838 files changed, 7735 insertions, 4534 deletions

diff --git a/.mailmap b/.mailmap
index 2a91c14c80bf..de22daefd9da 100644
--- a/.mailmap
+++ b/.mailmap
@@ -88,6 +88,7 @@ Kay Sievers <kay.sievers@vrfy.org>
 Kenneth W Chen <kenneth.w.chen@intel.com>
 Konstantin Khlebnikov <koct9i@gmail.com> <k.khlebnikov@samsung.com>
 Koushik <raghavendra.koushik@neterion.com>
+Krzysztof Kozlowski <krzk@kernel.org> <k.kozlowski@samsung.com>
 Krzysztof Kozlowski <krzk@kernel.org> <k.kozlowski.k@gmail.com>
 Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
 Leonid I Ananiev <leonid.i.ananiev@intel.com>
@@ -158,6 +159,8 @@ Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
 Viresh Kumar <vireshk@kernel.org> <viresh.kumar@st.com>
 Viresh Kumar <vireshk@kernel.org> <viresh.linux@gmail.com>
 Viresh Kumar <vireshk@kernel.org> <viresh.kumar2@arm.com>
+Vladimir Davydov <vdavydov.dev@gmail.com> <vdavydov@virtuozzo.com>
+Vladimir Davydov <vdavydov.dev@gmail.com> <vdavydov@parallels.com>
 Takashi YOSHII <takashi.yoshii.zj@renesas.com>
 Yusuke Goda <goda.yusuke@renesas.com>
 Gustavo Padovan <gustavo@las.ic.unicamp.br>
diff --git a/Documentation/ABI/stable/sysfs-devices b/Documentation/ABI/stable/sysfs-devices
index 43f78b88da28..df449d79b563 100644
--- a/Documentation/ABI/stable/sysfs-devices
+++ b/Documentation/ABI/stable/sysfs-devices
@@ -1,7 +1,7 @@
 # Note: This documents additional properties of any device beyond what
 # is documented in Documentation/sysfs-rules.txt
 
-What:           /sys/devices/*/of_path
+What:           /sys/devices/*/of_node
 Date:           February 2015
 Contact:        Device Tree mailing list <devicetree@vger.kernel.org>
 Description:
diff --git a/Documentation/PCI/MSI-HOWTO.txt b/Documentation/PCI/MSI-HOWTO.txt
index c55df2911136..cd9c9f6a7cd9 100644
--- a/Documentation/PCI/MSI-HOWTO.txt
+++ b/Documentation/PCI/MSI-HOWTO.txt
@@ -94,14 +94,11 @@ has a requirements for a minimum number of vectors the driver can pass a
 min_vecs argument set to this limit, and the PCI core will return -ENOSPC
 if it can't meet the minimum number of vectors.
 
-The flags argument should normally be set to 0, but can be used to pass the
-PCI_IRQ_NOMSI and PCI_IRQ_NOMSIX flag in case a device claims to support
-MSI or MSI-X, but the support is broken, or to pass PCI_IRQ_NOLEGACY in
-case the device does not support legacy interrupt lines.
-
-By default this function will spread the interrupts around the available
-CPUs, but this feature can be disabled by passing the PCI_IRQ_NOAFFINITY
-flag.
+The flags argument is used to specify which type of interrupt can be used
+by the device and the driver (PCI_IRQ_LEGACY, PCI_IRQ_MSI, PCI_IRQ_MSIX).
+A convenient short-hand (PCI_IRQ_ALL_TYPES) is also available to ask for
+any possible kind of interrupt.  If the PCI_IRQ_AFFINITY flag is set,
+pci_alloc_irq_vectors() will spread the interrupts around the available CPUs.
 
 To get the Linux IRQ numbers passed to request_irq() and free_irq() and the
 vectors, use the following function:
@@ -131,7 +128,7 @@ larger than the number supported by the device it will automatically be
 capped to the supported limit, so there is no need to query the number of
 vectors supported beforehand:
 
-        nvec = pci_alloc_irq_vectors(pdev, 1, nvec, 0);
+        nvec = pci_alloc_irq_vectors(pdev, 1, nvec, PCI_IRQ_ALL_TYPES)
         if (nvec < 0)
                 goto out_err;
 
@@ -140,7 +137,7 @@ interrupts it can request a particular number of interrupts by passing that
 number to pci_alloc_irq_vectors() function as both 'min_vecs' and
 'max_vecs' parameters:
 
-        ret = pci_alloc_irq_vectors(pdev, nvec, nvec, 0);
+        ret = pci_alloc_irq_vectors(pdev, nvec, nvec, PCI_IRQ_ALL_TYPES);
         if (ret < 0)
                 goto out_err;
 
@@ -148,15 +145,14 @@ The most notorious example of the request type described above is enabling
 the single MSI mode for a device.  It could be done by passing two 1s as
 'min_vecs' and 'max_vecs':
 
-        ret = pci_alloc_irq_vectors(pdev, 1, 1, 0);
+        ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES);
         if (ret < 0)
                 goto out_err;
 
 Some devices might not support using legacy line interrupts, in which case
-the PCI_IRQ_NOLEGACY flag can be used to fail the request if the platform
-can't provide MSI or MSI-X interrupts:
+the driver can specify that only MSI or MSI-X is acceptable:
 
-        nvec = pci_alloc_irq_vectors(pdev, 1, nvec, PCI_IRQ_NOLEGACY);
+        nvec = pci_alloc_irq_vectors(pdev, 1, nvec, PCI_IRQ_MSI | PCI_IRQ_MSIX);
         if (nvec < 0)
                 goto out_err;
 
diff --git a/Documentation/PCI/pci.txt b/Documentation/PCI/pci.txt
index 123881f62219..77f49dc5be23 100644
--- a/Documentation/PCI/pci.txt
+++ b/Documentation/PCI/pci.txt
@@ -124,7 +124,6 @@ initialization with a pointer to a structure describing the driver
 
 The ID table is an array of struct pci_device_id entries ending with an
 all-zero entry.  Definitions with static const are generally preferred.
-Use of the deprecated macro DEFINE_PCI_DEVICE_TABLE should be avoided.
 
 Each entry consists of:
 
diff --git a/Documentation/arm/CCN.txt b/Documentation/arm/CCN.txt
index ffca443a19b4..15cdb7bc57c3 100644
--- a/Documentation/arm/CCN.txt
+++ b/Documentation/arm/CCN.txt
@@ -18,13 +18,17 @@ and config2 fields of the perf_event_attr structure. The "events"
 directory provides configuration templates for all documented
 events, that can be used with perf tool. For example "xp_valid_flit"
 is an equivalent of "type=0x8,event=0x4". Other parameters must be
-explicitly specified. For events originating from device, "node"
-defines its index. All crosspoint events require "xp" (index),
-"port" (device port number) and "vc" (virtual channel ID) and
-"dir" (direction). Watchpoints (special "event" value 0xfe) also
-require comparator values ("cmp_l" and "cmp_h") and "mask", being
-index of the comparator mask.
+explicitly specified.
 
+For events originating from device, "node" defines its index.
+
+Crosspoint PMU events require "xp" (index), "bus" (bus number)
+and "vc" (virtual channel ID).
+
+Crosspoint watchpoint-based events (special "event" value 0xfe)
+require "xp" and "vc" as as above plus "port" (device port index),
+"dir" (transmit/receive direction), comparator values ("cmp_l"
+and "cmp_h") and "mask", being index of the comparator mask.
 Masks are defined separately from the event description
 (due to limited number of the config values) in the "cmp_mask"
 directory, with first 8 configurable by user and additional
diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt
index 4da60b463995..ccc60324e738 100644
--- a/Documentation/arm64/silicon-errata.txt
+++ b/Documentation/arm64/silicon-errata.txt
@@ -53,6 +53,7 @@ stable kernels.
 | ARM            | Cortex-A57      | #832075         | ARM64_ERRATUM_832075    |
 | ARM            | Cortex-A57      | #852523         | N/A                     |
 | ARM            | Cortex-A57      | #834220         | ARM64_ERRATUM_834220    |
+| ARM            | Cortex-A72      | #853709         | N/A                     |
 | ARM            | MMU-500         | #841119,#826419 | N/A                     |
 |                |                 |                 |                         |
 | Cavium         | ThunderX ITS    | #22375, #24313  | CAVIUM_ERRATUM_22375    |
diff --git a/Documentation/cpu-freq/cpufreq-stats.txt b/Documentation/cpu-freq/cpufreq-stats.txt
index fc647492e940..8d9773f23550 100644
--- a/Documentation/cpu-freq/cpufreq-stats.txt
+++ b/Documentation/cpu-freq/cpufreq-stats.txt
@@ -103,7 +103,7 @@ Config Main Menu
         Power management options (ACPI, APM)  --->
                 CPU Frequency scaling  --->
                         [*] CPU Frequency scaling
-                        <*>   CPU frequency translation statistics 
+                        [*]   CPU frequency translation statistics
                         [*]     CPU frequency translation statistics details
 
 
diff --git a/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt b/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt
index bf99e2f24788..205593f56fe7 100644
--- a/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt
+++ b/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt
@@ -16,6 +16,11 @@ Required properties:
 - vref-supply: The regulator supply ADC reference voltage.
 - #io-channel-cells: Should be 1, see ../iio-bindings.txt
 
+Optional properties:
+- resets: Must contain an entry for each entry in reset-names if need support
+          this option. See ../reset/reset.txt for details.
+- reset-names: Must include the name "saradc-apb".
+
 Example:
         saradc: saradc@2006c000 {
                 compatible = "rockchip,saradc";
@@ -23,6 +28,8 @@ Example:
                 interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
                 clock-names = "saradc", "apb_pclk";
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                 #io-channel-cells = <1>;
                 vref-supply = <&vcc18>;
         };
diff --git a/Documentation/devicetree/bindings/serial/8250.txt b/Documentation/devicetree/bindings/serial/8250.txt
index f5561ac7e17e..936ab5b87324 100644
--- a/Documentation/devicetree/bindings/serial/8250.txt
+++ b/Documentation/devicetree/bindings/serial/8250.txt
@@ -42,9 +42,6 @@ Optional properties:
 - auto-flow-control: one way to enable automatic flow control support. The
   driver is allowed to detect support for the capability even without this
   property.
-- {rts,cts,dtr,dsr,rng,dcd}-gpios: specify a GPIO for RTS/CTS/DTR/DSR/RI/DCD
-  line respectively. It will use specified GPIO instead of the peripheral
-  function pin for the UART feature. If unsure, don't specify this property.
 
 Note:
 * fsl,ns16550:
@@ -66,19 +63,3 @@ Example:
                 interrupts = <10>;
                 reg-shift = <2>;
         };
-
-Example for OMAP UART using GPIO-based modem control signals:
-
-        uart4: serial@49042000 {
-                compatible = "ti,omap3-uart";
-                reg = <0x49042000 0x400>;
-                interrupts = <80>;
-                ti,hwmods = "uart4";
-                clock-frequency = <48000000>;
-                cts-gpios = <&gpio3 5 GPIO_ACTIVE_LOW>;
-                rts-gpios = <&gpio3 6 GPIO_ACTIVE_LOW>;
-                dtr-gpios = <&gpio1 12 GPIO_ACTIVE_LOW>;
-                dsr-gpios = <&gpio1 13 GPIO_ACTIVE_LOW>;
-                dcd-gpios = <&gpio1 14 GPIO_ACTIVE_LOW>;
-                rng-gpios = <&gpio1 15 GPIO_ACTIVE_LOW>;
-        };
diff --git a/Documentation/devicetree/bindings/sound/omap-mcpdm.txt b/Documentation/devicetree/bindings/sound/omap-mcpdm.txt
index 6f6c2f8e908d..0741dff048dd 100644
--- a/Documentation/devicetree/bindings/sound/omap-mcpdm.txt
+++ b/Documentation/devicetree/bindings/sound/omap-mcpdm.txt
@@ -8,8 +8,6 @@ Required properties:
 - interrupts: Interrupt number for McPDM
 - interrupt-parent: The parent interrupt controller
 - ti,hwmods: Name of the hwmod associated to the McPDM
-- clocks:  phandle for the pdmclk provider, likely <&twl6040>
-- clock-names: Must be "pdmclk"
 
 Example:
 
@@ -21,11 +19,3 @@ mcpdm: mcpdm@40132000 {
         interrupt-parent = <&gic>;
         ti,hwmods = "mcpdm";
 };
-
-In board DTS file the pdmclk needs to be added:
-
-&mcpdm {
-        clocks = <&twl6040>;
-        clock-names = "pdmclk";
-        status = "okay";
-};
diff --git a/Documentation/devicetree/bindings/thermal/thermal.txt b/Documentation/devicetree/bindings/thermal/thermal.txt
index 41b817f7b670..88b6ea1ad290 100644
--- a/Documentation/devicetree/bindings/thermal/thermal.txt
+++ b/Documentation/devicetree/bindings/thermal/thermal.txt
@@ -62,7 +62,7 @@ For more examples of cooling devices, refer to the example sections below.
 Required properties:
 - #cooling-cells:       Used to provide cooling device specific information
   Type: unsigned        while referring to it. Must be at least 2, in order
-  Size: one cell        to specify minimum and maximum cooling state used
+  Size: one cell        to specify minimum and maximum cooling state used
                         in the reference. The first cell is the minimum
                         cooling state requested and the second cell is
                         the maximum cooling state requested in the reference.
@@ -119,7 +119,7 @@ Required properties:
 Optional property:
 - contribution:         The cooling contribution to the thermal zone of the
   Type: unsigned        referred cooling device at the referred trip point.
-  Size: one cell        The contribution is a ratio of the sum
+  Size: one cell        The contribution is a ratio of the sum
                         of all cooling contributions within a thermal zone.
 
 Note: Using the THERMAL_NO_LIMIT (-1UL) constant in the cooling-device phandle
@@ -145,7 +145,7 @@ Required properties:
   Size: one cell
 
 - thermal-sensors:      A list of thermal sensor phandles and sensor specifier
-  Type: list of         used while monitoring the thermal zone.
+  Type: list of         used while monitoring the thermal zone.
   phandles + sensor
   specifier
 
@@ -473,7 +473,7 @@ thermal-zones {
                                   <&adc>;       /* pcb north */
 
                 /* hotspot = 100 * bandgap - 120 * adc + 484 */
-                coefficients =          <100    -120    484>;
+                coefficients =          <100    -120    484>;
 
                 trips {
                         ...
@@ -502,7 +502,7 @@ from the ADC sensor. The binding would be then:
         thermal-sensors =  <&adc>;
 
                 /* hotspot = 1 * adc + 6000 */
-        coefficients =          <1      6000>;
+        coefficients =          <1      6000>;
 
 (d) - Board thermal
 
diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt
index d6259c786316..bcbf9710e4af 100644
--- a/Documentation/filesystems/overlayfs.txt
+++ b/Documentation/filesystems/overlayfs.txt
@@ -183,12 +183,10 @@ The copy_up operation essentially creates a new, identical file and
 moves it over to the old name.  The new file may be on a different
 filesystem, so both st_dev and st_ino of the file may change.
 
-Any open files referring to this inode will access the old data and
-metadata.  Similarly any file locks obtained before copy_up will not
-apply to the copied up file.
+Any open files referring to this inode will access the old data.
 
-On a file opened with O_RDONLY fchmod(2), fchown(2), futimesat(2) and
-fsetxattr(2) will fail with EROFS.
+Any file locks (and leases) obtained before copy_up will not apply
+to the copied up file.
 
 If a file with multiple hard links is copied up, then this will
 "break" the link.  Changes will not be propagated to other names
diff --git a/Documentation/i2c/slave-interface b/Documentation/i2c/slave-interface
index 80807adb8ded..7e2a228f21bc 100644
--- a/Documentation/i2c/slave-interface
+++ b/Documentation/i2c/slave-interface
@@ -145,6 +145,11 @@ If you want to add slave support to the bus driver:
 
 * Catch the slave interrupts and send appropriate i2c_slave_events to the backend.
 
+Note that most hardware supports being master _and_ slave on the same bus. So,
+if you extend a bus driver, please make sure that the driver supports that as
+well. In almost all cases, slave support does not need to disable the master
+functionality.
+
 Check the i2c-rcar driver as an example.
 
 
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 46c030a49186..a4f4d693e2c1 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -3032,6 +3032,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                                 PAGE_SIZE is used as alignment.
                                 PCI-PCI bridge can be specified, if resource
                                 windows need to be expanded.
+                                To specify the alignment for several
+                                instances of a device, the PCI vendor,
+                                device, subvendor, and subdevice may be
+                                specified, e.g., 4096@pci:8086:9c22:103c:198f
                 ecrc=           Enable/disable PCIe ECRC (transaction layer
                                 end-to-end CRC checking).
                                 bios: Use BIOS/firmware settings. This is the
diff --git a/Documentation/networking/dsa/dsa.txt b/Documentation/networking/dsa/dsa.txt
index 9d05ed7f7da5..f20c884c048a 100644
--- a/Documentation/networking/dsa/dsa.txt
+++ b/Documentation/networking/dsa/dsa.txt
@@ -587,26 +587,6 @@ of DSA, would be the its port-based VLAN, used by the associated bridge device.
 TODO
 ====
 
-The platform device problem
----------------------------
-DSA is currently implemented as a platform device driver which is far from ideal
-as was discussed in this thread:
-
-http://permalink.gmane.org/gmane.linux.network/329848
-
-This basically prevents the device driver model to be properly used and applied,
-and support non-MDIO, non-MMIO Ethernet connected switches.
-
-Another problem with the platform device driver approach is that it prevents the
-use of a modular switch drivers build due to a circular dependency, illustrated
-here:
-
-http://comments.gmane.org/gmane.linux.network/345803
-
-Attempts of reworking this has been done here:
-
-https://lwn.net/Articles/643149/
-
 Making SWITCHDEV and DSA converge towards an unified codebase
 -------------------------------------------------------------
 
diff --git a/Documentation/powerpc/transactional_memory.txt b/Documentation/powerpc/transactional_memory.txt
index ba0a2a4a54ba..e32fdbb4c9a7 100644
--- a/Documentation/powerpc/transactional_memory.txt
+++ b/Documentation/powerpc/transactional_memory.txt
@@ -167,6 +167,8 @@ signal will be rolled back anyway.
 For signals taken in non-TM or suspended mode, we use the
 normal/non-checkpointed stack pointer.
 
+Any transaction initiated inside a sighandler and suspended on return
+from the sighandler to the kernel will get reclaimed and discarded.
 
 Failure cause codes used by kernel
 ==================================
diff --git a/Documentation/rapidio/mport_cdev.txt b/Documentation/rapidio/mport_cdev.txt
index 6e491a662461..a53f786ee2e9 100644
--- a/Documentation/rapidio/mport_cdev.txt
+++ b/Documentation/rapidio/mport_cdev.txt
@@ -80,6 +80,10 @@ functionality of their platform when planning to use this driver:
 
 III. Module parameters
 
+- 'dma_timeout' - DMA transfer completion timeout (in msec, default value 3000).
+        This parameter set a maximum completion wait time for SYNC mode DMA
+        transfer requests and for RIO_WAIT_FOR_ASYNC ioctl requests.
+
 - 'dbg_level' - This parameter allows to control amount of debug information
         generated by this device driver. This parameter is formed by set of
         bit masks that correspond to the specific functional blocks.
diff --git a/MAINTAINERS b/MAINTAINERS
index 0bbe4b105c34..a5e1270dfbf1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -798,6 +798,7 @@ M:	Laura Abbott <labbott@redhat.com>
 M:      Sumit Semwal <sumit.semwal@linaro.org>
 L:      devel@driverdev.osuosl.org
 S:      Supported
+F:      Documentation/devicetree/bindings/staging/ion/
 F:      drivers/staging/android/ion
 F:      drivers/staging/android/uapi/ion.h
 F:      drivers/staging/android/uapi/ion_test.h
@@ -881,6 +882,15 @@ S:	Supported
 F:      drivers/gpu/drm/arc/
 F:      Documentation/devicetree/bindings/display/snps,arcpgu.txt
 
+ARM ARCHITECTED TIMER DRIVER
+M:      Mark Rutland <mark.rutland@arm.com>
+M:      Marc Zyngier <marc.zyngier@arm.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/include/asm/arch_timer.h
+F:      arch/arm64/include/asm/arch_timer.h
+F:      drivers/clocksource/arm_arch_timer.c
+
 ARM HDLCD DRM DRIVER
 M:      Liviu Dudau <liviu.dudau@arm.com>
 S:      Supported
@@ -1614,7 +1624,7 @@ N:	rockchip
 
 ARM/SAMSUNG EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene@kernel.org>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 S:      Maintained
@@ -1634,7 +1644,6 @@ F:	drivers/*/*s3c64xx*
 F:      drivers/*/*s5pv210*
 F:      drivers/memory/samsung/*
 F:      drivers/soc/samsung/*
-F:      drivers/spi/spi-s3c*
 F:      Documentation/arm/Samsung/
 F:      Documentation/devicetree/bindings/arm/samsung/
 F:      Documentation/devicetree/bindings/sram/samsung-sram.txt
@@ -1822,6 +1831,7 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-stericsson.git
 ARM/UNIPHIER ARCHITECTURE
 M:      Masahiro Yamada <yamada.masahiro@socionext.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-uniphier.git
 S:      Maintained
 F:      arch/arm/boot/dts/uniphier*
 F:      arch/arm/include/asm/hardware/cache-uniphier.h
@@ -2475,7 +2485,7 @@ F:	include/net/bluetooth/
 BONDING DRIVER
 M:      Jay Vosburgh <j.vosburgh@gmail.com>
 M:      Veaceslav Falico <vfalico@gmail.com>
-M:      Andy Gospodarek <gospo@cumulusnetworks.com>
+M:      Andy Gospodarek <andy@greyhouse.net>
 L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/bonding/
 S:      Supported
@@ -3238,7 +3248,7 @@ F:	kernel/cpuset.c
 CONTROL GROUP - MEMORY RESOURCE CONTROLLER (MEMCG)
 M:      Johannes Weiner <hannes@cmpxchg.org>
 M:      Michal Hocko <mhocko@kernel.org>
-M:      Vladimir Davydov <vdavydov@virtuozzo.com>
+M:      Vladimir Davydov <vdavydov.dev@gmail.com>
 L:      cgroups@vger.kernel.org
 L:      linux-mm@kvack.org
 S:      Maintained
@@ -3259,7 +3269,7 @@ S:	Maintained
 F:      drivers/net/wan/cosa*
 
 CPMAC ETHERNET DRIVER
-M:      Florian Fainelli <florian@openwrt.org>
+M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/ti/cpmac.c
@@ -7455,7 +7465,8 @@ F:	Documentation/devicetree/bindings/sound/max9860.txt
 F:      sound/soc/codecs/max9860.*
 
 MAXIM MUIC CHARGER DRIVERS FOR EXYNOS BASED BOARDS
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
 L:      linux-pm@vger.kernel.org
 S:      Supported
 F:      drivers/power/max14577_charger.c
@@ -7471,7 +7482,8 @@ F:	include/dt-bindings/*/*max77802.h
 
 MAXIM PMIC AND MUIC DRIVERS FOR EXYNOS BASED BOARDS
 M:      Chanwoo Choi <cw00.choi@samsung.com>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
 L:      linux-kernel@vger.kernel.org
 S:      Supported
 F:      drivers/*/max14577*.c
@@ -7661,7 +7673,7 @@ L:	linux-rdma@vger.kernel.org
 S:      Supported
 W:      https://github.com/SoftRoCE/rxe-dev/wiki/rxe-dev:-Home
 Q:      http://patchwork.kernel.org/project/linux-rdma/list/
-F:      drivers/infiniband/hw/rxe/
+F:      drivers/infiniband/sw/rxe/
 F:      include/uapi/rdma/rdma_user_rxe.h
 
 MEMBARRIER SUPPORT
@@ -9237,7 +9249,7 @@ F:	drivers/pinctrl/sh-pfc/
 
 PIN CONTROLLER - SAMSUNG
 M:      Tomasz Figa <tomasz.figa@gmail.com>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
 M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
@@ -10170,7 +10182,7 @@ S:	Maintained
 F:      drivers/platform/x86/samsung-laptop.c
 
 SAMSUNG AUDIO (ASoC) DRIVERS
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
 M:      Sangbeom Kim <sbkim73@samsung.com>
 M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
@@ -10185,7 +10197,8 @@ F:	drivers/video/fbdev/s3c-fb.c
 
 SAMSUNG MULTIFUNCTION PMIC DEVICE DRIVERS
 M:      Sangbeom Kim <sbkim73@samsung.com>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
 L:      linux-kernel@vger.kernel.org
 L:      linux-samsung-soc@vger.kernel.org
 S:      Supported
@@ -10244,6 +10257,17 @@ S:	Supported
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 F:      drivers/clk/samsung/
 
+SAMSUNG SPI DRIVERS
+M:      Kukjin Kim <kgene@kernel.org>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Andi Shyti <andi.shyti@samsung.com>
+L:      linux-spi@vger.kernel.org
+L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
+S:      Maintained
+F:      Documentation/devicetree/bindings/spi/spi-samsung.txt
+F:      drivers/spi/spi-s3c*
+F:      include/linux/platform_data/spi-s3c64xx.h
+
 SAMSUNG SXGBE DRIVERS
 M:      Byungho An <bh74.an@samsung.com>
 M:      Girish K S <ks.giri@samsung.com>
@@ -11223,12 +11247,8 @@ S:	Odd Fixes
 F:      drivers/staging/vt665?/
 
 STAGING - WILC1000 WIFI DRIVER
-M:      Johnny Kim <johnny.kim@atmel.com>
-M:      Austin Shin <austin.shin@atmel.com>
-M:      Chris Park <chris.park@atmel.com>
-M:      Tony Cho <tony.cho@atmel.com>
-M:      Glen Lee <glen.lee@atmel.com>
-M:      Leo Kim <leo.kim@atmel.com>
+M:      Aditya Shankar <aditya.shankar@microchip.com>
+M:      Ganesh Krishna <ganesh.krishna@microchip.com>
 L:      linux-wireless@vger.kernel.org
 S:      Supported
 F:      drivers/staging/wilc1000/
diff --git a/Makefile b/Makefile
index 3537aa23905f..1a8c8ddcb22f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 8
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc6
 NAME = Psychotic Stoned Sheep
 
 # *DOCUMENTATION*
diff --git a/arch/Kconfig b/arch/Kconfig
index 9ecf9f6f9e15..180ea33164dc 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -336,17 +336,6 @@ config HAVE_ARCH_SECCOMP_FILTER
             results in the system call being skipped immediately.
           - seccomp syscall wired up
 
-          For best performance, an arch should use seccomp_phase1 and
-          seccomp_phase2 directly.  It should call seccomp_phase1 for all
-          syscalls if TIF_SECCOMP is set, but seccomp_phase1 does not
-          need to be called from a ptrace-safe context.  It must then
-          call seccomp_phase2 if seccomp_phase1 returns anything other
-          than SECCOMP_PHASE1_OK or SECCOMP_PHASE1_SKIP.
-
-          As an additional optimization, an arch may provide seccomp_data
-          directly to seccomp_phase1; this avoids multiple calls
-          to the syscall_xyz helpers for every syscall.
-
 config SECCOMP_FILTER
         def_bool y
         depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET
diff --git a/arch/alpha/include/asm/uaccess.h b/arch/alpha/include/asm/uaccess.h
index c419b43c461d..466e42e96bfa 100644
--- a/arch/alpha/include/asm/uaccess.h
+++ b/arch/alpha/include/asm/uaccess.h
@@ -371,14 +371,6 @@ __copy_tofrom_user_nocheck(void *to, const void *from, long len)
         return __cu_len;
 }
 
-extern inline long
-__copy_tofrom_user(void *to, const void *from, long len, const void __user *validate)
-{
-        if (__access_ok((unsigned long)validate, len, get_fs()))
-                len = __copy_tofrom_user_nocheck(to, from, len);
-        return len;
-}
-
 #define __copy_to_user(to, from, n)                                     \
 ({                                                                      \
         __chk_user_ptr(to);                                             \
@@ -393,17 +385,22 @@ __copy_tofrom_user(void *to, const void *from, long len, const void __user *vali
 #define __copy_to_user_inatomic __copy_to_user
 #define __copy_from_user_inatomic __copy_from_user
 
-
 extern inline long
 copy_to_user(void __user *to, const void *from, long n)
 {
-        return __copy_tofrom_user((__force void *)to, from, n, to);
+        if (likely(__access_ok((unsigned long)to, n, get_fs())))
+                n = __copy_tofrom_user_nocheck((__force void *)to, from, n);
+        return n;
 }
 
 extern inline long
 copy_from_user(void *to, const void __user *from, long n)
 {
-        return __copy_tofrom_user(to, (__force void *)from, n, from);
+        if (likely(__access_ok((unsigned long)from, n, get_fs())))
+                n = __copy_tofrom_user_nocheck(to, (__force void *)from, n);
+        else
+                memset(to, 0, n);
+        return n;
 }
 
 extern void __do_clear_user(void);
diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h
index ad7860c5ce15..51597f344a62 100644
--- a/arch/arc/include/asm/entry.h
+++ b/arch/arc/include/asm/entry.h
@@ -142,7 +142,7 @@
 
 #ifdef CONFIG_ARC_CURR_IN_REG
         ; Retrieve orig r25 and save it with rest of callee_regs
-        ld.as   r12, [r12, PT_user_r25]
+        ld      r12, [r12, PT_user_r25]
         PUSH    r12
 #else
         PUSH    r25
@@ -198,7 +198,7 @@
 
         ; SP is back to start of pt_regs
 #ifdef CONFIG_ARC_CURR_IN_REG
-        st.as   r12, [sp, PT_user_r25]
+        st      r12, [sp, PT_user_r25]
 #endif
 .endm
 
diff --git a/arch/arc/include/asm/irqflags-compact.h b/arch/arc/include/asm/irqflags-compact.h
index c1d36458bfb7..4c6eed80cd8b 100644
--- a/arch/arc/include/asm/irqflags-compact.h
+++ b/arch/arc/include/asm/irqflags-compact.h
@@ -188,10 +188,10 @@ static inline int arch_irqs_disabled(void)
 .endm
 
 .macro IRQ_ENABLE  scratch
+        TRACE_ASM_IRQ_ENABLE
         lr      \scratch, [status32]
         or      \scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK)
         flag    \scratch
-        TRACE_ASM_IRQ_ENABLE
 .endm
 
 #endif  /* __ASSEMBLY__ */
diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
index 0f92d97432a2..89eeb3720051 100644
--- a/arch/arc/include/asm/pgtable.h
+++ b/arch/arc/include/asm/pgtable.h
@@ -280,7 +280,7 @@ static inline void pmd_set(pmd_t *pmdp, pte_t *ptep)
 
 #define pte_page(pte)           pfn_to_page(pte_pfn(pte))
 #define mk_pte(page, prot)      pfn_pte(page_to_pfn(page), prot)
-#define pfn_pte(pfn, prot)      (__pte(((pte_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)))
+#define pfn_pte(pfn, prot)      __pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot))
 
 /* Don't use virt_to_pfn for macros below: could cause truncations for PAE40*/
 #define pte_pfn(pte)            (pte_val(pte) >> PAGE_SHIFT)
diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h
index a78d5670884f..41faf17cd28d 100644
--- a/arch/arc/include/asm/uaccess.h
+++ b/arch/arc/include/asm/uaccess.h
@@ -83,7 +83,10 @@
         "2:     ;nop\n"                         \
         "       .section .fixup, \"ax\"\n"      \
         "       .align 4\n"                     \
-        "3:     mov %0, %3\n"                   \
+        "3:     # return -EFAULT\n"             \
+        "       mov %0, %3\n"                   \
+        "       # zero out dst ptr\n"           \
+        "       mov %1,  0\n"                   \
         "       j   2b\n"                       \
         "       .previous\n"                    \
         "       .section __ex_table, \"a\"\n"   \
@@ -101,7 +104,11 @@
         "2:     ;nop\n"                         \
         "       .section .fixup, \"ax\"\n"      \
         "       .align 4\n"                     \
-        "3:     mov %0, %3\n"                   \
+        "3:     # return -EFAULT\n"             \
+        "       mov %0, %3\n"                   \
+        "       # zero out dst ptr\n"           \
+        "       mov %1,  0\n"                   \
+        "       mov %R1, 0\n"                   \
         "       j   2b\n"                       \
         "       .previous\n"                    \
         "       .section __ex_table, \"a\"\n"   \
diff --git a/arch/arc/include/uapi/asm/elf.h b/arch/arc/include/uapi/asm/elf.h
index 0f99ac8fcbb2..0037a587320d 100644
--- a/arch/arc/include/uapi/asm/elf.h
+++ b/arch/arc/include/uapi/asm/elf.h
@@ -13,8 +13,15 @@
 
 /* Machine specific ELF Hdr flags */
 #define EF_ARC_OSABI_MSK        0x00000f00
-#define EF_ARC_OSABI_ORIG       0x00000000   /* MUST be zero for back-compat */
-#define EF_ARC_OSABI_CURRENT    0x00000300   /* v3 (no legacy syscalls) */
+
+#define EF_ARC_OSABI_V3         0x00000300   /* v3 (no legacy syscalls) */
+#define EF_ARC_OSABI_V4         0x00000400   /* v4 (64bit data any reg align) */
+
+#if __GNUC__ < 6
+#define EF_ARC_OSABI_CURRENT    EF_ARC_OSABI_V3
+#else
+#define EF_ARC_OSABI_CURRENT    EF_ARC_OSABI_V4
+#endif
 
 typedef unsigned long elf_greg_t;
 typedef unsigned long elf_fpregset_t;
diff --git a/arch/arc/kernel/arcksyms.c b/arch/arc/kernel/arcksyms.c
index 4d9e77724bed..000dd041ab42 100644
--- a/arch/arc/kernel/arcksyms.c
+++ b/arch/arc/kernel/arcksyms.c
@@ -28,6 +28,7 @@ extern void __muldf3(void);
 extern void __divdf3(void);
 extern void __floatunsidf(void);
 extern void __floatunsisf(void);
+extern void __udivdi3(void);
 
 EXPORT_SYMBOL(__ashldi3);
 EXPORT_SYMBOL(__ashrdi3);
@@ -45,6 +46,7 @@ EXPORT_SYMBOL(__muldf3);
 EXPORT_SYMBOL(__divdf3);
 EXPORT_SYMBOL(__floatunsidf);
 EXPORT_SYMBOL(__floatunsisf);
+EXPORT_SYMBOL(__udivdi3);
 
 /* ARC optimised assembler routines */
 EXPORT_SYMBOL(memset);
diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
index b5db9e7fd649..be1972bd2729 100644
--- a/arch/arc/kernel/process.c
+++ b/arch/arc/kernel/process.c
@@ -199,7 +199,7 @@ int elf_check_arch(const struct elf32_hdr *x)
         }
 
         eflags = x->e_flags;
-        if ((eflags & EF_ARC_OSABI_MSK) < EF_ARC_OSABI_CURRENT) {
+        if ((eflags & EF_ARC_OSABI_MSK) != EF_ARC_OSABI_CURRENT) {
                 pr_err("ABI mismatch - you need newer toolchain\n");
                 force_sigsegv(SIGSEGV, current);
                 return 0;
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index a946400a86d0..f52a0d0dc462 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -291,8 +291,10 @@ static char *arc_extn_mumbojumbo(int cpu_id, char *buf, int len)
                                cpu->dccm.base_addr, TO_KB(cpu->dccm.sz),
                                cpu->iccm.base_addr, TO_KB(cpu->iccm.sz));
 
-        n += scnprintf(buf + n, len - n,
-                       "OS ABI [v3]\t: no-legacy-syscalls\n");
+        n += scnprintf(buf + n, len - n, "OS ABI [v%d]\t: %s\n",
+                        EF_ARC_OSABI_CURRENT >> 8,
+                        EF_ARC_OSABI_CURRENT == EF_ARC_OSABI_V3 ?
+                        "no-legacy-syscalls" : "64-bit data any register aligned");
 
         return buf;
 }
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index 5a294b2c3cb3..0b10efe3a6a7 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -921,6 +921,15 @@ void arc_cache_init(void)
 
         printk(arc_cache_mumbojumbo(0, str, sizeof(str)));
 
+        /*
+         * Only master CPU needs to execute rest of function:
+         *  - Assume SMP so all cores will have same cache config so
+         *    any geomtry checks will be same for all
+         *  - IOC setup / dma callbacks only need to be setup once
+         */
+        if (cpu)
+                return;
+
         if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE)) {
                 struct cpuinfo_arc_cache *ic = &cpuinfo_arc700[cpu].icache;
 
diff --git a/arch/arc/mm/highmem.c b/arch/arc/mm/highmem.c
index 04f83322c9fd..77ff64a874a1 100644
--- a/arch/arc/mm/highmem.c
+++ b/arch/arc/mm/highmem.c
@@ -61,6 +61,7 @@ void *kmap(struct page *page)
 
         return kmap_high(page);
 }
+EXPORT_SYMBOL(kmap);
 
 void *kmap_atomic(struct page *page)
 {
diff --git a/arch/arm/boot/dts/am335x-baltos.dtsi b/arch/arm/boot/dts/am335x-baltos.dtsi
index c8609d8d2c55..b689172632ef 100644
--- a/arch/arm/boot/dts/am335x-baltos.dtsi
+++ b/arch/arm/boot/dts/am335x-baltos.dtsi
@@ -226,7 +226,7 @@
 
                 #address-cells = <1>;
                 #size-cells = <1>;
-                elm_id = <&elm>;
+                ti,elm-id = <&elm>;
         };
 };
 
diff --git a/arch/arm/boot/dts/am335x-igep0033.dtsi b/arch/arm/boot/dts/am335x-igep0033.dtsi
index df63484ef9b3..e7d9ca1305fa 100644
--- a/arch/arm/boot/dts/am335x-igep0033.dtsi
+++ b/arch/arm/boot/dts/am335x-igep0033.dtsi
@@ -161,7 +161,7 @@
 
                 #address-cells = <1>;
                 #size-cells = <1>;
-                elm_id = <&elm>;
+                ti,elm-id = <&elm>;
 
                 /* MTD partition table */
                 partition@0 {
diff --git a/arch/arm/boot/dts/am335x-phycore-som.dtsi b/arch/arm/boot/dts/am335x-phycore-som.dtsi
index 86f773165d5c..1263c9d4cba3 100644
--- a/arch/arm/boot/dts/am335x-phycore-som.dtsi
+++ b/arch/arm/boot/dts/am335x-phycore-som.dtsi
@@ -197,7 +197,7 @@
                 gpmc,wr-access-ns = <30>;
                 gpmc,wr-data-mux-bus-ns = <0>;
 
-                elm_id = <&elm>;
+                ti,elm-id = <&elm>;
 
                 #address-cells = <1>;
                 #size-cells = <1>;
diff --git a/arch/arm/boot/dts/armada-388-clearfog.dts b/arch/arm/boot/dts/armada-388-clearfog.dts
index 2e0556af6e5e..d3e6bd805006 100644
--- a/arch/arm/boot/dts/armada-388-clearfog.dts
+++ b/arch/arm/boot/dts/armada-388-clearfog.dts
@@ -390,12 +390,12 @@
 
                         port@0 {
                                 reg = <0>;
-                                label = "lan1";
+                                label = "lan5";
                         };
 
                         port@1 {
                                 reg = <1>;
-                                label = "lan2";
+                                label = "lan4";
                         };
 
                         port@2 {
@@ -405,12 +405,12 @@
 
                         port@3 {
                                 reg = <3>;
-                                label = "lan4";
+                                label = "lan2";
                         };
 
                         port@4 {
                                 reg = <4>;
-                                label = "lan5";
+                                label = "lan1";
                         };
 
                         port@5 {
diff --git a/arch/arm/boot/dts/exynos5410-odroidxu.dts b/arch/arm/boot/dts/exynos5410-odroidxu.dts
index d9499310a301..f6d135245a4b 100644
--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
+++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
@@ -447,14 +447,11 @@
         samsung,dw-mshc-ciu-div = <3>;
         samsung,dw-mshc-sdr-timing = <0 4>;
         samsung,dw-mshc-ddr-timing = <0 2>;
-        samsung,dw-mshc-hs400-timing = <0 2>;
-        samsung,read-strobe-delay = <90>;
         pinctrl-names = "default";
         pinctrl-0 = <&sd0_clk &sd0_cmd &sd0_bus1 &sd0_bus4 &sd0_bus8 &sd0_cd>;
         bus-width = <8>;
         cap-mmc-highspeed;
         mmc-hs200-1_8v;
-        mmc-hs400-1_8v;
         vmmc-supply = <&ldo20_reg>;
         vqmmc-supply = <&ldo11_reg>;
 };
diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
index b620ac884cfd..b13b0b2db881 100644
--- a/arch/arm/boot/dts/imx6qdl.dtsi
+++ b/arch/arm/boot/dts/imx6qdl.dtsi
@@ -243,7 +243,7 @@
                                         clocks = <&clks IMX6QDL_CLK_SPDIF_GCLK>, <&clks IMX6QDL_CLK_OSC>,
                                                  <&clks IMX6QDL_CLK_SPDIF>, <&clks IMX6QDL_CLK_ASRC>,
                                                  <&clks IMX6QDL_CLK_DUMMY>, <&clks IMX6QDL_CLK_ESAI_EXTAL>,
-                                                 <&clks IMX6QDL_CLK_IPG>, <&clks IMX6QDL_CLK_MLB>,
+                                                 <&clks IMX6QDL_CLK_IPG>, <&clks IMX6QDL_CLK_DUMMY>,
                                                  <&clks IMX6QDL_CLK_DUMMY>, <&clks IMX6QDL_CLK_SPBA>;
                                         clock-names = "core",  "rxtx0",
                                                       "rxtx1", "rxtx2",
diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
index 96ea936eeeb0..240a2864d044 100644
--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
+++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
@@ -64,7 +64,7 @@
         cd-gpios = <&gpio7 11 GPIO_ACTIVE_LOW>;
         no-1-8-v;
         keep-power-in-suspend;
-        enable-sdio-wakup;
+        wakeup-source;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
index 95ee268ed510..2f33c463cbce 100644
--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -131,7 +131,7 @@
                 ti,y-min = /bits/ 16 <0>;
                 ti,y-max = /bits/ 16 <0>;
                 ti,pressure-max = /bits/ 16 <0>;
-                ti,x-plat-ohms = /bits/ 16 <400>;
+                ti,x-plate-ohms = /bits/ 16 <400>;
                 wakeup-source;
         };
 };
diff --git a/arch/arm/boot/dts/kirkwood-ib62x0.dts b/arch/arm/boot/dts/kirkwood-ib62x0.dts
index ef84d8699a76..5bf62897014c 100644
--- a/arch/arm/boot/dts/kirkwood-ib62x0.dts
+++ b/arch/arm/boot/dts/kirkwood-ib62x0.dts
@@ -113,7 +113,7 @@
 
         partition@e0000 {
                 label = "u-boot environment";
-                reg = <0xe0000 0x100000>;
+                reg = <0xe0000 0x20000>;
         };
 
         partition@100000 {
diff --git a/arch/arm/boot/dts/kirkwood-openrd.dtsi b/arch/arm/boot/dts/kirkwood-openrd.dtsi
index e4ecab112601..7175511a92da 100644
--- a/arch/arm/boot/dts/kirkwood-openrd.dtsi
+++ b/arch/arm/boot/dts/kirkwood-openrd.dtsi
@@ -116,6 +116,10 @@
         };
 };
 
+&pciec {
+        status = "okay";
+};
+
 &pcie0 {
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
index 365f39ff58bb..0ff1c2de95bf 100644
--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
+++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
@@ -35,10 +35,15 @@
         ranges = <0 0 0x00000000 0x1000000>;    /* CS0: 16MB for NAND */
 
         nand@0,0 {
-                linux,mtd-name = "micron,mt29f4g16abbda3w";
+                compatible = "ti,omap2-nand";
                 reg = <0 0 4>; /* CS0, offset 0, IO size 4 */
+                interrupt-parent = <&gpmc>;
+                interrupts = <0 IRQ_TYPE_NONE>, /* fifoevent */
+                             <1 IRQ_TYPE_NONE>; /* termcount */
+                linux,mtd-name = "micron,mt29f4g16abbda3w";
                 nand-bus-width = <16>;
                 ti,nand-ecc-opt = "bch8";
+                rb-gpios = <&gpmc 0 GPIO_ACTIVE_HIGH>; /* gpmc_wait0 */
                 gpmc,sync-clk-ps = <0>;
                 gpmc,cs-on-ns = <0>;
                 gpmc,cs-rd-off-ns = <44>;
@@ -54,10 +59,6 @@
                 gpmc,wr-access-ns = <40>;
                 gpmc,wr-data-mux-bus-ns = <0>;
                 gpmc,device-width = <2>;
-
-                gpmc,page-burst-access-ns = <5>;
-                gpmc,cycle2cycle-delay-ns = <50>;
-
                 #address-cells = <1>;
                 #size-cells = <1>;
 
diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
index 5e9a13c0eaf7..1c2c74655416 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
@@ -46,6 +46,7 @@
                 linux,mtd-name = "micron,mt29f4g16abbda3w";
                 nand-bus-width = <16>;
                 ti,nand-ecc-opt = "bch8";
+                rb-gpios = <&gpmc 0 GPIO_ACTIVE_HIGH>; /* gpmc_wait0 */
                 gpmc,sync-clk-ps = <0>;
                 gpmc,cs-on-ns = <0>;
                 gpmc,cs-rd-off-ns = <44>;
diff --git a/arch/arm/boot/dts/omap3-overo-base.dtsi b/arch/arm/boot/dts/omap3-overo-base.dtsi
index de256fa8da48..3e946cac55f3 100644
--- a/arch/arm/boot/dts/omap3-overo-base.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-base.dtsi
@@ -223,7 +223,9 @@
 };
 
 &gpmc {
-        ranges = <0 0 0x00000000 0x20000000>;
+        ranges = <0 0 0x30000000 0x1000000>,    /* CS0 */
+                 <4 0 0x2b000000 0x1000000>,    /* CS4 */
+                 <5 0 0x2c000000 0x1000000>;    /* CS5 */
 
         nand@0,0 {
                 compatible = "ti,omap2-nand";
diff --git a/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi b/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
index 7df27926ead2..4f4c6efbd518 100644
--- a/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
@@ -55,8 +55,6 @@
 #include "omap-gpmc-smsc9221.dtsi"
 
 &gpmc {
-        ranges = <5 0 0x2c000000 0x1000000>;    /* CS5 */
-
         ethernet@gpmc {
                 reg = <5 0 0xff>;
                 interrupt-parent = <&gpio6>;
diff --git a/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
index 9e24b6a1d07b..1b304e2f1bd2 100644
--- a/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
@@ -27,8 +27,6 @@
 #include "omap-gpmc-smsc9221.dtsi"
 
 &gpmc {
-        ranges = <5 0 0x2c000000 0x1000000>;    /* CS5 */
-
         ethernet@gpmc {
                 reg = <5 0 0xff>;
                 interrupt-parent = <&gpio6>;
diff --git a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
index 334109e14613..82e98ee3023a 100644
--- a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
@@ -15,9 +15,6 @@
 #include "omap-gpmc-smsc9221.dtsi"
 
 &gpmc {
-        ranges = <4 0 0x2b000000 0x1000000>,    /* CS4 */
-                 <5 0 0x2c000000 0x1000000>;    /* CS5 */
-
         smsc1: ethernet@gpmc {
                 reg = <5 0 0xff>;
                 interrupt-parent = <&gpio6>;
diff --git a/arch/arm/boot/dts/rk3066a.dtsi b/arch/arm/boot/dts/rk3066a.dtsi
index c0ba86c3a2ab..0d0dae3a1694 100644
--- a/arch/arm/boot/dts/rk3066a.dtsi
+++ b/arch/arm/boot/dts/rk3066a.dtsi
@@ -197,6 +197,8 @@
                 clock-names = "saradc", "apb_pclk";
                 interrupts = <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>;
                 #io-channel-cells = <1>;
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                 status = "disabled";
         };
 
diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
index cd33f0170890..91c4b3c7a8d5 100644
--- a/arch/arm/boot/dts/rk3288.dtsi
+++ b/arch/arm/boot/dts/rk3288.dtsi
@@ -279,6 +279,8 @@
                 #io-channel-cells = <1>;
                 clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
                 clock-names = "saradc", "apb_pclk";
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                 status = "disabled";
         };
 
diff --git a/arch/arm/boot/dts/rk3xxx.dtsi b/arch/arm/boot/dts/rk3xxx.dtsi
index 99bbcc2c9b89..e2cd683b4e4b 100644
--- a/arch/arm/boot/dts/rk3xxx.dtsi
+++ b/arch/arm/boot/dts/rk3xxx.dtsi
@@ -399,6 +399,8 @@
                 #io-channel-cells = <1>;
                 clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
                 clock-names = "saradc", "apb_pclk";
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                 status = "disabled";
         };
 
diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
index e012890e0cf2..a17ba0243db3 100644
--- a/arch/arm/boot/dts/sun5i-a13.dtsi
+++ b/arch/arm/boot/dts/sun5i-a13.dtsi
@@ -84,7 +84,7 @@
                         trips {
                                 cpu_alert0: cpu_alert0 {
                                         /* milliCelsius */
-                                        temperature = <850000>;
+                                        temperature = <85000>;
                                         hysteresis = <2000>;
                                         type = "passive";
                                 };
diff --git a/arch/arm/boot/dts/tegra114-dalmore.dts b/arch/arm/boot/dts/tegra114-dalmore.dts
index 1dfc492cc004..1444fbd543e7 100644
--- a/arch/arm/boot/dts/tegra114-dalmore.dts
+++ b/arch/arm/boot/dts/tegra114-dalmore.dts
@@ -897,7 +897,7 @@
                 palmas: tps65913@58 {
                         compatible = "ti,palmas";
                         reg = <0x58>;
-                        interrupts = <0 86 IRQ_TYPE_LEVEL_LOW>;
+                        interrupts = <0 86 IRQ_TYPE_LEVEL_HIGH>;
 
                         #interrupt-cells = <2>;
                         interrupt-controller;
diff --git a/arch/arm/boot/dts/tegra114-roth.dts b/arch/arm/boot/dts/tegra114-roth.dts
index 70cf40996c3f..966a7fc044af 100644
--- a/arch/arm/boot/dts/tegra114-roth.dts
+++ b/arch/arm/boot/dts/tegra114-roth.dts
@@ -802,7 +802,7 @@
                 palmas: pmic@58 {
                         compatible = "ti,palmas";
                         reg = <0x58>;
-                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_LOW>;
+                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
 
                         #interrupt-cells = <2>;
                         interrupt-controller;
diff --git a/arch/arm/boot/dts/tegra114-tn7.dts b/arch/arm/boot/dts/tegra114-tn7.dts
index 17dd14545862..a161fa1dfb61 100644
--- a/arch/arm/boot/dts/tegra114-tn7.dts
+++ b/arch/arm/boot/dts/tegra114-tn7.dts
@@ -63,7 +63,7 @@
                 palmas: pmic@58 {
                         compatible = "ti,palmas";
                         reg = <0x58>;
-                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_LOW>;
+                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
 
                         #interrupt-cells = <2>;
                         interrupt-controller;
diff --git a/arch/arm/boot/dts/tegra124-jetson-tk1.dts b/arch/arm/boot/dts/tegra124-jetson-tk1.dts
index 6403e0de540e..e52b82449a79 100644
--- a/arch/arm/boot/dts/tegra124-jetson-tk1.dts
+++ b/arch/arm/boot/dts/tegra124-jetson-tk1.dts
@@ -1382,7 +1382,7 @@
          *   Pin 41: BR_UART1_TXD
          *   Pin 44: BR_UART1_RXD
          */
-        serial@0,70006000 {
+        serial@70006000 {
                 compatible = "nvidia,tegra124-hsuart", "nvidia,tegra30-hsuart";
                 status = "okay";
         };
@@ -1394,7 +1394,7 @@
          *   Pin 71: UART2_CTS_L
          *   Pin 74: UART2_RTS_L
          */
-        serial@0,70006040 {
+        serial@70006040 {
                 compatible = "nvidia,tegra124-hsuart", "nvidia,tegra30-hsuart";
                 status = "okay";
         };
diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
index 0b1e4a93d67e..15d073ae5da2 100644
--- a/arch/arm/kernel/hyp-stub.S
+++ b/arch/arm/kernel/hyp-stub.S
@@ -142,6 +142,19 @@ ARM_BE8(orr	r7, r7, #(1 << 25))     @ HSCTLR.EE
         and     r7, #0x1f               @ Preserve HPMN
         mcr     p15, 4, r7, c1, c1, 1   @ HDCR
 
+        @ Make sure NS-SVC is initialised appropriately
+        mrc     p15, 0, r7, c1, c0, 0   @ SCTLR
+        orr     r7, #(1 << 5)           @ CP15 barriers enabled
+        bic     r7, #(3 << 7)           @ Clear SED/ITD for v8 (RES0 for v7)
+        bic     r7, #(3 << 19)          @ WXN and UWXN disabled
+        mcr     p15, 0, r7, c1, c0, 0   @ SCTLR
+
+        mrc     p15, 0, r7, c0, c0, 0   @ MIDR
+        mcr     p15, 4, r7, c0, c0, 0   @ VPIDR
+
+        mrc     p15, 0, r7, c0, c0, 5   @ MPIDR
+        mcr     p15, 4, r7, c0, c0, 5   @ VMPIDR
+
 #if !defined(ZIMAGE) && defined(CONFIG_ARM_ARCH_TIMER)
         @ make CNTP_* and CNTPCT accessible from PL1
         mrc     p15, 0, r7, c0, c1, 1   @ ID_PFR1
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 75f130ef6504..c94b90d43772 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -158,8 +158,6 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
 {
         int i;
 
-        kvm_free_stage2_pgd(kvm);
-
         for (i = 0; i < KVM_MAX_VCPUS; ++i) {
                 if (kvm->vcpus[i]) {
                         kvm_arch_vcpu_free(kvm->vcpus[i]);
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index bda27b6b1aa2..e9a5c0e0c115 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -1309,7 +1309,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
         smp_rmb();
 
         pfn = gfn_to_pfn_prot(kvm, gfn, write_fault, &writable);
-        if (is_error_pfn(pfn))
+        if (is_error_noslot_pfn(pfn))
                 return -EFAULT;
 
         if (kvm_is_device_pfn(pfn)) {
@@ -1714,7 +1714,8 @@ int kvm_mmu_init(void)
                  kern_hyp_va(PAGE_OFFSET), kern_hyp_va(~0UL));
 
         if (hyp_idmap_start >= kern_hyp_va(PAGE_OFFSET) &&
-            hyp_idmap_start <  kern_hyp_va(~0UL)) {
+            hyp_idmap_start <  kern_hyp_va(~0UL) &&
+            hyp_idmap_start != (unsigned long)__hyp_idmap_text_start) {
                 /*
                  * The idmap page is intersecting with the VA space,
                  * it is not safe to continue further.
@@ -1893,6 +1894,7 @@ void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots)
 
 void kvm_arch_flush_shadow_all(struct kvm *kvm)
 {
+        kvm_free_stage2_pgd(kvm);
 }
 
 void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
diff --git a/arch/arm/mach-imx/mach-imx6ul.c b/arch/arm/mach-imx/mach-imx6ul.c
index 5d9bfab279dd..6bb7d9cf1e38 100644
--- a/arch/arm/mach-imx/mach-imx6ul.c
+++ b/arch/arm/mach-imx/mach-imx6ul.c
@@ -64,6 +64,7 @@ static void __init imx6ul_init_machine(void)
         if (parent == NULL)
                 pr_warn("failed to initialize soc device\n");
 
+        of_platform_default_populate(NULL, NULL, parent);
         imx6ul_enet_init();
         imx_anatop_init();
         imx6ul_pm_init();
diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
index 58924b3844df..fe708e26d021 100644
--- a/arch/arm/mach-imx/pm-imx6.c
+++ b/arch/arm/mach-imx/pm-imx6.c
@@ -295,7 +295,7 @@ int imx6_set_lpm(enum mxc_cpu_pwr_mode mode)
                 val &= ~BM_CLPCR_SBYOS;
                 if (cpu_is_imx6sl())
                         val |= BM_CLPCR_BYPASS_PMIC_READY;
-                if (cpu_is_imx6sl() || cpu_is_imx6sx())
+                if (cpu_is_imx6sl() || cpu_is_imx6sx() || cpu_is_imx6ul())
                         val |= BM_CLPCR_BYP_MMDC_CH0_LPM_HS;
                 else
                         val |= BM_CLPCR_BYP_MMDC_CH1_LPM_HS;
@@ -310,7 +310,7 @@ int imx6_set_lpm(enum mxc_cpu_pwr_mode mode)
                 val |= 0x3 << BP_CLPCR_STBY_COUNT;
                 val |= BM_CLPCR_VSTBY;
                 val |= BM_CLPCR_SBYOS;
-                if (cpu_is_imx6sl())
+                if (cpu_is_imx6sl() || cpu_is_imx6sx())
                         val |= BM_CLPCR_BYPASS_PMIC_READY;
                 if (cpu_is_imx6sl() || cpu_is_imx6sx() || cpu_is_imx6ul())
                         val |= BM_CLPCR_BYP_MMDC_CH0_LPM_HS;
diff --git a/arch/arm/mach-omap2/cm33xx.c b/arch/arm/mach-omap2/cm33xx.c
index c073fb57dd13..6f2d0aec0513 100644
--- a/arch/arm/mach-omap2/cm33xx.c
+++ b/arch/arm/mach-omap2/cm33xx.c
@@ -220,9 +220,6 @@ static int am33xx_cm_wait_module_ready(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout(_is_module_ready(inst, clkctrl_offs),
                           MAX_MODULE_READY_TIME, i);
 
@@ -246,9 +243,6 @@ static int am33xx_cm_wait_module_idle(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout((_clkctrl_idlest(inst, clkctrl_offs) ==
                                 CLKCTRL_IDLEST_DISABLED),
                                 MAX_MODULE_READY_TIME, i);
diff --git a/arch/arm/mach-omap2/cminst44xx.c b/arch/arm/mach-omap2/cminst44xx.c
index 2c0e07ed6b99..2ab27ade136a 100644
--- a/arch/arm/mach-omap2/cminst44xx.c
+++ b/arch/arm/mach-omap2/cminst44xx.c
@@ -278,9 +278,6 @@ static int omap4_cminst_wait_module_ready(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout(_is_module_ready(part, inst, clkctrl_offs),
                           MAX_MODULE_READY_TIME, i);
 
@@ -304,9 +301,6 @@ static int omap4_cminst_wait_module_idle(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout((_clkctrl_idlest(part, inst, clkctrl_offs) ==
                            CLKCTRL_IDLEST_DISABLED),
                           MAX_MODULE_DISABLE_TIME, i);
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 5b709383381c..1052b29697b8 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1053,6 +1053,10 @@ static int _omap4_wait_target_disable(struct omap_hwmod *oh)
         if (oh->flags & HWMOD_NO_IDLEST)
                 return 0;
 
+        if (!oh->prcm.omap4.clkctrl_offs &&
+            !(oh->prcm.omap4.flags & HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET))
+                return 0;
+
         return omap_cm_wait_module_idle(oh->clkdm->prcm_partition,
                                         oh->clkdm->cm_inst,
                                         oh->prcm.omap4.clkctrl_offs, 0);
@@ -2971,6 +2975,10 @@ static int _omap4_wait_target_ready(struct omap_hwmod *oh)
         if (!_find_mpu_rt_port(oh))
                 return 0;
 
+        if (!oh->prcm.omap4.clkctrl_offs &&
+            !(oh->prcm.omap4.flags & HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET))
+                return 0;
+
         /* XXX check module SIDLEMODE, hardreset status */
 
         return omap_cm_wait_module_ready(oh->clkdm->prcm_partition,
diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h
index 4041bad79a9a..78904017f18c 100644
--- a/arch/arm/mach-omap2/omap_hwmod.h
+++ b/arch/arm/mach-omap2/omap_hwmod.h
@@ -443,8 +443,12 @@ struct omap_hwmod_omap2_prcm {
  * HWMOD_OMAP4_NO_CONTEXT_LOSS_BIT: Some IP blocks don't have a PRCM
  *     module-level context loss register associated with them; this
  *     flag bit should be set in those cases
+ * HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET: Some IP blocks have a valid CLKCTRL
+ *      offset of zero; this flag bit should be set in those cases to
+ *      distinguish from hwmods that have no clkctrl offset.
  */
 #define HWMOD_OMAP4_NO_CONTEXT_LOSS_BIT         (1 << 0)
+#define HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET         (1 << 1)
 
 /**
  * struct omap_hwmod_omap4_prcm - OMAP4-specific PRCM data
diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
index 55c5878577f4..e2d84aa7f595 100644
--- a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
@@ -29,6 +29,7 @@
 #define CLKCTRL(oh, clkctrl) ((oh).prcm.omap4.clkctrl_offs = (clkctrl))
 #define RSTCTRL(oh, rstctrl) ((oh).prcm.omap4.rstctrl_offs = (rstctrl))
 #define RSTST(oh, rstst) ((oh).prcm.omap4.rstst_offs = (rstst))
+#define PRCM_FLAGS(oh, flag) ((oh).prcm.omap4.flags = (flag))
 
 /*
  * 'l3' class
@@ -1296,6 +1297,7 @@ static void omap_hwmod_am33xx_clkctrl(void)
         CLKCTRL(am33xx_i2c1_hwmod, AM33XX_CM_WKUP_I2C0_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_wd_timer1_hwmod, AM33XX_CM_WKUP_WDT1_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_rtc_hwmod, AM33XX_CM_RTC_RTC_CLKCTRL_OFFSET);
+        PRCM_FLAGS(am33xx_rtc_hwmod, HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_mmc2_hwmod, AM33XX_CM_PER_MMC2_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_gpmc_hwmod, AM33XX_CM_PER_GPMC_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_l4_ls_hwmod, AM33XX_CM_PER_L4LS_CLKCTRL_OFFSET);
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index d72ee6185d5e..1cc4a6f3954e 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -722,8 +722,20 @@ static struct omap_hwmod omap3xxx_dss_dispc_hwmod = {
  * display serial interface controller
  */
 
+static struct omap_hwmod_class_sysconfig omap3xxx_dsi_sysc = {
+        .rev_offs       = 0x0000,
+        .sysc_offs      = 0x0010,
+        .syss_offs      = 0x0014,
+        .sysc_flags     = (SYSC_HAS_AUTOIDLE | SYSC_HAS_CLOCKACTIVITY |
+                           SYSC_HAS_ENAWAKEUP | SYSC_HAS_SIDLEMODE |
+                           SYSC_HAS_SOFTRESET | SYSS_HAS_RESET_STATUS),
+        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
+        .sysc_fields    = &omap_hwmod_sysc_type1,
+};
+
 static struct omap_hwmod_class omap3xxx_dsi_hwmod_class = {
         .name = "dsi",
+        .sysc   = &omap3xxx_dsi_sysc,
 };
 
 static struct omap_hwmod_irq_info omap3xxx_dsi1_irqs[] = {
diff --git a/arch/arm/mach-pxa/idp.c b/arch/arm/mach-pxa/idp.c
index c410d84b243d..66070acaa888 100644
--- a/arch/arm/mach-pxa/idp.c
+++ b/arch/arm/mach-pxa/idp.c
@@ -83,7 +83,8 @@ static struct resource smc91x_resources[] = {
 };
 
 static struct smc91x_platdata smc91x_platdata = {
-        .flags = SMC91X_USE_32BIT | SMC91X_USE_DMA | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                 SMC91X_USE_DMA | SMC91X_NOWAIT,
 };
 
 static struct platform_device smc91x_device = {
diff --git a/arch/arm/mach-pxa/xcep.c b/arch/arm/mach-pxa/xcep.c
index 3f06cd90567a..056369ef250e 100644
--- a/arch/arm/mach-pxa/xcep.c
+++ b/arch/arm/mach-pxa/xcep.c
@@ -120,7 +120,8 @@ static struct resource smc91x_resources[] = {
 };
 
 static struct smc91x_platdata xcep_smc91x_info = {
-        .flags  = SMC91X_USE_32BIT | SMC91X_NOWAIT | SMC91X_USE_DMA,
+        .flags  = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                  SMC91X_NOWAIT | SMC91X_USE_DMA,
 };
 
 static struct platform_device smc91x_device = {
diff --git a/arch/arm/mach-realview/core.c b/arch/arm/mach-realview/core.c
index baf174542e36..a0ead0ae23d6 100644
--- a/arch/arm/mach-realview/core.c
+++ b/arch/arm/mach-realview/core.c
@@ -93,7 +93,8 @@ static struct smsc911x_platform_config smsc911x_config = {
 };
 
 static struct smc91x_platdata smc91x_platdata = {
-        .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                 SMC91X_NOWAIT,
 };
 
 static struct platform_device realview_eth_device = {
diff --git a/arch/arm/mach-sa1100/clock.c b/arch/arm/mach-sa1100/clock.c
index cbf53bb9c814..0db46895c82a 100644
--- a/arch/arm/mach-sa1100/clock.c
+++ b/arch/arm/mach-sa1100/clock.c
@@ -125,6 +125,8 @@ static unsigned long clk_36864_get_rate(struct clk *clk)
 }
 
 static struct clkops clk_36864_ops = {
+        .enable         = clk_cpu_enable,
+        .disable        = clk_cpu_disable,
         .get_rate       = clk_36864_get_rate,
 };
 
@@ -140,9 +142,8 @@ static struct clk_lookup sa11xx_clkregs[] = {
         CLKDEV_INIT(NULL, "OSTIMER0", &clk_36864),
 };
 
-static int __init sa11xx_clk_init(void)
+int __init sa11xx_clk_init(void)
 {
         clkdev_add_table(sa11xx_clkregs, ARRAY_SIZE(sa11xx_clkregs));
         return 0;
 }
-core_initcall(sa11xx_clk_init);
diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
index 345e63f4eb71..3e09beddb6e8 100644
--- a/arch/arm/mach-sa1100/generic.c
+++ b/arch/arm/mach-sa1100/generic.c
@@ -34,6 +34,7 @@
 
 #include <mach/hardware.h>
 #include <mach/irqs.h>
+#include <mach/reset.h>
 
 #include "generic.h"
 #include <clocksource/pxa.h>
@@ -95,6 +96,8 @@ static void sa1100_power_off(void)
 
 void sa11x0_restart(enum reboot_mode mode, const char *cmd)
 {
+        clear_reset_status(RESET_STATUS_ALL);
+
         if (mode == REBOOT_SOFT) {
                 /* Jump into ROM at address 0 */
                 soft_restart(0);
@@ -388,6 +391,7 @@ void __init sa1100_init_irq(void)
         sa11x0_init_irq_nodt(IRQ_GPIO0_SC, irq_resource.start);
 
         sa1100_init_gpio();
+        sa11xx_clk_init();
 }
 
 /*
diff --git a/arch/arm/mach-sa1100/generic.h b/arch/arm/mach-sa1100/generic.h
index 0d92e119b36b..68199b603ff7 100644
--- a/arch/arm/mach-sa1100/generic.h
+++ b/arch/arm/mach-sa1100/generic.h
@@ -44,3 +44,5 @@ int sa11x0_pm_init(void);
 #else
 static inline int sa11x0_pm_init(void) { return 0; }
 #endif
+
+int sa11xx_clk_init(void);
diff --git a/arch/arm/mach-sa1100/pleb.c b/arch/arm/mach-sa1100/pleb.c
index 1525d7b5f1b7..88149f85bc49 100644
--- a/arch/arm/mach-sa1100/pleb.c
+++ b/arch/arm/mach-sa1100/pleb.c
@@ -45,7 +45,7 @@ static struct resource smc91x_resources[] = {
 };
 
 static struct smc91x_platdata smc91x_platdata = {
-        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_16BIT | SMC91X_USE_8BIT | SMC91X_NOWAIT,
 };
 
 static struct platform_device smc91x_device = {
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index a7123b4e129d..d00d52c9de3e 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -16,6 +16,7 @@
 #include <asm/hwcap.h>
 #include <asm/pgtable-hwdef.h>
 #include <asm/pgtable.h>
+#include <asm/memory.h>
 
 #include "proc-macros.S"
 
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index b0b82f5ea338..f193414d0f6f 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -50,7 +50,7 @@ DEFINE_PER_CPU(struct vcpu_info *, xen_vcpu);
 static struct vcpu_info __percpu *xen_vcpu_info;
 
 /* Linux <-> Xen vCPU id mapping */
-DEFINE_PER_CPU(int, xen_vcpu_id) = -1;
+DEFINE_PER_CPU(uint32_t, xen_vcpu_id);
 EXPORT_PER_CPU_SYMBOL(xen_vcpu_id);
 
 /* These are unused until we support booting "pre-ballooned" */
@@ -170,9 +170,6 @@ static int xen_starting_cpu(unsigned int cpu)
         pr_info("Xen: initializing cpu%d\n", cpu);
         vcpup = per_cpu_ptr(xen_vcpu_info, cpu);
 
-        /* Direct vCPU id mapping for ARM guests. */
-        per_cpu(xen_vcpu_id, cpu) = cpu;
-
         info.mfn = virt_to_gfn(vcpup);
         info.offset = xen_offset_in_page(vcpup);
 
@@ -330,6 +327,7 @@ static int __init xen_guest_init(void)
 {
         struct xen_add_to_physmap xatp;
         struct shared_info *shared_info_page = NULL;
+        int cpu;
 
         if (!xen_domain())
                 return 0;
@@ -380,7 +378,8 @@ static int __init xen_guest_init(void)
                 return -ENOMEM;
 
         /* Direct vCPU id mapping for ARM guests. */
-        per_cpu(xen_vcpu_id, 0) = 0;
+        for_each_possible_cpu(cpu)
+                per_cpu(xen_vcpu_id, cpu) = cpu;
 
         xen_auto_xlat_grant_frames.count = gnttab_max_grant_frames();
         if (xen_xlate_map_ballooned_pages(&xen_auto_xlat_grant_frames.pfn,
diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
index d02a900378e1..4f44d1191bfd 100644
--- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
@@ -270,6 +270,8 @@
                 #io-channel-cells = <1>;
                 clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
                 clock-names = "saradc", "apb_pclk";
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                 status = "disabled";
         };
 
diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
index 0a456bef8c79..2fee2f59288c 100644
--- a/arch/arm64/include/asm/percpu.h
+++ b/arch/arm64/include/asm/percpu.h
@@ -199,19 +199,19 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
 #define _percpu_read(pcp)                                               \
 ({                                                                      \
         typeof(pcp) __retval;                                           \
-        preempt_disable();                                              \
+        preempt_disable_notrace();                                      \
         __retval = (typeof(pcp))__percpu_read(raw_cpu_ptr(&(pcp)),      \
                                               sizeof(pcp));             \
-        preempt_enable();                                               \
+        preempt_enable_notrace();                                       \
         __retval;                                                       \
 })
 
 #define _percpu_write(pcp, val)                                         \
 do {                                                                    \
-        preempt_disable();                                              \
+        preempt_disable_notrace();                                      \
         __percpu_write(raw_cpu_ptr(&(pcp)), (unsigned long)(val),       \
                                 sizeof(pcp));                           \
-        preempt_enable();                                               \
+        preempt_enable_notrace();                                       \
 } while(0)                                                              \
 
 #define _pcp_protect(operation, pcp, val)                       \
diff --git a/arch/arm64/include/asm/spinlock.h b/arch/arm64/include/asm/spinlock.h
index e875a5a551d7..89206b568cd4 100644
--- a/arch/arm64/include/asm/spinlock.h
+++ b/arch/arm64/include/asm/spinlock.h
@@ -363,4 +363,14 @@ static inline int arch_read_trylock(arch_rwlock_t *rw)
 #define arch_read_relax(lock)   cpu_relax()
 #define arch_write_relax(lock)  cpu_relax()
 
+/*
+ * Accesses appearing in program order before a spin_lock() operation
+ * can be reordered with accesses inside the critical section, by virtue
+ * of arch_spin_lock being constructed using acquire semantics.
+ *
+ * In cases where this is problematic (e.g. try_to_wake_up), an
+ * smp_mb__before_spinlock() can restore the required ordering.
+ */
+#define smp_mb__before_spinlock()       smp_mb()
+
 #endif /* __ASM_SPINLOCK_H */
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index b77f58355da1..3e7b050e99dc 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -757,6 +757,9 @@ ENTRY(__enable_mmu)
         isb
         bl      __create_page_tables            // recreate kernel mapping
 
+        tlbi    vmalle1                         // Remove any stale TLB entries
+        dsb     nsh
+
         msr     sctlr_el1, x19                  // re-enable the MMU
         isb
         ic      iallu                           // flush instructions fetched
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index ae7855f16ec2..5a84b4562603 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -256,7 +256,7 @@ static int __hyp_text __guest_run(struct kvm_vcpu *vcpu)
 
         /*
          * We must restore the 32-bit state before the sysregs, thanks
-         * to Cortex-A57 erratum #852523.
+         * to erratum #852523 (Cortex-A57) or #853709 (Cortex-A72).
          */
         __sysreg32_restore_state(vcpu);
         __sysreg_restore_guest_state(guest_ctxt);
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index b0b225ceca18..e51367d159d0 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -823,14 +823,6 @@ static bool access_pmuserenr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
  * Architected system registers.
  * Important: Must be sorted ascending by Op0, Op1, CRn, CRm, Op2
  *
- * We could trap ID_DFR0 and tell the guest we don't support performance
- * monitoring.  Unfortunately the patch to make the kernel check ID_DFR0 was
- * NAKed, so it will read the PMCR anyway.
- *
- * Therefore we tell the guest we have 0 counters.  Unfortunately, we
- * must always support PMCCNTR (the cycle counter): we just RAZ/WI for
- * all PM registers, which doesn't crash the guest kernel at least.
- *
  * Debug handling: We do trap most, if not all debug related system
  * registers. The implementation is good enough to ensure that a guest
  * can use these with minimal performance degradation. The drawback is
@@ -1360,7 +1352,7 @@ static const struct sys_reg_desc cp15_regs[] = {
         { Op1( 0), CRn(10), CRm( 3), Op2( 1), access_vm_reg, NULL, c10_AMAIR1 },
 
         /* ICC_SRE */
-        { Op1( 0), CRn(12), CRm(12), Op2( 5), trap_raz_wi },
+        { Op1( 0), CRn(12), CRm(12), Op2( 5), access_gic_sre },
 
         { Op1( 0), CRn(13), CRm( 0), Op2( 1), access_vm_reg, NULL, c13_CID },
 
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 5bb61de23201..9d37e967fa19 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -100,7 +100,16 @@ ENTRY(cpu_do_resume)
 
         msr     tcr_el1, x8
         msr     vbar_el1, x9
+
+        /*
+         * __cpu_setup() cleared MDSCR_EL1.MDE and friends, before unmasking
+         * debug exceptions. By restoring MDSCR_EL1 here, we may take a debug
+         * exception. Mask them until local_dbg_restore() in cpu_suspend()
+         * resets them.
+         */
+        disable_dbg
         msr     mdscr_el1, x10
+
         msr     sctlr_el1, x12
         /*
          * Restore oslsr_el1 by writing oslar_el1
diff --git a/arch/avr32/include/asm/uaccess.h b/arch/avr32/include/asm/uaccess.h
index 68cf638faf48..b1ec1fa06463 100644
--- a/arch/avr32/include/asm/uaccess.h
+++ b/arch/avr32/include/asm/uaccess.h
@@ -74,7 +74,7 @@ extern __kernel_size_t __copy_user(void *to, const void *from,
 
 extern __kernel_size_t copy_to_user(void __user *to, const void *from,
                                     __kernel_size_t n);
-extern __kernel_size_t copy_from_user(void *to, const void __user *from,
+extern __kernel_size_t ___copy_from_user(void *to, const void __user *from,
                                       __kernel_size_t n);
 
 static inline __kernel_size_t __copy_to_user(void __user *to, const void *from,
@@ -88,6 +88,15 @@ static inline __kernel_size_t __copy_from_user(void *to,
 {
         return __copy_user(to, (const void __force *)from, n);
 }
+static inline __kernel_size_t copy_from_user(void *to,
+                                               const void __user *from,
+                                               __kernel_size_t n)
+{
+        size_t res = ___copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
+}
 
 #define __copy_to_user_inatomic __copy_to_user
 #define __copy_from_user_inatomic __copy_from_user
diff --git a/arch/avr32/kernel/avr32_ksyms.c b/arch/avr32/kernel/avr32_ksyms.c
index d93ead02daed..7c6cf14f0985 100644
--- a/arch/avr32/kernel/avr32_ksyms.c
+++ b/arch/avr32/kernel/avr32_ksyms.c
@@ -36,7 +36,7 @@ EXPORT_SYMBOL(copy_page);
 /*
  * Userspace access stuff.
  */
-EXPORT_SYMBOL(copy_from_user);
+EXPORT_SYMBOL(___copy_from_user);
 EXPORT_SYMBOL(copy_to_user);
 EXPORT_SYMBOL(__copy_user);
 EXPORT_SYMBOL(strncpy_from_user);
diff --git a/arch/avr32/lib/copy_user.S b/arch/avr32/lib/copy_user.S
index ea59c04b07de..96a6de9d578f 100644
--- a/arch/avr32/lib/copy_user.S
+++ b/arch/avr32/lib/copy_user.S
@@ -25,11 +25,11 @@
         .align  1
         .global copy_from_user
         .type   copy_from_user, @function
-copy_from_user:
+___copy_from_user:
         branch_if_kernel r8, __copy_user
         ret_if_privileged r8, r11, r10, r10
         rjmp    __copy_user
-        .size   copy_from_user, . - copy_from_user
+        .size   ___copy_from_user, . - ___copy_from_user
 
         .global copy_to_user
         .type   copy_to_user, @function
diff --git a/arch/blackfin/include/asm/uaccess.h b/arch/blackfin/include/asm/uaccess.h
index 12f5d6851bbc..0a2a70096d8b 100644
--- a/arch/blackfin/include/asm/uaccess.h
+++ b/arch/blackfin/include/asm/uaccess.h
@@ -171,11 +171,12 @@ static inline int bad_user_access_length(void)
 static inline unsigned long __must_check
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        if (access_ok(VERIFY_READ, from, n))
+        if (likely(access_ok(VERIFY_READ, from, n))) {
                 memcpy(to, (const void __force *)from, n);
-        else
-                return n;
-        return 0;
+                return 0;
+        }
+        memset(to, 0, n);
+        return n;
 }
 
 static inline unsigned long __must_check
diff --git a/arch/blackfin/mach-bf561/boards/cm_bf561.c b/arch/blackfin/mach-bf561/boards/cm_bf561.c
index c6db52ba3a06..10c57771822d 100644
--- a/arch/blackfin/mach-bf561/boards/cm_bf561.c
+++ b/arch/blackfin/mach-bf561/boards/cm_bf561.c
@@ -146,7 +146,8 @@ static struct platform_device hitachi_fb_device = {
 #include <linux/smc91x.h>
 
 static struct smc91x_platdata smc91x_info = {
-        .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                 SMC91X_NOWAIT,
         .leda = RPC_LED_100_10,
         .ledb = RPC_LED_TX_RX,
 };
diff --git a/arch/blackfin/mach-bf561/boards/ezkit.c b/arch/blackfin/mach-bf561/boards/ezkit.c
index f35525b55819..57d1c43726d9 100644
--- a/arch/blackfin/mach-bf561/boards/ezkit.c
+++ b/arch/blackfin/mach-bf561/boards/ezkit.c
@@ -134,7 +134,8 @@ static struct platform_device net2272_bfin_device = {
 #include <linux/smc91x.h>
 
 static struct smc91x_platdata smc91x_info = {
-        .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                 SMC91X_NOWAIT,
         .leda = RPC_LED_100_10,
         .ledb = RPC_LED_TX_RX,
 };
diff --git a/arch/cris/include/asm/uaccess.h b/arch/cris/include/asm/uaccess.h
index e3530d0f13ee..56c7d5750abd 100644
--- a/arch/cris/include/asm/uaccess.h
+++ b/arch/cris/include/asm/uaccess.h
@@ -194,30 +194,6 @@ extern unsigned long __copy_user(void __user *to, const void *from, unsigned lon
 extern unsigned long __copy_user_zeroing(void *to, const void __user *from, unsigned long n);
 extern unsigned long __do_clear_user(void __user *to, unsigned long n);
 
-static inline unsigned long
-__generic_copy_to_user(void __user *to, const void *from, unsigned long n)
-{
-        if (access_ok(VERIFY_WRITE, to, n))
-                return __copy_user(to, from, n);
-        return n;
-}
-
-static inline unsigned long
-__generic_copy_from_user(void *to, const void __user *from, unsigned long n)
-{
-        if (access_ok(VERIFY_READ, from, n))
-                return __copy_user_zeroing(to, from, n);
-        return n;
-}
-
-static inline unsigned long
-__generic_clear_user(void __user *to, unsigned long n)
-{
-        if (access_ok(VERIFY_WRITE, to, n))
-                return __do_clear_user(to, n);
-        return n;
-}
-
 static inline long
 __strncpy_from_user(char *dst, const char __user *src, long count)
 {
@@ -282,7 +258,7 @@ __constant_copy_from_user(void *to, const void __user *from, unsigned long n)
         else if (n == 24)
                 __asm_copy_from_user_24(to, from, ret);
         else
-                ret = __generic_copy_from_user(to, from, n);
+                ret = __copy_user_zeroing(to, from, n);
 
         return ret;
 }
@@ -333,7 +309,7 @@ __constant_copy_to_user(void __user *to, const void *from, unsigned long n)
         else if (n == 24)
                 __asm_copy_to_user_24(to, from, ret);
         else
-                ret = __generic_copy_to_user(to, from, n);
+                ret = __copy_user(to, from, n);
 
         return ret;
 }
@@ -366,26 +342,43 @@ __constant_clear_user(void __user *to, unsigned long n)
         else if (n == 24)
                 __asm_clear_24(to, ret);
         else
-                ret = __generic_clear_user(to, n);
+                ret = __do_clear_user(to, n);
 
         return ret;
 }
 
 
-#define clear_user(to, n)                               \
-        (__builtin_constant_p(n) ?                      \
-         __constant_clear_user(to, n) :                 \
-         __generic_clear_user(to, n))
+static inline size_t clear_user(void __user *to, size_t n)
+{
+        if (unlikely(!access_ok(VERIFY_WRITE, to, n)))
+                return n;
+        if (__builtin_constant_p(n))
+                return __constant_clear_user(to, n);
+        else
+                return __do_clear_user(to, n);
+}
 
-#define copy_from_user(to, from, n)                     \
-        (__builtin_constant_p(n) ?                      \
-         __constant_copy_from_user(to, from, n) :       \
-         __generic_copy_from_user(to, from, n))
+static inline size_t copy_from_user(void *to, const void __user *from, size_t n)
+{
+        if (unlikely(!access_ok(VERIFY_READ, from, n))) {
+                memset(to, 0, n);
+                return n;
+        }
+        if (__builtin_constant_p(n))
+                return __constant_copy_from_user(to, from, n);
+        else
+                return __copy_user_zeroing(to, from, n);
+}
 
-#define copy_to_user(to, from, n)                       \
-        (__builtin_constant_p(n) ?                      \
-         __constant_copy_to_user(to, from, n) :         \
-         __generic_copy_to_user(to, from, n))
+static inline size_t copy_to_user(void __user *to, const void *from, size_t n)
+{
+        if (unlikely(!access_ok(VERIFY_WRITE, to, n)))
+                return n;
+        if (__builtin_constant_p(n))
+                return __constant_copy_to_user(to, from, n);
+        else
+                return __copy_user(to, from, n);
+}
 
 /* We let the __ versions of copy_from/to_user inline, because they're often
  * used in fast paths and have only a small space overhead.
diff --git a/arch/frv/include/asm/uaccess.h b/arch/frv/include/asm/uaccess.h
index 3ac9a59d65d4..87d9e34c5df8 100644
--- a/arch/frv/include/asm/uaccess.h
+++ b/arch/frv/include/asm/uaccess.h
@@ -263,19 +263,25 @@ do {							\
 extern long __memset_user(void *dst, unsigned long count);
 extern long __memcpy_user(void *dst, const void *src, unsigned long count);
 
-#define clear_user(dst,count)                   __memset_user(____force(dst), (count))
+#define __clear_user(dst,count)                 __memset_user(____force(dst), (count))
 #define __copy_from_user_inatomic(to, from, n)  __memcpy_user((to), ____force(from), (n))
 #define __copy_to_user_inatomic(to, from, n)    __memcpy_user(____force(to), (from), (n))
 
 #else
 
-#define clear_user(dst,count)                   (memset(____force(dst), 0, (count)), 0)
+#define __clear_user(dst,count)                 (memset(____force(dst), 0, (count)), 0)
 #define __copy_from_user_inatomic(to, from, n)  (memcpy((to), ____force(from), (n)), 0)
 #define __copy_to_user_inatomic(to, from, n)    (memcpy(____force(to), (from), (n)), 0)
 
 #endif
 
-#define __clear_user clear_user
+static inline unsigned long __must_check
+clear_user(void __user *to, unsigned long n)
+{
+        if (likely(__access_ok(to, n)))
+                n = __clear_user(to, n);
+        return n;
+}
 
 static inline unsigned long __must_check
 __copy_to_user(void __user *to, const void *from, unsigned long n)
diff --git a/arch/hexagon/include/asm/uaccess.h b/arch/hexagon/include/asm/uaccess.h
index f000a382bc7f..f61cfb28e9f2 100644
--- a/arch/hexagon/include/asm/uaccess.h
+++ b/arch/hexagon/include/asm/uaccess.h
@@ -103,7 +103,8 @@ static inline long hexagon_strncpy_from_user(char *dst, const char __user *src,
 {
         long res = __strnlen_user(src, n);
 
-        /* return from strnlen can't be zero -- that would be rubbish. */
+        if (unlikely(!res))
+                return -EFAULT;
 
         if (res > n) {
                 copy_from_user(dst, src, n);
diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
index 465c70982f40..bfe13196f770 100644
--- a/arch/ia64/include/asm/uaccess.h
+++ b/arch/ia64/include/asm/uaccess.h
@@ -241,8 +241,7 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
 static inline unsigned long
 __copy_to_user (void __user *to, const void *from, unsigned long count)
 {
-        if (!__builtin_constant_p(count))
-                check_object_size(from, count, true);
+        check_object_size(from, count, true);
 
         return __copy_user(to, (__force void __user *) from, count);
 }
@@ -250,8 +249,7 @@ __copy_to_user (void __user *to, const void *from, unsigned long count)
 static inline unsigned long
 __copy_from_user (void *to, const void __user *from, unsigned long count)
 {
-        if (!__builtin_constant_p(count))
-                check_object_size(to, count, false);
+        check_object_size(to, count, false);
 
         return __copy_user((__force void __user *) to, from, count);
 }
@@ -265,27 +263,22 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
         long __cu_len = (n);                                                            \
                                                                                         \
         if (__access_ok(__cu_to, __cu_len, get_fs())) {                                 \
-                if (!__builtin_constant_p(n))                                           \
-                        check_object_size(__cu_from, __cu_len, true);                   \
+                check_object_size(__cu_from, __cu_len, true);                   \
                 __cu_len = __copy_user(__cu_to, (__force void __user *)  __cu_from, __cu_len);  \
         }                                                                               \
         __cu_len;                                                                       \
 })
 
-#define copy_from_user(to, from, n)                                                     \
-({                                                                                      \
-        void *__cu_to = (to);                                                           \
-        const void __user *__cu_from = (from);                                          \
-        long __cu_len = (n);                                                            \
-                                                                                        \
-        __chk_user_ptr(__cu_from);                                                      \
-        if (__access_ok(__cu_from, __cu_len, get_fs())) {                               \
-                if (!__builtin_constant_p(n))                                           \
-                        check_object_size(__cu_to, __cu_len, false);                    \
-                __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);   \
-        }                                                                               \
-        __cu_len;                                                                       \
-})
+static inline unsigned long
+copy_from_user(void *to, const void __user *from, unsigned long n)
+{
+        check_object_size(to, n, false);
+        if (likely(__access_ok(from, n, get_fs())))
+                n = __copy_user((__force void __user *) to, from, n);
+        else
+                memset(to, 0, n);
+        return n;
+}
 
 #define __copy_in_user(to, from, size)  __copy_user((to), (from), (size))
 
diff --git a/arch/m32r/include/asm/uaccess.h b/arch/m32r/include/asm/uaccess.h
index cac7014daef3..6f8982157a75 100644
--- a/arch/m32r/include/asm/uaccess.h
+++ b/arch/m32r/include/asm/uaccess.h
@@ -219,7 +219,7 @@ extern int fixup_exception(struct pt_regs *regs);
 #define __get_user_nocheck(x, ptr, size)                                \
 ({                                                                      \
         long __gu_err = 0;                                              \
-        unsigned long __gu_val;                                         \
+        unsigned long __gu_val = 0;                                     \
         might_fault();                                                  \
         __get_user_size(__gu_val, (ptr), (size), __gu_err);             \
         (x) = (__force __typeof__(*(ptr)))__gu_val;                     \
diff --git a/arch/metag/include/asm/uaccess.h b/arch/metag/include/asm/uaccess.h
index 8282cbce7e39..273e61225c27 100644
--- a/arch/metag/include/asm/uaccess.h
+++ b/arch/metag/include/asm/uaccess.h
@@ -204,8 +204,9 @@ extern unsigned long __must_check __copy_user_zeroing(void *to,
 static inline unsigned long
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        if (access_ok(VERIFY_READ, from, n))
+        if (likely(access_ok(VERIFY_READ, from, n)))
                 return __copy_user_zeroing(to, from, n);
+        memset(to, 0, n);
         return n;
 }
 
diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h
index 331b0d35f89c..826676778094 100644
--- a/arch/microblaze/include/asm/uaccess.h
+++ b/arch/microblaze/include/asm/uaccess.h
@@ -227,7 +227,7 @@ extern long __user_bad(void);
 
 #define __get_user(x, ptr)                                              \
 ({                                                                      \
-        unsigned long __gu_val;                                         \
+        unsigned long __gu_val = 0;                                     \
         /*unsigned long __gu_ptr = (unsigned long)(ptr);*/              \
         long __gu_err;                                                  \
         switch (sizeof(*(ptr))) {                                       \
@@ -373,10 +373,13 @@ extern long __user_bad(void);
 static inline long copy_from_user(void *to,
                 const void __user *from, unsigned long n)
 {
+        unsigned long res = n;
         might_fault();
-        if (access_ok(VERIFY_READ, from, n))
-                return __copy_from_user(to, from, n);
-        return n;
+        if (likely(access_ok(VERIFY_READ, from, n)))
+                res = __copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
 #define __copy_to_user(to, from, n)     \
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index ea0cd9773914..5f987598054f 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -164,7 +164,7 @@ typedef struct { unsigned long pgprot; } pgprot_t;
  */
 static inline unsigned long ___pa(unsigned long x)
 {
-        if (config_enabled(CONFIG_64BIT)) {
+        if (IS_ENABLED(CONFIG_64BIT)) {
                 /*
                  * For MIPS64 the virtual address may either be in one of
                  * the compatibility segements ckseg0 or ckseg1, or it may
@@ -173,7 +173,7 @@ static inline unsigned long ___pa(unsigned long x)
                 return x < CKSEG0 ? XPHYSADDR(x) : CPHYSADDR(x);
         }
 
-        if (!config_enabled(CONFIG_EVA)) {
+        if (!IS_ENABLED(CONFIG_EVA)) {
                 /*
                  * We're using the standard MIPS32 legacy memory map, ie.
                  * the address x is going to be in kseg0 or kseg1. We can
diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
index 11b965f98d95..21a2aaba20d5 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -14,6 +14,7 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/thread_info.h>
+#include <linux/string.h>
 #include <asm/asm-eva.h>
 
 /*
@@ -1170,6 +1171,8 @@ extern size_t __copy_in_user_eva(void *__to, const void *__from, size_t __n);
                         __cu_len = __invoke_copy_from_user(__cu_to,     \
                                                            __cu_from,   \
                                                            __cu_len);   \
+                } else {                                                \
+                        memset(__cu_to, 0, __cu_len);                   \
                 }                                                       \
         }                                                               \
         __cu_len;                                                       \
diff --git a/arch/mips/kvm/mmu.c b/arch/mips/kvm/mmu.c
index 6cfdcf55572d..121008c0fcc9 100644
--- a/arch/mips/kvm/mmu.c
+++ b/arch/mips/kvm/mmu.c
@@ -40,7 +40,7 @@ static int kvm_mips_map_page(struct kvm *kvm, gfn_t gfn)
         srcu_idx = srcu_read_lock(&kvm->srcu);
         pfn = gfn_to_pfn(kvm, gfn);
 
