         return 0;
                 udelay(1);
         }
diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
index 4e817c8a18c0..14fafdaf1395 100644
--- a/sound/soc/sh/rcar/ssiu.c
+++ b/sound/soc/sh/rcar/ssiu.c
@@ -64,7 +64,11 @@ static int rsnd_ssiu_init(struct rsnd_mod *mod,
         mask1 = (1 << 4) | (1 << 20);   /* mask sync bit */
         mask2 = (1 << 4);               /* mask sync bit */
         val1  = val2  = 0;
-        if (rsnd_ssi_is_pin_sharing(io)) {
+        if (id == 8) {
+                /*
+                 * SSI8 pin is sharing with SSI7, nothing to do.
+                 */
+        } else if (rsnd_ssi_is_pin_sharing(io)) {
                 int shift = -1;
 
                 switch (id) {
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 6dca408faae3..2722bb0c5573 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -3326,7 +3326,10 @@ static int snd_soc_platform_drv_pcm_new(struct snd_soc_pcm_runtime *rtd)
 {
         struct snd_soc_platform *platform = rtd->platform;
 
-        return platform->driver->pcm_new(rtd);
+        if (platform->driver->pcm_new)
+                return platform->driver->pcm_new(rtd);
+        else
+                return 0;
 }
 
 static void snd_soc_platform_drv_pcm_free(struct snd_pcm *pcm)
@@ -3334,7 +3337,8 @@ static void snd_soc_platform_drv_pcm_free(struct snd_pcm *pcm)
         struct snd_soc_pcm_runtime *rtd = pcm->private_data;
         struct snd_soc_platform *platform = rtd->platform;
 
-        platform->driver->pcm_free(pcm);
+        if (platform->driver->pcm_free)
+                platform->driver->pcm_free(pcm);
 }
 
 /**
diff --git a/sound/soc/sti/uniperif_reader.c b/sound/soc/sti/uniperif_reader.c
index 5992c6ab3833..93a8df6ed880 100644
--- a/sound/soc/sti/uniperif_reader.c
+++ b/sound/soc/sti/uniperif_reader.c
@@ -349,6 +349,8 @@ static int uni_reader_startup(struct snd_pcm_substream *substream,
         struct uniperif *reader = priv->dai_data.uni;
         int ret;
 
+        reader->substream = substream;
+
         if (!UNIPERIF_TYPE_IS_TDM(reader))
                 return 0;
 
@@ -378,6 +380,7 @@ static void uni_reader_shutdown(struct snd_pcm_substream *substream,
                 /* Stop the reader */
                 uni_reader_stop(reader);
         }
+        reader->substream = NULL;
 }
 
 static const struct snd_soc_dai_ops uni_reader_dai_ops = {
diff --git a/sound/soc/sunxi/sun8i-codec.c b/sound/soc/sunxi/sun8i-codec.c
index b92bdc8361af..7527ba29a5a0 100644
--- a/sound/soc/sunxi/sun8i-codec.c
+++ b/sound/soc/sunxi/sun8i-codec.c
@@ -259,25 +259,20 @@ static int sun8i_codec_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static const struct snd_kcontrol_new sun8i_output_left_mixer_controls[] = {
-        SOC_DAPM_SINGLE("LSlot 0", SUN8I_DAC_MXR_SRC,
-                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_AIF1DA0L, 1, 0),
-        SOC_DAPM_SINGLE("LSlot 1", SUN8I_DAC_MXR_SRC,
-                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_AIF1DA1L, 1, 0),
-        SOC_DAPM_SINGLE("DACL", SUN8I_DAC_MXR_SRC,
-                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_AIF2DACL, 1, 0),
-        SOC_DAPM_SINGLE("ADCL", SUN8I_DAC_MXR_SRC,
-                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_ADCL, 1, 0),
-};
-
-static const struct snd_kcontrol_new sun8i_output_right_mixer_controls[] = {
-        SOC_DAPM_SINGLE("RSlot 0", SUN8I_DAC_MXR_SRC,
+static const struct snd_kcontrol_new sun8i_dac_mixer_controls[] = {
+        SOC_DAPM_DOUBLE("AIF1 Slot 0 Digital DAC Playback Switch",
+                        SUN8I_DAC_MXR_SRC,
+                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_AIF1DA0L,
                         SUN8I_DAC_MXR_SRC_DACR_MXR_SRC_AIF1DA0R, 1, 0),
-        SOC_DAPM_SINGLE("RSlot 1", SUN8I_DAC_MXR_SRC,
+        SOC_DAPM_DOUBLE("AIF1 Slot 1 Digital DAC Playback Switch",
+                        SUN8I_DAC_MXR_SRC,
+                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_AIF1DA1L,
                         SUN8I_DAC_MXR_SRC_DACR_MXR_SRC_AIF1DA1R, 1, 0),
-        SOC_DAPM_SINGLE("DACR", SUN8I_DAC_MXR_SRC,
+        SOC_DAPM_DOUBLE("AIF2 Digital DAC Playback Switch", SUN8I_DAC_MXR_SRC,
+                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_AIF2DACL,
                         SUN8I_DAC_MXR_SRC_DACR_MXR_SRC_AIF2DACR, 1, 0),
-        SOC_DAPM_SINGLE("ADCR", SUN8I_DAC_MXR_SRC,
+        SOC_DAPM_DOUBLE("ADC Digital DAC Playback Switch", SUN8I_DAC_MXR_SRC,
+                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_ADCL,
                         SUN8I_DAC_MXR_SRC_DACR_MXR_SRC_ADCR, 1, 0),
 };
 
@@ -286,19 +281,21 @@ static const struct snd_soc_dapm_widget sun8i_codec_dapm_widgets[] = {
         SND_SOC_DAPM_SUPPLY("DAC", SUN8I_DAC_DIG_CTRL, SUN8I_DAC_DIG_CTRL_ENDA,
                             0, NULL, 0),
 
-        /* Analog DAC */
-        SND_SOC_DAPM_DAC("Digital Left DAC", "Playback", SUN8I_AIF1_DACDAT_CTRL,
-                         SUN8I_AIF1_DACDAT_CTRL_AIF1_DA0L_ENA, 0),
-        SND_SOC_DAPM_DAC("Digital Right DAC", "Playback", SUN8I_AIF1_DACDAT_CTRL,
-                         SUN8I_AIF1_DACDAT_CTRL_AIF1_DA0R_ENA, 0),
+        /* Analog DAC AIF */
+        SND_SOC_DAPM_AIF_IN("AIF1 Slot 0 Left", "Playback", 0,
+                            SUN8I_AIF1_DACDAT_CTRL,
+                            SUN8I_AIF1_DACDAT_CTRL_AIF1_DA0L_ENA, 0),
+        SND_SOC_DAPM_AIF_IN("AIF1 Slot 0 Right", "Playback", 0,
+                            SUN8I_AIF1_DACDAT_CTRL,
+                            SUN8I_AIF1_DACDAT_CTRL_AIF1_DA0R_ENA, 0),
 
         /* DAC Mixers */
-        SND_SOC_DAPM_MIXER("Left DAC Mixer", SND_SOC_NOPM, 0, 0,
-                           sun8i_output_left_mixer_controls,
-                           ARRAY_SIZE(sun8i_output_left_mixer_controls)),
-        SND_SOC_DAPM_MIXER("Right DAC Mixer", SND_SOC_NOPM, 0, 0,
-                           sun8i_output_right_mixer_controls,
-                           ARRAY_SIZE(sun8i_output_right_mixer_controls)),
+        SND_SOC_DAPM_MIXER("Left Digital DAC Mixer", SND_SOC_NOPM, 0, 0,
+                           sun8i_dac_mixer_controls,
+                           ARRAY_SIZE(sun8i_dac_mixer_controls)),
+        SND_SOC_DAPM_MIXER("Right Digital DAC Mixer", SND_SOC_NOPM, 0, 0,
+                           sun8i_dac_mixer_controls,
+                           ARRAY_SIZE(sun8i_dac_mixer_controls)),
 
         /* Clocks */
         SND_SOC_DAPM_SUPPLY("MODCLK AFI1", SUN8I_MOD_CLK_ENA,
@@ -321,8 +318,6 @@ static const struct snd_soc_dapm_widget sun8i_codec_dapm_widgets[] = {
                             SUN8I_MOD_RST_CTL_AIF1, 0, NULL, 0),
         SND_SOC_DAPM_SUPPLY("RST DAC", SUN8I_MOD_RST_CTL,
                             SUN8I_MOD_RST_CTL_DAC, 0, NULL, 0),
-
-        SND_SOC_DAPM_OUTPUT("HP"),
 };
 
 static const struct snd_soc_dapm_route sun8i_codec_dapm_routes[] = {
@@ -338,16 +333,14 @@ static const struct snd_soc_dapm_route sun8i_codec_dapm_routes[] = {
         { "DAC", NULL, "MODCLK DAC" },
 
         /* DAC Routes */
-        { "Digital Left DAC", NULL, "DAC" },
-        { "Digital Right DAC", NULL, "DAC" },
+        { "AIF1 Slot 0 Right", NULL, "DAC" },
+        { "AIF1 Slot 0 Left", NULL, "DAC" },
 
         /* DAC Mixer Routes */
-        { "Left DAC Mixer", "LSlot 0", "Digital Left DAC"},
-        { "Right DAC Mixer", "RSlot 0", "Digital Right DAC"},
-
-        /* End of route : HP out */
-        { "HP", NULL, "Left DAC Mixer" },
-        { "HP", NULL, "Right DAC Mixer" },
+        { "Left Digital DAC Mixer", "AIF1 Slot 0 Digital DAC Playback Switch",
+          "AIF1 Slot 0 Left"},
+        { "Right Digital DAC Mixer", "AIF1 Slot 0 Digital DAC Playback Switch",
+          "AIF1 Slot 0 Right"},
 };
 
 static struct snd_soc_dai_ops sun8i_codec_dai_ops = {
diff --git a/sound/x86/Kconfig b/sound/x86/Kconfig
index 84c8f8fc597c..8adf4d1bd46e 100644
--- a/sound/x86/Kconfig
+++ b/sound/x86/Kconfig
@@ -1,6 +1,7 @@
 menuconfig SND_X86
-        tristate "X86 sound devices"
+        bool "X86 sound devices"
         depends on X86
+        default y
         ---help---
           X86 sound devices that don't fall under SoC or PCI categories
 
diff --git a/tools/include/uapi/linux/bpf_perf_event.h b/tools/include/uapi/linux/bpf_perf_event.h
new file mode 100644
index 000000000000..067427259820
--- /dev/null
+++ b/tools/include/uapi/linux/bpf_perf_event.h
@@ -0,0 +1,18 @@
+/* Copyright (c) 2016 Facebook
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ */
+#ifndef _UAPI__LINUX_BPF_PERF_EVENT_H__
+#define _UAPI__LINUX_BPF_PERF_EVENT_H__
+
+#include <linux/types.h>
+#include <linux/ptrace.h>
+
+struct bpf_perf_event_data {
+        struct pt_regs regs;
+        __u64 sample_period;
+};
+
+#endif /* _UAPI__LINUX_BPF_PERF_EVENT_H__ */
diff --git a/tools/lguest/lguest.c b/tools/lguest/lguest.c
index 11c8d9bc762e..5d19fdf80292 100644
--- a/tools/lguest/lguest.c
+++ b/tools/lguest/lguest.c
@@ -1387,7 +1387,7 @@ static bool pci_data_iowrite(u16 port, u32 mask, u32 val)
                 /* Allow writing to any other BAR, or expansion ROM */
                 iowrite(portoff, val, mask, &d->config_words[reg]);
                 return true;
-                /* We let them overide latency timer and cacheline size */
+                /* We let them override latency timer and cacheline size */
         } else if (&d->config_words[reg] == (void *)&d->config.cacheline_size) {
                 /* Only let them change the first two fields. */
                 if (mask == 0xFFFFFFFF)
diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
index e2efddf10231..1f5300e56b44 100644
--- a/tools/lib/bpf/Makefile
+++ b/tools/lib/bpf/Makefile
@@ -132,7 +132,7 @@ else
   Q = @
 endif
 
-# Disable command line variables (CFLAGS) overide from top
+# Disable command line variables (CFLAGS) override from top
 # level Makefile (perf), otherwise build Makefile will get
 # the same command line setup.
 MAKEOVERRIDES=
diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
index 47076b15eebe..9b8555ea3459 100644
--- a/tools/lib/traceevent/Makefile
+++ b/tools/lib/traceevent/Makefile
@@ -135,7 +135,7 @@ else
   Q = @
 endif
 
-# Disable command line variables (CFLAGS) overide from top
+# Disable command line variables (CFLAGS) override from top
 # level Makefile (perf), otherwise build Makefile will get
 # the same command line setup.
 MAKEOVERRIDES=
diff --git a/tools/lib/traceevent/event-parse.h b/tools/lib/traceevent/event-parse.h
index 66342804161c..0c03538df74c 100644
--- a/tools/lib/traceevent/event-parse.h
+++ b/tools/lib/traceevent/event-parse.h
@@ -140,7 +140,7 @@ struct pevent_plugin_option {
  *   struct pevent_plugin_option PEVENT_PLUGIN_OPTIONS[] = {
  *      {
  *              .name = "option-name",
- *              .plugin_alias = "overide-file-name", (optional)
+ *              .plugin_alias = "override-file-name", (optional)
  *              .description = "description of option to show users",
  *      },
  *      {
diff --git a/tools/objtool/builtin-check.c b/tools/objtool/builtin-check.c
index 4cfdbb5b6967..066086dd59a8 100644
--- a/tools/objtool/builtin-check.c
+++ b/tools/objtool/builtin-check.c
@@ -805,11 +805,20 @@ static struct rela *find_switch_table(struct objtool_file *file,
                      insn->jump_dest->offset > orig_insn->offset))
                     break;
 
+                /* look for a relocation which references .rodata */
                 text_rela = find_rela_by_dest_range(insn->sec, insn->offset,
                                                     insn->len);
-                if (text_rela && text_rela->sym == file->rodata->sym)
-                        return find_rela_by_dest(file->rodata,
-                                                 text_rela->addend);
+                if (!text_rela || text_rela->sym != file->rodata->sym)
+                        continue;
+
+                /*
+                 * Make sure the .rodata address isn't associated with a
+                 * symbol.  gcc jump tables are anonymous data.
+                 */
+                if (find_symbol_containing(file->rodata, text_rela->addend))
+                        continue;
+
+                return find_rela_by_dest(file->rodata, text_rela->addend);
         }
 
         return NULL;
diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index 0d7983ac63ef..d897702ce742 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -85,6 +85,18 @@ struct symbol *find_symbol_by_offset(struct section *sec, unsigned long offset)
         return NULL;
 }
 