-        if (is_error_pfn(pfn)) {
+        if (is_error_noslot_pfn(pfn)) {
                 kvm_err("Couldn't get pfn for gfn %#llx!\n", gfn);
                 err = -EFAULT;
                 goto out;
diff --git a/arch/mn10300/include/asm/uaccess.h b/arch/mn10300/include/asm/uaccess.h
index 20f7bf6de384..d012e877a95a 100644
--- a/arch/mn10300/include/asm/uaccess.h
+++ b/arch/mn10300/include/asm/uaccess.h
@@ -166,6 +166,7 @@ struct __large_struct { unsigned long buf[100]; };
                 "2:\n"                                          \
                 "       .section        .fixup,\"ax\"\n"        \
                 "3:\n\t"                                        \
+                "       mov             0,%1\n"                 \
                 "       mov             %3,%0\n"                \
                 "       jmp             2b\n"                   \
                 "       .previous\n"                            \
diff --git a/arch/mn10300/lib/usercopy.c b/arch/mn10300/lib/usercopy.c
index 7826e6c364e7..ce8899e5e171 100644
--- a/arch/mn10300/lib/usercopy.c
+++ b/arch/mn10300/lib/usercopy.c
@@ -9,7 +9,7 @@
  * as published by the Free Software Foundation; either version
  * 2 of the Licence, or (at your option) any later version.
  */
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 unsigned long
 __generic_copy_to_user(void *to, const void *from, unsigned long n)
@@ -24,6 +24,8 @@ __generic_copy_from_user(void *to, const void *from, unsigned long n)
 {
         if (access_ok(VERIFY_READ, from, n))
                 __copy_user_zeroing(to, from, n);
+        else
+                memset(to, 0, n);
         return n;
 }
 
diff --git a/arch/nios2/include/asm/uaccess.h b/arch/nios2/include/asm/uaccess.h
index caa51ff85a3c..0ab82324c817 100644
--- a/arch/nios2/include/asm/uaccess.h
+++ b/arch/nios2/include/asm/uaccess.h
@@ -102,9 +102,12 @@ extern long __copy_to_user(void __user *to, const void *from, unsigned long n);
 static inline long copy_from_user(void *to, const void __user *from,
                                 unsigned long n)
 {
-        if (!access_ok(VERIFY_READ, from, n))
-                return n;
-        return __copy_from_user(to, from, n);
+        unsigned long res = n;
+        if (access_ok(VERIFY_READ, from, n))
+                res = __copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
 static inline long copy_to_user(void __user *to, const void *from,
@@ -139,7 +142,7 @@ extern long strnlen_user(const char __user *s, long n);
 
 #define __get_user_unknown(val, size, ptr, err) do {                    \
         err = 0;                                                        \
-        if (copy_from_user(&(val), ptr, size)) {                        \
+        if (__copy_from_user(&(val), ptr, size)) {                      \
                 err = -EFAULT;                                          \
         }                                                               \
         } while (0)
@@ -166,7 +169,7 @@ do {									\
         ({                                                              \
         long __gu_err = -EFAULT;                                        \
         const __typeof__(*(ptr)) __user *__gu_ptr = (ptr);              \
-        unsigned long __gu_val;                                         \
+        unsigned long __gu_val = 0;                                     \
         __get_user_common(__gu_val, sizeof(*(ptr)), __gu_ptr, __gu_err);\
         (x) = (__force __typeof__(x))__gu_val;                          \
         __gu_err;                                                       \
diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h
index a6bd07ca3d6c..cbad29b5a131 100644
--- a/arch/openrisc/include/asm/uaccess.h
+++ b/arch/openrisc/include/asm/uaccess.h
@@ -273,28 +273,20 @@ __copy_tofrom_user(void *to, const void *from, unsigned long size);
 static inline unsigned long
 copy_from_user(void *to, const void *from, unsigned long n)
 {
-        unsigned long over;
-
-        if (access_ok(VERIFY_READ, from, n))
-                return __copy_tofrom_user(to, from, n);
-        if ((unsigned long)from < TASK_SIZE) {
-                over = (unsigned long)from + n - TASK_SIZE;
-                return __copy_tofrom_user(to, from, n - over) + over;
-        }
-        return n;
+        unsigned long res = n;
+
+        if (likely(access_ok(VERIFY_READ, from, n)))
+                n = __copy_tofrom_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
 static inline unsigned long
 copy_to_user(void *to, const void *from, unsigned long n)
 {
-        unsigned long over;
-
-        if (access_ok(VERIFY_WRITE, to, n))
-                return __copy_tofrom_user(to, from, n);
-        if ((unsigned long)to < TASK_SIZE) {
-                over = (unsigned long)to + n - TASK_SIZE;
-                return __copy_tofrom_user(to, from, n - over) + over;
-        }
+        if (likely(access_ok(VERIFY_WRITE, to, n)))
+                n = __copy_tofrom_user(to, from, n);
         return n;
 }
 
@@ -303,13 +295,8 @@ extern unsigned long __clear_user(void *addr, unsigned long size);
 static inline __must_check unsigned long
 clear_user(void *addr, unsigned long size)
 {
-
-        if (access_ok(VERIFY_WRITE, addr, size))
-                return __clear_user(addr, size);
-        if ((unsigned long)addr < TASK_SIZE) {
-                unsigned long over = (unsigned long)addr + size - TASK_SIZE;
-                return __clear_user(addr, size - over) + over;
-        }
+        if (likely(access_ok(VERIFY_WRITE, addr, size)))
+                size = __clear_user(addr, size);
         return size;
 }
 
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index cd8778103165..af12c2db9bb8 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -1,6 +1,5 @@
 config PARISC
         def_bool y
-        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
         select ARCH_MIGHT_HAVE_PC_PARPORT
         select HAVE_IDE
         select HAVE_OPROFILE
diff --git a/arch/parisc/configs/c8000_defconfig b/arch/parisc/configs/c8000_defconfig
index 1a8f6f95689e..f6a4c016304b 100644
--- a/arch/parisc/configs/c8000_defconfig
+++ b/arch/parisc/configs/c8000_defconfig
@@ -245,7 +245,6 @@ CONFIG_DEBUG_RT_MUTEXES=y
 CONFIG_PROVE_RCU_DELAY=y
 CONFIG_DEBUG_BLOCK_EXT_DEVT=y
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_KEYS=y
 # CONFIG_CRYPTO_HW is not set
 CONFIG_FONTS=y
diff --git a/arch/parisc/configs/generic-64bit_defconfig b/arch/parisc/configs/generic-64bit_defconfig
index 7e0792658952..c564e6e1fa23 100644
--- a/arch/parisc/configs/generic-64bit_defconfig
+++ b/arch/parisc/configs/generic-64bit_defconfig
@@ -291,7 +291,6 @@ CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
 # CONFIG_SCHED_DEBUG is not set
 CONFIG_TIMER_STATS=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_ECB=m
 CONFIG_CRYPTO_PCBC=m
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
index 0f59fd9ca205..482847865dac 100644
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
@@ -10,6 +10,7 @@
 #include <asm-generic/uaccess-unaligned.h>
 
 #include <linux/bug.h>
+#include <linux/string.h>
 
 #define VERIFY_READ 0
 #define VERIFY_WRITE 1
@@ -208,26 +209,30 @@ unsigned long copy_in_user(void __user *dst, const void __user *src, unsigned lo
 #define __copy_to_user_inatomic __copy_to_user
 #define __copy_from_user_inatomic __copy_from_user
 
-extern void copy_from_user_overflow(void)
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-        __compiletime_error("copy_from_user() buffer size is not provably correct")
-#else
-        __compiletime_warning("copy_from_user() buffer size is not provably correct")
-#endif
-;
+extern void __compiletime_error("usercopy buffer size is too small")
+__bad_copy_user(void);
+
+static inline void copy_user_overflow(int size, unsigned long count)
+{
+        WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
+}
 
 static inline unsigned long __must_check copy_from_user(void *to,
                                           const void __user *from,
                                           unsigned long n)
 {
         int sz = __compiletime_object_size(to);
-        int ret = -EFAULT;
+        unsigned long ret = n;
 
-        if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n))
+        if (likely(sz == -1 || sz >= n))
                 ret = __copy_from_user(to, from, n);
-        else
-                copy_from_user_overflow();
+        else if (!__builtin_constant_p(n))
+                copy_user_overflow(sz, n);
+        else
+                __bad_copy_user();
 
+        if (unlikely(ret))
+                memset(to + (n - ret), 0, ret);
         return ret;
 }
 
diff --git a/arch/powerpc/include/asm/cputhreads.h b/arch/powerpc/include/asm/cputhreads.h
index 666bef4ebfae..9377bdf42eb8 100644
--- a/arch/powerpc/include/asm/cputhreads.h
+++ b/arch/powerpc/include/asm/cputhreads.h
@@ -3,6 +3,7 @@
 
 #ifndef __ASSEMBLY__
 #include <linux/cpumask.h>
+#include <asm/cpu_has_feature.h>
 
 /*
  * Mapping of threads to cores
diff --git a/arch/powerpc/include/asm/hmi.h b/arch/powerpc/include/asm/hmi.h
index 88b4901ac4ee..85b7a1a21e22 100644
--- a/arch/powerpc/include/asm/hmi.h
+++ b/arch/powerpc/include/asm/hmi.h
@@ -21,7 +21,7 @@
 #ifndef __ASM_PPC64_HMI_H__
 #define __ASM_PPC64_HMI_H__
 
-#ifdef CONFIG_PPC_BOOK3S_64
+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
 
 #define CORE_TB_RESYNC_REQ_BIT          63
 #define MAX_SUBCORE_PER_CORE            4
diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h
index 148303e7771f..6a6792bb39fb 100644
--- a/arch/powerpc/include/asm/paca.h
+++ b/arch/powerpc/include/asm/paca.h
@@ -183,11 +183,6 @@ struct paca_struct {
          */
         u16 in_mce;
         u8 hmi_event_available;          /* HMI event is available */
-        /*
-         * Bitmap for sibling subcore status. See kvm/book3s_hv_ras.c for
-         * more details
-         */
-        struct sibling_subcore_state *sibling_subcore_state;
 #endif
 
         /* Stuff for accurate time accounting */
@@ -202,6 +197,13 @@ struct paca_struct {
         struct kvmppc_book3s_shadow_vcpu shadow_vcpu;
 #endif
         struct kvmppc_host_state kvm_hstate;
+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
+        /*
+         * Bitmap for sibling subcore status. See kvm/book3s_hv_ras.c for
+         * more details
+         */
+        struct sibling_subcore_state *sibling_subcore_state;
+#endif
 #endif
 };
 
diff --git a/arch/powerpc/include/asm/pci-bridge.h b/arch/powerpc/include/asm/pci-bridge.h
index b5e88e4a171a..c0309c59bed8 100644
--- a/arch/powerpc/include/asm/pci-bridge.h
+++ b/arch/powerpc/include/asm/pci-bridge.h
@@ -301,6 +301,7 @@ extern void pci_process_bridge_OF_ranges(struct pci_controller *hose,
 /* Allocate & free a PCI host bridge structure */
 extern struct pci_controller *pcibios_alloc_controller(struct device_node *dev);
 extern void pcibios_free_controller(struct pci_controller *phb);
+extern void pcibios_free_controller_deferred(struct pci_host_bridge *bridge);
 
 #ifdef CONFIG_PCI
 extern int pcibios_vaddr_is_ioport(void __iomem *address);
diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
index c1dc6c14deb8..c266227fdd5b 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -308,40 +308,21 @@ extern unsigned long __copy_tofrom_user(void __user *to,
 static inline unsigned long copy_from_user(void *to,
                 const void __user *from, unsigned long n)
 {
-        unsigned long over;
-
-        if (access_ok(VERIFY_READ, from, n)) {
-                if (!__builtin_constant_p(n))
-                        check_object_size(to, n, false);
+        if (likely(access_ok(VERIFY_READ, from, n))) {
+                check_object_size(to, n, false);
                 return __copy_tofrom_user((__force void __user *)to, from, n);
         }
-        if ((unsigned long)from < TASK_SIZE) {
-                over = (unsigned long)from + n - TASK_SIZE;
-                if (!__builtin_constant_p(n - over))
-                        check_object_size(to, n - over, false);
-                return __copy_tofrom_user((__force void __user *)to, from,
-                                n - over) + over;
-        }
+        memset(to, 0, n);
         return n;
 }
 
 static inline unsigned long copy_to_user(void __user *to,
                 const void *from, unsigned long n)
 {
-        unsigned long over;
-
         if (access_ok(VERIFY_WRITE, to, n)) {
-                if (!__builtin_constant_p(n))
-                        check_object_size(from, n, true);
+                check_object_size(from, n, true);
                 return __copy_tofrom_user(to, (__force void __user *)from, n);
         }
-        if ((unsigned long)to < TASK_SIZE) {
-                over = (unsigned long)to + n - TASK_SIZE;
-                if (!__builtin_constant_p(n))
-                        check_object_size(from, n - over, true);
-                return __copy_tofrom_user(to, (__force void __user *)from,
-                                n - over) + over;
-        }
         return n;
 }
 
@@ -383,8 +364,7 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
                         return 0;
         }
 
-        if (!__builtin_constant_p(n))
-                check_object_size(to, n, false);
+        check_object_size(to, n, false);
 
         return __copy_tofrom_user((__force void __user *)to, from, n);
 }
@@ -412,8 +392,8 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
                 if (ret == 0)
                         return 0;
         }
-        if (!__builtin_constant_p(n))
-                check_object_size(from, n, true);
+
+        check_object_size(from, n, true);
 
         return __copy_tofrom_user(to, (__force const void __user *)from, n);
 }
@@ -439,10 +419,6 @@ static inline unsigned long clear_user(void __user *addr, unsigned long size)
         might_fault();
         if (likely(access_ok(VERIFY_WRITE, addr, size)))
                 return __clear_user(addr, size);
-        if ((unsigned long)addr < TASK_SIZE) {
-                unsigned long over = (unsigned long)addr + size - TASK_SIZE;
-                return __clear_user(addr, size - over) + over;
-        }
         return size;
 }
 
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index b2027a5cf508..fe4c075bcf50 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -41,7 +41,7 @@ obj-$(CONFIG_VDSO32)		+= vdso32/
 obj-$(CONFIG_HAVE_HW_BREAKPOINT)        += hw_breakpoint.o
 obj-$(CONFIG_PPC_BOOK3S_64)     += cpu_setup_ppc970.o cpu_setup_pa6t.o
 obj-$(CONFIG_PPC_BOOK3S_64)     += cpu_setup_power.o
-obj-$(CONFIG_PPC_BOOK3S_64)     += mce.o mce_power.o hmi.o
+obj-$(CONFIG_PPC_BOOK3S_64)     += mce.o mce_power.o
 obj-$(CONFIG_PPC_BOOK3E_64)     += exceptions-64e.o idle_book3e.o
 obj-$(CONFIG_PPC64)             += vdso64/
 obj-$(CONFIG_ALTIVEC)           += vecemu.o
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 6b8bc0dd09d4..5afd03e5e8b8 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -368,13 +368,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
 tabort_syscall:
         /* Firstly we need to enable TM in the kernel */
         mfmsr   r10
-        li      r13, 1
-        rldimi  r10, r13, MSR_TM_LG, 63-MSR_TM_LG
+        li      r9, 1
+        rldimi  r10, r9, MSR_TM_LG, 63-MSR_TM_LG
         mtmsrd  r10, 0
 
         /* tabort, this dooms the transaction, nothing else */
-        li      r13, (TM_CAUSE_SYSCALL|TM_CAUSE_PERSISTENT)
-        TABORT(R13)
+        li      r9, (TM_CAUSE_SYSCALL|TM_CAUSE_PERSISTENT)
+        TABORT(R9)
 
         /*
          * Return directly to userspace. We have corrupted user register state,
@@ -382,8 +382,8 @@ tabort_syscall:
          * resume after the tbegin of the aborted transaction with the
          * checkpointed register state.
          */
-        li      r13, MSR_RI
-        andc    r10, r10, r13
+        li      r9, MSR_RI
+        andc    r10, r10, r9
         mtmsrd  r10, 1
         mtspr   SPRN_SRR0, r11
         mtspr   SPRN_SRR1, r12
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index df6d45eb4115..bffec73dbffc 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -485,7 +485,23 @@ machine_check_fwnmi:
         EXCEPTION_PROLOG_0(PACA_EXMC)
 machine_check_pSeries_0:
         EXCEPTION_PROLOG_1(PACA_EXMC, KVMTEST, 0x200)
-        EXCEPTION_PROLOG_PSERIES_1(machine_check_common, EXC_STD)
+        /*
+         * The following is essentially EXCEPTION_PROLOG_PSERIES_1 with the
+         * difference that MSR_RI is not enabled, because PACA_EXMC is being
+         * used, so nested machine check corrupts it. machine_check_common
+         * enables MSR_RI.
+         */
+        ld      r12,PACAKBASE(r13)
+        ld      r10,PACAKMSR(r13)
+        xori    r10,r10,MSR_RI
+        mfspr   r11,SPRN_SRR0
+        LOAD_HANDLER(r12, machine_check_common)
+        mtspr   SPRN_SRR0,r12
+        mfspr   r12,SPRN_SRR1
+        mtspr   SPRN_SRR1,r10
+        rfid
+        b       .       /* prevent speculative execution */
+
         KVM_HANDLER_SKIP(PACA_EXMC, EXC_STD, 0x200)
         KVM_HANDLER_SKIP(PACA_EXGEN, EXC_STD, 0x300)
         KVM_HANDLER_SKIP(PACA_EXSLB, EXC_STD, 0x380)
@@ -969,14 +985,17 @@ ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_TYPE_RADIX)
 machine_check_common:
 
         mfspr   r10,SPRN_DAR
-        std     r10,PACA_EXGEN+EX_DAR(r13)
+        std     r10,PACA_EXMC+EX_DAR(r13)
         mfspr   r10,SPRN_DSISR
-        stw     r10,PACA_EXGEN+EX_DSISR(r13)
+        stw     r10,PACA_EXMC+EX_DSISR(r13)
         EXCEPTION_PROLOG_COMMON(0x200, PACA_EXMC)
         FINISH_NAP
         RECONCILE_IRQ_STATE(r10, r11)
-        ld      r3,PACA_EXGEN+EX_DAR(r13)
-        lwz     r4,PACA_EXGEN+EX_DSISR(r13)
+        ld      r3,PACA_EXMC+EX_DAR(r13)
+        lwz     r4,PACA_EXMC+EX_DSISR(r13)
+        /* Enable MSR_RI when finished with PACA_EXMC */
+        li      r10,MSR_RI
+        mtmsrd  r10,1
         std     r3,_DAR(r1)
         std     r4,_DSISR(r1)
         bl      save_nvgprs
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index 3ed8ec09b5c9..e785cc9e1ecd 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -29,7 +29,7 @@
 #include <linux/kprobes.h>
 #include <linux/ptrace.h>
 #include <linux/preempt.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 #include <linux/kdebug.h>
 #include <linux/slab.h>
 #include <asm/code-patching.h>
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index 7fdf324d5b51..e58908066b0e 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -154,6 +154,42 @@ void pcibios_free_controller(struct pci_controller *phb)
 EXPORT_SYMBOL_GPL(pcibios_free_controller);
 
 /*
+ * This function is used to call pcibios_free_controller()
+ * in a deferred manner: a callback from the PCI subsystem.
+ *
+ * _*DO NOT*_ call pcibios_free_controller() explicitly if
+ * this is used (or it may access an invalid *phb pointer).
+ *
+ * The callback occurs when all references to the root bus
+ * are dropped (e.g., child buses/devices and their users).
+ *
+ * It's called as .release_fn() of 'struct pci_host_bridge'
+ * which is associated with the 'struct pci_controller.bus'
+ * (root bus) - it expects .release_data to hold a pointer
+ * to 'struct pci_controller'.
+ *
+ * In order to use it, register .release_fn()/release_data
+ * like this:
+ *
+ * pci_set_host_bridge_release(bridge,
+ *                             pcibios_free_controller_deferred
+ *                             (void *) phb);
+ *
+ * e.g. in the pcibios_root_bridge_prepare() callback from
+ * pci_create_root_bus().
+ */
+void pcibios_free_controller_deferred(struct pci_host_bridge *bridge)
+{
+        struct pci_controller *phb = (struct pci_controller *)
+                                         bridge->release_data;
+
+        pr_debug("domain %d, dynamic %d\n", phb->global_number, phb->is_dynamic);
+
+        pcibios_free_controller(phb);
+}
+EXPORT_SYMBOL_GPL(pcibios_free_controller_deferred);
+
+/*
  * The function is used to return the minimal alignment
  * for memory or I/O windows of the associated P2P bridge.
  * By default, 4KiB alignment for I/O windows and 1MiB for
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 4e74fc588a3f..d3eff99e938c 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -695,7 +695,7 @@ unsigned char ibm_architecture_vec[] = {
         OV4_MIN_ENT_CAP,                /* minimum VP entitled capacity */
 
         /* option vector 5: PAPR/OF options */
-        VECTOR_LENGTH(18),              /* length */
+        VECTOR_LENGTH(21),              /* length */
         0,                              /* don't ignore, don't halt */
         OV5_FEAT(OV5_LPAR) | OV5_FEAT(OV5_SPLPAR) | OV5_FEAT(OV5_LARGE_PAGES) |
         OV5_FEAT(OV5_DRCONF_MEMORY) | OV5_FEAT(OV5_DONATE_DEDICATE_CPU) |
@@ -726,8 +726,11 @@ unsigned char ibm_architecture_vec[] = {
         0,
         0,
         OV5_FEAT(OV5_PFO_HW_RNG) | OV5_FEAT(OV5_PFO_HW_ENCR) |
-        OV5_FEAT(OV5_PFO_HW_842),
-        OV5_FEAT(OV5_SUB_PROCESSORS),
+        OV5_FEAT(OV5_PFO_HW_842),                               /* Byte 17 */
+        0,                                                      /* Byte 18 */
+        0,                                                      /* Byte 19 */
+        0,                                                      /* Byte 20 */
+        OV5_FEAT(OV5_SUB_PROCESSORS),                           /* Byte 21 */
 
         /* option vector 6: IBM PAPR hints */
         VECTOR_LENGTH(3),               /* length */
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index b6aa378aff63..a7daf749b97f 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -1226,7 +1226,21 @@ long sys_rt_sigreturn(int r3, int r4, int r5, int r6, int r7, int r8,
                 (regs->gpr[1] + __SIGNAL_FRAMESIZE + 16);
         if (!access_ok(VERIFY_READ, rt_sf, sizeof(*rt_sf)))
                 goto bad;
+
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        /*
+         * If there is a transactional state then throw it away.
+         * The purpose of a sigreturn is to destroy all traces of the
+         * signal frame, this includes any transactional state created
+         * within in. We only check for suspended as we can never be
+         * active in the kernel, we are active, there is nothing better to
+         * do than go ahead and Bad Thing later.
+         * The cause is not important as there will never be a
+         * recheckpoint so it's not user visible.
+         */
+        if (MSR_TM_SUSPENDED(mfmsr()))
+                tm_reclaim_current(0);
+
         if (__get_user(tmp, &rt_sf->uc.uc_link))
                 goto bad;
         uc_transact = (struct ucontext __user *)(uintptr_t)tmp;
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 7e49984d4331..70409bb90a95 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -676,7 +676,21 @@ int sys_rt_sigreturn(unsigned long r3, unsigned long r4, unsigned long r5,
         if (__copy_from_user(&set, &uc->uc_sigmask, sizeof(set)))
                 goto badframe;
         set_current_blocked(&set);
+
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        /*
+         * If there is a transactional state then throw it away.
+         * The purpose of a sigreturn is to destroy all traces of the
+         * signal frame, this includes any transactional state created
+         * within in. We only check for suspended as we can never be
+         * active in the kernel, we are active, there is nothing better to
+         * do than go ahead and Bad Thing later.
+         * The cause is not important as there will never be a
+         * recheckpoint so it's not user visible.
+         */
+        if (MSR_TM_SUSPENDED(mfmsr()))
+                tm_reclaim_current(0);
+
         if (__get_user(msr, &uc->uc_mcontext.gp_regs[PT_MSR]))
                 goto badframe;
         if (MSR_TM_ACTIVE(msr)) {
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 25a39052bf6b..9c6f3fd58059 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -830,7 +830,7 @@ int __cpu_disable(void)
 
         /* Update sibling maps */
         base = cpu_first_thread_sibling(cpu);
-        for (i = 0; i < threads_per_core; i++) {
+        for (i = 0; i < threads_per_core && base + i < nr_cpu_ids; i++) {
                 cpumask_clear_cpu(cpu, cpu_sibling_mask(base + i));
                 cpumask_clear_cpu(base + i, cpu_sibling_mask(cpu));
                 cpumask_clear_cpu(cpu, cpu_core_mask(base + i));
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 2cb589264cb7..62859ebe0062 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -25,7 +25,8 @@
 #include <linux/user.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
-#include <linux/module.h>
+#include <linux/extable.h>
+#include <linux/module.h>       /* print_modules */
 #include <linux/prctl.h>
 #include <linux/delay.h>
 #include <linux/kprobes.h>
diff --git a/arch/powerpc/kvm/Makefile b/arch/powerpc/kvm/Makefile
index 1f9e5529e692..855d4b95d752 100644
--- a/arch/powerpc/kvm/Makefile
+++ b/arch/powerpc/kvm/Makefile
@@ -78,6 +78,7 @@ kvm-book3s_64-builtin-xics-objs-$(CONFIG_KVM_XICS) := \
 
 ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
 kvm-book3s_64-builtin-objs-$(CONFIG_KVM_BOOK3S_64_HANDLER) += \
+        book3s_hv_hmi.o \
         book3s_hv_rmhandlers.o \
         book3s_hv_rm_mmu.o \
         book3s_hv_ras.o \
diff --git a/arch/powerpc/kernel/hmi.c b/arch/powerpc/kvm/book3s_hv_hmi.c
index e3f738eb1cac..e3f738eb1cac 100644
--- a/arch/powerpc/kernel/hmi.c
+++ b/arch/powerpc/kvm/book3s_hv_hmi.c
diff --git a/arch/powerpc/lib/checksum_32.S b/arch/powerpc/lib/checksum_32.S
index 0a57fe6d49cc..aa8214f30c92 100644
--- a/arch/powerpc/lib/checksum_32.S
+++ b/arch/powerpc/lib/checksum_32.S
@@ -127,18 +127,19 @@ _GLOBAL(csum_partial_copy_generic)
         stw     r7,12(r1)
         stw     r8,8(r1)
 
-        rlwinm  r0,r4,3,0x8
-        rlwnm   r6,r6,r0,0,31   /* odd destination address: rotate one byte */
-        cmplwi  cr7,r0,0        /* is destination address even ? */
         addic   r12,r6,0
         addi    r6,r4,-4
         neg     r0,r4
         addi    r4,r3,-4
         andi.   r0,r0,CACHELINE_MASK    /* # bytes to start of cache line */
+        crset   4*cr7+eq
         beq     58f
 
         cmplw   0,r5,r0                 /* is this more than total to do? */
         blt     63f                     /* if not much to do */
+        rlwinm  r7,r6,3,0x8
+        rlwnm   r12,r12,r7,0,31 /* odd destination address: rotate one byte */
+        cmplwi  cr7,r7,0        /* is destination address even ? */
         andi.   r8,r0,3                 /* get it word-aligned first */
         mtctr   r8
         beq+    61f
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index a4db22f65021..bb1ffc559f38 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -26,7 +26,7 @@
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 #include <linux/highmem.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 #include <linux/kprobes.h>
 #include <linux/kdebug.h>
 #include <linux/perf_event.h>
diff --git a/arch/powerpc/mm/slb_low.S b/arch/powerpc/mm/slb_low.S
index dfdb90cb4403..9f1983404e1a 100644
--- a/arch/powerpc/mm/slb_low.S
+++ b/arch/powerpc/mm/slb_low.S
@@ -113,7 +113,12 @@ BEGIN_FTR_SECTION
 END_MMU_FTR_SECTION_IFCLR(MMU_FTR_1T_SEGMENT)
         b       slb_finish_load_1T
 
-0:
+0:      /*
+         * For userspace addresses, make sure this is region 0.
+         */
+        cmpdi   r9, 0
+        bne     8f
+
         /* when using slices, we extract the psize off the slice bitmaps
          * and then we need to get the sllp encoding off the mmu_psize_defs
          * array.
diff --git a/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c b/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
index 8eb82b043dd8..d93dd4acf40b 100644
--- a/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
+++ b/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
@@ -528,7 +528,6 @@ static struct platform_driver mpc512x_lpbfifo_driver = {
         .remove = mpc512x_lpbfifo_remove,
         .driver = {
                 .name = DRV_NAME,
-                .owner = THIS_MODULE,
                 .of_match_table = mpc512x_lpbfifo_match,
         },
 };
diff --git a/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c b/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
index dbcd0303afed..63c5ab6489c9 100644
--- a/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
+++ b/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
@@ -222,7 +222,6 @@ static const struct of_device_id mcu_of_match_table[] = {
 static struct i2c_driver mcu_driver = {
         .driver = {
                 .name = "mcu-mpc8349emitx",
-                .owner = THIS_MODULE,
                 .of_match_table = mcu_of_match_table,
         },
         .probe = mcu_probe,
diff --git a/arch/powerpc/platforms/embedded6xx/holly.c b/arch/powerpc/platforms/embedded6xx/holly.c
index dafba1057a47..dfd310031549 100644
--- a/arch/powerpc/platforms/embedded6xx/holly.c
+++ b/arch/powerpc/platforms/embedded6xx/holly.c
@@ -26,7 +26,7 @@
 #include <linux/tty.h>
 #include <linux/serial_core.h>
 #include <linux/of_platform.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 
 #include <asm/time.h>
 #include <asm/machdep.h>
diff --git a/arch/powerpc/platforms/embedded6xx/mpc7448_hpc2.c b/arch/powerpc/platforms/embedded6xx/mpc7448_hpc2.c
index 80804f9916ee..f97bab8e37a2 100644
--- a/arch/powerpc/platforms/embedded6xx/mpc7448_hpc2.c
+++ b/arch/powerpc/platforms/embedded6xx/mpc7448_hpc2.c
@@ -23,7 +23,7 @@
 #include <linux/pci.h>
 #include <linux/kdev_t.h>
 #include <linux/console.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 #include <linux/delay.h>
 #include <linux/irq.h>
 #include <linux/seq_file.h>
diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c
index 2ee96431f736..4c827826c05e 100644
--- a/arch/powerpc/platforms/powernv/opal-dump.c
+++ b/arch/powerpc/platforms/powernv/opal-dump.c
@@ -370,6 +370,7 @@ static irqreturn_t process_dump(int irq, void *data)
         uint32_t dump_id, dump_size, dump_type;
         struct dump_obj *dump;
         char name[22];
+        struct kobject *kobj;
 
         rc = dump_read_info(&dump_id, &dump_size, &dump_type);
         if (rc != OPAL_SUCCESS)
@@ -381,8 +382,12 @@ static irqreturn_t process_dump(int irq, void *data)
          * that gracefully and not create two conflicting
          * entries.
          */
-        if (kset_find_obj(dump_kset, name))
+        kobj = kset_find_obj(dump_kset, name);
+        if (kobj) {
+                /* Drop reference added by kset_find_obj() */
+                kobject_put(kobj);
                 return 0;
+        }
 
         dump = create_dump_obj(dump_id, dump_size, dump_type);
         if (!dump)
diff --git a/arch/powerpc/platforms/powernv/opal-elog.c b/arch/powerpc/platforms/powernv/opal-elog.c
index 37f959bf392e..f2344cbd2f46 100644
--- a/arch/powerpc/platforms/powernv/opal-elog.c
+++ b/arch/powerpc/platforms/powernv/opal-elog.c
@@ -247,6 +247,7 @@ static irqreturn_t elog_event(int irq, void *data)
         uint64_t elog_type;
         int rc;
         char name[2+16+1];
+        struct kobject *kobj;
 
         rc = opal_get_elog_size(&id, &size, &type);
         if (rc != OPAL_SUCCESS) {
@@ -269,8 +270,12 @@ static irqreturn_t elog_event(int irq, void *data)
          * that gracefully and not create two conflicting
          * entries.
          */
-        if (kset_find_obj(elog_kset, name))
+        kobj = kset_find_obj(elog_kset, name);
+        if (kobj) {
+                /* Drop reference added by kset_find_obj() */
+                kobject_put(kobj);
                 return IRQ_HANDLED;
+        }
 
         create_elog_obj(log_id, elog_size, elog_type);
 
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index fd9444f9fb0c..c16d790808f1 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -149,7 +149,7 @@ static void pnv_ioda_reserve_pe(struct pnv_phb *phb, int pe_no)
 
 static struct pnv_ioda_pe *pnv_ioda_alloc_pe(struct pnv_phb *phb)
 {
-        unsigned long pe = phb->ioda.total_pe_num - 1;
+        long pe;
 
         for (pe = phb->ioda.total_pe_num - 1; pe >= 0; pe--) {
                 if (!test_and_set_bit(pe, phb->ioda.pe_alloc))
@@ -162,11 +162,12 @@ static struct pnv_ioda_pe *pnv_ioda_alloc_pe(struct pnv_phb *phb)
 static void pnv_ioda_free_pe(struct pnv_ioda_pe *pe)
 {
         struct pnv_phb *phb = pe->phb;
+        unsigned int pe_num = pe->pe_number;
 
         WARN_ON(pe->pdev);
 
         memset(pe, 0, sizeof(struct pnv_ioda_pe));
-        clear_bit(pe->pe_number, phb->ioda.pe_alloc);
+        clear_bit(pe_num, phb->ioda.pe_alloc);
 }
 
 /* The default M64 BAR is shared by all PEs */
@@ -3402,12 +3403,6 @@ static void pnv_ioda_release_pe(struct pnv_ioda_pe *pe)
         struct pnv_phb *phb = pe->phb;
         struct pnv_ioda_pe *slave, *tmp;
 
-        /* Release slave PEs in compound PE */
-        if (pe->flags & PNV_IODA_PE_MASTER) {
-                list_for_each_entry_safe(slave, tmp, &pe->slaves, list)
-                        pnv_ioda_release_pe(slave);
-        }
-
         list_del(&pe->list);
         switch (phb->type) {
         case PNV_PHB_IODA1:
@@ -3422,6 +3417,15 @@ static void pnv_ioda_release_pe(struct pnv_ioda_pe *pe)
 
         pnv_ioda_release_pe_seg(pe);
         pnv_ioda_deconfigure_pe(pe->phb, pe);
+
+        /* Release slave PEs in the compound PE */
+        if (pe->flags & PNV_IODA_PE_MASTER) {
+                list_for_each_entry_safe(slave, tmp, &pe->slaves, list) {
+                        list_del(&slave->list);
+                        pnv_ioda_free_pe(slave);
+                }
+        }
+
         pnv_ioda_free_pe(pe);
 }
 
diff --git a/arch/powerpc/platforms/pseries/pci.c b/arch/powerpc/platforms/pseries/pci.c
index fe16a50700de..09eba5a9929a 100644
--- a/arch/powerpc/platforms/pseries/pci.c
+++ b/arch/powerpc/platforms/pseries/pci.c
@@ -119,6 +119,10 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
 
         bus = bridge->bus;
 
+        /* Rely on the pcibios_free_controller_deferred() callback. */
+        pci_set_host_bridge_release(bridge, pcibios_free_controller_deferred,
+                                        (void *) pci_bus_to_host(bus));
+
         dn = pcibios_get_phb_of_node(bus);
         if (!dn)
                 return 0;
diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
index 906dbaa97fe2..547fd13e4f8e 100644
--- a/arch/powerpc/platforms/pseries/pci_dlpar.c
+++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
@@ -106,8 +106,11 @@ int remove_phb_dynamic(struct pci_controller *phb)
                 release_resource(res);
         }
 
-        /* Free pci_controller data structure */
-        pcibios_free_controller(phb);
+        /*
+         * The pci_controller data structure is freed by
+         * the pcibios_free_controller_deferred() callback;
+         * see pseries_root_bridge_prepare().
+         */
 
         return 0;
 }
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 4ffcaa6f8670..a39d20e8623d 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -41,7 +41,6 @@
 #include <linux/root_dev.h>
 #include <linux/of.h>
 #include <linux/of_pci.h>
-#include <linux/kexec.h>
 
 #include <asm/mmu.h>
 #include <asm/processor.h>
@@ -66,6 +65,7 @@
 #include <asm/eeh.h>
 #include <asm/reg.h>
 #include <asm/plpar_wrappers.h>
+#include <asm/kexec.h>
 
 #include "pseries.h"
 
diff --git a/arch/powerpc/sysdev/cpm1.c b/arch/powerpc/sysdev/cpm1.c
index 6c110994d902..81d49476c47e 100644
--- a/arch/powerpc/sysdev/cpm1.c
+++ b/arch/powerpc/sysdev/cpm1.c
@@ -534,7 +534,8 @@ struct cpm1_gpio16_chip {
 
 static void cpm1_gpio16_save_regs(struct of_mm_gpio_chip *mm_gc)
 {
-        struct cpm1_gpio16_chip *cpm1_gc = gpiochip_get_data(&mm_gc->gc);
+        struct cpm1_gpio16_chip *cpm1_gc =
+                container_of(mm_gc, struct cpm1_gpio16_chip, mm_gc);
         struct cpm_ioport16 __iomem *iop = mm_gc->regs;
 
         cpm1_gc->cpdata = in_be16(&iop->dat);
@@ -649,7 +650,8 @@ struct cpm1_gpio32_chip {
 
 static void cpm1_gpio32_save_regs(struct of_mm_gpio_chip *mm_gc)
 {
-        struct cpm1_gpio32_chip *cpm1_gc = gpiochip_get_data(&mm_gc->gc);
+        struct cpm1_gpio32_chip *cpm1_gc =
+                container_of(mm_gc, struct cpm1_gpio32_chip, mm_gc);
         struct cpm_ioport32b __iomem *iop = mm_gc->regs;
 
         cpm1_gc->cpdata = in_be32(&iop->dat);
diff --git a/arch/powerpc/sysdev/cpm_common.c b/arch/powerpc/sysdev/cpm_common.c
index 911456d17713..947f42007734 100644
--- a/arch/powerpc/sysdev/cpm_common.c
+++ b/arch/powerpc/sysdev/cpm_common.c
@@ -94,7 +94,8 @@ struct cpm2_gpio32_chip {
 
 static void cpm2_gpio32_save_regs(struct of_mm_gpio_chip *mm_gc)
 {
-        struct cpm2_gpio32_chip *cpm2_gc = gpiochip_get_data(&mm_gc->gc);
+        struct cpm2_gpio32_chip *cpm2_gc =
+                container_of(mm_gc, struct cpm2_gpio32_chip, mm_gc);
         struct cpm2_ioports __iomem *iop = mm_gc->regs;
 
         cpm2_gc->cpdata = in_be32(&iop->dat);
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index 68e7c0dd2e45..3cc7cace194a 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -23,7 +23,7 @@
  */
 
 #include <linux/init.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 #include <linux/types.h>
 #include <linux/dma-mapping.h>
 #include <linux/interrupt.h>
diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
index 57d72f10a97f..9114243fa1b5 100644
--- a/arch/powerpc/sysdev/xics/icp-opal.c
+++ b/arch/powerpc/sysdev/xics/icp-opal.c
@@ -23,10 +23,10 @@
 
 static void icp_opal_teardown_cpu(void)
 {
-        int cpu = smp_processor_id();
+        int hw_cpu = hard_smp_processor_id();
 
         /* Clear any pending IPI */
-        opal_int_set_mfrr(cpu, 0xff);
+        opal_int_set_mfrr(hw_cpu, 0xff);
 }
 
 static void icp_opal_flush_ipi(void)
@@ -101,14 +101,16 @@ static void icp_opal_eoi(struct irq_data *d)
 
 static void icp_opal_cause_ipi(int cpu, unsigned long data)
 {
-        opal_int_set_mfrr(cpu, IPI_PRIORITY);
+        int hw_cpu = get_hard_smp_processor_id(cpu);
+
+        opal_int_set_mfrr(hw_cpu, IPI_PRIORITY);
 }
 
 static irqreturn_t icp_opal_ipi_action(int irq, void *dev_id)
 {
-        int cpu = smp_processor_id();
+        int hw_cpu = hard_smp_processor_id();
 
-        opal_int_set_mfrr(cpu, 0xff);
+        opal_int_set_mfrr(hw_cpu, 0xff);
 
         return smp_ipi_demux();
 }
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index e751fe25d6ab..c109f073d454 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -68,7 +68,6 @@ config DEBUG_RODATA
 config S390
         def_bool y
         select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
-        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
         select ARCH_HAS_DEVMEM_IS_ALLOWED
         select ARCH_HAS_ELF_RANDOMIZE
         select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index 26e0c7f08814..412b1bd21029 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -602,7 +602,6 @@ CONFIG_FAIL_FUTEX=y
 CONFIG_FAULT_INJECTION_DEBUG_FS=y
 CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_IRQSOFF_TRACER=y
 CONFIG_PREEMPT_TRACER=y
 CONFIG_SCHED_TRACER=y
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index 24879dab47bc..bec279eb4b93 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -552,7 +552,6 @@ CONFIG_NOTIFIER_ERROR_INJECTION=m
 CONFIG_CPU_NOTIFIER_ERROR_INJECT=m
 CONFIG_PM_NOTIFIER_ERROR_INJECT=m
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_BLK_DEV_IO_TRACE=y
 # CONFIG_KPROBE_EVENT is not set
 CONFIG_TRACE_ENUM_MAP_FILE=y
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index a5c1e5f2a0ca..1751446a5bbb 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -549,7 +549,6 @@ CONFIG_TIMER_STATS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_STACK_TRACER=y
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 73610f2e3b4f..2d40ef0a6295 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -172,7 +172,6 @@ CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_RCU_TRACE=y
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
index 9b49cf1daa8f..52d7c8709279 100644
--- a/arch/s390/include/asm/uaccess.h
+++ b/arch/s390/include/asm/uaccess.h
@@ -266,28 +266,28 @@ int __put_user_bad(void) __attribute__((noreturn));
         __chk_user_ptr(ptr);                                    \
         switch (sizeof(*(ptr))) {                               \
         case 1: {                                               \
-                unsigned char __x;                              \
+                unsigned char __x = 0;                          \
                 __gu_err = __get_user_fn(&__x, ptr,             \
                                          sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 2: {                                               \
-                unsigned short __x;                             \
+                unsigned short __x = 0;                         \
                 __gu_err = __get_user_fn(&__x, ptr,             \
                                          sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 4: {                                               \
-                unsigned int __x;                               \
+                unsigned int __x = 0;                           \
                 __gu_err = __get_user_fn(&__x, ptr,             \
                                          sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 8: {                                               \
-                unsigned long long __x;                         \
+                unsigned long long __x = 0;                     \
                 __gu_err = __get_user_fn(&__x, ptr,             \
                                          sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
@@ -311,6 +311,14 @@ int __get_user_bad(void) __attribute__((noreturn));
 #define __put_user_unaligned __put_user
 #define __get_user_unaligned __get_user
 
+extern void __compiletime_error("usercopy buffer size is too small")
+__bad_copy_user(void);
+
+static inline void copy_user_overflow(int size, unsigned long count)
+{
+        WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
+}
+
 /**
  * copy_to_user: - Copy a block of data into user space.
  * @to:   Destination address, in user space.
@@ -332,12 +340,6 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
         return __copy_to_user(to, from, n);
 }
 
-void copy_from_user_overflow(void)
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-__compiletime_warning("copy_from_user() buffer size is not provably correct")
-#endif
-;
-
 /**
  * copy_from_user: - Copy a block of data from user space.
  * @to:   Destination address, in kernel space.
@@ -362,7 +364,10 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
 
         might_fault();
         if (unlikely(sz != -1 && sz < n)) {
-                copy_from_user_overflow();
+                if (!__builtin_constant_p(n))
+                        copy_user_overflow(sz, n);
+                else
+                        __bad_copy_user();
                 return n;
         }
         return __copy_from_user(to, from, n);
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index ba5f456edaa9..7f7ba5f23f13 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -204,11 +204,9 @@ static void __init conmode_default(void)
 #endif
                 }
         } else if (MACHINE_IS_KVM) {
-                if (sclp.has_vt220 &&
-                    config_enabled(CONFIG_SCLP_VT220_CONSOLE))
+                if (sclp.has_vt220 && IS_ENABLED(CONFIG_SCLP_VT220_CONSOLE))
                         SET_CONSOLE_VT220;
-                else if (sclp.has_linemode &&
-                         config_enabled(CONFIG_SCLP_CONSOLE))
+                else if (sclp.has_linemode && IS_ENABLED(CONFIG_SCLP_CONSOLE))
                         SET_CONSOLE_SCLP;
                 else
                         SET_CONSOLE_HVC;
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index f142215ed30d..607ec91966c7 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -2231,9 +2231,10 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
                 return -EINVAL;
         current->thread.fpu.fpc = fpu->fpc;
         if (MACHINE_HAS_VX)
-                convert_fp_to_vx(current->thread.fpu.vxrs, (freg_t *)fpu->fprs);
+                convert_fp_to_vx((__vector128 *) vcpu->run->s.regs.vrs,
+                                 (freg_t *) fpu->fprs);
         else
-                memcpy(current->thread.fpu.fprs, &fpu->fprs, sizeof(fpu->fprs));
+                memcpy(vcpu->run->s.regs.fprs, &fpu->fprs, sizeof(fpu->fprs));
         return 0;
 }
 
@@ -2242,9 +2243,10 @@ int kvm_arch_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
         /* make sure we have the latest values */
         save_fpu_regs();
         if (MACHINE_HAS_VX)
-                convert_vx_to_fp((freg_t *)fpu->fprs, current->thread.fpu.vxrs);
+                convert_vx_to_fp((freg_t *) fpu->fprs,
+                                 (__vector128 *) vcpu->run->s.regs.vrs);
         else
-                memcpy(fpu->fprs, current->thread.fpu.fprs, sizeof(fpu->fprs));
+                memcpy(fpu->fprs, vcpu->run->s.regs.fprs, sizeof(fpu->fprs));
         fpu->fpc = current->thread.fpu.fpc;
         return 0;
 }
diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index c106488b4137..d8673e243f13 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -584,7 +584,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
                 /* Validity 0x0044 will be checked by SIE */
                 if (rc)
                         goto unpin;
-                scb_s->gvrd = hpa;
+                scb_s->riccbd = hpa;
         }
         return 0;
 unpin:
diff --git a/arch/score/include/asm/uaccess.h b/arch/score/include/asm/uaccess.h
index 20a3591225cc..01aec8ccde83 100644
--- a/arch/score/include/asm/uaccess.h
+++ b/arch/score/include/asm/uaccess.h
@@ -163,7 +163,7 @@ do {									\
                 __get_user_asm(val, "lw", ptr);                         \
                  break;                                                 \
         case 8:                                                         \
-                if ((copy_from_user((void *)&val, ptr, 8)) == 0)        \
+                if (__copy_from_user((void *)&val, ptr, 8) == 0)        \
                         __gu_err = 0;                                   \
                 else                                                    \
                         __gu_err = -EFAULT;                             \
@@ -188,6 +188,8 @@ do {									\
                                                                         \
         if (likely(access_ok(VERIFY_READ, __gu_ptr, size)))             \
                 __get_user_common((x), size, __gu_ptr);                 \
+        else                                                            \
+                (x) = 0;                                                \
                                                                         \
         __gu_err;                                                       \
 })
@@ -201,6 +203,7 @@ do {									\
                 "2:\n"                                                  \
                 ".section .fixup,\"ax\"\n"                              \
                 "3:li   %0, %4\n"                                       \
+                "li     %1, 0\n"                                        \
                 "j      2b\n"                                           \
                 ".previous\n"                                           \
                 ".section __ex_table,\"a\"\n"                           \
@@ -298,35 +301,34 @@ extern int __copy_tofrom_user(void *to, const void *from, unsigned long len);
 static inline unsigned long
 copy_from_user(void *to, const void *from, unsigned long len)
 {
-        unsigned long over;
+        unsigned long res = len;
 
-        if (access_ok(VERIFY_READ, from, len))
-                return __copy_tofrom_user(to, from, len);
+        if (likely(access_ok(VERIFY_READ, from, len)))
+                res = __copy_tofrom_user(to, from, len);
 
-        if ((unsigned long)from < TASK_SIZE) {
-                over = (unsigned long)from + len - TASK_SIZE;
-                return __copy_tofrom_user(to, from, len - over) + over;
-        }
-        return len;
+        if (unlikely(res))
+                memset(to + (len - res), 0, res);
+
+        return res;
 }
 
 static inline unsigned long
 copy_to_user(void *to, const void *from, unsigned long len)
 {
-        unsigned long over;
-
-        if (access_ok(VERIFY_WRITE, to, len))
-                return __copy_tofrom_user(to, from, len);
+        if (likely(access_ok(VERIFY_WRITE, to, len)))
+                len = __copy_tofrom_user(to, from, len);
 
-        if ((unsigned long)to < TASK_SIZE) {
-                over = (unsigned long)to + len - TASK_SIZE;
-                return __copy_tofrom_user(to, from, len - over) + over;
-        }
         return len;
 }
 
-#define __copy_from_user(to, from, len) \
-                __copy_tofrom_user((to), (from), (len))
+static inline unsigned long
+__copy_from_user(void *to, const void *from, unsigned long len)
+{
+        unsigned long left = __copy_tofrom_user(to, from, len);
+        if (unlikely(left))
+                memset(to + (len - left), 0, left);
+        return left;
+}
 
 #define __copy_to_user(to, from, len)           \
                 __copy_tofrom_user((to), (from), (len))
@@ -340,17 +342,17 @@ __copy_to_user_inatomic(void *to, const void *from, unsigned long len)
 static inline unsigned long
 __copy_from_user_inatomic(void *to, const void *from, unsigned long len)
 {
-        return __copy_from_user(to, from, len);
+        return __copy_tofrom_user(to, from, len);
 }
 
-#define __copy_in_user(to, from, len)   __copy_from_user(to, from, len)
+#define __copy_in_user(to, from, len)   __copy_tofrom_user(to, from, len)
 
 static inline unsigned long
 copy_in_user(void *to, const void *from, unsigned long len)
 {
         if (access_ok(VERIFY_READ, from, len) &&
                       access_ok(VERFITY_WRITE, to, len))
-                return copy_from_user(to, from, len);
+                return __copy_tofrom_user(to, from, len);
 }
 
 /*
diff --git a/arch/sh/include/asm/uaccess.h b/arch/sh/include/asm/uaccess.h
index a49635c51266..92ade79ac427 100644
--- a/arch/sh/include/asm/uaccess.h
+++ b/arch/sh/include/asm/uaccess.h
@@ -151,7 +151,10 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
         __kernel_size_t __copy_size = (__kernel_size_t) n;
 
         if (__copy_size && __access_ok(__copy_from, __copy_size))
-                return __copy_user(to, from, __copy_size);
+                __copy_size = __copy_user(to, from, __copy_size);
+
+        if (unlikely(__copy_size))
+                memset(to + (n - __copy_size), 0, __copy_size);
 
         return __copy_size;
 }
diff --git a/arch/sh/include/asm/uaccess_64.h b/arch/sh/include/asm/uaccess_64.h
index c01376c76b86..ca5073dd4596 100644
--- a/arch/sh/include/asm/uaccess_64.h
+++ b/arch/sh/include/asm/uaccess_64.h
@@ -24,6 +24,7 @@
 #define __get_user_size(x,ptr,size,retval)                      \
 do {                                                            \
         retval = 0;                                             \
+        x = 0;                                                  \
         switch (size) {                                         \
         case 1:                                                 \
                 retval = __get_user_asm_b((void *)&x,           \
diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
index 341a5a133f48..ea55f86d7ccd 100644
--- a/arch/sparc/include/asm/uaccess_32.h
+++ b/arch/sparc/include/asm/uaccess_32.h
@@ -249,8 +249,7 @@ unsigned long __copy_user(void __user *to, const void __user *from, unsigned lon
 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
 {
         if (n && __access_ok((unsigned long) to, n)) {
-                if (!__builtin_constant_p(n))
-                        check_object_size(from, n, true);
+                check_object_size(from, n, true);
                 return __copy_user(to, (__force void __user *) from, n);
         } else
                 return n;
@@ -258,19 +257,19 @@ static inline unsigned long copy_to_user(void __user *to, const void *from, unsi
 
 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
 {
-        if (!__builtin_constant_p(n))
-                check_object_size(from, n, true);
+        check_object_size(from, n, true);
         return __copy_user(to, (__force void __user *) from, n);
 }
 
 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
 {
         if (n && __access_ok((unsigned long) from, n)) {
-                if (!__builtin_constant_p(n))
-                        check_object_size(to, n, false);
+                check_object_size(to, n, false);
                 return __copy_user((__force void __user *) to, from, n);
-        } else
+        } else {
+                memset(to, 0, n);
                 return n;
+        }
 }
 
 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
index 8bda94fab8e8..37a315d0ddd4 100644
--- a/arch/sparc/include/asm/uaccess_64.h
+++ b/arch/sparc/include/asm/uaccess_64.h
@@ -212,8 +212,7 @@ copy_from_user(void *to, const void __user *from, unsigned long size)
 {
         unsigned long ret;
 
-        if (!__builtin_constant_p(size))
-                check_object_size(to, size, false);
+        check_object_size(to, size, false);
 
         ret = ___copy_from_user(to, from, size);
         if (unlikely(ret))
@@ -233,8 +232,8 @@ copy_to_user(void __user *to, const void *from, unsigned long size)
 {
         unsigned long ret;
 
-        if (!__builtin_constant_p(size))
-                check_object_size(from, size, true);
+        check_object_size(from, size, true);
+
         ret = ___copy_to_user(to, from, size);
         if (unlikely(ret))
                 ret = copy_to_user_fixup(to, from, size);
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index 4820a02838ac..78da75b670bc 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -4,7 +4,6 @@
 config TILE
         def_bool y
         select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
-        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
         select ARCH_HAS_DEVMEM_IS_ALLOWED
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
         select ARCH_WANT_FRAME_POINTERS
diff --git a/arch/tile/include/asm/uaccess.h b/arch/tile/include/asm/uaccess.h
index 0a9c4265763b..a77369e91e54 100644
--- a/arch/tile/include/asm/uaccess.h
+++ b/arch/tile/include/asm/uaccess.h
@@ -416,14 +416,13 @@ _copy_from_user(void *to, const void __user *from, unsigned long n)
         return n;
 }
 
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-/*
- * There are still unprovable places in the generic code as of 2.6.34, so this
- * option is not really compatible with -Werror, which is more useful in
- * general.
- */
-extern void copy_from_user_overflow(void)
-        __compiletime_warning("copy_from_user() size is not provably correct");
+extern void __compiletime_error("usercopy buffer size is too small")
+__bad_copy_user(void);
+
+static inline void copy_user_overflow(int size, unsigned long count)
+{
+        WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
+}
 
 static inline unsigned long __must_check copy_from_user(void *to,
                                           const void __user *from,
@@ -433,14 +432,13 @@ static inline unsigned long __must_check copy_from_user(void *to,
 
         if (likely(sz == -1 || sz >= n))
                 n = _copy_from_user(to, from, n);
+        else if (!__builtin_constant_p(n))
+                copy_user_overflow(sz, n);
         else
-                copy_from_user_overflow();
+                __bad_copy_user();
 
         return n;
 }
-#else
-#define copy_from_user _copy_from_user
-#endif
 
 #ifdef __tilegx__
 /**
diff --git a/arch/um/include/asm/common.lds.S b/arch/um/include/asm/common.lds.S
index 1dd5bd8a8c59..133055311dce 100644
--- a/arch/um/include/asm/common.lds.S
+++ b/arch/um/include/asm/common.lds.S
@@ -81,7 +81,7 @@
   .altinstr_replacement : { *(.altinstr_replacement) }
   /* .exit.text is discard at runtime, not link time, to deal with references
      from .altinstructions and .eh_frame */
-  .exit.text : { *(.exit.text) }
+  .exit.text : { EXIT_TEXT }
   .exit.data : { *(.exit.data) }
 
   .preinit_array : {
diff --git a/arch/um/kernel/skas/syscall.c b/arch/um/kernel/skas/syscall.c
index ef4b8f949b51..b783ac87d98a 100644
--- a/arch/um/kernel/skas/syscall.c
+++ b/arch/um/kernel/skas/syscall.c
@@ -21,21 +21,17 @@ void handle_syscall(struct uml_pt_regs *r)
         PT_REGS_SET_SYSCALL_RETURN(regs, -ENOSYS);
 
         if (syscall_trace_enter(regs))
-                return;
+                goto out;
 
         /* Do the seccomp check after ptrace; failures should be fast. */
         if (secure_computing(NULL) == -1)
-                return;
+                goto out;
 
-        /* Update the syscall number after orig_ax has potentially been updated
-         * with ptrace.
-         */
-        UPT_SYSCALL_NR(r) = PT_SYSCALL_NR(r->gp);
         syscall = UPT_SYSCALL_NR(r);
-
         if (syscall >= 0 && syscall <= __NR_syscall_max)
                 PT_REGS_SET_SYSCALL_RETURN(regs,
                                 EXECUTE_SYSCALL(syscall, regs));
 
+out:
         syscall_trace_leave(regs);
 }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index ce8860cccc34..4c3972847c2a 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -24,7 +24,6 @@ config X86
         select ARCH_DISCARD_MEMBLOCK
         select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI
         select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
-        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
         select ARCH_HAS_DEVMEM_IS_ALLOWED
         select ARCH_HAS_ELF_RANDOMIZE
         select ARCH_HAS_FAST_MULTIPLIER
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index ff574dad95cc..94dd4a31f5b3 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -1004,79 +1004,87 @@ static efi_status_t alloc_e820ext(u32 nr_desc, struct setup_data **e820ext,
         return status;
 }
 
-static efi_status_t exit_boot(struct boot_params *boot_params,
-                              void *handle, bool is64)
-{
-        struct efi_info *efi = &boot_params->efi_info;
-        unsigned long map_sz, key, desc_size;
-        efi_memory_desc_t *mem_map;
+struct exit_boot_struct {
+        struct boot_params *boot_params;
+        struct efi_info *efi;
         struct setup_data *e820ext;
-        const char *signature;
         __u32 e820ext_size;
-        __u32 nr_desc, prev_nr_desc;
-        efi_status_t status;
-        __u32 desc_version;
-        bool called_exit = false;
-        u8 nr_entries;
-        int i;
-
-        nr_desc = 0;
-        e820ext = NULL;
-        e820ext_size = 0;
-
-get_map:
-        status = efi_get_memory_map(sys_table, &mem_map, &map_sz, &desc_size,
-                                    &desc_version, &key);
-
-        if (status != EFI_SUCCESS)
-                return status;
-
-        prev_nr_desc = nr_desc;
-        nr_desc = map_sz / desc_size;
-        if (nr_desc > prev_nr_desc &&
-            nr_desc > ARRAY_SIZE(boot_params->e820_map)) {
-                u32 nr_e820ext = nr_desc - ARRAY_SIZE(boot_params->e820_map);
-
-                status = alloc_e820ext(nr_e820ext, &e820ext, &e820ext_size);
-                if (status != EFI_SUCCESS)
-                        goto free_mem_map;
+        bool is64;
+};
 
-                efi_call_early(free_pool, mem_map);
-                goto get_map; /* Allocated memory, get map again */
+static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
+                                   struct efi_boot_memmap *map,
+                                   void *priv)
+{
+        static bool first = true;
+        const char *signature;
+        __u32 nr_desc;
+        efi_status_t status;
+        struct exit_boot_struct *p = priv;
+
+        if (first) {
+                nr_desc = *map->buff_size / *map->desc_size;
+                if (nr_desc > ARRAY_SIZE(p->boot_params->e820_map)) {
+                        u32 nr_e820ext = nr_desc -
+                                        ARRAY_SIZE(p->boot_params->e820_map);
+
+                        status = alloc_e820ext(nr_e820ext, &p->e820ext,
+                                               &p->e820ext_size);
+                        if (status != EFI_SUCCESS)
+                                return status;
+                }
+                first = false;
         }
 
-        signature = is64 ? EFI64_LOADER_SIGNATURE : EFI32_LOADER_SIGNATURE;
-        memcpy(&efi->efi_loader_signature, signature, sizeof(__u32));
+        signature = p->is64 ? EFI64_LOADER_SIGNATURE : EFI32_LOADER_SIGNATURE;
+        memcpy(&p->efi->efi_loader_signature, signature, sizeof(__u32));
 
-        efi->efi_systab = (unsigned long)sys_table;
-        efi->efi_memdesc_size = desc_size;
-        efi->efi_memdesc_version = desc_version;
-        efi->efi_memmap = (unsigned long)mem_map;
-        efi->efi_memmap_size = map_sz;
+        p->efi->efi_systab = (unsigned long)sys_table_arg;
+        p->efi->efi_memdesc_size = *map->desc_size;
+        p->efi->efi_memdesc_version = *map->desc_ver;
+        p->efi->efi_memmap = (unsigned long)*map->map;
+        p->efi->efi_memmap_size = *map->map_size;
 
 #ifdef CONFIG_X86_64
-        efi->efi_systab_hi = (unsigned long)sys_table >> 32;
-        efi->efi_memmap_hi = (unsigned long)mem_map >> 32;
+        p->efi->efi_systab_hi = (unsigned long)sys_table_arg >> 32;
+        p->efi->efi_memmap_hi = (unsigned long)*map->map >> 32;
 #endif
 
+        return EFI_SUCCESS;
+}
+
+static efi_status_t exit_boot(struct boot_params *boot_params,
+                              void *handle, bool is64)
+{
+        unsigned long map_sz, key, desc_size, buff_size;
+        efi_memory_desc_t *mem_map;
+        struct setup_data *e820ext;
+        __u32 e820ext_size;
+        efi_status_t status;
+        __u32 desc_version;
+        struct efi_boot_memmap map;
+        struct exit_boot_struct priv;
+
+        map.map =               &mem_map;
+        map.map_size =          &map_sz;
+        map.desc_size =         &desc_size;
+        map.desc_ver =          &desc_version;
+        map.key_ptr =           &key;
+        map.buff_size =         &buff_size;
+        priv.boot_params =      boot_params;
+        priv.efi =              &boot_params->efi_info;
+        priv.e820ext =          NULL;
+        priv.e820ext_size =     0;
+        priv.is64 =             is64;
+
         /* Might as well exit boot services now */
-        status = efi_call_early(exit_boot_services, handle, key);
-        if (status != EFI_SUCCESS) {
-                /*
-                 * ExitBootServices() will fail if any of the event
-                 * handlers change the memory map. In which case, we
-                 * must be prepared to retry, but only once so that
-                 * we're guaranteed to exit on repeated failures instead
-                 * of spinning forever.
-                 */
-                if (called_exit)
-                        goto free_mem_map;
-
-                called_exit = true;
-                efi_call_early(free_pool, mem_map);
-                goto get_map;
-        }
+        status = efi_exit_boot_services(sys_table, handle, &map, &priv,
+                                        exit_boot_func);
+        if (status != EFI_SUCCESS)
+                return status;
 
+        e820ext = priv.e820ext;
+        e820ext_size = priv.e820ext_size;
         /* Historic? */
         boot_params->alt_mem_k = 32 * 1024;
 
@@ -1085,10 +1093,6 @@ get_map:
                 return status;
 
         return EFI_SUCCESS;
-
-free_mem_map:
-        efi_call_early(free_pool, mem_map);
-        return status;
 }
 
 /*
diff --git a/arch/x86/configs/tiny.config b/arch/x86/configs/tiny.config
index 4e2ecfa23c15..4b429df40d7a 100644
--- a/arch/x86/configs/tiny.config
+++ b/arch/x86/configs/tiny.config
@@ -1 +1,3 @@
 CONFIG_NOHIGHMEM=y
+# CONFIG_HIGHMEM4G is not set
+# CONFIG_HIGHMEM64G is not set
diff --git a/arch/x86/crypto/sha256-mb/sha256_mb.c b/arch/x86/crypto/sha256-mb/sha256_mb.c
index 89fa85e8b10c..6f97fb33ae21 100644
--- a/arch/x86/crypto/sha256-mb/sha256_mb.c
+++ b/arch/x86/crypto/sha256-mb/sha256_mb.c
@@ -485,10 +485,10 @@ static int sha_complete_job(struct mcryptd_hash_request_ctx *rctx,
 
                         req = cast_mcryptd_ctx_to_req(req_ctx);
                         if (irqs_disabled())
-                                rctx->complete(&req->base, ret);
+                                req_ctx->complete(&req->base, ret);
                         else {
                                 local_bh_disable();
-                                rctx->complete(&req->base, ret);
+                                req_ctx->complete(&req->base, ret);
                                 local_bh_enable();
                         }
                 }
diff --git a/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S b/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
index b691da981cd9..a78a0694ddef 100644
--- a/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
+++ b/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
@@ -265,13 +265,14 @@ ENTRY(sha256_mb_mgr_get_comp_job_avx2)
         vpinsrd $1, _args_digest+1*32(state, idx, 4), %xmm0, %xmm0
         vpinsrd $2, _args_digest+2*32(state, idx, 4), %xmm0, %xmm0
         vpinsrd $3, _args_digest+3*32(state, idx, 4), %xmm0, %xmm0
-        movl    _args_digest+4*32(state, idx, 4), tmp2_w
+        vmovd   _args_digest(state , idx, 4) , %xmm0
         vpinsrd $1, _args_digest+5*32(state, idx, 4), %xmm1, %xmm1
         vpinsrd $2, _args_digest+6*32(state, idx, 4), %xmm1, %xmm1
         vpinsrd $3, _args_digest+7*32(state, idx, 4), %xmm1, %xmm1
 
-        vmovdqu %xmm0, _result_digest(job_rax)
-        movl    tmp2_w, _result_digest+1*16(job_rax)
+        vmovdqu %xmm0, _result_digest(job_rax)
+        offset =  (_result_digest + 1*16)
+        vmovdqu %xmm1, offset(job_rax)
 
         pop     %rbx
 
diff --git a/arch/x86/crypto/sha512-mb/sha512_mb.c b/arch/x86/crypto/sha512-mb/sha512_mb.c
index f4cf5b78fd36..d210174a52b0 100644
--- a/arch/x86/crypto/sha512-mb/sha512_mb.c
+++ b/arch/x86/crypto/sha512-mb/sha512_mb.c
@@ -497,10 +497,10 @@ static int sha_complete_job(struct mcryptd_hash_request_ctx *rctx,
 
                         req = cast_mcryptd_ctx_to_req(req_ctx);
                         if (irqs_disabled())
-                                rctx->complete(&req->base, ret);
+                                req_ctx->complete(&req->base, ret);
                         else {
                                 local_bh_disable();
-                                rctx->complete(&req->base, ret);
+                                req_ctx->complete(&req->base, ret);
                                 local_bh_enable();
                         }
                 }
diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
index e6131d4454e6..65577f081d07 100644
--- a/arch/x86/events/amd/uncore.c
+++ b/arch/x86/events/amd/uncore.c
@@ -29,6 +29,8 @@
 
 #define COUNTER_SHIFT           16
 
+static HLIST_HEAD(uncore_unused_list);
+
 struct amd_uncore {
         int id;
         int refcnt;
@@ -39,7 +41,7 @@ struct amd_uncore {
         cpumask_t *active_mask;
         struct pmu *pmu;
         struct perf_event *events[MAX_COUNTERS];
-        struct amd_uncore *free_when_cpu_online;
+        struct hlist_node node;
 };
 
 static struct amd_uncore * __percpu *amd_uncore_nb;
@@ -306,6 +308,7 @@ static int amd_uncore_cpu_up_prepare(unsigned int cpu)
                 uncore_nb->msr_base = MSR_F15H_NB_PERF_CTL;
                 uncore_nb->active_mask = &amd_nb_active_mask;
                 uncore_nb->pmu = &amd_nb_pmu;
+                uncore_nb->id = -1;
                 *per_cpu_ptr(amd_uncore_nb, cpu) = uncore_nb;
         }
 
@@ -319,6 +322,7 @@ static int amd_uncore_cpu_up_prepare(unsigned int cpu)
                 uncore_l2->msr_base = MSR_F16H_L2I_PERF_CTL;
                 uncore_l2->active_mask = &amd_l2_active_mask;
                 uncore_l2->pmu = &amd_l2_pmu;
+                uncore_l2->id = -1;
                 *per_cpu_ptr(amd_uncore_l2, cpu) = uncore_l2;
         }
 
@@ -348,7 +352,7 @@ amd_uncore_find_online_sibling(struct amd_uncore *this,
                         continue;
 
                 if (this->id == that->id) {
-                        that->free_when_cpu_online = this;
+                        hlist_add_head(&this->node, &uncore_unused_list);
                         this = that;
                         break;
                 }
@@ -388,13 +392,23 @@ static int amd_uncore_cpu_starting(unsigned int cpu)
         return 0;
 }
 
+static void uncore_clean_online(void)
+{
+        struct amd_uncore *uncore;
+        struct hlist_node *n;
+
+        hlist_for_each_entry_safe(uncore, n, &uncore_unused_list, node) {
+                hlist_del(&uncore->node);
+                kfree(uncore);
+        }
+}
+
 static void uncore_online(unsigned int cpu,
                           struct amd_uncore * __percpu *uncores)
 {
         struct amd_uncore *uncore = *per_cpu_ptr(uncores, cpu);
 
-        kfree(uncore->free_when_cpu_online);
-        uncore->free_when_cpu_online = NULL;
+        uncore_clean_online();
 
         if (cpu == uncore->cpu)
                 cpumask_set_cpu(cpu, uncore->active_mask);
diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
index 0a6e393a2e62..bdcd6510992c 100644
--- a/arch/x86/events/intel/bts.c
+++ b/arch/x86/events/intel/bts.c
@@ -31,7 +31,17 @@
 struct bts_ctx {
         struct perf_output_handle       handle;
         struct debug_store              ds_back;
-        int                             started;
+        int                             state;
+};
+
+/* BTS context states: */
+enum {
+        /* no ongoing AUX transactions */
+        BTS_STATE_STOPPED = 0,
+        /* AUX transaction is on, BTS tracing is disabled */
+        BTS_STATE_INACTIVE,
+        /* AUX transaction is on, BTS tracing is running */
+        BTS_STATE_ACTIVE,
 };
 
 static DEFINE_PER_CPU(struct bts_ctx, bts_ctx);
@@ -204,6 +214,15 @@ static void bts_update(struct bts_ctx *bts)
 static int
 bts_buffer_reset(struct bts_buffer *buf, struct perf_output_handle *handle);
 
+/*
+ * Ordering PMU callbacks wrt themselves and the PMI is done by means
+ * of bts::state, which:
+ *  - is set when bts::handle::event is valid, that is, between
+ *    perf_aux_output_begin() and perf_aux_output_end();
+ *  - is zero otherwise;
+ *  - is ordered against bts::handle::event with a compiler barrier.
+ */
+
 static void __bts_event_start(struct perf_event *event)
 {
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
@@ -221,10 +240,13 @@ static void __bts_event_start(struct perf_event *event)
 
         /*
          * local barrier to make sure that ds configuration made it
-         * before we enable BTS
+         * before we enable BTS and bts::state goes ACTIVE
          */
         wmb();
 
+        /* INACTIVE/STOPPED -> ACTIVE */
+        WRITE_ONCE(bts->state, BTS_STATE_ACTIVE);
+
         intel_pmu_enable_bts(config);
 
 }
@@ -251,9 +273,6 @@ static void bts_event_start(struct perf_event *event, int flags)
 
         __bts_event_start(event);
 
-        /* PMI handler: this counter is running and likely generating PMIs */
-        ACCESS_ONCE(bts->started) = 1;
-
         return;
 
 fail_end_stop:
@@ -263,30 +282,34 @@ fail_stop:
         event->hw.state = PERF_HES_STOPPED;
 }
 
-static void __bts_event_stop(struct perf_event *event)
+static void __bts_event_stop(struct perf_event *event, int state)
 {
+        struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
+
+        /* ACTIVE -> INACTIVE(PMI)/STOPPED(->stop()) */
+        WRITE_ONCE(bts->state, state);
+
         /*
          * No extra synchronization is mandated by the documentation to have
          * BTS data stores globally visible.
          */
         intel_pmu_disable_bts();
-
-        if (event->hw.state & PERF_HES_STOPPED)
-                return;
-
-        ACCESS_ONCE(event->hw.state) |= PERF_HES_STOPPED;
 }
 
 static void bts_event_stop(struct perf_event *event, int flags)
 {
         struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
-        struct bts_buffer *buf = perf_get_aux(&bts->handle);
+        struct bts_buffer *buf = NULL;
+        int state = READ_ONCE(bts->state);
 
-        /* PMI handler: don't restart this counter */
-        ACCESS_ONCE(bts->started) = 0;
+        if (state == BTS_STATE_ACTIVE)
+                __bts_event_stop(event, BTS_STATE_STOPPED);
 
-        __bts_event_stop(event);
+        if (state != BTS_STATE_STOPPED)
+                buf = perf_get_aux(&bts->handle);
+
+        event->hw.state |= PERF_HES_STOPPED;
 
         if (flags & PERF_EF_UPDATE) {
                 bts_update(bts);
@@ -296,6 +319,7 @@ static void bts_event_stop(struct perf_event *event, int flags)
                                 bts->handle.head =
                                         local_xchg(&buf->data_size,
                                                    buf->nr_pages << PAGE_SHIFT);
+
                         perf_aux_output_end(&bts->handle, local_xchg(&buf->data_size, 0),
                                             !!local_xchg(&buf->lost, 0));
                 }
@@ -310,8 +334,20 @@ static void bts_event_stop(struct perf_event *event, int flags)
 void intel_bts_enable_local(void)
 {
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
+        int state = READ_ONCE(bts->state);
+
+        /*
+         * Here we transition from INACTIVE to ACTIVE;
+         * if we instead are STOPPED from the interrupt handler,
+         * stay that way. Can't be ACTIVE here though.
+         */
+        if (WARN_ON_ONCE(state == BTS_STATE_ACTIVE))
+                return;
+
+        if (state == BTS_STATE_STOPPED)
+                return;
 
-        if (bts->handle.event && bts->started)
+        if (bts->handle.event)
                 __bts_event_start(bts->handle.event);
 }
 
@@ -319,8 +355,15 @@ void intel_bts_disable_local(void)
 {
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
 
+        /*
+         * Here we transition from ACTIVE to INACTIVE;
+         * do nothing for STOPPED or INACTIVE.
+         */
+        if (READ_ONCE(bts->state) != BTS_STATE_ACTIVE)
+                return;
+
         if (bts->handle.event)
-                __bts_event_stop(bts->handle.event);
+                __bts_event_stop(bts->handle.event, BTS_STATE_INACTIVE);
 }
 
 static int
@@ -335,8 +378,6 @@ bts_buffer_reset(struct bts_buffer *buf, struct perf_output_handle *handle)
                 return 0;
 
         head = handle->head & ((buf->nr_pages << PAGE_SHIFT) - 1);
-        if (WARN_ON_ONCE(head != local_read(&buf->head)))
-                return -EINVAL;
 
         phys = &buf->buf[buf->cur_buf];
         space = phys->offset + phys->displacement + phys->size - head;
@@ -403,22 +444,37 @@ bts_buffer_reset(struct bts_buffer *buf, struct perf_output_handle *handle)
 
 int intel_bts_interrupt(void)
 {
+        struct debug_store *ds = this_cpu_ptr(&cpu_hw_events)->ds;
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
         struct perf_event *event = bts->handle.event;
         struct bts_buffer *buf;
         s64 old_head;
-        int err;
+        int err = -ENOSPC, handled = 0;
 
-        if (!event || !bts->started)
-                return 0;
+        /*
+         * The only surefire way of knowing if this NMI is ours is by checking
+         * the write ptr against the PMI threshold.
+         */
+        if (ds->bts_index >= ds->bts_interrupt_threshold)
+                handled = 1;
+
+        /*
+         * this is wrapped in intel_bts_enable_local/intel_bts_disable_local,
+         * so we can only be INACTIVE or STOPPED
+         */
+        if (READ_ONCE(bts->state) == BTS_STATE_STOPPED)
+                return handled;
 
         buf = perf_get_aux(&bts->handle);
+        if (!buf)
+                return handled;
+
         /*
          * Skip snapshot counters: they don't use the interrupt, but
          * there's no other way of telling, because the pointer will
          * keep moving
          */
-        if (!buf || buf->snapshot)
+        if (buf->snapshot)
                 return 0;
 
         old_head = local_read(&buf->head);
@@ -426,18 +482,27 @@ int intel_bts_interrupt(void)
 
         /* no new data */
         if (old_head == local_read(&buf->head))
-                return 0;
+                return handled;
 
         perf_aux_output_end(&bts->handle, local_xchg(&buf->data_size, 0),
                             !!local_xchg(&buf->lost, 0));
 
         buf = perf_aux_output_begin(&bts->handle, event);
-        if (!buf)
-                return 1;
+        if (buf)
+                err = bts_buffer_reset(buf, &bts->handle);
+
+        if (err) {
+                WRITE_ONCE(bts->state, BTS_STATE_STOPPED);
 
-        err = bts_buffer_reset(buf, &bts->handle);
-        if (err)
-                perf_aux_output_end(&bts->handle, 0, false);
+                if (buf) {
+                        /*
+                         * BTS_STATE_STOPPED should be visible before
+                         * cleared handle::event
+                         */
+                        barrier();
+                        perf_aux_output_end(&bts->handle, 0, false);
+                }
+        }
 
         return 1;
 }
diff --git a/arch/x86/events/intel/cqm.c b/arch/x86/events/intel/cqm.c
index 783c49ddef29..8f82b02934fa 100644
--- a/arch/x86/events/intel/cqm.c
+++ b/arch/x86/events/intel/cqm.c
@@ -458,6 +458,11 @@ static void __intel_cqm_event_count(void *info);
 static void init_mbm_sample(u32 rmid, u32 evt_type);
 static void __intel_mbm_event_count(void *info);
 
+static bool is_cqm_event(int e)
+{
+        return (e == QOS_L3_OCCUP_EVENT_ID);
+}
+
 static bool is_mbm_event(int e)
 {
         return (e >= QOS_MBM_TOTAL_EVENT_ID && e <= QOS_MBM_LOCAL_EVENT_ID);
@@ -1366,6 +1371,10 @@ static int intel_cqm_event_init(struct perf_event *event)
              (event->attr.config > QOS_MBM_LOCAL_EVENT_ID))
                 return -EINVAL;
 
+        if ((is_cqm_event(event->attr.config) && !cqm_enabled) ||
+            (is_mbm_event(event->attr.config) && !mbm_enabled))
+                return -EINVAL;
+
         /* unsupported modes and filters */
         if (event->attr.exclude_user   ||
             event->attr.exclude_kernel ||
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index 7ce9f3f669e6..9b983a474253 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -1274,18 +1274,18 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs)
                 struct pebs_record_nhm *p = at;
                 u64 pebs_status;
 
-                /* PEBS v3 has accurate status bits */
+                pebs_status = p->status & cpuc->pebs_enabled;
+                pebs_status &= (1ULL << x86_pmu.max_pebs_events) - 1;
+
+                /* PEBS v3 has more accurate status bits */
                 if (x86_pmu.intel_cap.pebs_format >= 3) {
-                        for_each_set_bit(bit, (unsigned long *)&p->status,
-                                         MAX_PEBS_EVENTS)
+                        for_each_set_bit(bit, (unsigned long *)&pebs_status,
+                                         x86_pmu.max_pebs_events)
                                 counts[bit]++;
 
                         continue;
                 }
 
-                pebs_status = p->status & cpuc->pebs_enabled;
-                pebs_status &= (1ULL << x86_pmu.max_pebs_events) - 1;
-
                 /*
                  * On some CPUs the PEBS status can be zero when PEBS is
                  * racing with clearing of GLOBAL_STATUS.
@@ -1333,8 +1333,11 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs)
                         continue;
 
                 event = cpuc->events[bit];
-                WARN_ON_ONCE(!event);
-                WARN_ON_ONCE(!event->attr.precise_ip);
+                if (WARN_ON_ONCE(!event))
+                        continue;
+
+                if (WARN_ON_ONCE(!event->attr.precise_ip))
+                        continue;
 
                 /* log dropped samples number */
                 if (error[bit])
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index a0ae610b9280..e3af86f58eaf 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -697,44 +697,15 @@ unsigned long __must_check _copy_from_user(void *to, const void __user *from,
 unsigned long __must_check _copy_to_user(void __user *to, const void *from,
                                          unsigned n);
 
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-# define copy_user_diag __compiletime_error
-#else
-# define copy_user_diag __compiletime_warning
-#endif
-
-extern void copy_user_diag("copy_from_user() buffer size is too small")
-copy_from_user_overflow(void);
-extern void copy_user_diag("copy_to_user() buffer size is too small")
-copy_to_user_overflow(void) __asm__("copy_from_user_overflow");
-
-#undef copy_user_diag
-
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-
-extern void
-__compiletime_warning("copy_from_user() buffer size is not provably correct")
-__copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
-#define __copy_from_user_overflow(size, count) __copy_from_user_overflow()
-
-extern void
-__compiletime_warning("copy_to_user() buffer size is not provably correct")
-__copy_to_user_overflow(void) __asm__("copy_from_user_overflow");
-#define __copy_to_user_overflow(size, count) __copy_to_user_overflow()
-
-#else
+extern void __compiletime_error("usercopy buffer size is too small")
+__bad_copy_user(void);
 
-static inline void
-__copy_from_user_overflow(int size, unsigned long count)
+static inline void copy_user_overflow(int size, unsigned long count)
 {
         WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
 }
 
-#define __copy_to_user_overflow __copy_from_user_overflow
-
-#endif
-
-static inline unsigned long __must_check
+static __always_inline unsigned long __must_check
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
         int sz = __compiletime_object_size(to);
@@ -743,36 +714,18 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
 
         kasan_check_write(to, n);
 
-        /*
-         * While we would like to have the compiler do the checking for us
-         * even in the non-constant size case, any false positives there are
-         * a problem (especially when DEBUG_STRICT_USER_COPY_CHECKS, but even
-         * without - the [hopefully] dangerous looking nature of the warning
-         * would make people go look at the respecitive call sites over and
-         * over again just to find that there's no problem).
-         *
-         * And there are cases where it's just not realistic for the compiler
-         * to prove the count to be in range. For example when multiple call
-         * sites of a helper function - perhaps in different source files -
-         * all doing proper range checking, yet the helper function not doing
-         * so again.
-         *
-         * Therefore limit the compile time checking to the constant size
-         * case, and do only runtime checking for non-constant sizes.
-         */
-
         if (likely(sz < 0 || sz >= n)) {
                 check_object_size(to, n, false);
                 n = _copy_from_user(to, from, n);
-        } else if (__builtin_constant_p(n))
-                copy_from_user_overflow();
+        } else if (!__builtin_constant_p(n))
+                copy_user_overflow(sz, n);
         else
-                __copy_from_user_overflow(sz, n);
+                __bad_copy_user();
 
         return n;
 }
 
-static inline unsigned long __must_check
+static __always_inline unsigned long __must_check
 copy_to_user(void __user *to, const void *from, unsigned long n)
 {
         int sz = __compiletime_object_size(from);
@@ -781,21 +734,17 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
 
         might_fault();
 
-        /* See the comment in copy_from_user() above. */
         if (likely(sz < 0 || sz >= n)) {
                 check_object_size(from, n, true);
                 n = _copy_to_user(to, from, n);
-        } else if (__builtin_constant_p(n))
-                copy_to_user_overflow();
+        } else if (!__builtin_constant_p(n))
+                copy_user_overflow(sz, n);
         else
-                __copy_to_user_overflow(sz, n);
+                __bad_copy_user();
 
         return n;
 }
 
-#undef __copy_from_user_overflow
-#undef __copy_to_user_overflow
-
 /*
  * We rely on the nested NMI work to allow atomic faults from the NMI path; the
  * nested NMI paths are careful to preserve CR2.
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index cea4fc19e844..f3e9b2df4b16 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1623,6 +1623,9 @@ void __init enable_IR_x2apic(void)
         unsigned long flags;
         int ret, ir_stat;
 
+        if (skip_ioapic_setup)
+                return;
+
         ir_stat = irq_remapping_prepare();
         if (ir_stat < 0 && !x2apic_supported())
                 return;
@@ -2090,7 +2093,6 @@ int generic_processor_info(int apicid, int version)
                 return -EINVAL;
         }
 
-        num_processors++;
         if (apicid == boot_cpu_physical_apicid) {
                 /*
                  * x86_bios_cpu_apicid is required to have processors listed
@@ -2113,10 +2115,13 @@ int generic_processor_info(int apicid, int version)
 
                 pr_warning("APIC: Package limit reached. Processor %d/0x%x ignored.\n",
                            thiscpu, apicid);
+
                 disabled_cpus++;
                 return -ENOSPC;
         }
 
+        num_processors++;
+
         /*
          * Validate version
          */
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index f5c69d8974e1..b81fe2d63e15 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -669,6 +669,17 @@ static void init_amd_gh(struct cpuinfo_x86 *c)
                 set_cpu_bug(c, X86_BUG_AMD_TLB_MMATCH);
 }
 
+#define MSR_AMD64_DE_CFG        0xC0011029
+
+static void init_amd_ln(struct cpuinfo_x86 *c)
+{
+        /*
+         * Apply erratum 665 fix unconditionally so machines without a BIOS
+         * fix work.
+         */
+        msr_set_bit(MSR_AMD64_DE_CFG, 31);
+}
+
 static void init_amd_bd(struct cpuinfo_x86 *c)
 {
         u64 value;
@@ -726,6 +737,7 @@ static void init_amd(struct cpuinfo_x86 *c)
         case 6:    init_amd_k7(c); break;
         case 0xf:  init_amd_k8(c); break;
         case 0x10: init_amd_gh(c); break;
+        case 0x12: init_amd_ln(c); break;
         case 0x15: init_amd_bd(c); break;
         }
 
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index b816971f5da4..620ab06bcf45 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -54,6 +54,7 @@ static LIST_HEAD(pcache);
  */
 static u8 *container;
 static size_t container_size;
+static bool ucode_builtin;
 
 static u32 ucode_new_rev;
 static u8 amd_ucode_patch[PATCH_MAX_SIZE];
@@ -281,18 +282,22 @@ static bool __init load_builtin_amd_microcode(struct cpio_data *cp,
 void __init load_ucode_amd_bsp(unsigned int family)
 {
         struct cpio_data cp;
+        bool *builtin;
         void **data;
         size_t *size;
 
 #ifdef CONFIG_X86_32
         data =  (void **)__pa_nodebug(&ucode_cpio.data);
         size = (size_t *)__pa_nodebug(&ucode_cpio.size);
+        builtin = (bool *)__pa_nodebug(&ucode_builtin);
 #else
         data = &ucode_cpio.data;
         size = &ucode_cpio.size;
+        builtin = &ucode_builtin;
 #endif
 
-        if (!load_builtin_amd_microcode(&cp, family))
+        *builtin = load_builtin_amd_microcode(&cp, family);
+        if (!*builtin)
                 cp = find_ucode_in_initrd();
 
         if (!(cp.data && cp.size))
@@ -373,7 +378,8 @@ void load_ucode_amd_ap(void)
                 return;
 
         /* Add CONFIG_RANDOMIZE_MEMORY offset. */
-        cont += PAGE_OFFSET - __PAGE_OFFSET_BASE;
+        if (!ucode_builtin)
+                cont += PAGE_OFFSET - __PAGE_OFFSET_BASE;
 
         eax = cpuid_eax(0x00000001);
         eq  = (struct equiv_cpu_entry *)(cont + CONTAINER_HDR_SZ);
@@ -439,7 +445,8 @@ int __init save_microcode_in_initrd_amd(void)
                 container = cont_va;
 
         /* Add CONFIG_RANDOMIZE_MEMORY offset. */
-        container += PAGE_OFFSET - __PAGE_OFFSET_BASE;
+        if (!ucode_builtin)
+                container += PAGE_OFFSET - __PAGE_OFFSET_BASE;
 
         eax   = cpuid_eax(0x00000001);
         eax   = ((eax >> 8) & 0xf) + ((eax >> 20) & 0xff);
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index 0964399ef942..60b9949f1e65 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -289,6 +289,7 @@ void __init kvmclock_init(void)
         put_cpu();
 
         x86_platform.calibrate_tsc = kvm_get_tsc_khz;
+        x86_platform.calibrate_cpu = kvm_get_tsc_khz;
         x86_platform.get_wallclock = kvm_get_wallclock;
         x86_platform.set_wallclock = kvm_set_wallclock;
 #ifdef CONFIG_X86_LOCAL_APIC
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index b8e4680a2e0b..bef340082d20 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -56,12 +56,12 @@ asm (".pushsection .entry.text, \"ax\"\n"
      ".popsection");
 
 /* identity function, which can be inlined */
-u32 _paravirt_ident_32(u32 x)
+u32 notrace _paravirt_ident_32(u32 x)
 {
         return x;
 }
 
-u64 _paravirt_ident_64(u64 x)
+u64 notrace _paravirt_ident_64(u64 x)
 {
         return x;
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 87eaa6bfc26a..121fdf6e9ed0 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -422,6 +422,7 @@ struct nested_vmx {
         struct list_head vmcs02_pool;
         int vmcs02_num;
         u64 vmcs01_tsc_offset;
+        bool change_vmcs01_virtual_x2apic_mode;
         /* L2 must run next, and mustn't decide to exit to L1. */
         bool nested_run_pending;
         /*
@@ -435,6 +436,8 @@ struct nested_vmx {
         bool pi_pending;
         u16 posted_intr_nv;
 
+        unsigned long *msr_bitmap;
+
         struct hrtimer preemption_timer;
         bool preemption_timer_expired;
 
@@ -924,7 +927,6 @@ static unsigned long *vmx_msr_bitmap_legacy;
 static unsigned long *vmx_msr_bitmap_longmode;
 static unsigned long *vmx_msr_bitmap_legacy_x2apic;
 static unsigned long *vmx_msr_bitmap_longmode_x2apic;
-static unsigned long *vmx_msr_bitmap_nested;
 static unsigned long *vmx_vmread_bitmap;
 static unsigned long *vmx_vmwrite_bitmap;
 
@@ -2198,6 +2200,12 @@ static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
                         new.control) != old.control);
 }
 
+static void decache_tsc_multiplier(struct vcpu_vmx *vmx)
+{
+        vmx->current_tsc_ratio = vmx->vcpu.arch.tsc_scaling_ratio;
+        vmcs_write64(TSC_MULTIPLIER, vmx->current_tsc_ratio);
+}
+
 /*
  * Switches to specified vcpu, until a matching vcpu_put(), but assumes
  * vcpu mutex is already taken.
@@ -2256,10 +2264,8 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 
         /* Setup TSC multiplier */
         if (kvm_has_tsc_control &&
-            vmx->current_tsc_ratio != vcpu->arch.tsc_scaling_ratio) {
-                vmx->current_tsc_ratio = vcpu->arch.tsc_scaling_ratio;
-                vmcs_write64(TSC_MULTIPLIER, vmx->current_tsc_ratio);
-        }
+            vmx->current_tsc_ratio != vcpu->arch.tsc_scaling_ratio)
+                decache_tsc_multiplier(vmx);
 
         vmx_vcpu_pi_load(vcpu, cpu);
         vmx->host_pkru = read_pkru();
@@ -2508,7 +2514,7 @@ static void vmx_set_msr_bitmap(struct kvm_vcpu *vcpu)
         unsigned long *msr_bitmap;
 
         if (is_guest_mode(vcpu))
-                msr_bitmap = vmx_msr_bitmap_nested;
+                msr_bitmap = to_vmx(vcpu)->nested.msr_bitmap;
         else if (cpu_has_secondary_exec_ctrls() &&
                  (vmcs_read32(SECONDARY_VM_EXEC_CONTROL) &
                   SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE)) {
@@ -6363,13 +6369,6 @@ static __init int hardware_setup(void)
         if (!vmx_msr_bitmap_longmode_x2apic)
                 goto out4;
 
-        if (nested) {
-                vmx_msr_bitmap_nested =
-                        (unsigned long *)__get_free_page(GFP_KERNEL);
-                if (!vmx_msr_bitmap_nested)
-                        goto out5;
-        }
-
         vmx_vmread_bitmap = (unsigned long *)__get_free_page(GFP_KERNEL);
         if (!vmx_vmread_bitmap)
                 goto out6;
@@ -6392,8 +6391,6 @@ static __init int hardware_setup(void)
 
         memset(vmx_msr_bitmap_legacy, 0xff, PAGE_SIZE);
         memset(vmx_msr_bitmap_longmode, 0xff, PAGE_SIZE);
-        if (nested)
-                memset(vmx_msr_bitmap_nested, 0xff, PAGE_SIZE);
 
         if (setup_vmcs_config(&vmcs_config) < 0) {
                 r = -EIO;
@@ -6529,9 +6526,6 @@ out8:
 out7:
         free_page((unsigned long)vmx_vmread_bitmap);
 out6:
-        if (nested)
-                free_page((unsigned long)vmx_msr_bitmap_nested);
-out5:
         free_page((unsigned long)vmx_msr_bitmap_longmode_x2apic);
 out4:
         free_page((unsigned long)vmx_msr_bitmap_longmode);
@@ -6557,8 +6551,6 @@ static __exit void hardware_unsetup(void)
         free_page((unsigned long)vmx_io_bitmap_a);
         free_page((unsigned long)vmx_vmwrite_bitmap);
         free_page((unsigned long)vmx_vmread_bitmap);
-        if (nested)
-                free_page((unsigned long)vmx_msr_bitmap_nested);
 
         free_kvm_area();
 }
@@ -6995,16 +6987,21 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
                 return 1;
         }
 
+        if (cpu_has_vmx_msr_bitmap()) {
+                vmx->nested.msr_bitmap =
+                                (unsigned long *)__get_free_page(GFP_KERNEL);
+                if (!vmx->nested.msr_bitmap)
+                        goto out_msr_bitmap;
+        }
+
         vmx->nested.cached_vmcs12 = kmalloc(VMCS12_SIZE, GFP_KERNEL);
         if (!vmx->nested.cached_vmcs12)
-                return -ENOMEM;
+                goto out_cached_vmcs12;
 
         if (enable_shadow_vmcs) {
                 shadow_vmcs = alloc_vmcs();
-                if (!shadow_vmcs) {
-                        kfree(vmx->nested.cached_vmcs12);
-                        return -ENOMEM;
-                }
+                if (!shadow_vmcs)
+                        goto out_shadow_vmcs;
                 /* mark vmcs as shadow */
                 shadow_vmcs->revision_id |= (1u << 31);
                 /* init shadow vmcs */
@@ -7024,6 +7021,15 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
         skip_emulated_instruction(vcpu);
         nested_vmx_succeed(vcpu);
         return 1;
+
+out_shadow_vmcs:
+        kfree(vmx->nested.cached_vmcs12);
+
+out_cached_vmcs12:
+        free_page((unsigned long)vmx->nested.msr_bitmap);
+
+out_msr_bitmap:
+        return -ENOMEM;
 }
 
 /*
@@ -7098,6 +7104,10 @@ static void free_nested(struct vcpu_vmx *vmx)
         vmx->nested.vmxon = false;
         free_vpid(vmx->nested.vpid02);
         nested_release_vmcs12(vmx);
+        if (vmx->nested.msr_bitmap) {
+                free_page((unsigned long)vmx->nested.msr_bitmap);
+                vmx->nested.msr_bitmap = NULL;
+        }
         if (enable_shadow_vmcs)
                 free_vmcs(vmx->nested.current_shadow_vmcs);
         kfree(vmx->nested.cached_vmcs12);
@@ -8419,6 +8429,12 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set)
 {
         u32 sec_exec_control;
 
+        /* Postpone execution until vmcs01 is the current VMCS. */
+        if (is_guest_mode(vcpu)) {
+                to_vmx(vcpu)->nested.change_vmcs01_virtual_x2apic_mode = true;
+                return;
+        }
+
         /*
          * There is not point to enable virtualize x2apic without enable
          * apicv
@@ -9472,8 +9488,10 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu,
 {
         int msr;
         struct page *page;
-        unsigned long *msr_bitmap;
+        unsigned long *msr_bitmap_l1;
+        unsigned long *msr_bitmap_l0 = to_vmx(vcpu)->nested.msr_bitmap;
 
+        /* This shortcut is ok because we support only x2APIC MSRs so far. */
         if (!nested_cpu_has_virt_x2apic_mode(vmcs12))
                 return false;
 
@@ -9482,63 +9500,37 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu,
                 WARN_ON(1);
                 return false;
         }
-        msr_bitmap = (unsigned long *)kmap(page);
-        if (!msr_bitmap) {
+        msr_bitmap_l1 = (unsigned long *)kmap(page);
+        if (!msr_bitmap_l1) {
                 nested_release_page_clean(page);
                 WARN_ON(1);
                 return false;
         }
 
+        memset(msr_bitmap_l0, 0xff, PAGE_SIZE);
+
         if (nested_cpu_has_virt_x2apic_mode(vmcs12)) {
                 if (nested_cpu_has_apic_reg_virt(vmcs12))
                         for (msr = 0x800; msr <= 0x8ff; msr++)
                                 nested_vmx_disable_intercept_for_msr(
-                                        msr_bitmap,
-                                        vmx_msr_bitmap_nested,
+                                        msr_bitmap_l1, msr_bitmap_l0,
                                         msr, MSR_TYPE_R);
-                /* TPR is allowed */
-                nested_vmx_disable_intercept_for_msr(msr_bitmap,
-                                vmx_msr_bitmap_nested,
+
+                nested_vmx_disable_intercept_for_msr(
+                                msr_bitmap_l1, msr_bitmap_l0,
                                 APIC_BASE_MSR + (APIC_TASKPRI >> 4),
                                 MSR_TYPE_R | MSR_TYPE_W);
+
                 if (nested_cpu_has_vid(vmcs12)) {
-                        /* EOI and self-IPI are allowed */
                         nested_vmx_disable_intercept_for_msr(
-                                msr_bitmap,
-                                vmx_msr_bitmap_nested,
+                                msr_bitmap_l1, msr_bitmap_l0,
                                 APIC_BASE_MSR + (APIC_EOI >> 4),
                                 MSR_TYPE_W);
                         nested_vmx_disable_intercept_for_msr(
-                                msr_bitmap,
-                                vmx_msr_bitmap_nested,
+                                msr_bitmap_l1, msr_bitmap_l0,
                                 APIC_BASE_MSR + (APIC_SELF_IPI >> 4),
                                 MSR_TYPE_W);
                 }
-        } else {
-                /*
-                 * Enable reading intercept of all the x2apic
-                 * MSRs. We should not rely on vmcs12 to do any
-                 * optimizations here, it may have been modified
-                 * by L1.
-                 */
-                for (msr = 0x800; msr <= 0x8ff; msr++)
-                        __vmx_enable_intercept_for_msr(
-                                vmx_msr_bitmap_nested,
-                                msr,
-                                MSR_TYPE_R);
-
-                __vmx_enable_intercept_for_msr(
-                                vmx_msr_bitmap_nested,
-                                APIC_BASE_MSR + (APIC_TASKPRI >> 4),
-                                MSR_TYPE_W);
-                __vmx_enable_intercept_for_msr(
-                                vmx_msr_bitmap_nested,
-                                APIC_BASE_MSR + (APIC_EOI >> 4),
-                                MSR_TYPE_W);
-                __vmx_enable_intercept_for_msr(
-                                vmx_msr_bitmap_nested,
-                                APIC_BASE_MSR + (APIC_SELF_IPI >> 4),
-                                MSR_TYPE_W);
         }
         kunmap(page);
         nested_release_page_clean(page);
@@ -9957,10 +9949,10 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
         }
 
         if (cpu_has_vmx_msr_bitmap() &&
-            exec_control & CPU_BASED_USE_MSR_BITMAPS) {
-                nested_vmx_merge_msr_bitmap(vcpu, vmcs12);
-                /* MSR_BITMAP will be set by following vmx_set_efer. */
-        } else
+            exec_control & CPU_BASED_USE_MSR_BITMAPS &&
+            nested_vmx_merge_msr_bitmap(vcpu, vmcs12))
+                ; /* MSR_BITMAP will be set by following vmx_set_efer. */
+        else
                 exec_control &= ~CPU_BASED_USE_MSR_BITMAPS;
 
         /*
@@ -10011,6 +10003,8 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
                         vmx->nested.vmcs01_tsc_offset + vmcs12->tsc_offset);
         else
                 vmcs_write64(TSC_OFFSET, vmx->nested.vmcs01_tsc_offset);
+        if (kvm_has_tsc_control)
+                decache_tsc_multiplier(vmx);
 
         if (enable_vpid) {
                 /*
@@ -10767,6 +10761,14 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
         else
                 vmcs_set_bits(PIN_BASED_VM_EXEC_CONTROL,
                               PIN_BASED_VMX_PREEMPTION_TIMER);
+        if (kvm_has_tsc_control)
+                decache_tsc_multiplier(vmx);
+
+        if (vmx->nested.change_vmcs01_virtual_x2apic_mode) {
+                vmx->nested.change_vmcs01_virtual_x2apic_mode = false;
+                vmx_set_virtual_x2apic_mode(vcpu,
+                                vcpu->arch.apic_base & X2APIC_ENABLE);
+        }
 
         /* This is needed for same reason as it was needed in prepare_vmcs02 */
         vmx->host_rsp = 0;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 19f9f9e05c2a..699f8726539a 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2743,16 +2743,16 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
                 if (tsc_delta < 0)
                         mark_tsc_unstable("KVM discovered backwards TSC");
 
-                if (kvm_lapic_hv_timer_in_use(vcpu) &&
-                                kvm_x86_ops->set_hv_timer(vcpu,
-                                        kvm_get_lapic_tscdeadline_msr(vcpu)))
-                        kvm_lapic_switch_to_sw_timer(vcpu);
                 if (check_tsc_unstable()) {
                         u64 offset = kvm_compute_tsc_offset(vcpu,
                                                 vcpu->arch.last_guest_tsc);
                         kvm_x86_ops->write_tsc_offset(vcpu, offset);
                         vcpu->arch.tsc_catchup = 1;
                 }
+                if (kvm_lapic_hv_timer_in_use(vcpu) &&
+                                kvm_x86_ops->set_hv_timer(vcpu,
+                                        kvm_get_lapic_tscdeadline_msr(vcpu)))
+                        kvm_lapic_switch_to_sw_timer(vcpu);
                 /*
                  * On a host with synchronized TSC, there is no need to update
                  * kvmclock on vcpu->cpu migration
diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c
index aec03aa96312..ddd2661c4502 100644
--- a/arch/x86/mm/kaslr.c
+++ b/arch/x86/mm/kaslr.c
@@ -87,7 +87,7 @@ static inline unsigned long get_padding(struct kaslr_memory_region *region)
  */
 static inline bool kaslr_memory_enabled(void)
 {
-        return kaslr_enabled() && !config_enabled(CONFIG_KASAN);
+        return kaslr_enabled() && !IS_ENABLED(CONFIG_KASAN);
 }
 
 /* Initialize base and padding for each memory region randomized with KASLR */
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index ecb1b69c1651..170cc4ff057b 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -927,9 +927,10 @@ int track_pfn_copy(struct vm_area_struct *vma)
 }
 
 /*
- * prot is passed in as a parameter for the new mapping. If the vma has a
- * linear pfn mapping for the entire range reserve the entire vma range with
- * single reserve_pfn_range call.
+ * prot is passed in as a parameter for the new mapping. If the vma has
+ * a linear pfn mapping for the entire range, or no vma is provided,
+ * reserve the entire pfn + size range with single reserve_pfn_range
+ * call.
  */
 int track_pfn_remap(struct vm_area_struct *vma, pgprot_t *prot,
                     unsigned long pfn, unsigned long addr, unsigned long size)
@@ -938,11 +939,12 @@ int track_pfn_remap(struct vm_area_struct *vma, pgprot_t *prot,
         enum page_cache_mode pcm;
 
         /* reserve the whole chunk starting from paddr */
-        if (addr == vma->vm_start && size == (vma->vm_end - vma->vm_start)) {
+        if (!vma || (addr == vma->vm_start
+                                && size == (vma->vm_end - vma->vm_start))) {
                 int ret;
 
                 ret = reserve_pfn_range(paddr, size, prot, 0);
-                if (!ret)
+                if (ret == 0 && vma)
                         vma->vm_flags |= VM_PAT;
                 return ret;
         }
@@ -997,7 +999,7 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn,
         resource_size_t paddr;
         unsigned long prot;
 
-        if (!(vma->vm_flags & VM_PAT))
+        if (vma && !(vma->vm_flags & VM_PAT))
                 return;
 
         /* free the chunk starting from pfn or the whole chunk */
@@ -1011,7 +1013,8 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn,
                 size = vma->vm_end - vma->vm_start;
         }
         free_pfn_range(paddr, size);
-        vma->vm_flags &= ~VM_PAT;
+        if (vma)
+                vma->vm_flags &= ~VM_PAT;
 }
 
 /*
diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
index 837ea36a837d..6d52b94f4bb9 100644
--- a/arch/x86/pci/fixup.c
+++ b/arch/x86/pci/fixup.c
@@ -553,15 +553,21 @@ static void twinhead_reserve_killing_zone(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone);
 
 /*
- * Broadwell EP Home Agent BARs erroneously return non-zero values when read.
+ * Device [8086:2fc0]
+ * Erratum HSE43
+ * CONFIG_TDP_NOMINAL CSR Implemented at Incorrect Offset
+ * http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html
  *
- * See http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v4-spec-update.html
- * entry BDF2.
+ * Devices [8086:6f60,6fa0,6fc0]
+ * Erratum BDF2
+ * PCI BARs in the Home Agent Will Return Non-Zero Values During Enumeration
+ * http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v4-spec-update.html
  */
-static void pci_bdwep_bar(struct pci_dev *dev)
+static void pci_invalid_bar(struct pci_dev *dev)
 {
         dev->non_compliant_bars = 1;
 }
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6f60, pci_bdwep_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_bdwep_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_bdwep_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2fc0, pci_invalid_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6f60, pci_invalid_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_invalid_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_invalid_bar);
diff --git a/arch/x86/pci/vmd.c b/arch/x86/pci/vmd.c
index b814ca675131..7948be342ee9 100644
--- a/arch/x86/pci/vmd.c
+++ b/arch/x86/pci/vmd.c
@@ -41,6 +41,7 @@ static DEFINE_RAW_SPINLOCK(list_lock);
  * @node:       list item for parent traversal.
  * @rcu:        RCU callback item for freeing.
  * @irq:        back pointer to parent.
+ * @enabled:    true if driver enabled IRQ
  * @virq:       the virtual IRQ value provided to the requesting driver.
  *
  * Every MSI/MSI-X IRQ requested for a device in a VMD domain will be mapped to
@@ -50,6 +51,7 @@ struct vmd_irq {
         struct list_head        node;
         struct rcu_head         rcu;
         struct vmd_irq_list     *irq;
+        bool                    enabled;
         unsigned int            virq;
 };
 
@@ -122,7 +124,9 @@ static void vmd_irq_enable(struct irq_data *data)
         unsigned long flags;
 
         raw_spin_lock_irqsave(&list_lock, flags);
+        WARN_ON(vmdirq->enabled);
         list_add_tail_rcu(&vmdirq->node, &vmdirq->irq->irq_list);
+        vmdirq->enabled = true;
         raw_spin_unlock_irqrestore(&list_lock, flags);
 
         data->chip->irq_unmask(data);
@@ -136,8 +140,10 @@ static void vmd_irq_disable(struct irq_data *data)
         data->chip->irq_mask(data);
 
         raw_spin_lock_irqsave(&list_lock, flags);
-        list_del_rcu(&vmdirq->node);
-        INIT_LIST_HEAD_RCU(&vmdirq->node);
+        if (vmdirq->enabled) {
+                list_del_rcu(&vmdirq->node);
+                vmdirq->enabled = false;
+        }
         raw_spin_unlock_irqrestore(&list_lock, flags);
 }
 
diff --git a/arch/x86/um/ptrace_32.c b/arch/x86/um/ptrace_32.c
index ebd4dd6ef73b..a7ef7b131e25 100644
--- a/arch/x86/um/ptrace_32.c
+++ b/arch/x86/um/ptrace_32.c
@@ -84,7 +84,10 @@ int putreg(struct task_struct *child, int regno, unsigned long value)
         case EAX:
         case EIP:
         case UESP:
+                break;
         case ORIG_EAX:
+                /* Update the syscall number. */
+                UPT_SYSCALL_NR(&child->thread.regs.regs) = value;
                 break;
         case FS:
                 if (value && (value & 3) != 3)
diff --git a/arch/x86/um/ptrace_64.c b/arch/x86/um/ptrace_64.c
index faab418876ce..0b5c184dd5b3 100644
--- a/arch/x86/um/ptrace_64.c
+++ b/arch/x86/um/ptrace_64.c
@@ -78,7 +78,11 @@ int putreg(struct task_struct *child, int regno, unsigned long value)
         case RSI:
         case RDI:
         case RBP:
+                break;
+
         case ORIG_RAX:
+                /* Update the syscall number. */
+                UPT_SYSCALL_NR(&child->thread.regs.regs) = value;
                 break;
 
         case FS:
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 8ffb089b19a5..b86ebb1a9a7f 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -118,7 +118,7 @@ DEFINE_PER_CPU(struct vcpu_info *, xen_vcpu);
 DEFINE_PER_CPU(struct vcpu_info, xen_vcpu_info);
 
 /* Linux <-> Xen vCPU id mapping */
-DEFINE_PER_CPU(int, xen_vcpu_id) = -1;
+DEFINE_PER_CPU(uint32_t, xen_vcpu_id);
 EXPORT_PER_CPU_SYMBOL(xen_vcpu_id);
 
 enum xen_domain_type xen_domain_type = XEN_NATIVE;
diff --git a/block/bio.c b/block/bio.c
index f39477538fef..aa7354088008 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -667,18 +667,19 @@ struct bio *bio_clone_bioset(struct bio *bio_src, gfp_t gfp_mask,
         bio->bi_iter.bi_sector  = bio_src->bi_iter.bi_sector;
         bio->bi_iter.bi_size    = bio_src->bi_iter.bi_size;
 
-        if (bio_op(bio) == REQ_OP_DISCARD)
-                goto integrity_clone;
-
-        if (bio_op(bio) == REQ_OP_WRITE_SAME) {
+        switch (bio_op(bio)) {
+        case REQ_OP_DISCARD:
+        case REQ_OP_SECURE_ERASE:
+                break;
+        case REQ_OP_WRITE_SAME:
                 bio->bi_io_vec[bio->bi_vcnt++] = bio_src->bi_io_vec[0];
-                goto integrity_clone;
+                break;
+        default:
+                bio_for_each_segment(bv, bio_src, iter)
+                        bio->bi_io_vec[bio->bi_vcnt++] = bv;
+                break;
         }
 
-        bio_for_each_segment(bv, bio_src, iter)
-                bio->bi_io_vec[bio->bi_vcnt++] = bv;
-
-integrity_clone:
         if (bio_integrity(bio_src)) {
                 int ret;
 
@@ -1788,7 +1789,7 @@ struct bio *bio_split(struct bio *bio, int sectors,
          * Discards need a mutable bio_vec to accommodate the payload
          * required by the DSM TRIM and UNMAP commands.
          */
-        if (bio_op(bio) == REQ_OP_DISCARD)
+        if (bio_op(bio) == REQ_OP_DISCARD || bio_op(bio) == REQ_OP_SECURE_ERASE)
                 split = bio_clone_bioset(bio, gfp, bs);
         else
                 split = bio_clone_fast(bio, gfp, bs);
diff --git a/block/blk-core.c b/block/blk-core.c
index 999442ec4601..36c7ac328d8c 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -515,7 +515,9 @@ EXPORT_SYMBOL_GPL(blk_queue_bypass_end);
 
 void blk_set_queue_dying(struct request_queue *q)
 {
-        queue_flag_set_unlocked(QUEUE_FLAG_DYING, q);
+        spin_lock_irq(q->queue_lock);
+        queue_flag_set(QUEUE_FLAG_DYING, q);
+        spin_unlock_irq(q->queue_lock);
 
         if (q->mq_ops)
                 blk_mq_wake_waiters(q);
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 3eec75a9e91d..2642e5fc8b69 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -94,9 +94,31 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
         bool do_split = true;
         struct bio *new = NULL;
         const unsigned max_sectors = get_max_io_size(q, bio);
+        unsigned bvecs = 0;
 
         bio_for_each_segment(bv, bio, iter) {
                 /*
+                 * With arbitrary bio size, the incoming bio may be very
+                 * big. We have to split the bio into small bios so that
+                 * each holds at most BIO_MAX_PAGES bvecs because
+                 * bio_clone() can fail to allocate big bvecs.
+                 *
+                 * It should have been better to apply the limit per
+                 * request queue in which bio_clone() is involved,
+                 * instead of globally. The biggest blocker is the
+                 * bio_clone() in bio bounce.
+                 *
+                 * If bio is splitted by this reason, we should have
+                 * allowed to continue bios merging, but don't do
+                 * that now for making the change simple.
+                 *
+                 * TODO: deal with bio bounce's bio_clone() gracefully
+                 * and convert the global limit into per-queue limit.
+                 */
+                if (bvecs++ >= BIO_MAX_PAGES)
+                        goto split;
+
+                /*
                  * If the queue doesn't support SG gaps and adding this
                  * offset would create a gap, disallow it.
                  */
@@ -172,12 +194,18 @@ void blk_queue_split(struct request_queue *q, struct bio **bio,
         struct bio *split, *res;
         unsigned nsegs;
 
-        if (bio_op(*bio) == REQ_OP_DISCARD)
+        switch (bio_op(*bio)) {
+        case REQ_OP_DISCARD:
+        case REQ_OP_SECURE_ERASE:
                 split = blk_bio_discard_split(q, *bio, bs, &nsegs);
-        else if (bio_op(*bio) == REQ_OP_WRITE_SAME)
+                break;
+        case REQ_OP_WRITE_SAME:
                 split = blk_bio_write_same_split(q, *bio, bs, &nsegs);
-        else
+                break;
+        default:
                 split = blk_bio_segment_split(q, *bio, q->bio_split, &nsegs);
+                break;
+        }
 
         /* physical segments can be figured out during splitting */
         res = split ? split : *bio;
@@ -213,7 +241,7 @@ static unsigned int __blk_recalc_rq_segments(struct request_queue *q,
          * This should probably be returning 0, but blk_add_request_payload()
          * (Christoph!!!!)
          */
-        if (bio_op(bio) == REQ_OP_DISCARD)
+        if (bio_op(bio) == REQ_OP_DISCARD || bio_op(bio) == REQ_OP_SECURE_ERASE)
                 return 1;
 
         if (bio_op(bio) == REQ_OP_WRITE_SAME)
@@ -385,7 +413,9 @@ static int __blk_bios_map_sg(struct request_queue *q, struct bio *bio,
         nsegs = 0;
         cluster = blk_queue_cluster(q);
 
-        if (bio_op(bio) == REQ_OP_DISCARD) {
+        switch (bio_op(bio)) {
+        case REQ_OP_DISCARD:
+        case REQ_OP_SECURE_ERASE:
                 /*
                  * This is a hack - drivers should be neither modifying the
                  * biovec, nor relying on bi_vcnt - but because of
@@ -393,19 +423,16 @@ static int __blk_bios_map_sg(struct request_queue *q, struct bio *bio,
                  * a payload we need to set up here (thank you Christoph) and
                  * bi_vcnt is really the only way of telling if we need to.
                  */
-
-                if (bio->bi_vcnt)
-                        goto single_segment;
-
-                return 0;
-        }
-
-        if (bio_op(bio) == REQ_OP_WRITE_SAME) {
-single_segment:
+                if (!bio->bi_vcnt)
+                        return 0;
+                /* Fall through */
+        case REQ_OP_WRITE_SAME:
                 *sg = sglist;
                 bvec = bio_iovec(bio);
                 sg_set_page(*sg, bvec.bv_page, bvec.bv_len, bvec.bv_offset);
                 return 1;
+        default:
+                break;
         }
 
         for_each_bio(bio)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index e931a0e8e73d..13f5a6c1de76 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -793,11 +793,12 @@ static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx)
         struct list_head *dptr;
         int queued;
 
-        WARN_ON(!cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask));
-
         if (unlikely(test_bit(BLK_MQ_S_STOPPED, &hctx->state)))
                 return;
 
+        WARN_ON(!cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask) &&
+                cpu_online(hctx->next_cpu));
+
         hctx->run++;
 
         /*
@@ -1036,10 +1037,11 @@ void blk_mq_delay_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs)
 EXPORT_SYMBOL(blk_mq_delay_queue);
 
 static inline void __blk_mq_insert_req_list(struct blk_mq_hw_ctx *hctx,
-                                            struct blk_mq_ctx *ctx,
                                             struct request *rq,
                                             bool at_head)
 {
+        struct blk_mq_ctx *ctx = rq->mq_ctx;
+
         trace_block_rq_insert(hctx->queue, rq);
 
         if (at_head)
@@ -1053,20 +1055,16 @@ static void __blk_mq_insert_request(struct blk_mq_hw_ctx *hctx,
 {
         struct blk_mq_ctx *ctx = rq->mq_ctx;
 
-        __blk_mq_insert_req_list(hctx, ctx, rq, at_head);
+        __blk_mq_insert_req_list(hctx, rq, at_head);
         blk_mq_hctx_mark_pending(hctx, ctx);
 }
 
 void blk_mq_insert_request(struct request *rq, bool at_head, bool run_queue,
-                bool async)
+                           bool async)
 {
+        struct blk_mq_ctx *ctx = rq->mq_ctx;
         struct request_queue *q = rq->q;
         struct blk_mq_hw_ctx *hctx;
-        struct blk_mq_ctx *ctx = rq->mq_ctx, *current_ctx;
-
-        current_ctx = blk_mq_get_ctx(q);
-        if (!cpu_online(ctx->cpu))
-                rq->mq_ctx = ctx = current_ctx;
 
         hctx = q->mq_ops->map_queue(q, ctx->cpu);
 
@@ -1076,8 +1074,6 @@ void blk_mq_insert_request(struct request *rq, bool at_head, bool run_queue,
 
         if (run_queue)
                 blk_mq_run_hw_queue(hctx, async);
-
-        blk_mq_put_ctx(current_ctx);
 }
 
 static void blk_mq_insert_requests(struct request_queue *q,
@@ -1088,14 +1084,9 @@ static void blk_mq_insert_requests(struct request_queue *q,
 
 {
         struct blk_mq_hw_ctx *hctx;
-        struct blk_mq_ctx *current_ctx;
 
         trace_block_unplug(q, depth, !from_schedule);
 
-        current_ctx = blk_mq_get_ctx(q);
-
-        if (!cpu_online(ctx->cpu))
-                ctx = current_ctx;
         hctx = q->mq_ops->map_queue(q, ctx->cpu);
 
         /*
@@ -1107,15 +1098,14 @@ static void blk_mq_insert_requests(struct request_queue *q,
                 struct request *rq;
 
                 rq = list_first_entry(list, struct request, queuelist);
+                BUG_ON(rq->mq_ctx != ctx);
                 list_del_init(&rq->queuelist);
-                rq->mq_ctx = ctx;
-                __blk_mq_insert_req_list(hctx, ctx, rq, false);
+                __blk_mq_insert_req_list(hctx, rq, false);
         }
         blk_mq_hctx_mark_pending(hctx, ctx);
         spin_unlock(&ctx->lock);
 
         blk_mq_run_hw_queue(hctx, from_schedule);
-        blk_mq_put_ctx(current_ctx);
 }
 
 static int plug_ctx_cmp(void *priv, struct list_head *a, struct list_head *b)
@@ -1630,16 +1620,17 @@ static int blk_mq_alloc_bitmap(struct blk_mq_ctxmap *bitmap, int node)
         return 0;
 }
 
+/*
+ * 'cpu' is going away. splice any existing rq_list entries from this
+ * software queue to the hw queue dispatch list, and ensure that it
+ * gets run.
+ */
 static int blk_mq_hctx_cpu_offline(struct blk_mq_hw_ctx *hctx, int cpu)
 {
-        struct request_queue *q = hctx->queue;
         struct blk_mq_ctx *ctx;
         LIST_HEAD(tmp);
 
-        /*
-         * Move ctx entries to new CPU, if this one is going away.
-         */
-        ctx = __blk_mq_get_ctx(q, cpu);
+        ctx = __blk_mq_get_ctx(hctx->queue, cpu);
 
         spin_lock(&ctx->lock);
         if (!list_empty(&ctx->rq_list)) {
@@ -1651,24 +1642,11 @@ static int blk_mq_hctx_cpu_offline(struct blk_mq_hw_ctx *hctx, int cpu)
         if (list_empty(&tmp))
                 return NOTIFY_OK;
 
-        ctx = blk_mq_get_ctx(q);
-        spin_lock(&ctx->lock);
-
-        while (!list_empty(&tmp)) {
-                struct request *rq;
-
-                rq = list_first_entry(&tmp, struct request, queuelist);
-                rq->mq_ctx = ctx;
-                list_move_tail(&rq->queuelist, &ctx->rq_list);
-        }
-
-        hctx = q->mq_ops->map_queue(q, ctx->cpu);
-        blk_mq_hctx_mark_pending(hctx, ctx);
-
-        spin_unlock(&ctx->lock);
+        spin_lock(&hctx->lock);
+        list_splice_tail_init(&tmp, &hctx->dispatch);
+        spin_unlock(&hctx->lock);
 
         blk_mq_run_hw_queue(hctx, true);
-        blk_mq_put_ctx(ctx);
         return NOTIFY_OK;
 }
 
diff --git a/block/elevator.c b/block/elevator.c
index 7096c22041e7..f7d973a56fd7 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -366,7 +366,7 @@ void elv_dispatch_sort(struct request_queue *q, struct request *rq)
         list_for_each_prev(entry, &q->queue_head) {
                 struct request *pos = list_entry_rq(entry);
 
-                if ((req_op(rq) == REQ_OP_DISCARD) != (req_op(pos) == REQ_OP_DISCARD))
+                if (req_op(rq) != req_op(pos))
                         break;
                 if (rq_data_dir(rq) != rq_data_dir(pos))
                         break;
diff --git a/crypto/cryptd.c b/crypto/cryptd.c
index cf8037a87b2d..0c654e59f215 100644
--- a/crypto/cryptd.c
+++ b/crypto/cryptd.c
@@ -631,9 +631,14 @@ static int cryptd_hash_export(struct ahash_request *req, void *out)
 
 static int cryptd_hash_import(struct ahash_request *req, const void *in)
 {
-        struct cryptd_hash_request_ctx *rctx = ahash_request_ctx(req);
+        struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+        struct cryptd_hash_ctx *ctx = crypto_ahash_ctx(tfm);
+        struct shash_desc *desc = cryptd_shash_desc(req);
+
+        desc->tfm = ctx->child;
+        desc->flags = req->base.flags;
 
-        return crypto_shash_import(&rctx->desc, in);
+        return crypto_shash_import(desc, in);
 }
 
 static int cryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,
@@ -733,13 +738,14 @@ static void cryptd_aead_crypt(struct aead_request *req,
         rctx = aead_request_ctx(req);
         compl = rctx->complete;
 
+        tfm = crypto_aead_reqtfm(req);
+
         if (unlikely(err == -EINPROGRESS))
                 goto out;
         aead_request_set_tfm(req, child);
         err = crypt( req );
 
 out:
-        tfm = crypto_aead_reqtfm(req);
         ctx = crypto_aead_ctx(tfm);
         refcnt = atomic_read(&ctx->refcnt);
 
diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c
index 4c745bf389fe..161f91539ae6 100644
--- a/drivers/acpi/nfit/mce.c
+++ b/drivers/acpi/nfit/mce.c
@@ -42,7 +42,7 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val,
                 list_for_each_entry(nfit_spa, &acpi_desc->spas, list) {
                         struct acpi_nfit_system_address *spa = nfit_spa->spa;
 
-                        if (nfit_spa_type(spa) == NFIT_SPA_PM)
+                        if (nfit_spa_type(spa) != NFIT_SPA_PM)
                                 continue;
                         /* find the spa that covers the mce addr */
                         if (spa->address > mce->addr)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index ad9fc84a8601..e878fc799af7 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2054,7 +2054,7 @@ int __init acpi_scan_init(void)
 
 static struct acpi_probe_entry *ape;
 static int acpi_probe_count;
-static DEFINE_SPINLOCK(acpi_probe_lock);
+static DEFINE_MUTEX(acpi_probe_mutex);
 
 static int __init acpi_match_madt(struct acpi_subtable_header *header,
                                   const unsigned long end)
@@ -2073,7 +2073,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr)
         if (acpi_disabled)
                 return 0;
 
-        spin_lock(&acpi_probe_lock);
+        mutex_lock(&acpi_probe_mutex);
         for (ape = ap_head; nr; ape++, nr--) {
                 if (ACPI_COMPARE_NAME(ACPI_SIG_MADT, ape->id)) {
                         acpi_probe_count = 0;
@@ -2086,7 +2086,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr)
                                 count++;
                 }
         }
-        spin_unlock(&acpi_probe_lock);
+        mutex_unlock(&acpi_probe_mutex);
 
         return count;
 }
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 7461a587b39b..dcf2c724fd06 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2524,7 +2524,7 @@ static int ahci_host_activate_multi_irqs(struct ata_host *host,
 
                 /* Do not receive interrupts sent by dummy ports */
                 if (!pp) {
-                        disable_irq(irq + i);
+                        disable_irq(irq);
                         continue;
                 }
 
diff --git a/drivers/ata/pata_ninja32.c b/drivers/ata/pata_ninja32.c
index 633aa2934a18..44f97ad3c88d 100644
--- a/drivers/ata/pata_ninja32.c
+++ b/drivers/ata/pata_ninja32.c
@@ -144,7 +144,7 @@ static int ninja32_init_one(struct pci_dev *dev, const struct pci_device_id *id)
         ap->ioaddr.altstatus_addr = base + 0x1E;
         ap->ioaddr.bmdma_addr = base;
         ata_sff_std_ports(&ap->ioaddr);
-        ap->pflags = ATA_PFLAG_PIO32 | ATA_PFLAG_PIO32CHANGE;
+        ap->pflags |= ATA_PFLAG_PIO32 | ATA_PFLAG_PIO32CHANGE;
 
         ninja32_program(base);
         /* FIXME: Should we disable them at remove ? */
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index e097d355cc04..17995fadebd7 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -301,7 +301,7 @@ static int rpm_idle(struct device *dev, int rpmflags)
         int (*callback)(struct device *);
         int retval;
 
-        trace_rpm_idle(dev, rpmflags);
+        trace_rpm_idle_rcuidle(dev, rpmflags);
         retval = rpm_check_suspend_allowed(dev);
         if (retval < 0)
                 ;       /* Conditions are wrong. */
@@ -337,7 +337,7 @@ static int rpm_idle(struct device *dev, int rpmflags)
                         dev->power.request_pending = true;
                         queue_work(pm_wq, &dev->power.work);
                 }
-                trace_rpm_return_int(dev, _THIS_IP_, 0);
+                trace_rpm_return_int_rcuidle(dev, _THIS_IP_, 0);
                 return 0;
         }
 
@@ -352,7 +352,7 @@ static int rpm_idle(struct device *dev, int rpmflags)
         wake_up_all(&dev->power.wait_queue);
 
  out:
-        trace_rpm_return_int(dev, _THIS_IP_, retval);
+        trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval);
         return retval ? retval : rpm_suspend(dev, rpmflags | RPM_AUTO);
 }
 
@@ -601,7 +601,7 @@ static int rpm_resume(struct device *dev, int rpmflags)
         struct device *parent = NULL;
         int retval = 0;
 
-        trace_rpm_resume(dev, rpmflags);
+        trace_rpm_resume_rcuidle(dev, rpmflags);
 
  repeat:
         if (dev->power.runtime_error)
@@ -764,7 +764,7 @@ static int rpm_resume(struct device *dev, int rpmflags)
                 spin_lock_irq(&dev->power.lock);
         }
 
-        trace_rpm_return_int(dev, _THIS_IP_, retval);
+        trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval);
 
         return retval;
 }
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index aa56af87d941..b11af3f2c1db 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -404,6 +404,7 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
                 unsigned int new_base_reg, new_top_reg;
                 unsigned int min, max;
                 unsigned int max_dist;
+                unsigned int dist, best_dist = UINT_MAX;
 
                 max_dist = map->reg_stride * sizeof(*rbnode_tmp) /
                         map->cache_word_size;
@@ -423,24 +424,41 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
                                 &base_reg, &top_reg);
 
                         if (base_reg <= max && top_reg >= min) {
-                                new_base_reg = min(reg, base_reg);
-                                new_top_reg = max(reg, top_reg);
-                        } else {
-                                if (max < base_reg)
-                                        node = node->rb_left;
+                                if (reg < base_reg)
+                                        dist = base_reg - reg;
+                                else if (reg > top_reg)
+                                        dist = reg - top_reg;
                                 else
-                                        node = node->rb_right;
-
-                                continue;
+                                        dist = 0;
+                                if (dist < best_dist) {
+                                        rbnode = rbnode_tmp;
+                                        best_dist = dist;
+                                        new_base_reg = min(reg, base_reg);
+                                        new_top_reg = max(reg, top_reg);
+                                }
                         }
 
-                        ret = regcache_rbtree_insert_to_block(map, rbnode_tmp,
+                        /*
+                         * Keep looking, we want to choose the closest block,
+                         * otherwise we might end up creating overlapping
+                         * blocks, which breaks the rbtree.
+                         */
+                        if (reg < base_reg)
+                                node = node->rb_left;
+                        else if (reg > top_reg)
+                                node = node->rb_right;
+                        else
+                                break;
+                }
+
+                if (rbnode) {
+                        ret = regcache_rbtree_insert_to_block(map, rbnode,
                                                               new_base_reg,
                                                               new_top_reg, reg,
                                                               value);
                         if (ret)
                                 return ret;
-                        rbtree_ctx->cached_rbnode = rbnode_tmp;
+                        rbtree_ctx->cached_rbnode = rbnode;
                         return 0;
                 }
 
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index df7ff7290821..4e582561e1e7 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -38,10 +38,11 @@ static int regcache_hw_init(struct regmap *map)
 
         /* calculate the size of reg_defaults */
         for (count = 0, i = 0; i < map->num_reg_defaults_raw; i++)
-                if (!regmap_volatile(map, i * map->reg_stride))
+                if (regmap_readable(map, i * map->reg_stride) &&
+                    !regmap_volatile(map, i * map->reg_stride))
                         count++;
 
-        /* all registers are volatile, so just bypass */
+        /* all registers are unreadable or volatile, so just bypass */
         if (!count) {
                 map->cache_bypass = true;
                 return 0;
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 51fa7d66a393..25d26bb18970 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1474,6 +1474,8 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
                 ret = map->bus->write(map->bus_context, buf, len);
 
                 kfree(buf);
+        } else if (ret != 0 && !map->cache_bypass && map->format.parse_val) {
+                regcache_drop_region(map, reg, reg + 1);
         }
 
         trace_regmap_hw_write_done(map, reg, val_len / map->format.val_bytes);
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index b71a9c767009..e3d8e4ced4a2 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3706,22 +3706,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
         if (UFDCS->rawcmd == 1)
                 UFDCS->rawcmd = 2;
 
-        if (mode & (FMODE_READ|FMODE_WRITE)) {
-                UDRS->last_checked = 0;
-                clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-                check_disk_change(bdev);
-                if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-                        goto out;
-                if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
+        if (!(mode & FMODE_NDELAY)) {
+                if (mode & (FMODE_READ|FMODE_WRITE)) {
+                        UDRS->last_checked = 0;
+                        clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
+                        check_disk_change(bdev);
+                        if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
+                                goto out;
+                        if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
+                                goto out;
+                }
+                res = -EROFS;
+                if ((mode & FMODE_WRITE) &&
+                    !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
                         goto out;
         }
-
-        res = -EROFS;
-
-        if ((mode & FMODE_WRITE) &&
-                        !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
-                goto out;
-
         mutex_unlock(&open_lock);
         mutex_unlock(&floppy_mutex);
         return 0;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index be4fea6a5dd3..88ef6d4729b4 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -189,6 +189,8 @@ struct blkfront_info
         struct mutex mutex;
         struct xenbus_device *xbdev;
         struct gendisk *gd;
+        u16 sector_size;
+        unsigned int physical_sector_size;
         int vdevice;
         blkif_vdev_t handle;
         enum blkif_state connected;
@@ -910,9 +912,45 @@ static struct blk_mq_ops blkfront_mq_ops = {
         .map_queue = blk_mq_map_queue,
 };
 
+static void blkif_set_queue_limits(struct blkfront_info *info)
+{
+        struct request_queue *rq = info->rq;
+        struct gendisk *gd = info->gd;
+        unsigned int segments = info->max_indirect_segments ? :
+                                BLKIF_MAX_SEGMENTS_PER_REQUEST;
+
+        queue_flag_set_unlocked(QUEUE_FLAG_VIRT, rq);
+
+        if (info->feature_discard) {
+                queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, rq);
+                blk_queue_max_discard_sectors(rq, get_capacity(gd));
+                rq->limits.discard_granularity = info->discard_granularity;
+                rq->limits.discard_alignment = info->discard_alignment;
+                if (info->feature_secdiscard)
+                        queue_flag_set_unlocked(QUEUE_FLAG_SECERASE, rq);
+        }
+
+        /* Hard sector size and max sectors impersonate the equiv. hardware. */
+        blk_queue_logical_block_size(rq, info->sector_size);
+        blk_queue_physical_block_size(rq, info->physical_sector_size);
+        blk_queue_max_hw_sectors(rq, (segments * XEN_PAGE_SIZE) / 512);
+
+        /* Each segment in a request is up to an aligned page in size. */
+        blk_queue_segment_boundary(rq, PAGE_SIZE - 1);
+        blk_queue_max_segment_size(rq, PAGE_SIZE);
+
+        /* Ensure a merged request will fit in a single I/O ring slot. */
+        blk_queue_max_segments(rq, segments / GRANTS_PER_PSEG);
+
+        /* Make sure buffer addresses are sector-aligned. */
+        blk_queue_dma_alignment(rq, 511);
+
+        /* Make sure we don't use bounce buffers. */
+        blk_queue_bounce_limit(rq, BLK_BOUNCE_ANY);
+}
+
 static int xlvbd_init_blk_queue(struct gendisk *gd, u16 sector_size,
-                                unsigned int physical_sector_size,
-                                unsigned int segments)
+                                unsigned int physical_sector_size)
 {
         struct request_queue *rq;
         struct blkfront_info *info = gd->private_data;
@@ -944,36 +982,11 @@ static int xlvbd_init_blk_queue(struct gendisk *gd, u16 sector_size,
         }
 
         rq->queuedata = info;
-        queue_flag_set_unlocked(QUEUE_FLAG_VIRT, rq);
-
-        if (info->feature_discard) {
-                queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, rq);
-                blk_queue_max_discard_sectors(rq, get_capacity(gd));
-                rq->limits.discard_granularity = info->discard_granularity;
-                rq->limits.discard_alignment = info->discard_alignment;
-                if (info->feature_secdiscard)
-                        queue_flag_set_unlocked(QUEUE_FLAG_SECERASE, rq);
-        }
-
-        /* Hard sector size and max sectors impersonate the equiv. hardware. */
-        blk_queue_logical_block_size(rq, sector_size);
-        blk_queue_physical_block_size(rq, physical_sector_size);
-        blk_queue_max_hw_sectors(rq, (segments * XEN_PAGE_SIZE) / 512);
-
-        /* Each segment in a request is up to an aligned page in size. */
-        blk_queue_segment_boundary(rq, PAGE_SIZE - 1);
-        blk_queue_max_segment_size(rq, PAGE_SIZE);
-
-        /* Ensure a merged request will fit in a single I/O ring slot. */
-        blk_queue_max_segments(rq, segments / GRANTS_PER_PSEG);
-
-        /* Make sure buffer addresses are sector-aligned. */
-        blk_queue_dma_alignment(rq, 511);
-
-        /* Make sure we don't use bounce buffers. */
-        blk_queue_bounce_limit(rq, BLK_BOUNCE_ANY);
-
-        gd->queue = rq;
+        info->rq = gd->queue = rq;
+        info->gd = gd;
+        info->sector_size = sector_size;
+        info->physical_sector_size = physical_sector_size;
+        blkif_set_queue_limits(info);
 
         return 0;
 }
@@ -1136,16 +1149,11 @@ static int xlvbd_alloc_gendisk(blkif_sector_t capacity,
         gd->private_data = info;
         set_capacity(gd, capacity);
 
-        if (xlvbd_init_blk_queue(gd, sector_size, physical_sector_size,
-                                 info->max_indirect_segments ? :
-                                 BLKIF_MAX_SEGMENTS_PER_REQUEST)) {
+        if (xlvbd_init_blk_queue(gd, sector_size, physical_sector_size)) {
                 del_gendisk(gd);
                 goto release;
         }
 
-        info->rq = gd->queue;
-        info->gd = gd;
-
         xlvbd_flush(info);
 
         if (vdisk_info & VDISK_READONLY)
@@ -1315,7 +1323,7 @@ free_shadow:
                         rinfo->ring_ref[i] = GRANT_INVALID_REF;
                 }
         }
-        free_pages((unsigned long)rinfo->ring.sring, get_order(info->nr_ring_pages * PAGE_SIZE));
+        free_pages((unsigned long)rinfo->ring.sring, get_order(info->nr_ring_pages * XEN_PAGE_SIZE));
         rinfo->ring.sring = NULL;
 
         if (rinfo->irq)
@@ -2007,8 +2015,10 @@ static int blkif_recover(struct blkfront_info *info)
         struct split_bio *split_bio;
 
         blkfront_gather_backend_features(info);
+        /* Reset limits changed by blk_mq_update_nr_hw_queues(). */
+        blkif_set_queue_limits(info);
         segs = info->max_indirect_segments ? : BLKIF_MAX_SEGMENTS_PER_REQUEST;
-        blk_queue_max_segments(info->rq, segs);
+        blk_queue_max_segments(info->rq, segs / GRANTS_PER_PSEG);
 
         for (r_index = 0; r_index < info->nr_rings; r_index++) {
                 struct blkfront_ring_info *rinfo = &info->rinfo[r_index];
@@ -2432,7 +2442,7 @@ static void blkfront_connect(struct blkfront_info *info)
         if (err) {
                 xenbus_dev_fatal(info->xbdev, err, "xlvbd_add at %s",
                                  info->xbdev->otherend);
-                return;
+                goto fail;
         }
 
         xenbus_switch_state(info->xbdev, XenbusStateConnected);
@@ -2445,6 +2455,11 @@ static void blkfront_connect(struct blkfront_info *info)
         device_add_disk(&info->xbdev->dev, info->gd);
 
         info->is_ready = 1;
+        return;
+
+fail:
+        blkif_free(info, 0);
+        return;
 }
 
 /**
diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c
index 5755907f836f..ffa7c9dcbd7a 100644
--- a/drivers/bus/arm-cci.c
+++ b/drivers/bus/arm-cci.c
@@ -551,7 +551,7 @@ static struct attribute *cci5xx_pmu_event_attrs[] = {
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_wrq, 0xB),
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snoop_cd_hs, 0xC),
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_rq_stall_addr_hazard, 0xD),
-        CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snopp_rq_stall_tt_full, 0xE),
+        CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snoop_rq_stall_tt_full, 0xE),
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snoop_rq_tzmp1_prot, 0xF),
         NULL
 };
diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
index 97a9185af433..884c0305e290 100644
--- a/drivers/bus/arm-ccn.c
+++ b/drivers/bus/arm-ccn.c
@@ -187,6 +187,7 @@ struct arm_ccn {
         struct arm_ccn_component *xp;
 
         struct arm_ccn_dt dt;
+        int mn_id;
 };
 
 static DEFINE_MUTEX(arm_ccn_mutex);
@@ -212,6 +213,7 @@ static int arm_ccn_node_to_xp_port(int node)
 #define CCN_CONFIG_TYPE(_config)        (((_config) >> 8) & 0xff)
 #define CCN_CONFIG_EVENT(_config)       (((_config) >> 16) & 0xff)
 #define CCN_CONFIG_PORT(_config)        (((_config) >> 24) & 0x3)
+#define CCN_CONFIG_BUS(_config)         (((_config) >> 24) & 0x3)
 #define CCN_CONFIG_VC(_config)          (((_config) >> 26) & 0x7)
 #define CCN_CONFIG_DIR(_config)         (((_config) >> 29) & 0x1)
 #define CCN_CONFIG_MASK(_config)        (((_config) >> 30) & 0xf)
@@ -241,6 +243,7 @@ static CCN_FORMAT_ATTR(xp, "config:0-7");
 static CCN_FORMAT_ATTR(type, "config:8-15");
 static CCN_FORMAT_ATTR(event, "config:16-23");
 static CCN_FORMAT_ATTR(port, "config:24-25");
+static CCN_FORMAT_ATTR(bus, "config:24-25");
 static CCN_FORMAT_ATTR(vc, "config:26-28");
 static CCN_FORMAT_ATTR(dir, "config:29-29");
 static CCN_FORMAT_ATTR(mask, "config:30-33");
@@ -253,6 +256,7 @@ static struct attribute *arm_ccn_pmu_format_attrs[] = {
         &arm_ccn_pmu_format_attr_type.attr.attr,
         &arm_ccn_pmu_format_attr_event.attr.attr,
         &arm_ccn_pmu_format_attr_port.attr.attr,
+        &arm_ccn_pmu_format_attr_bus.attr.attr,
         &arm_ccn_pmu_format_attr_vc.attr.attr,
         &arm_ccn_pmu_format_attr_dir.attr.attr,
         &arm_ccn_pmu_format_attr_mask.attr.attr,
@@ -328,6 +332,7 @@ struct arm_ccn_pmu_event {
 static ssize_t arm_ccn_pmu_event_show(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
+        struct arm_ccn *ccn = pmu_to_arm_ccn(dev_get_drvdata(dev));
         struct arm_ccn_pmu_event *event = container_of(attr,
                         struct arm_ccn_pmu_event, attr);
         ssize_t res;
@@ -349,10 +354,17 @@ static ssize_t arm_ccn_pmu_event_show(struct device *dev,
                 break;
         case CCN_TYPE_XP:
                 res += snprintf(buf + res, PAGE_SIZE - res,
-                                ",xp=?,port=?,vc=?,dir=?");
+                                ",xp=?,vc=?");
                 if (event->event == CCN_EVENT_WATCHPOINT)
                         res += snprintf(buf + res, PAGE_SIZE - res,
-                                        ",cmp_l=?,cmp_h=?,mask=?");
+                                        ",port=?,dir=?,cmp_l=?,cmp_h=?,mask=?");
+                else
+                        res += snprintf(buf + res, PAGE_SIZE - res,
+                                        ",bus=?");
+
+                break;
+        case CCN_TYPE_MN:
+                res += snprintf(buf + res, PAGE_SIZE - res, ",node=%d", ccn->mn_id);
                 break;
         default:
                 res += snprintf(buf + res, PAGE_SIZE - res, ",node=?");
@@ -383,9 +395,9 @@ static umode_t arm_ccn_pmu_events_is_visible(struct kobject *kobj,
 }
 
 static struct arm_ccn_pmu_event arm_ccn_pmu_events[] = {
-        CCN_EVENT_MN(eobarrier, "dir=0,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE),
-        CCN_EVENT_MN(ecbarrier, "dir=0,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE),
-        CCN_EVENT_MN(dvmop, "dir=0,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE),
+        CCN_EVENT_MN(eobarrier, "dir=1,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE),
+        CCN_EVENT_MN(ecbarrier, "dir=1,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE),
+        CCN_EVENT_MN(dvmop, "dir=1,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE),
         CCN_EVENT_HNI(txdatflits, "dir=1,vc=3", CCN_IDX_MASK_ANY),
         CCN_EVENT_HNI(rxdatflits, "dir=0,vc=3", CCN_IDX_MASK_ANY),
         CCN_EVENT_HNI(txreqflits, "dir=1,vc=0", CCN_IDX_MASK_ANY),
@@ -733,9 +745,10 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
 
         if (has_branch_stack(event) || event->attr.exclude_user ||
                         event->attr.exclude_kernel || event->attr.exclude_hv ||
-                        event->attr.exclude_idle) {
+                        event->attr.exclude_idle || event->attr.exclude_host ||
+                        event->attr.exclude_guest) {
                 dev_warn(ccn->dev, "Can't exclude execution levels!\n");
-                return -EOPNOTSUPP;
+                return -EINVAL;
         }
 
         if (event->cpu < 0) {
@@ -759,6 +772,12 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
 
         /* Validate node/xp vs topology */
         switch (type) {
+        case CCN_TYPE_MN:
+                if (node_xp != ccn->mn_id) {
+                        dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp);
+                        return -EINVAL;
+                }
+                break;
         case CCN_TYPE_XP:
                 if (node_xp >= ccn->num_xps) {
                         dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp);
@@ -886,6 +905,10 @@ static void arm_ccn_pmu_xp_dt_config(struct perf_event *event, int enable)
         struct arm_ccn_component *xp;
         u32 val, dt_cfg;
 
+        /* Nothing to do for cycle counter */
+        if (hw->idx == CCN_IDX_PMU_CYCLE_COUNTER)
+                return;
+
         if (CCN_CONFIG_TYPE(event->attr.config) == CCN_TYPE_XP)
                 xp = &ccn->xp[CCN_CONFIG_XP(event->attr.config)];
         else
@@ -917,38 +940,17 @@ static void arm_ccn_pmu_event_start(struct perf_event *event, int flags)
                         arm_ccn_pmu_read_counter(ccn, hw->idx));
         hw->state = 0;
 
-        /*
-         * Pin the timer, so that the overflows are handled by the chosen
-         * event->cpu (this is the same one as presented in "cpumask"
-         * attribute).
-         */
-        if (!ccn->irq)
-                hrtimer_start(&ccn->dt.hrtimer, arm_ccn_pmu_timer_period(),
-                                HRTIMER_MODE_REL_PINNED);
-
         /* Set the DT bus input, engaging the counter */
         arm_ccn_pmu_xp_dt_config(event, 1);
 }
 
 static void arm_ccn_pmu_event_stop(struct perf_event *event, int flags)
 {
-        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
         struct hw_perf_event *hw = &event->hw;
-        u64 timeout;
 
         /* Disable counting, setting the DT bus to pass-through mode */
         arm_ccn_pmu_xp_dt_config(event, 0);
 
-        if (!ccn->irq)
-                hrtimer_cancel(&ccn->dt.hrtimer);
-
-        /* Let the DT bus drain */
-        timeout = arm_ccn_pmu_read_counter(ccn, CCN_IDX_PMU_CYCLE_COUNTER) +
-                        ccn->num_xps;
-        while (arm_ccn_pmu_read_counter(ccn, CCN_IDX_PMU_CYCLE_COUNTER) <
-                        timeout)
-                cpu_relax();
-
         if (flags & PERF_EF_UPDATE)
                 arm_ccn_pmu_event_update(event);
 
@@ -988,7 +990,7 @@ static void arm_ccn_pmu_xp_watchpoint_config(struct perf_event *event)
 
         /* Comparison values */
         writel(cmp_l & 0xffffffff, source->base + CCN_XP_DT_CMP_VAL_L(wp));
-        writel((cmp_l >> 32) & 0xefffffff,
+        writel((cmp_l >> 32) & 0x7fffffff,
                         source->base + CCN_XP_DT_CMP_VAL_L(wp) + 4);
         writel(cmp_h & 0xffffffff, source->base + CCN_XP_DT_CMP_VAL_H(wp));
         writel((cmp_h >> 32) & 0x0fffffff,
@@ -996,7 +998,7 @@ static void arm_ccn_pmu_xp_watchpoint_config(struct perf_event *event)
 
         /* Mask */
         writel(mask_l & 0xffffffff, source->base + CCN_XP_DT_CMP_MASK_L(wp));
-        writel((mask_l >> 32) & 0xefffffff,
+        writel((mask_l >> 32) & 0x7fffffff,
                         source->base + CCN_XP_DT_CMP_MASK_L(wp) + 4);
         writel(mask_h & 0xffffffff, source->base + CCN_XP_DT_CMP_MASK_H(wp));
         writel((mask_h >> 32) & 0x0fffffff,
@@ -1014,7 +1016,7 @@ static void arm_ccn_pmu_xp_event_config(struct perf_event *event)
         hw->event_base = CCN_XP_DT_CONFIG__DT_CFG__XP_PMU_EVENT(hw->config_base);
 
         id = (CCN_CONFIG_VC(event->attr.config) << 4) |
-                        (CCN_CONFIG_PORT(event->attr.config) << 3) |
+                        (CCN_CONFIG_BUS(event->attr.config) << 3) |
                         (CCN_CONFIG_EVENT(event->attr.config) << 0);
 
         val = readl(source->base + CCN_XP_PMU_EVENT_SEL);
@@ -1099,15 +1101,31 @@ static void arm_ccn_pmu_event_config(struct perf_event *event)
         spin_unlock(&ccn->dt.config_lock);
 }
 
+static int arm_ccn_pmu_active_counters(struct arm_ccn *ccn)
+{
+        return bitmap_weight(ccn->dt.pmu_counters_mask,
+                             CCN_NUM_PMU_EVENT_COUNTERS + 1);
+}
+
 static int arm_ccn_pmu_event_add(struct perf_event *event, int flags)
 {
         int err;
         struct hw_perf_event *hw = &event->hw;
+        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
 
         err = arm_ccn_pmu_event_alloc(event);
         if (err)
                 return err;
 
+        /*
+         * Pin the timer, so that the overflows are handled by the chosen
+         * event->cpu (this is the same one as presented in "cpumask"
+         * attribute).
+         */
+        if (!ccn->irq && arm_ccn_pmu_active_counters(ccn) == 1)
+                hrtimer_start(&ccn->dt.hrtimer, arm_ccn_pmu_timer_period(),
+                              HRTIMER_MODE_REL_PINNED);
+
         arm_ccn_pmu_event_config(event);
 
         hw->state = PERF_HES_STOPPED;
@@ -1120,9 +1138,14 @@ static int arm_ccn_pmu_event_add(struct perf_event *event, int flags)
 
 static void arm_ccn_pmu_event_del(struct perf_event *event, int flags)
 {
+        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
+
         arm_ccn_pmu_event_stop(event, PERF_EF_UPDATE);
 
         arm_ccn_pmu_event_release(event);
+
+        if (!ccn->irq && arm_ccn_pmu_active_counters(ccn) == 0)
+                hrtimer_cancel(&ccn->dt.hrtimer);
 }
 
 static void arm_ccn_pmu_event_read(struct perf_event *event)
@@ -1130,6 +1153,24 @@ static void arm_ccn_pmu_event_read(struct perf_event *event)
         arm_ccn_pmu_event_update(event);
 }
 
+static void arm_ccn_pmu_enable(struct pmu *pmu)
+{
+        struct arm_ccn *ccn = pmu_to_arm_ccn(pmu);
+
+        u32 val = readl(ccn->dt.base + CCN_DT_PMCR);
+        val |= CCN_DT_PMCR__PMU_EN;
+        writel(val, ccn->dt.base + CCN_DT_PMCR);
+}
+
+static void arm_ccn_pmu_disable(struct pmu *pmu)
+{
+        struct arm_ccn *ccn = pmu_to_arm_ccn(pmu);
+
+        u32 val = readl(ccn->dt.base + CCN_DT_PMCR);
+        val &= ~CCN_DT_PMCR__PMU_EN;
+        writel(val, ccn->dt.base + CCN_DT_PMCR);
+}
+
 static irqreturn_t arm_ccn_pmu_overflow_handler(struct arm_ccn_dt *dt)
 {
         u32 pmovsr = readl(dt->base + CCN_DT_PMOVSR);
@@ -1252,6 +1293,8 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn)
                 .start = arm_ccn_pmu_event_start,
                 .stop = arm_ccn_pmu_event_stop,
                 .read = arm_ccn_pmu_event_read,
+                .pmu_enable = arm_ccn_pmu_enable,
+                .pmu_disable = arm_ccn_pmu_disable,
         };
 
         /* No overflow interrupt? Have to use a timer instead. */
@@ -1361,6 +1404,8 @@ static int arm_ccn_init_nodes(struct arm_ccn *ccn, int region,
 
         switch (type) {
         case CCN_TYPE_MN:
+                ccn->mn_id = id;
+                return 0;
         case CCN_TYPE_DT:
                 return 0;
         case CCN_TYPE_XP:
@@ -1471,8 +1516,9 @@ static int arm_ccn_probe(struct platform_device *pdev)
                 /* Can set 'disable' bits, so can acknowledge interrupts */
                 writel(CCN_MN_ERRINT_STATUS__PMU_EVENTS__ENABLE,
                                 ccn->base + CCN_MN_ERRINT_STATUS);
-                err = devm_request_irq(ccn->dev, irq, arm_ccn_irq_handler, 0,
-                                dev_name(ccn->dev), ccn);
+                err = devm_request_irq(ccn->dev, irq, arm_ccn_irq_handler,
+                                       IRQF_NOBALANCING | IRQF_NO_THREAD,
+                                       dev_name(ccn->dev), ccn);
                 if (err)
                         return err;
 
diff --git a/drivers/bus/vexpress-config.c b/drivers/bus/vexpress-config.c
index c3cb76b363c6..9efdf1de4035 100644
--- a/drivers/bus/vexpress-config.c
+++ b/drivers/bus/vexpress-config.c
@@ -178,6 +178,7 @@ static int vexpress_config_populate(struct device_node *node)
 
         parent = class_find_device(vexpress_config_class, NULL, bridge,
                         vexpress_config_node_match);
+        of_node_put(bridge);
         if (WARN_ON(!parent))
                 return -ENODEV;
 
diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index 56ad5a5936a9..8c0770bf8881 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -244,7 +244,7 @@ config HW_RANDOM_TX4939
 
 config HW_RANDOM_MXC_RNGA
         tristate "Freescale i.MX RNGA Random Number Generator"
-        depends on ARCH_HAS_RNGA
+        depends on SOC_IMX31
         default HW_RANDOM
         ---help---
           This driver provides kernel-side support for the Random Number
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 08c7e23ed535..0c75c3f1689f 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -957,7 +957,7 @@ int tpm2_auto_startup(struct tpm_chip *chip)
                 goto out;
 
         rc = tpm2_do_selftest(chip);
-        if (rc != TPM2_RC_INITIALIZE) {
+        if (rc != 0 && rc != TPM2_RC_INITIALIZE) {
                 dev_err(&chip->dev, "TPM self test failed\n");
                 goto out;
         }
@@ -974,7 +974,6 @@ int tpm2_auto_startup(struct tpm_chip *chip)
                 }
         }
 
-        return rc;
 out:
         if (rc > 0)
                 rc = -ENODEV;
diff --git a/drivers/clk/renesas/r8a7795-cpg-mssr.c b/drivers/clk/renesas/r8a7795-cpg-mssr.c
index d359c92e13a6..e38bf60c0ff4 100644
--- a/drivers/clk/renesas/r8a7795-cpg-mssr.c
+++ b/drivers/clk/renesas/r8a7795-cpg-mssr.c
@@ -69,6 +69,7 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = {
         DEF_FIXED(".s1",        CLK_S1,            CLK_PLL1_DIV2,  3, 1),
         DEF_FIXED(".s2",        CLK_S2,            CLK_PLL1_DIV2,  4, 1),
         DEF_FIXED(".s3",        CLK_S3,            CLK_PLL1_DIV2,  6, 1),
+        DEF_FIXED(".sdsrc",     CLK_SDSRC,         CLK_PLL1_DIV2,  2, 1),
 
         /* Core Clock Outputs */
         DEF_FIXED("ztr",        R8A7795_CLK_ZTR,   CLK_PLL1_DIV2,  6, 1),
@@ -87,10 +88,10 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = {
         DEF_FIXED("s3d2",       R8A7795_CLK_S3D2,  CLK_S3,         2, 1),
         DEF_FIXED("s3d4",       R8A7795_CLK_S3D4,  CLK_S3,         4, 1),
 
-        DEF_GEN3_SD("sd0",      R8A7795_CLK_SD0,   CLK_PLL1_DIV2, 0x0074),
-        DEF_GEN3_SD("sd1",      R8A7795_CLK_SD1,   CLK_PLL1_DIV2, 0x0078),
-        DEF_GEN3_SD("sd2",      R8A7795_CLK_SD2,   CLK_PLL1_DIV2, 0x0268),
-        DEF_GEN3_SD("sd3",      R8A7795_CLK_SD3,   CLK_PLL1_DIV2, 0x026c),
+        DEF_GEN3_SD("sd0",      R8A7795_CLK_SD0,   CLK_SDSRC,     0x0074),
+        DEF_GEN3_SD("sd1",      R8A7795_CLK_SD1,   CLK_SDSRC,     0x0078),
+        DEF_GEN3_SD("sd2",      R8A7795_CLK_SD2,   CLK_SDSRC,     0x0268),
+        DEF_GEN3_SD("sd3",      R8A7795_CLK_SD3,   CLK_SDSRC,     0x026c),
 
         DEF_FIXED("cl",         R8A7795_CLK_CL,    CLK_PLL1_DIV2, 48, 1),
         DEF_FIXED("cp",         R8A7795_CLK_CP,    CLK_EXTAL,      2, 1),
diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c
index c109d80e7a8a..cdfabeb9a034 100644
--- a/drivers/clk/rockchip/clk-rk3399.c
+++ b/drivers/clk/rockchip/clk-rk3399.c
@@ -833,9 +833,9 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
 
         /* perihp */
         GATE(0, "cpll_aclk_perihp_src", "cpll", CLK_IGNORE_UNUSED,
-                        RK3399_CLKGATE_CON(5), 0, GFLAGS),
-        GATE(0, "gpll_aclk_perihp_src", "gpll", CLK_IGNORE_UNUSED,
                         RK3399_CLKGATE_CON(5), 1, GFLAGS),
+        GATE(0, "gpll_aclk_perihp_src", "gpll", CLK_IGNORE_UNUSED,
+                        RK3399_CLKGATE_CON(5), 0, GFLAGS),
         COMPOSITE(ACLK_PERIHP, "aclk_perihp", mux_aclk_perihp_p, CLK_IGNORE_UNUSED,
                         RK3399_CLKSEL_CON(14), 7, 1, MFLAGS, 0, 5, DFLAGS,
                         RK3399_CLKGATE_CON(5), 2, GFLAGS),
@@ -923,9 +923,9 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
                         RK3399_CLKGATE_CON(6), 14, GFLAGS),
 
         GATE(0, "cpll_aclk_emmc_src", "cpll", CLK_IGNORE_UNUSED,
-                        RK3399_CLKGATE_CON(6), 12, GFLAGS),
-        GATE(0, "gpll_aclk_emmc_src", "gpll", CLK_IGNORE_UNUSED,
                         RK3399_CLKGATE_CON(6), 13, GFLAGS),
+        GATE(0, "gpll_aclk_emmc_src", "gpll", CLK_IGNORE_UNUSED,
+                        RK3399_CLKGATE_CON(6), 12, GFLAGS),
         COMPOSITE_NOGATE(ACLK_EMMC, "aclk_emmc", mux_aclk_emmc_p, CLK_IGNORE_UNUSED,
                         RK3399_CLKSEL_CON(21), 7, 1, MFLAGS, 0, 5, DFLAGS),
         GATE(ACLK_EMMC_CORE, "aclk_emmccore", "aclk_emmc", CLK_IGNORE_UNUSED,
@@ -1071,7 +1071,7 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
         /* vio */
         COMPOSITE(ACLK_VIO, "aclk_vio", mux_pll_src_cpll_gpll_ppll_p, CLK_IGNORE_UNUSED,
                         RK3399_CLKSEL_CON(42), 6, 2, MFLAGS, 0, 5, DFLAGS,
-                        RK3399_CLKGATE_CON(11), 10, GFLAGS),
+                        RK3399_CLKGATE_CON(11), 0, GFLAGS),
         COMPOSITE_NOMUX(PCLK_VIO, "pclk_vio", "aclk_vio", 0,
                         RK3399_CLKSEL_CON(43), 0, 5, DFLAGS,
                         RK3399_CLKGATE_CON(11), 1, GFLAGS),
@@ -1484,6 +1484,7 @@ static const char *const rk3399_cru_critical_clocks[] __initconst = {
         "hclk_perilp1",
         "hclk_perilp1_noc",
         "aclk_dmac0_perilp",
+        "aclk_emmc_noc",
         "gpll_hclk_perilp1_src",
         "gpll_aclk_perilp0_src",
         "gpll_aclk_perihp_src",
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
index 9af359544110..267f99523fbe 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
@@ -783,14 +783,14 @@ static struct ccu_reset_map sun8i_h3_ccu_resets[] = {
         [RST_BUS_I2S1]          =  { 0x2d0, BIT(13) },
         [RST_BUS_I2S2]          =  { 0x2d0, BIT(14) },
 
-        [RST_BUS_I2C0]          =  { 0x2d4, BIT(0) },
-        [RST_BUS_I2C1]          =  { 0x2d4, BIT(1) },
-        [RST_BUS_I2C2]          =  { 0x2d4, BIT(2) },
-        [RST_BUS_UART0]         =  { 0x2d4, BIT(16) },
-        [RST_BUS_UART1]         =  { 0x2d4, BIT(17) },
-        [RST_BUS_UART2]         =  { 0x2d4, BIT(18) },
-        [RST_BUS_UART3]         =  { 0x2d4, BIT(19) },
-        [RST_BUS_SCR]           =  { 0x2d4, BIT(20) },
+        [RST_BUS_I2C0]          =  { 0x2d8, BIT(0) },
+        [RST_BUS_I2C1]          =  { 0x2d8, BIT(1) },
+        [RST_BUS_I2C2]          =  { 0x2d8, BIT(2) },
+        [RST_BUS_UART0]         =  { 0x2d8, BIT(16) },
+        [RST_BUS_UART1]         =  { 0x2d8, BIT(17) },
+        [RST_BUS_UART2]         =  { 0x2d8, BIT(18) },
+        [RST_BUS_UART3]         =  { 0x2d8, BIT(19) },
+        [RST_BUS_SCR]           =  { 0x2d8, BIT(20) },
 };
 
 static const struct sunxi_ccu_desc sun8i_h3_ccu_desc = {
diff --git a/drivers/clk/sunxi-ng/ccu_common.c b/drivers/clk/sunxi-ng/ccu_common.c
index fc17b5295e16..51d4bac97ab3 100644
--- a/drivers/clk/sunxi-ng/ccu_common.c
+++ b/drivers/clk/sunxi-ng/ccu_common.c
@@ -31,7 +31,7 @@ void ccu_helper_wait_for_lock(struct ccu_common *common, u32 lock)
                 return;
 
         WARN_ON(readl_relaxed_poll_timeout(common->base + common->reg, reg,
-                                           !(reg & lock), 100, 70000));
+                                           reg & lock, 100, 70000));
 }
 
 int sunxi_ccu_probe(struct device_node *node, void __iomem *reg,
diff --git a/drivers/clk/sunxi-ng/ccu_nk.c b/drivers/clk/sunxi-ng/ccu_nk.c
index 4470ffc8cf0d..d6fafb397489 100644
--- a/drivers/clk/sunxi-ng/ccu_nk.c
+++ b/drivers/clk/sunxi-ng/ccu_nk.c
@@ -14,9 +14,9 @@
 #include "ccu_gate.h"
 #include "ccu_nk.h"
 
-void ccu_nk_find_best(unsigned long parent, unsigned long rate,
-                      unsigned int max_n, unsigned int max_k,
-                      unsigned int *n, unsigned int *k)
+static void ccu_nk_find_best(unsigned long parent, unsigned long rate,
+                             unsigned int max_n, unsigned int max_k,
+                             unsigned int *n, unsigned int *k)
 {
         unsigned long best_rate = 0;
         unsigned int best_k = 0, best_n = 0;
diff --git a/drivers/clk/sunxi/clk-a10-pll2.c b/drivers/clk/sunxi/clk-a10-pll2.c
index 0ee1f363e4be..d8eab90ae661 100644
--- a/drivers/clk/sunxi/clk-a10-pll2.c
+++ b/drivers/clk/sunxi/clk-a10-pll2.c
@@ -73,7 +73,7 @@ static void __init sun4i_pll2_setup(struct device_node *node,
                                           SUN4I_PLL2_PRE_DIV_WIDTH,
                                           CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
                                           &sun4i_a10_pll2_lock);
-        if (!prediv_clk) {
+        if (IS_ERR(prediv_clk)) {
                 pr_err("Couldn't register the prediv clock\n");
                 goto err_free_array;
         }
@@ -106,7 +106,7 @@ static void __init sun4i_pll2_setup(struct device_node *node,
                                           &mult->hw, &clk_multiplier_ops,
                                           &gate->hw, &clk_gate_ops,
                                           CLK_SET_RATE_PARENT);
-        if (!base_clk) {
+        if (IS_ERR(base_clk)) {
                 pr_err("Couldn't register the base multiplier clock\n");
                 goto err_free_multiplier;
         }
diff --git a/drivers/clk/sunxi/clk-sun8i-mbus.c b/drivers/clk/sunxi/clk-sun8i-mbus.c
index 411d3033a96e..b200ebf159ee 100644
--- a/drivers/clk/sunxi/clk-sun8i-mbus.c
+++ b/drivers/clk/sunxi/clk-sun8i-mbus.c
@@ -48,7 +48,7 @@ static void __init sun8i_a23_mbus_setup(struct device_node *node)
                 return;
 
         reg = of_io_request_and_map(node, 0, of_node_full_name(node));
-        if (!reg) {
+        if (IS_ERR(reg)) {
                 pr_err("Could not get registers for sun8i-mbus-clk\n");
                 goto err_free_parents;
         }
diff --git a/drivers/clk/tegra/clk-tegra114.c b/drivers/clk/tegra/clk-tegra114.c
index 64da7b79a6e4..933b5dd698b8 100644
--- a/drivers/clk/tegra/clk-tegra114.c
+++ b/drivers/clk/tegra/clk-tegra114.c
@@ -428,7 +428,7 @@ static struct tegra_clk_pll_params pll_d_params = {
         .div_nmp = &pllp_nmp,
         .freq_table = pll_d_freq_table,
         .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_SET_LFCON |
-                 TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+                 TEGRA_PLL_HAS_LOCK_ENABLE,
 };
 
 static struct tegra_clk_pll_params pll_d2_params = {
@@ -446,7 +446,7 @@ static struct tegra_clk_pll_params pll_d2_params = {
         .div_nmp = &pllp_nmp,
         .freq_table = pll_d_freq_table,
         .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_SET_LFCON |
-                 TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+                 TEGRA_PLL_HAS_LOCK_ENABLE,
 };
 
 static const struct pdiv_map pllu_p[] = {
diff --git a/drivers/clocksource/pxa_timer.c b/drivers/clocksource/pxa_timer.c
index 937e10b84d58..3e1cb512f3ce 100644
--- a/drivers/clocksource/pxa_timer.c
+++ b/drivers/clocksource/pxa_timer.c
@@ -21,6 +21,8 @@
 #include <linux/of_irq.h>
 #include <linux/sched_clock.h>
 
+#include <clocksource/pxa.h>
+
 #include <asm/div64.h>
 
 #define OSMR0           0x00    /* OS Timer 0 Match Register */
diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c
index 97669ee4df2a..c83452cacb41 100644
--- a/drivers/clocksource/sun4i_timer.c
+++ b/drivers/clocksource/sun4i_timer.c
@@ -123,12 +123,16 @@ static struct clock_event_device sun4i_clockevent = {
         .set_next_event = sun4i_clkevt_next_event,
 };
 
+static void sun4i_timer_clear_interrupt(void)
+{
+        writel(TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_ST_REG);
+}
 
 static irqreturn_t sun4i_timer_interrupt(int irq, void *dev_id)
 {
         struct clock_event_device *evt = (struct clock_event_device *)dev_id;
 
-        writel(0x1, timer_base + TIMER_IRQ_ST_REG);
+        sun4i_timer_clear_interrupt();
         evt->event_handler(evt);
 
         return IRQ_HANDLED;
@@ -208,6 +212,9 @@ static int __init sun4i_timer_init(struct device_node *node)
         /* Make sure timer is stopped before playing with interrupts */
         sun4i_clkevt_time_stop(0);
 
+        /* clear timer0 interrupt */
+        sun4i_timer_clear_interrupt();
+
         sun4i_clockevent.cpumask = cpu_possible_mask;
         sun4i_clockevent.irq = irq;
 
diff --git a/drivers/clocksource/time-pistachio.c b/drivers/clocksource/time-pistachio.c
index a7d9a08e4b0e..a8e6c7df853d 100644
--- a/drivers/clocksource/time-pistachio.c
+++ b/drivers/clocksource/time-pistachio.c
@@ -202,10 +202,10 @@ static int __init pistachio_clksrc_of_init(struct device_node *node)
         rate = clk_get_rate(fast_clk);
 
         /* Disable irq's for clocksource usage */
-        gpt_writel(&pcs_gpt.base, 0, TIMER_IRQ_MASK, 0);
-        gpt_writel(&pcs_gpt.base, 0, TIMER_IRQ_MASK, 1);
-        gpt_writel(&pcs_gpt.base, 0, TIMER_IRQ_MASK, 2);
-        gpt_writel(&pcs_gpt.base, 0, TIMER_IRQ_MASK, 3);
+        gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 0);
+        gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 1);
+        gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 2);
+        gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 3);
 
         /* Enable timer block */
         writel(TIMER_ME_GLOBAL, pcs_gpt.base);
diff --git a/drivers/clocksource/timer-atmel-pit.c b/drivers/clocksource/timer-atmel-pit.c
index 1ffac0cb0cb7..7f0f5b26d8c5 100644
--- a/drivers/clocksource/timer-atmel-pit.c
+++ b/drivers/clocksource/timer-atmel-pit.c
@@ -240,6 +240,7 @@ static int __init at91sam926x_pit_common_init(struct pit_data *data)
 static int __init at91sam926x_pit_dt_init(struct device_node *node)
 {
         struct pit_data *data;
+        int ret;
 
         data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (!data)
@@ -261,6 +262,12 @@ static int __init at91sam926x_pit_dt_init(struct device_node *node)
                 return PTR_ERR(data->mck);
         }
 
+        ret = clk_prepare_enable(data->mck);
+        if (ret) {
+                pr_err("Unable to enable mck\n");
+                return ret;
+        }
+
         /* Get the interrupts property */
         data->irq = irq_of_parse_and_map(node, 0);
         if (!data->irq) {
diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
index 0bb44d5b5df4..2ee40fd360ca 100644
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -74,6 +74,8 @@ static const struct of_device_id machines[] __initconst = {
         { .compatible = "ti,omap5", },
 
         { .compatible = "xlnx,zynq-7000", },
+
+        { }
 };
 
 static int __init cpufreq_dt_platdev_init(void)
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 6dc597126b79..b3044219772c 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -556,7 +556,10 @@ skip_enc:
 
         /* Read and write assoclen bytes */
         append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ);
-        append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
+        if (alg->caam.geniv)
+                append_math_add_imm_u32(desc, VARSEQOUTLEN, REG3, IMM, ivsize);
+        else
+                append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
 
         /* Skip assoc data */
         append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
@@ -565,6 +568,14 @@ skip_enc:
         append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS2 | FIFOLD_TYPE_MSG |
                              KEY_VLF);
 
+        if (alg->caam.geniv) {
+                append_seq_load(desc, ivsize, LDST_CLASS_1_CCB |
+                                LDST_SRCDST_BYTE_CONTEXT |
+                                (ctx1_iv_off << LDST_OFFSET_SHIFT));
+                append_move(desc, MOVE_SRC_CLASS1CTX | MOVE_DEST_CLASS2INFIFO |
+                            (ctx1_iv_off << MOVE_OFFSET_SHIFT) | ivsize);
+        }
+
         /* Load Counter into CONTEXT1 reg */
         if (is_rfc3686)
                 append_load_imm_u32(desc, be32_to_cpu(1), LDST_IMM |
@@ -2150,7 +2161,7 @@ static void init_authenc_job(struct aead_request *req,
 
         init_aead_job(req, edesc, all_contig, encrypt);
 
-        if (ivsize && (is_rfc3686 || !(alg->caam.geniv && encrypt)))
+        if (ivsize && ((is_rfc3686 && encrypt) || !alg->caam.geniv))
                 append_load_as_imm(desc, req->iv, ivsize,
                                    LDST_CLASS_1_CCB |
                                    LDST_SRCDST_BYTE_CONTEXT |
@@ -2537,20 +2548,6 @@ static int aead_decrypt(struct aead_request *req)
         return ret;
 }
 
-static int aead_givdecrypt(struct aead_request *req)
-{
-        struct crypto_aead *aead = crypto_aead_reqtfm(req);
-        unsigned int ivsize = crypto_aead_ivsize(aead);
-
-        if (req->cryptlen < ivsize)
-                return -EINVAL;
-
-        req->cryptlen -= ivsize;
-        req->assoclen += ivsize;
-
-        return aead_decrypt(req);
-}
-
 /*
  * allocate and map the ablkcipher extended descriptor for ablkcipher
  */
@@ -3210,7 +3207,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -3256,7 +3253,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -3302,7 +3299,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -3348,7 +3345,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -3394,7 +3391,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -3440,7 +3437,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
@@ -3486,7 +3483,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -3534,7 +3531,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -3582,7 +3579,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -3630,7 +3627,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -3678,7 +3675,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -3726,7 +3723,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
@@ -3772,7 +3769,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -3818,7 +3815,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -3864,7 +3861,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -3910,7 +3907,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -3956,7 +3953,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -4002,7 +3999,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
@@ -4051,7 +4048,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -4102,7 +4099,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -4153,7 +4150,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -4204,7 +4201,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -4255,7 +4252,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -4306,7 +4303,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
index 769148dbaeb3..20f35df8a01f 100644
--- a/drivers/crypto/qat/qat_common/qat_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_algs.c
@@ -1260,8 +1260,8 @@ static struct crypto_alg qat_algs[] = { {
                         .setkey = qat_alg_ablkcipher_xts_setkey,
                         .decrypt = qat_alg_ablkcipher_decrypt,
                         .encrypt = qat_alg_ablkcipher_encrypt,
-                        .min_keysize = AES_MIN_KEY_SIZE,
-                        .max_keysize = AES_MAX_KEY_SIZE,
+                        .min_keysize = 2 * AES_MIN_KEY_SIZE,
+                        .max_keysize = 2 * AES_MAX_KEY_SIZE,
                         .ivsize = AES_BLOCK_SIZE,
                 },
         },
diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c
index cfb25413917c..24353ec336c5 100644
--- a/drivers/crypto/vmx/aes_xts.c
+++ b/drivers/crypto/vmx/aes_xts.c
@@ -129,8 +129,8 @@ static int p8_aes_xts_crypt(struct blkcipher_desc *desc,
 
                 blkcipher_walk_init(&walk, dst, src, nbytes);
 
-                iv = (u8 *)walk.iv;
                 ret = blkcipher_walk_virt(desc, &walk);
+                iv = walk.iv;
                 memset(tweak, 0, AES_BLOCK_SIZE);
                 aes_p8_encrypt(iv, tweak, &ctx->tweak_key);
 
diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
index 803f3953b341..29f600f2c447 100644
--- a/drivers/dax/dax.c
+++ b/drivers/dax/dax.c
@@ -459,7 +459,7 @@ static int __dax_dev_pmd_fault(struct dax_dev *dax_dev,
         }
 
         pgoff = linear_page_index(vma, pmd_addr);
-        phys = pgoff_to_phys(dax_dev, pgoff, PAGE_SIZE);
+        phys = pgoff_to_phys(dax_dev, pgoff, PMD_SIZE);
         if (phys == -1) {
                 dev_dbg(dev, "%s: phys_to_pgoff(%#lx) failed\n", __func__,
                                 pgoff);
diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
index dfb168568af1..1f01e98c83c7 100644
--- a/drivers/dax/pmem.c
+++ b/drivers/dax/pmem.c
@@ -116,6 +116,9 @@ static int dax_pmem_probe(struct device *dev)
         if (rc)
                 return rc;
 
+        /* adjust the dax_region resource to the start of data */
+        res.start += le64_to_cpu(pfn_sb->dataoff);
+
         nd_region = to_nd_region(dev->parent);
         dax_region = alloc_dax_region(dev, nd_region->id, &res,
                         le32_to_cpu(pfn_sb->align), addr, PFN_DEV|PFN_MAP);
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index e434ffe7bc5c..832cbd647145 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -2067,7 +2067,7 @@ err_dma_unregister:
 err_clk_disable:
         clk_disable_unprepare(atxdmac->clk);
 err_free_irq:
-        free_irq(atxdmac->irq, atxdmac->dma.dev);
+        free_irq(atxdmac->irq, atxdmac);
         return ret;
 }
 
@@ -2081,7 +2081,7 @@ static int at_xdmac_remove(struct platform_device *pdev)
         dma_async_device_unregister(&atxdmac->dma);
         clk_disable_unprepare(atxdmac->clk);
 
-        free_irq(atxdmac->irq, atxdmac->dma.dev);
+        free_irq(atxdmac->irq, atxdmac);
 
         for (i = 0; i < atxdmac->dma.chancnt; i++) {
                 struct at_xdmac_chan *atchan = &atxdmac->chan[i];
diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
index aad167eaaee8..de2a2a2b1d75 100644
--- a/drivers/dma/fsl_raid.c
+++ b/drivers/dma/fsl_raid.c
@@ -836,6 +836,7 @@ static int fsl_re_probe(struct platform_device *ofdev)
                 rc = of_property_read_u32(np, "reg", &off);
                 if (rc) {
                         dev_err(dev, "Reg property not found in JQ node\n");
+                        of_node_put(np);
                         return -ENODEV;
                 }
                 /* Find out the Job Rings present under each JQ */
diff --git a/drivers/dma/img-mdc-dma.c b/drivers/dma/img-mdc-dma.c
index a4c53be482cf..624f1e1e9c55 100644
--- a/drivers/dma/img-mdc-dma.c
+++ b/drivers/dma/img-mdc-dma.c
@@ -861,7 +861,6 @@ static int mdc_dma_probe(struct platform_device *pdev)
 {
         struct mdc_dma *mdma;
         struct resource *res;
-        const struct of_device_id *match;
         unsigned int i;
         u32 val;
         int ret;
@@ -871,8 +870,7 @@ static int mdc_dma_probe(struct platform_device *pdev)
                 return -ENOMEM;
         platform_set_drvdata(pdev, mdma);
 
-        match = of_match_device(mdc_dma_of_match, &pdev->dev);
-        mdma->soc = match->data;
+        mdma->soc = of_device_get_match_data(&pdev->dev);
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         mdma->regs = devm_ioremap_resource(&pdev->dev, res);
diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c
index dc7850a422b8..3f56f9ca4482 100644
--- a/drivers/dma/pxa_dma.c
+++ b/drivers/dma/pxa_dma.c
@@ -638,7 +638,7 @@ static bool pxad_try_hotchain(struct virt_dma_chan *vc,
                 vd_last_issued = list_entry(vc->desc_issued.prev,
                                             struct virt_dma_desc, node);
                 pxad_desc_chain(vd_last_issued, vd);
-                if (is_chan_running(chan) || is_desc_completed(vd_last_issued))
+                if (is_chan_running(chan) || is_desc_completed(vd))
                         return true;
         }
 
@@ -671,6 +671,7 @@ static irqreturn_t pxad_chan_handler(int irq, void *dev_id)
         struct virt_dma_desc *vd, *tmp;
         unsigned int dcsr;
         unsigned long flags;
+        bool vd_completed;
         dma_cookie_t last_started = 0;
 
         BUG_ON(!chan);
@@ -681,15 +682,17 @@ static irqreturn_t pxad_chan_handler(int irq, void *dev_id)
 
         spin_lock_irqsave(&chan->vc.lock, flags);
         list_for_each_entry_safe(vd, tmp, &chan->vc.desc_issued, node) {
+                vd_completed = is_desc_completed(vd);
                 dev_dbg(&chan->vc.chan.dev->device,
-                        "%s(): checking txd %p[%x]: completed=%d\n",
-                        __func__, vd, vd->tx.cookie, is_desc_completed(vd));
+                        "%s(): checking txd %p[%x]: completed=%d dcsr=0x%x\n",
+                        __func__, vd, vd->tx.cookie, vd_completed,
+                        dcsr);
                 last_started = vd->tx.cookie;
                 if (to_pxad_sw_desc(vd)->cyclic) {
                         vchan_cyclic_callback(vd);
                         break;
                 }
-                if (is_desc_completed(vd)) {
+                if (vd_completed) {
                         list_del(&vd->node);
                         vchan_cookie_complete(vd);
                 } else {
diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
index 749f1bd5d65d..06ecdc38cee0 100644
--- a/drivers/dma/sh/usb-dmac.c
+++ b/drivers/dma/sh/usb-dmac.c
@@ -600,27 +600,30 @@ static irqreturn_t usb_dmac_isr_channel(int irq, void *dev)
 {
         struct usb_dmac_chan *chan = dev;
         irqreturn_t ret = IRQ_NONE;
-        u32 mask = USB_DMACHCR_TE;
-        u32 check_bits = USB_DMACHCR_TE | USB_DMACHCR_SP;
+        u32 mask = 0;
         u32 chcr;
+        bool xfer_end = false;
 
         spin_lock(&chan->vc.lock);
 
         chcr = usb_dmac_chan_read(chan, USB_DMACHCR);
-        if (chcr & check_bits)
-                mask |= USB_DMACHCR_DE | check_bits;
+        if (chcr & (USB_DMACHCR_TE | USB_DMACHCR_SP)) {
+                mask |= USB_DMACHCR_DE | USB_DMACHCR_TE | USB_DMACHCR_SP;
+                if (chcr & USB_DMACHCR_DE)
+                        xfer_end = true;
+                ret |= IRQ_HANDLED;
+        }
         if (chcr & USB_DMACHCR_NULL) {
                 /* An interruption of TE will happen after we set FTE */
                 mask |= USB_DMACHCR_NULL;
                 chcr |= USB_DMACHCR_FTE;
                 ret |= IRQ_HANDLED;
         }
-        usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask);
+        if (mask)
+                usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask);
 
-        if (chcr & check_bits) {
+        if (xfer_end)
                 usb_dmac_isr_transfer_end(chan);
-                ret |= IRQ_HANDLED;
-        }
 
         spin_unlock(&chan->vc.lock);
 
diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c
index 438893762076..ce2bc2a38101 100644
--- a/drivers/firmware/arm_scpi.c
+++ b/drivers/firmware/arm_scpi.c
@@ -709,9 +709,10 @@ static int scpi_probe(struct platform_device *pdev)
                 struct mbox_client *cl = &pchan->cl;
                 struct device_node *shmem = of_parse_phandle(np, "shmem", idx);
 
-                if (of_address_to_resource(shmem, 0, &res)) {
+                ret = of_address_to_resource(shmem, 0, &res);
+                of_node_put(shmem);
+                if (ret) {
                         dev_err(dev, "failed to get SCPI payload mem resource\n");
-                        ret = -EINVAL;
                         goto err;
                 }
 
diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c
index 94a58a082b99..44c01390d035 100644
--- a/drivers/firmware/dmi-id.c
+++ b/drivers/firmware/dmi-id.c
@@ -229,14 +229,14 @@ static int __init dmi_id_init(void)
 
         ret = device_register(dmi_dev);
         if (ret)
-                goto fail_free_dmi_dev;
+                goto fail_put_dmi_dev;
 
         return 0;
 
-fail_free_dmi_dev:
-        kfree(dmi_dev);
-fail_class_unregister:
+fail_put_dmi_dev:
+        put_device(dmi_dev);
 
+fail_class_unregister:
         class_unregister(&dmi_class);
 
         return ret;
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 5a2631af7410..7dd2e2d37231 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -657,9 +657,12 @@ static int __init fdt_find_uefi_params(unsigned long node, const char *uname,
                 }
 
                 if (subnode) {
-                        node = of_get_flat_dt_subnode_by_name(node, subnode);
-                        if (node < 0)
+                        int err = of_get_flat_dt_subnode_by_name(node, subnode);
+
+                        if (err < 0)
                                 return 0;
+
+                        node = err;
                 }
 
                 return __find_uefi_params(node, info, dt_params[i].params);
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 3bd127f95315..aded10662020 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -41,6 +41,8 @@ static unsigned long __chunk_size = EFI_READ_CHUNK_SIZE;
 #define EFI_ALLOC_ALIGN         EFI_PAGE_SIZE
 #endif
 
+#define EFI_MMAP_NR_SLACK_SLOTS 8
+
 struct file_info {
         efi_file_handle_t *handle;
         u64 size;
@@ -63,49 +65,62 @@ void efi_printk(efi_system_table_t *sys_table_arg, char *str)
         }
 }
 
+static inline bool mmap_has_headroom(unsigned long buff_size,
+                                     unsigned long map_size,
+                                     unsigned long desc_size)
+{
+        unsigned long slack = buff_size - map_size;
+
+        return slack / desc_size >= EFI_MMAP_NR_SLACK_SLOTS;
+}
+
 efi_status_t efi_get_memory_map(efi_system_table_t *sys_table_arg,
-                                efi_memory_desc_t **map,
-                                unsigned long *map_size,
-                                unsigned long *desc_size,
-                                u32 *desc_ver,
-                                unsigned long *key_ptr)
+                                struct efi_boot_memmap *map)
 {
         efi_memory_desc_t *m = NULL;
         efi_status_t status;
         unsigned long key;
         u32 desc_version;
 
-        *map_size = sizeof(*m) * 32;
+        *map->desc_size =       sizeof(*m);
+        *map->map_size =        *map->desc_size * 32;
+        *map->buff_size =       *map->map_size;
 again:
-        /*
-         * Add an additional efi_memory_desc_t because we're doing an
-         * allocation which may be in a new descriptor region.
-         */
-        *map_size += sizeof(*m);
         status = efi_call_early(allocate_pool, EFI_LOADER_DATA,
-                                *map_size, (void **)&m);
+                                *map->map_size, (void **)&m);
         if (status != EFI_SUCCESS)
                 goto fail;
 
-        *desc_size = 0;
+        *map->desc_size = 0;
         key = 0;
-        status = efi_call_early(get_memory_map, map_size, m,
-                                &key, desc_size, &desc_version);
-        if (status == EFI_BUFFER_TOO_SMALL) {
+        status = efi_call_early(get_memory_map, map->map_size, m,
+                                &key, map->desc_size, &desc_version);
+        if (status == EFI_BUFFER_TOO_SMALL ||
+            !mmap_has_headroom(*map->buff_size, *map->map_size,
+                               *map->desc_size)) {
                 efi_call_early(free_pool, m);
+                /*
+                 * Make sure there is some entries of headroom so that the
+                 * buffer can be reused for a new map after allocations are
+                 * no longer permitted.  Its unlikely that the map will grow to
+                 * exceed this headroom once we are ready to trigger
+                 * ExitBootServices()
+                 */
+                *map->map_size += *map->desc_size * EFI_MMAP_NR_SLACK_SLOTS;
+                *map->buff_size = *map->map_size;
                 goto again;
         }
 
         if (status != EFI_SUCCESS)
                 efi_call_early(free_pool, m);
 
-        if (key_ptr && status == EFI_SUCCESS)
-                *key_ptr = key;
-        if (desc_ver && status == EFI_SUCCESS)
-                *desc_ver = desc_version;
+        if (map->key_ptr && status == EFI_SUCCESS)
+                *map->key_ptr = key;
+        if (map->desc_ver && status == EFI_SUCCESS)
+                *map->desc_ver = desc_version;
 
 fail:
-        *map = m;
+        *map->map = m;
         return status;
 }
 
@@ -113,13 +128,20 @@ fail:
 unsigned long get_dram_base(efi_system_table_t *sys_table_arg)
 {
         efi_status_t status;
-        unsigned long map_size;
+        unsigned long map_size, buff_size;
         unsigned long membase  = EFI_ERROR;
         struct efi_memory_map map;
         efi_memory_desc_t *md;
+        struct efi_boot_memmap boot_map;
 
-        status = efi_get_memory_map(sys_table_arg, (efi_memory_desc_t **)&map.map,
-                                    &map_size, &map.desc_size, NULL, NULL);
+        boot_map.map =          (efi_memory_desc_t **)&map.map;
+        boot_map.map_size =     &map_size;
+        boot_map.desc_size =    &map.desc_size;
+        boot_map.desc_ver =     NULL;
+        boot_map.key_ptr =      NULL;
+        boot_map.buff_size =    &buff_size;
+
+        status = efi_get_memory_map(sys_table_arg, &boot_map);
         if (status != EFI_SUCCESS)
                 return membase;
 
@@ -144,15 +166,22 @@ efi_status_t efi_high_alloc(efi_system_table_t *sys_table_arg,
                             unsigned long size, unsigned long align,
                             unsigned long *addr, unsigned long max)
 {
-        unsigned long map_size, desc_size;
+        unsigned long map_size, desc_size, buff_size;
         efi_memory_desc_t *map;
         efi_status_t status;
         unsigned long nr_pages;
         u64 max_addr = 0;
         int i;
+        struct efi_boot_memmap boot_map;
+
+        boot_map.map =          &map;
+        boot_map.map_size =     &map_size;
+        boot_map.desc_size =    &desc_size;
+        boot_map.desc_ver =     NULL;
+        boot_map.key_ptr =      NULL;
+        boot_map.buff_size =    &buff_size;
 
-        status = efi_get_memory_map(sys_table_arg, &map, &map_size, &desc_size,
-                                    NULL, NULL);
+        status = efi_get_memory_map(sys_table_arg, &boot_map);
         if (status != EFI_SUCCESS)
                 goto fail;
 
@@ -230,14 +259,21 @@ efi_status_t efi_low_alloc(efi_system_table_t *sys_table_arg,
                            unsigned long size, unsigned long align,
                            unsigned long *addr)
 {
-        unsigned long map_size, desc_size;
+        unsigned long map_size, desc_size, buff_size;
         efi_memory_desc_t *map;
         efi_status_t status;
         unsigned long nr_pages;
         int i;
+        struct efi_boot_memmap boot_map;
 
-        status = efi_get_memory_map(sys_table_arg, &map, &map_size, &desc_size,
-                                    NULL, NULL);
+        boot_map.map =          &map;
+        boot_map.map_size =     &map_size;
+        boot_map.desc_size =    &desc_size;
+        boot_map.desc_ver =     NULL;
+        boot_map.key_ptr =      NULL;
+        boot_map.buff_size =    &buff_size;
+
+        status = efi_get_memory_map(sys_table_arg, &boot_map);
         if (status != EFI_SUCCESS)
                 goto fail;
 
@@ -704,3 +740,76 @@ char *efi_convert_cmdline(efi_system_table_t *sys_table_arg,
         *cmd_line_len = options_bytes;
         return (char *)cmdline_addr;
 }
+
+/*
+ * Handle calling ExitBootServices according to the requirements set out by the
+ * spec.  Obtains the current memory map, and returns that info after calling
+ * ExitBootServices.  The client must specify a function to perform any
+ * processing of the memory map data prior to ExitBootServices.  A client
+ * specific structure may be passed to the function via priv.  The client
+ * function may be called multiple times.
+ */
+efi_status_t efi_exit_boot_services(efi_system_table_t *sys_table_arg,
+                                    void *handle,
+                                    struct efi_boot_memmap *map,
+                                    void *priv,
+                                    efi_exit_boot_map_processing priv_func)
+{
+        efi_status_t status;
+
+        status = efi_get_memory_map(sys_table_arg, map);
+
+        if (status != EFI_SUCCESS)
+                goto fail;
+
+        status = priv_func(sys_table_arg, map, priv);
+        if (status != EFI_SUCCESS)
+                goto free_map;
+
+        status = efi_call_early(exit_boot_services, handle, *map->key_ptr);
+
+        if (status == EFI_INVALID_PARAMETER) {
+                /*
+                 * The memory map changed between efi_get_memory_map() and
+                 * exit_boot_services().  Per the UEFI Spec v2.6, Section 6.4:
+                 * EFI_BOOT_SERVICES.ExitBootServices we need to get the
+                 * updated map, and try again.  The spec implies one retry
+                 * should be sufficent, which is confirmed against the EDK2
+                 * implementation.  Per the spec, we can only invoke
+                 * get_memory_map() and exit_boot_services() - we cannot alloc
+                 * so efi_get_memory_map() cannot be used, and we must reuse
+                 * the buffer.  For all practical purposes, the headroom in the
+                 * buffer should account for any changes in the map so the call
+                 * to get_memory_map() is expected to succeed here.
+                 */
+                *map->map_size = *map->buff_size;
+                status = efi_call_early(get_memory_map,
+                                        map->map_size,
+                                        *map->map,
+                                        map->key_ptr,
+                                        map->desc_size,
+                                        map->desc_ver);
+
+                /* exit_boot_services() was called, thus cannot free */
+                if (status != EFI_SUCCESS)
+                        goto fail;
+
+                status = priv_func(sys_table_arg, map, priv);
+                /* exit_boot_services() was called, thus cannot free */
+                if (status != EFI_SUCCESS)
+                        goto fail;
+
+                status = efi_call_early(exit_boot_services, handle, *map->key_ptr);
+        }
+
+        /* exit_boot_services() was called, thus cannot free */
+        if (status != EFI_SUCCESS)
+                goto fail;
+
+        return EFI_SUCCESS;
+
+free_map:
+        efi_call_early(free_pool, *map->map);
+fail:
+        return status;
+}
diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
index e58abfa953cc..a6a93116a8f0 100644
--- a/drivers/firmware/efi/libstub/fdt.c
+++ b/drivers/firmware/efi/libstub/fdt.c
@@ -152,6 +152,27 @@ fdt_set_fail:
 #define EFI_FDT_ALIGN EFI_PAGE_SIZE
 #endif
 
+struct exit_boot_struct {
+        efi_memory_desc_t *runtime_map;
+        int *runtime_entry_count;
+};
+
+static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
+                                   struct efi_boot_memmap *map,
+                                   void *priv)
+{
+        struct exit_boot_struct *p = priv;
+        /*
+         * Update the memory map with virtual addresses. The function will also
+         * populate @runtime_map with copies of just the EFI_MEMORY_RUNTIME
+         * entries so that we can pass it straight to SetVirtualAddressMap()
+         */
+        efi_get_virtmap(*map->map, *map->map_size, *map->desc_size,
+                        p->runtime_map, p->runtime_entry_count);
+
+        return EFI_SUCCESS;
+}
+
 /*
  * Allocate memory for a new FDT, then add EFI, commandline, and
  * initrd related fields to the FDT.  This routine increases the
@@ -175,13 +196,22 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
                                             unsigned long fdt_addr,
                                             unsigned long fdt_size)
 {
-        unsigned long map_size, desc_size;
+        unsigned long map_size, desc_size, buff_size;
         u32 desc_ver;
         unsigned long mmap_key;
         efi_memory_desc_t *memory_map, *runtime_map;
         unsigned long new_fdt_size;
         efi_status_t status;
         int runtime_entry_count = 0;
+        struct efi_boot_memmap map;
+        struct exit_boot_struct priv;
+
+        map.map =       &runtime_map;
+        map.map_size =  &map_size;
+        map.desc_size = &desc_size;
+        map.desc_ver =  &desc_ver;
+        map.key_ptr =   &mmap_key;
+        map.buff_size = &buff_size;
 
         /*
          * Get a copy of the current memory map that we will use to prepare
@@ -189,8 +219,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
          * subsequent allocations adding entries, since they could not affect
          * the number of EFI_MEMORY_RUNTIME regions.
          */
-        status = efi_get_memory_map(sys_table, &runtime_map, &map_size,
-                                    &desc_size, &desc_ver, &mmap_key);
+        status = efi_get_memory_map(sys_table, &map);
         if (status != EFI_SUCCESS) {
                 pr_efi_err(sys_table, "Unable to retrieve UEFI memory map.\n");
                 return status;
@@ -199,6 +228,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
         pr_efi(sys_table,
                "Exiting boot services and installing virtual address map...\n");
 
+        map.map = &memory_map;
         /*
          * Estimate size of new FDT, and allocate memory for it. We
          * will allocate a bigger buffer if this ends up being too
@@ -218,8 +248,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
                  * we can get the memory map key  needed for
                  * exit_boot_services().
                  */
-                status = efi_get_memory_map(sys_table, &memory_map, &map_size,
-                                            &desc_size, &desc_ver, &mmap_key);
+                status = efi_get_memory_map(sys_table, &map);
                 if (status != EFI_SUCCESS)
                         goto fail_free_new_fdt;
 
@@ -250,16 +279,11 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
                 }
         }
 
-        /*
-         * Update the memory map with virtual addresses. The function will also
-         * populate @runtime_map with copies of just the EFI_MEMORY_RUNTIME
-         * entries so that we can pass it straight into SetVirtualAddressMap()
-         */
-        efi_get_virtmap(memory_map, map_size, desc_size, runtime_map,
-                        &runtime_entry_count);
-
-        /* Now we are ready to exit_boot_services.*/
-        status = sys_table->boottime->exit_boot_services(handle, mmap_key);
+        sys_table->boottime->free_pool(memory_map);
+        priv.runtime_map = runtime_map;
+        priv.runtime_entry_count = &runtime_entry_count;
+        status = efi_exit_boot_services(sys_table, handle, &map, &priv,
+                                        exit_boot_func);
 
         if (status == EFI_SUCCESS) {
                 efi_set_virtual_address_map_t *svam;
diff --git a/drivers/firmware/efi/libstub/random.c b/drivers/firmware/efi/libstub/random.c
index 53f6d3fe6d86..0c9f58c5ba50 100644
--- a/drivers/firmware/efi/libstub/random.c
+++ b/drivers/firmware/efi/libstub/random.c
@@ -73,12 +73,20 @@ efi_status_t efi_random_alloc(efi_system_table_t *sys_table_arg,
                               unsigned long random_seed)
 {
         unsigned long map_size, desc_size, total_slots = 0, target_slot;
+        unsigned long buff_size;
         efi_status_t status;
         efi_memory_desc_t *memory_map;
         int map_offset;
+        struct efi_boot_memmap map;
 
-        status = efi_get_memory_map(sys_table_arg, &memory_map, &map_size,
-                                    &desc_size, NULL, NULL);
+        map.map =       &memory_map;
+        map.map_size =  &map_size;
+        map.desc_size = &desc_size;
+        map.desc_ver =  NULL;
+        map.key_ptr =   NULL;
+        map.buff_size = &buff_size;
+
+        status = efi_get_memory_map(sys_table_arg, &map);
         if (status != EFI_SUCCESS)
                 return status;
 
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 98dd47a30fc7..24caedb00a7a 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -50,6 +50,7 @@ config GPIO_DEVRES
 config OF_GPIO
         def_bool y
         depends on OF
+        depends on HAS_IOMEM
 
 config GPIO_ACPI
         def_bool y
@@ -188,7 +189,7 @@ config GPIO_EP93XX
 config GPIO_ETRAXFS
         bool "Axis ETRAX FS General I/O"
         depends on CRIS || COMPILE_TEST
-        depends on OF
+        depends on OF_GPIO
         select GPIO_GENERIC
         select GPIOLIB_IRQCHIP
         help
@@ -214,7 +215,7 @@ config GPIO_GENERIC_PLATFORM
 
 config GPIO_GRGPIO
         tristate "Aeroflex Gaisler GRGPIO support"
-        depends on OF
+        depends on OF_GPIO
         select GPIO_GENERIC
         select IRQ_DOMAIN
         help
@@ -312,7 +313,7 @@ config GPIO_MPC8XXX
 config GPIO_MVEBU
         def_bool y
         depends on PLAT_ORION
-        depends on OF
+        depends on OF_GPIO
         select GENERIC_IRQ_CHIP
 
 config GPIO_MXC
@@ -405,7 +406,7 @@ config GPIO_TEGRA
         bool "NVIDIA Tegra GPIO support"
         default ARCH_TEGRA
         depends on ARCH_TEGRA || COMPILE_TEST
-        depends on OF
+        depends on OF_GPIO
         help
           Say yes here to support GPIO pins on NVIDIA Tegra SoCs.
 