+struct symbol *find_symbol_containing(struct section *sec, unsigned long offset)
+{
+        struct symbol *sym;
+
+        list_for_each_entry(sym, &sec->symbol_list, list)
+                if (sym->type != STT_SECTION &&
+                    offset >= sym->offset && offset < sym->offset + sym->len)
+                        return sym;
+
+        return NULL;
+}
+
 struct rela *find_rela_by_dest_range(struct section *sec, unsigned long offset,
                                      unsigned int len)
 {
diff --git a/tools/objtool/elf.h b/tools/objtool/elf.h
index aa1ff6596684..731973e1a3f5 100644
--- a/tools/objtool/elf.h
+++ b/tools/objtool/elf.h
@@ -79,6 +79,7 @@ struct elf {
 struct elf *elf_open(const char *name);
 struct section *find_section_by_name(struct elf *elf, const char *name);
 struct symbol *find_symbol_by_offset(struct section *sec, unsigned long offset);
+struct symbol *find_symbol_containing(struct section *sec, unsigned long offset);
 struct rela *find_rela_by_dest(struct section *sec, unsigned long offset);
 struct rela *find_rela_by_dest_range(struct section *sec, unsigned long offset,
                                      unsigned int len);
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c
index 7913363bde5c..4f3c758d875d 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c
@@ -31,7 +31,7 @@
 #error Instruction buffer size too small
 #endif
 
-/* Based on branch_type() from perf_event_intel_lbr.c */
+/* Based on branch_type() from arch/x86/events/intel/lbr.c */
 static void intel_pt_insn_decoder(struct insn *insn,
                                   struct intel_pt_insn *intel_pt_insn)
 {
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 70e389bc4af7..9b4d8ba22fed 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -202,7 +202,7 @@ void symbols__fixup_end(struct rb_root *symbols)
 
         /* Last entry */
         if (curr->end == curr->start)
-                curr->end = roundup(curr->start, 4096);
+                curr->end = roundup(curr->start, 4096) + 4096;
 }
 
 void __map_groups__fixup_end(struct map_groups *mg, enum map_type type)
diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
index 6e4eb2fc2d1e..0c8b61f8398e 100755
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -1880,6 +1880,7 @@ sub get_grub_index {
 sub wait_for_input
 {
     my ($fp, $time) = @_;
+    my $start_time;
     my $rin;
     my $rout;
     my $nr;
@@ -1895,17 +1896,22 @@ sub wait_for_input
     vec($rin, fileno($fp), 1) = 1;
     vec($rin, fileno(\*STDIN), 1) = 1;
 
+    $start_time = time;
+
     while (1) {
         $nr = select($rout=$rin, undef, undef, $time);
 
-        if ($nr <= 0) {
-            return undef;
-        }
+        last if ($nr <= 0);
 
         # copy data from stdin to the console
         if (vec($rout, fileno(\*STDIN), 1) == 1) {
-            sysread(\*STDIN, $buf, 1000);
-            syswrite($fp, $buf, 1000);
+            $nr = sysread(\*STDIN, $buf, 1000);
+            syswrite($fp, $buf, $nr) if ($nr > 0);
+        }
+
+        # The timeout is based on time waiting for the fp data
+        if (vec($rout, fileno($fp), 1) != 1) {
+            last if (defined($time) && (time - $start_time > $time));
             next;
         }
 
@@ -1917,12 +1923,11 @@ sub wait_for_input
             last if ($ch eq "\n");
         }
 
-        if (!length($line)) {
-            return undef;
-        }
+        last if (!length($line));
 
         return $line;
     }
+    return undef;
 }
 
 sub reboot_to {
diff --git a/tools/testing/radix-tree/Makefile b/tools/testing/radix-tree/Makefile
index f11315bedefc..6a9480c03cbd 100644
--- a/tools/testing/radix-tree/Makefile
+++ b/tools/testing/radix-tree/Makefile
@@ -1,6 +1,7 @@
 
 CFLAGS += -I. -I../../include -g -O2 -Wall -D_LGPL_SOURCE -fsanitize=address
-LDFLAGS += -lpthread -lurcu
+LDFLAGS += -fsanitize=address
+LDLIBS+= -lpthread -lurcu
 TARGETS = main idr-test multiorder
 CORE_OFILES := radix-tree.o idr.o linux.o test.o find_bit.o
 OFILES = main.o $(CORE_OFILES) regression1.o regression2.o regression3.o \
@@ -10,23 +11,25 @@ ifndef SHIFT
         SHIFT=3
 endif
 
+ifeq ($(BUILD), 32)
+        CFLAGS += -m32
+        LDFLAGS += -m32
+endif
+
 targets: mapshift $(TARGETS)
 
 main:   $(OFILES)
-        $(CC) $(CFLAGS) $(LDFLAGS) $^ -o main
 
 idr-test: idr-test.o $(CORE_OFILES)
-        $(CC) $(CFLAGS) $(LDFLAGS) $^ -o idr-test
 
 multiorder: multiorder.o $(CORE_OFILES)
-        $(CC) $(CFLAGS) $(LDFLAGS) $^ -o multiorder
 
 clean:
         $(RM) $(TARGETS) *.o radix-tree.c idr.c generated/map-shift.h
 
 vpath %.c ../../lib
 
-$(OFILES): *.h */*.h generated/map-shift.h \
+$(OFILES): Makefile *.h */*.h generated/map-shift.h \
         ../../include/linux/*.h \
         ../../include/asm/*.h \
         ../../../include/linux/radix-tree.h \
@@ -41,7 +44,7 @@ idr.c: ../../../lib/idr.c
 .PHONY: mapshift
 
 mapshift:
-        @if ! grep -qw $(SHIFT) generated/map-shift.h; then             \
+        @if ! grep -qws $(SHIFT) generated/map-shift.h; then            \
                 echo "#define RADIX_TREE_MAP_SHIFT $(SHIFT)" >          \
                                 generated/map-shift.h;                  \
         fi
diff --git a/tools/testing/radix-tree/benchmark.c b/tools/testing/radix-tree/benchmark.c
index 9b09ddfe462f..99c40f3ed133 100644
--- a/tools/testing/radix-tree/benchmark.c
+++ b/tools/testing/radix-tree/benchmark.c
@@ -17,6 +17,9 @@
 #include <time.h>
 #include "test.h"
 
+#define for_each_index(i, base, order) \
+                for (i = base; i < base + (1 << order); i++)
+
 #define NSEC_PER_SEC    1000000000L
 
 static long long benchmark_iter(struct radix_tree_root *root, bool tagged)
@@ -57,27 +60,176 @@ again:
         return nsec;
 }
 
+static void benchmark_insert(struct radix_tree_root *root,
+                             unsigned long size, unsigned long step, int order)
+{
+        struct timespec start, finish;
+        unsigned long index;
+        long long nsec;
+
+        clock_gettime(CLOCK_MONOTONIC, &start);
+
+        for (index = 0 ; index < size ; index += step)
+                item_insert_order(root, index, order);
+
+        clock_gettime(CLOCK_MONOTONIC, &finish);
+
+        nsec = (finish.tv_sec - start.tv_sec) * NSEC_PER_SEC +
+               (finish.tv_nsec - start.tv_nsec);
+
+        printv(2, "Size: %8ld, step: %8ld, order: %d, insertion: %15lld ns\n",
+                size, step, order, nsec);
+}
+
+static void benchmark_tagging(struct radix_tree_root *root,
+                             unsigned long size, unsigned long step, int order)
+{
+        struct timespec start, finish;
+        unsigned long index;
+        long long nsec;
+
+        clock_gettime(CLOCK_MONOTONIC, &start);
+
+        for (index = 0 ; index < size ; index += step)
+                radix_tree_tag_set(root, index, 0);
+
+        clock_gettime(CLOCK_MONOTONIC, &finish);
+
+        nsec = (finish.tv_sec - start.tv_sec) * NSEC_PER_SEC +
+               (finish.tv_nsec - start.tv_nsec);
+
+        printv(2, "Size: %8ld, step: %8ld, order: %d, tagging: %17lld ns\n",
+                size, step, order, nsec);
+}
+
+static void benchmark_delete(struct radix_tree_root *root,
+                             unsigned long size, unsigned long step, int order)
+{
+        struct timespec start, finish;
+        unsigned long index, i;
+        long long nsec;
+
+        clock_gettime(CLOCK_MONOTONIC, &start);
+
+        for (index = 0 ; index < size ; index += step)
+                for_each_index(i, index, order)
+                        item_delete(root, i);
+
+        clock_gettime(CLOCK_MONOTONIC, &finish);
+
+        nsec = (finish.tv_sec - start.tv_sec) * NSEC_PER_SEC +
+               (finish.tv_nsec - start.tv_nsec);
+
+        printv(2, "Size: %8ld, step: %8ld, order: %d, deletion: %16lld ns\n",
+                size, step, order, nsec);
+}
+
 static void benchmark_size(unsigned long size, unsigned long step, int order)
 {
         RADIX_TREE(tree, GFP_KERNEL);
         long long normal, tagged;
-        unsigned long index;
 