@@ -1099,7 +1100,7 @@ menu "SPI GPIO expanders"
 
 config GPIO_74X164
         tristate "74x164 serial-in/parallel-out 8-bits shift register"
-        depends on OF
+        depends on OF_GPIO
         help
           Driver for 74x164 compatible serial-in/parallel-out 8-outputs
           shift registers. This driver can be used to provide access
@@ -1130,6 +1131,7 @@ menu "SPI or I2C GPIO expanders"
 
 config GPIO_MCP23S08
         tristate "Microchip MCP23xxx I/O expander"
+        depends on OF_GPIO
         select GPIOLIB_IRQCHIP
         help
           SPI/I2C driver for Microchip MCP23S08/MCP23S17/MCP23008/MCP23017
diff --git a/drivers/gpio/gpio-max730x.c b/drivers/gpio/gpio-max730x.c
index 08807368f007..946d09195598 100644
--- a/drivers/gpio/gpio-max730x.c
+++ b/drivers/gpio/gpio-max730x.c
@@ -192,6 +192,10 @@ int __max730x_probe(struct max7301 *ts)
         ts->chip.parent = dev;
         ts->chip.owner = THIS_MODULE;
 
+        ret = gpiochip_add_data(&ts->chip, ts);
+        if (ret)
+                goto exit_destroy;
+
         /*
          * initialize pullups according to platform data and cache the
          * register values for later use.
@@ -213,10 +217,6 @@ int __max730x_probe(struct max7301 *ts)
                 }
         }
 
-        ret = gpiochip_add_data(&ts->chip, ts);
-        if (ret)
-                goto exit_destroy;
-
         return ret;
 
 exit_destroy:
diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
index ac22efc1840e..99d37b56c258 100644
--- a/drivers/gpio/gpio-mcp23s08.c
+++ b/drivers/gpio/gpio-mcp23s08.c
@@ -564,7 +564,7 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
         mcp->chip.direction_output = mcp23s08_direction_output;
         mcp->chip.set = mcp23s08_set;
         mcp->chip.dbg_show = mcp23s08_dbg_show;
-#ifdef CONFIG_OF
+#ifdef CONFIG_OF_GPIO
         mcp->chip.of_gpio_n_cells = 2;
         mcp->chip.of_node = dev->of_node;
 #endif
diff --git a/drivers/gpio/gpio-sa1100.c b/drivers/gpio/gpio-sa1100.c
index 0c99e8fb9af3..8d8ee0ebf14c 100644
--- a/drivers/gpio/gpio-sa1100.c
+++ b/drivers/gpio/gpio-sa1100.c
@@ -155,7 +155,7 @@ static int sa1100_gpio_irqdomain_map(struct irq_domain *d,
 {
         irq_set_chip_and_handler(irq, &sa1100_gpio_irq_chip,
                                  handle_edge_irq);
-        irq_set_noprobe(irq);
+        irq_set_probe(irq);
 
         return 0;
 }
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 75e7b3919ea7..a28feb3edf33 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -16,7 +16,6 @@
 #include <linux/errno.h>
 #include <linux/module.h>
 #include <linux/io.h>
-#include <linux/io-mapping.h>
 #include <linux/gpio/consumer.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 8c704c86597b..700c56baf2de 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -426,6 +426,8 @@ struct amdgpu_mman {
 
         /* custom LRU management */
         struct amdgpu_mman_lru                  log2_size[AMDGPU_TTM_LRU_SIZE];
+        /* guard for log2_size array, don't add anything in between */
+        struct amdgpu_mman_lru                  guard;
 };
 
 int amdgpu_copy_buffer(struct amdgpu_ring *ring,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
index 983175363b06..fe872b82e619 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
@@ -321,6 +321,19 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
                             (le16_to_cpu(path->usConnObjectId) &
                              OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
 
+                        /* Skip TV/CV support */
+                        if ((le16_to_cpu(path->usDeviceTag) ==
+                             ATOM_DEVICE_TV1_SUPPORT) ||
+                            (le16_to_cpu(path->usDeviceTag) ==
+                             ATOM_DEVICE_CV_SUPPORT))
+                                continue;
+
+                        if (con_obj_id >= ARRAY_SIZE(object_connector_convert)) {
+                                DRM_ERROR("invalid con_obj_id %d for device tag 0x%04x\n",
+                                          con_obj_id, le16_to_cpu(path->usDeviceTag));
+                                continue;
+                        }
+
                         connector_type =
                                 object_connector_convert[con_obj_id];
                         connector_object_id = con_obj_id;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
index a31d7ef3032c..ec1282af2479 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
@@ -280,7 +280,7 @@ void amdgpu_ib_pool_fini(struct amdgpu_device *adev)
 int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
 {
         unsigned i;
-        int r;
+        int r, ret = 0;
 
         for (i = 0; i < AMDGPU_MAX_RINGS; ++i) {
                 struct amdgpu_ring *ring = adev->rings[i];
@@ -301,10 +301,11 @@ int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
                         } else {
                                 /* still not good, but we can live with it */
                                 DRM_ERROR("amdgpu: failed testing IB on ring %d (%d).\n", i, r);
+                                ret = r;
                         }
                 }
         }
-        return 0;
+        return ret;
 }
 
 /*
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 9b61c8ba7aaf..716f2afeb6a9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -251,8 +251,8 @@ static int amdgpu_move_blit(struct ttm_buffer_object *bo,
 
         adev = amdgpu_get_adev(bo->bdev);
         ring = adev->mman.buffer_funcs_ring;
-        old_start = old_mem->start << PAGE_SHIFT;
-        new_start = new_mem->start << PAGE_SHIFT;
+        old_start = (u64)old_mem->start << PAGE_SHIFT;
+        new_start = (u64)new_mem->start << PAGE_SHIFT;
 
         switch (old_mem->mem_type) {
         case TTM_PL_VRAM:
@@ -950,6 +950,8 @@ static struct list_head *amdgpu_ttm_lru_tail(struct ttm_buffer_object *tbo)
         struct list_head *res = lru->lru[tbo->mem.mem_type];
 
         lru->lru[tbo->mem.mem_type] = &tbo->lru;
+        while ((++lru)->lru[tbo->mem.mem_type] == res)
+                lru->lru[tbo->mem.mem_type] = &tbo->lru;
 
         return res;
 }
@@ -960,6 +962,8 @@ static struct list_head *amdgpu_ttm_swap_lru_tail(struct ttm_buffer_object *tbo)
         struct list_head *res = lru->swap_lru;
 
         lru->swap_lru = &tbo->swap;
+        while ((++lru)->swap_lru == res)
+                lru->swap_lru = &tbo->swap;
 
         return res;
 }
@@ -1011,6 +1015,10 @@ int amdgpu_ttm_init(struct amdgpu_device *adev)
                 lru->swap_lru = &adev->mman.bdev.glob->swap_lru;
         }
 
+        for (j = 0; j < TTM_NUM_MEM_TYPES; ++j)
+                adev->mman.guard.lru[j] = NULL;
+        adev->mman.guard.swap_lru = NULL;
+
         adev->mman.initialized = true;
         r = ttm_bo_init_mm(&adev->mman.bdev, TTM_PL_VRAM,
                                 adev->mc.real_vram_size >> PAGE_SHIFT);
diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
index ee6466912497..77fdd9911c3c 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
@@ -52,6 +52,7 @@ static void cik_sdma_set_ring_funcs(struct amdgpu_device *adev);
 static void cik_sdma_set_irq_funcs(struct amdgpu_device *adev);
 static void cik_sdma_set_buffer_funcs(struct amdgpu_device *adev);
 static void cik_sdma_set_vm_pte_funcs(struct amdgpu_device *adev);
+static int cik_sdma_soft_reset(void *handle);
 
 MODULE_FIRMWARE("radeon/bonaire_sdma.bin");
 MODULE_FIRMWARE("radeon/bonaire_sdma1.bin");
@@ -1037,6 +1038,8 @@ static int cik_sdma_resume(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        cik_sdma_soft_reset(handle);
+
         return cik_sdma_hw_init(adev);
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
index d869d058ef24..425413fcaf02 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -2755,8 +2755,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
         u64 wb_gpu_addr;
         u32 *buf;
         struct bonaire_mqd *mqd;
-
-        gfx_v7_0_cp_compute_enable(adev, true);
+        struct amdgpu_ring *ring;
 
         /* fix up chicken bits */
         tmp = RREG32(mmCP_CPF_DEBUG);
@@ -2791,7 +2790,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
 
         /* init the queues.  Just two for now. */
         for (i = 0; i < adev->gfx.num_compute_rings; i++) {
-                struct amdgpu_ring *ring = &adev->gfx.compute_ring[i];
+                ring = &adev->gfx.compute_ring[i];
 
                 if (ring->mqd_obj == NULL) {
                         r = amdgpu_bo_create(adev,
@@ -2970,6 +2969,13 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
                 amdgpu_bo_unreserve(ring->mqd_obj);
 
                 ring->ready = true;
+        }
+
+        gfx_v7_0_cp_compute_enable(adev, true);
+
+        for (i = 0; i < adev->gfx.num_compute_rings; i++) {
+                ring = &adev->gfx.compute_ring[i];
+
                 r = amdgpu_ring_test_ring(ring);
                 if (r)
                         ring->ready = false;
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
index 1351c7e834a2..a64715d90503 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
@@ -714,7 +714,7 @@ static int sdma_v2_4_ring_test_ib(struct amdgpu_ring *ring, long timeout)
                 DRM_ERROR("amdgpu: IB test timed out\n");
                 r = -ETIMEDOUT;
                 goto err1;
-        } else if (r) {
+        } else if (r < 0) {
                 DRM_ERROR("amdgpu: fence wait failed (%ld).\n", r);
                 goto err1;
         }
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
index ef312bb75fda..963a24d46a93 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
@@ -405,7 +405,7 @@ void amd_sched_job_recovery(struct amd_gpu_scheduler *sched)
         spin_lock(&sched->job_list_lock);
         s_job = list_first_entry_or_null(&sched->ring_mirror_list,
                                          struct amd_sched_job, node);
-        if (s_job)
+        if (s_job && sched->timeout != MAX_SCHEDULE_TIMEOUT)
                 schedule_delayed_work(&s_job->work_tdr, sched->timeout);
 
         list_for_each_entry_safe(s_job, tmp, &sched->ring_mirror_list, node) {
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index fa3930757972..2a3ded44cf2a 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -475,7 +475,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
                                         val,
                                         -1,
                                         &replaced);
-                state->color_mgmt_changed = replaced;
+                state->color_mgmt_changed |= replaced;
                 return ret;
         } else if (property == config->ctm_property) {
                 ret = drm_atomic_replace_property_blob_from_id(crtc,
@@ -483,7 +483,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
                                         val,
                                         sizeof(struct drm_color_ctm),
                                         &replaced);
-                state->color_mgmt_changed = replaced;
+                state->color_mgmt_changed |= replaced;
                 return ret;
         } else if (property == config->gamma_lut_property) {
                 ret = drm_atomic_replace_property_blob_from_id(crtc,
@@ -491,7 +491,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
                                         val,
                                         -1,
                                         &replaced);
-                state->color_mgmt_changed = replaced;
+                state->color_mgmt_changed |= replaced;
                 return ret;
         } else if (crtc->funcs->atomic_set_property)
                 return crtc->funcs->atomic_set_property(crtc, state, property, val);
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index b1dbb60af99f..ddebe54cd5ca 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -5404,6 +5404,9 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
         struct drm_pending_vblank_event *e = NULL;
         int ret = -EINVAL;
 
+        if (!drm_core_check_feature(dev, DRIVER_MODESET))
+                return -EINVAL;
+
         if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
             page_flip->reserved != 0)
                 return -EINVAL;
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 20fe9d52e256..f68c78918d63 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -882,11 +882,12 @@ struct i915_gem_context {
 
         struct i915_ctx_hang_stats hang_stats;
 
-        /* Unique identifier for this context, used by the hw for tracking */
         unsigned long flags;
 #define CONTEXT_NO_ZEROMAP              BIT(0)
 #define CONTEXT_NO_ERROR_CAPTURE        BIT(1)
-        unsigned hw_id;
+
+        /* Unique identifier for this context, used by the hw for tracking */
+        unsigned int hw_id;
         u32 user_handle;
 
         u32 ggtt_alignment;
@@ -1963,6 +1964,13 @@ struct drm_i915_private {
         struct i915_suspend_saved_registers regfile;
         struct vlv_s0ix_state vlv_s0ix_state;
 
+        enum {
+                I915_SKL_SAGV_UNKNOWN = 0,
+                I915_SKL_SAGV_DISABLED,
+                I915_SKL_SAGV_ENABLED,
+                I915_SKL_SAGV_NOT_CONTROLLED
+        } skl_sagv_status;
+
         struct {
                 /*
                  * Raw watermark latency values:
@@ -3591,6 +3599,7 @@ int i915_gem_evict_vm(struct i915_address_space *vm, bool do_idle);
 /* belongs in i915_gem_gtt.h */
 static inline void i915_gem_chipset_flush(struct drm_i915_private *dev_priv)
 {
+        wmb();
         if (INTEL_GEN(dev_priv) < 6)
                 intel_gtt_chipset_flush();
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 1978633e7549..b35e5b6475b2 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -943,8 +943,6 @@ i915_gem_execbuffer_move_to_gpu(struct drm_i915_gem_request *req,
 {
         const unsigned other_rings = ~intel_engine_flag(req->engine);
         struct i915_vma *vma;
-        uint32_t flush_domains = 0;
-        bool flush_chipset = false;
         int ret;
 
         list_for_each_entry(vma, vmas, exec_list) {
@@ -957,16 +955,11 @@ i915_gem_execbuffer_move_to_gpu(struct drm_i915_gem_request *req,
                 }
 
                 if (obj->base.write_domain & I915_GEM_DOMAIN_CPU)
-                        flush_chipset |= i915_gem_clflush_object(obj, false);
-
-                flush_domains |= obj->base.write_domain;
+                        i915_gem_clflush_object(obj, false);
         }
 
-        if (flush_chipset)
-                i915_gem_chipset_flush(req->engine->i915);
-
-        if (flush_domains & I915_GEM_DOMAIN_GTT)
-                wmb();
+        /* Unconditionally flush any chipset caches (for streaming writes). */
+        i915_gem_chipset_flush(req->engine->i915);
 
         /* Unconditionally invalidate gpu caches and ensure that we do flush
          * any residual writes from the previous batch.
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 5c06413ae0e6..bf2cad3f9e1f 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -7145,6 +7145,15 @@ enum {
 
 #define GEN6_PCODE_MAILBOX                      _MMIO(0x138124)
 #define   GEN6_PCODE_READY                      (1<<31)
+#define   GEN6_PCODE_ERROR_MASK                 0xFF
+#define     GEN6_PCODE_SUCCESS                  0x0
+#define     GEN6_PCODE_ILLEGAL_CMD              0x1
+#define     GEN6_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE 0x2
+#define     GEN6_PCODE_TIMEOUT                  0x3
+#define     GEN6_PCODE_UNIMPLEMENTED_CMD        0xFF
+#define     GEN7_PCODE_TIMEOUT                  0x2
+#define     GEN7_PCODE_ILLEGAL_DATA             0x3
+#define     GEN7_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE 0x10
 #define   GEN6_PCODE_WRITE_RC6VIDS              0x4
 #define   GEN6_PCODE_READ_RC6VIDS               0x5
 #define     GEN6_ENCODE_RC6_VID(mv)             (((mv) - 245) / 5)
@@ -7166,6 +7175,10 @@ enum {
 #define   HSW_PCODE_DE_WRITE_FREQ_REQ           0x17
 #define   DISPLAY_IPS_CONTROL                   0x19
 #define   HSW_PCODE_DYNAMIC_DUTY_CYCLE_CONTROL  0x1A
+#define   GEN9_PCODE_SAGV_CONTROL               0x21
+#define     GEN9_SAGV_DISABLE                   0x0
+#define     GEN9_SAGV_IS_DISABLED               0x1
+#define     GEN9_SAGV_ENABLE                    0x3
 #define GEN6_PCODE_DATA                         _MMIO(0x138128)
 #define   GEN6_PCODE_FREQ_IA_RATIO_SHIFT        8
 #define   GEN6_PCODE_FREQ_RING_RATIO_SHIFT      16
diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
index 3edb9580928e..c3b33a10c15c 100644
--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -41,15 +41,15 @@
  * be moved to FW_FAILED.
  */
 
-#define I915_CSR_KBL "i915/kbl_dmc_ver1.bin"
+#define I915_CSR_KBL "i915/kbl_dmc_ver1_01.bin"
 MODULE_FIRMWARE(I915_CSR_KBL);
 #define KBL_CSR_VERSION_REQUIRED        CSR_VERSION(1, 1)
 
-#define I915_CSR_SKL "i915/skl_dmc_ver1.bin"
+#define I915_CSR_SKL "i915/skl_dmc_ver1_26.bin"
 MODULE_FIRMWARE(I915_CSR_SKL);
-#define SKL_CSR_VERSION_REQUIRED        CSR_VERSION(1, 23)
+#define SKL_CSR_VERSION_REQUIRED        CSR_VERSION(1, 26)
 
-#define I915_CSR_BXT "i915/bxt_dmc_ver1.bin"
+#define I915_CSR_BXT "i915/bxt_dmc_ver1_07.bin"
 MODULE_FIRMWARE(I915_CSR_BXT);
 #define BXT_CSR_VERSION_REQUIRED        CSR_VERSION(1, 7)
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 2a751b6e0253..175595fc3e45 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -13759,6 +13759,13 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
                      intel_state->cdclk_pll_vco != dev_priv->cdclk_pll.vco))
                         dev_priv->display.modeset_commit_cdclk(state);
 
+                /*
+                 * SKL workaround: bspec recommends we disable the SAGV when we
+                 * have more then one pipe enabled
+                 */
+                if (IS_SKYLAKE(dev_priv) && !skl_can_enable_sagv(state))
+                        skl_disable_sagv(dev_priv);
+
                 intel_modeset_verify_disabled(dev);
         }
 
@@ -13832,6 +13839,10 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
                 intel_modeset_verify_crtc(crtc, old_crtc_state, crtc->state);
         }
 
+        if (IS_SKYLAKE(dev_priv) && intel_state->modeset &&
+            skl_can_enable_sagv(state))
+                skl_enable_sagv(dev_priv);
+
         drm_atomic_helper_commit_hw_done(state);
 
         if (intel_state->modeset)
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index cc937a19b1ba..ff399b9a5c1f 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -1716,6 +1716,9 @@ void ilk_wm_get_hw_state(struct drm_device *dev);
 void skl_wm_get_hw_state(struct drm_device *dev);
 void skl_ddb_get_hw_state(struct drm_i915_private *dev_priv,
                           struct skl_ddb_allocation *ddb /* out */);
+bool skl_can_enable_sagv(struct drm_atomic_state *state);
+int skl_enable_sagv(struct drm_i915_private *dev_priv);
+int skl_disable_sagv(struct drm_i915_private *dev_priv);
 uint32_t ilk_pipe_pixel_rate(const struct intel_crtc_state *pipe_config);
 bool ilk_disable_lp_wm(struct drm_device *dev);
 int sanitize_rc6_option(struct drm_i915_private *dev_priv, int enable_rc6);
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index d5deb58a2128..53e13c10e4ea 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2852,6 +2852,7 @@ bool ilk_disable_lp_wm(struct drm_device *dev)
 
 #define SKL_DDB_SIZE            896     /* in blocks */
 #define BXT_DDB_SIZE            512
+#define SKL_SAGV_BLOCK_TIME     30 /* µs */
 
 /*
  * Return the index of a plane in the SKL DDB and wm result arrays.  Primary
@@ -2875,6 +2876,153 @@ skl_wm_plane_id(const struct intel_plane *plane)
         }
 }
 
+/*
+ * SAGV dynamically adjusts the system agent voltage and clock frequencies
+ * depending on power and performance requirements. The display engine access
+ * to system memory is blocked during the adjustment time. Because of the
+ * blocking time, having this enabled can cause full system hangs and/or pipe
+ * underruns if we don't meet all of the following requirements:
+ *
+ *  - <= 1 pipe enabled
+ *  - All planes can enable watermarks for latencies >= SAGV engine block time
+ *  - We're not using an interlaced display configuration
+ */
+int
+skl_enable_sagv(struct drm_i915_private *dev_priv)
+{
+        int ret;
+
+        if (dev_priv->skl_sagv_status == I915_SKL_SAGV_NOT_CONTROLLED ||
+            dev_priv->skl_sagv_status == I915_SKL_SAGV_ENABLED)
+                return 0;
+
+        DRM_DEBUG_KMS("Enabling the SAGV\n");
+        mutex_lock(&dev_priv->rps.hw_lock);
+
+        ret = sandybridge_pcode_write(dev_priv, GEN9_PCODE_SAGV_CONTROL,
+                                      GEN9_SAGV_ENABLE);
+
+        /* We don't need to wait for the SAGV when enabling */
+        mutex_unlock(&dev_priv->rps.hw_lock);
+
+        /*
+         * Some skl systems, pre-release machines in particular,
+         * don't actually have an SAGV.
+         */
+        if (ret == -ENXIO) {
+                DRM_DEBUG_DRIVER("No SAGV found on system, ignoring\n");
+                dev_priv->skl_sagv_status = I915_SKL_SAGV_NOT_CONTROLLED;
+                return 0;
+        } else if (ret < 0) {
+                DRM_ERROR("Failed to enable the SAGV\n");
+                return ret;
+        }
+
+        dev_priv->skl_sagv_status = I915_SKL_SAGV_ENABLED;
+        return 0;
+}
+
+static int
+skl_do_sagv_disable(struct drm_i915_private *dev_priv)
+{
+        int ret;
+        uint32_t temp = GEN9_SAGV_DISABLE;
+
+        ret = sandybridge_pcode_read(dev_priv, GEN9_PCODE_SAGV_CONTROL,
+                                     &temp);
+        if (ret)
+                return ret;
+        else
+                return temp & GEN9_SAGV_IS_DISABLED;
+}
+
+int
+skl_disable_sagv(struct drm_i915_private *dev_priv)
+{
+        int ret, result;
+
+        if (dev_priv->skl_sagv_status == I915_SKL_SAGV_NOT_CONTROLLED ||
+            dev_priv->skl_sagv_status == I915_SKL_SAGV_DISABLED)
+                return 0;
+
+        DRM_DEBUG_KMS("Disabling the SAGV\n");
+        mutex_lock(&dev_priv->rps.hw_lock);
+
+        /* bspec says to keep retrying for at least 1 ms */
+        ret = wait_for(result = skl_do_sagv_disable(dev_priv), 1);
+        mutex_unlock(&dev_priv->rps.hw_lock);
+
+        if (ret == -ETIMEDOUT) {
+                DRM_ERROR("Request to disable SAGV timed out\n");
+                return -ETIMEDOUT;
+        }
+
+        /*
+         * Some skl systems, pre-release machines in particular,
+         * don't actually have an SAGV.
+         */
+        if (result == -ENXIO) {
+                DRM_DEBUG_DRIVER("No SAGV found on system, ignoring\n");
+                dev_priv->skl_sagv_status = I915_SKL_SAGV_NOT_CONTROLLED;
+                return 0;
+        } else if (result < 0) {
+                DRM_ERROR("Failed to disable the SAGV\n");
+                return result;
+        }
+
+        dev_priv->skl_sagv_status = I915_SKL_SAGV_DISABLED;
+        return 0;
+}
+
+bool skl_can_enable_sagv(struct drm_atomic_state *state)
+{
+        struct drm_device *dev = state->dev;
+        struct drm_i915_private *dev_priv = to_i915(dev);
+        struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
+        struct drm_crtc *crtc;
+        enum pipe pipe;
+        int level, plane;
+
+        /*
+         * SKL workaround: bspec recommends we disable the SAGV when we have
+         * more then one pipe enabled
+         *
+         * If there are no active CRTCs, no additional checks need be performed
+         */
+        if (hweight32(intel_state->active_crtcs) == 0)
+                return true;
+        else if (hweight32(intel_state->active_crtcs) > 1)
+                return false;
+
+        /* Since we're now guaranteed to only have one active CRTC... */
+        pipe = ffs(intel_state->active_crtcs) - 1;
+        crtc = dev_priv->pipe_to_crtc_mapping[pipe];
+
+        if (crtc->state->mode.flags & DRM_MODE_FLAG_INTERLACE)
+                return false;
+
+        for_each_plane(dev_priv, pipe, plane) {
+                /* Skip this plane if it's not enabled */
+                if (intel_state->wm_results.plane[pipe][plane][0] == 0)
+                        continue;
+
+                /* Find the highest enabled wm level for this plane */
+                for (level = ilk_wm_max_level(dev);
+                     intel_state->wm_results.plane[pipe][plane][level] == 0; --level)
+                     { }
+
+                /*
+                 * If any of the planes on this pipe don't enable wm levels
+                 * that incur memory latencies higher then 30µs we can't enable
+                 * the SAGV
+                 */
+                if (dev_priv->wm.skl_latency[level] < SKL_SAGV_BLOCK_TIME)
+                        return false;
+        }
+
+        return true;
+}
+
 static void
 skl_ddb_get_pipe_allocation_limits(struct drm_device *dev,
                                    const struct intel_crtc_state *cstate,
@@ -3107,8 +3255,6 @@ skl_get_total_relative_data_rate(struct intel_crtc_state *intel_cstate)
                 total_data_rate += intel_cstate->wm.skl.plane_y_data_rate[id];
         }
 
-        WARN_ON(cstate->plane_mask && total_data_rate == 0);
-
         return total_data_rate;
 }
 
@@ -3912,9 +4058,24 @@ skl_compute_ddb(struct drm_atomic_state *state)
          * pretend that all pipes switched active status so that we'll
          * ensure a full DDB recompute.
          */
-        if (dev_priv->wm.distrust_bios_wm)
+        if (dev_priv->wm.distrust_bios_wm) {
+                ret = drm_modeset_lock(&dev->mode_config.connection_mutex,
+                                       state->acquire_ctx);
+                if (ret)
+                        return ret;
+
                 intel_state->active_pipe_changes = ~0;
 
+                /*
+                 * We usually only initialize intel_state->active_crtcs if we
+                 * we're doing a modeset; make sure this field is always
+                 * initialized during the sanitization process that happens
+                 * on the first commit too.
+                 */
+                if (!intel_state->modeset)
+                        intel_state->active_crtcs = dev_priv->active_crtcs;
+        }
+
         /*
          * If the modeset changes which CRTC's are active, we need to
          * recompute the DDB allocation for *all* active pipes, even
@@ -3943,11 +4104,33 @@ skl_compute_ddb(struct drm_atomic_state *state)
                 ret = skl_allocate_pipe_ddb(cstate, ddb);
                 if (ret)
                         return ret;
+
+                ret = drm_atomic_add_affected_planes(state, &intel_crtc->base);
+                if (ret)
+                        return ret;
         }
 
         return 0;
 }
 
+static void
+skl_copy_wm_for_pipe(struct skl_wm_values *dst,
+                     struct skl_wm_values *src,
+                     enum pipe pipe)
+{
+        dst->wm_linetime[pipe] = src->wm_linetime[pipe];
+        memcpy(dst->plane[pipe], src->plane[pipe],
+               sizeof(dst->plane[pipe]));
+        memcpy(dst->plane_trans[pipe], src->plane_trans[pipe],
+               sizeof(dst->plane_trans[pipe]));
+
+        dst->ddb.pipe[pipe] = src->ddb.pipe[pipe];
+        memcpy(dst->ddb.y_plane[pipe], src->ddb.y_plane[pipe],
+               sizeof(dst->ddb.y_plane[pipe]));
+        memcpy(dst->ddb.plane[pipe], src->ddb.plane[pipe],
+               sizeof(dst->ddb.plane[pipe]));
+}
+
 static int
 skl_compute_wm(struct drm_atomic_state *state)
 {
@@ -4020,8 +4203,10 @@ static void skl_update_wm(struct drm_crtc *crtc)
         struct drm_device *dev = crtc->dev;
         struct drm_i915_private *dev_priv = to_i915(dev);
         struct skl_wm_values *results = &dev_priv->wm.skl_results;
+        struct skl_wm_values *hw_vals = &dev_priv->wm.skl_hw;
         struct intel_crtc_state *cstate = to_intel_crtc_state(crtc->state);
         struct skl_pipe_wm *pipe_wm = &cstate->wm.skl.optimal;
+        int pipe;
 
         if ((results->dirty_pipes & drm_crtc_mask(crtc)) == 0)
                 return;
@@ -4033,8 +4218,12 @@ static void skl_update_wm(struct drm_crtc *crtc)
         skl_write_wm_values(dev_priv, results);
         skl_flush_wm_values(dev_priv, results);
 
-        /* store the new configuration */
-        dev_priv->wm.skl_hw = *results;
+        /*
+         * Store the new configuration (but only for the pipes that have
+         * changed; the other values weren't recomputed).
+         */
+        for_each_pipe_masked(dev_priv, pipe, results->dirty_pipes)
+                skl_copy_wm_for_pipe(hw_vals, results, pipe);
 
         mutex_unlock(&dev_priv->wm.wm_mutex);
 }
@@ -7658,8 +7847,53 @@ void intel_init_pm(struct drm_device *dev)
         }
 }
 
+static inline int gen6_check_mailbox_status(struct drm_i915_private *dev_priv)
+{
+        uint32_t flags =
+                I915_READ_FW(GEN6_PCODE_MAILBOX) & GEN6_PCODE_ERROR_MASK;
+
+        switch (flags) {
+        case GEN6_PCODE_SUCCESS:
+                return 0;
+        case GEN6_PCODE_UNIMPLEMENTED_CMD:
+        case GEN6_PCODE_ILLEGAL_CMD:
+                return -ENXIO;
+        case GEN6_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE:
+                return -EOVERFLOW;
+        case GEN6_PCODE_TIMEOUT:
+                return -ETIMEDOUT;
+        default:
+                MISSING_CASE(flags)
+                return 0;
+        }
+}
+
+static inline int gen7_check_mailbox_status(struct drm_i915_private *dev_priv)
+{
+        uint32_t flags =
+                I915_READ_FW(GEN6_PCODE_MAILBOX) & GEN6_PCODE_ERROR_MASK;
+
+        switch (flags) {
+        case GEN6_PCODE_SUCCESS:
+                return 0;
+        case GEN6_PCODE_ILLEGAL_CMD:
+                return -ENXIO;
+        case GEN7_PCODE_TIMEOUT:
+                return -ETIMEDOUT;
+        case GEN7_PCODE_ILLEGAL_DATA:
+                return -EINVAL;
+        case GEN7_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE:
+                return -EOVERFLOW;
+        default:
+                MISSING_CASE(flags);
+                return 0;
+        }
+}
+
 int sandybridge_pcode_read(struct drm_i915_private *dev_priv, u32 mbox, u32 *val)
 {
+        int status;
+
         WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
 
         /* GEN6_PCODE_* are outside of the forcewake domain, we can
@@ -7686,12 +7920,25 @@ int sandybridge_pcode_read(struct drm_i915_private *dev_priv, u32 mbox, u32 *val
         *val = I915_READ_FW(GEN6_PCODE_DATA);
         I915_WRITE_FW(GEN6_PCODE_DATA, 0);
 
+        if (INTEL_GEN(dev_priv) > 6)
+                status = gen7_check_mailbox_status(dev_priv);
+        else
+                status = gen6_check_mailbox_status(dev_priv);
+
+        if (status) {
+                DRM_DEBUG_DRIVER("warning: pcode (read) mailbox access failed: %d\n",
+                                 status);
+                return status;
+        }
+
         return 0;
 }
 
 int sandybridge_pcode_write(struct drm_i915_private *dev_priv,
-                               u32 mbox, u32 val)
+                            u32 mbox, u32 val)
 {
+        int status;
+
         WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
 
         /* GEN6_PCODE_* are outside of the forcewake domain, we can
@@ -7716,6 +7963,17 @@ int sandybridge_pcode_write(struct drm_i915_private *dev_priv,
 
         I915_WRITE_FW(GEN6_PCODE_DATA, 0);
 
+        if (INTEL_GEN(dev_priv) > 6)
+                status = gen7_check_mailbox_status(dev_priv);
+        else
+                status = gen6_check_mailbox_status(dev_priv);
+
+        if (status) {
+                DRM_DEBUG_DRIVER("warning: pcode (write) mailbox access failed: %d\n",
+                                 status);
+                return status;
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c
index 9f7dafce3a4c..7bf90e9e6139 100644
--- a/drivers/gpu/drm/imx/imx-drm-core.c
+++ b/drivers/gpu/drm/imx/imx-drm-core.c
@@ -171,10 +171,34 @@ static void imx_drm_output_poll_changed(struct drm_device *drm)
         drm_fbdev_cma_hotplug_event(imxdrm->fbhelper);
 }
 
+static int imx_drm_atomic_check(struct drm_device *dev,
+                                struct drm_atomic_state *state)
+{
+        int ret;
+
+        ret = drm_atomic_helper_check_modeset(dev, state);
+        if (ret)
+                return ret;
+
+        ret = drm_atomic_helper_check_planes(dev, state);
+        if (ret)
+                return ret;
+
+        /*
+         * Check modeset again in case crtc_state->mode_changed is
+         * updated in plane's ->atomic_check callback.
+         */
+        ret = drm_atomic_helper_check_modeset(dev, state);
+        if (ret)
+                return ret;
+
+        return ret;
+}
+
 static const struct drm_mode_config_funcs imx_drm_mode_config_funcs = {
         .fb_create = drm_fb_cma_create,
         .output_poll_changed = imx_drm_output_poll_changed,
-        .atomic_check = drm_atomic_helper_check,
+        .atomic_check = imx_drm_atomic_check,
         .atomic_commit = drm_atomic_helper_commit,
 };
 
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index 08e188bc10fc..462056e4b9e4 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -76,6 +76,8 @@ static void ipu_crtc_disable(struct drm_crtc *crtc)
                 crtc->state->event = NULL;
         }
         spin_unlock_irq(&crtc->dev->event_lock);
+
+        drm_crtc_vblank_off(crtc);
 }
 
 static void imx_drm_crtc_reset(struct drm_crtc *crtc)
@@ -175,6 +177,8 @@ static int ipu_crtc_atomic_check(struct drm_crtc *crtc,
 static void ipu_crtc_atomic_begin(struct drm_crtc *crtc,
                                   struct drm_crtc_state *old_crtc_state)
 {
+        drm_crtc_vblank_on(crtc);
+
         spin_lock_irq(&crtc->dev->event_lock);
         if (crtc->state->event) {
                 WARN_ON(drm_crtc_vblank_get(crtc));
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index 4ad67d015ec7..29423e757d36 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -319,13 +319,14 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
                 return -EINVAL;
 
         /*
-         * since we cannot touch active IDMAC channels, we do not support
-         * resizing the enabled plane or changing its format
+         * We support resizing active plane or changing its format by
+         * forcing CRTC mode change and disabling-enabling plane in plane's
+         * ->atomic_update callback.
          */
         if (old_fb && (state->src_w != old_state->src_w ||
                               state->src_h != old_state->src_h ||
                               fb->pixel_format != old_fb->pixel_format))
-                return -EINVAL;
+                crtc_state->mode_changed = true;
 
         eba = drm_plane_state_to_eba(state);
 
@@ -336,7 +337,7 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
                 return -EINVAL;
 
         if (old_fb && fb->pitches[0] != old_fb->pitches[0])
-                return -EINVAL;
+                crtc_state->mode_changed = true;
 
         switch (fb->pixel_format) {
         case DRM_FORMAT_YUV420:
@@ -372,7 +373,7 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
                         return -EINVAL;
 
                 if (old_fb && old_fb->pitches[1] != fb->pitches[1])
-                        return -EINVAL;
+                        crtc_state->mode_changed = true;
         }
 
         return 0;
@@ -392,8 +393,14 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
         enum ipu_color_space ics;
 
         if (old_state->fb) {
-                ipu_plane_atomic_set_base(ipu_plane, old_state);
-                return;
+                struct drm_crtc_state *crtc_state = state->crtc->state;
+
+                if (!crtc_state->mode_changed) {
+                        ipu_plane_atomic_set_base(ipu_plane, old_state);
+                        return;
+                }
+
+                ipu_disable_plane(plane);
         }
 
         switch (ipu_plane->dp_flow) {
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index b4bc7f1ef717..d0da52f2a806 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -157,6 +157,12 @@ struct msm_drm_private {
         struct shrinker shrinker;
 
         struct msm_vblank_ctrl vblank_ctrl;
+
+        /* task holding struct_mutex.. currently only used in submit path
+         * to detect and reject faults from copy_from_user() for submit
+         * ioctl.
+         */
+        struct task_struct *struct_mutex_task;
 };
 
 struct msm_format {
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 6cd4af443139..85f3047e05ae 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -196,11 +196,20 @@ int msm_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
         struct drm_gem_object *obj = vma->vm_private_data;
         struct drm_device *dev = obj->dev;
+        struct msm_drm_private *priv = dev->dev_private;
         struct page **pages;
         unsigned long pfn;
         pgoff_t pgoff;
         int ret;
 
+        /* This should only happen if userspace tries to pass a mmap'd
+         * but unfaulted gem bo vaddr into submit ioctl, triggering
+         * a page fault while struct_mutex is already held.  This is
+         * not a valid use-case so just bail.
+         */
+        if (priv->struct_mutex_task == current)
+                return VM_FAULT_SIGBUS;
+
         /* Make sure we don't parallel update on a fault, nor move or remove
          * something from beneath our feet
          */
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 9766f9ae4b7d..880d6a9af7c8 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -64,6 +64,14 @@ void msm_gem_submit_free(struct msm_gem_submit *submit)
         kfree(submit);
 }
 
+static inline unsigned long __must_check
+copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
+{
+        if (access_ok(VERIFY_READ, from, n))
+                return __copy_from_user_inatomic(to, from, n);
+        return -EFAULT;
+}
+
 static int submit_lookup_objects(struct msm_gem_submit *submit,
                 struct drm_msm_gem_submit *args, struct drm_file *file)
 {
@@ -71,6 +79,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
         int ret = 0;
 
         spin_lock(&file->table_lock);
+        pagefault_disable();
 
         for (i = 0; i < args->nr_bos; i++) {
                 struct drm_msm_gem_submit_bo submit_bo;
@@ -84,10 +93,15 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
                  */
                 submit->bos[i].flags = 0;
 
-                ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
-                if (ret) {
-                        ret = -EFAULT;
-                        goto out_unlock;
+                ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo));
+                if (unlikely(ret)) {
+                        pagefault_enable();
+                        spin_unlock(&file->table_lock);
+                        ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
+                        if (ret)
+                                goto out;
+                        spin_lock(&file->table_lock);
+                        pagefault_disable();
                 }
 
                 if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
@@ -127,9 +141,12 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
         }
 
 out_unlock:
-        submit->nr_bos = i;
+        pagefault_enable();
         spin_unlock(&file->table_lock);
 
+out:
+        submit->nr_bos = i;
+
         return ret;
 }
 
@@ -377,6 +394,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
         if (ret)
                 return ret;
 
+        priv->struct_mutex_task = current;
+
         submit = submit_create(dev, gpu, args->nr_bos, args->nr_cmds);
         if (!submit) {
                 ret = -ENOMEM;
@@ -468,6 +487,7 @@ out:
         if (ret)
                 msm_gem_submit_free(submit);
 out_unlock:
+        priv->struct_mutex_task = NULL;
         mutex_unlock(&dev->struct_mutex);
         return ret;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index f2ad17aa33f0..dc57b628e074 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -225,6 +225,17 @@ static bool nouveau_pr3_present(struct pci_dev *pdev)
         if (!parent_pdev)
                 return false;
 
+        if (!parent_pdev->bridge_d3) {
+                /*
+                 * Parent PCI bridge is currently not power managed.
+                 * Since userspace can change these afterwards to be on
+                 * the safe side we stick with _DSM and prevent usage of
+                 * _PR3 from the bridge.
+                 */
+                pci_d3cold_disable(pdev);
+                return false;
+        }
+
         parent_adev = ACPI_COMPANION(&parent_pdev->dev);
         if (!parent_adev)
                 return false;
diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c
index df2657051afd..28c1423049c5 100644
--- a/drivers/gpu/drm/qxl/qxl_fb.c
+++ b/drivers/gpu/drm/qxl/qxl_fb.c
@@ -73,10 +73,12 @@ static void qxl_fb_image_init(struct qxl_fb_image *qxl_fb_image,
         }
 }
 
+#ifdef CONFIG_DRM_FBDEV_EMULATION
 static struct fb_deferred_io qxl_defio = {
         .delay          = QXL_DIRTY_DELAY,
         .deferred_io    = drm_fb_helper_deferred_io,
 };
+#endif
 
 static struct fb_ops qxlfb_ops = {
         .owner = THIS_MODULE,
@@ -313,8 +315,10 @@ static int qxlfb_create(struct qxl_fbdev *qfbdev,
                 goto out_destroy_fbi;
         }
 
+#ifdef CONFIG_DRM_FBDEV_EMULATION
         info->fbdefio = &qxl_defio;
         fb_deferred_io_init(info);
+#endif
 
         qdev->fbdev_info = info;
         qdev->fbdev_qfb = &qfbdev->qfb;
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index a97abc8af657..1dcf39084555 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -627,7 +627,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                         if (radeon_crtc->ss.refdiv) {
                                 radeon_crtc->pll_flags |= RADEON_PLL_USE_REF_DIV;
                                 radeon_crtc->pll_reference_div = radeon_crtc->ss.refdiv;
-                                if (rdev->family >= CHIP_RV770)
+                                if (ASIC_IS_AVIVO(rdev) &&
+                                    rdev->family != CHIP_RS780 &&
+                                    rdev->family != CHIP_RS880)
                                         radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
                         }
                 }
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 0c00e192c845..c2e0a1ccdfbc 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -263,8 +263,8 @@ static int radeon_move_blit(struct ttm_buffer_object *bo,
 
         rdev = radeon_get_rdev(bo->bdev);
         ridx = radeon_copy_ring_index(rdev);
-        old_start = old_mem->start << PAGE_SHIFT;
-        new_start = new_mem->start << PAGE_SHIFT;
+        old_start = (u64)old_mem->start << PAGE_SHIFT;
+        new_start = (u64)new_mem->start << PAGE_SHIFT;
 
         switch (old_mem->mem_type) {
         case TTM_PL_VRAM:
diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
index 3d228ad90e0f..3dea1216bafd 100644
--- a/drivers/gpu/drm/tegra/dsi.c
+++ b/drivers/gpu/drm/tegra/dsi.c
@@ -840,6 +840,21 @@ static const struct drm_encoder_funcs tegra_dsi_encoder_funcs = {
         .destroy = tegra_output_encoder_destroy,
 };
 
+static void tegra_dsi_unprepare(struct tegra_dsi *dsi)
+{
+        int err;
+
+        if (dsi->slave)
+                tegra_dsi_unprepare(dsi->slave);
+
+        err = tegra_mipi_disable(dsi->mipi);
+        if (err < 0)
+                dev_err(dsi->dev, "failed to disable MIPI calibration: %d\n",
+                        err);
+
+        pm_runtime_put(dsi->dev);
+}
+
 static void tegra_dsi_encoder_disable(struct drm_encoder *encoder)
 {
         struct tegra_output *output = encoder_to_output(encoder);
@@ -876,7 +891,26 @@ static void tegra_dsi_encoder_disable(struct drm_encoder *encoder)
 
         tegra_dsi_disable(dsi);
 
-        pm_runtime_put(dsi->dev);
+        tegra_dsi_unprepare(dsi);
+}
+
+static void tegra_dsi_prepare(struct tegra_dsi *dsi)
+{
+        int err;
+
+        pm_runtime_get_sync(dsi->dev);
+
+        err = tegra_mipi_enable(dsi->mipi);
+        if (err < 0)
+                dev_err(dsi->dev, "failed to enable MIPI calibration: %d\n",
+                        err);
+
+        err = tegra_dsi_pad_calibrate(dsi);
+        if (err < 0)
+                dev_err(dsi->dev, "MIPI calibration failed: %d\n", err);
+
+        if (dsi->slave)
+                tegra_dsi_prepare(dsi->slave);
 }
 
 static void tegra_dsi_encoder_enable(struct drm_encoder *encoder)
@@ -887,13 +921,8 @@ static void tegra_dsi_encoder_enable(struct drm_encoder *encoder)
         struct tegra_dsi *dsi = to_dsi(output);
         struct tegra_dsi_state *state;
         u32 value;
-        int err;
-
-        pm_runtime_get_sync(dsi->dev);
 
-        err = tegra_dsi_pad_calibrate(dsi);
-        if (err < 0)
-                dev_err(dsi->dev, "MIPI calibration failed: %d\n", err);
+        tegra_dsi_prepare(dsi);
 
         state = tegra_dsi_get_state(dsi);
 
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index d5df555aeba0..9688bfa92ccd 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -203,6 +203,7 @@ static int udl_fb_open(struct fb_info *info, int user)
 
         ufbdev->fb_count++;
 
+#ifdef CONFIG_DRM_FBDEV_EMULATION
         if (fb_defio && (info->fbdefio == NULL)) {
                 /* enable defio at last moment if not disabled by client */
 
@@ -218,6 +219,7 @@ static int udl_fb_open(struct fb_info *info, int user)
                 info->fbdefio = fbdefio;
                 fb_deferred_io_init(info);
         }
+#endif
 
         pr_notice("open /dev/fb%d user=%d fb_info=%p count=%d\n",
                   info->node, user, info, ufbdev->fb_count);
@@ -235,12 +237,14 @@ static int udl_fb_release(struct fb_info *info, int user)
 
         ufbdev->fb_count--;
 
+#ifdef CONFIG_DRM_FBDEV_EMULATION
         if ((ufbdev->fb_count == 0) && (info->fbdefio)) {
                 fb_deferred_io_cleanup(info);
                 kfree(info->fbdefio);
                 info->fbdefio = NULL;
                 info->fbops->fb_mmap = udl_fb_mmap;
         }
+#endif
 
         pr_warn("released /dev/fb%d user=%d count=%d\n",
                 info->node, user, ufbdev->fb_count);
diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 8b42d31a7f0e..9ecef9385491 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -57,21 +57,21 @@ static int vc4_get_param_ioctl(struct drm_device *dev, void *data,
         switch (args->param) {
         case DRM_VC4_PARAM_V3D_IDENT0:
                 ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
-                if (ret)
+                if (ret < 0)
                         return ret;
                 args->value = V3D_READ(V3D_IDENT0);
                 pm_runtime_put(&vc4->v3d->pdev->dev);
                 break;
         case DRM_VC4_PARAM_V3D_IDENT1:
                 ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
-                if (ret)
+                if (ret < 0)
                         return ret;
                 args->value = V3D_READ(V3D_IDENT1);
                 pm_runtime_put(&vc4->v3d->pdev->dev);
                 break;
         case DRM_VC4_PARAM_V3D_IDENT2:
                 ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
-                if (ret)
+                if (ret < 0)
                         return ret;
                 args->value = V3D_READ(V3D_IDENT2);
                 pm_runtime_put(&vc4->v3d->pdev->dev);
diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
index 489e3de0c050..428e24919ef1 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.h
+++ b/drivers/gpu/drm/vc4/vc4_drv.h
@@ -321,6 +321,15 @@ vc4_first_render_job(struct vc4_dev *vc4)
                                 struct vc4_exec_info, head);
 }
 
+static inline struct vc4_exec_info *
+vc4_last_render_job(struct vc4_dev *vc4)
+{
+        if (list_empty(&vc4->render_job_list))
+                return NULL;
+        return list_last_entry(&vc4->render_job_list,
+                               struct vc4_exec_info, head);
+}
+
 /**
  * struct vc4_texture_sample_info - saves the offsets into the UBO for texture
  * setup parameters.
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 6155e8aca1c6..b262c5c26f10 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -534,8 +534,8 @@ vc4_cl_lookup_bos(struct drm_device *dev,
                 return -EINVAL;
         }
 
-        exec->bo = kcalloc(exec->bo_count, sizeof(struct drm_gem_cma_object *),
-                           GFP_KERNEL);
+        exec->bo = drm_calloc_large(exec->bo_count,
+                                    sizeof(struct drm_gem_cma_object *));
         if (!exec->bo) {
                 DRM_ERROR("Failed to allocate validated BO pointers\n");
                 return -ENOMEM;
@@ -572,8 +572,8 @@ vc4_cl_lookup_bos(struct drm_device *dev,
         spin_unlock(&file_priv->table_lock);
 
 fail:
-        kfree(handles);
-        return 0;
+        drm_free_large(handles);
+        return ret;
 }
 
 static int
@@ -608,7 +608,7 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
          * read the contents back for validation, and I think the
          * bo->vaddr is uncached access.
          */
-        temp = kmalloc(temp_size, GFP_KERNEL);
+        temp = drm_malloc_ab(temp_size, 1);
         if (!temp) {
                 DRM_ERROR("Failed to allocate storage for copying "
                           "in bin/render CLs.\n");
@@ -675,7 +675,7 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
         ret = vc4_validate_shader_recs(dev, exec);
 
 fail:
-        kfree(temp);
+        drm_free_large(temp);
         return ret;
 }
 
@@ -688,7 +688,7 @@ vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
         if (exec->bo) {
                 for (i = 0; i < exec->bo_count; i++)
                         drm_gem_object_unreference_unlocked(&exec->bo[i]->base);
-                kfree(exec->bo);
+                drm_free_large(exec->bo);
         }
 
         while (!list_empty(&exec->unref_list)) {
@@ -942,8 +942,8 @@ vc4_gem_destroy(struct drm_device *dev)
                 vc4->overflow_mem = NULL;
         }
 
-        vc4_bo_cache_destroy(dev);
-
         if (vc4->hang_state)
                 vc4_free_hang_state(dev, vc4->hang_state);
+
+        vc4_bo_cache_destroy(dev);
 }
diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
index b0104a346a74..094bc6a475c1 100644
--- a/drivers/gpu/drm/vc4/vc4_irq.c
+++ b/drivers/gpu/drm/vc4/vc4_irq.c
@@ -83,8 +83,10 @@ vc4_overflow_mem_work(struct work_struct *work)
 
                 spin_lock_irqsave(&vc4->job_lock, irqflags);
                 current_exec = vc4_first_bin_job(vc4);
+                if (!current_exec)
+                        current_exec = vc4_last_render_job(vc4);
                 if (current_exec) {
-                        vc4->overflow_mem->seqno = vc4->finished_seqno + 1;
+                        vc4->overflow_mem->seqno = current_exec->seqno;
                         list_add_tail(&vc4->overflow_mem->unref_head,
                                       &current_exec->unref_list);
                         vc4->overflow_mem = NULL;
diff --git a/drivers/gpu/host1x/mipi.c b/drivers/gpu/host1x/mipi.c
index 52a6fd224127..e00809d996a2 100644
--- a/drivers/gpu/host1x/mipi.c
+++ b/drivers/gpu/host1x/mipi.c
@@ -242,20 +242,6 @@ struct tegra_mipi_device *tegra_mipi_request(struct device *device)
         dev->pads = args.args[0];
         dev->device = device;
 
-        mutex_lock(&dev->mipi->lock);
-
-        if (dev->mipi->usage_count++ == 0) {
-                err = tegra_mipi_power_up(dev->mipi);
-                if (err < 0) {
-                        dev_err(dev->mipi->dev,
-                                "failed to power up MIPI bricks: %d\n",
-                                err);
-                        return ERR_PTR(err);
-                }
-        }
-
-        mutex_unlock(&dev->mipi->lock);
-
         return dev;
 
 put:
@@ -270,29 +256,42 @@ EXPORT_SYMBOL(tegra_mipi_request);
 
 void tegra_mipi_free(struct tegra_mipi_device *device)
 {
-        int err;
+        platform_device_put(device->pdev);
+        kfree(device);
+}
+EXPORT_SYMBOL(tegra_mipi_free);
 
-        mutex_lock(&device->mipi->lock);
+int tegra_mipi_enable(struct tegra_mipi_device *dev)
+{
+        int err = 0;
 
-        if (--device->mipi->usage_count == 0) {
-                err = tegra_mipi_power_down(device->mipi);
-                if (err < 0) {
-                        /*
-                         * Not much that can be done here, so an error message
-                         * will have to do.
-                         */
-                        dev_err(device->mipi->dev,
-                                "failed to power down MIPI bricks: %d\n",
-                                err);
-                }
-        }
+        mutex_lock(&dev->mipi->lock);
 
-        mutex_unlock(&device->mipi->lock);
+        if (dev->mipi->usage_count++ == 0)
+                err = tegra_mipi_power_up(dev->mipi);
+
+        mutex_unlock(&dev->mipi->lock);
+
+        return err;
 
-        platform_device_put(device->pdev);
-        kfree(device);
 }
-EXPORT_SYMBOL(tegra_mipi_free);
+EXPORT_SYMBOL(tegra_mipi_enable);
+
+int tegra_mipi_disable(struct tegra_mipi_device *dev)
+{
+        int err = 0;
+
+        mutex_lock(&dev->mipi->lock);
+
+        if (--dev->mipi->usage_count == 0)
+                err = tegra_mipi_power_down(dev->mipi);
+
+        mutex_unlock(&dev->mipi->lock);
+
+        return err;
+
+}
+EXPORT_SYMBOL(tegra_mipi_disable);
 
 static int tegra_mipi_wait(struct tegra_mipi *mipi)
 {
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index d0203a115eff..4667012b46b7 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -2015,6 +2015,7 @@ static struct attribute *it87_attributes_in[] = {
         &sensor_dev_attr_in10_input.dev_attr.attr,      /* 41 */
         &sensor_dev_attr_in11_input.dev_attr.attr,      /* 41 */
         &sensor_dev_attr_in12_input.dev_attr.attr,      /* 41 */
+        NULL
 };
 
 static const struct attribute_group it87_group_in = {
diff --git a/drivers/i2c/busses/i2c-bcm-kona.c b/drivers/i2c/busses/i2c-bcm-kona.c
index f98743277e3c..258cb9a40ab3 100644
--- a/drivers/i2c/busses/i2c-bcm-kona.c
+++ b/drivers/i2c/busses/i2c-bcm-kona.c
@@ -643,7 +643,7 @@ static int bcm_kona_i2c_xfer(struct i2c_adapter *adapter,
                         if (rc < 0) {
                                 dev_err(dev->device,
                                         "restart cmd failed rc = %d\n", rc);
-                                        goto xfer_send_stop;
+                                goto xfer_send_stop;
                         }
                 }
 
diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index 90bbd9f9dd8f..3c16a2f7c673 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -767,7 +767,7 @@ static int cdns_i2c_setclk(unsigned long clk_in, struct cdns_i2c *id)
  * depending on the scaling direction.
  *
  * Return:      NOTIFY_STOP if the rate change should be aborted, NOTIFY_OK
- *              to acknowedge the change, NOTIFY_DONE if the notification is
+ *              to acknowledge the change, NOTIFY_DONE if the notification is
  *              considered irrelevant.
  */
 static int cdns_i2c_clk_notifier_cb(struct notifier_block *nb, unsigned long
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index c6922b806fb7..fcd973d5131e 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -367,13 +367,17 @@ int i2c_dw_init(struct dw_i2c_dev *dev)
         dev_dbg(dev->dev, "Fast-mode HCNT:LCNT = %d:%d\n", hcnt, lcnt);
 
         /* Configure SDA Hold Time if required */
-        if (dev->sda_hold_time) {
-                reg = dw_readl(dev, DW_IC_COMP_VERSION);
-                if (reg >= DW_IC_SDA_HOLD_MIN_VERS)
+        reg = dw_readl(dev, DW_IC_COMP_VERSION);
+        if (reg >= DW_IC_SDA_HOLD_MIN_VERS) {
+                if (dev->sda_hold_time) {
                         dw_writel(dev, dev->sda_hold_time, DW_IC_SDA_HOLD);
-                else
-                        dev_warn(dev->dev,
-                                "Hardware too old to adjust SDA hold time.");
+                } else {
+                        /* Keep previous hold time setting if no one set it */
+                        dev->sda_hold_time = dw_readl(dev, DW_IC_SDA_HOLD);
+                }
+        } else {
+                dev_warn(dev->dev,
+                        "Hardware too old to adjust SDA hold time.\n");
         }
 
         /* Configure Tx/Rx FIFO threshold levels */
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 52407f3c9e1c..9bd849dacee8 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -378,7 +378,7 @@ static void rcar_i2c_dma(struct rcar_i2c_priv *priv)
         }
 
         dma_addr = dma_map_single(chan->device->dev, buf, len, dir);
-        if (dma_mapping_error(dev, dma_addr)) {
+        if (dma_mapping_error(chan->device->dev, dma_addr)) {
                 dev_dbg(dev, "dma map failed, using PIO\n");
                 return;
         }
diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
index 2bc8b01153d6..5c5b7cada8be 100644
--- a/drivers/i2c/busses/i2c-rk3x.c
+++ b/drivers/i2c/busses/i2c-rk3x.c
@@ -918,7 +918,7 @@ static void rk3x_i2c_adapt_div(struct rk3x_i2c *i2c, unsigned long clk_rate)
  * Code adapted from i2c-cadence.c.
  *
  * Return:      NOTIFY_STOP if the rate change should be aborted, NOTIFY_OK
- *              to acknowedge the change, NOTIFY_DONE if the notification is
+ *              to acknowledge the change, NOTIFY_DONE if the notification is
  *              considered irrelevant.
  */
 static int rk3x_i2c_clk_notifier_cb(struct notifier_block *nb, unsigned long
@@ -1111,6 +1111,15 @@ static int rk3x_i2c_xfer(struct i2c_adapter *adap,
         return ret < 0 ? ret : num;
 }
 
+static __maybe_unused int rk3x_i2c_resume(struct device *dev)
+{
+        struct rk3x_i2c *i2c = dev_get_drvdata(dev);
+
+        rk3x_i2c_adapt_div(i2c, clk_get_rate(i2c->clk));
+
+        return 0;
+}
+
 static u32 rk3x_i2c_func(struct i2c_adapter *adap)
 {
         return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_PROTOCOL_MANGLING;
@@ -1334,12 +1343,15 @@ static int rk3x_i2c_remove(struct platform_device *pdev)
         return 0;
 }
 
+static SIMPLE_DEV_PM_OPS(rk3x_i2c_pm_ops, NULL, rk3x_i2c_resume);
+
 static struct platform_driver rk3x_i2c_driver = {
         .probe   = rk3x_i2c_probe,
         .remove  = rk3x_i2c_remove,
         .driver  = {
                 .name  = "rk3x-i2c",
                 .of_match_table = rk3x_i2c_match,
+                .pm = &rk3x_i2c_pm_ops,
         },
 };
 
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 6fb3e2645992..05b1eeab9cf5 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -610,7 +610,7 @@ static void sh_mobile_i2c_xfer_dma(struct sh_mobile_i2c_data *pd)
                 return;
 
         dma_addr = dma_map_single(chan->device->dev, pd->msg->buf, pd->msg->len, dir);
-        if (dma_mapping_error(pd->dev, dma_addr)) {
+        if (dma_mapping_error(chan->device->dev, dma_addr)) {
                 dev_dbg(pd->dev, "dma map failed, using PIO\n");
                 return;
         }
diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
index 215ac87f606d..b3893f6282ba 100644
--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
@@ -37,8 +37,6 @@ struct i2c_demux_pinctrl_priv {
         struct i2c_demux_pinctrl_chan chan[];
 };
 
-static struct property status_okay = { .name = "status", .length = 3, .value = "ok" };
-
 static int i2c_demux_master_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
 {
         struct i2c_demux_pinctrl_priv *priv = adap->algo_data;
@@ -107,6 +105,7 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
         of_changeset_revert(&priv->chan[new_chan].chgset);
  err:
         dev_err(priv->dev, "failed to setup demux-adapter %d (%d)\n", new_chan, ret);
+        priv->cur_chan = -EINVAL;
         return ret;
 }
 
@@ -192,6 +191,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
 {
         struct device_node *np = pdev->dev.of_node;
         struct i2c_demux_pinctrl_priv *priv;
+        struct property *props;
         int num_chan, i, j, err;
 
         num_chan = of_count_phandle_with_args(np, "i2c-parent", NULL);
@@ -202,7 +202,10 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
 
         priv = devm_kzalloc(&pdev->dev, sizeof(*priv)
                            + num_chan * sizeof(struct i2c_demux_pinctrl_chan), GFP_KERNEL);
-        if (!priv)
+
+        props = devm_kcalloc(&pdev->dev, num_chan, sizeof(*props), GFP_KERNEL);
+
+        if (!priv || !props)
                 return -ENOMEM;
 
         err = of_property_read_string(np, "i2c-bus-name", &priv->bus_name);
@@ -220,8 +223,12 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
                 }
                 priv->chan[i].parent_np = adap_np;
 
+                props[i].name = devm_kstrdup(&pdev->dev, "status", GFP_KERNEL);
+                props[i].value = devm_kstrdup(&pdev->dev, "ok", GFP_KERNEL);
+                props[i].length = 3;
+
                 of_changeset_init(&priv->chan[i].chgset);
-                of_changeset_update_property(&priv->chan[i].chgset, adap_np, &status_okay);
+                of_changeset_update_property(&priv->chan[i].chgset, adap_np, &props[i]);
         }
 
         priv->num_chan = num_chan;
diff --git a/drivers/iio/accel/Kconfig b/drivers/iio/accel/Kconfig
index 89d78208de3f..78f148ea9d9f 100644
--- a/drivers/iio/accel/Kconfig
+++ b/drivers/iio/accel/Kconfig
@@ -20,6 +20,8 @@ config BMA180
 config BMA220
     tristate "Bosch BMA220 3-Axis Accelerometer Driver"
         depends on SPI
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
     help
       Say yes here to add support for the Bosch BMA220 triaxial
       acceleration sensor.
@@ -234,7 +236,8 @@ config STK8312
 config STK8BA50
         tristate "Sensortek STK8BA50 3-Axis Accelerometer Driver"
         depends on I2C
-        depends on IIO_TRIGGER
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
           Say yes here to get support for the Sensortek STK8BA50 3-axis
           accelerometer.
diff --git a/drivers/iio/accel/bma220_spi.c b/drivers/iio/accel/bma220_spi.c
index 1098d10df8e8..5099f295dd37 100644
--- a/drivers/iio/accel/bma220_spi.c
+++ b/drivers/iio/accel/bma220_spi.c
@@ -253,7 +253,7 @@ static int bma220_probe(struct spi_device *spi)
         if (ret < 0)
                 return ret;
 
-        ret = iio_triggered_buffer_setup(indio_dev, NULL,
+        ret = iio_triggered_buffer_setup(indio_dev, iio_pollfunc_store_time,
                                          bma220_trigger_handler, NULL);
         if (ret < 0) {
                 dev_err(&spi->dev, "iio triggered buffer setup failed\n");
diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
index bf17aae66145..59b380dbf27f 100644
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -67,6 +67,9 @@
 #define BMC150_ACCEL_REG_PMU_BW         0x10
 #define BMC150_ACCEL_DEF_BW                     125
 
+#define BMC150_ACCEL_REG_RESET                  0x14
+#define BMC150_ACCEL_RESET_VAL                  0xB6
+
 #define BMC150_ACCEL_REG_INT_MAP_0              0x19
 #define BMC150_ACCEL_INT_MAP_0_BIT_SLOPE        BIT(2)
 
@@ -1497,6 +1500,14 @@ static int bmc150_accel_chip_init(struct bmc150_accel_data *data)
         int ret, i;
         unsigned int val;
 
+        /*
+         * Reset chip to get it in a known good state. A delay of 1.8ms after
+         * reset is required according to the data sheets of supported chips.
+         */
+        regmap_write(data->regmap, BMC150_ACCEL_REG_RESET,
+                     BMC150_ACCEL_RESET_VAL);
+        usleep_range(1800, 2500);
+
         ret = regmap_read(data->regmap, BMC150_ACCEL_REG_CHIP_ID, &val);
         if (ret < 0) {
                 dev_err(dev, "Error: Reading chip id\n");
diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index 3a9f106787d2..9d72d4bcf5e9 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -160,11 +160,13 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev,
                 if (ret < 0)
                         goto error_ret;
                 *val = ret;
+                ret = IIO_VAL_INT;
                 break;
         case IIO_CHAN_INFO_SCALE:
                 ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
                 if (ret < 0)
                         goto error_ret;
+                *val = 0;
                 *val2 = kxsd9_micro_scales[ret & KXSD9_FS_MASK];
                 ret = IIO_VAL_INT_PLUS_MICRO;
                 break;
diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index 1de31bdd4ce4..767577298ee3 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -389,6 +389,7 @@ config QCOM_SPMI_VADC
 config ROCKCHIP_SARADC
         tristate "Rockchip SARADC driver"
         depends on ARCH_ROCKCHIP || (ARM && COMPILE_TEST)
+        depends on RESET_CONTROLLER
         help
           Say yes here to build support for the SARADC found in SoCs from
           Rockchip.
diff --git a/drivers/iio/adc/ad799x.c b/drivers/iio/adc/ad799x.c
index b6163764489c..9704090b7908 100644
--- a/drivers/iio/adc/ad799x.c
+++ b/drivers/iio/adc/ad799x.c
@@ -527,6 +527,7 @@ static struct attribute_group ad799x_event_attrs_group = {
 static const struct iio_info ad7991_info = {
         .read_raw = &ad799x_read_raw,
         .driver_module = THIS_MODULE,
+        .update_scan_mode = ad799x_update_scan_mode,
 };
 
 static const struct iio_info ad7993_4_7_8_noirq_info = {
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 52430ba171f3..0438c68015e8 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -381,8 +381,8 @@ static irqreturn_t at91_adc_rl_interrupt(int irq, void *private)
                 st->ts_bufferedmeasure = false;
                 input_report_key(st->ts_input, BTN_TOUCH, 0);
                 input_sync(st->ts_input);
-        } else if (status & AT91_ADC_EOC(3)) {
-                /* Conversion finished */
+        } else if (status & AT91_ADC_EOC(3) && st->ts_input) {
+                /* Conversion finished and we've a touchscreen */
                 if (st->ts_bufferedmeasure) {
                         /*
                          * Last measurement is always discarded, since it can
diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c
index f9ad6c2d6821..85d701291654 100644
--- a/drivers/iio/adc/rockchip_saradc.c
+++ b/drivers/iio/adc/rockchip_saradc.c
@@ -21,6 +21,8 @@
 #include <linux/of_device.h>
 #include <linux/clk.h>
 #include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/reset.h>
 #include <linux/regulator/consumer.h>
 #include <linux/iio/iio.h>
 
@@ -53,6 +55,7 @@ struct rockchip_saradc {
         struct clk              *clk;
         struct completion       completion;
         struct regulator        *vref;
+        struct reset_control    *reset;
         const struct rockchip_saradc_data *data;
         u16                     last_val;
 };
@@ -190,6 +193,16 @@ static const struct of_device_id rockchip_saradc_match[] = {
 };
 MODULE_DEVICE_TABLE(of, rockchip_saradc_match);
 
+/**
+ * Reset SARADC Controller.
+ */
+static void rockchip_saradc_reset_controller(struct reset_control *reset)
+{
+        reset_control_assert(reset);
+        usleep_range(10, 20);
+        reset_control_deassert(reset);
+}
+
 static int rockchip_saradc_probe(struct platform_device *pdev)
 {
         struct rockchip_saradc *info = NULL;
@@ -218,6 +231,20 @@ static int rockchip_saradc_probe(struct platform_device *pdev)
         if (IS_ERR(info->regs))
                 return PTR_ERR(info->regs);
 
+        /*
+         * The reset should be an optional property, as it should work
+         * with old devicetrees as well
+         */
+        info->reset = devm_reset_control_get(&pdev->dev, "saradc-apb");
+        if (IS_ERR(info->reset)) {
+                ret = PTR_ERR(info->reset);
+                if (ret != -ENOENT)
+                        return ret;
+
+                dev_dbg(&pdev->dev, "no reset control found\n");
+                info->reset = NULL;
+        }
+
         init_completion(&info->completion);
 
         irq = platform_get_irq(pdev, 0);
@@ -252,6 +279,9 @@ static int rockchip_saradc_probe(struct platform_device *pdev)
                 return PTR_ERR(info->vref);
         }
 
+        if (info->reset)
+                rockchip_saradc_reset_controller(info->reset);
+
         /*
          * Use a default value for the converter clock.
          * This may become user-configurable in the future.
diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
index 1ef398770a1f..066abaf80201 100644
--- a/drivers/iio/adc/ti-ads1015.c
+++ b/drivers/iio/adc/ti-ads1015.c
@@ -489,7 +489,8 @@ static struct iio_info ads1115_info = {
 #ifdef CONFIG_OF
 static int ads1015_get_channels_config_of(struct i2c_client *client)
 {
-        struct ads1015_data *data = i2c_get_clientdata(client);
+        struct iio_dev *indio_dev = i2c_get_clientdata(client);
+        struct ads1015_data *data = iio_priv(indio_dev);
         struct device_node *node;
 
         if (!client->dev.of_node ||
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 8a368756881b..c3cfacca2541 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -32,6 +32,7 @@
 
 struct tiadc_device {
         struct ti_tscadc_dev *mfd_tscadc;
+        struct mutex fifo1_lock; /* to protect fifo access */
         int channels;
         u8 channel_line[8];
         u8 channel_step[8];
@@ -359,6 +360,7 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
                 int *val, int *val2, long mask)
 {
         struct tiadc_device *adc_dev = iio_priv(indio_dev);
+        int ret = IIO_VAL_INT;
         int i, map_val;
         unsigned int fifo1count, read, stepid;
         bool found = false;
@@ -372,13 +374,14 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
         if (!step_en)
                 return -EINVAL;
 
+        mutex_lock(&adc_dev->fifo1_lock);
         fifo1count = tiadc_readl(adc_dev, REG_FIFO1CNT);
         while (fifo1count--)
                 tiadc_readl(adc_dev, REG_FIFO1);
 
         am335x_tsc_se_set_once(adc_dev->mfd_tscadc, step_en);
 
-        timeout = jiffies + usecs_to_jiffies
+        timeout = jiffies + msecs_to_jiffies
                                 (IDLE_TIMEOUT * adc_dev->channels);
         /* Wait for Fifo threshold interrupt */
         while (1) {
@@ -388,7 +391,8 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
 
                 if (time_after(jiffies, timeout)) {
                         am335x_tsc_se_adc_done(adc_dev->mfd_tscadc);
-                        return -EAGAIN;
+                        ret = -EAGAIN;
+                        goto err_unlock;
                 }
         }
         map_val = adc_dev->channel_step[chan->scan_index];
@@ -414,8 +418,11 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
         am335x_tsc_se_adc_done(adc_dev->mfd_tscadc);
 
         if (found == false)
-                return -EBUSY;
-        return IIO_VAL_INT;
+                ret =  -EBUSY;
+
+err_unlock:
+        mutex_unlock(&adc_dev->fifo1_lock);
+        return ret;
 }
 
 static const struct iio_info tiadc_info = {
@@ -483,6 +490,7 @@ static int tiadc_probe(struct platform_device *pdev)
 
         tiadc_step_config(indio_dev);
         tiadc_writel(adc_dev, REG_FIFO1THR, FIFO1_THRESHOLD);
+        mutex_init(&adc_dev->fifo1_lock);
 
         err = tiadc_channel_init(indio_dev, adc_dev->channels);
         if (err < 0)
diff --git a/drivers/iio/chemical/atlas-ph-sensor.c b/drivers/iio/chemical/atlas-ph-sensor.c
index ae038a59d256..407f141a1eee 100644
--- a/drivers/iio/chemical/atlas-ph-sensor.c
+++ b/drivers/iio/chemical/atlas-ph-sensor.c
@@ -434,7 +434,7 @@ static int atlas_read_raw(struct iio_dev *indio_dev,
                         break;
                 case IIO_ELECTRICALCONDUCTIVITY:
                         *val = 1; /* 0.00001 */
-                        *val = 100000;
+                        *val2 = 100000;
                         break;
                 case IIO_CONCENTRATION:
                         *val = 0; /* 0.000000001 */
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
index e81f434760f4..dc33c1dd5191 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
@@ -56,8 +56,8 @@ static struct {
         {HID_USAGE_SENSOR_ALS, 0, 1, 0},
         {HID_USAGE_SENSOR_ALS, HID_USAGE_SENSOR_UNITS_LUX, 1, 0},
 
-        {HID_USAGE_SENSOR_PRESSURE, 0, 100000, 0},
-        {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 1, 0},
+        {HID_USAGE_SENSOR_PRESSURE, 0, 100, 0},
+        {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000},
 };
 
 static int pow_10(unsigned power)
diff --git a/drivers/iio/dac/stx104.c b/drivers/iio/dac/stx104.c
index 792a97164cb2..bebbd00304ce 100644
--- a/drivers/iio/dac/stx104.c
+++ b/drivers/iio/dac/stx104.c
@@ -65,6 +65,16 @@ struct stx104_gpio {
         unsigned int out_state;
 };
 
+/**
+ * struct stx104_dev - STX104 device private data structure
+ * @indio_dev:  IIO device
+ * @chip:       instance of the gpio_chip
+ */
+struct stx104_dev {
+        struct iio_dev *indio_dev;
+        struct gpio_chip *chip;
+};
+
 static int stx104_read_raw(struct iio_dev *indio_dev,
         struct iio_chan_spec const *chan, int *val, int *val2, long mask)
 {
@@ -107,6 +117,7 @@ static const struct iio_chan_spec stx104_channels[STX104_NUM_CHAN] = {
 static int stx104_gpio_get_direction(struct gpio_chip *chip,
         unsigned int offset)
 {
+        /* GPIO 0-3 are input only, while the rest are output only */
         if (offset < 4)
                 return 1;
 
@@ -169,6 +180,7 @@ static int stx104_probe(struct device *dev, unsigned int id)
         struct iio_dev *indio_dev;
         struct stx104_iio *priv;
         struct stx104_gpio *stx104gpio;
+        struct stx104_dev *stx104dev;
         int err;
 
         indio_dev = devm_iio_device_alloc(dev, sizeof(*priv));
@@ -179,6 +191,10 @@ static int stx104_probe(struct device *dev, unsigned int id)
         if (!stx104gpio)
                 return -ENOMEM;
 
+        stx104dev = devm_kzalloc(dev, sizeof(*stx104dev), GFP_KERNEL);
+        if (!stx104dev)
+                return -ENOMEM;
+
         if (!devm_request_region(dev, base[id], STX104_EXTENT,
                 dev_name(dev))) {
                 dev_err(dev, "Unable to lock port addresses (0x%X-0x%X)\n",
@@ -199,12 +215,6 @@ static int stx104_probe(struct device *dev, unsigned int id)
         outw(0, base[id] + 4);
         outw(0, base[id] + 6);
 
-        err = devm_iio_device_register(dev, indio_dev);
-        if (err) {
-                dev_err(dev, "IIO device registering failed (%d)\n", err);
-                return err;
-        }
-
         stx104gpio->chip.label = dev_name(dev);
         stx104gpio->chip.parent = dev;
         stx104gpio->chip.owner = THIS_MODULE;
@@ -220,7 +230,9 @@ static int stx104_probe(struct device *dev, unsigned int id)
 
         spin_lock_init(&stx104gpio->lock);
 
-        dev_set_drvdata(dev, stx104gpio);
+        stx104dev->indio_dev = indio_dev;
+        stx104dev->chip = &stx104gpio->chip;
+        dev_set_drvdata(dev, stx104dev);
 
         err = gpiochip_add_data(&stx104gpio->chip, stx104gpio);
         if (err) {
@@ -228,14 +240,22 @@ static int stx104_probe(struct device *dev, unsigned int id)
                 return err;
         }
 
+        err = iio_device_register(indio_dev);
+        if (err) {
+                dev_err(dev, "IIO device registering failed (%d)\n", err);
+                gpiochip_remove(&stx104gpio->chip);
+                return err;
+        }
+
         return 0;
 }
 
 static int stx104_remove(struct device *dev, unsigned int id)
 {
-        struct stx104_gpio *const stx104gpio = dev_get_drvdata(dev);
+        struct stx104_dev *const stx104dev = dev_get_drvdata(dev);
 
-        gpiochip_remove(&stx104gpio->chip);
+        iio_device_unregister(stx104dev->indio_dev);
+        gpiochip_remove(stx104dev->chip);
 
         return 0;
 }
diff --git a/drivers/iio/humidity/Kconfig b/drivers/iio/humidity/Kconfig
index 738a86d9e4a9..d04124345992 100644
--- a/drivers/iio/humidity/Kconfig
+++ b/drivers/iio/humidity/Kconfig
@@ -6,6 +6,8 @@ menu "Humidity sensors"
 config AM2315
     tristate "Aosong AM2315 relative humidity and temperature sensor"
     depends on I2C
+    select IIO_BUFFER
+    select IIO_TRIGGERED_BUFFER
     help
       If you say yes here you get support for the Aosong AM2315
       relative humidity and ambient temperature sensor.
diff --git a/drivers/iio/humidity/am2315.c b/drivers/iio/humidity/am2315.c
index 3e200f69e886..ff96b6d0fdae 100644
--- a/drivers/iio/humidity/am2315.c
+++ b/drivers/iio/humidity/am2315.c
@@ -244,7 +244,7 @@ static int am2315_probe(struct i2c_client *client,
         indio_dev->channels = am2315_channels;
         indio_dev->num_channels = ARRAY_SIZE(am2315_channels);
 
-        ret = iio_triggered_buffer_setup(indio_dev, NULL,
+        ret = iio_triggered_buffer_setup(indio_dev, iio_pollfunc_store_time,
                                          am2315_trigger_handler, NULL);
         if (ret < 0) {
                 dev_err(&client->dev, "iio triggered buffer setup failed\n");
diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c
index a03832a5fc95..e0c9c70c2a4a 100644
--- a/drivers/iio/humidity/hdc100x.c
+++ b/drivers/iio/humidity/hdc100x.c
@@ -142,7 +142,7 @@ static int hdc100x_get_measurement(struct hdc100x_data *data,
         struct i2c_client *client = data->client;
         int delay = data->adc_int_us[chan->address];
         int ret;
-        int val;
+        __be16 val;
 
         /* start measurement */
         ret = i2c_smbus_write_byte(client, chan->address);
@@ -154,26 +154,13 @@ static int hdc100x_get_measurement(struct hdc100x_data *data,
         /* wait for integration time to pass */
         usleep_range(delay, delay + 1000);
 
-        /*
-         * i2c_smbus_read_word_data cannot() be used here due to the command
-         * value not being understood and causes NAKs preventing any reading
-         * from being accessed.
-         */
-        ret = i2c_smbus_read_byte(client);
+        /* read measurement */
+        ret = i2c_master_recv(data->client, (char *)&val, sizeof(val));
         if (ret < 0) {
-                dev_err(&client->dev, "cannot read high byte measurement");
+                dev_err(&client->dev, "cannot read sensor data\n");
                 return ret;
         }
-        val = ret << 8;
-
-        ret = i2c_smbus_read_byte(client);
-        if (ret < 0) {
-                dev_err(&client->dev, "cannot read low byte measurement");
-                return ret;
-        }
-        val |= ret;
-
-        return val;
+        return be16_to_cpu(val);
 }
 
 static int hdc100x_get_heater_status(struct hdc100x_data *data)
@@ -272,8 +259,8 @@ static int hdc100x_probe(struct i2c_client *client,
         struct iio_dev *indio_dev;
         struct hdc100x_data *data;
 