-        for (index = 0 ; index < size ; index += step) {
-                item_insert_order(&tree, index, order);
-                radix_tree_tag_set(&tree, index, 0);
-        }
+        benchmark_insert(&tree, size, step, order);
+        benchmark_tagging(&tree, size, step, order);
 
         tagged = benchmark_iter(&tree, true);
         normal = benchmark_iter(&tree, false);
 
-        printv(2, "Size %ld, step %6ld, order %d tagged %10lld ns, normal %10lld ns\n",
-                size, step, order, tagged, normal);
+        printv(2, "Size: %8ld, step: %8ld, order: %d, tagged iteration: %8lld ns\n",
+                size, step, order, tagged);
+        printv(2, "Size: %8ld, step: %8ld, order: %d, normal iteration: %8lld ns\n",
+                size, step, order, normal);
+
+        benchmark_delete(&tree, size, step, order);
 
         item_kill_tree(&tree);
         rcu_barrier();
 }
 
+static long long  __benchmark_split(unsigned long index,
+                                    int old_order, int new_order)
+{
+        struct timespec start, finish;
+        long long nsec;
+        RADIX_TREE(tree, GFP_ATOMIC);
+
+        item_insert_order(&tree, index, old_order);
+
+        clock_gettime(CLOCK_MONOTONIC, &start);
+        radix_tree_split(&tree, index, new_order);
+        clock_gettime(CLOCK_MONOTONIC, &finish);
+        nsec = (finish.tv_sec - start.tv_sec) * NSEC_PER_SEC +
+               (finish.tv_nsec - start.tv_nsec);
+
+        item_kill_tree(&tree);
+
+        return nsec;
+
+}
+
+static void benchmark_split(unsigned long size, unsigned long step)
+{
+        int i, j, idx;
+        long long nsec = 0;
+
+
+        for (idx = 0; idx < size; idx += step) {
+                for (i = 3; i < 11; i++) {
+                        for (j = 0; j < i; j++) {
+                                nsec += __benchmark_split(idx, i, j);
+                        }
+                }
+        }
+
+        printv(2, "Size %8ld, step %8ld, split time %10lld ns\n",
+                        size, step, nsec);
+
+}
+
+static long long  __benchmark_join(unsigned long index,
+                             unsigned order1, unsigned order2)
+{
+        unsigned long loc;
+        struct timespec start, finish;
+        long long nsec;
+        void *item, *item2 = item_create(index + 1, order1);
+        RADIX_TREE(tree, GFP_KERNEL);
+
+        item_insert_order(&tree, index, order2);
+        item = radix_tree_lookup(&tree, index);
+
+        clock_gettime(CLOCK_MONOTONIC, &start);
+        radix_tree_join(&tree, index + 1, order1, item2);
+        clock_gettime(CLOCK_MONOTONIC, &finish);
+        nsec = (finish.tv_sec - start.tv_sec) * NSEC_PER_SEC +
+                (finish.tv_nsec - start.tv_nsec);
+
+        loc = find_item(&tree, item);
+        if (loc == -1)
+                free(item);
+
+        item_kill_tree(&tree);
+
+        return nsec;
+}
+
+static void benchmark_join(unsigned long step)
+{
+        int i, j, idx;
+        long long nsec = 0;
+
+        for (idx = 0; idx < 1 << 10; idx += step) {
+                for (i = 1; i < 15; i++) {
+                        for (j = 0; j < i; j++) {
+                                nsec += __benchmark_join(idx, i, j);
+                        }
+                }
+        }
+
+        printv(2, "Size %8d, step %8ld, join time %10lld ns\n",
+                        1 << 10, step, nsec);
+}
+
 void benchmark(void)
 {
         unsigned long size[] = {1 << 10, 1 << 20, 0};
@@ -95,4 +247,11 @@ void benchmark(void)
         for (c = 0; size[c]; c++)
                 for (s = 0; step[s]; s++)
                         benchmark_size(size[c], step[s] << 9, 9);
+
+        for (c = 0; size[c]; c++)
+                for (s = 0; step[s]; s++)
+                        benchmark_split(size[c], step[s]);
+
+        for (s = 0; step[s]; s++)
+                benchmark_join(step[s]);
 }
diff --git a/tools/testing/radix-tree/idr-test.c b/tools/testing/radix-tree/idr-test.c
index a26098c6123d..30cd0b296f1a 100644
--- a/tools/testing/radix-tree/idr-test.c
+++ b/tools/testing/radix-tree/idr-test.c
@@ -153,6 +153,30 @@ void idr_nowait_test(void)
         idr_destroy(&idr);
 }
 
+void idr_get_next_test(void)
+{
+        unsigned long i;
+        int nextid;
+        DEFINE_IDR(idr);
+
+        int indices[] = {4, 7, 9, 15, 65, 128, 1000, 99999, 0};
+
+        for(i = 0; indices[i]; i++) {
+                struct item *item = item_create(indices[i], 0);
+                assert(idr_alloc(&idr, item, indices[i], indices[i+1],
+                                 GFP_KERNEL) == indices[i]);
+        }
+
+        for(i = 0, nextid = 0; indices[i]; i++) {
+                idr_get_next(&idr, &nextid);
+                assert(nextid == indices[i]);
+                nextid++;
+        }
+
+        idr_for_each(&idr, item_idr_free, &idr);
+        idr_destroy(&idr);
+}
+
 void idr_checks(void)
 {
         unsigned long i;
@@ -202,6 +226,7 @@ void idr_checks(void)
         idr_alloc_test();
         idr_null_test();
         idr_nowait_test();
+        idr_get_next_test();
 }
 
 /*
@@ -338,7 +363,7 @@ void ida_check_random(void)
 {
         DEFINE_IDA(ida);
         DECLARE_BITMAP(bitmap, 2048);
-        int id;
+        int id, err;
         unsigned int i;
         time_t s = time(NULL);
 
@@ -352,8 +377,11 @@ void ida_check_random(void)
                         ida_remove(&ida, bit);
                 } else {
                         __set_bit(bit, bitmap);
-                        ida_pre_get(&ida, GFP_KERNEL);
-                        assert(!ida_get_new_above(&ida, bit, &id));
+                        do {
+                                ida_pre_get(&ida, GFP_KERNEL);
+                                err = ida_get_new_above(&ida, bit, &id);
+                        } while (err == -ENOMEM);
+                        assert(!err);
                         assert(id == bit);
                 }
         }
@@ -362,6 +390,24 @@ void ida_check_random(void)
                 goto repeat;
 }
 