-        if (!i2c_check_functionality(client->adapter,
-                                I2C_FUNC_SMBUS_WORD_DATA | I2C_FUNC_SMBUS_BYTE))
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_WORD_DATA |
+                                     I2C_FUNC_SMBUS_BYTE | I2C_FUNC_I2C))
                 return -EOPNOTSUPP;
 
         indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*data));
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 90462fcf5436..158aaf44dd95 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -107,9 +107,10 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
 {
         struct iio_dev *indio_dev = filp->private_data;
         struct iio_buffer *rb = indio_dev->buffer;
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
         size_t datum_size;
         size_t to_wait;
-        int ret;
+        int ret = 0;
 
         if (!indio_dev->info)
                 return -ENODEV;
@@ -131,19 +132,29 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
         else
                 to_wait = min_t(size_t, n / datum_size, rb->watermark);
 
+        add_wait_queue(&rb->pollq, &wait);
         do {
-                ret = wait_event_interruptible(rb->pollq,
-                      iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size));
-                if (ret)
-                        return ret;
+                if (!indio_dev->info) {
+                        ret = -ENODEV;
+                        break;
+                }
 
-                if (!indio_dev->info)
-                        return -ENODEV;
+                if (!iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size)) {
+                        if (signal_pending(current)) {
+                                ret = -ERESTARTSYS;
+                                break;
+                        }
+
+                        wait_woken(&wait, TASK_INTERRUPTIBLE,
+                                   MAX_SCHEDULE_TIMEOUT);
+                        continue;
+                }
 
                 ret = rb->access->read_first_n(rb, n, buf);
                 if (ret == 0 && (filp->f_flags & O_NONBLOCK))
                         ret = -EAGAIN;
-         } while (ret == 0);
+        } while (ret == 0);
+        remove_wait_queue(&rb->pollq, &wait);
 
         return ret;
 }
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index f914d5d140e4..d2b889918c3e 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -613,9 +613,8 @@ ssize_t iio_format_value(char *buf, unsigned int type, int size, int *vals)
                         return sprintf(buf, "%d.%09u\n", vals[0], vals[1]);
         case IIO_VAL_FRACTIONAL:
                 tmp = div_s64((s64)vals[0] * 1000000000LL, vals[1]);
-                vals[1] = do_div(tmp, 1000000000LL);
-                vals[0] = tmp;
-                return sprintf(buf, "%d.%09u\n", vals[0], vals[1]);
+                vals[0] = (int)div_s64_rem(tmp, 1000000000, &vals[1]);
+                return sprintf(buf, "%d.%09u\n", vals[0], abs(vals[1]));
         case IIO_VAL_FRACTIONAL_LOG2:
                 tmp = (s64)vals[0] * 1000000000LL >> vals[1];
                 vals[1] = do_div(tmp, 1000000000LL);
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index 7c566f516572..3574945183fe 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -76,7 +76,6 @@ config BH1750
 config BH1780
         tristate "ROHM BH1780 ambient light sensor"
         depends on I2C
-        depends on !SENSORS_BH1780
         help
          Say Y here to build support for the ROHM BH1780GLI ambient
          light sensor.
@@ -238,6 +237,8 @@ config MAX44000
         tristate "MAX44000 Ambient and Infrared Proximity Sensor"
         depends on I2C
         select REGMAP_I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
          Say Y here if you want to build support for Maxim Integrated's
          MAX44000 ambient and infrared proximity sensor device.
diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
index 6943688e66df..e5a533cbd53f 100644
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -970,7 +970,7 @@ int bmp280_common_probe(struct device *dev,
         data->vdda = devm_regulator_get(dev, "vdda");
         if (IS_ERR(data->vdda)) {
                 dev_err(dev, "failed to get VDDA regulator\n");
-                ret = PTR_ERR(data->vddd);
+                ret = PTR_ERR(data->vdda);
                 goto out_disable_vddd;
         }
         ret = regulator_enable(data->vdda);
@@ -1079,7 +1079,8 @@ EXPORT_SYMBOL(bmp280_common_remove);
 #ifdef CONFIG_PM
 static int bmp280_runtime_suspend(struct device *dev)
 {
-        struct bmp280_data *data = dev_get_drvdata(dev);
+        struct iio_dev *indio_dev = dev_get_drvdata(dev);
+        struct bmp280_data *data = iio_priv(indio_dev);
         int ret;
 
         ret = regulator_disable(data->vdda);
@@ -1090,7 +1091,8 @@ static int bmp280_runtime_suspend(struct device *dev)
 
 static int bmp280_runtime_resume(struct device *dev)
 {
-        struct bmp280_data *data = dev_get_drvdata(dev);
+        struct iio_dev *indio_dev = dev_get_drvdata(dev);
+        struct bmp280_data *data = iio_priv(indio_dev);
         int ret;
 
         ret = regulator_enable(data->vddd);
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index 2e3a70e1b245..5656deb17261 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -397,7 +397,7 @@ static int as3935_probe(struct spi_device *spi)
                 return ret;
         }
 
-        ret = iio_triggered_buffer_setup(indio_dev, NULL,
+        ret = iio_triggered_buffer_setup(indio_dev, iio_pollfunc_store_time,
                 &as3935_trigger_handler, NULL);
 
         if (ret) {
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index e6dfa1bd3def..5f65a78b27c9 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2462,18 +2462,24 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv)
 
         if (addr->dev_addr.bound_dev_if) {
                 ndev = dev_get_by_index(&init_net, addr->dev_addr.bound_dev_if);
-                if (!ndev)
-                        return -ENODEV;
+                if (!ndev) {
+                        ret = -ENODEV;
+                        goto err2;
+                }
 
                 if (ndev->flags & IFF_LOOPBACK) {
                         dev_put(ndev);
-                        if (!id_priv->id.device->get_netdev)
-                                return -EOPNOTSUPP;
+                        if (!id_priv->id.device->get_netdev) {
+                                ret = -EOPNOTSUPP;
+                                goto err2;
+                        }
 
                         ndev = id_priv->id.device->get_netdev(id_priv->id.device,
                                                               id_priv->id.port_num);
-                        if (!ndev)
-                                return -ENODEV;
+                        if (!ndev) {
+                                ret = -ENODEV;
+                                goto err2;
+                        }
                 }
 
                 route->path_rec->net = &init_net;
diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
index 3a3c5d73bbfc..51c79b2fb0b8 100644
--- a/drivers/infiniband/core/multicast.c
+++ b/drivers/infiniband/core/multicast.c
@@ -106,7 +106,6 @@ struct mcast_group {
         atomic_t                refcount;
         enum mcast_group_state  state;
         struct ib_sa_query      *query;
-        int                     query_id;
         u16                     pkey_index;
         u8                      leave_state;
         int                     retries;
@@ -340,11 +339,7 @@ static int send_join(struct mcast_group *group, struct mcast_member *member)
                                        member->multicast.comp_mask,
                                        3000, GFP_KERNEL, join_handler, group,
                                        &group->query);
-        if (ret >= 0) {
-                group->query_id = ret;
-                ret = 0;
-        }
-        return ret;
+        return (ret > 0) ? 0 : ret;
 }
 
 static int send_leave(struct mcast_group *group, u8 leave_state)
@@ -364,11 +359,7 @@ static int send_leave(struct mcast_group *group, u8 leave_state)
                                        IB_SA_MCMEMBER_REC_JOIN_STATE,
                                        3000, GFP_KERNEL, leave_handler,
                                        group, &group->query);
-        if (ret >= 0) {
-                group->query_id = ret;
-                ret = 0;
-        }
-        return ret;
+        return (ret > 0) ? 0 : ret;
 }
 
 static void join_group(struct mcast_group *group, struct mcast_member *member,
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 3aca7f6171b4..b6a953aed7e8 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1827,8 +1827,12 @@ static int process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
                                 (ep->mpa_pkt + sizeof(*mpa));
                         ep->ird = ntohs(mpa_v2_params->ird) &
                                 MPA_V2_IRD_ORD_MASK;
+                        ep->ird = min_t(u32, ep->ird,
+                                        cur_max_read_depth(ep->com.dev));
                         ep->ord = ntohs(mpa_v2_params->ord) &
                                 MPA_V2_IRD_ORD_MASK;
+                        ep->ord = min_t(u32, ep->ord,
+                                        cur_max_read_depth(ep->com.dev));
                         PDBG("%s initiator ird %u ord %u\n", __func__, ep->ird,
                              ep->ord);
                         if (ntohs(mpa_v2_params->ird) & MPA_V2_PEER2PEER_MODEL)
@@ -3136,7 +3140,7 @@ int c4iw_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         if (ep->mpa_attr.version == 2 && ep->mpa_attr.enhanced_rdma_conn) {
                 if (conn_param->ord > ep->ird) {
                         if (RELAXED_IRD_NEGOTIATION) {
-                                ep->ord = ep->ird;
+                                conn_param->ord = ep->ird;
                         } else {
                                 ep->ird = conn_param->ird;
                                 ep->ord = conn_param->ord;
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 812ab7278b8e..ac926c942fee 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -1016,15 +1016,15 @@ int c4iw_resize_cq(struct ib_cq *cq, int cqe, struct ib_udata *udata)
 int c4iw_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
 {
         struct c4iw_cq *chp;
-        int ret;
+        int ret = 0;
         unsigned long flag;
 
         chp = to_c4iw_cq(ibcq);
         spin_lock_irqsave(&chp->lock, flag);
-        ret = t4_arm_cq(&chp->cq,
-                        (flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED);
+        t4_arm_cq(&chp->cq,
+                  (flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED);
+        if (flags & IB_CQ_REPORT_MISSED_EVENTS)
+                ret = t4_cq_notempty(&chp->cq);
         spin_unlock_irqrestore(&chp->lock, flag);
-        if (ret && !(flags & IB_CQ_REPORT_MISSED_EVENTS))
-                ret = 0;
         return ret;
 }
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index edb1172b6f54..690435229be7 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -683,7 +683,7 @@ static int build_inv_stag(union t4_wr *wqe, struct ib_send_wr *wr,
         return 0;
 }
 
-void _free_qp(struct kref *kref)
+static void _free_qp(struct kref *kref)
 {
         struct c4iw_qp *qhp;
 
diff --git a/drivers/infiniband/hw/cxgb4/t4.h b/drivers/infiniband/hw/cxgb4/t4.h
index 6126bbe36095..02173f4315fa 100644
--- a/drivers/infiniband/hw/cxgb4/t4.h
+++ b/drivers/infiniband/hw/cxgb4/t4.h
@@ -634,6 +634,11 @@ static inline int t4_valid_cqe(struct t4_cq *cq, struct t4_cqe *cqe)
         return (CQE_GENBIT(cqe) == cq->gen);
 }
 
+static inline int t4_cq_notempty(struct t4_cq *cq)
+{
+        return cq->sw_in_use || t4_valid_cqe(cq, &cq->queue[cq->cidx]);
+}
+
 static inline int t4_next_hw_cqe(struct t4_cq *cq, struct t4_cqe **cqe)
 {
         int ret;
diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c
index 79575ee873f2..0566393e5aba 100644
--- a/drivers/infiniband/hw/hfi1/affinity.c
+++ b/drivers/infiniband/hw/hfi1/affinity.c
@@ -47,7 +47,6 @@
 #include <linux/topology.h>
 #include <linux/cpumask.h>
 #include <linux/module.h>
-#include <linux/cpumask.h>
 
 #include "hfi.h"
 #include "affinity.h"
@@ -682,7 +681,7 @@ int hfi1_set_sdma_affinity(struct hfi1_devdata *dd, const char *buf,
                            size_t count)
 {
         struct hfi1_affinity_node *entry;
-        struct cpumask mask;
+        cpumask_var_t mask;
         int ret, i;
 
         spin_lock(&node_affinity.lock);
@@ -692,19 +691,24 @@ int hfi1_set_sdma_affinity(struct hfi1_devdata *dd, const char *buf,
         if (!entry)
                 return -EINVAL;
 
-        ret = cpulist_parse(buf, &mask);
+        ret = zalloc_cpumask_var(&mask, GFP_KERNEL);
+        if (!ret)
+                return -ENOMEM;
+
+        ret = cpulist_parse(buf, mask);
         if (ret)
-                return ret;
+                goto out;
 
-        if (!cpumask_subset(&mask, cpu_online_mask) || cpumask_empty(&mask)) {
+        if (!cpumask_subset(mask, cpu_online_mask) || cpumask_empty(mask)) {
                 dd_dev_warn(dd, "Invalid CPU mask\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
         }
 
         mutex_lock(&sdma_affinity_mutex);
         /* reset the SDMA interrupt affinity details */
         init_cpu_mask_set(&entry->def_intr);
-        cpumask_copy(&entry->def_intr.mask, &mask);
+        cpumask_copy(&entry->def_intr.mask, mask);
         /*
          * Reassign the affinity for each SDMA interrupt.
          */
@@ -720,8 +724,9 @@ int hfi1_set_sdma_affinity(struct hfi1_devdata *dd, const char *buf,
                 if (ret)
                         break;
         }
-
         mutex_unlock(&sdma_affinity_mutex);
+out:
+        free_cpumask_var(mask);
         return ret ? ret : strnlen(buf, PAGE_SIZE);
 }
 
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index b32638d58ae8..cc38004cea42 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -9490,6 +9490,78 @@ static void init_lcb(struct hfi1_devdata *dd)
         write_csr(dd, DC_LCB_CFG_TX_FIFOS_RESET, 0x00);
 }
 
+/*
+ * Perform a test read on the QSFP.  Return 0 on success, -ERRNO
+ * on error.
+ */
+static int test_qsfp_read(struct hfi1_pportdata *ppd)
+{
+        int ret;
+        u8 status;
+
+        /* report success if not a QSFP */
+        if (ppd->port_type != PORT_TYPE_QSFP)
+                return 0;
+
+        /* read byte 2, the status byte */
+        ret = one_qsfp_read(ppd, ppd->dd->hfi1_id, 2, &status, 1);
+        if (ret < 0)
+                return ret;
+        if (ret != 1)
+                return -EIO;
+
+        return 0; /* success */
+}
+
+/*
+ * Values for QSFP retry.
+ *
+ * Give up after 10s (20 x 500ms).  The overall timeout was empirically
+ * arrived at from experience on a large cluster.
+ */
+#define MAX_QSFP_RETRIES 20
+#define QSFP_RETRY_WAIT 500 /* msec */
+
+/*
+ * Try a QSFP read.  If it fails, schedule a retry for later.
+ * Called on first link activation after driver load.
+ */
+static void try_start_link(struct hfi1_pportdata *ppd)
+{
+        if (test_qsfp_read(ppd)) {
+                /* read failed */
+                if (ppd->qsfp_retry_count >= MAX_QSFP_RETRIES) {
+                        dd_dev_err(ppd->dd, "QSFP not responding, giving up\n");
+                        return;
+                }
+                dd_dev_info(ppd->dd,
+                            "QSFP not responding, waiting and retrying %d\n",
+                            (int)ppd->qsfp_retry_count);
+                ppd->qsfp_retry_count++;
+                queue_delayed_work(ppd->hfi1_wq, &ppd->start_link_work,
+                                   msecs_to_jiffies(QSFP_RETRY_WAIT));
+                return;
+        }
+        ppd->qsfp_retry_count = 0;
+
+        /*
+         * Tune the SerDes to a ballpark setting for optimal signal and bit
+         * error rate.  Needs to be done before starting the link.
+         */
+        tune_serdes(ppd);
+        start_link(ppd);
+}
+
+/*
+ * Workqueue function to start the link after a delay.
+ */
+void handle_start_link(struct work_struct *work)
+{
+        struct hfi1_pportdata *ppd = container_of(work, struct hfi1_pportdata,
+                                                  start_link_work.work);
+        try_start_link(ppd);
+}
+
 int bringup_serdes(struct hfi1_pportdata *ppd)
 {
         struct hfi1_devdata *dd = ppd->dd;
@@ -9525,14 +9597,8 @@ int bringup_serdes(struct hfi1_pportdata *ppd)
                 set_qsfp_int_n(ppd, 1);
         }
 
-        /*
-         * Tune the SerDes to a ballpark setting for
-         * optimal signal and bit error rate
-         * Needs to be done before starting the link
-         */
-        tune_serdes(ppd);
-
-        return start_link(ppd);
+        try_start_link(ppd);
+        return 0;
 }
 
 void hfi1_quiet_serdes(struct hfi1_pportdata *ppd)
@@ -9549,6 +9615,10 @@ void hfi1_quiet_serdes(struct hfi1_pportdata *ppd)
         ppd->driver_link_ready = 0;
         ppd->link_enabled = 0;
 
+        ppd->qsfp_retry_count = MAX_QSFP_RETRIES; /* prevent more retries */
+        flush_delayed_work(&ppd->start_link_work);
+        cancel_delayed_work_sync(&ppd->start_link_work);
+
         ppd->offline_disabled_reason =
                         HFI1_ODR_MASK(OPA_LINKDOWN_REASON_SMA_DISABLED);
         set_link_down_reason(ppd, OPA_LINKDOWN_REASON_SMA_DISABLED, 0,
@@ -12865,7 +12935,7 @@ fail:
  */
 static int set_up_context_variables(struct hfi1_devdata *dd)
 {
-        int num_kernel_contexts;
+        unsigned long num_kernel_contexts;
         int total_contexts;
         int ret;
         unsigned ngroups;
@@ -12894,9 +12964,9 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
          */
         if (num_kernel_contexts > (dd->chip_send_contexts - num_vls - 1)) {
                 dd_dev_err(dd,
-                           "Reducing # kernel rcv contexts to: %d, from %d\n",
+                           "Reducing # kernel rcv contexts to: %d, from %lu\n",
                            (int)(dd->chip_send_contexts - num_vls - 1),
-                           (int)num_kernel_contexts);
+                           num_kernel_contexts);
                 num_kernel_contexts = dd->chip_send_contexts - num_vls - 1;
         }
         /*
diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
index ed11107c50fe..e29573769efc 100644
--- a/drivers/infiniband/hw/hfi1/chip.h
+++ b/drivers/infiniband/hw/hfi1/chip.h
@@ -706,6 +706,7 @@ void handle_link_up(struct work_struct *work);
 void handle_link_down(struct work_struct *work);
 void handle_link_downgrade(struct work_struct *work);
 void handle_link_bounce(struct work_struct *work);
+void handle_start_link(struct work_struct *work);
 void handle_sma_message(struct work_struct *work);
 void reset_qsfp(struct hfi1_pportdata *ppd);
 void qsfp_event(struct work_struct *work);
diff --git a/drivers/infiniband/hw/hfi1/debugfs.c b/drivers/infiniband/hw/hfi1/debugfs.c
index dbab9d9cc288..5e9be16f6cd3 100644
--- a/drivers/infiniband/hw/hfi1/debugfs.c
+++ b/drivers/infiniband/hw/hfi1/debugfs.c
@@ -59,6 +59,40 @@
 
 static struct dentry *hfi1_dbg_root;
 
+/* wrappers to enforce srcu in seq file */
+static ssize_t hfi1_seq_read(
+        struct file *file,
+        char __user *buf,
+        size_t size,
+        loff_t *ppos)
+{
+        struct dentry *d = file->f_path.dentry;
+        int srcu_idx;
+        ssize_t r;
+
+        r = debugfs_use_file_start(d, &srcu_idx);
+        if (likely(!r))
+                r = seq_read(file, buf, size, ppos);
+        debugfs_use_file_finish(srcu_idx);
+        return r;
+}
+
+static loff_t hfi1_seq_lseek(
+        struct file *file,
+        loff_t offset,
+        int whence)
+{
+        struct dentry *d = file->f_path.dentry;
+        int srcu_idx;
+        loff_t r;
+
+        r = debugfs_use_file_start(d, &srcu_idx);
+        if (likely(!r))
+                r = seq_lseek(file, offset, whence);
+        debugfs_use_file_finish(srcu_idx);
+        return r;
+}
+
 #define private2dd(file) (file_inode(file)->i_private)
 #define private2ppd(file) (file_inode(file)->i_private)
 
@@ -87,8 +121,8 @@ static int _##name##_open(struct inode *inode, struct file *s) \
 static const struct file_operations _##name##_file_ops = { \
         .owner   = THIS_MODULE, \
         .open    = _##name##_open, \
-        .read    = seq_read, \
-        .llseek  = seq_lseek, \
+        .read    = hfi1_seq_read, \
+        .llseek  = hfi1_seq_lseek, \
         .release = seq_release \
 }
 
@@ -105,11 +139,9 @@ do { \
         DEBUGFS_FILE_CREATE(#name, parent, data, &_##name##_file_ops, S_IRUGO)
 
 static void *_opcode_stats_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
         struct hfi1_opcode_stats_perctx *opstats;
 
-        rcu_read_lock();
         if (*pos >= ARRAY_SIZE(opstats->stats))
                 return NULL;
         return pos;
@@ -126,9 +158,7 @@ static void *_opcode_stats_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void _opcode_stats_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static int _opcode_stats_seq_show(struct seq_file *s, void *v)
@@ -223,28 +253,32 @@ DEBUGFS_SEQ_FILE_OPEN(ctx_stats)
 DEBUGFS_FILE_OPS(ctx_stats);
 
 static void *_qp_stats_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
+        __acquires(RCU)
 {
         struct qp_iter *iter;
         loff_t n = *pos;
 
-        rcu_read_lock();
         iter = qp_iter_init(s->private);
+
+        /* stop calls rcu_read_unlock */
+        rcu_read_lock();
+
         if (!iter)
                 return NULL;
 
-        while (n--) {
+        do {
                 if (qp_iter_next(iter)) {
                         kfree(iter);
                         return NULL;
                 }
-        }
+        } while (n--);
 
         return iter;
 }
 
 static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
                                 loff_t *pos)
+        __must_hold(RCU)
 {
         struct qp_iter *iter = iter_ptr;
 
@@ -259,7 +293,7 @@ static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
 }
 
 static void _qp_stats_seq_stop(struct seq_file *s, void *iter_ptr)
-__releases(RCU)
+        __releases(RCU)
 {
         rcu_read_unlock();
 }
@@ -281,12 +315,10 @@ DEBUGFS_SEQ_FILE_OPEN(qp_stats)
 DEBUGFS_FILE_OPS(qp_stats);
 
 static void *_sdes_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
         struct hfi1_ibdev *ibd;
         struct hfi1_devdata *dd;
 
-        rcu_read_lock();
         ibd = (struct hfi1_ibdev *)s->private;
         dd = dd_from_dev(ibd);
         if (!dd->per_sdma || *pos >= dd->num_sdma)
@@ -306,9 +338,7 @@ static void *_sdes_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void _sdes_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static int _sdes_seq_show(struct seq_file *s, void *v)
@@ -335,11 +365,9 @@ static ssize_t dev_counters_read(struct file *file, char __user *buf,
         struct hfi1_devdata *dd;
         ssize_t rval;
 
-        rcu_read_lock();
         dd = private2dd(file);
         avail = hfi1_read_cntrs(dd, NULL, &counters);
         rval =  simple_read_from_buffer(buf, count, ppos, counters, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -352,11 +380,9 @@ static ssize_t dev_names_read(struct file *file, char __user *buf,
         struct hfi1_devdata *dd;
         ssize_t rval;
 
-        rcu_read_lock();
         dd = private2dd(file);
         avail = hfi1_read_cntrs(dd, &names, NULL);
         rval =  simple_read_from_buffer(buf, count, ppos, names, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -379,11 +405,9 @@ static ssize_t portnames_read(struct file *file, char __user *buf,
         struct hfi1_devdata *dd;
         ssize_t rval;
 
-        rcu_read_lock();
         dd = private2dd(file);
         avail = hfi1_read_portcntrs(dd->pport, &names, NULL);
         rval = simple_read_from_buffer(buf, count, ppos, names, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -396,11 +420,9 @@ static ssize_t portcntrs_debugfs_read(struct file *file, char __user *buf,
         struct hfi1_pportdata *ppd;
         ssize_t rval;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         avail = hfi1_read_portcntrs(ppd, NULL, &counters);
         rval = simple_read_from_buffer(buf, count, ppos, counters, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -430,16 +452,13 @@ static ssize_t asic_flags_read(struct file *file, char __user *buf,
         int used;
         int i;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         dd = ppd->dd;
         size = PAGE_SIZE;
         used = 0;
         tmp = kmalloc(size, GFP_KERNEL);
-        if (!tmp) {
-                rcu_read_unlock();
+        if (!tmp)
                 return -ENOMEM;
-        }
 
         scratch0 = read_csr(dd, ASIC_CFG_SCRATCH);
         used += scnprintf(tmp + used, size - used,
@@ -466,7 +485,6 @@ static ssize_t asic_flags_read(struct file *file, char __user *buf,
         used += scnprintf(tmp + used, size - used, "Write bits to clear\n");
 
         ret = simple_read_from_buffer(buf, count, ppos, tmp, used);
-        rcu_read_unlock();
         kfree(tmp);
         return ret;
 }
@@ -482,15 +500,12 @@ static ssize_t asic_flags_write(struct file *file, const char __user *buf,
         u64 scratch0;
         u64 clear;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         dd = ppd->dd;
 
         buff = kmalloc(count + 1, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto do_return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         ret = copy_from_user(buff, buf, count);
         if (ret > 0) {
@@ -523,8 +538,6 @@ static ssize_t asic_flags_write(struct file *file, const char __user *buf,
 
  do_free:
         kfree(buff);
- do_return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -538,18 +551,14 @@ static ssize_t qsfp_debugfs_dump(struct file *file, char __user *buf,
         char *tmp;
         int ret;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         tmp = kmalloc(PAGE_SIZE, GFP_KERNEL);
-        if (!tmp) {
-                rcu_read_unlock();
+        if (!tmp)
                 return -ENOMEM;
-        }
 
         ret = qsfp_dump(ppd, tmp, PAGE_SIZE);
         if (ret > 0)
                 ret = simple_read_from_buffer(buf, count, ppos, tmp, ret);
-        rcu_read_unlock();
         kfree(tmp);
         return ret;
 }
@@ -565,7 +574,6 @@ static ssize_t __i2c_debugfs_write(struct file *file, const char __user *buf,
         int offset;
         int total_written;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
 
         /* byte offset format: [offsetSize][i2cAddr][offsetHigh][offsetLow] */
@@ -573,16 +581,12 @@ static ssize_t __i2c_debugfs_write(struct file *file, const char __user *buf,
         offset = *ppos & 0xffff;
 
         /* explicitly reject invalid address 0 to catch cp and cat */
-        if (i2c_addr == 0) {
-                ret = -EINVAL;
-                goto _return;
-        }
+        if (i2c_addr == 0)
+                return -EINVAL;
 
         buff = kmalloc(count, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto _return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         ret = copy_from_user(buff, buf, count);
         if (ret > 0) {
@@ -602,8 +606,6 @@ static ssize_t __i2c_debugfs_write(struct file *file, const char __user *buf,
 
  _free:
         kfree(buff);
- _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -632,7 +634,6 @@ static ssize_t __i2c_debugfs_read(struct file *file, char __user *buf,
         int offset;
         int total_read;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
 
         /* byte offset format: [offsetSize][i2cAddr][offsetHigh][offsetLow] */
@@ -640,16 +641,12 @@ static ssize_t __i2c_debugfs_read(struct file *file, char __user *buf,
         offset = *ppos & 0xffff;
 
         /* explicitly reject invalid address 0 to catch cp and cat */
-        if (i2c_addr == 0) {
-                ret = -EINVAL;
-                goto _return;
-        }
+        if (i2c_addr == 0)
+                return -EINVAL;
 
         buff = kmalloc(count, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto _return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         total_read = i2c_read(ppd, target, i2c_addr, offset, buff, count);
         if (total_read < 0) {
@@ -669,8 +666,6 @@ static ssize_t __i2c_debugfs_read(struct file *file, char __user *buf,
 
  _free:
         kfree(buff);
- _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -697,26 +692,20 @@ static ssize_t __qsfp_debugfs_write(struct file *file, const char __user *buf,
         int ret;
         int total_written;
 
-        rcu_read_lock();
-        if (*ppos + count > QSFP_PAGESIZE * 4) { /* base page + page00-page03 */
-                ret = -EINVAL;
-                goto _return;
-        }
+        if (*ppos + count > QSFP_PAGESIZE * 4) /* base page + page00-page03 */
+                return -EINVAL;
 
         ppd = private2ppd(file);
 
         buff = kmalloc(count, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto _return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         ret = copy_from_user(buff, buf, count);
         if (ret > 0) {
                 ret = -EFAULT;
                 goto _free;
         }
-
         total_written = qsfp_write(ppd, target, *ppos, buff, count);
         if (total_written < 0) {
                 ret = total_written;
@@ -729,8 +718,6 @@ static ssize_t __qsfp_debugfs_write(struct file *file, const char __user *buf,
 
  _free:
         kfree(buff);
- _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -757,7 +744,6 @@ static ssize_t __qsfp_debugfs_read(struct file *file, char __user *buf,
         int ret;
         int total_read;
 
-        rcu_read_lock();
         if (*ppos + count > QSFP_PAGESIZE * 4) { /* base page + page00-page03 */
                 ret = -EINVAL;
                 goto _return;
@@ -790,7 +776,6 @@ static ssize_t __qsfp_debugfs_read(struct file *file, char __user *buf,
  _free:
         kfree(buff);
  _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -1006,7 +991,6 @@ void hfi1_dbg_ibdev_exit(struct hfi1_ibdev *ibd)
         debugfs_remove_recursive(ibd->hfi1_ibdev_dbg);
 out:
         ibd->hfi1_ibdev_dbg = NULL;
-        synchronize_rcu();
 }
 
 /*
@@ -1031,9 +1015,7 @@ static const char * const hfi1_statnames[] = {
 };
 
 static void *_driver_stats_names_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
-        rcu_read_lock();
         if (*pos >= ARRAY_SIZE(hfi1_statnames))
                 return NULL;
         return pos;
@@ -1051,9 +1033,7 @@ static void *_driver_stats_names_seq_next(
 }
 
 static void _driver_stats_names_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static int _driver_stats_names_seq_show(struct seq_file *s, void *v)
@@ -1069,9 +1049,7 @@ DEBUGFS_SEQ_FILE_OPEN(driver_stats_names)
 DEBUGFS_FILE_OPS(driver_stats_names);
 
 static void *_driver_stats_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
-        rcu_read_lock();
         if (*pos >= ARRAY_SIZE(hfi1_statnames))
                 return NULL;
         return pos;
@@ -1086,9 +1064,7 @@ static void *_driver_stats_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void _driver_stats_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static u64 hfi1_sps_ints(void)
diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
index 8246dc7d0573..303f10555729 100644
--- a/drivers/infiniband/hw/hfi1/driver.c
+++ b/drivers/infiniband/hw/hfi1/driver.c
@@ -888,14 +888,15 @@ void set_all_slowpath(struct hfi1_devdata *dd)
 }
 
 static inline int set_armed_to_active(struct hfi1_ctxtdata *rcd,
-                                      struct hfi1_packet packet,
+                                      struct hfi1_packet *packet,
                                       struct hfi1_devdata *dd)
 {
         struct work_struct *lsaw = &rcd->ppd->linkstate_active_work;
-        struct hfi1_message_header *hdr = hfi1_get_msgheader(packet.rcd->dd,
-                                                             packet.rhf_addr);
+        struct hfi1_message_header *hdr = hfi1_get_msgheader(packet->rcd->dd,
+                                                             packet->rhf_addr);
+        u8 etype = rhf_rcv_type(packet->rhf);
 
-        if (hdr2sc(hdr, packet.rhf) != 0xf) {
+        if (etype == RHF_RCV_TYPE_IB && hdr2sc(hdr, packet->rhf) != 0xf) {
                 int hwstate = read_logical_state(dd);
 
                 if (hwstate != LSTATE_ACTIVE) {
@@ -979,7 +980,7 @@ int handle_receive_interrupt(struct hfi1_ctxtdata *rcd, int thread)
                         /* Auto activate link on non-SC15 packet receive */
                         if (unlikely(rcd->ppd->host_link_state ==
                                      HLS_UP_ARMED) &&
-                            set_armed_to_active(rcd, packet, dd))
+                            set_armed_to_active(rcd, &packet, dd))
                                 goto bail;
                         last = process_rcv_packet(&packet, thread);
                 }
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index 1ecbec192358..7e03ccd2554d 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -183,6 +183,7 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
         if (fd) {
                 fd->rec_cpu_num = -1; /* no cpu affinity by default */
                 fd->mm = current->mm;
+                atomic_inc(&fd->mm->mm_count);
         }
 
         fp->private_data = fd;
@@ -222,7 +223,7 @@ static long hfi1_file_ioctl(struct file *fp, unsigned int cmd,
                 ret = assign_ctxt(fp, &uinfo);
                 if (ret < 0)
                         return ret;
-                setup_ctxt(fp);
+                ret = setup_ctxt(fp);
                 if (ret)
                         return ret;
                 ret = user_init(fp);
@@ -779,6 +780,7 @@ static int hfi1_file_close(struct inode *inode, struct file *fp)
         mutex_unlock(&hfi1_mutex);
         hfi1_free_ctxtdata(dd, uctxt);
 done:
+        mmdrop(fdata->mm);
         kobject_put(&dd->kobj);
         kfree(fdata);
         return 0;
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index 1000e0fd96d9..325ec211370f 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -605,6 +605,7 @@ struct hfi1_pportdata {
         struct work_struct freeze_work;
         struct work_struct link_downgrade_work;
         struct work_struct link_bounce_work;
+        struct delayed_work start_link_work;
         /* host link state variables */
         struct mutex hls_lock;
         u32 host_link_state;
@@ -659,6 +660,7 @@ struct hfi1_pportdata {
         u8 linkinit_reason;
         u8 local_tx_rate;       /* rate given to 8051 firmware */
         u8 last_pstate;         /* info only */
+        u8 qsfp_retry_count;
 
         /* placeholders for IB MAD packet settings */
         u8 overrun_threshold;
@@ -1272,9 +1274,26 @@ static inline int hdr2sc(struct hfi1_message_header *hdr, u64 rhf)
                ((!!(rhf_dc_info(rhf))) << 4);
 }
 
+#define HFI1_JKEY_WIDTH       16
+#define HFI1_JKEY_MASK        (BIT(16) - 1)
+#define HFI1_ADMIN_JKEY_RANGE 32
+
+/*
+ * J_KEYs are split and allocated in the following groups:
+ *   0 - 31    - users with administrator privileges
+ *  32 - 63    - kernel protocols using KDETH packets
+ *  64 - 65535 - all other users using KDETH packets
+ */
 static inline u16 generate_jkey(kuid_t uid)
 {
-        return from_kuid(current_user_ns(), uid) & 0xffff;
+        u16 jkey = from_kuid(current_user_ns(), uid) & HFI1_JKEY_MASK;
+
+        if (capable(CAP_SYS_ADMIN))
+                jkey &= HFI1_ADMIN_JKEY_RANGE - 1;
+        else if (jkey < 64)
+                jkey |= BIT(HFI1_JKEY_WIDTH - 1);
+
+        return jkey;
 }
 
 /*
@@ -1656,7 +1675,6 @@ struct cc_state *get_cc_state_protected(struct hfi1_pportdata *ppd)
 struct hfi1_devdata *hfi1_init_dd(struct pci_dev *,
                                   const struct pci_device_id *);
 void hfi1_free_devdata(struct hfi1_devdata *);
-void cc_state_reclaim(struct rcu_head *rcu);
 struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, size_t extra);
 
 /* LED beaconing functions */
@@ -1788,7 +1806,7 @@ extern unsigned int hfi1_max_mtu;
 extern unsigned int hfi1_cu;
 extern unsigned int user_credit_return_threshold;
 extern int num_user_contexts;
-extern unsigned n_krcvqs;
+extern unsigned long n_krcvqs;
 extern uint krcvqs[];
 extern int krcvqsset;
 extern uint kdeth_qp;
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index a358d23ecd54..384b43d2fd49 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -94,7 +94,7 @@ module_param_array(krcvqs, uint, &krcvqsset, S_IRUGO);
 MODULE_PARM_DESC(krcvqs, "Array of the number of non-control kernel receive queues by VL");
 
 /* computed based on above array */
-unsigned n_krcvqs;
+unsigned long n_krcvqs;
 
 static unsigned hfi1_rcvarr_split = 25;
 module_param_named(rcvarr_split, hfi1_rcvarr_split, uint, S_IRUGO);
@@ -500,6 +500,7 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd,
         INIT_WORK(&ppd->link_downgrade_work, handle_link_downgrade);
         INIT_WORK(&ppd->sma_message_work, handle_sma_message);
         INIT_WORK(&ppd->link_bounce_work, handle_link_bounce);
+        INIT_DELAYED_WORK(&ppd->start_link_work, handle_start_link);
         INIT_WORK(&ppd->linkstate_active_work, receive_interrupt_work);
         INIT_WORK(&ppd->qsfp_info.qsfp_work, qsfp_event);
 
@@ -1333,7 +1334,7 @@ static void cleanup_device_data(struct hfi1_devdata *dd)
                 spin_unlock(&ppd->cc_state_lock);
 
                 if (cc_state)
-                        call_rcu(&cc_state->rcu, cc_state_reclaim);
+                        kfree_rcu(cc_state, rcu);
         }
 
         free_credit_return(dd);
diff --git a/drivers/infiniband/hw/hfi1/mad.c b/drivers/infiniband/hw/hfi1/mad.c
index 1263abe01999..7ffc14f21523 100644
--- a/drivers/infiniband/hw/hfi1/mad.c
+++ b/drivers/infiniband/hw/hfi1/mad.c
@@ -1819,6 +1819,11 @@ static int __subn_get_opa_cable_info(struct opa_smp *smp, u32 am, u8 *data,
         u32 len = OPA_AM_CI_LEN(am) + 1;
         int ret;
 
+        if (dd->pport->port_type != PORT_TYPE_QSFP) {
+                smp->status |= IB_SMP_INVALID_FIELD;
+                return reply((struct ib_mad_hdr *)smp);
+        }
+
 #define __CI_PAGE_SIZE BIT(7) /* 128 bytes */
 #define __CI_PAGE_MASK ~(__CI_PAGE_SIZE - 1)
 #define __CI_PAGE_NUM(a) ((a) & __CI_PAGE_MASK)
@@ -2599,7 +2604,7 @@ static int pma_get_opa_datacounters(struct opa_pma_mad *pmp,
         u8 lq, num_vls;
         u8 res_lli, res_ler;
         u64 port_mask;
-        unsigned long port_num;
+        u8 port_num;
         unsigned long vl;
         u32 vl_select_mask;
         int vfi;
@@ -2633,9 +2638,9 @@ static int pma_get_opa_datacounters(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
-        if ((u8)port_num != port) {
+        if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
                 return reply((struct ib_mad_hdr *)pmp);
         }
@@ -2837,7 +2842,7 @@ static int pma_get_opa_porterrors(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
         if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
@@ -3010,7 +3015,7 @@ static int pma_get_opa_errorinfo(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
         if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
@@ -3247,7 +3252,7 @@ static int pma_set_opa_errorinfo(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
         if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
@@ -3398,7 +3403,7 @@ static void apply_cc_state(struct hfi1_pportdata *ppd)
 
         spin_unlock(&ppd->cc_state_lock);
 
-        call_rcu(&old_cc_state->rcu, cc_state_reclaim);
+        kfree_rcu(old_cc_state, rcu);
 }
 
 static int __subn_set_opa_cong_setting(struct opa_smp *smp, u32 am, u8 *data,
@@ -3553,13 +3558,6 @@ static int __subn_get_opa_cc_table(struct opa_smp *smp, u32 am, u8 *data,
         return reply((struct ib_mad_hdr *)smp);
 }
 
-void cc_state_reclaim(struct rcu_head *rcu)
-{
-        struct cc_state *cc_state = container_of(rcu, struct cc_state, rcu);
-
-        kfree(cc_state);
-}
-
 static int __subn_set_opa_cc_table(struct opa_smp *smp, u32 am, u8 *data,
                                    struct ib_device *ibdev, u8 port,
                                    u32 *resp_len)
diff --git a/drivers/infiniband/hw/hfi1/pio_copy.c b/drivers/infiniband/hw/hfi1/pio_copy.c
index 8c25e1b58849..3a1ef3056282 100644
--- a/drivers/infiniband/hw/hfi1/pio_copy.c
+++ b/drivers/infiniband/hw/hfi1/pio_copy.c
@@ -771,6 +771,9 @@ void seg_pio_copy_mid(struct pio_buf *pbuf, const void *from, size_t nbytes)
                         read_extra_bytes(pbuf, from, to_fill);
                         from += to_fill;
                         nbytes -= to_fill;
+                        /* may not be enough valid bytes left to align */
+                        if (extra > nbytes)
+                                extra = nbytes;
 
                         /* ...now write carry */
                         dest = pbuf->start + (pbuf->qw_written * sizeof(u64));
@@ -798,6 +801,15 @@ void seg_pio_copy_mid(struct pio_buf *pbuf, const void *from, size_t nbytes)
                         read_low_bytes(pbuf, from, extra);
                         from += extra;
                         nbytes -= extra;
+                        /*
+                         * If no bytes are left, return early - we are done.
+                         * NOTE: This short-circuit is *required* because
+                         * "extra" may have been reduced in size and "from"
+                         * is not aligned, as required when leaving this
+                         * if block.
+                         */
+                        if (nbytes == 0)
+                                return;
                 }
 
                 /* at this point, from is QW aligned */
diff --git a/drivers/infiniband/hw/hfi1/qp.c b/drivers/infiniband/hw/hfi1/qp.c
index a5aa3517e7d5..4e4d8317c281 100644
--- a/drivers/infiniband/hw/hfi1/qp.c
+++ b/drivers/infiniband/hw/hfi1/qp.c
@@ -656,10 +656,6 @@ struct qp_iter *qp_iter_init(struct hfi1_ibdev *dev)
 
         iter->dev = dev;
         iter->specials = dev->rdi.ibdev.phys_port_cnt * 2;
-        if (qp_iter_next(iter)) {
-                kfree(iter);
-                return NULL;
-        }
 
         return iter;
 }
diff --git a/drivers/infiniband/hw/hfi1/qsfp.c b/drivers/infiniband/hw/hfi1/qsfp.c
index a207717ade2a..4e95ad810847 100644
--- a/drivers/infiniband/hw/hfi1/qsfp.c
+++ b/drivers/infiniband/hw/hfi1/qsfp.c
@@ -706,8 +706,8 @@ int get_cable_info(struct hfi1_devdata *dd, u32 port_num, u32 addr, u32 len,
                    u8 *data)
 {
         struct hfi1_pportdata *ppd;
-        u32 excess_len = 0;
-        int ret = 0;
+        u32 excess_len = len;
+        int ret = 0, offset = 0;
 
         if (port_num > dd->num_pports || port_num < 1) {
                 dd_dev_info(dd, "%s: Invalid port number %d\n",
@@ -740,6 +740,34 @@ int get_cable_info(struct hfi1_devdata *dd, u32 port_num, u32 addr, u32 len,
         }
 
         memcpy(data, &ppd->qsfp_info.cache[addr], len);
+
+        if (addr <= QSFP_MONITOR_VAL_END &&
+            (addr + len) >= QSFP_MONITOR_VAL_START) {
+                /* Overlap with the dynamic channel monitor range */
+                if (addr < QSFP_MONITOR_VAL_START) {
+                        if (addr + len <= QSFP_MONITOR_VAL_END)
+                                len = addr + len - QSFP_MONITOR_VAL_START;
+                        else
+                                len = QSFP_MONITOR_RANGE;
+                        offset = QSFP_MONITOR_VAL_START - addr;
+                        addr = QSFP_MONITOR_VAL_START;
+                } else if (addr == QSFP_MONITOR_VAL_START) {
+                        offset = 0;
+                        if (addr + len > QSFP_MONITOR_VAL_END)
+                                len = QSFP_MONITOR_RANGE;
+                } else {
+                        offset = 0;
+                        if (addr + len > QSFP_MONITOR_VAL_END)
+                                len = QSFP_MONITOR_VAL_END - addr + 1;
+                }
+                /* Refresh the values of the dynamic monitors from the cable */
+                ret = one_qsfp_read(ppd, dd->hfi1_id, addr, data + offset, len);
+                if (ret != len) {
+                        ret = -EAGAIN;
+                        goto set_zeroes;
+                }
+        }
+
         return 0;
 
 set_zeroes:
diff --git a/drivers/infiniband/hw/hfi1/qsfp.h b/drivers/infiniband/hw/hfi1/qsfp.h
index 69275ebd9597..36cf52359848 100644
--- a/drivers/infiniband/hw/hfi1/qsfp.h
+++ b/drivers/infiniband/hw/hfi1/qsfp.h
@@ -74,6 +74,9 @@
 /* Defined fields that Intel requires of qualified cables */
 /* Byte 0 is Identifier, not checked */
 /* Byte 1 is reserved "status MSB" */
+#define QSFP_MONITOR_VAL_START 22
+#define QSFP_MONITOR_VAL_END 81
+#define QSFP_MONITOR_RANGE (QSFP_MONITOR_VAL_END - QSFP_MONITOR_VAL_START + 1)
 #define QSFP_TX_CTRL_BYTE_OFFS 86
 #define QSFP_PWR_CTRL_BYTE_OFFS 93
 #define QSFP_CDR_CTRL_BYTE_OFFS 98
diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
index 0ecf27903dc2..1694037d1eee 100644
--- a/drivers/infiniband/hw/hfi1/user_sdma.c
+++ b/drivers/infiniband/hw/hfi1/user_sdma.c
@@ -114,6 +114,8 @@ MODULE_PARM_DESC(sdma_comp_size, "Size of User SDMA completion ring. Default: 12
 #define KDETH_HCRC_LOWER_SHIFT    24
 #define KDETH_HCRC_LOWER_MASK     0xff
 
+#define AHG_KDETH_INTR_SHIFT 12
+
 #define PBC2LRH(x) ((((x) & 0xfff) << 2) - 4)
 #define LRH2PBC(x) ((((x) >> 2) + 1) & 0xfff)
 
@@ -1480,7 +1482,8 @@ static int set_txreq_header_ahg(struct user_sdma_request *req,
                 /* Clear KDETH.SH on last packet */
                 if (unlikely(tx->flags & TXREQ_FLAGS_REQ_LAST_PKT)) {
                         val |= cpu_to_le16(KDETH_GET(hdr->kdeth.ver_tid_offset,
-                                                                INTR) >> 16);
+                                                     INTR) <<
+                                           AHG_KDETH_INTR_SHIFT);
                         val &= cpu_to_le16(~(1U << 13));
                         AHG_HEADER_SET(req->ahg, diff, 7, 16, 14, val);
                 } else {
diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h
index b738acdb9b02..8ec09e470f84 100644
--- a/drivers/infiniband/hw/i40iw/i40iw.h
+++ b/drivers/infiniband/hw/i40iw/i40iw.h
@@ -232,7 +232,7 @@ struct i40iw_device {
         struct i40e_client *client;
         struct i40iw_hw hw;
         struct i40iw_cm_core cm_core;
-        unsigned long *mem_resources;
+        u8 *mem_resources;
         unsigned long *allocated_qps;
         unsigned long *allocated_cqs;
         unsigned long *allocated_mrs;
@@ -435,8 +435,8 @@ static inline int i40iw_alloc_resource(struct i40iw_device *iwdev,
         *next = resource_num + 1;
         if (*next == max_resources)
                 *next = 0;
-        spin_unlock_irqrestore(&iwdev->resource_lock, flags);
         *req_resource_num = resource_num;
+        spin_unlock_irqrestore(&iwdev->resource_lock, flags);
 
         return 0;
 }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
index 5026dc79978a..7ca0638579c0 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
@@ -535,8 +535,8 @@ static struct i40iw_puda_buf *i40iw_form_cm_frame(struct i40iw_cm_node *cm_node,
                 buf += hdr_len;
         }
 
-        if (pd_len)
-                memcpy(buf, pdata->addr, pd_len);
+        if (pdata && pdata->addr)
+                memcpy(buf, pdata->addr, pdata->size);
 
         atomic_set(&sqbuf->refcount, 1);
 
@@ -3347,26 +3347,6 @@ int i40iw_cm_disconn(struct i40iw_qp *iwqp)
 }
 
 /**
- * i40iw_loopback_nop - Send a nop
- * @qp: associated hw qp
- */
-static void i40iw_loopback_nop(struct i40iw_sc_qp *qp)
-{
-        u64 *wqe;
-        u64 header;
-
-        wqe = qp->qp_uk.sq_base->elem;
-        set_64bit_val(wqe, 0, 0);
-        set_64bit_val(wqe, 8, 0);
-        set_64bit_val(wqe, 16, 0);
-
-        header = LS_64(I40IWQP_OP_NOP, I40IWQPSQ_OPCODE) |
-            LS_64(0, I40IWQPSQ_SIGCOMPL) |
-            LS_64(qp->qp_uk.swqe_polarity, I40IWQPSQ_VALID);
-        set_64bit_val(wqe, 24, header);
-}
-
-/**
  * i40iw_qp_disconnect - free qp and close cm
  * @iwqp: associate qp for the connection
  */
@@ -3638,7 +3618,7 @@ int i40iw_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         } else {
                 if (iwqp->page)
                         iwqp->sc_qp.qp_uk.sq_base = kmap(iwqp->page);
-                i40iw_loopback_nop(&iwqp->sc_qp);
+                dev->iw_priv_qp_ops->qp_send_lsmm(&iwqp->sc_qp, NULL, 0, 0);
         }
 
         if (iwqp->page)
diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c
index 3ee0cad96bc6..0c92a40b3e86 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_hw.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c
@@ -265,6 +265,7 @@ void i40iw_next_iw_state(struct i40iw_qp *iwqp,
                 info.dont_send_fin = false;
         if (iwqp->sc_qp.term_flags && (state == I40IW_QP_STATE_ERROR))
                 info.reset_tcp_conn = true;
+        iwqp->hw_iwarp_state = state;
         i40iw_hw_modify_qp(iwqp->iwdev, iwqp, &info, 0);
 }
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
index 6e9081380a27..445e230d5ff8 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -100,7 +100,7 @@ static struct notifier_block i40iw_net_notifier = {
         .notifier_call = i40iw_net_event
 };
 
-static int i40iw_notifiers_registered;
+static atomic_t i40iw_notifiers_registered;
 
 /**
  * i40iw_find_i40e_handler - find a handler given a client info
@@ -1342,12 +1342,11 @@ exit:
  */
 static void i40iw_register_notifiers(void)
 {
-        if (!i40iw_notifiers_registered) {
+        if (atomic_inc_return(&i40iw_notifiers_registered) == 1) {
                 register_inetaddr_notifier(&i40iw_inetaddr_notifier);
                 register_inet6addr_notifier(&i40iw_inetaddr6_notifier);
                 register_netevent_notifier(&i40iw_net_notifier);
         }
-        i40iw_notifiers_registered++;
 }
 
 /**
@@ -1429,8 +1428,7 @@ static void i40iw_deinit_device(struct i40iw_device *iwdev, bool reset, bool del
                         i40iw_del_macip_entry(iwdev, (u8)iwdev->mac_ip_table_idx);
                 /* fallthrough */
         case INET_NOTIFIER:
-                if (i40iw_notifiers_registered > 0) {
-                        i40iw_notifiers_registered--;
+                if (!atomic_dec_return(&i40iw_notifiers_registered)) {
                         unregister_netevent_notifier(&i40iw_net_notifier);
                         unregister_inetaddr_notifier(&i40iw_inetaddr_notifier);
                         unregister_inet6addr_notifier(&i40iw_inetaddr6_notifier);
@@ -1558,6 +1556,10 @@ static int i40iw_open(struct i40e_info *ldev, struct i40e_client *client)
         enum i40iw_status_code status;
         struct i40iw_handler *hdl;
 
+        hdl = i40iw_find_netdev(ldev->netdev);
+        if (hdl)
+                return 0;
+
         hdl = kzalloc(sizeof(*hdl), GFP_KERNEL);
         if (!hdl)
                 return -ENOMEM;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index 0e8db0a35141..6fd043b1d714 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -673,8 +673,11 @@ enum i40iw_status_code i40iw_free_virt_mem(struct i40iw_hw *hw,
 {
         if (!mem)
                 return I40IW_ERR_PARAM;
+        /*
+         * mem->va points to the parent of mem, so both mem and mem->va
+         * can not be touched once mem->va is freed
+         */
         kfree(mem->va);
-        mem->va = NULL;
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 2360338877bf..6329c971c22f 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -794,7 +794,6 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd,
         return &iwqp->ibqp;
 error:
         i40iw_free_qp_resources(iwdev, iwqp, qp_num);
-        kfree(mem);
         return ERR_PTR(err_code);
 }
 
@@ -1926,8 +1925,7 @@ static int i40iw_dereg_mr(struct ib_mr *ib_mr)
                 }
                 if (iwpbl->pbl_allocated)
                         i40iw_free_pble(iwdev->pble_rsrc, palloc);
-                kfree(iwpbl->iwmr);
-                iwpbl->iwmr = NULL;
+                kfree(iwmr);
                 return 0;
         }
 
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index d6fc8a6e8c33..5df63dacaaa3 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -576,8 +576,8 @@ static int mlx4_ib_ipoib_csum_ok(__be16 status, __be16 checksum)
                 checksum == cpu_to_be16(0xffff);
 }
 
-static int use_tunnel_data(struct mlx4_ib_qp *qp, struct mlx4_ib_cq *cq, struct ib_wc *wc,
-                           unsigned tail, struct mlx4_cqe *cqe, int is_eth)
+static void use_tunnel_data(struct mlx4_ib_qp *qp, struct mlx4_ib_cq *cq, struct ib_wc *wc,
+                            unsigned tail, struct mlx4_cqe *cqe, int is_eth)
 {
         struct mlx4_ib_proxy_sqp_hdr *hdr;
 
@@ -600,8 +600,6 @@ static int use_tunnel_data(struct mlx4_ib_qp *qp, struct mlx4_ib_cq *cq, struct
                 wc->slid        = be16_to_cpu(hdr->tun.slid_mac_47_32);
                 wc->sl          = (u8) (be16_to_cpu(hdr->tun.sl_vid) >> 12);
         }
-
-        return 0;
 }
 
 static void mlx4_ib_qp_sw_comp(struct mlx4_ib_qp *qp, int num_entries,
@@ -689,12 +687,6 @@ repoll:
         is_error = (cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) ==
                 MLX4_CQE_OPCODE_ERROR;
 
-        if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) == MLX4_OPCODE_NOP &&
-                     is_send)) {
-                pr_warn("Completion for NOP opcode detected!\n");
-                return -EINVAL;
-        }
-
         /* Resize CQ in progress */
         if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) == MLX4_CQE_OPCODE_RESIZE)) {
                 if (cq->resize_buf) {
@@ -720,12 +712,6 @@ repoll:
                  */
                 mqp = __mlx4_qp_lookup(to_mdev(cq->ibcq.device)->dev,
                                        be32_to_cpu(cqe->vlan_my_qpn));
-                if (unlikely(!mqp)) {
-                        pr_warn("CQ %06x with entry for unknown QPN %06x\n",
-                               cq->mcq.cqn, be32_to_cpu(cqe->vlan_my_qpn) & MLX4_CQE_QPN_MASK);
-                        return -EINVAL;
-                }
-
                 *cur_qp = to_mibqp(mqp);
         }
 
@@ -738,11 +724,6 @@ repoll:
                 /* SRQ is also in the radix tree */
                 msrq = mlx4_srq_lookup(to_mdev(cq->ibcq.device)->dev,
                                        srq_num);
-                if (unlikely(!msrq)) {
-                        pr_warn("CQ %06x with entry for unknown SRQN %06x\n",
-                                cq->mcq.cqn, srq_num);
-                        return -EINVAL;
-                }
         }
 
         if (is_send) {
@@ -852,9 +833,11 @@ repoll:
                 if (mlx4_is_mfunc(to_mdev(cq->ibcq.device)->dev)) {
                         if ((*cur_qp)->mlx4_ib_qp_type &
                             (MLX4_IB_QPT_PROXY_SMI_OWNER |
-                             MLX4_IB_QPT_PROXY_SMI | MLX4_IB_QPT_PROXY_GSI))
-                                return use_tunnel_data(*cur_qp, cq, wc, tail,
-                                                       cqe, is_eth);
+                             MLX4_IB_QPT_PROXY_SMI | MLX4_IB_QPT_PROXY_GSI)) {
+                                use_tunnel_data(*cur_qp, cq, wc, tail, cqe,
+                                                is_eth);
+                                return 0;
+                        }
                 }
 
                 wc->slid           = be16_to_cpu(cqe->rlid);
@@ -891,7 +874,6 @@ int mlx4_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         struct mlx4_ib_qp *cur_qp = NULL;
         unsigned long flags;
         int npolled;
-        int err = 0;
         struct mlx4_ib_dev *mdev = to_mdev(cq->ibcq.device);
 
         spin_lock_irqsave(&cq->lock, flags);
@@ -901,8 +883,7 @@ int mlx4_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         }
 
         for (npolled = 0; npolled < num_entries; ++npolled) {
-                err = mlx4_ib_poll_one(cq, &cur_qp, wc + npolled);
-                if (err)
+                if (mlx4_ib_poll_one(cq, &cur_qp, wc + npolled))
                         break;
         }
 
@@ -911,10 +892,7 @@ int mlx4_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
 out:
         spin_unlock_irqrestore(&cq->lock, flags);
 
-        if (err == 0 || err == -EAGAIN)
-                return npolled;
-        else
-                return err;
+        return npolled;
 }
 
 int mlx4_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index 308a358e5b46..e4fac9292e4a 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -553,12 +553,6 @@ repoll:
                  * from the table.
                  */
                 mqp = __mlx5_qp_lookup(dev->mdev, qpn);
-                if (unlikely(!mqp)) {
-                        mlx5_ib_warn(dev, "CQE@CQ %06x for unknown QPN %6x\n",
-                                     cq->mcq.cqn, qpn);
-                        return -EINVAL;
-                }
-
                 *cur_qp = to_mibqp(mqp);
         }
 
@@ -619,13 +613,6 @@ repoll:
                 read_lock(&dev->mdev->priv.mkey_table.lock);
                 mmkey = __mlx5_mr_lookup(dev->mdev,
                                          mlx5_base_mkey(be32_to_cpu(sig_err_cqe->mkey)));
-                if (unlikely(!mmkey)) {
-                        read_unlock(&dev->mdev->priv.mkey_table.lock);
-                        mlx5_ib_warn(dev, "CQE@CQ %06x for unknown MR %6x\n",
-                                     cq->mcq.cqn, be32_to_cpu(sig_err_cqe->mkey));
-                        return -EINVAL;
-                }
-
                 mr = to_mibmr(mmkey);
                 get_sig_err_item(sig_err_cqe, &mr->sig->err_item);
                 mr->sig->sig_err_exists = true;
@@ -676,7 +663,6 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         unsigned long flags;
         int soft_polled = 0;
         int npolled;
-        int err = 0;
 
         spin_lock_irqsave(&cq->lock, flags);
         if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
@@ -688,8 +674,7 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
                 soft_polled = poll_soft_wc(cq, num_entries, wc);
 
         for (npolled = 0; npolled < num_entries - soft_polled; npolled++) {
-                err = mlx5_poll_one(cq, &cur_qp, wc + soft_polled + npolled);
-                if (err)
+                if (mlx5_poll_one(cq, &cur_qp, wc + soft_polled + npolled))
                         break;
         }
 
@@ -698,10 +683,7 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
 out:
         spin_unlock_irqrestore(&cq->lock, flags);
 
-        if (err == 0 || err == -EAGAIN)
-                return soft_polled + npolled;
-        else
-                return err;
+        return soft_polled + npolled;
 }
 
 int mlx5_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index a84bb766fc62..8150ea372c53 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -37,7 +37,6 @@
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/slab.h>
-#include <linux/io-mapping.h>
 #if defined(CONFIG_X86)
 #include <asm/pat.h>
 #endif
@@ -1850,6 +1849,7 @@ static struct ib_flow *mlx5_ib_create_flow(struct ib_qp *qp,
                                            int domain)
 {
         struct mlx5_ib_dev *dev = to_mdev(qp->device);
+        struct mlx5_ib_qp *mqp = to_mqp(qp);
         struct mlx5_ib_flow_handler *handler = NULL;
         struct mlx5_flow_destination *dst = NULL;
         struct mlx5_ib_flow_prio *ft_prio;
@@ -1876,7 +1876,10 @@ static struct ib_flow *mlx5_ib_create_flow(struct ib_qp *qp,
         }
 
         dst->type = MLX5_FLOW_DESTINATION_TYPE_TIR;
-        dst->tir_num = to_mqp(qp)->raw_packet_qp.rq.tirn;
+        if (mqp->flags & MLX5_IB_QP_RSS)
+                dst->tir_num = mqp->rss_qp.tirn;
+        else
+                dst->tir_num = mqp->raw_packet_qp.rq.tirn;
 
         if (flow_attr->type == IB_FLOW_ATTR_NORMAL) {
                 if (flow_attr->flags & IB_FLOW_ATTR_FLAGS_DONT_TRAP)  {
diff --git a/drivers/infiniband/hw/mlx5/mem.c b/drivers/infiniband/hw/mlx5/mem.c
index 40df2cca0609..996b54e366b0 100644
--- a/drivers/infiniband/hw/mlx5/mem.c
+++ b/drivers/infiniband/hw/mlx5/mem.c
@@ -71,7 +71,7 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr, int *count, int *shift,
 
         addr = addr >> page_shift;
         tmp = (unsigned long)addr;
-        m = find_first_bit(&tmp, sizeof(tmp));
+        m = find_first_bit(&tmp, BITS_PER_LONG);
         skip = 1 << m;
         mask = skip - 1;
         i = 0;
@@ -81,7 +81,7 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr, int *count, int *shift,
                 for (k = 0; k < len; k++) {
                         if (!(i & mask)) {
                                 tmp = (unsigned long)pfn;
-                                m = min_t(unsigned long, m, find_first_bit(&tmp, sizeof(tmp)));
+                                m = min_t(unsigned long, m, find_first_bit(&tmp, BITS_PER_LONG));
                                 skip = 1 << m;
                                 mask = skip - 1;
                                 base = pfn;
@@ -89,7 +89,7 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr, int *count, int *shift,
                         } else {
                                 if (base + p != pfn) {
                                         tmp = (unsigned long)p;
-                                        m = find_first_bit(&tmp, sizeof(tmp));
+                                        m = find_first_bit(&tmp, BITS_PER_LONG);
                                         skip = 1 << m;
                                         mask = skip - 1;
                                         base = pfn;
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 372385d0f993..95146f4aa3e3 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -402,6 +402,7 @@ enum mlx5_ib_qp_flags {
         /* QP uses 1 as its source QP number */
         MLX5_IB_QP_SQPN_QP1                     = 1 << 6,
         MLX5_IB_QP_CAP_SCATTER_FCS              = 1 << 7,
+        MLX5_IB_QP_RSS                          = 1 << 8,
 };
 
 struct mlx5_umr_wr {
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 0dd7d93cac95..affc3f6598ca 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1449,6 +1449,7 @@ create_tir:
         kvfree(in);
         /* qpn is reserved for that QP */
         qp->trans_qp.base.mqp.qpn = 0;
+        qp->flags |= MLX5_IB_QP_RSS;
         return 0;
 
 err:
@@ -3658,12 +3659,8 @@ static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
                      struct ib_send_wr *wr, unsigned *idx,
                      int *size, int nreq)
 {
-        int err = 0;
-
-        if (unlikely(mlx5_wq_overflow(&qp->sq, nreq, qp->ibqp.send_cq))) {
-                err = -ENOMEM;
-                return err;
-        }
+        if (unlikely(mlx5_wq_overflow(&qp->sq, nreq, qp->ibqp.send_cq)))
+                return -ENOMEM;
 
         *idx = qp->sq.cur_post & (qp->sq.wqe_cnt - 1);
         *seg = mlx5_get_send_wqe(qp, *idx);
@@ -3679,7 +3676,7 @@ static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
         *seg += sizeof(**ctrl);
         *size = sizeof(**ctrl) / 16;
 
-        return err;
+        return 0;
 }
 
 static void finish_wqe(struct mlx5_ib_qp *qp,
@@ -3758,7 +3755,7 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 num_sge = wr->num_sge;
                 if (unlikely(num_sge > qp->sq.max_gs)) {
                         mlx5_ib_warn(dev, "\n");
-                        err = -ENOMEM;
+                        err = -EINVAL;
                         *bad_wr = wr;
                         goto out;
                 }
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 16740dcb876b..67fc0b6857e1 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -1156,18 +1156,18 @@ static void ocrdma_get_attr(struct ocrdma_dev *dev,
         attr->max_srq =
                 (rsp->max_srq_rpir_qps & OCRDMA_MBX_QUERY_CFG_MAX_SRQ_MASK) >>
                 OCRDMA_MBX_QUERY_CFG_MAX_SRQ_OFFSET;
-        attr->max_send_sge = ((rsp->max_write_send_sge &
+        attr->max_send_sge = ((rsp->max_recv_send_sge &
                                OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_MASK) >>
                               OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_SHIFT);
-        attr->max_recv_sge = (rsp->max_write_send_sge &
-                              OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_MASK) >>
-            OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_SHIFT;
+        attr->max_recv_sge = (rsp->max_recv_send_sge &
+                              OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_MASK) >>
+            OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_SHIFT;
         attr->max_srq_sge = (rsp->max_srq_rqe_sge &
                               OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_MASK) >>
             OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_OFFSET;
-        attr->max_rdma_sge = (rsp->max_write_send_sge &
-                              OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_MASK) >>
-            OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_SHIFT;
+        attr->max_rdma_sge = (rsp->max_wr_rd_sge &
+                              OCRDMA_MBX_QUERY_CFG_MAX_RD_SGE_MASK) >>
+            OCRDMA_MBX_QUERY_CFG_MAX_RD_SGE_SHIFT;
         attr->max_ord_per_qp = (rsp->max_ird_ord_per_qp &
                                 OCRDMA_MBX_QUERY_CFG_MAX_ORD_PER_QP_MASK) >>
             OCRDMA_MBX_QUERY_CFG_MAX_ORD_PER_QP_SHIFT;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
index 0efc9662c6d8..37df4481bb8f 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
@@ -554,9 +554,9 @@ enum {
         OCRDMA_MBX_QUERY_CFG_L3_TYPE_MASK               = 0x18,
         OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_SHIFT         = 0,
         OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_MASK          = 0xFFFF,
-        OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_SHIFT        = 16,
-        OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_MASK         = 0xFFFF <<
-                                OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_SHIFT,
+        OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_SHIFT = 16,
+        OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_MASK          = 0xFFFF <<
+                                OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_SHIFT,
 
         OCRDMA_MBX_QUERY_CFG_MAX_ORD_PER_QP_SHIFT       = 0,
         OCRDMA_MBX_QUERY_CFG_MAX_ORD_PER_QP_MASK        = 0xFFFF,
@@ -612,6 +612,8 @@ enum {
         OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_OFFSET         = 0,
         OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_MASK           = 0xFFFF <<
                                 OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_OFFSET,
+        OCRDMA_MBX_QUERY_CFG_MAX_RD_SGE_SHIFT           = 0,
+        OCRDMA_MBX_QUERY_CFG_MAX_RD_SGE_MASK            = 0xFFFF,
 };
 
 struct ocrdma_mbx_query_config {
@@ -619,7 +621,7 @@ struct ocrdma_mbx_query_config {
         struct ocrdma_mbx_rsp rsp;
         u32 qp_srq_cq_ird_ord;
         u32 max_pd_ca_ack_delay;
-        u32 max_write_send_sge;
+        u32 max_recv_send_sge;
         u32 max_ird_ord_per_qp;
         u32 max_shared_ird_ord;
         u32 max_mr;
@@ -639,6 +641,8 @@ struct ocrdma_mbx_query_config {
         u32 max_wqes_rqes_per_q;
         u32 max_cq_cqes_per_cq;
         u32 max_srq_rqe_sge;
+        u32 max_wr_rd_sge;
+        u32 ird_pgsz_num_pages;
 };
 
 struct ocrdma_fw_ver_rsp {
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index b1a3d91fe8b9..0aa854737e74 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -125,8 +125,8 @@ int ocrdma_query_device(struct ib_device *ibdev, struct ib_device_attr *attr,
                                         IB_DEVICE_SYS_IMAGE_GUID |
                                         IB_DEVICE_LOCAL_DMA_LKEY |
                                         IB_DEVICE_MEM_MGT_EXTENSIONS;
-        attr->max_sge = dev->attr.max_send_sge;
-        attr->max_sge_rd = attr->max_sge;
+        attr->max_sge = min(dev->attr.max_send_sge, dev->attr.max_recv_sge);
+        attr->max_sge_rd = dev->attr.max_rdma_sge;
         attr->max_cq = dev->attr.max_cq;
         attr->max_cqe = dev->attr.max_cqe;
         attr->max_mr = dev->attr.max_mr;
diff --git a/drivers/infiniband/hw/qib/qib_debugfs.c b/drivers/infiniband/hw/qib/qib_debugfs.c
index 5e75b43c596b..5bad8e3b40bb 100644
--- a/drivers/infiniband/hw/qib/qib_debugfs.c
+++ b/drivers/infiniband/hw/qib/qib_debugfs.c
@@ -189,27 +189,32 @@ static int _ctx_stats_seq_show(struct seq_file *s, void *v)
 DEBUGFS_FILE(ctx_stats)
 
 static void *_qp_stats_seq_start(struct seq_file *s, loff_t *pos)
+        __acquires(RCU)
 {
         struct qib_qp_iter *iter;
         loff_t n = *pos;
 
-        rcu_read_lock();
         iter = qib_qp_iter_init(s->private);
+
+        /* stop calls rcu_read_unlock */
+        rcu_read_lock();
+
         if (!iter)
                 return NULL;
 
-        while (n--) {
+        do {
                 if (qib_qp_iter_next(iter)) {
                         kfree(iter);
                         return NULL;
                 }
-        }
+        } while (n--);
 
         return iter;
 }
 
 static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
                                    loff_t *pos)
+        __must_hold(RCU)
 {
         struct qib_qp_iter *iter = iter_ptr;
 
@@ -224,6 +229,7 @@ static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
 }
 
 static void _qp_stats_seq_stop(struct seq_file *s, void *iter_ptr)
+        __releases(RCU)
 {
         rcu_read_unlock();
 }
diff --git a/drivers/infiniband/hw/qib/qib_fs.c b/drivers/infiniband/hw/qib/qib_fs.c
index fcdf37913a26..c3edc033f7c4 100644
--- a/drivers/infiniband/hw/qib/qib_fs.c
+++ b/drivers/infiniband/hw/qib/qib_fs.c
@@ -328,26 +328,12 @@ static ssize_t flash_write(struct file *file, const char __user *buf,
 
         pos = *ppos;
 
-        if (pos != 0) {
-                ret = -EINVAL;
-                goto bail;
-        }
-
-        if (count != sizeof(struct qib_flash)) {
-                ret = -EINVAL;
-                goto bail;
-        }
-
-        tmp = kmalloc(count, GFP_KERNEL);
-        if (!tmp) {
-                ret = -ENOMEM;
-                goto bail;
-        }
+        if (pos != 0 || count != sizeof(struct qib_flash))
+                return -EINVAL;
 
-        if (copy_from_user(tmp, buf, count)) {
-                ret = -EFAULT;
-                goto bail_tmp;
-        }
+        tmp = memdup_user(buf, count);
+        if (IS_ERR(tmp))
+                return PTR_ERR(tmp);
 
         dd = private2dd(file);
         if (qib_eeprom_write(dd, pos, tmp, count)) {
@@ -361,8 +347,6 @@ static ssize_t flash_write(struct file *file, const char __user *buf,
 
 bail_tmp:
         kfree(tmp);
-
-bail:
         return ret;
 }
 
diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
index 9cc0aae1d781..f9b8cd2354d1 100644
--- a/drivers/infiniband/hw/qib/qib_qp.c
+++ b/drivers/infiniband/hw/qib/qib_qp.c
@@ -573,10 +573,6 @@ struct qib_qp_iter *qib_qp_iter_init(struct qib_ibdev *dev)
                 return NULL;
 
         iter->dev = dev;
-        if (qib_qp_iter_next(iter)) {
-                kfree(iter);
-                return NULL;
-        }
 
         return iter;
 }
diff --git a/drivers/infiniband/hw/usnic/usnic_ib_main.c b/drivers/infiniband/hw/usnic/usnic_ib_main.c
index c229b9f4a52d..0a89a955550b 100644
--- a/drivers/infiniband/hw/usnic/usnic_ib_main.c
+++ b/drivers/infiniband/hw/usnic/usnic_ib_main.c
@@ -664,7 +664,8 @@ static int __init usnic_ib_init(void)
                 return err;
         }
 
-        if (pci_register_driver(&usnic_ib_pci_driver)) {
+        err = pci_register_driver(&usnic_ib_pci_driver);
+        if (err) {
                 usnic_err("Unable to register with PCI\n");
                 goto out_umem_fini;
         }
diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index bdb540f25a88..870b4f212fbc 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -873,7 +873,8 @@ bail_qpn:
         free_qpn(&rdi->qp_dev->qpn_table, qp->ibqp.qp_num);
 
 bail_rq_wq:
-        vfree(qp->r_rq.wq);
+        if (!qp->ip)
+                vfree(qp->r_rq.wq);
 
 bail_driver_priv:
         rdi->driver_f.qp_priv_free(rdi, qp);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 4f7d9b48df64..9dbfcc0ab577 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -478,6 +478,7 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                 struct ipoib_ah *address, u32 qpn);
 void ipoib_reap_ah(struct work_struct *work);
 
+struct ipoib_path *__path_find(struct net_device *dev, void *gid);
 void ipoib_mark_paths_invalid(struct net_device *dev);
 void ipoib_flush_paths(struct net_device *dev);
 int ipoib_check_sm_sendonly_fullmember_support(struct ipoib_dev_priv *priv);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 951d9abcca8b..4ad297d3de89 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1318,6 +1318,8 @@ void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx)
         }
 }
 
+#define QPN_AND_OPTIONS_OFFSET  4
+
 static void ipoib_cm_tx_start(struct work_struct *work)
 {
         struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
@@ -1326,6 +1328,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
         struct ipoib_neigh *neigh;
         struct ipoib_cm_tx *p;
         unsigned long flags;
+        struct ipoib_path *path;
         int ret;
 
         struct ib_sa_path_rec pathrec;
@@ -1338,7 +1341,19 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                 p = list_entry(priv->cm.start_list.next, typeof(*p), list);
                 list_del_init(&p->list);
                 neigh = p->neigh;
+
                 qpn = IPOIB_QPN(neigh->daddr);
+                /*
+                 * As long as the search is with these 2 locks,
+                 * path existence indicates its validity.
+                 */
+                path = __path_find(dev, neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+                if (!path) {
+                        pr_info("%s ignore not valid path %pI6\n",
+                                __func__,
+                                neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+                        goto free_neigh;
+                }
                 memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);
 
                 spin_unlock_irqrestore(&priv->lock, flags);
@@ -1350,6 +1365,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                 spin_lock_irqsave(&priv->lock, flags);
 
                 if (ret) {
+free_neigh:
                         neigh = p->neigh;
                         if (neigh) {
                                 neigh->cm = NULL;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 74bcaa064226..cc1c1b062ea5 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -485,7 +485,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
         return -EINVAL;
 }
 
-static struct ipoib_path *__path_find(struct net_device *dev, void *gid)
+struct ipoib_path *__path_find(struct net_device *dev, void *gid)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct rb_node *n = priv->path_tree.rb_node;
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index ba6be060a476..cae9bbcc27e7 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -403,6 +403,7 @@ isert_init_conn(struct isert_conn *isert_conn)
         INIT_LIST_HEAD(&isert_conn->node);
         init_completion(&isert_conn->login_comp);
         init_completion(&isert_conn->login_req_comp);
+        init_waitqueue_head(&isert_conn->rem_wait);
         kref_init(&isert_conn->kref);
         mutex_init(&isert_conn->mutex);
         INIT_WORK(&isert_conn->release_work, isert_release_work);
@@ -448,7 +449,7 @@ isert_alloc_login_buf(struct isert_conn *isert_conn,
 
         isert_conn->login_rsp_buf = kzalloc(ISER_RX_PAYLOAD_SIZE, GFP_KERNEL);
         if (!isert_conn->login_rsp_buf) {
-                isert_err("Unable to allocate isert_conn->login_rspbuf\n");
+                ret = -ENOMEM;
                 goto out_unmap_login_req_buf;
         }
 
@@ -578,7 +579,8 @@ isert_connect_release(struct isert_conn *isert_conn)
         BUG_ON(!device);
 
         isert_free_rx_descriptors(isert_conn);
-        if (isert_conn->cm_id)
+        if (isert_conn->cm_id &&
+            !isert_conn->dev_removed)
                 rdma_destroy_id(isert_conn->cm_id);
 
         if (isert_conn->qp) {
@@ -593,7 +595,10 @@ isert_connect_release(struct isert_conn *isert_conn)
 
         isert_device_put(device);
 
-        kfree(isert_conn);
+        if (isert_conn->dev_removed)
+                wake_up_interruptible(&isert_conn->rem_wait);
+        else
+                kfree(isert_conn);
 }
 
 static void
@@ -753,6 +758,7 @@ static int
 isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
 {
         struct isert_np *isert_np = cma_id->context;
+        struct isert_conn *isert_conn;
         int ret = 0;
 
         isert_info("%s (%d): status %d id %p np %p\n",
@@ -773,10 +779,21 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                 break;
         case RDMA_CM_EVENT_ADDR_CHANGE:    /* FALLTHRU */
         case RDMA_CM_EVENT_DISCONNECTED:   /* FALLTHRU */
-        case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */
         case RDMA_CM_EVENT_TIMEWAIT_EXIT:  /* FALLTHRU */
                 ret = isert_disconnected_handler(cma_id, event->event);
                 break;
+        case RDMA_CM_EVENT_DEVICE_REMOVAL:
+                isert_conn = cma_id->qp->qp_context;
+                isert_conn->dev_removed = true;
+                isert_disconnected_handler(cma_id, event->event);
+                wait_event_interruptible(isert_conn->rem_wait,
+                                         isert_conn->state == ISER_CONN_DOWN);
+                kfree(isert_conn);
+                /*
+                 * return non-zero from the callback to destroy
+                 * the rdma cm id
+                 */
+                return 1;
         case RDMA_CM_EVENT_REJECTED:       /* FALLTHRU */
         case RDMA_CM_EVENT_UNREACHABLE:    /* FALLTHRU */
         case RDMA_CM_EVENT_CONNECT_ERROR:
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index fc791efe3a10..c02ada57d7f5 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -158,6 +158,8 @@ struct isert_conn {
         struct work_struct      release_work;
         bool                    logout_posted;
         bool                    snd_w_inv;
+        wait_queue_head_t       rem_wait;
+        bool                    dev_removed;
 };
 
 #define ISERT_MAX_CQ 64
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index dfa23b075a88..883bbfe08e0e 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -522,6 +522,11 @@ static int srpt_refresh_port(struct srpt_port *sport)
         if (ret)
                 goto err_query_port;
 
+        snprintf(sport->port_guid, sizeof(sport->port_guid),
+                "0x%016llx%016llx",
+                be64_to_cpu(sport->gid.global.subnet_prefix),
+                be64_to_cpu(sport->gid.global.interface_id));
+
         if (!sport->mad_agent) {
                 memset(&reg_req, 0, sizeof(reg_req));
                 reg_req.mgmt_class = IB_MGMT_CLASS_DEVICE_MGMT;
@@ -2548,10 +2553,6 @@ static void srpt_add_one(struct ib_device *device)
                                sdev->device->name, i);
                         goto err_ring;
                 }
-                snprintf(sport->port_guid, sizeof(sport->port_guid),
-                        "0x%016llx%016llx",
-                        be64_to_cpu(sport->gid.global.subnet_prefix),
-                        be64_to_cpu(sport->gid.global.interface_id));
         }
 
         spin_lock(&srpt_dev_lock);
diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c
index 7d61439be5f2..0c07e1023a46 100644
--- a/drivers/input/keyboard/tegra-kbc.c
+++ b/drivers/input/keyboard/tegra-kbc.c
@@ -376,7 +376,7 @@ static int tegra_kbc_start(struct tegra_kbc *kbc)
         /* Reset the KBC controller to clear all previous status.*/
         reset_control_assert(kbc->rst);
         udelay(100);
-        reset_control_assert(kbc->rst);
+        reset_control_deassert(kbc->rst);
         udelay(100);
 
         tegra_kbc_config_pins(kbc);
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index faa295ec4f31..c83bce89028b 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -553,7 +553,6 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
                 goto free_struct_buff;
 
         reg = find_first_bit(rdesc->presense_map, RMI_REG_DESC_PRESENSE_BITS);
-        map_offset = 0;
         for (i = 0; i < rdesc->num_registers; i++) {
                 struct rmi_register_desc_item *item = &rdesc->registers[i];
                 int reg_size = struct_buf[offset];
@@ -576,6 +575,8 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
                 item->reg = reg;
                 item->reg_size = reg_size;
 
+                map_offset = 0;
+
                 do {
                         for (b = 0; b < 7; b++) {
                                 if (struct_buf[offset] & (0x1 << b))
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index b4d34086e73f..405252a884dd 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -1305,6 +1305,7 @@ static int __init i8042_create_aux_port(int idx)
         serio->write            = i8042_aux_write;
         serio->start            = i8042_start;
         serio->stop             = i8042_stop;
+        serio->ps2_cmd_mutex    = &i8042_mutex;
         serio->port_data        = port;
         serio->dev.parent       = &i8042_platform_device->dev;
         if (idx < 0) {
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index a61b2153ab8c..1ce3ecbe37f8 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -1473,7 +1473,6 @@ static int ads7846_remove(struct spi_device *spi)
 
         ads784x_hwmon_unregister(spi, ts);
 
-        regulator_disable(ts->reg);
         regulator_put(ts->reg);
 
         if (!ts->get_pendown_state) {
diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c
index 7379fe153cf9..b2744a64e933 100644
--- a/drivers/input/touchscreen/silead.c
+++ b/drivers/input/touchscreen/silead.c
@@ -464,7 +464,7 @@ static int silead_ts_probe(struct i2c_client *client,
                 return -ENODEV;
 
         /* Power GPIO pin */
-        data->gpio_power = gpiod_get_optional(dev, "power", GPIOD_OUT_LOW);
+        data->gpio_power = devm_gpiod_get_optional(dev, "power", GPIOD_OUT_LOW);
         if (IS_ERR(data->gpio_power)) {
                 if (PTR_ERR(data->gpio_power) != -EPROBE_DEFER)
                         dev_err(dev, "Shutdown GPIO request failed\n");
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index ce801170d5f2..641e88761319 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -879,7 +879,7 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
          * We may have concurrent producers, so we need to be careful
          * not to touch any of the shadow cmdq state.
          */
-        queue_read(cmd, Q_ENT(q, idx), q->ent_dwords);
+        queue_read(cmd, Q_ENT(q, cons), q->ent_dwords);
         dev_err(smmu->dev, "skipping command in error state:\n");
         for (i = 0; i < ARRAY_SIZE(cmd); ++i)
                 dev_err(smmu->dev, "\t0x%016llx\n", (unsigned long long)cmd[i]);
@@ -890,7 +890,7 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
                 return;
         }
 
-        queue_write(cmd, Q_ENT(q, idx), q->ent_dwords);
+        queue_write(Q_ENT(q, cons), cmd, q->ent_dwords);
 }
 
 static void arm_smmu_cmdq_issue_cmd(struct arm_smmu_device *smmu,
@@ -1034,6 +1034,9 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid,
                 case STRTAB_STE_0_CFG_S2_TRANS:
                         ste_live = true;
                         break;
+                case STRTAB_STE_0_CFG_ABORT:
+                        if (disable_bypass)
+                                break;
                 default:
                         BUG(); /* STE corruption */
                 }
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index 4f49fe29f202..2db74ebc3240 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -686,8 +686,7 @@ static struct iommu_gather_ops arm_smmu_gather_ops = {
 
 static irqreturn_t arm_smmu_context_fault(int irq, void *dev)
 {
-        int flags, ret;
-        u32 fsr, fsynr, resume;
+        u32 fsr, fsynr;
         unsigned long iova;
         struct iommu_domain *domain = dev;
         struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
@@ -701,34 +700,15 @@ static irqreturn_t arm_smmu_context_fault(int irq, void *dev)
         if (!(fsr & FSR_FAULT))
                 return IRQ_NONE;
 
-        if (fsr & FSR_IGN)
-                dev_err_ratelimited(smmu->dev,
-                                    "Unexpected context fault (fsr 0x%x)\n",
-                                    fsr);
-
         fsynr = readl_relaxed(cb_base + ARM_SMMU_CB_FSYNR0);
-        flags = fsynr & FSYNR0_WNR ? IOMMU_FAULT_WRITE : IOMMU_FAULT_READ;
-
         iova = readq_relaxed(cb_base + ARM_SMMU_CB_FAR);
-        if (!report_iommu_fault(domain, smmu->dev, iova, flags)) {
-                ret = IRQ_HANDLED;
-                resume = RESUME_RETRY;
-        } else {
-                dev_err_ratelimited(smmu->dev,
-                    "Unhandled context fault: iova=0x%08lx, fsynr=0x%x, cb=%d\n",
-                    iova, fsynr, cfg->cbndx);
-                ret = IRQ_NONE;
-                resume = RESUME_TERMINATE;
-        }
-
-        /* Clear the faulting FSR */
-        writel(fsr, cb_base + ARM_SMMU_CB_FSR);
 
-        /* Retry or terminate any stalled transactions */
-        if (fsr & FSR_SS)
-                writel_relaxed(resume, cb_base + ARM_SMMU_CB_RESUME);
+        dev_err_ratelimited(smmu->dev,
+        "Unhandled context fault: fsr=0x%x, iova=0x%08lx, fsynr=0x%x, cb=%d\n",
+                            fsr, iova, fsynr, cfg->cbndx);
 
-        return ret;
+        writel(fsr, cb_base + ARM_SMMU_CB_FSR);
+        return IRQ_HANDLED;
 }
 
 static irqreturn_t arm_smmu_global_fault(int irq, void *dev)
@@ -837,7 +817,7 @@ static void arm_smmu_init_context_bank(struct arm_smmu_domain *smmu_domain,
         }
 
         /* SCTLR */
-        reg = SCTLR_CFCFG | SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP;
+        reg = SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP;
         if (stage1)
                 reg |= SCTLR_S1_ASIDPNE;
 #ifdef __BIG_ENDIAN
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
index 8c6139986d7d..def8ca1c982d 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -286,12 +286,14 @@ static int arm_v7s_pte_to_prot(arm_v7s_iopte pte, int lvl)
         int prot = IOMMU_READ;
         arm_v7s_iopte attr = pte >> ARM_V7S_ATTR_SHIFT(lvl);
 
-        if (attr & ARM_V7S_PTE_AP_RDONLY)
+        if (!(attr & ARM_V7S_PTE_AP_RDONLY))
                 prot |= IOMMU_WRITE;
         if ((attr & (ARM_V7S_TEX_MASK << ARM_V7S_TEX_SHIFT)) == 0)
                 prot |= IOMMU_MMIO;
         else if (pte & ARM_V7S_ATTR_C)
                 prot |= IOMMU_CACHE;
+        if (pte & ARM_V7S_ATTR_XN(lvl))
+                prot |= IOMMU_NOEXEC;
 
         return prot;
 }
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 7ceaba81efb4..36b9c28a5c91 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1545,7 +1545,12 @@ static int its_force_quiescent(void __iomem *base)
         u32 val;
 
         val = readl_relaxed(base + GITS_CTLR);
-        if (val & GITS_CTLR_QUIESCENT)
+        /*
+         * GIC architecture specification requires the ITS to be both
+         * disabled and quiescent for writes to GITS_BASER<n> or
+         * GITS_CBASER to not have UNPREDICTABLE results.
+         */
+        if ((val & GITS_CTLR_QUIESCENT) && !(val & GITS_CTLR_ENABLE))
                 return 0;
 
         /* Disable the generation of all interrupts to this ITS */
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 6fc56c3466b0..ede5672ab34d 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -667,13 +667,20 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
 #endif
 
 #ifdef CONFIG_CPU_PM
+/* Check whether it's single security state view */
+static bool gic_dist_security_disabled(void)
+{
+        return readl_relaxed(gic_data.dist_base + GICD_CTLR) & GICD_CTLR_DS;
+}
+
 static int gic_cpu_pm_notifier(struct notifier_block *self,
                                unsigned long cmd, void *v)
 {
         if (cmd == CPU_PM_EXIT) {
-                gic_enable_redist(true);
+                if (gic_dist_security_disabled())
+                        gic_enable_redist(true);
                 gic_cpu_sys_reg_init();
-        } else if (cmd == CPU_PM_ENTER) {
+        } else if (cmd == CPU_PM_ENTER && gic_dist_security_disabled()) {
                 gic_write_grpen1(0);
                 gic_enable_redist(false);
         }
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index c2cab572c511..390fac59c6bc 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -769,6 +769,13 @@ static void gic_raise_softirq(const struct cpumask *mask, unsigned int irq)
         int cpu;
         unsigned long flags, map = 0;
 
+        if (unlikely(nr_cpu_ids == 1)) {
+                /* Only one CPU? let's do a self-IPI... */
+                writel_relaxed(2 << 24 | irq,
+                               gic_data_dist_base(&gic_data[0]) + GIC_DIST_SOFTINT);
+                return;
+        }
+
         raw_spin_lock_irqsave(&irq_controller_lock, flags);
 
         /* Convert our logical CPU mask into a physical one. */
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index c5f33c3bd228..83f498393a7f 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -713,9 +713,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
         unsigned long flags;
         int i;
 
-        irq_set_chip_and_handler(virq, &gic_level_irq_controller,
-                                 handle_level_irq);
-
         spin_lock_irqsave(&gic_lock, flags);
         gic_map_to_pin(intr, gic_cpu_pin);
         gic_map_to_vpe(intr, mips_cm_vp_id(vpe));
@@ -732,6 +729,10 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq,
 {
         if (GIC_HWIRQ_TO_LOCAL(hw) < GIC_NUM_LOCAL_INTRS)
                 return gic_local_irq_domain_map(d, virq, hw);
+
+        irq_set_chip_and_handler(virq, &gic_level_irq_controller,
+                                 handle_level_irq);
+
         return gic_shared_irq_domain_map(d, virq, hw, 0);
 }
 
@@ -771,11 +772,13 @@ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq,
                         hwirq = GIC_SHARED_TO_HWIRQ(base_hwirq + i);
 
                         ret = irq_domain_set_hwirq_and_chip(d, virq + i, hwirq,
-                                                            &gic_edge_irq_controller,
+                                                            &gic_level_irq_controller,
                                                             NULL);
                         if (ret)
                                 goto error;
 
+                        irq_set_handler(virq + i, handle_level_irq);
+
                         ret = gic_shared_irq_domain_map(d, virq + i, hwirq, cpu);
                         if (ret)
                                 goto error;
@@ -890,10 +893,17 @@ void gic_dev_domain_free(struct irq_domain *d, unsigned int virq,
         return;
 }
 
+static void gic_dev_domain_activate(struct irq_domain *domain,
+                                    struct irq_data *d)
+{
+        gic_shared_irq_domain_map(domain, d->irq, d->hwirq, 0);
+}
+
 static struct irq_domain_ops gic_dev_domain_ops = {
         .xlate = gic_dev_domain_xlate,
         .alloc = gic_dev_domain_alloc,
         .free = gic_dev_domain_free,
+        .activate = gic_dev_domain_activate,
 };
 
 static int gic_ipi_domain_xlate(struct irq_domain *d, struct device_node *ctrlr,
diff --git a/drivers/macintosh/ams/ams-i2c.c b/drivers/macintosh/ams/ams-i2c.c
index 978eda8d6678..8a3ba565106f 100644
--- a/drivers/macintosh/ams/ams-i2c.c
+++ b/drivers/macintosh/ams/ams-i2c.c
@@ -73,7 +73,6 @@ MODULE_DEVICE_TABLE(i2c, ams_id);
 static struct i2c_driver ams_i2c_driver = {
         .driver = {
                 .name   = "ams",
-                .owner  = THIS_MODULE,
         },
         .probe          = ams_i2c_probe,
         .remove         = ams_i2c_remove,
diff --git a/drivers/macintosh/windfarm_pm112.c b/drivers/macintosh/windfarm_pm112.c
index 3024685e4cca..96d16fca68b2 100644
--- a/drivers/macintosh/windfarm_pm112.c
+++ b/drivers/macintosh/windfarm_pm112.c
@@ -668,7 +668,6 @@ static struct platform_driver wf_pm112_driver = {
         .remove = wf_pm112_remove,
         .driver = {
                 .name = "windfarm",
-                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/macintosh/windfarm_pm72.c b/drivers/macintosh/windfarm_pm72.c
index 2f506b9d5a52..e88cfb36a74d 100644
--- a/drivers/macintosh/windfarm_pm72.c
+++ b/drivers/macintosh/windfarm_pm72.c
@@ -789,7 +789,6 @@ static struct platform_driver wf_pm72_driver = {
         .remove = wf_pm72_remove,
         .driver = {
                 .name = "windfarm",
-                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/macintosh/windfarm_rm31.c b/drivers/macintosh/windfarm_rm31.c
index 82fc86a90c1a..bdfcb8a8bfbb 100644
--- a/drivers/macintosh/windfarm_rm31.c
+++ b/drivers/macintosh/windfarm_rm31.c
@@ -682,7 +682,6 @@ static struct platform_driver wf_rm31_driver = {
         .remove = wf_rm31_remove,
         .driver = {
                 .name = "windfarm",
-                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/mailbox/Kconfig b/drivers/mailbox/Kconfig
index 97c372908e78..7817d40d81e7 100644
--- a/drivers/mailbox/Kconfig
+++ b/drivers/mailbox/Kconfig
@@ -127,6 +127,7 @@ config XGENE_SLIMPRO_MBOX
 config BCM_PDC_MBOX
         tristate "Broadcom PDC Mailbox"
         depends on ARM64 || COMPILE_TEST
+        depends on HAS_DMA
         default ARCH_BCM_IPROC
         help
           Mailbox implementation for the Broadcom PDC ring manager,
diff --git a/drivers/mailbox/bcm-pdc-mailbox.c b/drivers/mailbox/bcm-pdc-mailbox.c
index cbe0c1ee4ba9..c19dd820ea9b 100644
--- a/drivers/mailbox/bcm-pdc-mailbox.c
+++ b/drivers/mailbox/bcm-pdc-mailbox.c
@@ -469,7 +469,7 @@ static const struct file_operations pdc_debugfs_stats = {
  * this directory for a SPU.
  * @pdcs: PDC state structure
  */
-void pdc_setup_debugfs(struct pdc_state *pdcs)
+static void pdc_setup_debugfs(struct pdc_state *pdcs)
 {
         char spu_stats_name[16];
 