+void ida_simple_get_remove_test(void)
+{
+        DEFINE_IDA(ida);
+        unsigned long i;
+
+        for (i = 0; i < 10000; i++) {
+                assert(ida_simple_get(&ida, 0, 20000, GFP_KERNEL) == i);
+        }
+        assert(ida_simple_get(&ida, 5, 30, GFP_KERNEL) < 0);
+
+        for (i = 0; i < 10000; i++) {
+                ida_simple_remove(&ida, i);
+        }
+        assert(ida_is_empty(&ida));
+
+        ida_destroy(&ida);
+}
+
 void ida_checks(void)
 {
         DEFINE_IDA(ida);
@@ -428,15 +474,41 @@ void ida_checks(void)
         ida_check_max();
         ida_check_conv();
         ida_check_random();
+        ida_simple_get_remove_test();
 
         radix_tree_cpu_dead(1);
 }
 
+static void *ida_random_fn(void *arg)
+{
+        rcu_register_thread();
+        ida_check_random();
+        rcu_unregister_thread();
+        return NULL;
+}
+
+void ida_thread_tests(void)
+{
+        pthread_t threads[10];
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(threads); i++)
+                if (pthread_create(&threads[i], NULL, ida_random_fn, NULL)) {
+                        perror("creating ida thread");
+                        exit(1);
+                }
+
+        while (i--)
+                pthread_join(threads[i], NULL);
+}
+
 int __weak main(void)
 {
         radix_tree_init();
         idr_checks();
         ida_checks();
+        ida_thread_tests();
+        radix_tree_cpu_dead(1);
         rcu_barrier();
         if (nr_allocated)
                 printf("nr_allocated = %d\n", nr_allocated);
diff --git a/tools/testing/radix-tree/main.c b/tools/testing/radix-tree/main.c
index b829127d5670..bc9a78449572 100644
--- a/tools/testing/radix-tree/main.c
+++ b/tools/testing/radix-tree/main.c
@@ -368,6 +368,7 @@ int main(int argc, char **argv)
         iteration_test(0, 10 + 90 * long_run);
         iteration_test(7, 10 + 90 * long_run);
         single_thread_tests(long_run);
+        ida_thread_tests();
 
         /* Free any remaining preallocated nodes */
         radix_tree_cpu_dead(0);
diff --git a/tools/testing/radix-tree/tag_check.c b/tools/testing/radix-tree/tag_check.c
index d4ff00989245..36dcf7d6945d 100644
--- a/tools/testing/radix-tree/tag_check.c
+++ b/tools/testing/radix-tree/tag_check.c
@@ -330,6 +330,34 @@ static void single_check(void)
         item_kill_tree(&tree);
 }
 
+void radix_tree_clear_tags_test(void)
+{
+        unsigned long index;
+        struct radix_tree_node *node;
+        struct radix_tree_iter iter;
+        void **slot;
+
+        RADIX_TREE(tree, GFP_KERNEL);
+
+        item_insert(&tree, 0);
+        item_tag_set(&tree, 0, 0);
+        __radix_tree_lookup(&tree, 0, &node, &slot);
+        radix_tree_clear_tags(&tree, node, slot);
+        assert(item_tag_get(&tree, 0, 0) == 0);
+
+        for (index = 0; index < 1000; index++) {
+                item_insert(&tree, index);
+                item_tag_set(&tree, index, 0);
+        }
+
+        radix_tree_for_each_slot(slot, &tree, &iter, 0) {
+                radix_tree_clear_tags(&tree, iter.node, slot);
+                assert(item_tag_get(&tree, iter.index, 0) == 0);
+        }
+
+        item_kill_tree(&tree);
+}
+
 void tag_check(void)
 {
         single_check();
@@ -347,4 +375,5 @@ void tag_check(void)
         thrash_tags();
         rcu_barrier();
         printv(2, "after thrash_tags: %d allocated\n", nr_allocated);
+        radix_tree_clear_tags_test();
 }
diff --git a/tools/testing/radix-tree/test.h b/tools/testing/radix-tree/test.h
index b30e11d9d271..0f8220cc6166 100644
--- a/tools/testing/radix-tree/test.h
+++ b/tools/testing/radix-tree/test.h
@@ -36,6 +36,7 @@ void iteration_test(unsigned order, unsigned duration);
 void benchmark(void);
 void idr_checks(void);
 void ida_checks(void);
+void ida_thread_tests(void);
 
 struct item *
 item_tag_set(struct radix_tree_root *root, unsigned long index, int tag);
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 4b498265dae6..6a1ad58cb66f 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -1,20 +1,23 @@
 LIBDIR := ../../../lib
-BPFOBJ := $(LIBDIR)/bpf/bpf.o
+BPFDIR := $(LIBDIR)/bpf
 
-CFLAGS += -Wall -O2 -lcap -I../../../include/uapi -I$(LIBDIR)
+CFLAGS += -Wall -O2 -I../../../include/uapi -I$(LIBDIR)
+LDLIBS += -lcap
 
 TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map
 
 TEST_PROGS := test_kmod.sh
 
-.PHONY: all clean force
+include ../lib.mk
+
+BPFOBJ := $(OUTPUT)/bpf.o
+
+$(TEST_GEN_PROGS): $(BPFOBJ)
+
+.PHONY: force
 
 # force a rebuild of BPFOBJ when its dependencies are updated
 force:
 
 $(BPFOBJ): force
-        $(MAKE) -C $(dir $(BPFOBJ))
-
-$(test_objs): $(BPFOBJ)
-
-include ../lib.mk
+        $(MAKE) -C $(BPFDIR) OUTPUT=$(OUTPUT)/
diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
index cada17ac00b8..a0aa2009b0e0 100644
--- a/tools/testing/selftests/bpf/test_maps.c
+++ b/tools/testing/selftests/bpf/test_maps.c
@@ -80,8 +80,9 @@ static void test_hashmap(int task, void *data)
         assert(bpf_map_update_elem(fd, &key, &value, BPF_EXIST) == 0);
         key = 2;
         assert(bpf_map_update_elem(fd, &key, &value, BPF_ANY) == 0);
-        key = 1;
-        assert(bpf_map_update_elem(fd, &key, &value, BPF_ANY) == 0);
+        key = 3;
+        assert(bpf_map_update_elem(fd, &key, &value, BPF_NOEXIST) == -1 &&
+               errno == E2BIG);
 
         /* Check that key = 0 doesn't exist. */
         key = 0;
@@ -110,6 +111,24 @@ static void test_hashmap(int task, void *data)
         close(fd);
 }
 
+static void test_hashmap_sizes(int task, void *data)
+{
+        int fd, i, j;
+
+        for (i = 1; i <= 512; i <<= 1)
+                for (j = 1; j <= 1 << 18; j <<= 1) {
+                        fd = bpf_create_map(BPF_MAP_TYPE_HASH, i, j,
+                                            2, map_flags);
+                        if (fd < 0) {
+                                printf("Failed to create hashmap key=%d value=%d '%s'\n",
+                                       i, j, strerror(errno));
+                                exit(1);
+                        }
+                        close(fd);
+                        usleep(10); /* give kernel time to destroy */
+                }
+}
+
 static void test_hashmap_percpu(int task, void *data)
 {
         unsigned int nr_cpus = bpf_num_possible_cpus();
@@ -317,7 +336,10 @@ static void test_arraymap_percpu(int task, void *data)
 static void test_arraymap_percpu_many_keys(void)
 {
         unsigned int nr_cpus = bpf_num_possible_cpus();
-        unsigned int nr_keys = 20000;
+        /* nr_keys is not too large otherwise the test stresses percpu
+         * allocator more than anything else
+         */
+        unsigned int nr_keys = 2000;
         long values[nr_cpus];
         int key, fd, i;
 
@@ -419,6 +441,7 @@ static void test_map_stress(void)
 {
         run_parallel(100, test_hashmap, NULL);
         run_parallel(100, test_hashmap_percpu, NULL);
+        run_parallel(100, test_hashmap_sizes, NULL);
 
         run_parallel(100, test_arraymap, NULL);
         run_parallel(100, test_arraymap_percpu, NULL);
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index e1f5b9eea1e8..d1555e4240c0 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -8,6 +8,8 @@
  * License as published by the Free Software Foundation.
  */
 
+#include <asm/types.h>
+#include <linux/types.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -4583,10 +4585,12 @@ static bool is_admin(void)
         cap_flag_value_t sysadmin = CAP_CLEAR;
         const cap_value_t cap_val = CAP_SYS_ADMIN;
 
+#ifdef CAP_IS_SUPPORTED
         if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
                 perror("cap_get_flag");
                 return false;
         }
+#endif
         caps = cap_get_proc();
         if (!caps) {
                 perror("cap_get_proc");
diff --git a/tools/testing/selftests/powerpc/harness.c b/tools/testing/selftests/powerpc/harness.c
index 248a820048df..66d31de60b9a 100644
--- a/tools/testing/selftests/powerpc/harness.c
+++ b/tools/testing/selftests/powerpc/harness.c
@@ -114,9 +114,11 @@ int test_harness(int (test_function)(void), char *name)
 
         rc = run_test(test_function, name);
 
-        if (rc == MAGIC_SKIP_RETURN_VALUE)
+        if (rc == MAGIC_SKIP_RETURN_VALUE) {
                 test_skip(name);
-        else
+                /* so that skipped test is not marked as failed */
+                rc = 0;
+        } else
                 test_finish(name, rc);
 
         return rc;
diff --git a/tools/testing/selftests/powerpc/include/vsx_asm.h b/tools/testing/selftests/powerpc/include/vsx_asm.h
index d828bfb6ef2d..54064ced9e95 100644
--- a/tools/testing/selftests/powerpc/include/vsx_asm.h
+++ b/tools/testing/selftests/powerpc/include/vsx_asm.h
@@ -16,56 +16,56 @@
  */
 FUNC_START(load_vsx)
         li      r5,0
-        lxvx    vs20,r5,r3
+        lxvd2x  vs20,r5,r3
         addi    r5,r5,16
-        lxvx    vs21,r5,r3
+        lxvd2x  vs21,r5,r3
         addi    r5,r5,16
-        lxvx    vs22,r5,r3
+        lxvd2x  vs22,r5,r3
         addi    r5,r5,16
-        lxvx    vs23,r5,r3
+        lxvd2x  vs23,r5,r3
         addi    r5,r5,16
-        lxvx    vs24,r5,r3
+        lxvd2x  vs24,r5,r3
         addi    r5,r5,16
-        lxvx    vs25,r5,r3
+        lxvd2x  vs25,r5,r3
         addi    r5,r5,16
-        lxvx    vs26,r5,r3
+        lxvd2x  vs26,r5,r3
         addi    r5,r5,16
-        lxvx    vs27,r5,r3
+        lxvd2x  vs27,r5,r3
         addi    r5,r5,16
-        lxvx    vs28,r5,r3
+        lxvd2x  vs28,r5,r3
         addi    r5,r5,16
-        lxvx    vs29,r5,r3
+        lxvd2x  vs29,r5,r3
         addi    r5,r5,16
-        lxvx    vs30,r5,r3
+        lxvd2x  vs30,r5,r3
         addi    r5,r5,16
-        lxvx    vs31,r5,r3
+        lxvd2x  vs31,r5,r3
         blr
 FUNC_END(load_vsx)
 
 FUNC_START(store_vsx)
         li      r5,0
-        stxvx   vs20,r5,r3
+        stxvd2x vs20,r5,r3
         addi    r5,r5,16
-        stxvx   vs21,r5,r3
+        stxvd2x vs21,r5,r3
         addi    r5,r5,16
-        stxvx   vs22,r5,r3
+        stxvd2x vs22,r5,r3
         addi    r5,r5,16
-        stxvx   vs23,r5,r3
+        stxvd2x vs23,r5,r3
         addi    r5,r5,16
-        stxvx   vs24,r5,r3
+        stxvd2x vs24,r5,r3
         addi    r5,r5,16
-        stxvx   vs25,r5,r3
+        stxvd2x vs25,r5,r3
         addi    r5,r5,16
-        stxvx   vs26,r5,r3
+        stxvd2x vs26,r5,r3
         addi    r5,r5,16
-        stxvx   vs27,r5,r3
+        stxvd2x vs27,r5,r3
         addi    r5,r5,16
-        stxvx   vs28,r5,r3
+        stxvd2x vs28,r5,r3
         addi    r5,r5,16
-        stxvx   vs29,r5,r3
+        stxvd2x vs29,r5,r3
         addi    r5,r5,16
-        stxvx   vs30,r5,r3
+        stxvd2x vs30,r5,r3
         addi    r5,r5,16
-        stxvx   vs31,r5,r3
+        stxvd2x vs31,r5,r3
         blr
 FUNC_END(store_vsx)
diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
index 4cff7e7ddcc4..41642ba5e318 100644
--- a/tools/testing/selftests/vm/Makefile
+++ b/tools/testing/selftests/vm/Makefile
@@ -1,5 +1,9 @@
 # Makefile for vm selftests
 
+ifndef OUTPUT
+  OUTPUT := $(shell pwd)
+endif
+
 CFLAGS = -Wall -I ../../../../usr/include $(EXTRA_CFLAGS)
 LDLIBS = -lrt
 TEST_GEN_FILES = compaction_test
diff --git a/tools/testing/selftests/x86/fsgsbase.c b/tools/testing/selftests/x86/fsgsbase.c
index 5b2b4b3c634c..b4967d875236 100644
--- a/tools/testing/selftests/x86/fsgsbase.c
+++ b/tools/testing/selftests/x86/fsgsbase.c
@@ -245,7 +245,7 @@ void do_unexpected_base(void)
                 long ret;
                 asm volatile ("int $0x80"
                               : "=a" (ret) : "a" (243), "b" (low_desc)
-                              : "flags");
+                              : "r8", "r9", "r10", "r11");
                 memcpy(&desc, low_desc, sizeof(desc));
                 munmap(low_desc, sizeof(desc));
 
diff --git a/tools/testing/selftests/x86/ldt_gdt.c b/tools/testing/selftests/x86/ldt_gdt.c
index 4af47079cf04..f6121612e769 100644
--- a/tools/testing/selftests/x86/ldt_gdt.c
+++ b/tools/testing/selftests/x86/ldt_gdt.c
@@ -45,6 +45,12 @@
 #define AR_DB                   (1 << 22)
 #define AR_G                    (1 << 23)
 
+#ifdef __x86_64__
+# define INT80_CLOBBERS "r8", "r9", "r10", "r11"
+#else
+# define INT80_CLOBBERS
+#endif
+
 static int nerrs;
 
 /* Points to an array of 1024 ints, each holding its own index. */
@@ -588,7 +594,7 @@ static int invoke_set_thread_area(void)
         asm volatile ("int $0x80"
                       : "=a" (ret), "+m" (low_user_desc) :
                         "a" (243), "b" (low_user_desc)
-                      : "flags");
+                      : INT80_CLOBBERS);
         return ret;
 }
 
@@ -657,7 +663,7 @@ static void test_gdt_invalidation(void)
                         "+a" (eax)
                       : "m" (low_user_desc_clear),
                         [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
-                      : "flags");
+                      : INT80_CLOBBERS);
 
         if (sel != 0) {
                 result = "FAIL";
@@ -688,7 +694,7 @@ static void test_gdt_invalidation(void)
                         "+a" (eax)
                       : "m" (low_user_desc_clear),
                         [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
-                      : "flags");
+                      : INT80_CLOBBERS);
 
         if (sel != 0) {
                 result = "FAIL";
@@ -721,7 +727,7 @@ static void test_gdt_invalidation(void)
                         "+a" (eax)
                       : "m" (low_user_desc_clear),
                         [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
-                      : "flags");
+                      : INT80_CLOBBERS);
 