@@ -485,7 +485,7 @@ void pdc_setup_debugfs(struct pdc_state *pdcs)
                                                   &pdc_debugfs_stats);
 }
 
-void pdc_free_debugfs(void)
+static void pdc_free_debugfs(void)
 {
         if (debugfs_dir && simple_empty(debugfs_dir)) {
                 debugfs_remove_recursive(debugfs_dir);
@@ -1191,10 +1191,11 @@ static void pdc_shutdown(struct mbox_chan *chan)
 {
         struct pdc_state *pdcs = chan->con_priv;
 
-        if (pdcs)
-                dev_dbg(&pdcs->pdev->dev,
-                        "Shutdown mailbox channel for PDC %u", pdcs->pdc_idx);
+        if (!pdcs)
+                return;
 
+        dev_dbg(&pdcs->pdev->dev,
+                "Shutdown mailbox channel for PDC %u", pdcs->pdc_idx);
         pdc_ring_free(pdcs);
 }
 
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 95a4ca6ce6ff..849ad441cd76 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -760,7 +760,8 @@ static int bcache_device_init(struct bcache_device *d, unsigned block_size,
         if (!d->nr_stripes ||
             d->nr_stripes > INT_MAX ||
             d->nr_stripes > SIZE_MAX / sizeof(atomic_t)) {
-                pr_err("nr_stripes too large");
+                pr_err("nr_stripes too large or invalid: %u (start sector beyond end of disk?)",
+                        (unsigned)d->nr_stripes);
                 return -ENOMEM;
         }
 
@@ -1820,7 +1821,7 @@ static int cache_alloc(struct cache *ca)
         free = roundup_pow_of_two(ca->sb.nbuckets) >> 10;
 
         if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) ||
-            !init_fifo(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
+            !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
             !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) ||
             !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) ||
             !init_fifo(&ca->free_inc,   free << 2, GFP_KERNEL) ||
@@ -1844,7 +1845,7 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
                                 struct block_device *bdev, struct cache *ca)
 {
         char name[BDEVNAME_SIZE];
-        const char *err = NULL;
+        const char *err = NULL; /* must be set for any error case */
         int ret = 0;
 
         memcpy(&ca->sb, sb, sizeof(struct cache_sb));
@@ -1861,8 +1862,13 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
                 ca->discard = CACHE_DISCARD(&ca->sb);
 
         ret = cache_alloc(ca);
-        if (ret != 0)
+        if (ret != 0) {
+                if (ret == -ENOMEM)
+                        err = "cache_alloc(): -ENOMEM";
+                else
+                        err = "cache_alloc(): unknown error";
                 goto err;
+        }
 
         if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) {
                 err = "error calling kobject_add";
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 6fff794e0c72..13041ee37ad6 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -2183,19 +2183,29 @@ location_show(struct mddev *mddev, char *page)
 static ssize_t
 location_store(struct mddev *mddev, const char *buf, size_t len)
 {
+        int rv;
 
+        rv = mddev_lock(mddev);
+        if (rv)
+                return rv;
         if (mddev->pers) {
-                if (!mddev->pers->quiesce)
-                        return -EBUSY;
-                if (mddev->recovery || mddev->sync_thread)
-                        return -EBUSY;
+                if (!mddev->pers->quiesce) {
+                        rv = -EBUSY;
+                        goto out;
+                }
+                if (mddev->recovery || mddev->sync_thread) {
+                        rv = -EBUSY;
+                        goto out;
+                }
         }
 
         if (mddev->bitmap || mddev->bitmap_info.file ||
             mddev->bitmap_info.offset) {
                 /* bitmap already configured.  Only option is to clear it */
-                if (strncmp(buf, "none", 4) != 0)
-                        return -EBUSY;
+                if (strncmp(buf, "none", 4) != 0) {
+                        rv = -EBUSY;
+                        goto out;
+                }
                 if (mddev->pers) {
                         mddev->pers->quiesce(mddev, 1);
                         bitmap_destroy(mddev);
@@ -2214,21 +2224,25 @@ location_store(struct mddev *mddev, const char *buf, size_t len)
                         /* nothing to be done */;
                 else if (strncmp(buf, "file:", 5) == 0) {
                         /* Not supported yet */
-                        return -EINVAL;
+                        rv = -EINVAL;
+                        goto out;
                 } else {
-                        int rv;
                         if (buf[0] == '+')
                                 rv = kstrtoll(buf+1, 10, &offset);
                         else
                                 rv = kstrtoll(buf, 10, &offset);
                         if (rv)
-                                return rv;
-                        if (offset == 0)
-                                return -EINVAL;
+                                goto out;
+                        if (offset == 0) {
+                                rv = -EINVAL;
+                                goto out;
+                        }
                         if (mddev->bitmap_info.external == 0 &&
                             mddev->major_version == 0 &&
-                            offset != mddev->bitmap_info.default_offset)
-                                return -EINVAL;
+                            offset != mddev->bitmap_info.default_offset) {
+                                rv = -EINVAL;
+                                goto out;
+                        }
                         mddev->bitmap_info.offset = offset;
                         if (mddev->pers) {
                                 struct bitmap *bitmap;
@@ -2245,7 +2259,7 @@ location_store(struct mddev *mddev, const char *buf, size_t len)
                                 mddev->pers->quiesce(mddev, 0);
                                 if (rv) {
                                         bitmap_destroy(mddev);
-                                        return rv;
+                                        goto out;
                                 }
                         }
                 }
@@ -2257,6 +2271,11 @@ location_store(struct mddev *mddev, const char *buf, size_t len)
                 set_bit(MD_CHANGE_DEVS, &mddev->flags);
                 md_wakeup_thread(mddev->thread);
         }
+        rv = 0;
+out:
+        mddev_unlock(mddev);
+        if (rv)
+                return rv;
         return len;
 }
 
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 6571c81465e1..8625040bae92 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1879,7 +1879,7 @@ static int __init dm_bufio_init(void)
         __cache_size_refresh();
         mutex_unlock(&dm_bufio_clients_lock);
 
-        dm_bufio_wq = create_singlethread_workqueue("dm_bufio_cache");
+        dm_bufio_wq = alloc_workqueue("dm_bufio_cache", WQ_MEM_RECLAIM, 0);
         if (!dm_bufio_wq)
                 return -ENOMEM;
 
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index eedba67b0e3e..874295757caa 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1453,7 +1453,7 @@ static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode)
         unsigned i;
         int err;
 
-        cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_skcipher *),
+        cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_skcipher *),
                            GFP_KERNEL);
         if (!cc->tfms)
                 return -ENOMEM;
@@ -1924,6 +1924,13 @@ static int crypt_map(struct dm_target *ti, struct bio *bio)
                 return DM_MAPIO_REMAPPED;
         }
 
+        /*
+         * Check if bio is too large, split as needed.
+         */
+        if (unlikely(bio->bi_iter.bi_size > (BIO_MAX_PAGES << PAGE_SHIFT)) &&
+            bio_data_dir(bio) == WRITE)
+                dm_accept_partial_bio(bio, ((BIO_MAX_PAGES << PAGE_SHIFT) >> SECTOR_SHIFT));
+
         io = dm_per_bio_data(bio, cc->per_bio_data_size);
         crypt_io_init(io, cc, bio, dm_target_offset(ti, bio->bi_iter.bi_sector));
         io->ctx.req = (struct skcipher_request *)(io + 1);
diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
index 97e446d54a15..6a2e8dd44a1b 100644
--- a/drivers/md/dm-flakey.c
+++ b/drivers/md/dm-flakey.c
@@ -289,15 +289,13 @@ static int flakey_map(struct dm_target *ti, struct bio *bio)
                 pb->bio_submitted = true;
 
                 /*
-                 * Map reads as normal only if corrupt_bio_byte set.
+                 * Error reads if neither corrupt_bio_byte or drop_writes are set.
+                 * Otherwise, flakey_end_io() will decide if the reads should be modified.
                  */
                 if (bio_data_dir(bio) == READ) {
-                        /* If flags were specified, only corrupt those that match. */
-                        if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
-                            all_corrupt_bio_flags_match(bio, fc))
-                                goto map_bio;
-                        else
+                        if (!fc->corrupt_bio_byte && !test_bit(DROP_WRITES, &fc->flags))
                                 return -EIO;
+                        goto map_bio;
                 }
 
                 /*
@@ -334,14 +332,21 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, int error)
         struct flakey_c *fc = ti->private;
         struct per_bio_data *pb = dm_per_bio_data(bio, sizeof(struct per_bio_data));
 
-        /*
-         * Corrupt successful READs while in down state.
-         */
         if (!error && pb->bio_submitted && (bio_data_dir(bio) == READ)) {
-                if (fc->corrupt_bio_byte)
+                if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
+                    all_corrupt_bio_flags_match(bio, fc)) {
+                        /*
+                         * Corrupt successful matching READs while in down state.
+                         */
                         corrupt_bio_data(bio, fc);
-                else
+
+                } else if (!test_bit(DROP_WRITES, &fc->flags)) {
+                        /*
+                         * Error read during the down_interval if drop_writes
+                         * wasn't configured.
+                         */
                         return -EIO;
+                }
         }
 
         return error;
diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c
index 4ab68033f9d1..49e4d8d4558f 100644
--- a/drivers/md/dm-log-writes.c
+++ b/drivers/md/dm-log-writes.c
@@ -259,12 +259,12 @@ static int log_one_block(struct log_writes_c *lc,
                 goto out;
         sector++;
 
-        bio = bio_alloc(GFP_KERNEL, block->vec_cnt);
+        atomic_inc(&lc->io_blocks);
+        bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt, BIO_MAX_PAGES));
         if (!bio) {
                 DMERR("Couldn't alloc log bio");
                 goto error;
         }
-        atomic_inc(&lc->io_blocks);
         bio->bi_iter.bi_size = 0;
         bio->bi_iter.bi_sector = sector;
         bio->bi_bdev = lc->logdev->bdev;
@@ -282,7 +282,7 @@ static int log_one_block(struct log_writes_c *lc,
                 if (ret != block->vecs[i].bv_len) {
                         atomic_inc(&lc->io_blocks);
                         submit_bio(bio);
-                        bio = bio_alloc(GFP_KERNEL, block->vec_cnt - i);
+                        bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt - i, BIO_MAX_PAGES));
                         if (!bio) {
                                 DMERR("Couldn't alloc log bio");
                                 goto error;
@@ -459,9 +459,9 @@ static int log_writes_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 goto bad;
         }
 
-        ret = -EINVAL;
         lc->log_kthread = kthread_run(log_writes_kthread, lc, "log-write");
-        if (!lc->log_kthread) {
+        if (IS_ERR(lc->log_kthread)) {
+                ret = PTR_ERR(lc->log_kthread);
                 ti->error = "Couldn't alloc kthread";
                 dm_put_device(ti, lc->dev);
                 dm_put_device(ti, lc->logdev);
diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
index 4ca2d1df5b44..07fc1ad42ec5 100644
--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -291,9 +291,10 @@ static void header_from_disk(struct log_header_core *core, struct log_header_dis
         core->nr_regions = le64_to_cpu(disk->nr_regions);
 }
 
-static int rw_header(struct log_c *lc, int rw)
+static int rw_header(struct log_c *lc, int op)
 {
-        lc->io_req.bi_op = rw;
+        lc->io_req.bi_op = op;
+        lc->io_req.bi_op_flags = 0;
 
         return dm_io(&lc->io_req, 1, &lc->header_location, NULL);
 }
@@ -316,7 +317,7 @@ static int read_header(struct log_c *log)
 {
         int r;
 
-        r = rw_header(log, READ);
+        r = rw_header(log, REQ_OP_READ);
         if (r)
                 return r;
 
@@ -630,7 +631,7 @@ static int disk_resume(struct dm_dirty_log *log)
         header_to_disk(&lc->header, lc->disk_header);
 
         /* write the new header */
-        r = rw_header(lc, WRITE);
+        r = rw_header(lc, REQ_OP_WRITE);
         if (!r) {
                 r = flush_header(lc);
                 if (r)
@@ -698,7 +699,7 @@ static int disk_flush(struct dm_dirty_log *log)
                         log_clear_bit(lc, lc->clean_bits, i);
         }
 
-        r = rw_header(lc, WRITE);
+        r = rw_header(lc, REQ_OP_WRITE);
         if (r)
                 fail_log_device(lc);
         else {
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 41573f1f626f..34a840d9df76 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -834,8 +834,10 @@ static int join(struct mddev *mddev, int nodes)
                 goto err;
         }
         cinfo->ack_lockres = lockres_init(mddev, "ack", ack_bast, 0);
-        if (!cinfo->ack_lockres)
+        if (!cinfo->ack_lockres) {
+                ret = -ENOMEM;
                 goto err;
+        }
         /* get sync CR lock on ACK. */
         if (dlm_lock_sync(cinfo->ack_lockres, DLM_LOCK_CR))
                 pr_err("md-cluster: failed to get a sync CR lock on ACK!(%d)\n",
@@ -849,8 +851,10 @@ static int join(struct mddev *mddev, int nodes)
         pr_info("md-cluster: Joined cluster %s slot %d\n", str, cinfo->slot_number);
         snprintf(str, 64, "bitmap%04d", cinfo->slot_number - 1);
         cinfo->bitmap_lockres = lockres_init(mddev, str, NULL, 1);
-        if (!cinfo->bitmap_lockres)
+        if (!cinfo->bitmap_lockres) {
+                ret = -ENOMEM;
                 goto err;
+        }
         if (dlm_lock_sync(cinfo->bitmap_lockres, DLM_LOCK_PW)) {
                 pr_err("Failed to get bitmap lock\n");
                 ret = -EINVAL;
@@ -858,8 +862,10 @@ static int join(struct mddev *mddev, int nodes)
         }
 
         cinfo->resync_lockres = lockres_init(mddev, "resync", NULL, 0);
-        if (!cinfo->resync_lockres)
+        if (!cinfo->resync_lockres) {
+                ret = -ENOMEM;
                 goto err;
+        }
 
         return 0;
 err:
diff --git a/drivers/md/md.c b/drivers/md/md.c
index d646f6e444f0..915e84d631a2 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1604,11 +1604,8 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
                         mddev->new_chunk_sectors = mddev->chunk_sectors;
                 }
 
-                if (le32_to_cpu(sb->feature_map) & MD_FEATURE_JOURNAL) {
+                if (le32_to_cpu(sb->feature_map) & MD_FEATURE_JOURNAL)
                         set_bit(MD_HAS_JOURNAL, &mddev->flags);
-                        if (mddev->recovery_cp == MaxSector)
-                                set_bit(MD_JOURNAL_CLEAN, &mddev->flags);
-                }
         } else if (mddev->pers == NULL) {
                 /* Insist of good event counter while assembling, except for
                  * spares (which don't need an event count) */
@@ -5851,6 +5848,9 @@ static int get_array_info(struct mddev *mddev, void __user *arg)
                         working++;
                         if (test_bit(In_sync, &rdev->flags))
                                 insync++;
+                        else if (test_bit(Journal, &rdev->flags))
+                                /* TODO: add journal count to md_u.h */
+                                ;
                         else
                                 spare++;
                 }
@@ -7610,16 +7610,12 @@ EXPORT_SYMBOL(unregister_md_cluster_operations);
 
 int md_setup_cluster(struct mddev *mddev, int nodes)
 {
-        int err;
-
-        err = request_module("md-cluster");
-        if (err) {
-                pr_err("md-cluster module not found.\n");
-                return -ENOENT;
-        }
-
+        if (!md_cluster_ops)
+                request_module("md-cluster");
         spin_lock(&pers_lock);
+        /* ensure module won't be unloaded */
         if (!md_cluster_ops || !try_module_get(md_cluster_mod)) {
+                pr_err("can't find md-cluster module or get it's reference.\n");
                 spin_unlock(&pers_lock);
                 return -ENOENT;
         }
@@ -7862,6 +7858,7 @@ void md_do_sync(struct md_thread *thread)
          */
 
         do {
+                int mddev2_minor = -1;
                 mddev->curr_resync = 2;
 
         try_again:
@@ -7891,10 +7888,14 @@ void md_do_sync(struct md_thread *thread)
                                 prepare_to_wait(&resync_wait, &wq, TASK_INTERRUPTIBLE);
                                 if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
                                     mddev2->curr_resync >= mddev->curr_resync) {
-                                        printk(KERN_INFO "md: delaying %s of %s"
-                                               " until %s has finished (they"
-                                               " share one or more physical units)\n",
-                                               desc, mdname(mddev), mdname(mddev2));
+                                        if (mddev2_minor != mddev2->md_minor) {
+                                                mddev2_minor = mddev2->md_minor;
+                                                printk(KERN_INFO "md: delaying %s of %s"
+                                                       " until %s has finished (they"
+                                                       " share one or more physical units)\n",
+                                                       desc, mdname(mddev),
+                                                       mdname(mddev2));
+                                        }
                                         mddev_put(mddev2);
                                         if (signal_pending(current))
                                                 flush_signals(current);
@@ -8275,16 +8276,13 @@ no_add:
 static void md_start_sync(struct work_struct *ws)
 {
         struct mddev *mddev = container_of(ws, struct mddev, del_work);
-        int ret = 0;
 
         mddev->sync_thread = md_register_thread(md_do_sync,
                                                 mddev,
                                                 "resync");
         if (!mddev->sync_thread) {
-                if (!(mddev_is_clustered(mddev) && ret == -EAGAIN))
-                        printk(KERN_ERR "%s: could not start resync"
-                               " thread...\n",
-                               mdname(mddev));
+                printk(KERN_ERR "%s: could not start resync thread...\n",
+                       mdname(mddev));
                 /* leave the spares where they are, it shouldn't hurt */
                 clear_bit(MD_RECOVERY_SYNC, &mddev->recovery);
                 clear_bit(MD_RECOVERY_RESHAPE, &mddev->recovery);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 0e4efcd10795..be1a9fca3b2d 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1064,6 +1064,8 @@ static void __make_request(struct mddev *mddev, struct bio *bio)
         int max_sectors;
         int sectors;
 
+        md_write_start(mddev, bio);
+
         /*
          * Register the new request and wait if the reconstruction
          * thread has put up a bar for new requests.
@@ -1445,8 +1447,6 @@ static void raid10_make_request(struct mddev *mddev, struct bio *bio)
                 return;
         }
 
-        md_write_start(mddev, bio);
-
         do {
 
                 /*
@@ -2465,20 +2465,21 @@ static int narrow_write_error(struct r10bio *r10_bio, int i)
 
         while (sect_to_write) {
                 struct bio *wbio;
+                sector_t wsector;
                 if (sectors > sect_to_write)
                         sectors = sect_to_write;
                 /* Write at 'sector' for 'sectors' */
                 wbio = bio_clone_mddev(bio, GFP_NOIO, mddev);
                 bio_trim(wbio, sector - bio->bi_iter.bi_sector, sectors);
-                wbio->bi_iter.bi_sector = (r10_bio->devs[i].addr+
-                                   choose_data_offset(r10_bio, rdev) +
-                                   (sector - r10_bio->sector));
+                wsector = r10_bio->devs[i].addr + (sector - r10_bio->sector);
+                wbio->bi_iter.bi_sector = wsector +
+                                   choose_data_offset(r10_bio, rdev);
                 wbio->bi_bdev = rdev->bdev;
                 bio_set_op_attrs(wbio, REQ_OP_WRITE, 0);
 
                 if (submit_bio_wait(wbio) < 0)
                         /* Failure! */
-                        ok = rdev_set_badblocks(rdev, sector,
+                        ok = rdev_set_badblocks(rdev, wsector,
                                                 sectors, 0)
                                 && ok;
 
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 51f76ddbe265..1b1ab4a1d132 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -96,7 +96,6 @@ struct r5l_log {
         spinlock_t no_space_stripes_lock;
 
         bool need_cache_flush;
-        bool in_teardown;
 };
 
 /*
@@ -704,31 +703,22 @@ static void r5l_write_super_and_discard_space(struct r5l_log *log,
 
         mddev = log->rdev->mddev;
         /*
-         * This is to avoid a deadlock. r5l_quiesce holds reconfig_mutex and
-         * wait for this thread to finish. This thread waits for
-         * MD_CHANGE_PENDING clear, which is supposed to be done in
-         * md_check_recovery(). md_check_recovery() tries to get
-         * reconfig_mutex. Since r5l_quiesce already holds the mutex,
-         * md_check_recovery() fails, so the PENDING never get cleared. The
-         * in_teardown check workaround this issue.
+         * Discard could zero data, so before discard we must make sure
+         * superblock is updated to new log tail. Updating superblock (either
+         * directly call md_update_sb() or depend on md thread) must hold
+         * reconfig mutex. On the other hand, raid5_quiesce is called with
+         * reconfig_mutex hold. The first step of raid5_quiesce() is waitting
+         * for all IO finish, hence waitting for reclaim thread, while reclaim
+         * thread is calling this function and waitting for reconfig mutex. So
+         * there is a deadlock. We workaround this issue with a trylock.
+         * FIXME: we could miss discard if we can't take reconfig mutex
          */
-        if (!log->in_teardown) {
-                set_mask_bits(&mddev->flags, 0,
-                              BIT(MD_CHANGE_DEVS) | BIT(MD_CHANGE_PENDING));
-                md_wakeup_thread(mddev->thread);
-                wait_event(mddev->sb_wait,
-                        !test_bit(MD_CHANGE_PENDING, &mddev->flags) ||
-                        log->in_teardown);
-                /*
-                 * r5l_quiesce could run after in_teardown check and hold
-                 * mutex first. Superblock might get updated twice.
-                 */
-                if (log->in_teardown)
-                        md_update_sb(mddev, 1);
-        } else {
-                WARN_ON(!mddev_is_locked(mddev));
-                md_update_sb(mddev, 1);
-        }
+        set_mask_bits(&mddev->flags, 0,
+                BIT(MD_CHANGE_DEVS) | BIT(MD_CHANGE_PENDING));
+        if (!mddev_trylock(mddev))
+                return;
+        md_update_sb(mddev, 1);
+        mddev_unlock(mddev);
 
         /* discard IO error really doesn't matter, ignore it */
         if (log->last_checkpoint < end) {
@@ -827,7 +817,6 @@ void r5l_quiesce(struct r5l_log *log, int state)
         if (!log || state == 2)
                 return;
         if (state == 0) {
-                log->in_teardown = 0;
                 /*
                  * This is a special case for hotadd. In suspend, the array has
                  * no journal. In resume, journal is initialized as well as the
@@ -838,11 +827,6 @@ void r5l_quiesce(struct r5l_log *log, int state)
                 log->reclaim_thread = md_register_thread(r5l_reclaim_thread,
                                         log->rdev->mddev, "reclaim");
         } else if (state == 1) {
-                /*
-                 * at this point all stripes are finished, so io_unit is at
-                 * least in STRIPE_END state
-                 */
-                log->in_teardown = 1;
                 /* make sure r5l_write_super_and_discard_space exits */
                 mddev = log->rdev->mddev;
                 wake_up(&mddev->sb_wait);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 8912407a4dd0..ee7fc3701700 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -659,6 +659,7 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector,
 {
         struct stripe_head *sh;
         int hash = stripe_hash_locks_hash(sector);
+        int inc_empty_inactive_list_flag;
 
         pr_debug("get_stripe, sector %llu\n", (unsigned long long)sector);
 
@@ -703,7 +704,12 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector,
                                         atomic_inc(&conf->active_stripes);
                                 BUG_ON(list_empty(&sh->lru) &&
                                        !test_bit(STRIPE_EXPANDING, &sh->state));
+                                inc_empty_inactive_list_flag = 0;
+                                if (!list_empty(conf->inactive_list + hash))
+                                        inc_empty_inactive_list_flag = 1;
                                 list_del_init(&sh->lru);
+                                if (list_empty(conf->inactive_list + hash) && inc_empty_inactive_list_flag)
+                                        atomic_inc(&conf->empty_inactive_list_nr);
                                 if (sh->group) {
                                         sh->group->stripes_cnt--;
                                         sh->group = NULL;
@@ -762,6 +768,7 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
         sector_t head_sector, tmp_sec;
         int hash;
         int dd_idx;
+        int inc_empty_inactive_list_flag;
 
         /* Don't cross chunks, so stripe pd_idx/qd_idx is the same */
         tmp_sec = sh->sector;
@@ -779,7 +786,12 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
                                 atomic_inc(&conf->active_stripes);
                         BUG_ON(list_empty(&head->lru) &&
                                !test_bit(STRIPE_EXPANDING, &head->state));
+                        inc_empty_inactive_list_flag = 0;
+                        if (!list_empty(conf->inactive_list + hash))
+                                inc_empty_inactive_list_flag = 1;
                         list_del_init(&head->lru);
+                        if (list_empty(conf->inactive_list + hash) && inc_empty_inactive_list_flag)
+                                atomic_inc(&conf->empty_inactive_list_nr);
                         if (head->group) {
                                 head->group->stripes_cnt--;
                                 head->group = NULL;
@@ -993,7 +1005,6 @@ again:
 
                         set_bit(STRIPE_IO_STARTED, &sh->state);
 
-                        bio_reset(bi);
                         bi->bi_bdev = rdev->bdev;
                         bio_set_op_attrs(bi, op, op_flags);
                         bi->bi_end_io = op_is_write(op)
@@ -1045,7 +1056,6 @@ again:
 
                         set_bit(STRIPE_IO_STARTED, &sh->state);
 
-                        bio_reset(rbi);
                         rbi->bi_bdev = rrdev->bdev;
                         bio_set_op_attrs(rbi, op, op_flags);
                         BUG_ON(!op_is_write(op));
@@ -1978,9 +1988,11 @@ static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
         put_cpu();
 }
 
-static struct stripe_head *alloc_stripe(struct kmem_cache *sc, gfp_t gfp)
+static struct stripe_head *alloc_stripe(struct kmem_cache *sc, gfp_t gfp,
+        int disks)
 {
         struct stripe_head *sh;
+        int i;
 
         sh = kmem_cache_zalloc(sc, gfp);
         if (sh) {
@@ -1989,6 +2001,17 @@ static struct stripe_head *alloc_stripe(struct kmem_cache *sc, gfp_t gfp)
                 INIT_LIST_HEAD(&sh->batch_list);
                 INIT_LIST_HEAD(&sh->lru);
                 atomic_set(&sh->count, 1);
+                for (i = 0; i < disks; i++) {
+                        struct r5dev *dev = &sh->dev[i];
+
+                        bio_init(&dev->req);
+                        dev->req.bi_io_vec = &dev->vec;
+                        dev->req.bi_max_vecs = 1;
+
+                        bio_init(&dev->rreq);
+                        dev->rreq.bi_io_vec = &dev->rvec;
+                        dev->rreq.bi_max_vecs = 1;
+                }
         }
         return sh;
 }
@@ -1996,7 +2019,7 @@ static int grow_one_stripe(struct r5conf *conf, gfp_t gfp)
 {
         struct stripe_head *sh;
 
-        sh = alloc_stripe(conf->slab_cache, gfp);
+        sh = alloc_stripe(conf->slab_cache, gfp, conf->pool_size);
         if (!sh)
                 return 0;
 
@@ -2167,7 +2190,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
         mutex_lock(&conf->cache_size_mutex);
 
         for (i = conf->max_nr_stripes; i; i--) {
-                nsh = alloc_stripe(sc, GFP_KERNEL);
+                nsh = alloc_stripe(sc, GFP_KERNEL, newsize);
                 if (!nsh)
                         break;
 
@@ -2299,6 +2322,7 @@ static void raid5_end_read_request(struct bio * bi)
                 (unsigned long long)sh->sector, i, atomic_read(&sh->count),
                 bi->bi_error);
         if (i == disks) {
+                bio_reset(bi);
                 BUG();
                 return;
         }
@@ -2399,6 +2423,7 @@ static void raid5_end_read_request(struct bio * bi)
                 }
         }
         rdev_dec_pending(rdev, conf->mddev);
+        bio_reset(bi);
         clear_bit(R5_LOCKED, &sh->dev[i].flags);
         set_bit(STRIPE_HANDLE, &sh->state);
         raid5_release_stripe(sh);
@@ -2436,6 +2461,7 @@ static void raid5_end_write_request(struct bio *bi)
                 (unsigned long long)sh->sector, i, atomic_read(&sh->count),
                 bi->bi_error);
         if (i == disks) {
+                bio_reset(bi);
                 BUG();
                 return;
         }
@@ -2472,6 +2498,7 @@ static void raid5_end_write_request(struct bio *bi)
         if (sh->batch_head && bi->bi_error && !replacement)
                 set_bit(STRIPE_BATCH_ERR, &sh->batch_head->state);
 
+        bio_reset(bi);
         if (!test_and_clear_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags))
                 clear_bit(R5_LOCKED, &sh->dev[i].flags);
         set_bit(STRIPE_HANDLE, &sh->state);
@@ -2485,16 +2512,6 @@ static void raid5_build_block(struct stripe_head *sh, int i, int previous)
 {
         struct r5dev *dev = &sh->dev[i];
 
-        bio_init(&dev->req);
-        dev->req.bi_io_vec = &dev->vec;
-        dev->req.bi_max_vecs = 1;
-        dev->req.bi_private = sh;
-
-        bio_init(&dev->rreq);
-        dev->rreq.bi_io_vec = &dev->rvec;
-        dev->rreq.bi_max_vecs = 1;
-        dev->rreq.bi_private = sh;
-
         dev->flags = 0;
         dev->sector = raid5_compute_blocknr(sh, i, previous);
 }
@@ -4628,7 +4645,9 @@ finish:
         }
 
         if (!bio_list_empty(&s.return_bi)) {
-                if (test_bit(MD_CHANGE_PENDING, &conf->mddev->flags)) {
+                if (test_bit(MD_CHANGE_PENDING, &conf->mddev->flags) &&
+                                (s.failed <= conf->max_degraded ||
+                                        conf->mddev->external == 0)) {
                         spin_lock_irq(&conf->device_lock);
                         bio_list_merge(&conf->return_bi, &s.return_bi);
                         spin_unlock_irq(&conf->device_lock);
@@ -6620,6 +6639,16 @@ static struct r5conf *setup_conf(struct mddev *mddev)
         }
 
         conf->min_nr_stripes = NR_STRIPES;
+        if (mddev->reshape_position != MaxSector) {
+                int stripes = max_t(int,
+                        ((mddev->chunk_sectors << 9) / STRIPE_SIZE) * 4,
+                        ((mddev->new_chunk_sectors << 9) / STRIPE_SIZE) * 4);
+                conf->min_nr_stripes = max(NR_STRIPES, stripes);
+                if (conf->min_nr_stripes != NR_STRIPES)
+                        printk(KERN_INFO
+                                "md/raid:%s: force stripe size %d for reshape\n",
+                                mdname(mddev), conf->min_nr_stripes);
+        }
         memory = conf->min_nr_stripes * (sizeof(struct stripe_head) +
                  max_disks * ((sizeof(struct bio) + PAGE_SIZE))) / 1024;
         atomic_set(&conf->empty_inactive_list_nr, NR_STRIPE_HASH_LOCKS);
@@ -6826,11 +6855,14 @@ static int raid5_run(struct mddev *mddev)
         if (IS_ERR(conf))
                 return PTR_ERR(conf);
 
-        if (test_bit(MD_HAS_JOURNAL, &mddev->flags) && !journal_dev) {
-                printk(KERN_ERR "md/raid:%s: journal disk is missing, force array readonly\n",
-                       mdname(mddev));
-                mddev->ro = 1;
-                set_disk_ro(mddev->gendisk, 1);
+        if (test_bit(MD_HAS_JOURNAL, &mddev->flags)) {
+                if (!journal_dev) {
+                        pr_err("md/raid:%s: journal disk is missing, force array readonly\n",
+                               mdname(mddev));
+                        mddev->ro = 1;
+                        set_disk_ro(mddev->gendisk, 1);
+                } else if (mddev->recovery_cp == MaxSector)
+                        set_bit(MD_JOURNAL_CLEAN, &mddev->flags);
         }
 
         conf->min_offset_diff = min_offset_diff;
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index 869c83fb3c5d..f00f3e742265 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -2185,7 +2185,7 @@ static int gpmc_probe_dt(struct platform_device *pdev)
         return 0;
 }
 
-static int gpmc_probe_dt_children(struct platform_device *pdev)
+static void gpmc_probe_dt_children(struct platform_device *pdev)
 {
         int ret;
         struct device_node *child;
@@ -2200,11 +2200,11 @@ static int gpmc_probe_dt_children(struct platform_device *pdev)
                 else
                         ret = gpmc_probe_generic_child(pdev, child);
 
-                if (ret)
-                        return ret;
+                if (ret) {
+                        dev_err(&pdev->dev, "failed to probe DT child '%s': %d\n",
+                                child->name, ret);
+                }
         }
-
-        return 0;
 }
 #else
 static int gpmc_probe_dt(struct platform_device *pdev)
@@ -2212,9 +2212,8 @@ static int gpmc_probe_dt(struct platform_device *pdev)
         return 0;
 }
 
-static int gpmc_probe_dt_children(struct platform_device *pdev)
+static void gpmc_probe_dt_children(struct platform_device *pdev)
 {
-        return 0;
 }
 #endif /* CONFIG_OF */
 
@@ -2369,16 +2368,10 @@ static int gpmc_probe(struct platform_device *pdev)
                 goto setup_irq_failed;
         }
 
-        rc = gpmc_probe_dt_children(pdev);
-        if (rc < 0) {
-                dev_err(gpmc->dev, "failed to probe DT children\n");
-                goto dt_children_failed;
-        }
+        gpmc_probe_dt_children(pdev);
 
         return 0;
 
-dt_children_failed:
-        gpmc_free_irq(gpmc);
 setup_irq_failed:
         gpmc_gpio_exit(gpmc);
 gpio_init_failed:
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index a216b4667742..d00252828966 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -345,16 +345,6 @@ config SENSORS_TSL2550
           This driver can also be built as a module.  If so, the module
           will be called tsl2550.
 
-config SENSORS_BH1780
-        tristate "ROHM BH1780GLI ambient light sensor"
-        depends on I2C && SYSFS
-        help
-          If you say yes here you get support for the ROHM BH1780GLI
-          ambient light sensor.
-
-          This driver can also be built as a module.  If so, the module
-          will be called bh1780gli.
-
 config SENSORS_BH1770
          tristate "BH1770GLC / SFH7770 combined ALS - Proximity sensor"
          depends on I2C
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 7410c6d9a34d..fb32516ddfe2 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -19,7 +19,6 @@ obj-$(CONFIG_TIFM_CORE)       	+= tifm_core.o
 obj-$(CONFIG_TIFM_7XX1)         += tifm_7xx1.o
 obj-$(CONFIG_PHANTOM)           += phantom.o
 obj-$(CONFIG_QCOM_COINCELL)     += qcom-coincell.o
-obj-$(CONFIG_SENSORS_BH1780)    += bh1780gli.o
 obj-$(CONFIG_SENSORS_BH1770)    += bh1770glc.o
 obj-$(CONFIG_SENSORS_APDS990X)  += apds990x.o
 obj-$(CONFIG_SGI_IOC4)          += ioc4.o
diff --git a/drivers/misc/bh1780gli.c b/drivers/misc/bh1780gli.c
deleted file mode 100644
index 7f90ce5a569a..000000000000
--- a/drivers/misc/bh1780gli.c
+++ /dev/null
@@ -1,259 +0,0 @@
-/*
- * bh1780gli.c
- * ROHM Ambient Light Sensor Driver
- *
- * Copyright (C) 2010 Texas Instruments
- * Author: Hemanth V <hemanthv@ti.com>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-#include <linux/i2c.h>
-#include <linux/slab.h>
-#include <linux/mutex.h>
-#include <linux/platform_device.h>
-#include <linux/delay.h>
-#include <linux/module.h>
-#include <linux/of.h>
-
-#define BH1780_REG_CONTROL      0x80
-#define BH1780_REG_PARTID       0x8A
-#define BH1780_REG_MANFID       0x8B
-#define BH1780_REG_DLOW 0x8C
-#define BH1780_REG_DHIGH        0x8D
-
-#define BH1780_REVMASK          (0xf)
-#define BH1780_POWMASK          (0x3)
-#define BH1780_POFF             (0x0)
-#define BH1780_PON              (0x3)
-
-/* power on settling time in ms */
-#define BH1780_PON_DELAY        2
-
-struct bh1780_data {
-        struct i2c_client *client;
-        int power_state;
-        /* lock for sysfs operations */
-        struct mutex lock;
-};
-
-static int bh1780_write(struct bh1780_data *ddata, u8 reg, u8 val, char *msg)
-{
-        int ret = i2c_smbus_write_byte_data(ddata->client, reg, val);
-        if (ret < 0)
-                dev_err(&ddata->client->dev,
-                        "i2c_smbus_write_byte_data failed error %d Register (%s)\n",
-                        ret, msg);
-        return ret;
-}
-
-static int bh1780_read(struct bh1780_data *ddata, u8 reg, char *msg)
-{
-        int ret = i2c_smbus_read_byte_data(ddata->client, reg);
-        if (ret < 0)
-                dev_err(&ddata->client->dev,
-                        "i2c_smbus_read_byte_data failed error %d Register (%s)\n",
-                        ret, msg);
-        return ret;
-}
-
-static ssize_t bh1780_show_lux(struct device *dev,
-                                struct device_attribute *attr, char *buf)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct bh1780_data *ddata = platform_get_drvdata(pdev);
-        int lsb, msb;
-
-        lsb = bh1780_read(ddata, BH1780_REG_DLOW, "DLOW");
-        if (lsb < 0)
-                return lsb;
-
-        msb = bh1780_read(ddata, BH1780_REG_DHIGH, "DHIGH");
-        if (msb < 0)
-                return msb;
-
-        return sprintf(buf, "%d\n", (msb << 8) | lsb);
-}
-
-static ssize_t bh1780_show_power_state(struct device *dev,
-                                        struct device_attribute *attr,
-                                        char *buf)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct bh1780_data *ddata = platform_get_drvdata(pdev);
-        int state;
-
-        state = bh1780_read(ddata, BH1780_REG_CONTROL, "CONTROL");
-        if (state < 0)
-                return state;
-
-        return sprintf(buf, "%d\n", state & BH1780_POWMASK);
-}
-
-static ssize_t bh1780_store_power_state(struct device *dev,
-                                        struct device_attribute *attr,
-                                        const char *buf, size_t count)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct bh1780_data *ddata = platform_get_drvdata(pdev);
-        unsigned long val;
-        int error;
-
-        error = kstrtoul(buf, 0, &val);
-        if (error)
-                return error;
-
-        if (val < BH1780_POFF || val > BH1780_PON)
-                return -EINVAL;
-
-        mutex_lock(&ddata->lock);
-
-        error = bh1780_write(ddata, BH1780_REG_CONTROL, val, "CONTROL");
-        if (error < 0) {
-                mutex_unlock(&ddata->lock);
-                return error;
-        }
-
-        msleep(BH1780_PON_DELAY);
-        ddata->power_state = val;
-        mutex_unlock(&ddata->lock);
-
-        return count;
-}
-
-static DEVICE_ATTR(lux, S_IRUGO, bh1780_show_lux, NULL);
-
-static DEVICE_ATTR(power_state, S_IWUSR | S_IRUGO,
-                bh1780_show_power_state, bh1780_store_power_state);
-
-static struct attribute *bh1780_attributes[] = {
-        &dev_attr_power_state.attr,
-        &dev_attr_lux.attr,
-        NULL
-};
-
-static const struct attribute_group bh1780_attr_group = {
-        .attrs = bh1780_attributes,
-};
-
-static int bh1780_probe(struct i2c_client *client,
-                                                const struct i2c_device_id *id)
-{
-        int ret;
-        struct bh1780_data *ddata;
-        struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
-
-        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE))
-                return -EIO;
-
-        ddata = devm_kzalloc(&client->dev, sizeof(struct bh1780_data),
-                             GFP_KERNEL);
-        if (ddata == NULL)
-                return -ENOMEM;
-
-        ddata->client = client;
-        i2c_set_clientdata(client, ddata);
-
-        ret = bh1780_read(ddata, BH1780_REG_PARTID, "PART ID");
-        if (ret < 0)
-                return ret;
-
-        dev_info(&client->dev, "Ambient Light Sensor, Rev : %d\n",
-                        (ret & BH1780_REVMASK));
-
-        mutex_init(&ddata->lock);
-
-        return sysfs_create_group(&client->dev.kobj, &bh1780_attr_group);
-}
-
-static int bh1780_remove(struct i2c_client *client)
-{
-        sysfs_remove_group(&client->dev.kobj, &bh1780_attr_group);
-
-        return 0;
-}
-
-#ifdef CONFIG_PM_SLEEP
-static int bh1780_suspend(struct device *dev)
-{
-        struct bh1780_data *ddata;
-        int state, ret;
-        struct i2c_client *client = to_i2c_client(dev);
-
-        ddata = i2c_get_clientdata(client);
-        state = bh1780_read(ddata, BH1780_REG_CONTROL, "CONTROL");
-        if (state < 0)
-                return state;
-
-        ddata->power_state = state & BH1780_POWMASK;
-
-        ret = bh1780_write(ddata, BH1780_REG_CONTROL, BH1780_POFF,
-                                "CONTROL");
-
-        if (ret < 0)
-                return ret;
-
-        return 0;
-}
-
-static int bh1780_resume(struct device *dev)
-{
-        struct bh1780_data *ddata;
-        int state, ret;
-        struct i2c_client *client = to_i2c_client(dev);
-
-        ddata = i2c_get_clientdata(client);
-        state = ddata->power_state;
-        ret = bh1780_write(ddata, BH1780_REG_CONTROL, state,
-                                "CONTROL");
-
-        if (ret < 0)
-                return ret;
-
-        return 0;
-}
-#endif /* CONFIG_PM_SLEEP */
-
-static SIMPLE_DEV_PM_OPS(bh1780_pm, bh1780_suspend, bh1780_resume);
-
-static const struct i2c_device_id bh1780_id[] = {
-        { "bh1780", 0 },
-        { },
-};
-
-MODULE_DEVICE_TABLE(i2c, bh1780_id);
-
-#ifdef CONFIG_OF
-static const struct of_device_id of_bh1780_match[] = {
-        { .compatible = "rohm,bh1780gli", },
-        {},
-};
-
-MODULE_DEVICE_TABLE(of, of_bh1780_match);
-#endif
-
-static struct i2c_driver bh1780_driver = {
-        .probe          = bh1780_probe,
-        .remove         = bh1780_remove,
-        .id_table       = bh1780_id,
-        .driver = {
-                .name = "bh1780",
-                .pm     = &bh1780_pm,
-                .of_match_table = of_match_ptr(of_bh1780_match),
-        },
-};
-
-module_i2c_driver(bh1780_driver);
-
-MODULE_DESCRIPTION("BH1780GLI Ambient Light Sensor Driver");
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Hemanth V <hemanthv@ti.com>");
diff --git a/drivers/misc/cxl/vphb.c b/drivers/misc/cxl/vphb.c
index 7ada5f1b7bb6..3519acebfdab 100644
--- a/drivers/misc/cxl/vphb.c
+++ b/drivers/misc/cxl/vphb.c
@@ -230,6 +230,11 @@ int cxl_pci_vphb_add(struct cxl_afu *afu)
         if (phb->bus == NULL)
                 return -ENXIO;
 
+        /* Set release hook on root bus */
+        pci_set_host_bridge_release(to_pci_host_bridge(phb->bus->bridge),
+                                    pcibios_free_controller_deferred,
+                                    (void *) phb);
+
         /* Claim resources. This might need some rework as well depending
          * whether we are doing probe-only or not, like assigning unassigned
          * resources etc...
@@ -256,7 +261,10 @@ void cxl_pci_vphb_remove(struct cxl_afu *afu)
         afu->phb = NULL;
 
         pci_remove_root_bus(phb->bus);
-        pcibios_free_controller(phb);
+        /*
+         * We don't free phb here - that's handled by
+         * pcibios_free_controller_deferred()
+         */
 }
 
 static bool _cxl_pci_is_vphb_device(struct pci_controller *phb)
diff --git a/drivers/misc/lkdtm_rodata.c b/drivers/misc/lkdtm_rodata.c
index 166b1db3969f..3564477b8c2d 100644
--- a/drivers/misc/lkdtm_rodata.c
+++ b/drivers/misc/lkdtm_rodata.c
@@ -4,7 +4,7 @@
  */
 #include "lkdtm.h"
 
-void lkdtm_rodata_do_nothing(void)
+void notrace lkdtm_rodata_do_nothing(void)
 {
         /* Does nothing. We just want an architecture agnostic "return". */
 }
diff --git a/drivers/misc/lkdtm_usercopy.c b/drivers/misc/lkdtm_usercopy.c
index 5525a204db93..1dd611423d8b 100644
--- a/drivers/misc/lkdtm_usercopy.c
+++ b/drivers/misc/lkdtm_usercopy.c
@@ -9,7 +9,15 @@
 #include <linux/uaccess.h>
 #include <asm/cacheflush.h>
 
-static size_t cache_size = 1024;
+/*
+ * Many of the tests here end up using const sizes, but those would
+ * normally be ignored by hardened usercopy, so force the compiler
+ * into choosing the non-const path to make sure we trigger the
+ * hardened usercopy checks by added "unconst" to all the const copies,
+ * and making sure "cache_size" isn't optimized into a const.
+ */
+static volatile size_t unconst = 0;
+static volatile size_t cache_size = 1024;
 static struct kmem_cache *bad_cache;
 
 static const unsigned char test_text[] = "This is a test.\n";
@@ -67,14 +75,14 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
         if (to_user) {
                 pr_info("attempting good copy_to_user of local stack\n");
                 if (copy_to_user((void __user *)user_addr, good_stack,
-                                 sizeof(good_stack))) {
+                                 unconst + sizeof(good_stack))) {
                         pr_warn("copy_to_user failed unexpectedly?!\n");
                         goto free_user;
                 }
 
                 pr_info("attempting bad copy_to_user of distant stack\n");
                 if (copy_to_user((void __user *)user_addr, bad_stack,
-                                 sizeof(good_stack))) {
+                                 unconst + sizeof(good_stack))) {
                         pr_warn("copy_to_user failed, but lacked Oops\n");
                         goto free_user;
                 }
@@ -88,14 +96,14 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
 
                 pr_info("attempting good copy_from_user of local stack\n");
                 if (copy_from_user(good_stack, (void __user *)user_addr,
-                                   sizeof(good_stack))) {
+                                   unconst + sizeof(good_stack))) {
                         pr_warn("copy_from_user failed unexpectedly?!\n");
                         goto free_user;
                 }
 
                 pr_info("attempting bad copy_from_user of distant stack\n");
                 if (copy_from_user(bad_stack, (void __user *)user_addr,
-                                   sizeof(good_stack))) {
+                                   unconst + sizeof(good_stack))) {
                         pr_warn("copy_from_user failed, but lacked Oops\n");
                         goto free_user;
                 }
@@ -109,7 +117,7 @@ static void do_usercopy_heap_size(bool to_user)
 {
         unsigned long user_addr;
         unsigned char *one, *two;
-        const size_t size = 1024;
+        size_t size = unconst + 1024;
 
         one = kmalloc(size, GFP_KERNEL);
         two = kmalloc(size, GFP_KERNEL);
@@ -285,13 +293,14 @@ void lkdtm_USERCOPY_KERNEL(void)
 
         pr_info("attempting good copy_to_user from kernel rodata\n");
         if (copy_to_user((void __user *)user_addr, test_text,
-                         sizeof(test_text))) {
+                         unconst + sizeof(test_text))) {
                 pr_warn("copy_to_user failed unexpectedly?!\n");
                 goto free_user;
         }
 
         pr_info("attempting bad copy_to_user from kernel text\n");
-        if (copy_to_user((void __user *)user_addr, vm_mmap, PAGE_SIZE)) {
+        if (copy_to_user((void __user *)user_addr, vm_mmap,
+                         unconst + PAGE_SIZE)) {
                 pr_warn("copy_to_user failed, but lacked Oops\n");
                 goto free_user;
         }
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index e2fb44cc5c37..dc3a854e02d3 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -1263,8 +1263,14 @@ static bool mei_me_fw_type_nm(struct pci_dev *pdev)
 static bool mei_me_fw_type_sps(struct pci_dev *pdev)
 {
         u32 reg;
-        /* Read ME FW Status check for SPS Firmware */
-        pci_read_config_dword(pdev, PCI_CFG_HFS_1, &reg);
+        unsigned int devfn;
+
+        /*
+         * Read ME FW Status register to check for SPS Firmware
+         * The SPS FW is only signaled in pci function 0
+         */
+        devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0);
+        pci_bus_read_config_dword(pdev->bus, devfn, PCI_CFG_HFS_1, &reg);
         trace_mei_pci_cfg_read(&pdev->dev, "PCI_CFG_HFS_1", PCI_CFG_HFS_1, reg);
         /* if bits [19:16] = 15, running SPS Firmware */
         return (reg & 0xf0000) == 0xf0000;
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 64e64da6da44..71cea9b296b2 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -85,8 +85,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
 
         {MEI_PCI_DEVICE(MEI_DEV_ID_SPT, mei_me_pch8_cfg)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_cfg)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_cfg)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)},
 
         {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 48a5dd740f3b..2206d4477dbb 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -1726,6 +1726,7 @@ static u8 mmc_blk_prep_packed_list(struct mmc_queue *mq, struct request *req)
                         break;
 
                 if (req_op(next) == REQ_OP_DISCARD ||
+                    req_op(next) == REQ_OP_SECURE_ERASE ||
                     req_op(next) == REQ_OP_FLUSH)
                         break;
 
@@ -2150,6 +2151,7 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
         struct mmc_card *card = md->queue.card;
         struct mmc_host *host = card->host;
         unsigned long flags;
+        bool req_is_special = mmc_req_is_special(req);
 
         if (req && !mq->mqrq_prev->req)
                 /* claim host only for the first request */
@@ -2190,8 +2192,7 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
         }
 
 out:
-        if ((!req && !(mq->flags & MMC_QUEUE_NEW_REQUEST)) ||
-            mmc_req_is_special(req))
+        if ((!req && !(mq->flags & MMC_QUEUE_NEW_REQUEST)) || req_is_special)
                 /*
                  * Release host when there are no more requests
                  * and after special request(discard, flush) is done.
diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
index bf14642a576a..708057261b38 100644
--- a/drivers/mmc/card/queue.c
+++ b/drivers/mmc/card/queue.c
@@ -33,7 +33,8 @@ static int mmc_prep_request(struct request_queue *q, struct request *req)
         /*
          * We only like normal block requests and discards.
          */
-        if (req->cmd_type != REQ_TYPE_FS && req_op(req) != REQ_OP_DISCARD) {
+        if (req->cmd_type != REQ_TYPE_FS && req_op(req) != REQ_OP_DISCARD &&
+            req_op(req) != REQ_OP_SECURE_ERASE) {
                 blk_dump_rq_flags(req, "MMC bad request");
                 return BLKPREP_KILL;
         }
@@ -64,6 +65,8 @@ static int mmc_queue_thread(void *d)
                 spin_unlock_irq(q->queue_lock);
 
                 if (req || mq->mqrq_prev->req) {
+                        bool req_is_special = mmc_req_is_special(req);
+
                         set_current_state(TASK_RUNNING);
                         mq->issue_fn(mq, req);
                         cond_resched();
@@ -79,7 +82,7 @@ static int mmc_queue_thread(void *d)
                          * has been finished. Do not assign it to previous
                          * request.
                          */
-                        if (mmc_req_is_special(req))
+                        if (req_is_special)
                                 mq->mqrq_cur->req = NULL;
 
                         mq->mqrq_prev->brq.mrq.data = NULL;
diff --git a/drivers/mmc/card/queue.h b/drivers/mmc/card/queue.h
index d62531124d54..fee5e1271465 100644
--- a/drivers/mmc/card/queue.h
+++ b/drivers/mmc/card/queue.h
@@ -4,7 +4,9 @@
 static inline bool mmc_req_is_special(struct request *req)
 {
         return req &&
-                (req_op(req) == REQ_OP_FLUSH || req_op(req) == REQ_OP_DISCARD);
+                (req_op(req) == REQ_OP_FLUSH ||
+                 req_op(req) == REQ_OP_DISCARD ||
+                 req_op(req) == REQ_OP_SECURE_ERASE);
 }
 
 struct request;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 217e8da0628c..9599ed6f1213 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1341,9 +1341,10 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                             slave_dev->name);
         }
 
-        /* already enslaved */
-        if (slave_dev->flags & IFF_SLAVE) {
-                netdev_dbg(bond_dev, "Error: Device was already enslaved\n");
+        /* already in-use? */
+        if (netdev_is_rx_handler_busy(slave_dev)) {
+                netdev_err(bond_dev,
+                           "Error: Device is in use and cannot be enslaved\n");
                 return -EBUSY;
         }
 
diff --git a/drivers/net/dsa/bcm_sf2.h b/drivers/net/dsa/bcm_sf2.h
index 463bed8cbe4c..dd446e466699 100644
--- a/drivers/net/dsa/bcm_sf2.h
+++ b/drivers/net/dsa/bcm_sf2.h
@@ -205,8 +205,8 @@ static inline void name##_writeq(struct bcm_sf2_priv *priv, u64 val,	\
 static inline void intrl2_##which##_mask_clear(struct bcm_sf2_priv *priv, \
                                                 u32 mask)               \
 {                                                                       \
-        intrl2_##which##_writel(priv, mask, INTRL2_CPU_MASK_CLEAR);     \
         priv->irq##which##_mask &= ~(mask);                             \
+        intrl2_##which##_writel(priv, mask, INTRL2_CPU_MASK_CLEAR);     \
 }                                                                       \
 static inline void intrl2_##which##_mask_set(struct bcm_sf2_priv *priv, \
                                                 u32 mask)               \
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index d1d9d3cf9139..710679067594 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -2656,15 +2656,19 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
                         return ret;
         }
 
+        /* Rate Control: disable ingress rate limiting. */
         if (mv88e6xxx_6352_family(chip) || mv88e6xxx_6351_family(chip) ||
             mv88e6xxx_6165_family(chip) || mv88e6xxx_6097_family(chip) ||
-            mv88e6xxx_6185_family(chip) || mv88e6xxx_6095_family(chip) ||
             mv88e6xxx_6320_family(chip)) {
-                /* Rate Control: disable ingress rate limiting. */
                 ret = _mv88e6xxx_reg_write(chip, REG_PORT(port),
                                            PORT_RATE_CONTROL, 0x0001);
                 if (ret)
                         return ret;
+        } else if (mv88e6xxx_6185_family(chip) || mv88e6xxx_6095_family(chip)) {
+                ret = _mv88e6xxx_reg_write(chip, REG_PORT(port),
+                                           PORT_RATE_CONTROL, 0x0000);
+                if (ret)
+                        return ret;
         }
 
         /* Port Control 1: disable trunking, disable sending
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 6453148d066a..4eb17daefc4f 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1545,6 +1545,8 @@ static const struct pci_device_id alx_pci_tbl[] = {
           .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
         { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_E2400),
           .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
+        { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_E2500),
+          .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
         { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_AR8162),
           .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
         { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_AR8171) },
diff --git a/drivers/net/ethernet/atheros/alx/reg.h b/drivers/net/ethernet/atheros/alx/reg.h
index 0959e6824cb6..1fc2d852249f 100644
--- a/drivers/net/ethernet/atheros/alx/reg.h
+++ b/drivers/net/ethernet/atheros/alx/reg.h
@@ -38,6 +38,7 @@
 #define ALX_DEV_ID_AR8161                               0x1091
 #define ALX_DEV_ID_E2200                                0xe091
 #define ALX_DEV_ID_E2400                                0xe0a1
+#define ALX_DEV_ID_E2500                                0xe0b1
 #define ALX_DEV_ID_AR8162                               0x1090
 #define ALX_DEV_ID_AR8171                               0x10A1
 #define ALX_DEV_ID_AR8172                               0x10A0
diff --git a/drivers/net/ethernet/broadcom/bgmac-bcma.c b/drivers/net/ethernet/broadcom/bgmac-bcma.c
index 9a9745c4047c..625235db644f 100644
--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
+++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
@@ -159,7 +159,7 @@ static int bgmac_probe(struct bcma_device *core)
 
         if (!bgmac_is_bcm4707_family(core)) {
                 mii_bus = bcma_mdio_mii_register(core, bgmac->phyaddr);
-                if (!IS_ERR(mii_bus)) {
+                if (IS_ERR(mii_bus)) {
                         err = PTR_ERR(mii_bus);
                         goto err;
                 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 97e892511666..fa3386bb14f7 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -772,6 +772,11 @@ void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
                 (bp->common.bc_ver & 0xff00) >> 8,
                 (bp->common.bc_ver & 0xff));
 
+        if (pci_channel_offline(bp->pdev)) {
+                BNX2X_ERR("Cannot dump MCP info while in PCI error\n");
+                return;
+        }
+
         val = REG_RD(bp, MCP_REG_MCPR_CPU_PROGRAM_COUNTER);
         if (val == REG_RD(bp, MCP_REG_MCPR_CPU_PROGRAM_COUNTER))
                 BNX2X_ERR("%s" "MCP PC at 0x%x\n", lvl, val);
@@ -9415,10 +9420,16 @@ unload_error:
         /* Release IRQs */
         bnx2x_free_irq(bp);
 
-        /* Reset the chip */
-        rc = bnx2x_reset_hw(bp, reset_code);
-        if (rc)
-                BNX2X_ERR("HW_RESET failed\n");
+        /* Reset the chip, unless PCI function is offline. If we reach this
+         * point following a PCI error handling, it means device is really
+         * in a bad state and we're about to remove it, so reset the chip
+         * is not a good idea.
+         */
+        if (!pci_channel_offline(bp->pdev)) {
+                rc = bnx2x_reset_hw(bp, reset_code);
+                if (rc)
+                        BNX2X_ERR("HW_RESET failed\n");
+        }
 
         /* Report UNLOAD_DONE to MCP */
         bnx2x_send_unload_done(bp, keep_link);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 2cf79100c9cb..228c964e709a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -353,8 +353,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 push_len = (length + sizeof(*tx_push) + 7) / 8;
                 if (push_len > 16) {
                         __iowrite64_copy(txr->tx_doorbell, tx_push_buf, 16);
-                        __iowrite64_copy(txr->tx_doorbell + 4, tx_push_buf + 1,
-                                         push_len - 16);
+                        __iowrite32_copy(txr->tx_doorbell + 4, tx_push_buf + 1,
+                                         (push_len - 16) << 1);
                 } else {
                         __iowrite64_copy(txr->tx_doorbell, tx_push_buf,
                                          push_len);
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 659261218d9f..a2551bcd1027 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -14012,6 +14012,7 @@ static int tg3_set_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
         if ((ec->rx_coalesce_usecs > MAX_RXCOL_TICKS) ||
             (!ec->rx_coalesce_usecs) ||
             (ec->tx_coalesce_usecs > MAX_TXCOL_TICKS) ||
+            (!ec->tx_coalesce_usecs) ||
             (ec->rx_max_coalesced_frames > MAX_RXMAX_FRAMES) ||
             (ec->tx_max_coalesced_frames > MAX_TXMAX_FRAMES) ||
             (ec->rx_coalesce_usecs_irq > max_rxcoal_tick_int) ||
@@ -14022,16 +14023,6 @@ static int tg3_set_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
             (ec->stats_block_coalesce_usecs < min_stat_coal_ticks))
                 return -EINVAL;
 
-        /* No rx interrupts will be generated if both are zero */
-        if ((ec->rx_coalesce_usecs == 0) &&
-            (ec->rx_max_coalesced_frames == 0))
-                return -EINVAL;
-
-        /* No tx interrupts will be generated if both are zero */
-        if ((ec->tx_coalesce_usecs == 0) &&
-            (ec->tx_max_coalesced_frames == 0))
-                return -EINVAL;
-
         /* Only copy relevant parameters, ignore all others. */
         tp->coal.rx_coalesce_usecs = ec->rx_coalesce_usecs;
         tp->coal.tx_coalesce_usecs = ec->tx_coalesce_usecs;
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index 89c0cfa9719f..d954a97b0b0b 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -1323,6 +1323,24 @@ dma_error:
         return 0;
 }
 
+static inline int macb_clear_csum(struct sk_buff *skb)
+{
+        /* no change for packets without checksum offloading */
+        if (skb->ip_summed != CHECKSUM_PARTIAL)
+                return 0;
+
+        /* make sure we can modify the header */
+        if (unlikely(skb_cow_head(skb, 0)))
+                return -1;
+
+        /* initialize checksum field
+         * This is required - at least for Zynq, which otherwise calculates
+         * wrong UDP header checksums for UDP packets with UDP data len <=2
+         */
+        *(__sum16 *)(skb_checksum_start(skb) + skb->csum_offset) = 0;
+        return 0;
+}
+
 static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         u16 queue_index = skb_get_queue_mapping(skb);
@@ -1362,6 +1380,11 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
         }
 
+        if (macb_clear_csum(skb)) {
+                dev_kfree_skb_any(skb);
+                return NETDEV_TX_OK;
+        }
+
         /* Map socket buffer for DMA transfer */
         if (!macb_tx_map(bp, queue, skb)) {
                 dev_kfree_skb_any(skb);
diff --git a/drivers/net/ethernet/cavium/thunder/nic.h b/drivers/net/ethernet/cavium/thunder/nic.h
index 83025bb4737c..e29815d9e6f4 100644
--- a/drivers/net/ethernet/cavium/thunder/nic.h
+++ b/drivers/net/ethernet/cavium/thunder/nic.h
@@ -279,6 +279,7 @@ struct nicvf {
         u8                      sqs_id;
         bool                    sqs_mode;
         bool                    hw_tso;
+        bool                    t88;
 
         /* Receive buffer alloc */
         u32                     rb_page_offset;
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 16ed20357c5c..85cc782b9060 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -251,9 +251,14 @@ static void nic_set_tx_pkt_pad(struct nicpf *nic, int size)
         int lmac;
         u64 lmac_cfg;
 
-        /* Max value that can be set is 60 */
-        if (size > 60)
-                size = 60;
+        /* There is a issue in HW where-in while sending GSO sized
+         * pkts as part of TSO, if pkt len falls below this size
+         * NIC will zero PAD packet and also updates IP total length.
+         * Hence set this value to lessthan min pkt size of MAC+IP+TCP
+         * headers, BGX will do the padding to transmit 64 byte pkt.
+         */
+        if (size > 52)
+                size = 52;
 
         for (lmac = 0; lmac < (MAX_BGX_PER_CN88XX * MAX_LMAC_PER_BGX); lmac++) {
                 lmac_cfg = nic_reg_read(nic, NIC_PF_LMAC_0_7_CFG | (lmac << 3));
diff --git a/drivers/net/ethernet/cavium/thunder/nic_reg.h b/drivers/net/ethernet/cavium/thunder/nic_reg.h
index afb10e326b4f..fab35a593898 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_reg.h
+++ b/drivers/net/ethernet/cavium/thunder/nic_reg.h
@@ -170,7 +170,6 @@
 #define   NIC_QSET_SQ_0_7_DOOR                  (0x010838)
 #define   NIC_QSET_SQ_0_7_STATUS                (0x010840)
 #define   NIC_QSET_SQ_0_7_DEBUG                 (0x010848)
-#define   NIC_QSET_SQ_0_7_CNM_CHG               (0x010860)
 #define   NIC_QSET_SQ_0_7_STAT_0_1              (0x010900)
 
 #define   NIC_QSET_RBDR_0_1_CFG                 (0x010C00)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
index d2d8ef270142..ad4fddb55421 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
@@ -382,7 +382,10 @@ static void nicvf_get_regs(struct net_device *dev,
                 p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_DOOR, q);
                 p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_STATUS, q);
                 p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_DEBUG, q);
-                p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_CNM_CHG, q);
+                /* Padding, was NIC_QSET_SQ_0_7_CNM_CHG, which
+                 * produces bus errors when read
+                 */
+                p[i++] = 0;
                 p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_STAT_0_1, q);
                 reg_offset = NIC_QSET_SQ_0_7_STAT_0_1 | (1 << 3);
                 p[i++] = nicvf_queue_reg_read(nic, reg_offset, q);
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index a19e73f11d73..3240349615bd 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -513,6 +513,7 @@ static void nicvf_snd_pkt_handler(struct net_device *netdev,
         struct nicvf *nic = netdev_priv(netdev);
         struct snd_queue *sq;
         struct sq_hdr_subdesc *hdr;
+        struct sq_hdr_subdesc *tso_sqe;
 
         sq = &nic->qs->sq[cqe_tx->sq_idx];
 
@@ -527,17 +528,21 @@ static void nicvf_snd_pkt_handler(struct net_device *netdev,
 
         nicvf_check_cqe_tx_errs(nic, cq, cqe_tx);
         skb = (struct sk_buff *)sq->skbuff[cqe_tx->sqe_ptr];
-        /* For TSO offloaded packets only one SQE will have a valid SKB */
         if (skb) {
+                /* Check for dummy descriptor used for HW TSO offload on 88xx */
+                if (hdr->dont_send) {
+                        /* Get actual TSO descriptors and free them */
+                        tso_sqe =
+                         (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, hdr->rsvd2);
+                        nicvf_put_sq_desc(sq, tso_sqe->subdesc_cnt + 1);
+                }
                 nicvf_put_sq_desc(sq, hdr->subdesc_cnt + 1);
                 prefetch(skb);
                 dev_consume_skb_any(skb);
                 sq->skbuff[cqe_tx->sqe_ptr] = (u64)NULL;
         } else {
-                /* In case of HW TSO, HW sends a CQE for each segment of a TSO
-                 * packet instead of a single CQE for the whole TSO packet
-                 * transmitted. Each of this CQE points to the same SQE, so
-                 * avoid freeing same SQE multiple times.
+                /* In case of SW TSO on 88xx, only last segment will have
+                 * a SKB attached, so just free SQEs here.
                  */
                 if (!nic->hw_tso)
                         nicvf_put_sq_desc(sq, hdr->subdesc_cnt + 1);
@@ -1502,6 +1507,7 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         struct net_device *netdev;
         struct nicvf *nic;
         int    err, qcount;
+        u16    sdevid;
 
         err = pci_enable_device(pdev);
         if (err) {
@@ -1575,6 +1581,10 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!pass1_silicon(nic->pdev))
                 nic->hw_tso = true;
 
+        pci_read_config_word(nic->pdev, PCI_SUBSYSTEM_ID, &sdevid);
+        if (sdevid == 0xA134)
+                nic->t88 = true;
+
         /* Check if this VF is in QS only mode */
         if (nic->sqs_mode)
                 return 0;
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 0ff8e60deccb..dda3ea3f3bb6 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -938,6 +938,8 @@ static int nicvf_tso_count_subdescs(struct sk_buff *skb)
         return num_edescs + sh->gso_segs;
 }
 
+#define POST_CQE_DESC_COUNT 2
+
 /* Get the number of SQ descriptors needed to xmit this skb */
 static int nicvf_sq_subdesc_required(struct nicvf *nic, struct sk_buff *skb)
 {
@@ -948,6 +950,10 @@ static int nicvf_sq_subdesc_required(struct nicvf *nic, struct sk_buff *skb)
                 return subdesc_cnt;
         }
 
+        /* Dummy descriptors to get TSO pkt completion notification */
+        if (nic->t88 && nic->hw_tso && skb_shinfo(skb)->gso_size)
+                subdesc_cnt += POST_CQE_DESC_COUNT;
+
         if (skb_shinfo(skb)->nr_frags)
                 subdesc_cnt += skb_shinfo(skb)->nr_frags;
 
@@ -965,14 +971,21 @@ nicvf_sq_add_hdr_subdesc(struct nicvf *nic, struct snd_queue *sq, int qentry,
         struct sq_hdr_subdesc *hdr;
 
         hdr = (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, qentry);
-        sq->skbuff[qentry] = (u64)skb;
-
         memset(hdr, 0, SND_QUEUE_DESC_SIZE);
         hdr->subdesc_type = SQ_DESC_TYPE_HEADER;
-        /* Enable notification via CQE after processing SQE */
-        hdr->post_cqe = 1;
-        /* No of subdescriptors following this */
-        hdr->subdesc_cnt = subdesc_cnt;
+
+        if (nic->t88 && nic->hw_tso && skb_shinfo(skb)->gso_size) {
+                /* post_cqe = 0, to avoid HW posting a CQE for every TSO
+                 * segment transmitted on 88xx.
+                 */
+                hdr->subdesc_cnt = subdesc_cnt - POST_CQE_DESC_COUNT;
+        } else {
+                sq->skbuff[qentry] = (u64)skb;
+                /* Enable notification via CQE after processing SQE */
+                hdr->post_cqe = 1;
+                /* No of subdescriptors following this */
+                hdr->subdesc_cnt = subdesc_cnt;
+        }
         hdr->tot_len = len;
 
         /* Offload checksum calculation to HW */
@@ -1023,6 +1036,37 @@ static inline void nicvf_sq_add_gather_subdesc(struct snd_queue *sq, int qentry,
         gather->addr = data;
 }
 
+/* Add HDR + IMMEDIATE subdescriptors right after descriptors of a TSO
+ * packet so that a CQE is posted as a notifation for transmission of
+ * TSO packet.
+ */
+static inline void nicvf_sq_add_cqe_subdesc(struct snd_queue *sq, int qentry,
+                                            int tso_sqe, struct sk_buff *skb)
+{
+        struct sq_imm_subdesc *imm;
+        struct sq_hdr_subdesc *hdr;
+
+        sq->skbuff[qentry] = (u64)skb;
+
+        hdr = (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, qentry);
+        memset(hdr, 0, SND_QUEUE_DESC_SIZE);
+        hdr->subdesc_type = SQ_DESC_TYPE_HEADER;
+        /* Enable notification via CQE after processing SQE */
+        hdr->post_cqe = 1;
+        /* There is no packet to transmit here */
+        hdr->dont_send = 1;
+        hdr->subdesc_cnt = POST_CQE_DESC_COUNT - 1;
+        hdr->tot_len = 1;
+        /* Actual TSO header SQE index, needed for cleanup */
+        hdr->rsvd2 = tso_sqe;
+
+        qentry = nicvf_get_nxt_sqentry(sq, qentry);
+        imm = (struct sq_imm_subdesc *)GET_SQ_DESC(sq, qentry);
+        memset(imm, 0, SND_QUEUE_DESC_SIZE);
+        imm->subdesc_type = SQ_DESC_TYPE_IMMEDIATE;
+        imm->len = 1;
+}
+
 /* Segment a TSO packet into 'gso_size' segments and append
  * them to SQ for transfer
  */
@@ -1096,7 +1140,7 @@ static int nicvf_sq_append_tso(struct nicvf *nic, struct snd_queue *sq,
 int nicvf_sq_append_skb(struct nicvf *nic, struct sk_buff *skb)
 {
         int i, size;
-        int subdesc_cnt;
+        int subdesc_cnt, tso_sqe = 0;
         int sq_num, qentry;
         struct queue_set *qs;
         struct snd_queue *sq;
@@ -1131,6 +1175,7 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct sk_buff *skb)
         /* Add SQ header subdesc */
         nicvf_sq_add_hdr_subdesc(nic, sq, qentry, subdesc_cnt - 1,
                                  skb, skb->len);
+        tso_sqe = qentry;
 
         /* Add SQ gather subdescs */
         qentry = nicvf_get_nxt_sqentry(sq, qentry);
@@ -1154,6 +1199,11 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct sk_buff *skb)
         }
 
 doorbell:
+        if (nic->t88 && skb_shinfo(skb)->gso_size) {
+                qentry = nicvf_get_nxt_sqentry(sq, qentry);
+                nicvf_sq_add_cqe_subdesc(sq, qentry, tso_sqe, skb);
+        }
+
         /* make sure all memory stores are done before ringing doorbell */
         smp_wmb();
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index c45de49dc963..c762a8c8c954 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4335,6 +4335,11 @@ static void cfg_queues(struct adapter *adap)
 #endif
         int ciq_size;
 
+        /* Reduce memory usage in kdump environment, disable all offload.
+         */
+        if (is_kdump_kernel())
+                adap->params.offload = 0;
+
         for_each_port(adap, i)
                 n10g += is_x_10g_port(&adap2pinfo(adap, i)->link_cfg);
 #ifdef CONFIG_CHELSIO_T4_DCB
@@ -4365,11 +4370,6 @@ static void cfg_queues(struct adapter *adap)
         if (q10g > netif_get_num_default_rss_queues())
                 q10g = netif_get_num_default_rss_queues();
 
-        /* Reduce memory usage in kdump environment, disable all offload.
-         */
-        if (is_kdump_kernel())
-                adap->params.offload = 0;
-
         for_each_port(adap, i) {
                 struct port_info *pi = adap2pinfo(adap, i);
 
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index d20935dc8399..4b4f5bc0e279 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2922,17 +2922,25 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
 {
         unsigned int size = lstatus & BD_LENGTH_MASK;
         struct page *page = rxb->page;
+        bool last = !!(lstatus & BD_LFLAG(RXBD_LAST));
 
         /* Remove the FCS from the packet length */
-        if (likely(lstatus & BD_LFLAG(RXBD_LAST)))
+        if (last)
                 size -= ETH_FCS_LEN;
 
-        if (likely(first))
+        if (likely(first)) {
                 skb_put(skb, size);
-        else
-                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
-                                rxb->page_offset + RXBUF_ALIGNMENT,
-                                size, GFAR_RXB_TRUESIZE);
+        } else {
+                /* the last fragments' length contains the full frame length */
+                if (last)
+                        size -= skb->len;
+
+                /* in case the last fragment consisted only of the FCS */
+                if (size > 0)
+                        skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
+                                        rxb->page_offset + RXBUF_ALIGNMENT,
+                                        size, GFAR_RXB_TRUESIZE);
+        }
 
         /* try reuse page */
         if (unlikely(page_count(page) != 1))
diff --git a/drivers/net/ethernet/freescale/gianfar.h b/drivers/net/ethernet/freescale/gianfar.h
index 373fd094f2f3..6e8a9c8467b9 100644
--- a/drivers/net/ethernet/freescale/gianfar.h
+++ b/drivers/net/ethernet/freescale/gianfar.h
@@ -100,7 +100,8 @@ extern const char gfar_driver_version[];
 #define DEFAULT_RX_LFC_THR  16
 #define DEFAULT_LFC_PTVVAL  4
 
-#define GFAR_RXB_SIZE 1536
+/* prevent fragmenation by HW in DSA environments */
+#define GFAR_RXB_SIZE roundup(1536 + 8, 64)
 #define GFAR_SKBFRAG_SIZE (RXBUF_ALIGNMENT + GFAR_RXB_SIZE \
                           + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 #define GFAR_RXB_TRUESIZE 2048
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
index ff8b6a468b24..6ea872287307 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
@@ -328,9 +328,10 @@ static void hns_ppe_init_hw(struct hns_ppe_cb *ppe_cb)
 static void hns_ppe_uninit_hw(struct hns_ppe_cb *ppe_cb)
 {
         u32 port;
-        struct dsaf_device *dsaf_dev = ppe_cb->ppe_common_cb->dsaf_dev;
 
         if (ppe_cb->ppe_common_cb) {
+                struct dsaf_device *dsaf_dev = ppe_cb->ppe_common_cb->dsaf_dev;
+
                 port = ppe_cb->index;
                 dsaf_dev->misc_op->ppe_srst(dsaf_dev, port, 0);
         }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
index e1370c556a3c..618f18436618 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_client.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
@@ -199,6 +199,7 @@ void i40e_notify_client_of_l2_param_changes(struct i40e_vsi *vsi)
 void i40e_notify_client_of_netdev_open(struct i40e_vsi *vsi)
 {
         struct i40e_client_instance *cdev;
+        int ret = 0;
 
         if (!vsi)
                 return;
@@ -211,7 +212,14 @@ void i40e_notify_client_of_netdev_open(struct i40e_vsi *vsi)
                                         "Cannot locate client instance open routine\n");
                                 continue;
                         }
-                        cdev->client->ops->open(&cdev->lan_info, cdev->client);
+                        if (!(test_bit(__I40E_CLIENT_INSTANCE_OPENED,
+                                       &cdev->state))) {
+                                ret = cdev->client->ops->open(&cdev->lan_info,
+                                                              cdev->client);
+                                if (!ret)
+                                        set_bit(__I40E_CLIENT_INSTANCE_OPENED,
+                                                &cdev->state);
+                        }
                 }
         }
         mutex_unlock(&i40e_client_instance_mutex);
@@ -407,12 +415,14 @@ struct i40e_vsi *i40e_vsi_lookup(struct i40e_pf *pf,
  * i40e_client_add_instance - add a client instance struct to the instance list
  * @pf: pointer to the board struct
  * @client: pointer to a client struct in the client list.
+ * @existing: if there was already an existing instance
  *
- * Returns cdev ptr on success, NULL on failure
+ * Returns cdev ptr on success or if already exists, NULL on failure
  **/
 static
 struct i40e_client_instance *i40e_client_add_instance(struct i40e_pf *pf,
-                                                      struct i40e_client *client)
+                                                     struct i40e_client *client,
+                                                     bool *existing)
 {
         struct i40e_client_instance *cdev;
         struct netdev_hw_addr *mac = NULL;
@@ -421,7 +431,7 @@ struct i40e_client_instance *i40e_client_add_instance(struct i40e_pf *pf,
         mutex_lock(&i40e_client_instance_mutex);
         list_for_each_entry(cdev, &i40e_client_instances, list) {
                 if ((cdev->lan_info.pf == pf) && (cdev->client == client)) {
-                        cdev = NULL;
+                        *existing = true;
                         goto out;
                 }
         }
@@ -505,6 +515,7 @@ void i40e_client_subtask(struct i40e_pf *pf)
 {
         struct i40e_client_instance *cdev;
         struct i40e_client *client;
+        bool existing = false;
         int ret = 0;
 
         if (!(pf->flags & I40E_FLAG_SERVICE_CLIENT_REQUESTED))
@@ -528,18 +539,25 @@ void i40e_client_subtask(struct i40e_pf *pf)
                         /* check if L2 VSI is up, if not we are not ready */
                         if (test_bit(__I40E_DOWN, &pf->vsi[pf->lan_vsi]->state))
                                 continue;
+                } else {
+                        dev_warn(&pf->pdev->dev, "This client %s is being instanciated at probe\n",
+                                 client->name);
                 }
 
                 /* Add the client instance to the instance list */
-                cdev = i40e_client_add_instance(pf, client);
+                cdev = i40e_client_add_instance(pf, client, &existing);
                 if (!cdev)
                         continue;
 
-                /* Also up the ref_cnt of no. of instances of this client */
-                atomic_inc(&client->ref_cnt);
-                dev_info(&pf->pdev->dev, "Added instance of Client %s to PF%d bus=0x%02x func=0x%02x\n",
-                         client->name, pf->hw.pf_id,
-                         pf->hw.bus.device, pf->hw.bus.func);
+                if (!existing) {
+                        /* Also up the ref_cnt for no. of instances of this
+                         * client.
+                         */
+                        atomic_inc(&client->ref_cnt);
+                        dev_info(&pf->pdev->dev, "Added instance of Client %s to PF%d bus=0x%02x func=0x%02x\n",
+                                 client->name, pf->hw.pf_id,
+                                 pf->hw.bus.device, pf->hw.bus.func);
+                }
 
                 /* Send an Open request to the client */
                 atomic_inc(&cdev->ref_cnt);
@@ -588,7 +606,8 @@ int i40e_lan_add_device(struct i40e_pf *pf)
                  pf->hw.pf_id, pf->hw.bus.device, pf->hw.bus.func);
 
         /* Since in some cases register may have happened before a device gets
-         * added, we can schedule a subtask to go initiate the clients.
+         * added, we can schedule a subtask to go initiate the clients if
+         * they can be launched at probe time.
          */
         pf->flags |= I40E_FLAG_SERVICE_CLIENT_REQUESTED;
         i40e_service_event_schedule(pf);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index c6ac7a61812f..d0b3a1bb82ca 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -5113,9 +5113,13 @@ static int i40e_init_pf_dcb(struct i40e_pf *pf)
                                        DCB_CAP_DCBX_VER_IEEE;
 
                         pf->flags |= I40E_FLAG_DCB_CAPABLE;
-                        /* Enable DCB tagging only when more than one TC */
+                        /* Enable DCB tagging only when more than one TC
+                         * or explicitly disable if only one TC
+                         */
                         if (i40e_dcb_get_num_tc(&hw->local_dcbx_config) > 1)
                                 pf->flags |= I40E_FLAG_DCB_ENABLED;
+                        else
+                                pf->flags &= ~I40E_FLAG_DCB_ENABLED;
                         dev_dbg(&pf->pdev->dev,
                                 "DCBX offload is supported for this PF.\n");
                 }
@@ -5431,7 +5435,6 @@ int i40e_open(struct net_device *netdev)
         wr32(&pf->hw, I40E_GLLAN_TSOMSK_L, be32_to_cpu(TCP_FLAG_CWR) >> 16);
 
         udp_tunnel_get_rx_info(netdev);
-        i40e_notify_client_of_netdev_open(vsi);
 
         return 0;
 }
@@ -5717,7 +5720,7 @@ static int i40e_handle_lldp_event(struct i40e_pf *pf,
         u8 type;
 
         /* Not DCB capable or capability disabled */
-        if (!(pf->flags & I40E_FLAG_DCB_CAPABLE))
+        if (!(pf->flags & I40E_FLAG_DCB_ENABLED))
                 return ret;
 
         /* Ignore if event is not for Nearest Bridge */
@@ -7897,6 +7900,7 @@ static int i40e_init_interrupt_scheme(struct i40e_pf *pf)
 #endif
                                        I40E_FLAG_RSS_ENABLED    |
                                        I40E_FLAG_DCB_CAPABLE    |
+                                       I40E_FLAG_DCB_ENABLED    |
                                        I40E_FLAG_SRIOV_ENABLED  |
                                        I40E_FLAG_FD_SB_ENABLED  |
                                        I40E_FLAG_FD_ATR_ENABLED |
@@ -10503,6 +10507,7 @@ static void i40e_determine_queue_usage(struct i40e_pf *pf)
                                I40E_FLAG_FD_SB_ENABLED  |
                                I40E_FLAG_FD_ATR_ENABLED |
                                I40E_FLAG_DCB_CAPABLE    |
+                               I40E_FLAG_DCB_ENABLED    |
                                I40E_FLAG_SRIOV_ENABLED  |
                                I40E_FLAG_VMDQ_ENABLED);
         } else if (!(pf->flags & (I40E_FLAG_RSS_ENABLED |
@@ -10526,7 +10531,8 @@ static void i40e_determine_queue_usage(struct i40e_pf *pf)
                 /* Not enough queues for all TCs */
                 if ((pf->flags & I40E_FLAG_DCB_CAPABLE) &&
                     (queues_left < I40E_MAX_TRAFFIC_CLASS)) {
-                        pf->flags &= ~I40E_FLAG_DCB_CAPABLE;
+                        pf->flags &= ~(I40E_FLAG_DCB_CAPABLE |
+                                        I40E_FLAG_DCB_ENABLED);
                         dev_info(&pf->pdev->dev, "not enough queues for DCB. DCB is disabled.\n");
                 }
                 pf->num_lan_qps = max_t(int, pf->rss_size_max,
@@ -10923,7 +10929,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         err = i40e_init_pf_dcb(pf);
         if (err) {
                 dev_info(&pdev->dev, "DCB init failed %d, disabled\n", err);
-                pf->flags &= ~I40E_FLAG_DCB_CAPABLE;
+                pf->flags &= ~(I40E_FLAG_DCB_CAPABLE & I40E_FLAG_DCB_ENABLED);
                 /* Continue without DCB enabled */
         }
 #endif /* CONFIG_I40E_DCB */
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
index b4217f30e89c..c47b605e8651 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -2958,8 +2958,10 @@ s32 ixgbe_clear_vmdq_generic(struct ixgbe_hw *hw, u32 rar, u32 vmdq)
         }
 
         /* was that the last pool using this rar? */
-        if (mpsar_lo == 0 && mpsar_hi == 0 && rar != 0)
+        if (mpsar_lo == 0 && mpsar_hi == 0 &&
+            rar != 0 && rar != hw->mac.san_mac_rar_index)
                 hw->mac.ops.clear_rar(hw, rar);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index f1609542adf1..d9199151a83e 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -50,6 +50,10 @@ static const struct mtk_ethtool_stats {
         MTK_ETHTOOL_STAT(rx_flow_control_packets),
 };
 
+static const char * const mtk_clks_source_name[] = {
+        "ethif", "esw", "gp1", "gp2"
+};
+
 void mtk_w32(struct mtk_eth *eth, u32 val, unsigned reg)
 {
         __raw_writel(val, eth->base + reg);
@@ -291,7 +295,7 @@ err_phy:
 static int mtk_mdio_init(struct mtk_eth *eth)
 {
         struct device_node *mii_np;
-        int err;
+        int ret;
 
         mii_np = of_get_child_by_name(eth->dev->of_node, "mdio-bus");
         if (!mii_np) {
@@ -300,13 +304,13 @@ static int mtk_mdio_init(struct mtk_eth *eth)
         }
 
         if (!of_device_is_available(mii_np)) {
-                err = 0;
+                ret = -ENODEV;
                 goto err_put_node;
         }
 
-        eth->mii_bus = mdiobus_alloc();
+        eth->mii_bus = devm_mdiobus_alloc(eth->dev);
         if (!eth->mii_bus) {
-                err = -ENOMEM;
+                ret = -ENOMEM;
                 goto err_put_node;
         }
 
@@ -317,19 +321,11 @@ static int mtk_mdio_init(struct mtk_eth *eth)
         eth->mii_bus->parent = eth->dev;
 
         snprintf(eth->mii_bus->id, MII_BUS_ID_SIZE, "%s", mii_np->name);
-        err = of_mdiobus_register(eth->mii_bus, mii_np);
-        if (err)
-                goto err_free_bus;
-
-        return 0;
-
-err_free_bus:
-        mdiobus_free(eth->mii_bus);
+        ret = of_mdiobus_register(eth->mii_bus, mii_np);
 
 err_put_node:
         of_node_put(mii_np);
-        eth->mii_bus = NULL;
-        return err;
+        return ret;
 }
 
 static void mtk_mdio_cleanup(struct mtk_eth *eth)
@@ -338,8 +334,6 @@ static void mtk_mdio_cleanup(struct mtk_eth *eth)
                 return;
 
         mdiobus_unregister(eth->mii_bus);
-        of_node_put(eth->mii_bus->dev.of_node);
-        mdiobus_free(eth->mii_bus);
 }
 
 static inline void mtk_irq_disable(struct mtk_eth *eth, u32 mask)
@@ -588,14 +582,15 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
         dma_addr_t mapped_addr;
         unsigned int nr_frags;
         int i, n_desc = 1;
-        u32 txd4 = 0;
+        u32 txd4 = 0, fport;
 
         itxd = ring->next_free;
         if (itxd == ring->last_free)
                 return -ENOMEM;
 
         /* set the forward port */
-        txd4 |= (mac->id + 1) << TX_DMA_FPORT_SHIFT;
+        fport = (mac->id + 1) << TX_DMA_FPORT_SHIFT;
+        txd4 |= fport;
 
         tx_buf = mtk_desc_to_tx_buf(ring, itxd);
         memset(tx_buf, 0, sizeof(*tx_buf));
@@ -653,7 +648,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
                         WRITE_ONCE(txd->txd3, (TX_DMA_SWC |
                                                TX_DMA_PLEN0(frag_map_size) |
                                                last_frag * TX_DMA_LS0));
-                        WRITE_ONCE(txd->txd4, 0);
+                        WRITE_ONCE(txd->txd4, fport);
 
                         tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;
                         tx_buf = mtk_desc_to_tx_buf(ring, txd);
@@ -865,7 +860,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                 /* receive data */
                 skb = build_skb(data, ring->frag_size);
                 if (unlikely(!skb)) {
-                        put_page(virt_to_head_page(new_data));
+                        skb_free_frag(new_data);
                         netdev->stats.rx_dropped++;
                         goto release_desc;
                 }
@@ -1506,10 +1501,7 @@ static void mtk_uninit(struct net_device *dev)
         struct mtk_eth *eth = mac->hw;
 
         phy_disconnect(mac->phy_dev);
-        mtk_mdio_cleanup(eth);
         mtk_irq_disable(eth, ~0);
-        free_irq(eth->irq[1], dev);
-        free_irq(eth->irq[2], dev);
 }
 
 static int mtk_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
@@ -1813,6 +1805,7 @@ static int mtk_probe(struct platform_device *pdev)
         if (!eth)
                 return -ENOMEM;
 
+        eth->dev = &pdev->dev;
         eth->base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(eth->base))
                 return PTR_ERR(eth->base);
@@ -1847,21 +1840,21 @@ static int mtk_probe(struct platform_device *pdev)
                         return -ENXIO;
                 }
         }
+        for (i = 0; i < ARRAY_SIZE(eth->clks); i++) {
+                eth->clks[i] = devm_clk_get(eth->dev,
+                                            mtk_clks_source_name[i]);
+                if (IS_ERR(eth->clks[i])) {
+                        if (PTR_ERR(eth->clks[i]) == -EPROBE_DEFER)
+                                return -EPROBE_DEFER;
+                        return -ENODEV;
+                }
+        }
 
-        eth->clk_ethif = devm_clk_get(&pdev->dev, "ethif");
-        eth->clk_esw = devm_clk_get(&pdev->dev, "esw");
-        eth->clk_gp1 = devm_clk_get(&pdev->dev, "gp1");
-        eth->clk_gp2 = devm_clk_get(&pdev->dev, "gp2");
-        if (IS_ERR(eth->clk_esw) || IS_ERR(eth->clk_gp1) ||
-            IS_ERR(eth->clk_gp2) || IS_ERR(eth->clk_ethif))
-                return -ENODEV;
-
-        clk_prepare_enable(eth->clk_ethif);
-        clk_prepare_enable(eth->clk_esw);
-        clk_prepare_enable(eth->clk_gp1);
-        clk_prepare_enable(eth->clk_gp2);
+        clk_prepare_enable(eth->clks[MTK_CLK_ETHIF]);
+        clk_prepare_enable(eth->clks[MTK_CLK_ESW]);
+        clk_prepare_enable(eth->clks[MTK_CLK_GP1]);
+        clk_prepare_enable(eth->clks[MTK_CLK_GP2]);
 
-        eth->dev = &pdev->dev;
         eth->msg_enable = netif_msg_init(mtk_msg_level, MTK_DEFAULT_MSG_ENABLE);
         INIT_WORK(&eth->pending_work, mtk_pending_work);
 
@@ -1903,15 +1896,24 @@ err_free_dev:
 static int mtk_remove(struct platform_device *pdev)
 {
         struct mtk_eth *eth = platform_get_drvdata(pdev);
+        int i;
 
-        clk_disable_unprepare(eth->clk_ethif);
-        clk_disable_unprepare(eth->clk_esw);
-        clk_disable_unprepare(eth->clk_gp1);
-        clk_disable_unprepare(eth->clk_gp2);
+        /* stop all devices to make sure that dma is properly shut down */
+        for (i = 0; i < MTK_MAC_COUNT; i++) {
+                if (!eth->netdev[i])
+                        continue;
+                mtk_stop(eth->netdev[i]);
+        }
+
+        clk_disable_unprepare(eth->clks[MTK_CLK_ETHIF]);
+        clk_disable_unprepare(eth->clks[MTK_CLK_ESW]);
+        clk_disable_unprepare(eth->clks[MTK_CLK_GP1]);
+        clk_disable_unprepare(eth->clks[MTK_CLK_GP2]);
 
         netif_napi_del(&eth->tx_napi);
         netif_napi_del(&eth->rx_napi);
         mtk_cleanup(eth);
+        mtk_mdio_cleanup(eth);
         platform_set_drvdata(pdev, NULL);
 
         return 0;
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
index f82e3acb947b..6e1ade7a25c5 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
@@ -290,6 +290,17 @@ enum mtk_tx_flags {
         MTK_TX_FLAGS_PAGE0      = 0x02,
 };
 
+/* This enum allows us to identify how the clock is defined on the array of the
+ * clock in the order
+ */
+enum mtk_clks_map {
+        MTK_CLK_ETHIF,
+        MTK_CLK_ESW,
+        MTK_CLK_GP1,
+        MTK_CLK_GP2,
+        MTK_CLK_MAX
+};
+
 /* struct mtk_tx_buf -  This struct holds the pointers to the memory pointed at
  *                      by the TX descriptor    s
  * @skb:                The SKB pointer of the packet being sent
@@ -370,10 +381,7 @@ struct mtk_rx_ring {
  * @scratch_ring:       Newer SoCs need memory for a second HW managed TX ring
  * @phy_scratch_ring:   physical address of scratch_ring
  * @scratch_head:       The scratch memory that scratch_ring points to.
- * @clk_ethif:          The ethif clock
- * @clk_esw:            The switch clock
- * @clk_gp1:            The gmac1 clock
- * @clk_gp2:            The gmac2 clock
+ * @clks:               clock array for all clocks required
  * @mii_bus:            If there is a bus we need to create an instance for it
  * @pending_work:       The workqueue used to reset the dma ring
  */
@@ -400,10 +408,8 @@ struct mtk_eth {
         struct mtk_tx_dma               *scratch_ring;
         dma_addr_t                      phy_scratch_ring;
         void                            *scratch_head;
-        struct clk                      *clk_ethif;
-        struct clk                      *clk_esw;
-        struct clk                      *clk_gp1;
-        struct clk                      *clk_gp2;
+        struct clk                      *clks[MTK_CLK_MAX];
+
         struct mii_bus                  *mii_bus;
         struct work_struct              pending_work;
 };
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
index 99c6bbdff501..b04760a5034b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
@@ -94,7 +94,7 @@ static u8 mlx4_en_dcbnl_getcap(struct net_device *dev, int capid, u8 *cap)
                 *cap = true;
                 break;
         case DCB_CAP_ATTR_DCBX:
-                *cap = priv->cee_params.dcbx_cap;
+                *cap = priv->dcbx_cap;
                 break;
         case DCB_CAP_ATTR_PFC_TCS:
                 *cap = 1 <<  mlx4_max_tc(priv->mdev->dev);
@@ -111,14 +111,14 @@ static u8 mlx4_en_dcbnl_getpfcstate(struct net_device *netdev)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        return priv->cee_params.dcb_cfg.pfc_state;
+        return priv->cee_config.pfc_state;
 }
 
 static void mlx4_en_dcbnl_setpfcstate(struct net_device *netdev, u8 state)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        priv->cee_params.dcb_cfg.pfc_state = state;
+        priv->cee_config.pfc_state = state;
 }
 
 static void mlx4_en_dcbnl_get_pfc_cfg(struct net_device *netdev, int priority,
@@ -126,7 +126,7 @@ static void mlx4_en_dcbnl_get_pfc_cfg(struct net_device *netdev, int priority,
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        *setting = priv->cee_params.dcb_cfg.tc_config[priority].dcb_pfc;
+        *setting = priv->cee_config.dcb_pfc[priority];
 }
 
 static void mlx4_en_dcbnl_set_pfc_cfg(struct net_device *netdev, int priority,
@@ -134,8 +134,8 @@ static void mlx4_en_dcbnl_set_pfc_cfg(struct net_device *netdev, int priority,
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        priv->cee_params.dcb_cfg.tc_config[priority].dcb_pfc = setting;
-        priv->cee_params.dcb_cfg.pfc_state = true;
+        priv->cee_config.dcb_pfc[priority] = setting;
+        priv->cee_config.pfc_state = true;
 }
 
 static int mlx4_en_dcbnl_getnumtcs(struct net_device *netdev, int tcid, u8 *num)
@@ -157,13 +157,11 @@ static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
         struct mlx4_en_dev *mdev = priv->mdev;
-        struct mlx4_en_cee_config *dcb_cfg = &priv->cee_params.dcb_cfg;
-        int err = 0;
 
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
-                return -EINVAL;
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+                return 1;
 
-        if (dcb_cfg->pfc_state) {
+        if (priv->cee_config.pfc_state) {
                 int tc;
 
                 priv->prof->rx_pause = 0;
@@ -171,7 +169,7 @@ static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
                 for (tc = 0; tc < CEE_DCBX_MAX_PRIO; tc++) {
                         u8 tc_mask = 1 << tc;
 
-                        switch (dcb_cfg->tc_config[tc].dcb_pfc) {
+                        switch (priv->cee_config.dcb_pfc[tc]) {
                         case pfc_disabled:
                                 priv->prof->tx_ppp &= ~tc_mask;
                                 priv->prof->rx_ppp &= ~tc_mask;
@@ -199,15 +197,17 @@ static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
                 en_dbg(DRV, priv, "Set pfc off\n");
         }
 
-        err = mlx4_SET_PORT_general(mdev->dev, priv->port,
-                                    priv->rx_skb_size + ETH_FCS_LEN,
-                                    priv->prof->tx_pause,
-                                    priv->prof->tx_ppp,
-                                    priv->prof->rx_pause,
-                                    priv->prof->rx_ppp);
-        if (err)
+        if (mlx4_SET_PORT_general(mdev->dev, priv->port,
+                                  priv->rx_skb_size + ETH_FCS_LEN,
+                                  priv->prof->tx_pause,
+                                  priv->prof->tx_ppp,
+                                  priv->prof->rx_pause,
+                                  priv->prof->rx_ppp)) {
                 en_err(priv, "Failed setting pause params\n");
-        return err;
+                return 1;
+        }
+
+        return 0;
 }
 
 static u8 mlx4_en_dcbnl_get_state(struct net_device *dev)
@@ -225,7 +225,7 @@ static u8 mlx4_en_dcbnl_set_state(struct net_device *dev, u8 state)
         struct mlx4_en_priv *priv = netdev_priv(dev);
         int num_tcs = 0;
 
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
                 return 1;
 
         if (!!(state) == !!(priv->flags & MLX4_EN_FLAG_DCB_ENABLED))
@@ -238,7 +238,10 @@ static u8 mlx4_en_dcbnl_set_state(struct net_device *dev, u8 state)
                 priv->flags &= ~MLX4_EN_FLAG_DCB_ENABLED;
         }
 
-        return mlx4_en_setup_tc(dev, num_tcs);
+        if (mlx4_en_setup_tc(dev, num_tcs))
+                return 1;
+
+        return 0;
 }
 
 /* On success returns a non-zero 802.1p user priority bitmap
@@ -252,7 +255,7 @@ static int mlx4_en_dcbnl_getapp(struct net_device *netdev, u8 idtype, u16 id)
                                 .selector = idtype,
                                 .protocol = id,
                              };
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
                 return 0;
 
         return dcb_getapp(netdev, &app);
@@ -264,7 +267,7 @@ static int mlx4_en_dcbnl_setapp(struct net_device *netdev, u8 idtype,
         struct mlx4_en_priv *priv = netdev_priv(netdev);
         struct dcb_app app;
 
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
                 return -EINVAL;
 
         memset(&app, 0, sizeof(struct dcb_app));
@@ -433,7 +436,7 @@ static u8 mlx4_en_dcbnl_getdcbx(struct net_device *dev)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
 
-        return priv->cee_params.dcbx_cap;
+        return priv->dcbx_cap;
 }
 
 static u8 mlx4_en_dcbnl_setdcbx(struct net_device *dev, u8 mode)
@@ -442,7 +445,7 @@ static u8 mlx4_en_dcbnl_setdcbx(struct net_device *dev, u8 mode)
         struct ieee_ets ets = {0};
         struct ieee_pfc pfc = {0};
 
-        if (mode == priv->cee_params.dcbx_cap)
+        if (mode == priv->dcbx_cap)
                 return 0;
 
         if ((mode & DCB_CAP_DCBX_LLD_MANAGED) ||
@@ -451,7 +454,7 @@ static u8 mlx4_en_dcbnl_setdcbx(struct net_device *dev, u8 mode)
             !(mode & DCB_CAP_DCBX_HOST))
                 goto err;
 
-        priv->cee_params.dcbx_cap = mode;
+        priv->dcbx_cap = mode;
 
         ets.ets_cap = IEEE_8021QAZ_MAX_TCS;
         pfc.pfc_cap = IEEE_8021QAZ_MAX_TCS;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 4198e9bf89d0..fedb829276f4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -71,10 +71,11 @@ int mlx4_en_setup_tc(struct net_device *dev, u8 up)
 #ifdef CONFIG_MLX4_EN_DCB
         if (!mlx4_is_slave(priv->mdev->dev)) {
                 if (up) {
-                        priv->flags |= MLX4_EN_FLAG_DCB_ENABLED;
+                        if (priv->dcbx_cap)
+                                priv->flags |= MLX4_EN_FLAG_DCB_ENABLED;
                 } else {
                         priv->flags &= ~MLX4_EN_FLAG_DCB_ENABLED;
-                        priv->cee_params.dcb_cfg.pfc_state = false;
+                        priv->cee_config.pfc_state = false;
                 }
         }
 #endif /* CONFIG_MLX4_EN_DCB */
@@ -3048,9 +3049,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         struct mlx4_en_priv *priv;
         int i;
         int err;
-#ifdef CONFIG_MLX4_EN_DCB
-        struct tc_configuration *tc;
-#endif
 
         dev = alloc_etherdev_mqs(sizeof(struct mlx4_en_priv),
                                  MAX_TX_RINGS, MAX_RX_RINGS);
@@ -3117,16 +3115,13 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         priv->msg_enable = MLX4_EN_MSG_LEVEL;
 #ifdef CONFIG_MLX4_EN_DCB
         if (!mlx4_is_slave(priv->mdev->dev)) {
-                priv->cee_params.dcbx_cap = DCB_CAP_DCBX_VER_CEE |
-                                            DCB_CAP_DCBX_HOST |
-                                            DCB_CAP_DCBX_VER_IEEE;
+                priv->dcbx_cap = DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_HOST |
+                        DCB_CAP_DCBX_VER_IEEE;
                 priv->flags |= MLX4_EN_DCB_ENABLED;
-                priv->cee_params.dcb_cfg.pfc_state = false;
+                priv->cee_config.pfc_state = false;
 
-                for (i = 0; i < MLX4_EN_NUM_UP; i++) {
-                        tc = &priv->cee_params.dcb_cfg.tc_config[i];
-                        tc->dcb_pfc = pfc_disabled;
-                }
+                for (i = 0; i < MLX4_EN_NUM_UP; i++)
+                        priv->cee_config.dcb_pfc[i] = pfc_disabled;
 
                 if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_ETS_CFG) {
                         dev->dcbnl_ops = &mlx4_en_dcbnl_ops;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 9df87ca0515a..e2509bba3e7c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -818,7 +818,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
         real_size = get_real_size(skb, shinfo, dev, &lso_header_size,
                                   &inline_ok, &fragptr);
         if (unlikely(!real_size))
-                goto tx_drop;
+                goto tx_drop_count;
 
         /* Align descriptor to TXBB size */
         desc_size = ALIGN(real_size, TXBB_SIZE);
@@ -826,7 +826,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
         if (unlikely(nr_txbb > MAX_DESC_TXBBS)) {
                 if (netif_msg_tx_err(priv))
                         en_warn(priv, "Oversized header or SG list\n");
-                goto tx_drop;
+                goto tx_drop_count;
         }
 
         bf_ok = ring->bf_enabled;
@@ -1071,9 +1071,10 @@ tx_drop_unmap:
                                PCI_DMA_TODEVICE);
         }
 
+tx_drop_count:
+        ring->tx_dropped++;
 tx_drop:
         dev_kfree_skb_any(skb);
-        ring->tx_dropped++;
         return NETDEV_TX_OK;
 }
 
@@ -1106,7 +1107,7 @@ netdev_tx_t mlx4_en_xmit_frame(struct mlx4_en_rx_alloc *frame,
                 goto tx_drop;
 
         if (mlx4_en_is_tx_ring_full(ring))
-                goto tx_drop;
+                goto tx_drop_count;
 
         /* fetch ring->cons far ahead before needing it to avoid stall */
         ring_cons = READ_ONCE(ring->cons);
@@ -1176,7 +1177,8 @@ netdev_tx_t mlx4_en_xmit_frame(struct mlx4_en_rx_alloc *frame,
 
         return NETDEV_TX_OK;
 
-tx_drop:
+tx_drop_count:
         ring->tx_dropped++;
+tx_drop:
         return NETDEV_TX_BUSY;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 2c2913dcae98..9099dbd04951 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -482,20 +482,10 @@ enum dcb_pfc_type {
         pfc_enabled_rx
 };
 
-struct tc_configuration {
-        enum dcb_pfc_type  dcb_pfc;
-};
-
 struct mlx4_en_cee_config {
         bool    pfc_state;
-        struct  tc_configuration tc_config[MLX4_EN_NUM_UP];
+        enum    dcb_pfc_type dcb_pfc[MLX4_EN_NUM_UP];
 };
-
-struct mlx4_en_cee_params {
-        u8 dcbx_cap;
-        struct mlx4_en_cee_config dcb_cfg;
-};
-
 #endif
 
 struct ethtool_flow_id {
@@ -624,7 +614,8 @@ struct mlx4_en_priv {
         struct ieee_ets ets;
         u16 maxrate[IEEE_8021QAZ_MAX_TCS];
         enum dcbnl_cndd_states cndd_state[IEEE_8021QAZ_MAX_TCS];
-        struct mlx4_en_cee_params cee_params;
+        struct mlx4_en_cee_config cee_config;
+        u8 dcbx_cap;
 #endif
 #ifdef CONFIG_RFS_ACCEL
         spinlock_t filters_lock;
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index 3d2095e5c61c..c5b2064297a1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -52,7 +52,7 @@
 
 #define MLX4_FLAG_V_IGNORE_FCS_MASK             0x2
 #define MLX4_IGNORE_FCS_MASK                    0x1
-#define MLNX4_TX_MAX_NUMBER                     8
+#define MLX4_TC_MAX_NUMBER                      8
 
 void mlx4_init_mac_table(struct mlx4_dev *dev, struct mlx4_mac_table *table)
 {
@@ -2022,7 +2022,7 @@ int mlx4_max_tc(struct mlx4_dev *dev)
         u8 num_tc = dev->caps.max_tc_eth;
 
         if (!num_tc)
-                num_tc = MLNX4_TX_MAX_NUMBER;
+                num_tc = MLX4_TC_MAX_NUMBER;
 
         return num_tc;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index d6e2a1cae19a..c2ec01a22d55 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -143,13 +143,14 @@ static struct mlx5_cmd_layout *get_inst(struct mlx5_cmd *cmd, int idx)
         return cmd->cmd_buf + (idx << cmd->log_stride);
 }
 
-static u8 xor8_buf(void *buf, int len)
+static u8 xor8_buf(void *buf, size_t offset, int len)
 {
         u8 *ptr = buf;
         u8 sum = 0;
         int i;
+        int end = len + offset;
 
-        for (i = 0; i < len; i++)
+        for (i = offset; i < end; i++)
                 sum ^= ptr[i];
 
         return sum;
@@ -157,41 +158,49 @@ static u8 xor8_buf(void *buf, int len)
 
 static int verify_block_sig(struct mlx5_cmd_prot_block *block)
 {
-        if (xor8_buf(block->rsvd0, sizeof(*block) - sizeof(block->data) - 1) != 0xff)
+        size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0);
+        int xor_len = sizeof(*block) - sizeof(block->data) - 1;
+
+        if (xor8_buf(block, rsvd0_off, xor_len) != 0xff)
                 return -EINVAL;
 
-        if (xor8_buf(block, sizeof(*block)) != 0xff)
+        if (xor8_buf(block, 0, sizeof(*block)) != 0xff)
                 return -EINVAL;
 
         return 0;
 }
 
-static void calc_block_sig(struct mlx5_cmd_prot_block *block, u8 token,
-                           int csum)
+static void calc_block_sig(struct mlx5_cmd_prot_block *block)
 {
-        block->token = token;
-        if (csum) {
-                block->ctrl_sig = ~xor8_buf(block->rsvd0, sizeof(*block) -
-                                            sizeof(block->data) - 2);
-                block->sig = ~xor8_buf(block, sizeof(*block) - 1);
-        }
+        int ctrl_xor_len = sizeof(*block) - sizeof(block->data) - 2;
+        size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0);
+
+        block->ctrl_sig = ~xor8_buf(block, rsvd0_off, ctrl_xor_len);
+        block->sig = ~xor8_buf(block, 0, sizeof(*block) - 1);
 }
 
-static void calc_chain_sig(struct mlx5_cmd_msg *msg, u8 token, int csum)
+static void calc_chain_sig(struct mlx5_cmd_msg *msg)
 {
         struct mlx5_cmd_mailbox *next = msg->next;
-
-        while (next) {
-                calc_block_sig(next->buf, token, csum);
+        int size = msg->len;
+        int blen = size - min_t(int, sizeof(msg->first.data), size);
+        int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1)
+                / MLX5_CMD_DATA_BLOCK_SIZE;
+        int i = 0;
+
+        for (i = 0; i < n && next; i++)  {
+                calc_block_sig(next->buf);
                 next = next->next;
         }
 }
 
 static void set_signature(struct mlx5_cmd_work_ent *ent, int csum)
 {
-        ent->lay->sig = ~xor8_buf(ent->lay, sizeof(*ent->lay));
-        calc_chain_sig(ent->in, ent->token, csum);
-        calc_chain_sig(ent->out, ent->token, csum);
+        ent->lay->sig = ~xor8_buf(ent->lay, 0,  sizeof(*ent->lay));
+        if (csum) {
+                calc_chain_sig(ent->in);
+                calc_chain_sig(ent->out);
+        }
 }
 
 static void poll_timeout(struct mlx5_cmd_work_ent *ent)
@@ -222,12 +231,17 @@ static int verify_signature(struct mlx5_cmd_work_ent *ent)
         struct mlx5_cmd_mailbox *next = ent->out->next;
         int err;
         u8 sig;
+        int size = ent->out->len;
+        int blen = size - min_t(int, sizeof(ent->out->first.data), size);
+        int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1)
+                / MLX5_CMD_DATA_BLOCK_SIZE;
+        int i = 0;
 
-        sig = xor8_buf(ent->lay, sizeof(*ent->lay));
+        sig = xor8_buf(ent->lay, 0, sizeof(*ent->lay));
         if (sig != 0xff)
                 return -EINVAL;
 
-        while (next) {
+        for (i = 0; i < n && next; i++) {
                 err = verify_block_sig(next->buf);
                 if (err)
                         return err;
@@ -656,7 +670,6 @@ static void cmd_work_handler(struct work_struct *work)
                 spin_unlock_irqrestore(&cmd->alloc_lock, flags);
         }
 
-        ent->token = alloc_token(cmd);
         cmd->ent_arr[ent->idx] = ent;
         lay = get_inst(cmd, ent->idx);
         ent->lay = lay;
@@ -766,7 +779,8 @@ static u8 *get_status_ptr(struct mlx5_outbox_hdr *out)
 static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
                            struct mlx5_cmd_msg *out, void *uout, int uout_size,
                            mlx5_cmd_cbk_t callback,
-                           void *context, int page_queue, u8 *status)
+                           void *context, int page_queue, u8 *status,
+                           u8 token)
 {
         struct mlx5_cmd *cmd = &dev->cmd;
         struct mlx5_cmd_work_ent *ent;
@@ -783,6 +797,8 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
         if (IS_ERR(ent))
                 return PTR_ERR(ent);
 
+        ent->token = token;
+
         if (!callback)
                 init_completion(&ent->done);
 
@@ -854,7 +870,8 @@ static const struct file_operations fops = {
         .write  = dbg_write,
 };
 
-static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size)
+static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size,
+                            u8 token)
 {
         struct mlx5_cmd_prot_block *block;
         struct mlx5_cmd_mailbox *next;
@@ -880,6 +897,7 @@ static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size)
                 memcpy(block->data, from, copy);
                 from += copy;
                 size -= copy;
+                block->token = token;
                 next = next->next;
         }
 
@@ -949,7 +967,8 @@ static void free_cmd_box(struct mlx5_core_dev *dev,
 }
 
 static struct mlx5_cmd_msg *mlx5_alloc_cmd_msg(struct mlx5_core_dev *dev,
-                                               gfp_t flags, int size)
+                                               gfp_t flags, int size,
+                                               u8 token)
 {
         struct mlx5_cmd_mailbox *tmp, *head = NULL;
         struct mlx5_cmd_prot_block *block;
@@ -978,6 +997,7 @@ static struct mlx5_cmd_msg *mlx5_alloc_cmd_msg(struct mlx5_core_dev *dev,
                 tmp->next = head;
                 block->next = cpu_to_be64(tmp->next ? tmp->next->dma : 0);
                 block->block_num = cpu_to_be32(n - i - 1);
+                block->token = token;
                 head = tmp;
         }
         msg->next = head;
@@ -1352,7 +1372,7 @@ static struct mlx5_cmd_msg *alloc_msg(struct mlx5_core_dev *dev, int in_size,
         }
 
         if (IS_ERR(msg))
-                msg = mlx5_alloc_cmd_msg(dev, gfp, in_size);
+                msg = mlx5_alloc_cmd_msg(dev, gfp, in_size, 0);
 
         return msg;
 }
@@ -1377,6 +1397,7 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out,
         int err;
         u8 status = 0;
         u32 drv_synd;
+        u8 token;
 
         if (pci_channel_offline(dev->pdev) ||
             dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
@@ -1395,20 +1416,22 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out,
                 return err;
         }
 
-        err = mlx5_copy_to_msg(inb, in, in_size);
+        token = alloc_token(&dev->cmd);
+
+        err = mlx5_copy_to_msg(inb, in, in_size, token);
         if (err) {
                 mlx5_core_warn(dev, "err %d\n", err);
                 goto out_in;
         }
 
-        outb = mlx5_alloc_cmd_msg(dev, gfp, out_size);
+        outb = mlx5_alloc_cmd_msg(dev, gfp, out_size, token);
         if (IS_ERR(outb)) {
                 err = PTR_ERR(outb);
                 goto out_in;
         }
 
         err = mlx5_cmd_invoke(dev, inb, outb, out, out_size, callback, context,
-                              pages_queue, &status);
+                              pages_queue, &status, token);
         if (err)
                 goto out_out;
 
@@ -1476,7 +1499,7 @@ static int create_msg_cache(struct mlx5_core_dev *dev)
         INIT_LIST_HEAD(&cmd->cache.med.head);
 
         for (i = 0; i < NUM_LONG_LISTS; i++) {
-                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE);
+                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE, 0);
                 if (IS_ERR(msg)) {
                         err = PTR_ERR(msg);
                         goto ex_err;
@@ -1486,7 +1509,7 @@ static int create_msg_cache(struct mlx5_core_dev *dev)
         }
 
         for (i = 0; i < NUM_MED_LISTS; i++) {
-                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE);
+                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE, 0);
                 if (IS_ERR(msg)) {
                         err = PTR_ERR(msg);
                         goto ex_err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 1b495efa7490..bf722aa88cf0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -73,8 +73,12 @@
 #define MLX5_MPWRQ_PAGES_PER_WQE                BIT(MLX5_MPWRQ_WQE_PAGE_ORDER)
 #define MLX5_MPWRQ_STRIDES_PER_PAGE             (MLX5_MPWRQ_NUM_STRIDES >> \
                                                  MLX5_MPWRQ_WQE_PAGE_ORDER)
-#define MLX5_CHANNEL_MAX_NUM_MTTS (ALIGN(MLX5_MPWRQ_PAGES_PER_WQE, 8) * \
-                                   BIT(MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW))
+
+#define MLX5_MTT_OCTW(npages) (ALIGN(npages, 8) / 2)
+#define MLX5E_REQUIRED_MTTS(rqs, wqes)\
+        (rqs * wqes * ALIGN(MLX5_MPWRQ_PAGES_PER_WQE, 8))
+#define MLX5E_VALID_NUM_MTTS(num_mtts) (MLX5_MTT_OCTW(num_mtts) <= U16_MAX)
+
 #define MLX5_UMR_ALIGN                          (2048)
 #define MLX5_MPWRQ_SMALL_PACKET_THRESHOLD       (128)
 
@@ -219,9 +223,8 @@ struct mlx5e_tstamp {
 };
 
 enum {
-        MLX5E_RQ_STATE_POST_WQES_ENABLE,
+        MLX5E_RQ_STATE_FLUSH,
         MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS,
-        MLX5E_RQ_STATE_FLUSH_TIMEOUT,
         MLX5E_RQ_STATE_AM,
 };
 
@@ -304,6 +307,7 @@ struct mlx5e_rq {
 
         unsigned long          state;
         int                    ix;
+        u32                    mpwqe_mtt_offset;
 
         struct mlx5e_rx_am     am; /* Adaptive Moderation */
 
@@ -365,9 +369,8 @@ struct mlx5e_sq_dma {
 };
 
 enum {
-        MLX5E_SQ_STATE_WAKE_TXQ_ENABLE,
+        MLX5E_SQ_STATE_FLUSH,
         MLX5E_SQ_STATE_BF_ENABLE,
-        MLX5E_SQ_STATE_TX_TIMEOUT,
 };
 
 struct mlx5e_ico_wqe_info {
@@ -698,7 +701,6 @@ int mlx5e_napi_poll(struct napi_struct *napi, int budget);
 bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget);
 int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget);
 void mlx5e_free_tx_descs(struct mlx5e_sq *sq);
-void mlx5e_free_rx_descs(struct mlx5e_rq *rq);
 
 void mlx5e_handle_rx_cqe(struct mlx5e_rq *rq, struct mlx5_cqe64 *cqe);
 void mlx5e_handle_rx_cqe_mpwrq(struct mlx5e_rq *rq, struct mlx5_cqe64 *cqe);
@@ -814,11 +816,6 @@ static inline int mlx5e_get_max_num_channels(struct mlx5_core_dev *mdev)
                      MLX5E_MAX_NUM_CHANNELS);
 }
 
-static inline int mlx5e_get_mtt_octw(int npages)
-{
-        return ALIGN(npages, 8) / 2;
-}
-
 extern const struct ethtool_ops mlx5e_ethtool_ops;
 #ifdef CONFIG_MLX5_CORE_EN_DCB
 extern const struct dcbnl_rtnl_ops mlx5e_dcbnl_ops;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
index 673043ccd76c..9cce153e1035 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
@@ -139,7 +139,7 @@ int mlx5e_refresh_tirs_self_loopback_enable(struct mlx5_core_dev *mdev)
         struct mlx5e_tir *tir;
         void *in;
         int inlen;
-        int err;
+        int err = 0;
 
         inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
         in = mlx5_vzalloc(inlen);
@@ -151,10 +151,11 @@ int mlx5e_refresh_tirs_self_loopback_enable(struct mlx5_core_dev *mdev)
         list_for_each_entry(tir, &mdev->mlx5e_res.td.tirs_list, list) {
                 err = mlx5_core_modify_tir(mdev, tir->tirn, in, inlen);
                 if (err)
-                        return err;
+                        goto out;
         }
 
+out:
         kvfree(in);
 
-        return 0;
+        return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index caa9a3ccc3f3..762af16ed021 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -127,29 +127,40 @@ int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets)
         return mlx5_set_port_tc_bw_alloc(mdev, tc_tx_bw);
 }
 
-static int mlx5e_dbcnl_validate_ets(struct ieee_ets *ets)
+static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
+                                    struct ieee_ets *ets)
 {
         int bw_sum = 0;
         int i;
 
         /* Validate Priority */
         for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
-                if (ets->prio_tc[i] >= MLX5E_MAX_PRIORITY)
+                if (ets->prio_tc[i] >= MLX5E_MAX_PRIORITY) {
+                        netdev_err(netdev,
+                                   "Failed to validate ETS: priority value greater than max(%d)\n",
+                                    MLX5E_MAX_PRIORITY);
                         return -EINVAL;
+                }
         }
 
         /* Validate Bandwidth Sum */
         for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
                 if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) {
-                        if (!ets->tc_tx_bw[i])
+                        if (!ets->tc_tx_bw[i]) {
+                                netdev_err(netdev,
+                                           "Failed to validate ETS: BW 0 is illegal\n");
                                 return -EINVAL;
+                        }
 
                         bw_sum += ets->tc_tx_bw[i];
                 }
         }
 
-        if (bw_sum != 0 && bw_sum != 100)
+        if (bw_sum != 0 && bw_sum != 100) {
+                netdev_err(netdev,
+                           "Failed to validate ETS: BW sum is illegal\n");
                 return -EINVAL;
+        }
         return 0;
 }
 
@@ -159,7 +170,7 @@ static int mlx5e_dcbnl_ieee_setets(struct net_device *netdev,
         struct mlx5e_priv *priv = netdev_priv(netdev);
         int err;
 
-        err = mlx5e_dbcnl_validate_ets(ets);
+        err = mlx5e_dbcnl_validate_ets(netdev, ets);
         if (err)
                 return err;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 4a3757e60441..7a346bb2ed00 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -331,7 +331,7 @@ static void mlx5e_get_ethtool_stats(struct net_device *dev,
         if (mlx5e_query_global_pause_combined(priv)) {
                 for (i = 0; i < NUM_PPORT_PER_PRIO_PFC_COUNTERS; i++) {
                         data[idx++] = MLX5E_READ_CTR64_BE(&priv->stats.pport.per_prio_counters[0],
-                                                          pport_per_prio_pfc_stats_desc, 0);
+                                                          pport_per_prio_pfc_stats_desc, i);
                 }
         }
 
@@ -352,15 +352,61 @@ static void mlx5e_get_ethtool_stats(struct net_device *dev,
                                                                    sq_stats_desc, j);
 }
 
+static u32 mlx5e_rx_wqes_to_packets(struct mlx5e_priv *priv, int rq_wq_type,
+                                    int num_wqe)
+{
+        int packets_per_wqe;
+        int stride_size;
+        int num_strides;
+        int wqe_size;
+
+        if (rq_wq_type != MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ)
+                return num_wqe;
+
+        stride_size = 1 << priv->params.mpwqe_log_stride_sz;
+        num_strides = 1 << priv->params.mpwqe_log_num_strides;
+        wqe_size = stride_size * num_strides;
+
+        packets_per_wqe = wqe_size /
+                          ALIGN(ETH_DATA_LEN, stride_size);
+        return (1 << (order_base_2(num_wqe * packets_per_wqe) - 1));
+}
+
+static u32 mlx5e_packets_to_rx_wqes(struct mlx5e_priv *priv, int rq_wq_type,
+                                    int num_packets)
+{
+        int packets_per_wqe;
+        int stride_size;
+        int num_strides;
+        int wqe_size;
+        int num_wqes;
+
+        if (rq_wq_type != MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ)
+                return num_packets;
+
+        stride_size = 1 << priv->params.mpwqe_log_stride_sz;
+        num_strides = 1 << priv->params.mpwqe_log_num_strides;
+        wqe_size = stride_size * num_strides;
+
+        num_packets = (1 << order_base_2(num_packets));
+
+        packets_per_wqe = wqe_size /
+                          ALIGN(ETH_DATA_LEN, stride_size);
+        num_wqes = DIV_ROUND_UP(num_packets, packets_per_wqe);
+        return 1 << (order_base_2(num_wqes));
+}
+
 static void mlx5e_get_ringparam(struct net_device *dev,
                                 struct ethtool_ringparam *param)
 {
         struct mlx5e_priv *priv = netdev_priv(dev);
         int rq_wq_type = priv->params.rq_wq_type;
 
-        param->rx_max_pending = 1 << mlx5_max_log_rq_size(rq_wq_type);
+        param->rx_max_pending = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                                         1 << mlx5_max_log_rq_size(rq_wq_type));
         param->tx_max_pending = 1 << MLX5E_PARAMS_MAXIMUM_LOG_SQ_SIZE;
-        param->rx_pending     = 1 << priv->params.log_rq_size;
+        param->rx_pending = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                                     1 << priv->params.log_rq_size);
         param->tx_pending     = 1 << priv->params.log_sq_size;
 }
 
@@ -370,9 +416,13 @@ static int mlx5e_set_ringparam(struct net_device *dev,
         struct mlx5e_priv *priv = netdev_priv(dev);
         bool was_opened;
         int rq_wq_type = priv->params.rq_wq_type;
+        u32 rx_pending_wqes;
+        u32 min_rq_size;
+        u32 max_rq_size;
         u16 min_rx_wqes;
         u8 log_rq_size;
         u8 log_sq_size;
+        u32 num_mtts;
         int err = 0;
 
         if (param->rx_jumbo_pending) {
@@ -385,18 +435,36 @@ static int mlx5e_set_ringparam(struct net_device *dev,
                             __func__);
                 return -EINVAL;
         }
-        if (param->rx_pending < (1 << mlx5_min_log_rq_size(rq_wq_type))) {
+
+        min_rq_size = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                               1 << mlx5_min_log_rq_size(rq_wq_type));
+        max_rq_size = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                               1 << mlx5_max_log_rq_size(rq_wq_type));
+        rx_pending_wqes = mlx5e_packets_to_rx_wqes(priv, rq_wq_type,
+                                                   param->rx_pending);
+
+        if (param->rx_pending < min_rq_size) {
                 netdev_info(dev, "%s: rx_pending (%d) < min (%d)\n",
                             __func__, param->rx_pending,
-                            1 << mlx5_min_log_rq_size(rq_wq_type));
+                            min_rq_size);
                 return -EINVAL;
         }
-        if (param->rx_pending > (1 << mlx5_max_log_rq_size(rq_wq_type))) {
+        if (param->rx_pending > max_rq_size) {
                 netdev_info(dev, "%s: rx_pending (%d) > max (%d)\n",
                             __func__, param->rx_pending,
-                            1 << mlx5_max_log_rq_size(rq_wq_type));
+                            max_rq_size);
                 return -EINVAL;
         }
+
+        num_mtts = MLX5E_REQUIRED_MTTS(priv->params.num_channels,
+                                       rx_pending_wqes);
+        if (priv->params.rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ &&
+            !MLX5E_VALID_NUM_MTTS(num_mtts)) {
+                netdev_info(dev, "%s: rx_pending (%d) request can't be satisfied, try to reduce.\n",
+                            __func__, param->rx_pending);
+                return -EINVAL;
+        }
+
         if (param->tx_pending < (1 << MLX5E_PARAMS_MINIMUM_LOG_SQ_SIZE)) {
                 netdev_info(dev, "%s: tx_pending (%d) < min (%d)\n",
                             __func__, param->tx_pending,
@@ -410,9 +478,9 @@ static int mlx5e_set_ringparam(struct net_device *dev,
                 return -EINVAL;
         }
 
-        log_rq_size = order_base_2(param->rx_pending);
+        log_rq_size = order_base_2(rx_pending_wqes);
         log_sq_size = order_base_2(param->tx_pending);
-        min_rx_wqes = mlx5_min_rx_wqes(rq_wq_type, param->rx_pending);
+        min_rx_wqes = mlx5_min_rx_wqes(rq_wq_type, rx_pending_wqes);
 
         if (log_rq_size == priv->params.log_rq_size &&
             log_sq_size == priv->params.log_sq_size &&
@@ -454,6 +522,7 @@ static int mlx5e_set_channels(struct net_device *dev,
         unsigned int count = ch->combined_count;
         bool arfs_enabled;
         bool was_opened;
+        u32 num_mtts;
         int err = 0;
 
         if (!count) {
@@ -472,6 +541,14 @@ static int mlx5e_set_channels(struct net_device *dev,
                 return -EINVAL;
         }
 
+        num_mtts = MLX5E_REQUIRED_MTTS(count, BIT(priv->params.log_rq_size));
+        if (priv->params.rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ &&
+            !MLX5E_VALID_NUM_MTTS(num_mtts)) {
+                netdev_info(dev, "%s: rx count (%d) request can't be satisfied, try to reduce.\n",
+                            __func__, count);
+                return -EINVAL;
+        }
+
         if (priv->params.num_channels == count)
                 return 0;
 
@@ -582,9 +659,10 @@ out:
 static void ptys2ethtool_supported_link(unsigned long *supported_modes,
                                         u32 eth_proto_cap)
 {
+        unsigned long proto_cap = eth_proto_cap;
         int proto;
 
-        for_each_set_bit(proto, (unsigned long *)&eth_proto_cap, MLX5E_LINK_MODES_NUMBER)
+        for_each_set_bit(proto, &proto_cap, MLX5E_LINK_MODES_NUMBER)
                 bitmap_or(supported_modes, supported_modes,
                           ptys2ethtool_table[proto].supported,
                           __ETHTOOL_LINK_MODE_MASK_NBITS);
@@ -593,9 +671,10 @@ static void ptys2ethtool_supported_link(unsigned long *supported_modes,
 static void ptys2ethtool_adver_link(unsigned long *advertising_modes,
                                     u32 eth_proto_cap)
 {
+        unsigned long proto_cap = eth_proto_cap;
         int proto;
 
-        for_each_set_bit(proto, (unsigned long *)&eth_proto_cap, MLX5E_LINK_MODES_NUMBER)
+        for_each_set_bit(proto, &proto_cap, MLX5E_LINK_MODES_NUMBER)
                 bitmap_or(advertising_modes, advertising_modes,
                           ptys2ethtool_table[proto].advertised,
                           __ETHTOOL_LINK_MODE_MASK_NBITS);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 870bea37c57c..2459c7f3db8d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -39,13 +39,6 @@
 #include "eswitch.h"
 #include "vxlan.h"
 
-enum {
-        MLX5_EN_QP_FLUSH_TIMEOUT_MS     = 5000,
-        MLX5_EN_QP_FLUSH_MSLEEP_QUANT   = 20,
-        MLX5_EN_QP_FLUSH_MAX_ITER       = MLX5_EN_QP_FLUSH_TIMEOUT_MS /
-                                          MLX5_EN_QP_FLUSH_MSLEEP_QUANT,
-};
-
 struct mlx5e_rq_param {
         u32                     rqc[MLX5_ST_SZ_DW(rqc)];
         struct mlx5_wq_param    wq;
@@ -162,6 +155,7 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
                         s->tx_queue_stopped     += sq_stats->stopped;
                         s->tx_queue_wake        += sq_stats->wake;
                         s->tx_queue_dropped     += sq_stats->dropped;
+                        s->tx_xmit_more         += sq_stats->xmit_more;
                         s->tx_csum_partial_inner += sq_stats->csum_partial_inner;
                         tx_offload_none         += sq_stats->csum_none;
                 }
@@ -340,6 +334,9 @@ static int mlx5e_create_rq(struct mlx5e_channel *c,
                 rq->alloc_wqe = mlx5e_alloc_rx_mpwqe;
                 rq->dealloc_wqe = mlx5e_dealloc_rx_mpwqe;
 
+                rq->mpwqe_mtt_offset = c->ix *
+                        MLX5E_REQUIRED_MTTS(1, BIT(priv->params.log_rq_size));
+
                 rq->mpwqe_stride_sz = BIT(priv->params.mpwqe_log_stride_sz);
                 rq->mpwqe_num_strides = BIT(priv->params.mpwqe_log_num_strides);
                 rq->wqe_sz = rq->mpwqe_stride_sz * rq->mpwqe_num_strides;
@@ -428,7 +425,6 @@ static int mlx5e_enable_rq(struct mlx5e_rq *rq, struct mlx5e_rq_param *param)
 
         MLX5_SET(rqc,  rqc, cqn,                rq->cq.mcq.cqn);
         MLX5_SET(rqc,  rqc, state,              MLX5_RQC_STATE_RST);
-        MLX5_SET(rqc,  rqc, flush_in_error_en,  1);
         MLX5_SET(rqc,  rqc, vsd, priv->params.vlan_strip_disable);
         MLX5_SET(wq,   wq,  log_wq_pg_sz,       rq->wq_ctrl.buf.page_shift -
                                                 MLX5_ADAPTER_PAGE_SHIFT);
@@ -525,6 +521,27 @@ static int mlx5e_wait_for_min_rx_wqes(struct mlx5e_rq *rq)
         return -ETIMEDOUT;
 }
 
+static void mlx5e_free_rx_descs(struct mlx5e_rq *rq)
+{
+        struct mlx5_wq_ll *wq = &rq->wq;
+        struct mlx5e_rx_wqe *wqe;
+        __be16 wqe_ix_be;
+        u16 wqe_ix;
+
+        /* UMR WQE (if in progress) is always at wq->head */
+        if (test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
+                mlx5e_free_rx_fragmented_mpwqe(rq, &rq->wqe_info[wq->head]);
+
+        while (!mlx5_wq_ll_is_empty(wq)) {
+                wqe_ix_be = *wq->tail_next;
+                wqe_ix    = be16_to_cpu(wqe_ix_be);
+                wqe       = mlx5_wq_ll_get_wqe(&rq->wq, wqe_ix);
+                rq->dealloc_wqe(rq, wqe_ix);
+                mlx5_wq_ll_pop(&rq->wq, wqe_ix_be,
+                               &wqe->next.next_wqe_index);
+        }
+}
+
 static int mlx5e_open_rq(struct mlx5e_channel *c,
                          struct mlx5e_rq_param *param,
                          struct mlx5e_rq *rq)
@@ -548,8 +565,6 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
         if (param->am_enabled)
                 set_bit(MLX5E_RQ_STATE_AM, &c->rq.state);
 
-        set_bit(MLX5E_RQ_STATE_POST_WQES_ENABLE, &rq->state);
-
         sq->ico_wqe_info[pi].opcode     = MLX5_OPCODE_NOP;
         sq->ico_wqe_info[pi].num_wqebbs = 1;
         mlx5e_send_nop(sq, true); /* trigger mlx5e_post_rx_wqes() */
@@ -566,23 +581,8 @@ err_destroy_rq:
 
 static void mlx5e_close_rq(struct mlx5e_rq *rq)
 {
-        int tout = 0;
-        int err;
-
-        clear_bit(MLX5E_RQ_STATE_POST_WQES_ENABLE, &rq->state);
+        set_bit(MLX5E_RQ_STATE_FLUSH, &rq->state);
         napi_synchronize(&rq->channel->napi); /* prevent mlx5e_post_rx_wqes */
-
-        err = mlx5e_modify_rq_state(rq, MLX5_RQC_STATE_RDY, MLX5_RQC_STATE_ERR);
-        while (!mlx5_wq_ll_is_empty(&rq->wq) && !err &&
-               tout++ < MLX5_EN_QP_FLUSH_MAX_ITER)
-                msleep(MLX5_EN_QP_FLUSH_MSLEEP_QUANT);
-
-        if (err || tout == MLX5_EN_QP_FLUSH_MAX_ITER)
-                set_bit(MLX5E_RQ_STATE_FLUSH_TIMEOUT, &rq->state);
-
-        /* avoid destroying rq before mlx5e_poll_rx_cq() is done with it */
-        napi_synchronize(&rq->channel->napi);
-
         cancel_work_sync(&rq->am.work);
 
         mlx5e_disable_rq(rq);
@@ -821,7 +821,6 @@ static int mlx5e_open_sq(struct mlx5e_channel *c,
                 goto err_disable_sq;
 
         if (sq->txq) {
-                set_bit(MLX5E_SQ_STATE_WAKE_TXQ_ENABLE, &sq->state);
                 netdev_tx_reset_queue(sq->txq);
                 netif_tx_start_queue(sq->txq);
         }
@@ -845,38 +844,20 @@ static inline void netif_tx_disable_queue(struct netdev_queue *txq)
 
 static void mlx5e_close_sq(struct mlx5e_sq *sq)
 {
-        int tout = 0;
-        int err;
+        set_bit(MLX5E_SQ_STATE_FLUSH, &sq->state);
+        /* prevent netif_tx_wake_queue */
+        napi_synchronize(&sq->channel->napi);
 
         if (sq->txq) {
-                clear_bit(MLX5E_SQ_STATE_WAKE_TXQ_ENABLE, &sq->state);
-                /* prevent netif_tx_wake_queue */
-                napi_synchronize(&sq->channel->napi);
                 netif_tx_disable_queue(sq->txq);
 
-                /* ensure hw is notified of all pending wqes */
+                /* last doorbell out, godspeed .. */
                 if (mlx5e_sq_has_room_for(sq, 1))
                         mlx5e_send_nop(sq, true);
-
-                err = mlx5e_modify_sq(sq, MLX5_SQC_STATE_RDY,
-                                      MLX5_SQC_STATE_ERR, false, 0);
-                if (err)
-                        set_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state);
-        }
-
-        /* wait till sq is empty, unless a TX timeout occurred on this SQ */
-        while (sq->cc != sq->pc &&
-               !test_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state)) {
-                msleep(MLX5_EN_QP_FLUSH_MSLEEP_QUANT);
-                if (tout++ > MLX5_EN_QP_FLUSH_MAX_ITER)
-                        set_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state);
         }
 
-        /* avoid destroying sq before mlx5e_poll_tx_cq() is done with it */
-        napi_synchronize(&sq->channel->napi);
-
-        mlx5e_free_tx_descs(sq);
         mlx5e_disable_sq(sq);
+        mlx5e_free_tx_descs(sq);
         mlx5e_destroy_sq(sq);
 }
 
@@ -1826,10 +1807,6 @@ int mlx5e_open_locked(struct net_device *netdev)
         netif_set_real_num_tx_queues(netdev, num_txqs);
         netif_set_real_num_rx_queues(netdev, priv->params.num_channels);
 
-        err = mlx5e_set_dev_port_mtu(netdev);
-        if (err)
-                goto err_clear_state_opened_flag;
-
         err = mlx5e_open_channels(priv);
         if (err) {
                 netdev_err(netdev, "%s: mlx5e_open_channels failed, %d\n",
@@ -2573,6 +2550,7 @@ static int mlx5e_change_mtu(struct net_device *netdev, int new_mtu)
         u16 max_mtu;
         u16 min_mtu;
         int err = 0;
+        bool reset;
 
         mlx5_query_port_max_mtu(mdev, &max_mtu, 1);
 
@@ -2588,13 +2566,18 @@ static int mlx5e_change_mtu(struct net_device *netdev, int new_mtu)
 
         mutex_lock(&priv->state_lock);
 
+        reset = !priv->params.lro_en &&
+                (priv->params.rq_wq_type !=
+                 MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ);
+
         was_opened = test_bit(MLX5E_STATE_OPENED, &priv->state);
-        if (was_opened)
+        if (was_opened && reset)
                 mlx5e_close_locked(netdev);
 
         netdev->mtu = new_mtu;
+        mlx5e_set_dev_port_mtu(netdev);
 
-        if (was_opened)
+        if (was_opened && reset)
                 err = mlx5e_open_locked(netdev);
 
         mutex_unlock(&priv->state_lock);
@@ -2794,7 +2777,7 @@ static void mlx5e_tx_timeout(struct net_device *dev)
                 if (!netif_xmit_stopped(netdev_get_tx_queue(dev, i)))
                         continue;
                 sched_work = true;
-                set_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state);
+                set_bit(MLX5E_SQ_STATE_FLUSH, &sq->state);
                 netdev_err(dev, "TX timeout on queue: %d, SQ: 0x%x, CQ: 0x%x, SQ Cons: 0x%x SQ Prod: 0x%x\n",
                            i, sq->sqn, sq->cq.mcq.cqn, sq->cc, sq->pc);
         }
@@ -3231,8 +3214,8 @@ static int mlx5e_create_umr_mkey(struct mlx5e_priv *priv)
         struct mlx5_create_mkey_mbox_in *in;
         struct mlx5_mkey_seg *mkc;
         int inlen = sizeof(*in);
-        u64 npages =
-                priv->profile->max_nch(mdev) * MLX5_CHANNEL_MAX_NUM_MTTS;
+        u64 npages = MLX5E_REQUIRED_MTTS(priv->profile->max_nch(mdev),
+                                         BIT(MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW));
         int err;
 
         in = mlx5_vzalloc(inlen);
@@ -3246,10 +3229,12 @@ static int mlx5e_create_umr_mkey(struct mlx5e_priv *priv)
                      MLX5_PERM_LOCAL_WRITE |
                      MLX5_ACCESS_MODE_MTT;
 
+        npages = min_t(u32, ALIGN(U16_MAX, 4) * 2, npages);
+
         mkc->qpn_mkey7_0 = cpu_to_be32(0xffffff << 8);
         mkc->flags_pd = cpu_to_be32(mdev->mlx5e_res.pdn);
         mkc->len = cpu_to_be64(npages << PAGE_SHIFT);
-        mkc->xlt_oct_size = cpu_to_be32(mlx5e_get_mtt_octw(npages));
+        mkc->xlt_oct_size = cpu_to_be32(MLX5_MTT_OCTW(npages));
         mkc->log2_page_size = PAGE_SHIFT;
 
         err = mlx5_core_create_mkey(mdev, &priv->umr_mkey, in, inlen, NULL,
@@ -3385,6 +3370,7 @@ static void mlx5e_nic_enable(struct mlx5e_priv *priv)
         queue_work(priv->wq, &priv->set_rx_mode_work);
 
         if (MLX5_CAP_GEN(mdev, vport_group_manager)) {
+                mlx5_query_nic_vport_mac_address(mdev, 0, rep.hw_id);
                 rep.load = mlx5e_nic_rep_load;
                 rep.unload = mlx5e_nic_rep_unload;
                 rep.vport = 0;
@@ -3463,6 +3449,8 @@ void *mlx5e_create_netdev(struct mlx5_core_dev *mdev,
 
         mlx5e_init_l2_addr(priv);
 
+        mlx5e_set_dev_port_mtu(netdev);
+
         err = register_netdev(netdev);
         if (err) {
                 mlx5_core_err(mdev, "register_netdev failed, %d\n", err);
@@ -3501,16 +3489,20 @@ static void mlx5e_register_vport_rep(struct mlx5_core_dev *mdev)
         struct mlx5_eswitch *esw = mdev->priv.eswitch;
         int total_vfs = MLX5_TOTAL_VPORTS(mdev);
         int vport;
+        u8 mac[ETH_ALEN];
 
         if (!MLX5_CAP_GEN(mdev, vport_group_manager))
                 return;
 
+        mlx5_query_nic_vport_mac_address(mdev, 0, mac);
+
         for (vport = 1; vport < total_vfs; vport++) {
                 struct mlx5_eswitch_rep rep;
 
                 rep.load = mlx5e_vport_rep_load;
                 rep.unload = mlx5e_vport_rep_unload;
                 rep.vport = vport;
+                ether_addr_copy(rep.hw_id, mac);
                 mlx5_eswitch_register_vport_rep(esw, &rep);
         }
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 1c7d8b8314bf..134de4a11f1d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -135,17 +135,16 @@ static const struct ethtool_ops mlx5e_rep_ethtool_ops = {
 int mlx5e_attr_get(struct net_device *dev, struct switchdev_attr *attr)
 {
         struct mlx5e_priv *priv = netdev_priv(dev);
+        struct mlx5_eswitch_rep *rep = priv->ppriv;
         struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
-        u8 mac[ETH_ALEN];
 
         if (esw->mode == SRIOV_NONE)
                 return -EOPNOTSUPP;
 
         switch (attr->id) {
         case SWITCHDEV_ATTR_ID_PORT_PARENT_ID:
-                mlx5_query_nic_vport_mac_address(priv->mdev, 0, mac);
                 attr->u.ppid.id_len = ETH_ALEN;
-                memcpy(&attr->u.ppid.id, &mac, ETH_ALEN);
+                ether_addr_copy(attr->u.ppid.id, rep->hw_id);
                 break;
         default:
                 return -EOPNOTSUPP;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 9f2a16a507e0..e7c969df3dad 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -324,9 +324,9 @@ mlx5e_copy_skb_header_fragmented_mpwqe(struct device *pdev,
         }
 }
 
-static u16 mlx5e_get_wqe_mtt_offset(u16 rq_ix, u16 wqe_ix)
+static u32 mlx5e_get_wqe_mtt_offset(struct mlx5e_rq *rq, u16 wqe_ix)
 {
-        return rq_ix * MLX5_CHANNEL_MAX_NUM_MTTS +
+        return rq->mpwqe_mtt_offset +
                 wqe_ix * ALIGN(MLX5_MPWRQ_PAGES_PER_WQE, 8);
 }
 
@@ -340,7 +340,7 @@ static void mlx5e_build_umr_wqe(struct mlx5e_rq *rq,
         struct mlx5_wqe_data_seg      *dseg = &wqe->data;
         struct mlx5e_mpw_info *wi = &rq->wqe_info[ix];
         u8 ds_cnt = DIV_ROUND_UP(sizeof(*wqe), MLX5_SEND_WQE_DS);
-        u16 umr_wqe_mtt_offset = mlx5e_get_wqe_mtt_offset(rq->ix, ix);
+        u32 umr_wqe_mtt_offset = mlx5e_get_wqe_mtt_offset(rq, ix);
 
         memset(wqe, 0, sizeof(*wqe));
         cseg->opmod_idx_opcode =
@@ -353,9 +353,9 @@ static void mlx5e_build_umr_wqe(struct mlx5e_rq *rq,
 
         ucseg->flags = MLX5_UMR_TRANSLATION_OFFSET_EN;
         ucseg->klm_octowords =
-                cpu_to_be16(mlx5e_get_mtt_octw(MLX5_MPWRQ_PAGES_PER_WQE));
+                cpu_to_be16(MLX5_MTT_OCTW(MLX5_MPWRQ_PAGES_PER_WQE));
         ucseg->bsf_octowords =
-                cpu_to_be16(mlx5e_get_mtt_octw(umr_wqe_mtt_offset));
+                cpu_to_be16(MLX5_MTT_OCTW(umr_wqe_mtt_offset));
         ucseg->mkey_mask     = cpu_to_be64(MLX5_MKEY_MASK_FREE);
 
         dseg->lkey = sq->mkey_be;
@@ -423,7 +423,7 @@ static int mlx5e_alloc_rx_fragmented_mpwqe(struct mlx5e_rq *rq,
 {
         struct mlx5e_mpw_info *wi = &rq->wqe_info[ix];
         int mtt_sz = mlx5e_get_wqe_mtt_sz();
-        u32 dma_offset = mlx5e_get_wqe_mtt_offset(rq->ix, ix) << PAGE_SHIFT;
+        u64 dma_offset = (u64)mlx5e_get_wqe_mtt_offset(rq, ix) << PAGE_SHIFT;
         int i;
 
         wi->umr.dma_info = kmalloc(sizeof(*wi->umr.dma_info) *
@@ -506,6 +506,12 @@ void mlx5e_post_rx_fragmented_mpwqe(struct mlx5e_rq *rq)
         struct mlx5e_rx_wqe *wqe = mlx5_wq_ll_get_wqe(wq, wq->head);
 
         clear_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state);
+
+        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state))) {
+                mlx5e_free_rx_fragmented_mpwqe(rq, &rq->wqe_info[wq->head]);
+                return;
+        }
+
         mlx5_wq_ll_push(wq, be16_to_cpu(wqe->next.next_wqe_index));
         rq->stats.mpwqe_frag++;
 
@@ -595,26 +601,9 @@ void mlx5e_dealloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix)
         wi->free_wqe(rq, wi);
 }
 
-void mlx5e_free_rx_descs(struct mlx5e_rq *rq)
-{
-        struct mlx5_wq_ll *wq = &rq->wq;
-        struct mlx5e_rx_wqe *wqe;
-        __be16 wqe_ix_be;
-        u16 wqe_ix;
-
-        while (!mlx5_wq_ll_is_empty(wq)) {
-                wqe_ix_be = *wq->tail_next;
-                wqe_ix    = be16_to_cpu(wqe_ix_be);
-                wqe       = mlx5_wq_ll_get_wqe(&rq->wq, wqe_ix);
-                rq->dealloc_wqe(rq, wqe_ix);
-                mlx5_wq_ll_pop(&rq->wq, wqe_ix_be,
-                               &wqe->next.next_wqe_index);
-        }
-}
-
 #define RQ_CANNOT_POST(rq) \
-                (!test_bit(MLX5E_RQ_STATE_POST_WQES_ENABLE, &rq->state) || \
-                 test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
+        (test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state) || \
+         test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
 
 bool mlx5e_post_rx_wqes(struct mlx5e_rq *rq)
 {
@@ -648,24 +637,32 @@ bool mlx5e_post_rx_wqes(struct mlx5e_rq *rq)
 static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe,
                                  u32 cqe_bcnt)
 {
-        struct ethhdr   *eth    = (struct ethhdr *)(skb->data);
-        struct iphdr    *ipv4   = (struct iphdr *)(skb->data + ETH_HLEN);
-        struct ipv6hdr  *ipv6   = (struct ipv6hdr *)(skb->data + ETH_HLEN);
+        struct ethhdr   *eth = (struct ethhdr *)(skb->data);
+        struct iphdr    *ipv4;
+        struct ipv6hdr  *ipv6;
         struct tcphdr   *tcp;
+        int network_depth = 0;
+        __be16 proto;
+        u16 tot_len;
 
         u8 l4_hdr_type = get_cqe_l4_hdr_type(cqe);
         int tcp_ack = ((CQE_L4_HDR_TYPE_TCP_ACK_NO_DATA  == l4_hdr_type) ||
                        (CQE_L4_HDR_TYPE_TCP_ACK_AND_DATA == l4_hdr_type));
 
-        u16 tot_len = cqe_bcnt - ETH_HLEN;
+        skb->mac_len = ETH_HLEN;
+        proto = __vlan_get_protocol(skb, eth->h_proto, &network_depth);
+
+        ipv4 = (struct iphdr *)(skb->data + network_depth);
+        ipv6 = (struct ipv6hdr *)(skb->data + network_depth);
+        tot_len = cqe_bcnt - network_depth;
 
-        if (eth->h_proto == htons(ETH_P_IP)) {
-                tcp = (struct tcphdr *)(skb->data + ETH_HLEN +
+        if (proto == htons(ETH_P_IP)) {
+                tcp = (struct tcphdr *)(skb->data + network_depth +
                                         sizeof(struct iphdr));
                 ipv6 = NULL;
                 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
         } else {
-                tcp = (struct tcphdr *)(skb->data + ETH_HLEN +
+                tcp = (struct tcphdr *)(skb->data + network_depth +
                                         sizeof(struct ipv6hdr));
                 ipv4 = NULL;
                 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
@@ -916,7 +913,7 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
         struct mlx5e_rq *rq = container_of(cq, struct mlx5e_rq, cq);
         int work_done = 0;
 
-        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH_TIMEOUT, &rq->state)))
+        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state)))
                 return 0;
 
         if (cq->decmprs_left)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 7b9d8a989b52..499487ce3b53 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -70,6 +70,7 @@ struct mlx5e_sw_stats {
         u64 tx_queue_stopped;
         u64 tx_queue_wake;
         u64 tx_queue_dropped;
+        u64 tx_xmit_more;
         u64 rx_wqe_err;
         u64 rx_mpwqe_filler;
         u64 rx_mpwqe_frag;
@@ -101,6 +102,7 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_stopped) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_wake) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_dropped) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_xmit_more) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_wqe_err) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_frag) },
@@ -298,6 +300,7 @@ struct mlx5e_sq_stats {
         /* commonly accessed in data path */
         u64 packets;
         u64 bytes;
+        u64 xmit_more;
         u64 tso_packets;
         u64 tso_bytes;
         u64 tso_inner_packets;
@@ -324,6 +327,7 @@ static const struct counter_desc sq_stats_desc[] = {
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, stopped) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, wake) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, dropped) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, xmit_more) },
 };
 
 #define NUM_SW_COUNTERS                 ARRAY_SIZE(sw_stats_desc)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index dc8b1cb0fdc8..22cfc4ac1837 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -170,7 +170,7 @@ static int parse_cls_flower(struct mlx5e_priv *priv, struct mlx5_flow_spec *spec
         if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CONTROL)) {
                 struct flow_dissector_key_control *key =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  FLOW_DISSECTOR_KEY_CONTROL,
                                                   f->key);
                 addr_type = key->addr_type;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index e073bf59890d..eb0e72537f10 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -356,6 +356,7 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
                 sq->stats.stopped++;
         }
 
+        sq->stats.xmit_more += skb->xmit_more;
         if (!skb->xmit_more || netif_xmit_stopped(sq->txq)) {
                 int bf_sz = 0;
 
@@ -394,35 +395,6 @@ netdev_tx_t mlx5e_xmit(struct sk_buff *skb, struct net_device *dev)
         return mlx5e_sq_xmit(sq, skb);
 }
 
-void mlx5e_free_tx_descs(struct mlx5e_sq *sq)
-{
-        struct mlx5e_tx_wqe_info *wi;
-        struct sk_buff *skb;
-        u16 ci;
-        int i;
-
-        while (sq->cc != sq->pc) {
-                ci = sq->cc & sq->wq.sz_m1;
-                skb = sq->skb[ci];
-                wi = &sq->wqe_info[ci];
-
-                if (!skb) { /* nop */
-                        sq->cc++;
-                        continue;
-                }
-
-                for (i = 0; i < wi->num_dma; i++) {
-                        struct mlx5e_sq_dma *dma =
-                                mlx5e_dma_get(sq, sq->dma_fifo_cc++);
-
-                        mlx5e_tx_dma_unmap(sq->pdev, dma);
-                }
-
-                dev_kfree_skb_any(skb);
-                sq->cc += wi->num_wqebbs;
-        }
-}
-
 bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
 {
         struct mlx5e_sq *sq;
@@ -434,7 +406,7 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
 
         sq = container_of(cq, struct mlx5e_sq, cq);
 
-        if (unlikely(test_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state)))
+        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
                 return false;
 
         npkts = 0;
@@ -512,11 +484,39 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
         netdev_tx_completed_queue(sq->txq, npkts, nbytes);
 
         if (netif_tx_queue_stopped(sq->txq) &&
-            mlx5e_sq_has_room_for(sq, MLX5E_SQ_STOP_ROOM) &&
-            likely(test_bit(MLX5E_SQ_STATE_WAKE_TXQ_ENABLE, &sq->state))) {
-                                netif_tx_wake_queue(sq->txq);
-                                sq->stats.wake++;
+            mlx5e_sq_has_room_for(sq, MLX5E_SQ_STOP_ROOM)) {
+                netif_tx_wake_queue(sq->txq);
+                sq->stats.wake++;
         }
 
         return (i == MLX5E_TX_CQ_POLL_BUDGET);
 }
+
+void mlx5e_free_tx_descs(struct mlx5e_sq *sq)
+{
+        struct mlx5e_tx_wqe_info *wi;
+        struct sk_buff *skb;
+        u16 ci;
+        int i;
+
+        while (sq->cc != sq->pc) {
+                ci = sq->cc & sq->wq.sz_m1;
+                skb = sq->skb[ci];
+                wi = &sq->wqe_info[ci];
+
+                if (!skb) { /* nop */
+                        sq->cc++;
+                        continue;
+                }
+
+                for (i = 0; i < wi->num_dma; i++) {
+                        struct mlx5e_sq_dma *dma =
+                                mlx5e_dma_get(sq, sq->dma_fifo_cc++);
+
+                        mlx5e_tx_dma_unmap(sq->pdev, dma);
+                }
+
+                dev_kfree_skb_any(skb);
+                sq->cc += wi->num_wqebbs;
+        }
+}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
index 64ae2e800daa..9bf33bb69210 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
@@ -51,16 +51,18 @@ struct mlx5_cqe64 *mlx5e_get_cqe(struct mlx5e_cq *cq)
 
 static void mlx5e_poll_ico_cq(struct mlx5e_cq *cq)
 {
+        struct mlx5e_sq *sq = container_of(cq, struct mlx5e_sq, cq);
         struct mlx5_wq_cyc *wq;
         struct mlx5_cqe64 *cqe;
-        struct mlx5e_sq *sq;
         u16 sqcc;
 
+        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
+                return;
+
         cqe = mlx5e_get_cqe(cq);
         if (likely(!cqe))
                 return;
 
-        sq = container_of(cq, struct mlx5e_sq, cq);
         wq = &sq->wq;
 
         /* sq->cc must be updated only after mlx5_cqwq_update_db_record(),
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index f6d667797ee1..8b78f156214e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1451,7 +1451,8 @@ static void esw_enable_vport(struct mlx5_eswitch *esw, int vport_num,
 
         esw_debug(esw->dev, "Enabling VPORT(%d)\n", vport_num);
 
-        if (vport_num) { /* Only VFs need ACLs for VST and spoofchk filtering */
+        /* Only VFs need ACLs for VST and spoofchk filtering */
+        if (vport_num && esw->mode == SRIOV_LEGACY) {
                 esw_vport_ingress_config(esw, vport);
                 esw_vport_egress_config(esw, vport);
         }
@@ -1502,7 +1503,7 @@ static void esw_disable_vport(struct mlx5_eswitch *esw, int vport_num)
          */
         esw_vport_change_handle_locked(vport);
         vport->enabled_events = 0;
-        if (vport_num) {
+        if (vport_num && esw->mode == SRIOV_LEGACY) {
                 esw_vport_disable_egress_acl(esw, vport);
                 esw_vport_disable_ingress_acl(esw, vport);
         }
@@ -1767,7 +1768,7 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
                                vport, err);
 
         mutex_lock(&esw->state_lock);
-        if (evport->enabled)
+        if (evport->enabled && esw->mode == SRIOV_LEGACY)
                 err = esw_vport_ingress_config(esw, evport);
         mutex_unlock(&esw->state_lock);
         return err;
@@ -1839,7 +1840,7 @@ int mlx5_eswitch_set_vport_vlan(struct mlx5_eswitch *esw,
         mutex_lock(&esw->state_lock);
         evport->vlan = vlan;
         evport->qos = qos;
-        if (evport->enabled) {
+        if (evport->enabled && esw->mode == SRIOV_LEGACY) {
                 err = esw_vport_ingress_config(esw, evport);
                 if (err)
                         goto out;
@@ -1868,10 +1869,11 @@ int mlx5_eswitch_set_vport_spoofchk(struct mlx5_eswitch *esw,
         mutex_lock(&esw->state_lock);
         pschk = evport->spoofchk;
         evport->spoofchk = spoofchk;
-        if (evport->enabled)
+        if (evport->enabled && esw->mode == SRIOV_LEGACY) {
                 err = esw_vport_ingress_config(esw, evport);
-        if (err)
-                evport->spoofchk = pschk;
+                if (err)
+                        evport->spoofchk = pschk;
+        }
         mutex_unlock(&esw->state_lock);
 
         return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index c0b05603fc31..a96140971d77 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -174,6 +174,7 @@ struct mlx5_eswitch_rep {
         void                  *priv_data;
         struct list_head       vport_sqs_list;
         bool                   valid;
+        u8                     hw_id[ETH_ALEN];
 };
 
 struct mlx5_esw_offload {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index a357e8eeeed8..3dc83a9459a4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -113,7 +113,7 @@ mlx5_eswitch_add_send_to_vport_rule(struct mlx5_eswitch *esw, int vport, u32 sqn
         dest.type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
         dest.vport_num = vport;
 
-        flow_rule = mlx5_add_flow_rule(esw->fdb_table.fdb, spec,
+        flow_rule = mlx5_add_flow_rule(esw->fdb_table.offloads.fdb, spec,
                                        MLX5_FLOW_CONTEXT_ACTION_FWD_DEST,
                                        0, &dest);
         if (IS_ERR(flow_rule))
@@ -535,7 +535,7 @@ void esw_offloads_cleanup(struct mlx5_eswitch *esw, int nvports)
         esw_destroy_offloads_fdb_table(esw);
 }
 
-static int mlx5_esw_mode_from_devlink(u16 mode, u16 *mlx5_mode)
+static int esw_mode_from_devlink(u16 mode, u16 *mlx5_mode)
 {
         switch (mode) {
         case DEVLINK_ESWITCH_MODE_LEGACY:
@@ -551,6 +551,22 @@ static int mlx5_esw_mode_from_devlink(u16 mode, u16 *mlx5_mode)
         return 0;
 }
 
+static int esw_mode_to_devlink(u16 mlx5_mode, u16 *mode)
+{
+        switch (mlx5_mode) {
+        case SRIOV_LEGACY:
+                *mode = DEVLINK_ESWITCH_MODE_LEGACY;
+                break;
+        case SRIOV_OFFLOADS:
+                *mode = DEVLINK_ESWITCH_MODE_SWITCHDEV;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
 {
         struct mlx5_core_dev *dev;
@@ -566,7 +582,7 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
         if (cur_mlx5_mode == SRIOV_NONE)
                 return -EOPNOTSUPP;
 
-        if (mlx5_esw_mode_from_devlink(mode, &mlx5_mode))
+        if (esw_mode_from_devlink(mode, &mlx5_mode))
                 return -EINVAL;
 
         if (cur_mlx5_mode == mlx5_mode)
@@ -592,9 +608,7 @@ int mlx5_devlink_eswitch_mode_get(struct devlink *devlink, u16 *mode)
         if (dev->priv.eswitch->mode == SRIOV_NONE)
                 return -EOPNOTSUPP;
 
-        *mode = dev->priv.eswitch->mode;
-
-        return 0;
+        return esw_mode_to_devlink(dev->priv.eswitch->mode, mode);
 }
 
 void mlx5_eswitch_register_vport_rep(struct mlx5_eswitch *esw,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 75bb8c864557..3d6c1f65e586 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -80,7 +80,7 @@
                            LEFTOVERS_NUM_PRIOS)
 
 #define ETHTOOL_PRIO_NUM_LEVELS 1
-#define ETHTOOL_NUM_PRIOS 10
+#define ETHTOOL_NUM_PRIOS 11
 #define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS)
 /* Vlan, mac, ttc, aRFS */
 #define KERNEL_NIC_PRIO_NUM_LEVELS 4
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
index c2877e9de8a1..3a9195b4169d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
@@ -126,12 +126,21 @@ static struct rb_node *mlx5_fc_stats_query(struct mlx5_core_dev *dev,
         for (node = &first->node; node; node = rb_next(node)) {
                 struct mlx5_fc *counter = rb_entry(node, struct mlx5_fc, node);
                 struct mlx5_fc_cache *c = &counter->cache;
+                u64 packets;
+                u64 bytes;
 
                 if (counter->id > last_id)
                         break;
 
                 mlx5_cmd_fc_bulk_get(dev, b,
-                                     counter->id, &c->packets, &c->bytes);
+                                     counter->id, &packets, &bytes);
+
+                if (c->packets == packets)
+                        continue;
+
+                c->packets = packets;
+                c->bytes = bytes;
+                c->lastuse = jiffies;
         }
 
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 4f491d43e77d..2385bae92672 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1420,36 +1420,12 @@ static pci_ers_result_t mlx5_pci_err_detected(struct pci_dev *pdev,
         dev_info(&pdev->dev, "%s was called\n", __func__);
         mlx5_enter_error_state(dev);
         mlx5_unload_one(dev, priv);
+        pci_save_state(pdev);
         mlx5_pci_disable_device(dev);
         return state == pci_channel_io_perm_failure ?
                 PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_NEED_RESET;
 }
 
-static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
-{
-        struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
-        int err = 0;
-
-        dev_info(&pdev->dev, "%s was called\n", __func__);
-
-        err = mlx5_pci_enable_device(dev);
-        if (err) {
-                dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n"
-                        , __func__, err);
-                return PCI_ERS_RESULT_DISCONNECT;
-        }
-        pci_set_master(pdev);
-        pci_set_power_state(pdev, PCI_D0);
-        pci_restore_state(pdev);
-
-        return err ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED;
-}
-
-void mlx5_disable_device(struct mlx5_core_dev *dev)
-{
-        mlx5_pci_err_detected(dev->pdev, 0);
-}
-
 /* wait for the device to show vital signs by waiting
  * for the health counter to start counting.
  */
@@ -1477,21 +1453,44 @@ static int wait_vital(struct pci_dev *pdev)
         return -ETIMEDOUT;
 }
 
-static void mlx5_pci_resume(struct pci_dev *pdev)
+static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
 {
         struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
-        struct mlx5_priv *priv = &dev->priv;
         int err;
 
         dev_info(&pdev->dev, "%s was called\n", __func__);
 
-        pci_save_state(pdev);
-        err = wait_vital(pdev);
+        err = mlx5_pci_enable_device(dev);
         if (err) {
+                dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n"
+                        , __func__, err);
+                return PCI_ERS_RESULT_DISCONNECT;
+        }
+
+        pci_set_master(pdev);
+        pci_restore_state(pdev);
+
+        if (wait_vital(pdev)) {
                 dev_err(&pdev->dev, "%s: wait_vital timed out\n", __func__);
-                return;
+                return PCI_ERS_RESULT_DISCONNECT;
         }
 
+        return PCI_ERS_RESULT_RECOVERED;
+}
+
+void mlx5_disable_device(struct mlx5_core_dev *dev)
+{
+        mlx5_pci_err_detected(dev->pdev, 0);
+}
+
+static void mlx5_pci_resume(struct pci_dev *pdev)
+{
+        struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
+        struct mlx5_priv *priv = &dev->priv;
+        int err;
+
+        dev_info(&pdev->dev, "%s was called\n", __func__);
+
         err = mlx5_load_one(dev, priv);
         if (err)
                 dev_err(&pdev->dev, "%s: mlx5_load_one failed with error code: %d\n"
diff --git a/drivers/net/ethernet/mellanox/mlxsw/port.h b/drivers/net/ethernet/mellanox/mlxsw/port.h
index f33b997f2b61..af371a82c35b 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/port.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/port.h
@@ -56,6 +56,7 @@
 #define MLXSW_PORT_PHY_BITS_MASK        (MLXSW_PORT_MAX_PHY_PORTS - 1)
 
 #define MLXSW_PORT_CPU_PORT             0x0
+#define MLXSW_PORT_ROUTER_PORT          (MLXSW_PORT_MAX_PHY_PORTS + 2)
 
 #define MLXSW_PORT_DONT_CARE            (MLXSW_PORT_MAX_PORTS)
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 1f8168906811..d48873bcbddf 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -56,6 +56,7 @@
 #include <generated/utsrelease.h>
 #include <net/pkt_cls.h>
 #include <net/tc_act/tc_mirred.h>
+#include <net/netevent.h>
 
 #include "spectrum.h"
 #include "core.h"
@@ -2105,6 +2106,13 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
         dev->netdev_ops = &mlxsw_sp_port_netdev_ops;
         dev->ethtool_ops = &mlxsw_sp_port_ethtool_ops;
 
+        err = mlxsw_sp_port_swid_set(mlxsw_sp_port, 0);
+        if (err) {
+                dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to set SWID\n",
+                        mlxsw_sp_port->local_port);
+                goto err_port_swid_set;
+        }
+
         err = mlxsw_sp_port_dev_addr_init(mlxsw_sp_port);
         if (err) {
                 dev_err(mlxsw_sp->bus_info->dev, "Port %d: Unable to init port mac address\n",
@@ -2130,13 +2138,6 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                 goto err_port_system_port_mapping_set;
         }
 
-        err = mlxsw_sp_port_swid_set(mlxsw_sp_port, 0);
-        if (err) {
-                dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to set SWID\n",
-                        mlxsw_sp_port->local_port);
-                goto err_port_swid_set;
-        }
-
         err = mlxsw_sp_port_speed_by_width_set(mlxsw_sp_port, width);
         if (err) {
                 dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to enable speeds\n",
@@ -2218,10 +2219,10 @@ err_port_buffers_init:
 err_port_admin_status_set:
 err_port_mtu_set:
 err_port_speed_by_width_set:
-        mlxsw_sp_port_swid_set(mlxsw_sp_port, MLXSW_PORT_SWID_DISABLED_PORT);
-err_port_swid_set:
 err_port_system_port_mapping_set:
 err_dev_addr_init:
+        mlxsw_sp_port_swid_set(mlxsw_sp_port, MLXSW_PORT_SWID_DISABLED_PORT);
+err_port_swid_set:
         free_percpu(mlxsw_sp_port->pcpu_stats);
 err_alloc_stats:
         kfree(mlxsw_sp_port->untagged_vlans);
@@ -3324,6 +3325,39 @@ static struct mlxsw_sp_fid *mlxsw_sp_bridge_fid_get(struct mlxsw_sp *mlxsw_sp,
         return mlxsw_sp_fid_find(mlxsw_sp, fid);
 }
 
+static enum mlxsw_flood_table_type mlxsw_sp_flood_table_type_get(u16 fid)
+{
+        return mlxsw_sp_fid_is_vfid(fid) ? MLXSW_REG_SFGC_TABLE_TYPE_FID :
+               MLXSW_REG_SFGC_TABLE_TYPE_FID_OFFEST;
+}
+
+static u16 mlxsw_sp_flood_table_index_get(u16 fid)
+{
+        return mlxsw_sp_fid_is_vfid(fid) ? mlxsw_sp_fid_to_vfid(fid) : fid;
+}
+
+static int mlxsw_sp_router_port_flood_set(struct mlxsw_sp *mlxsw_sp, u16 fid,
+                                          bool set)
+{
+        enum mlxsw_flood_table_type table_type;
+        char *sftr_pl;
+        u16 index;
+        int err;
+
+        sftr_pl = kmalloc(MLXSW_REG_SFTR_LEN, GFP_KERNEL);
+        if (!sftr_pl)
+                return -ENOMEM;
+
+        table_type = mlxsw_sp_flood_table_type_get(fid);
+        index = mlxsw_sp_flood_table_index_get(fid);
+        mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_BM, index, table_type,
+                            1, MLXSW_PORT_ROUTER_PORT, set);
+        err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
+
+        kfree(sftr_pl);
+        return err;
+}
+
 static enum mlxsw_reg_ritr_if_type mlxsw_sp_rif_type_get(u16 fid)
 {
         if (mlxsw_sp_fid_is_vfid(fid))
@@ -3360,10 +3394,14 @@ static int mlxsw_sp_rif_bridge_create(struct mlxsw_sp *mlxsw_sp,
         if (rif == MLXSW_SP_RIF_MAX)
                 return -ERANGE;
 
-        err = mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, true);
+        err = mlxsw_sp_router_port_flood_set(mlxsw_sp, f->fid, true);
         if (err)
                 return err;
 
+        err = mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, true);
+        if (err)
+                goto err_rif_bridge_op;
+
         err = mlxsw_sp_rif_fdb_op(mlxsw_sp, l3_dev->dev_addr, f->fid, true);
         if (err)
                 goto err_rif_fdb_op;
@@ -3385,6 +3423,8 @@ err_rif_alloc:
         mlxsw_sp_rif_fdb_op(mlxsw_sp, l3_dev->dev_addr, f->fid, false);
 err_rif_fdb_op:
         mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, false);
+err_rif_bridge_op:
+        mlxsw_sp_router_port_flood_set(mlxsw_sp, f->fid, false);
         return err;
 }
 
@@ -3404,6 +3444,8 @@ void mlxsw_sp_rif_bridge_destroy(struct mlxsw_sp *mlxsw_sp,
 
         mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, false);
 
+        mlxsw_sp_router_port_flood_set(mlxsw_sp, f->fid, false);
+
         netdev_dbg(l3_dev, "RIF=%d destroyed\n", rif);
 }
 
@@ -4500,18 +4542,26 @@ static struct notifier_block mlxsw_sp_inetaddr_nb __read_mostly = {
         .priority = 10, /* Must be called before FIB notifier block */
 };
 
+static struct notifier_block mlxsw_sp_router_netevent_nb __read_mostly = {
+        .notifier_call = mlxsw_sp_router_netevent_event,
+};
+
 static int __init mlxsw_sp_module_init(void)
 {
         int err;
 
         register_netdevice_notifier(&mlxsw_sp_netdevice_nb);
         register_inetaddr_notifier(&mlxsw_sp_inetaddr_nb);
+        register_netevent_notifier(&mlxsw_sp_router_netevent_nb);
+
         err = mlxsw_core_driver_register(&mlxsw_sp_driver);
         if (err)
                 goto err_core_driver_register;
         return 0;
 
 err_core_driver_register:
+        unregister_netevent_notifier(&mlxsw_sp_router_netevent_nb);
+        unregister_inetaddr_notifier(&mlxsw_sp_inetaddr_nb);
         unregister_netdevice_notifier(&mlxsw_sp_netdevice_nb);
         return err;
 }
@@ -4519,6 +4569,7 @@ err_core_driver_register:
 static void __exit mlxsw_sp_module_exit(void)
 {
         mlxsw_core_driver_unregister(&mlxsw_sp_driver);
+        unregister_netevent_notifier(&mlxsw_sp_router_netevent_nb);
         unregister_inetaddr_notifier(&mlxsw_sp_inetaddr_nb);
         unregister_netdevice_notifier(&mlxsw_sp_netdevice_nb);
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index ab3feb81bd43..ac48abebe904 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -587,6 +587,8 @@ int mlxsw_sp_router_neigh_construct(struct net_device *dev,
                                     struct neighbour *n);
 void mlxsw_sp_router_neigh_destroy(struct net_device *dev,
                                    struct neighbour *n);
+int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
+                                   unsigned long event, void *ptr);
 
 int mlxsw_sp_kvdl_alloc(struct mlxsw_sp *mlxsw_sp, unsigned int entry_count);
 void mlxsw_sp_kvdl_free(struct mlxsw_sp *mlxsw_sp, int entry_index);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
index 237418a0e6e0..953b214f38d0 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -717,22 +717,18 @@ int mlxsw_sp_sb_tc_pool_bind_set(struct mlxsw_core_port *mlxsw_core_port,
         u8 local_port = mlxsw_sp_port->local_port;
         u8 pg_buff = tc_index;
         enum mlxsw_reg_sbxx_dir dir = pool_type;
-        u8 pool = pool_index;
+        u8 pool = pool_get(pool_index);
         u32 max_buff;
         int err;
 
+        if (dir != dir_get(pool_index))
+                return -EINVAL;
+
         err = mlxsw_sp_sb_threshold_in(mlxsw_sp, pool, dir,
                                        threshold, &max_buff);
         if (err)
                 return err;
 
-        if (pool_type == DEVLINK_SB_POOL_TYPE_EGRESS) {
-                if (pool < MLXSW_SP_SB_POOL_COUNT)
-                        return -EINVAL;
-                pool -= MLXSW_SP_SB_POOL_COUNT;
-        } else if (pool >= MLXSW_SP_SB_POOL_COUNT) {
-                return -EINVAL;
-        }
         return mlxsw_sp_sb_cm_write(mlxsw_sp, local_port, pg_buff, dir,
                                     0, max_buff, pool);
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 90bb93b037ec..3f5c51da6d3e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -107,6 +107,7 @@ mlxsw_sp_prefix_usage_clear(struct mlxsw_sp_prefix_usage *prefix_usage,
 }
 
 struct mlxsw_sp_fib_key {
+        struct net_device *dev;
         unsigned char addr[sizeof(struct in6_addr)];
         unsigned char prefix_len;
 };
@@ -123,7 +124,7 @@ struct mlxsw_sp_fib_entry {
         struct rhash_head ht_node;
         struct mlxsw_sp_fib_key key;
         enum mlxsw_sp_fib_entry_type type;
-        u8 added:1;
+        unsigned int ref_count;
         u16 rif; /* used for action local */
         struct mlxsw_sp_vr *vr;
         struct list_head nexthop_group_node;
@@ -171,13 +172,15 @@ static void mlxsw_sp_fib_entry_remove(struct mlxsw_sp_fib *fib,
 
 static struct mlxsw_sp_fib_entry *
 mlxsw_sp_fib_entry_create(struct mlxsw_sp_fib *fib, const void *addr,
-                          size_t addr_len, unsigned char prefix_len)
+                          size_t addr_len, unsigned char prefix_len,
+                          struct net_device *dev)
 {
         struct mlxsw_sp_fib_entry *fib_entry;
 
         fib_entry = kzalloc(sizeof(*fib_entry), GFP_KERNEL);
         if (!fib_entry)
                 return NULL;
+        fib_entry->key.dev = dev;
         memcpy(fib_entry->key.addr, addr, addr_len);
         fib_entry->key.prefix_len = prefix_len;
         return fib_entry;
@@ -190,10 +193,13 @@ static void mlxsw_sp_fib_entry_destroy(struct mlxsw_sp_fib_entry *fib_entry)
 
 static struct mlxsw_sp_fib_entry *
 mlxsw_sp_fib_entry_lookup(struct mlxsw_sp_fib *fib, const void *addr,
-                          size_t addr_len, unsigned char prefix_len)
+                          size_t addr_len, unsigned char prefix_len,
+                          struct net_device *dev)
 {
-        struct mlxsw_sp_fib_key key = {{ 0 } };
+        struct mlxsw_sp_fib_key key;
 
+        memset(&key, 0, sizeof(key));
+        key.dev = dev;
         memcpy(key.addr, addr, addr_len);
         key.prefix_len = prefix_len;
         return rhashtable_lookup_fast(&fib->ht, &key, mlxsw_sp_fib_ht_params);
@@ -657,7 +663,7 @@ int mlxsw_sp_router_neigh_construct(struct net_device *dev,
                 return 0;
         }
 
-        r = mlxsw_sp_rif_find_by_dev(mlxsw_sp, dev);
+        r = mlxsw_sp_rif_find_by_dev(mlxsw_sp, n->dev);
         if (WARN_ON(!r))
                 return -EINVAL;
 
@@ -938,8 +944,8 @@ static void mlxsw_sp_router_neigh_update_hw(struct work_struct *work)
         mlxsw_sp_port_dev_put(mlxsw_sp_port);
 }
 
-static int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
-                                          unsigned long event, void *ptr)
+int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
+                                   unsigned long event, void *ptr)
 {
         struct mlxsw_sp_neigh_entry *neigh_entry;
         struct mlxsw_sp_port *mlxsw_sp_port;
@@ -1009,10 +1015,6 @@ static int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
         return NOTIFY_DONE;
 }
 
-static struct notifier_block mlxsw_sp_router_netevent_nb __read_mostly = {
-        .notifier_call = mlxsw_sp_router_netevent_event,
-};
-
 static int mlxsw_sp_neigh_init(struct mlxsw_sp *mlxsw_sp)
 {
         int err;
@@ -1027,10 +1029,6 @@ static int mlxsw_sp_neigh_init(struct mlxsw_sp *mlxsw_sp)
          */
         mlxsw_sp_router_neighs_update_interval_init(mlxsw_sp);
 
-        err = register_netevent_notifier(&mlxsw_sp_router_netevent_nb);
-        if (err)
-                goto err_register_netevent_notifier;
-
         /* Create the delayed works for the activity_update */
         INIT_DELAYED_WORK(&mlxsw_sp->router.neighs_update.dw,
                           mlxsw_sp_router_neighs_update_work);
@@ -1039,17 +1037,12 @@ static int mlxsw_sp_neigh_init(struct mlxsw_sp *mlxsw_sp)
         mlxsw_core_schedule_dw(&mlxsw_sp->router.neighs_update.dw, 0);
         mlxsw_core_schedule_dw(&mlxsw_sp->router.nexthop_probe_dw, 0);
         return 0;
-
-err_register_netevent_notifier:
-        rhashtable_destroy(&mlxsw_sp->router.neigh_ht);
-        return err;
 }
 
 static void mlxsw_sp_neigh_fini(struct mlxsw_sp *mlxsw_sp)
 {
         cancel_delayed_work_sync(&mlxsw_sp->router.neighs_update.dw);
         cancel_delayed_work_sync(&mlxsw_sp->router.nexthop_probe_dw);
-        unregister_netevent_notifier(&mlxsw_sp_router_netevent_nb);
         rhashtable_destroy(&mlxsw_sp->router.neigh_ht);
 }
 
@@ -1524,7 +1517,14 @@ int mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp)
                 return err;
         mlxsw_sp_lpm_init(mlxsw_sp);
         mlxsw_sp_vrs_init(mlxsw_sp);
-        return mlxsw_sp_neigh_init(mlxsw_sp);
+        err = mlxsw_sp_neigh_init(mlxsw_sp);
+        if (err)
+                goto err_neigh_init;
+        return 0;
+
+err_neigh_init:
+        __mlxsw_sp_router_fini(mlxsw_sp);
+        return err;
 }
 
 void mlxsw_sp_router_fini(struct mlxsw_sp *mlxsw_sp)
@@ -1626,11 +1626,8 @@ static int mlxsw_sp_fib_entry_op(struct mlxsw_sp *mlxsw_sp,
 static int mlxsw_sp_fib_entry_update(struct mlxsw_sp *mlxsw_sp,
                                      struct mlxsw_sp_fib_entry *fib_entry)
 {
-        enum mlxsw_reg_ralue_op op;
-
-        op = !fib_entry->added ? MLXSW_REG_RALUE_OP_WRITE_WRITE :
-                                 MLXSW_REG_RALUE_OP_WRITE_UPDATE;
-        return mlxsw_sp_fib_entry_op(mlxsw_sp, fib_entry, op);
+        return mlxsw_sp_fib_entry_op(mlxsw_sp, fib_entry,
+                                     MLXSW_REG_RALUE_OP_WRITE_WRITE);
 }
 
 static int mlxsw_sp_fib_entry_del(struct mlxsw_sp *mlxsw_sp,
@@ -1695,34 +1692,93 @@ mlxsw_sp_router_fib4_entry_fini(struct mlxsw_sp *mlxsw_sp,
         mlxsw_sp_nexthop_group_put(mlxsw_sp, fib_entry);
 }
 
-static int
-mlxsw_sp_router_fib4_add_prepare(struct mlxsw_sp_port *mlxsw_sp_port,
-                                 const struct switchdev_obj_ipv4_fib *fib4,
-                                 struct switchdev_trans *trans)
+static struct mlxsw_sp_fib_entry *
+mlxsw_sp_fib_entry_get(struct mlxsw_sp *mlxsw_sp,
+                       const struct switchdev_obj_ipv4_fib *fib4)
 {
-        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
-        struct mlxsw_sp_router_fib4_add_info *info;
         struct mlxsw_sp_fib_entry *fib_entry;
+        struct fib_info *fi = fib4->fi;
         struct mlxsw_sp_vr *vr;
         int err;
 
         vr = mlxsw_sp_vr_get(mlxsw_sp, fib4->dst_len, fib4->tb_id,
                              MLXSW_SP_L3_PROTO_IPV4);
         if (IS_ERR(vr))
-                return PTR_ERR(vr);
+                return ERR_CAST(vr);
 
+        fib_entry = mlxsw_sp_fib_entry_lookup(vr->fib, &fib4->dst,
+                                              sizeof(fib4->dst),
+                                              fib4->dst_len, fi->fib_dev);
+        if (fib_entry) {
+                /* Already exists, just take a reference */
+                fib_entry->ref_count++;
+                return fib_entry;
+        }
         fib_entry = mlxsw_sp_fib_entry_create(vr->fib, &fib4->dst,
-                                              sizeof(fib4->dst), fib4->dst_len);
+                                              sizeof(fib4->dst),
+                                              fib4->dst_len, fi->fib_dev);
         if (!fib_entry) {
                 err = -ENOMEM;
                 goto err_fib_entry_create;
         }
         fib_entry->vr = vr;
+        fib_entry->ref_count = 1;
 
         err = mlxsw_sp_router_fib4_entry_init(mlxsw_sp, fib4, fib_entry);
         if (err)
                 goto err_fib4_entry_init;
 
+        return fib_entry;
+
+err_fib4_entry_init:
+        mlxsw_sp_fib_entry_destroy(fib_entry);
+err_fib_entry_create:
+        mlxsw_sp_vr_put(mlxsw_sp, vr);
+
+        return ERR_PTR(err);
+}
+
+static struct mlxsw_sp_fib_entry *
+mlxsw_sp_fib_entry_find(struct mlxsw_sp *mlxsw_sp,
+                        const struct switchdev_obj_ipv4_fib *fib4)
+{
+        struct mlxsw_sp_vr *vr;
+
+        vr = mlxsw_sp_vr_find(mlxsw_sp, fib4->tb_id, MLXSW_SP_L3_PROTO_IPV4);
+        if (!vr)
+                return NULL;
+
+        return mlxsw_sp_fib_entry_lookup(vr->fib, &fib4->dst,
+                                         sizeof(fib4->dst), fib4->dst_len,
+                                         fib4->fi->fib_dev);
+}
+
+void mlxsw_sp_fib_entry_put(struct mlxsw_sp *mlxsw_sp,
+                            struct mlxsw_sp_fib_entry *fib_entry)
+{
+        struct mlxsw_sp_vr *vr = fib_entry->vr;
+
+        if (--fib_entry->ref_count == 0) {
+                mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
+                mlxsw_sp_fib_entry_destroy(fib_entry);
+        }
+        mlxsw_sp_vr_put(mlxsw_sp, vr);
+}
+
+static int
+mlxsw_sp_router_fib4_add_prepare(struct mlxsw_sp_port *mlxsw_sp_port,
+                                 const struct switchdev_obj_ipv4_fib *fib4,
+                                 struct switchdev_trans *trans)
+{
+        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
+        struct mlxsw_sp_router_fib4_add_info *info;
+        struct mlxsw_sp_fib_entry *fib_entry;
+        int err;
+
+        fib_entry = mlxsw_sp_fib_entry_get(mlxsw_sp, fib4);
+        if (IS_ERR(fib_entry))
+                return PTR_ERR(fib_entry);
+
         info = kmalloc(sizeof(*info), GFP_KERNEL);
         if (!info) {
                 err = -ENOMEM;
@@ -1736,11 +1792,7 @@ mlxsw_sp_router_fib4_add_prepare(struct mlxsw_sp_port *mlxsw_sp_port,
         return 0;
 
 err_alloc_info:
-        mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
-err_fib4_entry_init:
-        mlxsw_sp_fib_entry_destroy(fib_entry);
-err_fib_entry_create:
-        mlxsw_sp_vr_put(mlxsw_sp, vr);
+        mlxsw_sp_fib_entry_put(mlxsw_sp, fib_entry);
         return err;
 }
 