 #ifdef __x86_64__
         syscall(SYS_arch_prctl, ARCH_GET_FS, &new_base);
@@ -774,7 +780,7 @@ static void test_gdt_invalidation(void)
                         "+a" (eax)
                       : "m" (low_user_desc_clear),
                         [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
-                      : "flags");
+                      : INT80_CLOBBERS);
 
 #ifdef __x86_64__
         syscall(SYS_arch_prctl, ARCH_GET_GS, &new_base);
diff --git a/tools/testing/selftests/x86/ptrace_syscall.c b/tools/testing/selftests/x86/ptrace_syscall.c
index b037ce9cf116..eaea92439708 100644
--- a/tools/testing/selftests/x86/ptrace_syscall.c
+++ b/tools/testing/selftests/x86/ptrace_syscall.c
@@ -58,7 +58,8 @@ static void do_full_int80(struct syscall_args32 *args)
         asm volatile ("int $0x80"
                       : "+a" (args->nr),
                         "+b" (args->arg0), "+c" (args->arg1), "+d" (args->arg2),
-                        "+S" (args->arg3), "+D" (args->arg4), "+r" (bp));
+                        "+S" (args->arg3), "+D" (args->arg4), "+r" (bp)
+                        : : "r8", "r9", "r10", "r11");
         args->arg5 = bp;
 #else
         sys32_helper(args, int80_and_ret);
diff --git a/tools/testing/selftests/x86/single_step_syscall.c b/tools/testing/selftests/x86/single_step_syscall.c
index 50c26358e8b7..a48da95c18fd 100644
--- a/tools/testing/selftests/x86/single_step_syscall.c
+++ b/tools/testing/selftests/x86/single_step_syscall.c
@@ -56,9 +56,11 @@ static volatile sig_atomic_t sig_traps;
 #ifdef __x86_64__
 # define REG_IP REG_RIP
 # define WIDTH "q"
+# define INT80_CLOBBERS "r8", "r9", "r10", "r11"
 #else
 # define REG_IP REG_EIP
 # define WIDTH "l"
+# define INT80_CLOBBERS
 #endif
 
 static unsigned long get_eflags(void)
@@ -140,7 +142,8 @@ int main()
 
         printf("[RUN]\tSet TF and check int80\n");
         set_eflags(get_eflags() | X86_EFLAGS_TF);
-        asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid));
+        asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)
+                        : INT80_CLOBBERS);
         check_result();
 
         /*
diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
index 571b64a01c50..8d1da1af4b09 100644
--- a/virt/kvm/arm/vgic/vgic-its.c
+++ b/virt/kvm/arm/vgic/vgic-its.c
@@ -360,29 +360,6 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu)
         return ret;
 }
 
-static unsigned long vgic_mmio_read_its_ctlr(struct kvm *vcpu,
-                                             struct vgic_its *its,
-                                             gpa_t addr, unsigned int len)
-{
-        u32 reg = 0;
-
-        mutex_lock(&its->cmd_lock);
-        if (its->creadr == its->cwriter)
-                reg |= GITS_CTLR_QUIESCENT;
-        if (its->enabled)
-                reg |= GITS_CTLR_ENABLE;
-        mutex_unlock(&its->cmd_lock);
-
-        return reg;
-}
-
-static void vgic_mmio_write_its_ctlr(struct kvm *kvm, struct vgic_its *its,
-                                     gpa_t addr, unsigned int len,
-                                     unsigned long val)
-{
-        its->enabled = !!(val & GITS_CTLR_ENABLE);
-}
-
 static unsigned long vgic_mmio_read_its_typer(struct kvm *kvm,
                                               struct vgic_its *its,
                                               gpa_t addr, unsigned int len)
@@ -1161,33 +1138,16 @@ static void vgic_mmio_write_its_cbaser(struct kvm *kvm, struct vgic_its *its,
 #define ITS_CMD_SIZE                    32
 #define ITS_CMD_OFFSET(reg)             ((reg) & GENMASK(19, 5))
 
-/*
- * By writing to CWRITER the guest announces new commands to be processed.
- * To avoid any races in the first place, we take the its_cmd lock, which
- * protects our ring buffer variables, so that there is only one user
- * per ITS handling commands at a given time.
- */
-static void vgic_mmio_write_its_cwriter(struct kvm *kvm, struct vgic_its *its,
-                                        gpa_t addr, unsigned int len,
-                                        unsigned long val)
+/* Must be called with the cmd_lock held. */
+static void vgic_its_process_commands(struct kvm *kvm, struct vgic_its *its)
 {
         gpa_t cbaser;
         u64 cmd_buf[4];
-        u32 reg;
 
-        if (!its)
-                return;
-
-        mutex_lock(&its->cmd_lock);
-
-        reg = update_64bit_reg(its->cwriter, addr & 7, len, val);
-        reg = ITS_CMD_OFFSET(reg);
-        if (reg >= ITS_CMD_BUFFER_SIZE(its->cbaser)) {
-                mutex_unlock(&its->cmd_lock);
+        /* Commands are only processed when the ITS is enabled. */
+        if (!its->enabled)
                 return;
-        }
 
-        its->cwriter = reg;
         cbaser = CBASER_ADDRESS(its->cbaser);
 
         while (its->cwriter != its->creadr) {
@@ -1207,6 +1167,34 @@ static void vgic_mmio_write_its_cwriter(struct kvm *kvm, struct vgic_its *its,
                 if (its->creadr == ITS_CMD_BUFFER_SIZE(its->cbaser))
                         its->creadr = 0;
         }
+}
+
+/*
+ * By writing to CWRITER the guest announces new commands to be processed.
+ * To avoid any races in the first place, we take the its_cmd lock, which
+ * protects our ring buffer variables, so that there is only one user
+ * per ITS handling commands at a given time.
+ */
+static void vgic_mmio_write_its_cwriter(struct kvm *kvm, struct vgic_its *its,
+                                        gpa_t addr, unsigned int len,
+                                        unsigned long val)
+{
+        u64 reg;
+
+        if (!its)
+                return;
+
+        mutex_lock(&its->cmd_lock);
+
+        reg = update_64bit_reg(its->cwriter, addr & 7, len, val);
+        reg = ITS_CMD_OFFSET(reg);
+        if (reg >= ITS_CMD_BUFFER_SIZE(its->cbaser)) {
+                mutex_unlock(&its->cmd_lock);
+                return;
+        }
+        its->cwriter = reg;
+
+        vgic_its_process_commands(kvm, its);
 
         mutex_unlock(&its->cmd_lock);
 }
@@ -1287,6 +1275,39 @@ static void vgic_mmio_write_its_baser(struct kvm *kvm,
         *regptr = reg;
 }
 
+static unsigned long vgic_mmio_read_its_ctlr(struct kvm *vcpu,
+                                             struct vgic_its *its,
+                                             gpa_t addr, unsigned int len)
+{
+        u32 reg = 0;
+
+        mutex_lock(&its->cmd_lock);
+        if (its->creadr == its->cwriter)
+                reg |= GITS_CTLR_QUIESCENT;
+        if (its->enabled)
+                reg |= GITS_CTLR_ENABLE;
+        mutex_unlock(&its->cmd_lock);
+
+        return reg;
+}
+
+static void vgic_mmio_write_its_ctlr(struct kvm *kvm, struct vgic_its *its,
+                                     gpa_t addr, unsigned int len,
+                                     unsigned long val)
+{
+        mutex_lock(&its->cmd_lock);
+
+        its->enabled = !!(val & GITS_CTLR_ENABLE);
+
+        /*
+         * Try to process any pending commands. This function bails out early
+         * if the ITS is disabled or no commands have been queued.
+         */
+        vgic_its_process_commands(kvm, its);
+
+        mutex_unlock(&its->cmd_lock);
+}
+
 #define REGISTER_ITS_DESC(off, rd, wr, length, acc)             \
 {                                                               \
         .reg_offset = off,                                      \
diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
index 3654b4c835ef..2a5db1352722 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -180,21 +180,37 @@ unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu,
 static void vgic_mmio_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
                                     bool new_active_state)
 {
+        struct kvm_vcpu *requester_vcpu;
         spin_lock(&irq->irq_lock);
+
+        /*
+         * The vcpu parameter here can mean multiple things depending on how
+         * this function is called; when handling a trap from the kernel it
+         * depends on the GIC version, and these functions are also called as
+         * part of save/restore from userspace.
+         *
+         * Therefore, we have to figure out the requester in a reliable way.
+         *
+         * When accessing VGIC state from user space, the requester_vcpu is
+         * NULL, which is fine, because we guarantee that no VCPUs are running
+         * when accessing VGIC state from user space so irq->vcpu->cpu is
+         * always -1.
+         */
+        requester_vcpu = kvm_arm_get_running_vcpu();
+
         /*
          * If this virtual IRQ was written into a list register, we
          * have to make sure the CPU that runs the VCPU thread has
-         * synced back LR state to the struct vgic_irq.  We can only
-         * know this for sure, when either this irq is not assigned to
-         * anyone's AP list anymore, or the VCPU thread is not
-         * running on any CPUs.
+         * synced back the LR state to the struct vgic_irq.
          *
-         * In the opposite case, we know the VCPU thread may be on its
-         * way back from the guest and still has to sync back this
-         * IRQ, so we release and re-acquire the spin_lock to let the
-         * other thread sync back the IRQ.
+         * As long as the conditions below are true, we know the VCPU thread
+         * may be on its way back from the guest (we kicked the VCPU thread in
+         * vgic_change_active_prepare)  and still has to sync back this IRQ,
+         * so we release and re-acquire the spin_lock to let the other thread
+         * sync back the IRQ.
          */
         while (irq->vcpu && /* IRQ may have state in an LR somewhere */
+               irq->vcpu != requester_vcpu && /* Current thread is not the VCPU thread */
                irq->vcpu->cpu != -1) /* VCPU thread is running */
                 cond_resched_lock(&irq->irq_lock);
 
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index edc6ee2dc852..be0f4c3e0142 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -229,10 +229,13 @@ void vgic_v3_enable(struct kvm_vcpu *vcpu)
         /*
          * If we are emulating a GICv3, we do it in an non-GICv2-compatible
          * way, so we force SRE to 1 to demonstrate this to the guest.
+         * Also, we don't support any form of IRQ/FIQ bypass.
          * This goes with the spec allowing the value to be RAO/WI.
          */
         if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) {
-                vgic_v3->vgic_sre = ICC_SRE_EL1_SRE;
+                vgic_v3->vgic_sre = (ICC_SRE_EL1_DIB |
+                                     ICC_SRE_EL1_DFB |
+                                     ICC_SRE_EL1_SRE);
                 vcpu->arch.vgic_cpu.pendbaser = INITIAL_PENDBASER_VALUE;
         } else {
                 vgic_v3->vgic_sre = 0;
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index a29786dd9522..4d28a9ddbee0 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -870,7 +870,8 @@ kvm_deassign_ioeventfd_idx(struct kvm *kvm, enum kvm_bus bus_idx,
                         continue;
 
                 kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev);
-                kvm->buses[bus_idx]->ioeventfd_count--;
+                if (kvm->buses[bus_idx])
+                        kvm->buses[bus_idx]->ioeventfd_count--;
                 ioeventfd_release(p);
                 ret = 0;
                 break;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index a17d78759727..88257b311cb5 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -727,8 +727,11 @@ static void kvm_destroy_vm(struct kvm *kvm)
         list_del(&kvm->vm_list);
         spin_unlock(&kvm_lock);
         kvm_free_irq_routing(kvm);
-        for (i = 0; i < KVM_NR_BUSES; i++)
-                kvm_io_bus_destroy(kvm->buses[i]);
+        for (i = 0; i < KVM_NR_BUSES; i++) {
+                if (kvm->buses[i])
+                        kvm_io_bus_destroy(kvm->buses[i]);
+                kvm->buses[i] = NULL;
+        }
         kvm_coalesced_mmio_free(kvm);
 #if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
         mmu_notifier_unregister(&kvm->mmu_notifier, kvm->mm);
@@ -1062,7 +1065,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
          * changes) is disallowed above, so any other attribute changes getting
          * here can be skipped.
          */
-        if ((change == KVM_MR_CREATE) || (change == KVM_MR_MOVE)) {
+        if (as_id == 0 && (change == KVM_MR_CREATE || change == KVM_MR_MOVE)) {
                 r = kvm_iommu_map_pages(kvm, &new);
                 return r;
         }
@@ -3474,6 +3477,8 @@ int kvm_io_bus_write(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
         };
 
         bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
+        if (!bus)
+                return -ENOMEM;
         r = __kvm_io_bus_write(vcpu, bus, &range, val);
         return r < 0 ? r : 0;
 }
@@ -3491,6 +3496,8 @@ int kvm_io_bus_write_cookie(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx,
         };
 
         bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
+        if (!bus)
+                return -ENOMEM;
 
         /* First try the device referenced by cookie. */
         if ((cookie >= 0) && (cookie < bus->dev_count) &&
@@ -3541,6 +3548,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
         };
 
         bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
+        if (!bus)
+                return -ENOMEM;
         r = __kvm_io_bus_read(vcpu, bus, &range, val);
         return r < 0 ? r : 0;
 }
@@ -3553,6 +3562,9 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
         struct kvm_io_bus *new_bus, *bus;
 
         bus = kvm->buses[bus_idx];
+        if (!bus)
+                return -ENOMEM;
+
         /* exclude ioeventfd which is limited by maximum fd */
         if (bus->dev_count - bus->ioeventfd_count > NR_IOBUS_DEVS - 1)
                 return -ENOSPC;
@@ -3572,37 +3584,41 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
 }
 
 /* Caller must hold slots_lock. */
-int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
-                              struct kvm_io_device *dev)
+void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+                               struct kvm_io_device *dev)
 {
-        int i, r;
+        int i;
         struct kvm_io_bus *new_bus, *bus;
 
         bus = kvm->buses[bus_idx];
-        r = -ENOENT;
+        if (!bus)
+                return;
+
         for (i = 0; i < bus->dev_count; i++)
                 if (bus->range[i].dev == dev) {
-                        r = 0;
                         break;
                 }
 
-        if (r)
-                return r;
+        if (i == bus->dev_count)
+                return;
 
         new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) *
                           sizeof(struct kvm_io_range)), GFP_KERNEL);
-        if (!new_bus)
-                return -ENOMEM;
+        if (!new_bus)  {
+                pr_err("kvm: failed to shrink bus, removing it completely\n");
+                goto broken;
+        }
 
         memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
         new_bus->dev_count--;
         memcpy(new_bus->range + i, bus->range + i + 1,
                (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
 
+broken:
         rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
         synchronize_srcu_expedited(&kvm->srcu);
         kfree(bus);
-        return r;
+        return;
 }
 
 struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
@@ -3615,6 +3631,8 @@ struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
         srcu_idx = srcu_read_lock(&kvm->srcu);
 
         bus = srcu_dereference(kvm->buses[bus_idx], &kvm->srcu);
+        if (!bus)
+                goto out_unlock;
 
         dev_idx = kvm_io_bus_get_first_dev(bus, addr, 1);
         if (dev_idx < 0)