@@ -1759,11 +1811,14 @@ mlxsw_sp_router_fib4_add_commit(struct mlxsw_sp_port *mlxsw_sp_port,
         fib_entry = info->fib_entry;
         kfree(info);
 
+        if (fib_entry->ref_count != 1)
+                return 0;
+
         vr = fib_entry->vr;
-        err = mlxsw_sp_fib_entry_insert(fib_entry->vr->fib, fib_entry);
+        err = mlxsw_sp_fib_entry_insert(vr->fib, fib_entry);
         if (err)
                 goto err_fib_entry_insert;
-        err = mlxsw_sp_fib_entry_update(mlxsw_sp, fib_entry);
+        err = mlxsw_sp_fib_entry_update(mlxsw_sp_port->mlxsw_sp, fib_entry);
         if (err)
                 goto err_fib_entry_add;
         return 0;
@@ -1771,9 +1826,7 @@ mlxsw_sp_router_fib4_add_commit(struct mlxsw_sp_port *mlxsw_sp_port,
 err_fib_entry_add:
         mlxsw_sp_fib_entry_remove(vr->fib, fib_entry);
 err_fib_entry_insert:
-        mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
-        mlxsw_sp_fib_entry_destroy(fib_entry);
-        mlxsw_sp_vr_put(mlxsw_sp, vr);
+        mlxsw_sp_fib_entry_put(mlxsw_sp, fib_entry);
         return err;
 }
 
@@ -1793,23 +1846,18 @@ int mlxsw_sp_router_fib4_del(struct mlxsw_sp_port *mlxsw_sp_port,
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         struct mlxsw_sp_fib_entry *fib_entry;
-        struct mlxsw_sp_vr *vr;
 
-        vr = mlxsw_sp_vr_find(mlxsw_sp, fib4->tb_id, MLXSW_SP_L3_PROTO_IPV4);
-        if (!vr) {
-                dev_warn(mlxsw_sp->bus_info->dev, "Failed to find virtual router for FIB4 entry being removed.\n");
-                return -ENOENT;
-        }
-        fib_entry = mlxsw_sp_fib_entry_lookup(vr->fib, &fib4->dst,
-                                              sizeof(fib4->dst), fib4->dst_len);
+        fib_entry = mlxsw_sp_fib_entry_find(mlxsw_sp, fib4);
         if (!fib_entry) {
                 dev_warn(mlxsw_sp->bus_info->dev, "Failed to find FIB4 entry being removed.\n");
                 return -ENOENT;
         }
-        mlxsw_sp_fib_entry_del(mlxsw_sp_port->mlxsw_sp, fib_entry);
-        mlxsw_sp_fib_entry_remove(vr->fib, fib_entry);
-        mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
-        mlxsw_sp_fib_entry_destroy(fib_entry);
-        mlxsw_sp_vr_put(mlxsw_sp, vr);
+
+        if (fib_entry->ref_count == 1) {
+                mlxsw_sp_fib_entry_del(mlxsw_sp, fib_entry);
+                mlxsw_sp_fib_entry_remove(fib_entry->vr->fib, fib_entry);
+        }
+
+        mlxsw_sp_fib_entry_put(mlxsw_sp, fib_entry);
         return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index d1b59cdfacc1..7b654c517b91 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -167,8 +167,8 @@ static int mlxsw_sp_port_attr_stp_state_set(struct mlxsw_sp_port *mlxsw_sp_port,
 }
 
 static int __mlxsw_sp_port_flood_set(struct mlxsw_sp_port *mlxsw_sp_port,
-                                     u16 idx_begin, u16 idx_end, bool set,
-                                     bool only_uc)
+                                     u16 idx_begin, u16 idx_end, bool uc_set,
+                                     bool bm_set)
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         u16 local_port = mlxsw_sp_port->local_port;
@@ -187,28 +187,22 @@ static int __mlxsw_sp_port_flood_set(struct mlxsw_sp_port *mlxsw_sp_port,
                 return -ENOMEM;
 
         mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_UC, idx_begin,
-                            table_type, range, local_port, set);
+                            table_type, range, local_port, uc_set);
         err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
         if (err)
                 goto buffer_out;
 
-        /* Flooding control allows one to decide whether a given port will
-         * flood unicast traffic for which there is no FDB entry.
-         */
-        if (only_uc)
-                goto buffer_out;
-
         mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_BM, idx_begin,
-                            table_type, range, local_port, set);
+                            table_type, range, local_port, bm_set);
         err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
         if (err)
                 goto err_flood_bm_set;
-        else
-                goto buffer_out;
+
+        goto buffer_out;
 
 err_flood_bm_set:
         mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_UC, idx_begin,
-                            table_type, range, local_port, !set);
+                            table_type, range, local_port, !uc_set);
         mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
 buffer_out:
         kfree(sftr_pl);
@@ -257,8 +251,7 @@ int mlxsw_sp_vport_flood_set(struct mlxsw_sp_port *mlxsw_sp_vport, u16 fid,
          * the start of the vFIDs range.
          */
         vfid = mlxsw_sp_fid_to_vfid(fid);
-        return __mlxsw_sp_port_flood_set(mlxsw_sp_vport, vfid, vfid, set,
-                                         false);
+        return __mlxsw_sp_port_flood_set(mlxsw_sp_vport, vfid, vfid, set, set);
 }
 
 static int mlxsw_sp_port_attr_br_flags_set(struct mlxsw_sp_port *mlxsw_sp_port,
@@ -460,6 +453,9 @@ static int __mlxsw_sp_port_fid_join(struct mlxsw_sp_port *mlxsw_sp_port,
 {
         struct mlxsw_sp_fid *f;
 
+        if (test_bit(fid, mlxsw_sp_port->active_vlans))
+                return 0;
+
         f = mlxsw_sp_fid_find(mlxsw_sp_port->mlxsw_sp, fid);
         if (!f) {
                 f = mlxsw_sp_fid_create(mlxsw_sp_port->mlxsw_sp, fid);
@@ -517,7 +513,7 @@ static int mlxsw_sp_port_fid_join(struct mlxsw_sp_port *mlxsw_sp_port,
         }
 
         err = __mlxsw_sp_port_flood_set(mlxsw_sp_port, fid_begin, fid_end,
-                                        true, false);
+                                        mlxsw_sp_port->uc_flood, true);
         if (err)
                 goto err_port_flood_set;
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 88678c172b19..252e4924de0f 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -41,7 +41,6 @@
  *          Chris Telfer <chris.telfer@netronome.com>
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -1441,10 +1440,6 @@ static int nfp_net_rx(struct nfp_net_rx_ring *rx_ring, int budget)
 
                 nfp_net_set_hash(nn->netdev, skb, rxd);
 
-                /* Pad small frames to minimum */
-                if (skb_put_padto(skb, 60))
-                        break;
-
                 /* Stats update */
                 u64_stats_update_begin(&r_vec->rx_sync);
                 r_vec->rx_pkts++;
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
index 7d7933d00b8f..4c9897220969 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
@@ -40,7 +40,6 @@
  *          Brad Petrus <brad.petrus@netronome.com>
  */
 
-#include <linux/version.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c b/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c
index 37abef016a0a..f7062cb648e1 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c
@@ -38,7 +38,6 @@
  *         Rolf Neugebauer <rolf.neugebauer@netronome.com>
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -134,7 +133,7 @@ static int nfp_netvf_pci_probe(struct pci_dev *pdev,
         }
 
         nfp_net_get_fw_version(&fw_ver, ctrl_bar);
-        if (fw_ver.class != NFP_NET_CFG_VERSION_CLASS_GENERIC) {
+        if (fw_ver.resv || fw_ver.class != NFP_NET_CFG_VERSION_CLASS_GENERIC) {
                 dev_err(&pdev->dev, "Unknown Firmware ABI %d.%d.%d.%d\n",
                         fw_ver.resv, fw_ver.class, fw_ver.major, fw_ver.minor);
                 err = -EINVAL;
@@ -142,9 +141,7 @@ static int nfp_netvf_pci_probe(struct pci_dev *pdev,
         }
 
         /* Determine stride */
-        if (nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0, 0) ||
-            nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0, 1) ||
-            nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0x12, 0x48)) {
+        if (nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0, 1)) {
                 stride = 2;
                 tx_bar_no = NFP_NET_Q0_BAR;
                 rx_bar_no = NFP_NET_Q1_BAR;
diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index 4d4ecba0aad9..8e13ec84c538 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -475,14 +475,6 @@ static void __lpc_get_mac(struct netdata_local *pldat, u8 *mac)
         mac[5] = tmp >> 8;
 }
 
-static void __lpc_eth_clock_enable(struct netdata_local *pldat, bool enable)
-{
-        if (enable)
-                clk_prepare_enable(pldat->clk);
-        else
-                clk_disable_unprepare(pldat->clk);
-}
-
 static void __lpc_params_setup(struct netdata_local *pldat)
 {
         u32 tmp;
@@ -1056,7 +1048,7 @@ static int lpc_eth_close(struct net_device *ndev)
         writel(0, LPC_ENET_MAC2(pldat->net_base));
         spin_unlock_irqrestore(&pldat->lock, flags);
 
-        __lpc_eth_clock_enable(pldat, false);
+        clk_disable_unprepare(pldat->clk);
 
         return 0;
 }
@@ -1197,11 +1189,14 @@ static int lpc_eth_ioctl(struct net_device *ndev, struct ifreq *req, int cmd)
 static int lpc_eth_open(struct net_device *ndev)
 {
         struct netdata_local *pldat = netdev_priv(ndev);
+        int ret;
 
         if (netif_msg_ifup(pldat))
                 dev_dbg(&pldat->pdev->dev, "enabling %s\n", ndev->name);
 
-        __lpc_eth_clock_enable(pldat, true);
+        ret = clk_prepare_enable(pldat->clk);
+        if (ret)
+                return ret;
 
         /* Suspended PHY makes LPC ethernet core block, so resume now */
         phy_resume(ndev->phydev);
@@ -1320,7 +1315,9 @@ static int lpc_eth_drv_probe(struct platform_device *pdev)
         }
 
         /* Enable network clock */
-        __lpc_eth_clock_enable(pldat, true);
+        ret = clk_prepare_enable(pldat->clk);
+        if (ret)
+                goto err_out_clk_put;
 
         /* Map IO space */
         pldat->net_base = ioremap(res->start, resource_size(res));
@@ -1454,6 +1451,7 @@ err_out_iounmap:
         iounmap(pldat->net_base);
 err_out_disable_clocks:
         clk_disable_unprepare(pldat->clk);
+err_out_clk_put:
         clk_put(pldat->clk);
 err_out_free_dev:
         free_netdev(ndev);
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index 35e53771533f..45ab74676573 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -561,9 +561,18 @@ struct qed_dev {
 static inline u8 qed_concrete_to_sw_fid(struct qed_dev *cdev,
                                         u32 concrete_fid)
 {
+        u8 vfid = GET_FIELD(concrete_fid, PXP_CONCRETE_FID_VFID);
         u8 pfid = GET_FIELD(concrete_fid, PXP_CONCRETE_FID_PFID);
+        u8 vf_valid = GET_FIELD(concrete_fid,
+                                PXP_CONCRETE_FID_VFVALID);
+        u8 sw_fid;
 
-        return pfid;
+        if (vf_valid)
+                sw_fid = vfid + MAX_NUM_PFS;
+        else
+                sw_fid = pfid;
+
+        return sw_fid;
 }
 
 #define PURE_LB_TC 8
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index 226cb08cc055..3656d2fd673d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -19,6 +19,7 @@
 #include "qed_dcbx.h"
 #include "qed_hsi.h"
 #include "qed_sp.h"
+#include "qed_sriov.h"
 #ifdef CONFIG_DCB
 #include <linux/qed/qed_eth_if.h>
 #endif
@@ -945,6 +946,9 @@ static int qed_dcbx_query_params(struct qed_hwfn *p_hwfn,
         struct qed_ptt *p_ptt;
         int rc;
 
+        if (IS_VF(p_hwfn->cdev))
+                return -EINVAL;
+
         p_ptt = qed_ptt_acquire(p_hwfn);
         if (!p_ptt)
                 return -EBUSY;
@@ -984,6 +988,7 @@ qed_dcbx_set_pfc_data(struct qed_hwfn *p_hwfn,
                 if (p_params->pfc.prio[i])
                         pfc_map |= BIT(i);
 
+        *pfc &= ~DCBX_PFC_PRI_EN_BITMAP_MASK;
         *pfc |= (pfc_map << DCBX_PFC_PRI_EN_BITMAP_SHIFT);
 
         DP_VERBOSE(p_hwfn, QED_MSG_DCB, "pfc = 0x%x\n", *pfc);
@@ -1058,24 +1063,33 @@ qed_dcbx_set_app_data(struct qed_hwfn *p_hwfn,
 
         for (i = 0; i < DCBX_MAX_APP_PROTOCOL; i++) {
                 entry = &p_app->app_pri_tbl[i].entry;
+                *entry = 0;
                 if (ieee) {
-                        *entry &= ~DCBX_APP_SF_IEEE_MASK;
+                        *entry &= ~(DCBX_APP_SF_IEEE_MASK | DCBX_APP_SF_MASK);
                         switch (p_params->app_entry[i].sf_ieee) {
                         case QED_DCBX_SF_IEEE_ETHTYPE:
                                 *entry |= ((u32)DCBX_APP_SF_IEEE_ETHTYPE <<
                                            DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_ETHTYPE <<
+                                           DCBX_APP_SF_SHIFT);
                                 break;
                         case QED_DCBX_SF_IEEE_TCP_PORT:
                                 *entry |= ((u32)DCBX_APP_SF_IEEE_TCP_PORT <<
                                            DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
                                 break;
                         case QED_DCBX_SF_IEEE_UDP_PORT:
                                 *entry |= ((u32)DCBX_APP_SF_IEEE_UDP_PORT <<
                                            DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
                                 break;
                         case QED_DCBX_SF_IEEE_TCP_UDP_PORT:
                                 *entry |= ((u32)DCBX_APP_SF_IEEE_TCP_UDP_PORT <<
                                            DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
                                 break;
                         }
                 } else {
@@ -1175,7 +1189,7 @@ int qed_dcbx_get_config_params(struct qed_hwfn *p_hwfn,
                 return 0;
         }
 
-        dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_KERNEL);
+        dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
         if (!dcbx_info) {
                 DP_ERR(p_hwfn, "Failed to allocate struct qed_dcbx_info\n");
                 return -ENOMEM;
@@ -1212,7 +1226,7 @@ static struct qed_dcbx_get *qed_dcbnl_get_dcbx(struct qed_hwfn *hwfn,
 {
         struct qed_dcbx_get *dcbx_info;
 
-        dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_KERNEL);
+        dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
         if (!dcbx_info) {
                 DP_ERR(hwfn->cdev, "Failed to allocate memory for dcbx_info\n");
                 return NULL;
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index e4bd02e46e57..9544e4c41359 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -722,11 +722,14 @@ netdev_tx_t qede_start_xmit(struct sk_buff *skb,
         txq->tx_db.data.bd_prod =
                 cpu_to_le16(qed_chain_get_prod_idx(&txq->tx_pbl));
 
-        if (!skb->xmit_more || netif_tx_queue_stopped(netdev_txq))
+        if (!skb->xmit_more || netif_xmit_stopped(netdev_txq))
                 qede_update_tx_producer(txq);
 
         if (unlikely(qed_chain_get_elem_left(&txq->tx_pbl)
                       < (MAX_SKB_FRAGS + 1))) {
+                if (skb->xmit_more)
+                        qede_update_tx_producer(txq);
+
                 netif_tx_stop_queue(netdev_txq);
                 DP_VERBOSE(edev, NETIF_MSG_TX_QUEUED,
                            "Stop queue was called\n");
@@ -2517,7 +2520,8 @@ static int __qede_probe(struct pci_dev *pdev, u32 dp_module, u8 dp_level,
         edev->ops->register_ops(cdev, &qede_ll_ops, edev);
 
 #ifdef CONFIG_DCB
-        qede_set_dcbnl_ops(edev->ndev);
+        if (!IS_VF(edev))
+                qede_set_dcbnl_ops(edev->ndev);
 #endif
 
         INIT_DELAYED_WORK(&edev->sp_task, qede_sp_task);
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index deae10d7426d..5297bf77211c 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -467,8 +467,8 @@ static int cp_rx_poll(struct napi_struct *napi, int budget)
         unsigned int rx_tail = cp->rx_tail;
         int rx;
 
-rx_status_loop:
         rx = 0;
+rx_status_loop:
         cpw16(IntrStatus, cp_rx_intr_mask);
 
         while (rx < budget) {
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 799d58d86e6d..054e795df90f 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -201,9 +201,14 @@ static const u16 sh_eth_offset_fast_rz[SH_ETH_MAX_REGISTER_OFFSET] = {
 
         [ARSTR]         = 0x0000,
         [TSU_CTRST]     = 0x0004,
+        [TSU_FWSLC]     = 0x0038,
         [TSU_VTAG0]     = 0x0058,
         [TSU_ADSBSY]    = 0x0060,
         [TSU_TEN]       = 0x0064,
+        [TSU_POST1]     = 0x0070,
+        [TSU_POST2]     = 0x0074,
+        [TSU_POST3]     = 0x0078,
+        [TSU_POST4]     = 0x007c,
         [TSU_ADRH0]     = 0x0100,
 
         [TXNLCR0]       = 0x0080,
@@ -2786,6 +2791,8 @@ static void sh_eth_tsu_init(struct sh_eth_private *mdp)
 {
         if (sh_eth_is_rz_fast_ether(mdp)) {
                 sh_eth_tsu_write(mdp, 0, TSU_TEN); /* Disable all CAM entry */
+                sh_eth_tsu_write(mdp, TSU_FWSLC_POSTENU | TSU_FWSLC_POSTENL,
+                                 TSU_FWSLC);    /* Enable POST registers */
                 return;
         }
 
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index f658fee74f18..e00a669e9e09 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -1517,13 +1517,14 @@ static void efx_ef10_get_stat_mask(struct efx_nic *efx, unsigned long *mask)
         }
 
 #if BITS_PER_LONG == 64
+        BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 2);
         mask[0] = raw_mask[0];
         mask[1] = raw_mask[1];
 #else
+        BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 3);
         mask[0] = raw_mask[0] & 0xffffffff;
         mask[1] = raw_mask[0] >> 32;
         mask[2] = raw_mask[1] & 0xffffffff;
-        mask[3] = raw_mask[1] >> 32;
 #endif
 }
 
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 726b80f45906..503a3b6dce91 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -2275,6 +2275,13 @@ static int smc_drv_probe(struct platform_device *pdev)
         if (pd) {
                 memcpy(&lp->cfg, pd, sizeof(lp->cfg));
                 lp->io_shift = SMC91X_IO_SHIFT(lp->cfg.flags);
+
+                if (!SMC_8BIT(lp) && !SMC_16BIT(lp)) {
+                        dev_err(&pdev->dev,
+                                "at least one of 8-bit or 16-bit access support is required.\n");
+                        ret = -ENXIO;
+                        goto out_free_netdev;
+                }
         }
 
 #if IS_BUILTIN(CONFIG_OF)
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index 1a55c7976df0..ea8465467469 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -37,6 +37,27 @@
 #include <linux/smc91x.h>
 
 /*
+ * Any 16-bit access is performed with two 8-bit accesses if the hardware
+ * can't do it directly. Most registers are 16-bit so those are mandatory.
+ */
+#define SMC_outw_b(x, a, r)                                             \
+        do {                                                            \
+                unsigned int __val16 = (x);                             \
+                unsigned int __reg = (r);                               \
+                SMC_outb(__val16, a, __reg);                            \
+                SMC_outb(__val16 >> 8, a, __reg + (1 << SMC_IO_SHIFT)); \
+        } while (0)
+
+#define SMC_inw_b(a, r)                                                 \
+        ({                                                              \
+                unsigned int __val16;                                   \
+                unsigned int __reg = r;                                 \
+                __val16  = SMC_inb(a, __reg);                           \
+                __val16 |= SMC_inb(a, __reg + (1 << SMC_IO_SHIFT)) << 8; \
+                __val16;                                                \
+        })
+
+/*
  * Define your architecture specific bus configuration parameters here.
  */
 
@@ -55,10 +76,30 @@
 #define SMC_IO_SHIFT            (lp->io_shift)
 
 #define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_inw(a, r)           readw((a) + (r))
+#define SMC_inw(a, r)                                                   \
+        ({                                                              \
+                unsigned int __smc_r = r;                               \
+                SMC_16BIT(lp) ? readw((a) + __smc_r) :                  \
+                SMC_8BIT(lp) ? SMC_inw_b(a, __smc_r) :                  \
+                ({ BUG(); 0; });                                        \
+        })
+
 #define SMC_inl(a, r)           readl((a) + (r))
 #define SMC_outb(v, a, r)       writeb(v, (a) + (r))
+#define SMC_outw(v, a, r)                                               \
+        do {                                                            \
+                unsigned int __v = v, __smc_r = r;                      \
+                if (SMC_16BIT(lp))                                      \
+                        __SMC_outw(__v, a, __smc_r);                    \
+                else if (SMC_8BIT(lp))                                  \
+                        SMC_outw_b(__v, a, __smc_r);                    \
+                else                                                    \
+                        BUG();                                          \
+        } while (0)
+
 #define SMC_outl(v, a, r)       writel(v, (a) + (r))
+#define SMC_insb(a, r, p, l)    readsb((a) + (r), p, l)
+#define SMC_outsb(a, r, p, l)   writesb((a) + (r), p, l)
 #define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
 #define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
 #define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
@@ -66,7 +107,7 @@
 #define SMC_IRQ_FLAGS           (-1)    /* from resource */
 
 /* We actually can't write halfwords properly if not word aligned */
-static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
+static inline void __SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 {
         if ((machine_is_mainstone() || machine_is_stargate2() ||
              machine_is_pxa_idp()) && reg & 2) {
@@ -416,24 +457,8 @@ smc_pxa_dma_insw(void __iomem *ioaddr, struct smc_local *lp, int reg, int dma,
 
 #if ! SMC_CAN_USE_16BIT
 
-/*
- * Any 16-bit access is performed with two 8-bit accesses if the hardware
- * can't do it directly. Most registers are 16-bit so those are mandatory.
- */
-#define SMC_outw(x, ioaddr, reg)                                        \
-        do {                                                            \
-                unsigned int __val16 = (x);                             \
-                SMC_outb( __val16, ioaddr, reg );                       \
-                SMC_outb( __val16 >> 8, ioaddr, reg + (1 << SMC_IO_SHIFT));\
-        } while (0)
-#define SMC_inw(ioaddr, reg)                                            \
-        ({                                                              \
-                unsigned int __val16;                                   \
-                __val16 =  SMC_inb( ioaddr, reg );                      \
-                __val16 |= SMC_inb( ioaddr, reg + (1 << SMC_IO_SHIFT)) << 8; \
-                __val16;                                                \
-        })
-
+#define SMC_outw(x, ioaddr, reg)        SMC_outw_b(x, ioaddr, reg)
+#define SMC_inw(ioaddr, reg)            SMC_inw_b(ioaddr, reg)
 #define SMC_insw(a, r, p, l)            BUG()
 #define SMC_outsw(a, r, p, l)           BUG()
 
@@ -445,7 +470,9 @@ smc_pxa_dma_insw(void __iomem *ioaddr, struct smc_local *lp, int reg, int dma,
 #endif
 
 #if ! SMC_CAN_USE_8BIT
+#undef SMC_inb
 #define SMC_inb(ioaddr, reg)            ({ BUG(); 0; })
+#undef SMC_outb
 #define SMC_outb(x, ioaddr, reg)        BUG()
 #define SMC_insb(a, r, p, l)            BUG()
 #define SMC_outsb(a, r, p, l)           BUG()
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index ca3134540d2d..4f8910b7db2e 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -1099,15 +1099,8 @@ static int smsc911x_mii_init(struct platform_device *pdev,
                 goto err_out_free_bus_2;
         }
 
-        if (smsc911x_mii_probe(dev) < 0) {
-                SMSC_WARN(pdata, probe, "Error registering mii bus");
-                goto err_out_unregister_bus_3;
-        }
-
         return 0;
 
-err_out_unregister_bus_3:
-        mdiobus_unregister(pdata->mii_bus);
 err_out_free_bus_2:
         mdiobus_free(pdata->mii_bus);
 err_out_1:
@@ -1514,23 +1507,90 @@ static void smsc911x_disable_irq_chip(struct net_device *dev)
         smsc911x_reg_write(pdata, INT_STS, 0xFFFFFFFF);
 }
 
+static irqreturn_t smsc911x_irqhandler(int irq, void *dev_id)
+{
+        struct net_device *dev = dev_id;
+        struct smsc911x_data *pdata = netdev_priv(dev);
+        u32 intsts = smsc911x_reg_read(pdata, INT_STS);
+        u32 inten = smsc911x_reg_read(pdata, INT_EN);
+        int serviced = IRQ_NONE;
+        u32 temp;
+
+        if (unlikely(intsts & inten & INT_STS_SW_INT_)) {
+                temp = smsc911x_reg_read(pdata, INT_EN);
+                temp &= (~INT_EN_SW_INT_EN_);
+                smsc911x_reg_write(pdata, INT_EN, temp);
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_SW_INT_);
+                pdata->software_irq_signal = 1;
+                smp_wmb();
+                serviced = IRQ_HANDLED;
+        }
+
+        if (unlikely(intsts & inten & INT_STS_RXSTOP_INT_)) {
+                /* Called when there is a multicast update scheduled and
+                 * it is now safe to complete the update */
+                SMSC_TRACE(pdata, intr, "RX Stop interrupt");
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXSTOP_INT_);
+                if (pdata->multicast_update_pending)
+                        smsc911x_rx_multicast_update_workaround(pdata);
+                serviced = IRQ_HANDLED;
+        }
+
+        if (intsts & inten & INT_STS_TDFA_) {
+                temp = smsc911x_reg_read(pdata, FIFO_INT);
+                temp |= FIFO_INT_TX_AVAIL_LEVEL_;
+                smsc911x_reg_write(pdata, FIFO_INT, temp);
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_TDFA_);
+                netif_wake_queue(dev);
+                serviced = IRQ_HANDLED;
+        }
+
+        if (unlikely(intsts & inten & INT_STS_RXE_)) {
+                SMSC_TRACE(pdata, intr, "RX Error interrupt");
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXE_);
+                serviced = IRQ_HANDLED;
+        }
+
+        if (likely(intsts & inten & INT_STS_RSFL_)) {
+                if (likely(napi_schedule_prep(&pdata->napi))) {
+                        /* Disable Rx interrupts */
+                        temp = smsc911x_reg_read(pdata, INT_EN);
+                        temp &= (~INT_EN_RSFL_EN_);
+                        smsc911x_reg_write(pdata, INT_EN, temp);
+                        /* Schedule a NAPI poll */
+                        __napi_schedule(&pdata->napi);
+                } else {
+                        SMSC_WARN(pdata, rx_err, "napi_schedule_prep failed");
+                }
+                serviced = IRQ_HANDLED;
+        }
+
+        return serviced;
+}
+
 static int smsc911x_open(struct net_device *dev)
 {
         struct smsc911x_data *pdata = netdev_priv(dev);
         unsigned int timeout;
         unsigned int temp;
         unsigned int intcfg;
+        int retval;
+        int irq_flags;
 
-        /* if the phy is not yet registered, retry later*/
+        /* find and start the given phy */
         if (!dev->phydev) {
-                SMSC_WARN(pdata, hw, "phy_dev is NULL");
-                return -EAGAIN;
+                retval = smsc911x_mii_probe(dev);
+                if (retval < 0) {
+                        SMSC_WARN(pdata, probe, "Error starting phy");
+                        goto out;
+                }
         }
 
         /* Reset the LAN911x */
-        if (smsc911x_soft_reset(pdata)) {
+        retval = smsc911x_soft_reset(pdata);
+        if (retval) {
                 SMSC_WARN(pdata, hw, "soft reset failed");
-                return -EIO;
+                goto mii_free_out;
         }
 
         smsc911x_reg_write(pdata, HW_CFG, 0x00050000);
@@ -1586,6 +1646,15 @@ static int smsc911x_open(struct net_device *dev)
         pdata->software_irq_signal = 0;
         smp_wmb();
 
+        irq_flags = irq_get_trigger_type(dev->irq);
+        retval = request_irq(dev->irq, smsc911x_irqhandler,
+                             irq_flags | IRQF_SHARED, dev->name, dev);
+        if (retval) {
+                SMSC_WARN(pdata, probe,
+                          "Unable to claim requested irq: %d", dev->irq);
+                goto mii_free_out;
+        }
+
         temp = smsc911x_reg_read(pdata, INT_EN);
         temp |= INT_EN_SW_INT_EN_;
         smsc911x_reg_write(pdata, INT_EN, temp);
@@ -1600,7 +1669,8 @@ static int smsc911x_open(struct net_device *dev)
         if (!pdata->software_irq_signal) {
                 netdev_warn(dev, "ISR failed signaling test (IRQ %d)\n",
                             dev->irq);
-                return -ENODEV;
+                retval = -ENODEV;
+                goto irq_stop_out;
         }
         SMSC_TRACE(pdata, ifup, "IRQ handler passed test using IRQ %d",
                    dev->irq);
@@ -1646,6 +1716,14 @@ static int smsc911x_open(struct net_device *dev)
 
         netif_start_queue(dev);
         return 0;
+
+irq_stop_out:
+        free_irq(dev->irq, dev);
+mii_free_out:
+        phy_disconnect(dev->phydev);
+        dev->phydev = NULL;
+out:
+        return retval;
 }
 
 /* Entry point for stopping the interface */
@@ -1667,9 +1745,15 @@ static int smsc911x_stop(struct net_device *dev)
         dev->stats.rx_dropped += smsc911x_reg_read(pdata, RX_DROP);
         smsc911x_tx_update_txcounters(dev);
 
+        free_irq(dev->irq, dev);
+
         /* Bring the PHY down */
-        if (dev->phydev)
+        if (dev->phydev) {
                 phy_stop(dev->phydev);
+                phy_disconnect(dev->phydev);
+                dev->phydev = NULL;
+        }
+        netif_carrier_off(dev);
 
         SMSC_TRACE(pdata, ifdown, "Interface stopped");
         return 0;
@@ -1811,67 +1895,6 @@ static void smsc911x_set_multicast_list(struct net_device *dev)
         spin_unlock_irqrestore(&pdata->mac_lock, flags);
 }
 
-static irqreturn_t smsc911x_irqhandler(int irq, void *dev_id)
-{
-        struct net_device *dev = dev_id;
-        struct smsc911x_data *pdata = netdev_priv(dev);
-        u32 intsts = smsc911x_reg_read(pdata, INT_STS);
-        u32 inten = smsc911x_reg_read(pdata, INT_EN);
-        int serviced = IRQ_NONE;
-        u32 temp;
-
-        if (unlikely(intsts & inten & INT_STS_SW_INT_)) {
-                temp = smsc911x_reg_read(pdata, INT_EN);
-                temp &= (~INT_EN_SW_INT_EN_);
-                smsc911x_reg_write(pdata, INT_EN, temp);
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_SW_INT_);
-                pdata->software_irq_signal = 1;
-                smp_wmb();
-                serviced = IRQ_HANDLED;
-        }
-
-        if (unlikely(intsts & inten & INT_STS_RXSTOP_INT_)) {
-                /* Called when there is a multicast update scheduled and
-                 * it is now safe to complete the update */
-                SMSC_TRACE(pdata, intr, "RX Stop interrupt");
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXSTOP_INT_);
-                if (pdata->multicast_update_pending)
-                        smsc911x_rx_multicast_update_workaround(pdata);
-                serviced = IRQ_HANDLED;
-        }
-
-        if (intsts & inten & INT_STS_TDFA_) {
-                temp = smsc911x_reg_read(pdata, FIFO_INT);
-                temp |= FIFO_INT_TX_AVAIL_LEVEL_;
-                smsc911x_reg_write(pdata, FIFO_INT, temp);
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_TDFA_);
-                netif_wake_queue(dev);
-                serviced = IRQ_HANDLED;
-        }
-
-        if (unlikely(intsts & inten & INT_STS_RXE_)) {
-                SMSC_TRACE(pdata, intr, "RX Error interrupt");
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXE_);
-                serviced = IRQ_HANDLED;
-        }
-
-        if (likely(intsts & inten & INT_STS_RSFL_)) {
-                if (likely(napi_schedule_prep(&pdata->napi))) {
-                        /* Disable Rx interrupts */
-                        temp = smsc911x_reg_read(pdata, INT_EN);
-                        temp &= (~INT_EN_RSFL_EN_);
-                        smsc911x_reg_write(pdata, INT_EN, temp);
-                        /* Schedule a NAPI poll */
-                        __napi_schedule(&pdata->napi);
-                } else {
-                        SMSC_WARN(pdata, rx_err, "napi_schedule_prep failed");
-                }
-                serviced = IRQ_HANDLED;
-        }
-
-        return serviced;
-}
-
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void smsc911x_poll_controller(struct net_device *dev)
 {
@@ -2291,16 +2314,14 @@ static int smsc911x_drv_remove(struct platform_device *pdev)
         pdata = netdev_priv(dev);
         BUG_ON(!pdata);
         BUG_ON(!pdata->ioaddr);
-        BUG_ON(!dev->phydev);
+        WARN_ON(dev->phydev);
 
         SMSC_TRACE(pdata, ifdown, "Stopping driver");
 
-        phy_disconnect(dev->phydev);
         mdiobus_unregister(pdata->mii_bus);
         mdiobus_free(pdata->mii_bus);
 
         unregister_netdev(dev);
-        free_irq(dev->irq, dev);
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
                                            "smsc911x-memory");
         if (!res)
@@ -2385,8 +2406,7 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
         struct smsc911x_data *pdata;
         struct smsc911x_platform_config *config = dev_get_platdata(&pdev->dev);
         struct resource *res;
-        unsigned int intcfg = 0;
-        int res_size, irq, irq_flags;
+        int res_size, irq;
         int retval;
 
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -2425,7 +2445,6 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
 
         pdata = netdev_priv(dev);
         dev->irq = irq;
-        irq_flags = irq_get_trigger_type(irq);
         pdata->ioaddr = ioremap_nocache(res->start, res_size);
 
         pdata->dev = dev;
@@ -2472,43 +2491,23 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
         if (retval < 0)
                 goto out_disable_resources;
 
-        /* configure irq polarity and type before connecting isr */
-        if (pdata->config.irq_polarity == SMSC911X_IRQ_POLARITY_ACTIVE_HIGH)
-                intcfg |= INT_CFG_IRQ_POL_;
-
-        if (pdata->config.irq_type == SMSC911X_IRQ_TYPE_PUSH_PULL)
-                intcfg |= INT_CFG_IRQ_TYPE_;
-
-        smsc911x_reg_write(pdata, INT_CFG, intcfg);
-
-        /* Ensure interrupts are globally disabled before connecting ISR */
-        smsc911x_disable_irq_chip(dev);
+        netif_carrier_off(dev);
 
-        retval = request_irq(dev->irq, smsc911x_irqhandler,
-                             irq_flags | IRQF_SHARED, dev->name, dev);
+        retval = smsc911x_mii_init(pdev, dev);
         if (retval) {
-                SMSC_WARN(pdata, probe,
-                          "Unable to claim requested irq: %d", dev->irq);
+                SMSC_WARN(pdata, probe, "Error %i initialising mii", retval);
                 goto out_disable_resources;
         }
 
-        netif_carrier_off(dev);
-
         retval = register_netdev(dev);
         if (retval) {
                 SMSC_WARN(pdata, probe, "Error %i registering device", retval);
-                goto out_free_irq;
+                goto out_disable_resources;
         } else {
                 SMSC_TRACE(pdata, probe,
                            "Network interface: \"%s\"", dev->name);
         }
 
-        retval = smsc911x_mii_init(pdev, dev);
-        if (retval) {
-                SMSC_WARN(pdata, probe, "Error %i initialising mii", retval);
-                goto out_unregister_netdev_5;
-        }
-
         spin_lock_irq(&pdata->mac_lock);
 
         /* Check if mac address has been specified when bringing interface up */
@@ -2544,10 +2543,6 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
 
         return 0;
 
-out_unregister_netdev_5:
-        unregister_netdev(dev);
-out_free_irq:
-        free_irq(dev->irq, dev);
 out_disable_resources:
         pm_runtime_put(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
diff --git a/drivers/net/ethernet/synopsys/dwc_eth_qos.c b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
index 9f159a775af3..4490ebaed127 100644
--- a/drivers/net/ethernet/synopsys/dwc_eth_qos.c
+++ b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
@@ -1246,7 +1246,7 @@ static int dwceqos_mii_init(struct net_local *lp)
         lp->mii_bus->read  = &dwceqos_mdio_read;
         lp->mii_bus->write = &dwceqos_mdio_write;
         lp->mii_bus->priv = lp;
-        lp->mii_bus->parent = &lp->ndev->dev;
+        lp->mii_bus->parent = &lp->pdev->dev;
 
         of_address_to_resource(lp->pdev->dev.of_node, 0, &res);
         snprintf(lp->mii_bus->id, MII_BUS_ID_SIZE, "%.8llx",
@@ -1622,13 +1622,7 @@ static void dwceqos_init_hw(struct net_local *lp)
                 DWCEQOS_MMC_CTRL_RSTONRD);
         dwceqos_enable_mmc_interrupt(lp);
 
-        /* Enable Interrupts */
-        dwceqos_write(lp, REG_DWCEQOS_DMA_CH0_IE,
-                      DWCEQOS_DMA_CH0_IE_NIE |
-                      DWCEQOS_DMA_CH0_IE_RIE | DWCEQOS_DMA_CH0_IE_TIE |
-                      DWCEQOS_DMA_CH0_IE_AIE |
-                      DWCEQOS_DMA_CH0_IE_FBEE);
-
+        dwceqos_write(lp, REG_DWCEQOS_DMA_CH0_IE, 0);
         dwceqos_write(lp, REG_DWCEQOS_MAC_IE, 0);
 
         dwceqos_write(lp, REG_DWCEQOS_MAC_CFG, DWCEQOS_MAC_CFG_IPC |
@@ -1905,6 +1899,15 @@ static int dwceqos_open(struct net_device *ndev)
         netif_start_queue(ndev);
         tasklet_enable(&lp->tx_bdreclaim_tasklet);
 
+        /* Enable Interrupts -- do this only after we enable NAPI and the
+         * tasklet.
+         */
+        dwceqos_write(lp, REG_DWCEQOS_DMA_CH0_IE,
+                      DWCEQOS_DMA_CH0_IE_NIE |
+                      DWCEQOS_DMA_CH0_IE_RIE | DWCEQOS_DMA_CH0_IE_TIE |
+                      DWCEQOS_DMA_CH0_IE_AIE |
+                      DWCEQOS_DMA_CH0_IE_FBEE);
+
         return 0;
 }
 
@@ -2850,25 +2853,17 @@ static int dwceqos_probe(struct platform_device *pdev)
 
         ndev->features = ndev->hw_features;
 
-        netif_napi_add(ndev, &lp->napi, dwceqos_rx_poll, NAPI_POLL_WEIGHT);
-
-        ret = register_netdev(ndev);
-        if (ret) {
-                dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
-                goto err_out_clk_dis_aper;
-        }
-
         lp->phy_ref_clk = devm_clk_get(&pdev->dev, "phy_ref_clk");
         if (IS_ERR(lp->phy_ref_clk)) {
                 dev_err(&pdev->dev, "phy_ref_clk clock not found.\n");
                 ret = PTR_ERR(lp->phy_ref_clk);
-                goto err_out_unregister_netdev;
+                goto err_out_clk_dis_aper;
         }
 
         ret = clk_prepare_enable(lp->phy_ref_clk);
         if (ret) {
                 dev_err(&pdev->dev, "Unable to enable device clock.\n");
-                goto err_out_unregister_netdev;
+                goto err_out_clk_dis_aper;
         }
 
         lp->phy_node = of_parse_phandle(lp->pdev->dev.of_node,
@@ -2877,7 +2872,7 @@ static int dwceqos_probe(struct platform_device *pdev)
                 ret = of_phy_register_fixed_link(lp->pdev->dev.of_node);
                 if (ret < 0) {
                         dev_err(&pdev->dev, "invalid fixed-link");
-                        goto err_out_unregister_clk_notifier;
+                        goto err_out_clk_dis_phy;
                 }
 
                 lp->phy_node = of_node_get(lp->pdev->dev.of_node);
@@ -2886,7 +2881,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = of_get_phy_mode(lp->pdev->dev.of_node);
         if (ret < 0) {
                 dev_err(&lp->pdev->dev, "error in getting phy i/f\n");
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         lp->phy_interface = ret;
@@ -2894,14 +2889,14 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = dwceqos_mii_init(lp);
         if (ret) {
                 dev_err(&lp->pdev->dev, "error in dwceqos_mii_init\n");
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         ret = dwceqos_mii_probe(ndev);
         if (ret != 0) {
                 netdev_err(ndev, "mii_probe fail.\n");
                 ret = -ENXIO;
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         dwceqos_set_umac_addr(lp, lp->ndev->dev_addr, 0);
@@ -2919,7 +2914,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&lp->pdev->dev, "Unable to retrieve DT, error %d\n",
                         ret);
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
         dev_info(&lp->pdev->dev, "pdev->id %d, baseaddr 0x%08lx, irq %d\n",
                  pdev->id, ndev->base_addr, ndev->irq);
@@ -2929,18 +2924,24 @@ static int dwceqos_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&lp->pdev->dev, "Unable to request IRQ %d, error %d\n",
                         ndev->irq, ret);
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         if (netif_msg_probe(lp))
                 netdev_dbg(ndev, "net_local@%p\n", lp);
 
+        netif_napi_add(ndev, &lp->napi, dwceqos_rx_poll, NAPI_POLL_WEIGHT);
+
+        ret = register_netdev(ndev);
+        if (ret) {
+                dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
+                        goto err_out_clk_dis_phy;
+        }
+
         return 0;
 
-err_out_unregister_clk_notifier:
+err_out_clk_dis_phy:
         clk_disable_unprepare(lp->phy_ref_clk);
-err_out_unregister_netdev:
-        unregister_netdev(ndev);
 err_out_clk_dis_aper:
         clk_disable_unprepare(lp->apb_pclk);
 err_out_free_netdev:
diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
index 7452b5f9d024..7108c68f16d3 100644
--- a/drivers/net/ethernet/tehuti/tehuti.c
+++ b/drivers/net/ethernet/tehuti/tehuti.c
@@ -1987,7 +1987,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if ((readl(nic->regs + FPGA_VER) & 0xFFF) >= 378) {
                 err = pci_enable_msi(pdev);
                 if (err)
-                        pr_err("Can't eneble msi. error is %d\n", err);
+                        pr_err("Can't enable msi. error is %d\n", err);
                 else
                         nic->irq_type = IRQ_MSI;
         } else
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 3cee84a24815..93dc10b10c09 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -1131,11 +1131,13 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
         lp->rx_ping_pong = get_bool(ofdev, "xlnx,rx-ping-pong");
         mac_address = of_get_mac_address(ofdev->dev.of_node);
 
-        if (mac_address)
+        if (mac_address) {
                 /* Set the MAC address. */
                 memcpy(ndev->dev_addr, mac_address, ETH_ALEN);
-        else
-                dev_warn(dev, "No MAC address found\n");
+        } else {
+                dev_warn(dev, "No MAC address found, using random\n");
+                eth_hw_addr_random(ndev);
+        }
 
         /* Clear the Tx CSR's in case this is a restart */
         __raw_writel(0, lp->base_addr + XEL_TSR_OFFSET);
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 47a64342cc16..b4863e4e522b 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -303,6 +303,7 @@ config MDIO_HISI_FEMAC
 
 config MDIO_XGENE
         tristate "APM X-Gene SoC MDIO bus controller"
+        depends on ARCH_XGENE || COMPILE_TEST
         help
           This module provides a driver for the MDIO busses found in the
           APM X-Gene SoC's.
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 053e87905b94..885ac9cbab5a 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -964,7 +964,7 @@ static struct phy_driver ksphy_driver[] = {
         .get_strings    = kszphy_get_strings,
         .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
-        .resume         = genphy_resume,
+        .resume         = kszphy_resume,
 }, {
         .phy_id         = PHY_ID_KSZ8873MLL,
         .phy_id_mask    = MICREL_PHY_ID_MASK,
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index c5dc2c363f96..c6f66832a1a6 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -722,8 +722,10 @@ phy_err:
 int phy_start_interrupts(struct phy_device *phydev)
 {
         atomic_set(&phydev->irq_disable, 0);
-        if (request_irq(phydev->irq, phy_interrupt, 0, "phy_interrupt",
-                        phydev) < 0) {
+        if (request_irq(phydev->irq, phy_interrupt,
+                                IRQF_SHARED,
+                                "phy_interrupt",
+                                phydev) < 0) {
                 pr_warn("%s: Can't get IRQ %d (PHY)\n",
                         phydev->mdio.bus->name, phydev->irq);
                 phydev->irq = PHY_POLL;
diff --git a/drivers/net/team/team_mode_loadbalance.c b/drivers/net/team/team_mode_loadbalance.c
index cdb19b385d42..b228bea7931f 100644
--- a/drivers/net/team/team_mode_loadbalance.c
+++ b/drivers/net/team/team_mode_loadbalance.c
@@ -14,9 +14,23 @@
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/filter.h>
 #include <linux/if_team.h>
 
+static rx_handler_result_t lb_receive(struct team *team, struct team_port *port,
+                                      struct sk_buff *skb)
+{
+        if (unlikely(skb->protocol == htons(ETH_P_SLOW))) {
+                /* LACPDU packets should go to exact delivery */
+                const unsigned char *dest = eth_hdr(skb)->h_dest;
+
+                if (is_link_local_ether_addr(dest) && dest[5] == 0x02)
+                        return RX_HANDLER_EXACT;
+        }
+        return RX_HANDLER_ANOTHER;
+}
+
 struct lb_priv;
 
 typedef struct team_port *lb_select_tx_port_func_t(struct team *,
@@ -652,6 +666,7 @@ static const struct team_mode_ops lb_mode_ops = {
         .port_enter             = lb_port_enter,
         .port_leave             = lb_port_leave,
         .port_disabled          = lb_port_disabled,
+        .receive                = lb_receive,
         .transmit               = lb_transmit,
 };
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 9c8b5bc2b9d8..6f9df375c5d4 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -894,11 +894,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
         if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
                 goto drop;
 
-        if (skb->sk && sk_fullsock(skb->sk)) {
-                sock_tx_timestamp(skb->sk, skb->sk->sk_tsflags,
-                                  &skb_shinfo(skb)->tx_flags);
-                sw_tx_timestamp(skb);
-        }
+        skb_tx_timestamp(skb);
 
         /* Orphan the skb - required as we might hang on to it
          * for indefinite time.
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 770212baaf05..528b9c9c4e60 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -1009,6 +1009,7 @@ static int kaweth_probe(
         struct net_device *netdev;
         const eth_addr_t bcast_addr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
         int result = 0;
+        int rv = -EIO;
 
         dev_dbg(dev,
                 "Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n",
@@ -1029,6 +1030,7 @@ static int kaweth_probe(
         kaweth = netdev_priv(netdev);
         kaweth->dev = udev;
         kaweth->net = netdev;
+        kaweth->intf = intf;
 
         spin_lock_init(&kaweth->device_lock);
         init_waitqueue_head(&kaweth->term_wait);
@@ -1048,6 +1050,10 @@ static int kaweth_probe(
                 /* Download the firmware */
                 dev_info(dev, "Downloading firmware...\n");
                 kaweth->firmware_buf = (__u8 *)__get_free_page(GFP_KERNEL);
+                if (!kaweth->firmware_buf) {
+                        rv = -ENOMEM;
+                        goto err_free_netdev;
+                }
                 if ((result = kaweth_download_firmware(kaweth,
                                                       "kaweth/new_code.bin",
                                                       100,
@@ -1139,8 +1145,6 @@ err_fw:
 
         dev_dbg(dev, "Initializing net device.\n");
 
-        kaweth->intf = intf;
-
         kaweth->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!kaweth->tx_urb)
                 goto err_free_netdev;
@@ -1204,7 +1208,7 @@ err_only_tx:
 err_free_netdev:
         free_netdev(netdev);
 
-        return -EIO;
+        return rv;
 }
 
 /****************************************************************
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index c68fe495d3f9..4244b9d4418e 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -914,7 +914,9 @@ vmxnet3_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
 {
         struct Vmxnet3_TxDataDesc *tdd;
 
-        tdd = tq->data_ring.base + tq->tx_ring.next2fill;
+        tdd = (struct Vmxnet3_TxDataDesc *)((u8 *)tq->data_ring.base +
+                                            tq->tx_ring.next2fill *
+                                            tq->txdata_desc_size);
 
         memcpy(tdd->data, skb->data, ctx->copy_size);
         netdev_dbg(adapter->netdev,
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 74fc03072b87..7dc37a090549 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.9.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.a.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040900
+#define VMXNET3_DRIVER_VERSION_NUM      0x01040a00
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index c0dda6fc0921..6e65832051d6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2782,14 +2782,15 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
         struct net_device *lowerdev = NULL;
 
         if (conf->flags & VXLAN_F_GPE) {
-                if (conf->flags & ~VXLAN_F_ALLOWED_GPE)
-                        return -EINVAL;
                 /* For now, allow GPE only together with COLLECT_METADATA.
                  * This can be relaxed later; in such case, the other side
                  * of the PtP link will have to be provided.
                  */
-                if (!(conf->flags & VXLAN_F_COLLECT_METADATA))
+                if ((conf->flags & ~VXLAN_F_ALLOWED_GPE) ||
+                    !(conf->flags & VXLAN_F_COLLECT_METADATA)) {
+                        pr_info("unsupported combination of extensions\n");
                         return -EINVAL;
+                }
 
                 vxlan_raw_setup(dev);
         } else {
@@ -2842,6 +2843,9 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
                         dev->mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
 
                 needed_headroom = lowerdev->hard_header_len;
+        } else if (vxlan_addr_multicast(&dst->remote_ip)) {
+                pr_info("multicast destination requires interface to be specified\n");
+                return -EINVAL;
         }
 
         if (conf->mtu) {
@@ -2874,8 +2878,10 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
                      tmp->cfg.saddr.sa.sa_family == AF_INET6) == use_ipv6 &&
                     tmp->cfg.dst_port == vxlan->cfg.dst_port &&
                     (tmp->flags & VXLAN_F_RCV_FLAGS) ==
-                    (vxlan->flags & VXLAN_F_RCV_FLAGS))
-                return -EEXIST;
+                    (vxlan->flags & VXLAN_F_RCV_FLAGS)) {
+                        pr_info("duplicate VNI %u\n", be32_to_cpu(conf->vni));
+                        return -EEXIST;
+                }
         }
 
         dev->ethtool_ops = &vxlan_ethtool_ops;
@@ -2909,7 +2915,6 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
                          struct nlattr *tb[], struct nlattr *data[])
 {
         struct vxlan_config conf;
-        int err;
 
         memset(&conf, 0, sizeof(conf));
 
@@ -3018,26 +3023,7 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
         if (tb[IFLA_MTU])
                 conf.mtu = nla_get_u32(tb[IFLA_MTU]);
 
-        err = vxlan_dev_configure(src_net, dev, &conf);
-        switch (err) {
-        case -ENODEV:
-                pr_info("ifindex %d does not exist\n", conf.remote_ifindex);
-                break;
-
-        case -EPERM:
-                pr_info("IPv6 is disabled via sysctl\n");
-                break;
-
-        case -EEXIST:
-                pr_info("duplicate VNI %u\n", be32_to_cpu(conf.vni));
-                break;
-
-        case -EINVAL:
-                pr_info("unsupported combination of extensions\n");
-                break;
-        }
-
-        return err;
+        return vxlan_dev_configure(src_net, dev, &conf);
 }
 
 static void vxlan_dellink(struct net_device *dev, struct list_head *head)
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 78db5d679f19..24c8d65bcf34 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -1525,7 +1525,7 @@ static void ath10k_htt_rx_h_filter(struct ath10k *ar,
 static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
 {
         struct ath10k *ar = htt->ar;
-        static struct ieee80211_rx_status rx_status;
+        struct ieee80211_rx_status *rx_status = &htt->rx_status;
         struct sk_buff_head amsdu;
         int ret;
 
@@ -1549,11 +1549,11 @@ static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
                 return ret;
         }
 
-        ath10k_htt_rx_h_ppdu(ar, &amsdu, &rx_status, 0xffff);
+        ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff);
         ath10k_htt_rx_h_unchain(ar, &amsdu, ret > 0);
-        ath10k_htt_rx_h_filter(ar, &amsdu, &rx_status);
-        ath10k_htt_rx_h_mpdu(ar, &amsdu, &rx_status);
-        ath10k_htt_rx_h_deliver(ar, &amsdu, &rx_status);
+        ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
+        ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
+        ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 9a22c478dd1b..07933c51a850 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -3162,7 +3162,6 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 pci_hard_reset = ath10k_pci_qca988x_chip_reset;
                 break;
         case QCA9887_1_0_DEVICE_ID:
-                dev_warn(&pdev->dev, "QCA9887 support is still experimental, there are likely bugs. You have been warned.\n");
                 hw_rev = ATH10K_HW_QCA9887;
                 pci_ps = false;
                 pci_soft_reset = ath10k_pci_warm_reset;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index d1d0c06d627c..14b13f07cd1f 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2482,6 +2482,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 return -EINVAL;
         }
 
+        ath9k_gpio_cap_init(ah);
+
         if (AR_SREV_9485(ah) ||
             AR_SREV_9285(ah) ||
             AR_SREV_9330(ah) ||
@@ -2531,8 +2533,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         else
                 pCap->hw_caps &= ~ATH9K_HW_CAP_HT;
 
-        ath9k_gpio_cap_init(ah);
-
         if (AR_SREV_9160_10_OR_LATER(ah) || AR_SREV_9100(ah))
                 pCap->rts_aggr_limit = ATH_AMPDU_LIMIT_MAX;
         else
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index a394622c9022..7cb65c303f8d 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -718,9 +718,12 @@ static int ath9k_start(struct ieee80211_hw *hw)
         if (!ath_complete_reset(sc, false))
                 ah->reset_power_on = false;
 
-        if (ah->led_pin >= 0)
+        if (ah->led_pin >= 0) {
                 ath9k_hw_set_gpio(ah, ah->led_pin,
                                   (ah->config.led_active_high) ? 1 : 0);
+                ath9k_hw_gpio_request_out(ah, ah->led_pin, NULL,
+                                          AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+        }
 
         /*
          * Reset key cache to sane defaults (all entries cleared) instead of
@@ -864,9 +867,11 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         spin_lock_bh(&sc->sc_pcu_lock);
 
-        if (ah->led_pin >= 0)
+        if (ah->led_pin >= 0) {
                 ath9k_hw_set_gpio(ah, ah->led_pin,
                                   (ah->config.led_active_high) ? 0 : 1);
+                ath9k_hw_gpio_request_in(ah, ah->led_pin, NULL);
+        }
 
         ath_prepare_reset(sc);
 
@@ -1154,6 +1159,7 @@ void ath9k_calculate_summary_state(struct ath_softc *sc,
                 bool changed = (iter_data.primary_sta != ctx->primary_sta);
 
                 if (iter_data.primary_sta) {
+                        iter_data.primary_beacon_vif = iter_data.primary_sta;
                         iter_data.beacons = true;
                         ath9k_set_assoc_state(sc, iter_data.primary_sta,
                                               changed);
@@ -1563,13 +1569,13 @@ static int ath9k_sta_state(struct ieee80211_hw *hw,
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         int ret = 0;
 
-        if (old_state == IEEE80211_STA_AUTH &&
-            new_state == IEEE80211_STA_ASSOC) {
+        if (old_state == IEEE80211_STA_NOTEXIST &&
+            new_state == IEEE80211_STA_NONE) {
                 ret = ath9k_sta_add(hw, vif, sta);
                 ath_dbg(common, CONFIG,
                         "Add station: %pM\n", sta->addr);
-        } else if (old_state == IEEE80211_STA_ASSOC &&
-                   new_state == IEEE80211_STA_AUTH) {
+        } else if (old_state == IEEE80211_STA_NONE &&
+                   new_state == IEEE80211_STA_NOTEXIST) {
                 ret = ath9k_sta_remove(hw, vif, sta);
                 ath_dbg(common, CONFIG,
                         "Remove station: %pM\n", sta->addr);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 2628d5e12c64..b8aec5e5ef93 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -4527,7 +4527,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                                 (u8 *)&settings->beacon.head[ie_offset],
                                 settings->beacon.head_len - ie_offset,
                                 WLAN_EID_SSID);
-                if (!ssid_ie)
+                if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
                         return -EINVAL;
 
                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
@@ -5635,7 +5635,7 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
                   ifevent->action, ifevent->flags, ifevent->ifidx,
                   ifevent->bsscfgidx);
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         event->action = ifevent->action;
         vif = event->vif;
 
@@ -5643,7 +5643,7 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
         case BRCMF_E_IF_ADD:
                 /* waiting process may have timed out */
                 if (!cfg->vif_event.vif) {
-                        mutex_unlock(&event->vif_event_lock);
+                        spin_unlock(&event->vif_event_lock);
                         return -EBADF;
                 }
 
@@ -5654,24 +5654,24 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
                         ifp->ndev->ieee80211_ptr = &vif->wdev;
                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
                 }
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 wake_up(&event->vif_wq);
                 return 0;
 
         case BRCMF_E_IF_DEL:
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 /* event may not be upon user request */
                 if (brcmf_cfg80211_vif_event_armed(cfg))
                         wake_up(&event->vif_wq);
                 return 0;
 
         case BRCMF_E_IF_CHANGE:
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 wake_up(&event->vif_wq);
                 return 0;
 
         default:
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 break;
         }
         return -EINVAL;
@@ -5792,7 +5792,7 @@ static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
 {
         init_waitqueue_head(&event->vif_wq);
-        mutex_init(&event->vif_event_lock);
+        spin_lock_init(&event->vif_event_lock);
 }
 
 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
@@ -6691,9 +6691,9 @@ static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
 {
         u8 evt_action;
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         evt_action = event->action;
-        mutex_unlock(&event->vif_event_lock);
+        spin_unlock(&event->vif_event_lock);
         return evt_action == action;
 }
 
@@ -6702,10 +6702,10 @@ void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
 {
         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         event->vif = vif;
         event->action = 0;
-        mutex_unlock(&event->vif_event_lock);
+        spin_unlock(&event->vif_event_lock);
 }
 
 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
@@ -6713,9 +6713,9 @@ bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
         bool armed;
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         armed = event->vif != NULL;
-        mutex_unlock(&event->vif_event_lock);
+        spin_unlock(&event->vif_event_lock);
 
         return armed;
 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
index 7d77f869b7f1..8889832c17e0 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
@@ -227,7 +227,7 @@ struct escan_info {
  */
 struct brcmf_cfg80211_vif_event {
         wait_queue_head_t vif_wq;
-        struct mutex vif_event_lock;
+        spinlock_t vif_event_lock;
         u8 action;
         struct brcmf_cfg80211_vif *vif;
 };
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 8d16f0204985..65e8c8766441 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -743,7 +743,7 @@ static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx,
                  * serious troublesome side effects. The p2p module will clean
                  * up the ifp if needed.
                  */
-                brcmf_p2p_ifp_removed(ifp);
+                brcmf_p2p_ifp_removed(ifp, rtnl_locked);
                 kfree(ifp);
         }
 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 66f942f7448e..de19c7c92bc6 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -2297,7 +2297,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
         return err;
 }
 
-void brcmf_p2p_ifp_removed(struct brcmf_if *ifp)
+void brcmf_p2p_ifp_removed(struct brcmf_if *ifp, bool rtnl_locked)
 {
         struct brcmf_cfg80211_info *cfg;
         struct brcmf_cfg80211_vif *vif;
@@ -2306,9 +2306,11 @@ void brcmf_p2p_ifp_removed(struct brcmf_if *ifp)
         vif = ifp->vif;
         cfg = wdev_to_cfg(&vif->wdev);
         cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
-        rtnl_lock();
+        if (!rtnl_locked)
+                rtnl_lock();
         cfg80211_unregister_wdev(&vif->wdev);
-        rtnl_unlock();
+        if (!rtnl_locked)
+                rtnl_unlock();
         brcmf_free_vif(vif);
 }
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
index a3bd18c2360b..8ce9447533ef 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
@@ -155,7 +155,7 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
 int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev);
 int brcmf_p2p_ifchange(struct brcmf_cfg80211_info *cfg,
                        enum brcmf_fil_p2p_if_types if_type);
-void brcmf_p2p_ifp_removed(struct brcmf_if *ifp);
+void brcmf_p2p_ifp_removed(struct brcmf_if *ifp, bool rtnl_locked);
 int brcmf_p2p_start_device(struct wiphy *wiphy, struct wireless_dev *wdev);
 void brcmf_p2p_stop_device(struct wiphy *wiphy, struct wireless_dev *wdev);
 int brcmf_p2p_scan_prep(struct wiphy *wiphy,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
index 1abcabb9b6cd..46b52bf705fb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
@@ -960,5 +960,6 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
         }
 
         mvm->fw_dbg_conf = conf_id;
-        return ret;
+
+        return 0;
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h
index f7dff7612c9c..e9f1be9da7d4 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h
@@ -105,7 +105,8 @@ iwl_fw_dbg_trigger_vif_match(struct iwl_fw_dbg_trigger_tlv *trig,
 {
         u32 trig_vif = le32_to_cpu(trig->vif_type);
 
-        return trig_vif == IWL_FW_DBG_CONF_VIF_ANY || vif->type == trig_vif;
+        return trig_vif == IWL_FW_DBG_CONF_VIF_ANY ||
+               ieee80211_vif_type_p2p(vif) == trig_vif;
 }
 
 static inline bool
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 6d6064534d59..5dd77e336617 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -624,6 +624,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
                                NL80211_FEATURE_LOW_PRIORITY_SCAN |
                                NL80211_FEATURE_P2P_GO_OPPPS |
+                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
                                NL80211_FEATURE_DYNAMIC_SMPS |
                                NL80211_FEATURE_STATIC_SMPS |
                                NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index b4fc86d5d7ef..6a615bb73042 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -467,6 +467,8 @@ struct iwl_mvm_vif {
 static inline struct iwl_mvm_vif *
 iwl_mvm_vif_from_mac80211(struct ieee80211_vif *vif)
 {
+        if (!vif)
+                return NULL;
         return (void *)vif->drv_priv;
 }
 
diff --git a/drivers/net/wireless/marvell/mwifiex/11n_aggr.c b/drivers/net/wireless/marvell/mwifiex/11n_aggr.c
index dc49c3de1f25..c47d6366875d 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_aggr.c
@@ -205,7 +205,8 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
 
         do {
                 /* Check if AMSDU can accommodate this MSDU */
-                if (skb_tailroom(skb_aggr) < (skb_src->len + LLC_SNAP_LEN))
+                if ((skb_aggr->len + skb_src->len + LLC_SNAP_LEN) >
+                    adapter->tx_buf_size)
                         break;
 
                 skb_src = skb_dequeue(&pra_list->skb_head);
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 458daf927336..935866fe5ec2 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -185,8 +185,12 @@ long nvdimm_clear_poison(struct device *dev, phys_addr_t phys,
                 return -ENXIO;
 
         nd_desc = nvdimm_bus->nd_desc;
+        /*
+         * if ndctl does not exist, it's PMEM_LEGACY and
+         * we want to just pretend everything is handled.
+         */
         if (!nd_desc->ndctl)
-                return -ENXIO;
+                return len;
 
         memset(&ars_cap, 0, sizeof(ars_cap));
         ars_cap.address = phys;
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index db39d53cdfb9..f7d37a62f874 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -30,8 +30,8 @@ config NVME_FABRICS
 
 config NVME_RDMA
         tristate "NVM Express over Fabrics RDMA host driver"
-        depends on INFINIBAND
-        depends on BLK_DEV_NVME
+        depends on INFINIBAND && BLOCK
+        select NVME_CORE
         select NVME_FABRICS
         select SG_POOL
         help
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 7ff2e820bbf4..2feacc70bf61 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -81,10 +81,12 @@ EXPORT_SYMBOL_GPL(nvme_cancel_request);
 bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                 enum nvme_ctrl_state new_state)
 {
-        enum nvme_ctrl_state old_state = ctrl->state;
+        enum nvme_ctrl_state old_state;
         bool changed = false;
 
         spin_lock_irq(&ctrl->lock);
+
+        old_state = ctrl->state;
         switch (new_state) {
         case NVME_CTRL_LIVE:
                 switch (old_state) {
@@ -140,11 +142,12 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
         default:
                 break;
         }
-        spin_unlock_irq(&ctrl->lock);
 
         if (changed)
                 ctrl->state = new_state;
 
+        spin_unlock_irq(&ctrl->lock);
+
         return changed;
 }
 EXPORT_SYMBOL_GPL(nvme_change_ctrl_state);
@@ -608,7 +611,7 @@ int nvme_get_features(struct nvme_ctrl *dev, unsigned fid, unsigned nsid,
 
         ret = __nvme_submit_sync_cmd(dev->admin_q, &c, &cqe, NULL, 0, 0,
                         NVME_QID_ANY, 0, 0);
-        if (ret >= 0)
+        if (ret >= 0 && result)
                 *result = le32_to_cpu(cqe.result);
         return ret;
 }
@@ -628,7 +631,7 @@ int nvme_set_features(struct nvme_ctrl *dev, unsigned fid, unsigned dword11,
 
         ret = __nvme_submit_sync_cmd(dev->admin_q, &c, &cqe, NULL, 0, 0,
                         NVME_QID_ANY, 0, 0);
-        if (ret >= 0)
+        if (ret >= 0 && result)
                 *result = le32_to_cpu(cqe.result);
         return ret;
 }
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index dc996761042f..4eff49174466 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -47,8 +47,10 @@ static struct nvmf_host *nvmf_host_add(const char *hostnqn)
 
         mutex_lock(&nvmf_hosts_mutex);
         host = __nvmf_host_find(hostnqn);
-        if (host)
+        if (host) {
+                kref_get(&host->ref);
                 goto out_unlock;
+        }
 
         host = kmalloc(sizeof(*host), GFP_KERNEL);
         if (!host)
@@ -56,7 +58,7 @@ static struct nvmf_host *nvmf_host_add(const char *hostnqn)
 
         kref_init(&host->ref);
         memcpy(host->nqn, hostnqn, NVMF_NQN_SIZE);
-        uuid_le_gen(&host->id);
+        uuid_be_gen(&host->id);
 
         list_add_tail(&host->list, &nvmf_hosts);
 out_unlock:
@@ -73,9 +75,9 @@ static struct nvmf_host *nvmf_host_default(void)
                 return NULL;
 
         kref_init(&host->ref);
-        uuid_le_gen(&host->id);
+        uuid_be_gen(&host->id);
         snprintf(host->nqn, NVMF_NQN_SIZE,
-                "nqn.2014-08.org.nvmexpress:NVMf:uuid:%pUl", &host->id);
+                "nqn.2014-08.org.nvmexpress:NVMf:uuid:%pUb", &host->id);
 
         mutex_lock(&nvmf_hosts_mutex);
         list_add_tail(&host->list, &nvmf_hosts);
@@ -363,7 +365,14 @@ int nvmf_connect_admin_queue(struct nvme_ctrl *ctrl)
         cmd.connect.opcode = nvme_fabrics_command;
         cmd.connect.fctype = nvme_fabrics_type_connect;
         cmd.connect.qid = 0;
-        cmd.connect.sqsize = cpu_to_le16(ctrl->sqsize);
+
+        /*
+         * fabrics spec sets a minimum of depth 32 for admin queue,
+         * so set the queue with this depth always until
+         * justification otherwise.
+         */
+        cmd.connect.sqsize = cpu_to_le16(NVMF_AQ_DEPTH - 1);
+
         /*
          * Set keep-alive timeout in seconds granularity (ms * 1000)
          * and add a grace period for controller kato enforcement
@@ -375,7 +384,7 @@ int nvmf_connect_admin_queue(struct nvme_ctrl *ctrl)
         if (!data)
                 return -ENOMEM;
 
-        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_le));
+        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_be));
         data->cntlid = cpu_to_le16(0xffff);
         strncpy(data->subsysnqn, ctrl->opts->subsysnqn, NVMF_NQN_SIZE);
         strncpy(data->hostnqn, ctrl->opts->host->nqn, NVMF_NQN_SIZE);
@@ -434,7 +443,7 @@ int nvmf_connect_io_queue(struct nvme_ctrl *ctrl, u16 qid)
         if (!data)
                 return -ENOMEM;
 
-        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_le));
+        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_be));
         data->cntlid = cpu_to_le16(ctrl->cntlid);
         strncpy(data->subsysnqn, ctrl->opts->subsysnqn, NVMF_NQN_SIZE);
         strncpy(data->hostnqn, ctrl->opts->host->nqn, NVMF_NQN_SIZE);
diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
index 89df52c8be97..46e460aee52d 100644
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -34,7 +34,7 @@ struct nvmf_host {
         struct kref             ref;
         struct list_head        list;
         char                    nqn[NVMF_NQN_SIZE];
-        uuid_le                 id;
+        uuid_be                 id;
 };
 
 /**
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 8d2875b4c56d..ab545fb347a0 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -43,10 +43,6 @@
 
 #define NVME_RDMA_MAX_INLINE_SEGMENTS   1
 
-#define NVME_RDMA_MAX_PAGES_PER_MR      512
-
-#define NVME_RDMA_DEF_RECONNECT_DELAY   20
-
 /*
  * We handle AEN commands ourselves and don't even let the
  * block layer know about them.
@@ -77,7 +73,6 @@ struct nvme_rdma_request {
         u32                     num_sge;
         int                     nents;
         bool                    inline_data;
-        bool                    need_inval;
         struct ib_reg_wr        reg_wr;
         struct ib_cqe           reg_cqe;
         struct nvme_rdma_queue  *queue;
@@ -286,7 +281,7 @@ static int nvme_rdma_reinit_request(void *data, struct request *rq)
         struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq);
         int ret = 0;
 
-        if (!req->need_inval)
+        if (!req->mr->need_inval)
                 goto out;
 
         ib_dereg_mr(req->mr);
@@ -298,7 +293,7 @@ static int nvme_rdma_reinit_request(void *data, struct request *rq)
                 req->mr = NULL;
         }
 
-        req->need_inval = false;
+        req->mr->need_inval = false;
 
 out:
         return ret;
@@ -645,7 +640,8 @@ static int nvme_rdma_init_io_queues(struct nvme_rdma_ctrl *ctrl)
         int i, ret;
 
         for (i = 1; i < ctrl->queue_count; i++) {
-                ret = nvme_rdma_init_queue(ctrl, i, ctrl->ctrl.sqsize);
+                ret = nvme_rdma_init_queue(ctrl, i,
+                                           ctrl->ctrl.opts->queue_size);
                 if (ret) {
                         dev_info(ctrl->ctrl.device,
                                 "failed to initialize i/o queue: %d\n", ret);
@@ -849,7 +845,7 @@ static void nvme_rdma_unmap_data(struct nvme_rdma_queue *queue,
         if (!blk_rq_bytes(rq))
                 return;
 
-        if (req->need_inval) {
+        if (req->mr->need_inval) {
                 res = nvme_rdma_inv_rkey(queue, req);
                 if (res < 0) {
                         dev_err(ctrl->ctrl.device,
@@ -935,7 +931,7 @@ static int nvme_rdma_map_sg_fr(struct nvme_rdma_queue *queue,
                              IB_ACCESS_REMOTE_READ |
                              IB_ACCESS_REMOTE_WRITE;
 
-        req->need_inval = true;
+        req->mr->need_inval = true;
 
         sg->addr = cpu_to_le64(req->mr->iova);
         put_unaligned_le24(req->mr->length, sg->length);
@@ -958,7 +954,7 @@ static int nvme_rdma_map_data(struct nvme_rdma_queue *queue,
 
         req->num_sge = 1;
         req->inline_data = false;
-        req->need_inval = false;
+        req->mr->need_inval = false;
 
         c->common.flags |= NVME_CMD_SGL_METABUF;
 
@@ -1145,7 +1141,7 @@ static int nvme_rdma_process_nvme_rsp(struct nvme_rdma_queue *queue,
 
         if ((wc->wc_flags & IB_WC_WITH_INVALIDATE) &&
             wc->ex.invalidate_rkey == req->mr->rkey)
-                req->need_inval = false;
+                req->mr->need_inval = false;
 
         blk_mq_complete_request(rq, status);
 
@@ -1278,8 +1274,22 @@ static int nvme_rdma_route_resolved(struct nvme_rdma_queue *queue)
 
         priv.recfmt = cpu_to_le16(NVME_RDMA_CM_FMT_1_0);
         priv.qid = cpu_to_le16(nvme_rdma_queue_idx(queue));
-        priv.hrqsize = cpu_to_le16(queue->queue_size);
-        priv.hsqsize = cpu_to_le16(queue->queue_size);
+        /*
+         * set the admin queue depth to the minimum size
+         * specified by the Fabrics standard.
+         */
+        if (priv.qid == 0) {
+                priv.hrqsize = cpu_to_le16(NVMF_AQ_DEPTH);
+                priv.hsqsize = cpu_to_le16(NVMF_AQ_DEPTH - 1);
+        } else {
+                /*
+                 * current interpretation of the fabrics spec
+                 * is at minimum you make hrqsize sqsize+1, or a
+                 * 1's based representation of sqsize.
+                 */
+                priv.hrqsize = cpu_to_le16(queue->queue_size);
+                priv.hsqsize = cpu_to_le16(queue->ctrl->ctrl.sqsize);
+        }
 
         ret = rdma_connect(queue->cm_id, &param);
         if (ret) {
@@ -1319,7 +1329,7 @@ out_destroy_queue_ib:
 static int nvme_rdma_device_unplug(struct nvme_rdma_queue *queue)
 {
         struct nvme_rdma_ctrl *ctrl = queue->ctrl;
-        int ret;
+        int ret = 0;
 
         /* Own the controller deletion */
         if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING))
@@ -1461,7 +1471,7 @@ static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
         if (rq->cmd_type == REQ_TYPE_FS && req_op(rq) == REQ_OP_FLUSH)
                 flush = true;
         ret = nvme_rdma_post_send(queue, sqe, req->sge, req->num_sge,
-                        req->need_inval ? &req->reg_wr.wr : NULL, flush);
+                        req->mr->need_inval ? &req->reg_wr.wr : NULL, flush);
         if (ret) {
                 nvme_rdma_unmap_data(queue, rq);
                 goto err;
@@ -1816,7 +1826,7 @@ static int nvme_rdma_create_io_queues(struct nvme_rdma_ctrl *ctrl)
 
         memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
         ctrl->tag_set.ops = &nvme_rdma_mq_ops;
-        ctrl->tag_set.queue_depth = ctrl->ctrl.sqsize;
+        ctrl->tag_set.queue_depth = ctrl->ctrl.opts->queue_size;
         ctrl->tag_set.reserved_tags = 1; /* fabric connect */
         ctrl->tag_set.numa_node = NUMA_NO_NODE;
         ctrl->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
@@ -1914,7 +1924,7 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
         spin_lock_init(&ctrl->lock);
 
         ctrl->queue_count = opts->nr_io_queues + 1; /* +1 for admin queue */
-        ctrl->ctrl.sqsize = opts->queue_size;
+        ctrl->ctrl.sqsize = opts->queue_size - 1;
         ctrl->ctrl.kato = opts->kato;
 
         ret = -ENOMEM;
diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig
index a5c31cbeb481..3a5b9d0576cb 100644
--- a/drivers/nvme/target/Kconfig
+++ b/drivers/nvme/target/Kconfig
@@ -15,8 +15,8 @@ config NVME_TARGET
 
 config NVME_TARGET_LOOP
         tristate "NVMe loopback device support"
-        depends on BLK_DEV_NVME
         depends on NVME_TARGET
+        select NVME_CORE
         select NVME_FABRICS
         select SG_POOL
         help
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index 7affd40a6b33..395e60dad835 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -556,7 +556,7 @@ static int nvme_loop_create_io_queues(struct nvme_loop_ctrl *ctrl)
 
         memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
         ctrl->tag_set.ops = &nvme_loop_mq_ops;
-        ctrl->tag_set.queue_depth = ctrl->ctrl.sqsize;
+        ctrl->tag_set.queue_depth = ctrl->ctrl.opts->queue_size;
         ctrl->tag_set.reserved_tags = 1; /* fabric connect */
         ctrl->tag_set.numa_node = NUMA_NO_NODE;
         ctrl->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
@@ -620,7 +620,7 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev,
 
         ret = -ENOMEM;
 
-        ctrl->ctrl.sqsize = opts->queue_size;
+        ctrl->ctrl.sqsize = opts->queue_size - 1;
         ctrl->ctrl.kato = opts->kato;
 
         ctrl->queues = kcalloc(opts->nr_io_queues + 1, sizeof(*ctrl->queues),
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index b4d648536c3e..1cbe6e053b5b 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -978,10 +978,11 @@ static void nvmet_rdma_release_queue_work(struct work_struct *w)
                 container_of(w, struct nvmet_rdma_queue, release_work);
         struct rdma_cm_id *cm_id = queue->cm_id;
         struct nvmet_rdma_device *dev = queue->dev;
+        enum nvmet_rdma_queue_state state = queue->state;
 
         nvmet_rdma_free_queue(queue);
 
-        if (queue->state != NVMET_RDMA_IN_DEVICE_REMOVAL)
+        if (state != NVMET_RDMA_IN_DEVICE_REMOVAL)
                 rdma_destroy_id(cm_id);
 
         kref_put(&dev->ref, nvmet_rdma_free_dev);
@@ -1003,10 +1004,10 @@ nvmet_rdma_parse_cm_connect_req(struct rdma_conn_param *conn,
         queue->host_qid = le16_to_cpu(req->qid);
 
         /*
-         * req->hsqsize corresponds to our recv queue size
+         * req->hsqsize corresponds to our recv queue size plus 1
          * req->hrqsize corresponds to our send queue size
          */
-        queue->recv_queue_size = le16_to_cpu(req->hsqsize);
+        queue->recv_queue_size = le16_to_cpu(req->hsqsize) + 1;
         queue->send_queue_size = le16_to_cpu(req->hrqsize);
 
         if (!queue->host_qid && queue->recv_queue_size > NVMF_AQ_DEPTH)
diff --git a/drivers/pci/host-bridge.c b/drivers/pci/host-bridge.c
index 5f4a2e04c8d7..add66236215c 100644
--- a/drivers/pci/host-bridge.c
+++ b/drivers/pci/host-bridge.c
@@ -44,6 +44,7 @@ void pci_set_host_bridge_release(struct pci_host_bridge *bridge,
         bridge->release_fn = release_fn;
         bridge->release_data = release_data;
 }
+EXPORT_SYMBOL_GPL(pci_set_host_bridge_release);
 
 void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region,
                              struct resource *res)
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index eafa6138a6b8..98f12223c734 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -1069,7 +1069,7 @@ static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
                 nvec = maxvec;
 
         for (;;) {
-                if (!(flags & PCI_IRQ_NOAFFINITY)) {
+                if (flags & PCI_IRQ_AFFINITY) {
                         dev->irq_affinity = irq_create_affinity_mask(&nvec);
                         if (nvec < minvec)
                                 return -ENOSPC;
@@ -1105,7 +1105,7 @@ static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
  **/
 int pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec)
 {
-        return __pci_enable_msi_range(dev, minvec, maxvec, PCI_IRQ_NOAFFINITY);
+        return __pci_enable_msi_range(dev, minvec, maxvec, 0);
 }
 EXPORT_SYMBOL(pci_enable_msi_range);
 
@@ -1120,7 +1120,7 @@ static int __pci_enable_msix_range(struct pci_dev *dev,
                 return -ERANGE;
 
         for (;;) {
-                if (!(flags & PCI_IRQ_NOAFFINITY)) {
+                if (flags & PCI_IRQ_AFFINITY) {
                         dev->irq_affinity = irq_create_affinity_mask(&nvec);
                         if (nvec < minvec)
                                 return -ENOSPC;
@@ -1160,8 +1160,7 @@ static int __pci_enable_msix_range(struct pci_dev *dev,
 int pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries,
                 int minvec, int maxvec)
 {
-        return __pci_enable_msix_range(dev, entries, minvec, maxvec,
-                        PCI_IRQ_NOAFFINITY);
+        return __pci_enable_msix_range(dev, entries, minvec, maxvec, 0);
 }
 EXPORT_SYMBOL(pci_enable_msix_range);
 
@@ -1187,22 +1186,25 @@ int pci_alloc_irq_vectors(struct pci_dev *dev, unsigned int min_vecs,
 {
         int vecs = -ENOSPC;
 
-        if (!(flags & PCI_IRQ_NOMSIX)) {
+        if (flags & PCI_IRQ_MSIX) {
                 vecs = __pci_enable_msix_range(dev, NULL, min_vecs, max_vecs,
                                 flags);
                 if (vecs > 0)
                         return vecs;
         }
 
-        if (!(flags & PCI_IRQ_NOMSI)) {
+        if (flags & PCI_IRQ_MSI) {
                 vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, flags);
                 if (vecs > 0)
                         return vecs;
         }
 
         /* use legacy irq if allowed */
-        if (!(flags & PCI_IRQ_NOLEGACY) && min_vecs == 1)
+        if ((flags & PCI_IRQ_LEGACY) && min_vecs == 1) {
+                pci_intx(dev, 1);
                 return 1;
+        }
+
         return vecs;
 }
 EXPORT_SYMBOL(pci_alloc_irq_vectors);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 37ff0158e45f..44e0ff37480b 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3327,9 +3327,9 @@ static void quirk_apple_wait_for_thunderbolt(struct pci_dev *dev)
         if (nhi->vendor != PCI_VENDOR_ID_INTEL
                     || (nhi->device != PCI_DEVICE_ID_INTEL_LIGHT_RIDGE &&
                         nhi->device != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C &&
+                        nhi->device != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_NHI &&
                         nhi->device != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_NHI)
-                    || nhi->subsystem_vendor != 0x2222
-                    || nhi->subsystem_device != 0x1111)
+                    || nhi->class != PCI_CLASS_SYSTEM_OTHER << 8)
                 goto out;
         dev_info(&dev->dev, "quirk: waiting for thunderbolt to reestablish PCI tunnels...\n");
         device_pm_wait_for_dev(&dev->dev, &nhi->dev);
@@ -3344,6 +3344,9 @@ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_INTEL,
                                PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C,
                                quirk_apple_wait_for_thunderbolt);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_INTEL,
+                               PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_BRIDGE,
+                               quirk_apple_wait_for_thunderbolt);
+DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_INTEL,
                                PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_BRIDGE,
                                quirk_apple_wait_for_thunderbolt);
 #endif
diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
index d1ef7acf6930..f9357e09e9b3 100644
--- a/drivers/pci/remove.c
+++ b/drivers/pci/remove.c
@@ -40,6 +40,7 @@ static void pci_destroy_dev(struct pci_dev *dev)
         list_del(&dev->bus_list);
         up_write(&pci_bus_sem);
 
+        pci_bridge_d3_device_removed(dev);
         pci_free_resources(dev);
         put_device(&dev->dev);
 }
@@ -96,8 +97,6 @@ static void pci_remove_bus_device(struct pci_dev *dev)
                 dev->subordinate = NULL;
         }
 
-        pci_bridge_d3_device_removed(dev);
-
         pci_destroy_dev(dev);
 }
 
diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
index c494613c1909..f5e1008a223d 100644
--- a/drivers/perf/arm_pmu.c
+++ b/drivers/perf/arm_pmu.c
@@ -925,6 +925,7 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
                         if (i > 0 && spi != using_spi) {
                                 pr_err("PPI/SPI IRQ type mismatch for %s!\n",
                                         dn->name);
+                                of_node_put(dn);
                                 kfree(irqs);
                                 return -EINVAL;
                         }
@@ -969,7 +970,7 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
         if (cpumask_weight(&pmu->supported_cpus) == 0) {
                 int irq = platform_get_irq(pdev, 0);
 
-                if (irq_is_percpu(irq)) {
+                if (irq >= 0 && irq_is_percpu(irq)) {
                         /* If using PPIs, check the affinity of the partition */
                         int ret;
 
diff --git a/drivers/phy/phy-brcm-sata.c b/drivers/phy/phy-brcm-sata.c
index 18d662610075..8ffc44afdb75 100644
--- a/drivers/phy/phy-brcm-sata.c
+++ b/drivers/phy/phy-brcm-sata.c
@@ -367,7 +367,7 @@ static int brcm_sata_phy_init(struct phy *phy)
                 rc = -ENODEV;
         };
 
-        return 0;
+        return rc;
 }
 
 static const struct phy_ops phy_ops = {
diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c
index 0a45bc6088ae..8c7eb335622e 100644
--- a/drivers/phy/phy-sun4i-usb.c
+++ b/drivers/phy/phy-sun4i-usb.c
@@ -40,6 +40,7 @@
 #include <linux/power_supply.h>
 #include <linux/regulator/consumer.h>
 #include <linux/reset.h>
+#include <linux/usb/of.h>
 #include <linux/workqueue.h>
 
 #define REG_ISCR                        0x00
@@ -110,6 +111,7 @@ struct sun4i_usb_phy_cfg {
 struct sun4i_usb_phy_data {
         void __iomem *base;
         const struct sun4i_usb_phy_cfg *cfg;
+        enum usb_dr_mode dr_mode;
         struct mutex mutex;
         struct sun4i_usb_phy {
                 struct phy *phy;
@@ -120,6 +122,7 @@ struct sun4i_usb_phy_data {
                 bool regulator_on;
                 int index;
         } phys[MAX_PHYS];
+        int first_phy;
         /* phy0 / otg related variables */
         struct extcon_dev *extcon;
         bool phy0_init;
@@ -285,16 +288,10 @@ static int sun4i_usb_phy_init(struct phy *_phy)
                 sun4i_usb_phy0_update_iscr(_phy, 0, ISCR_DPDM_PULLUP_EN);
                 sun4i_usb_phy0_update_iscr(_phy, 0, ISCR_ID_PULLUP_EN);
 
-                if (data->id_det_gpio) {
-                        /* OTG mode, force ISCR and cable state updates */
-                        data->id_det = -1;
-                        data->vbus_det = -1;
-                        queue_delayed_work(system_wq, &data->detect, 0);
-                } else {
-                        /* Host only mode */
-                        sun4i_usb_phy0_set_id_detect(_phy, 0);
-                        sun4i_usb_phy0_set_vbus_detect(_phy, 1);
-                }
+                /* Force ISCR and cable state updates */
+                data->id_det = -1;
+                data->vbus_det = -1;
+                queue_delayed_work(system_wq, &data->detect, 0);
         }
 
         return 0;
@@ -319,6 +316,19 @@ static int sun4i_usb_phy_exit(struct phy *_phy)
         return 0;
 }
 
+static int sun4i_usb_phy0_get_id_det(struct sun4i_usb_phy_data *data)
+{
+        switch (data->dr_mode) {
+        case USB_DR_MODE_OTG:
+                return gpiod_get_value_cansleep(data->id_det_gpio);
+        case USB_DR_MODE_HOST:
+                return 0;
+        case USB_DR_MODE_PERIPHERAL:
+        default:
+                return 1;
+        }
+}
+
 static int sun4i_usb_phy0_get_vbus_det(struct sun4i_usb_phy_data *data)
 {
         if (data->vbus_det_gpio)
@@ -432,7 +442,10 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
         struct phy *phy0 = data->phys[0].phy;
         int id_det, vbus_det, id_notify = 0, vbus_notify = 0;
 
-        id_det = gpiod_get_value_cansleep(data->id_det_gpio);
+        if (phy0 == NULL)
+                return;
+
+        id_det = sun4i_usb_phy0_get_id_det(data);
         vbus_det = sun4i_usb_phy0_get_vbus_det(data);
 
         mutex_lock(&phy0->mutex);
@@ -448,7 +461,8 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
                  * without vbus detection report vbus low for long enough for
                  * the musb-ip to end the current device session.
                  */
-                if (!sun4i_usb_phy0_have_vbus_det(data) && id_det == 0) {
+                if (data->dr_mode == USB_DR_MODE_OTG &&
+                    !sun4i_usb_phy0_have_vbus_det(data) && id_det == 0) {
                         sun4i_usb_phy0_set_vbus_detect(phy0, 0);
                         msleep(200);
                         sun4i_usb_phy0_set_vbus_detect(phy0, 1);
@@ -474,7 +488,8 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
                  * without vbus detection report vbus low for long enough to
                  * the musb-ip to end the current host session.
                  */
-                if (!sun4i_usb_phy0_have_vbus_det(data) && id_det == 1) {
+                if (data->dr_mode == USB_DR_MODE_OTG &&
+                    !sun4i_usb_phy0_have_vbus_det(data) && id_det == 1) {
                         mutex_lock(&phy0->mutex);
                         sun4i_usb_phy0_set_vbus_detect(phy0, 0);
                         msleep(1000);
@@ -519,7 +534,8 @@ static struct phy *sun4i_usb_phy_xlate(struct device *dev,
 {
         struct sun4i_usb_phy_data *data = dev_get_drvdata(dev);
 
-        if (args->args[0] >= data->cfg->num_phys)
+        if (args->args[0] < data->first_phy ||
+            args->args[0] >= data->cfg->num_phys)
                 return ERR_PTR(-ENODEV);
 
         return data->phys[args->args[0]].phy;
@@ -593,13 +609,17 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
                         return -EPROBE_DEFER;
         }
 
-        /* vbus_det without id_det makes no sense, and is not supported */
-        if (sun4i_usb_phy0_have_vbus_det(data) && !data->id_det_gpio) {
-                dev_err(dev, "usb0_id_det missing or invalid\n");
-                return -ENODEV;
-        }
-
-        if (data->id_det_gpio) {
+        data->dr_mode = of_usb_get_dr_mode_by_phy(np, 0);
+        switch (data->dr_mode) {
+        case USB_DR_MODE_OTG:
+                /* otg without id_det makes no sense, and is not supported */
+                if (!data->id_det_gpio) {
+                        dev_err(dev, "usb0_id_det missing or invalid\n");
+                        return -ENODEV;
+                }
+                /* fall through */
+        case USB_DR_MODE_HOST:
+        case USB_DR_MODE_PERIPHERAL:
                 data->extcon = devm_extcon_dev_allocate(dev,
                                                         sun4i_usb_phy0_cable);
                 if (IS_ERR(data->extcon))
@@ -610,9 +630,13 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
                         dev_err(dev, "failed to register extcon: %d\n", ret);
                         return ret;
                 }
+                break;
+        default:
+                dev_info(dev, "dr_mode unknown, not registering usb phy0\n");
+                data->first_phy = 1;
         }
 
-        for (i = 0; i < data->cfg->num_phys; i++) {
+        for (i = data->first_phy; i < data->cfg->num_phys; i++) {
                 struct sun4i_usb_phy *phy = data->phys + i;
                 char name[16];
 
diff --git a/drivers/phy/phy-sun9i-usb.c b/drivers/phy/phy-sun9i-usb.c
index ac4f31abefe3..28fce4bce638 100644
--- a/drivers/phy/phy-sun9i-usb.c
+++ b/drivers/phy/phy-sun9i-usb.c
@@ -141,9 +141,9 @@ static int sun9i_usb_phy_probe(struct platform_device *pdev)
                 }
 
                 phy->hsic_clk = devm_clk_get(dev, "hsic_12M");
-                if (IS_ERR(phy->clk)) {
+                if (IS_ERR(phy->hsic_clk)) {
                         dev_err(dev, "failed to get hsic_12M clock\n");
-                        return PTR_ERR(phy->clk);
+                        return PTR_ERR(phy->hsic_clk);
                 }
 
                 phy->reset = devm_reset_control_get(dev, "hsic");
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 5749a4eee746..0fe8fad25e4d 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1539,12 +1539,11 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
                 offset += range->npins;
         }
 
-        /* Mask and clear all interrupts */
-        chv_writel(0, pctrl->regs + CHV_INTMASK);
+        /* Clear all interrupts */
         chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
 
         ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
-                                   handle_simple_irq, IRQ_TYPE_NONE);
+                                   handle_bad_irq, IRQ_TYPE_NONE);
         if (ret) {
                 dev_err(pctrl->dev, "failed to add IRQ chip\n");
                 goto fail;
diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c
index 7bad200bd67c..55375b1b3cc8 100644
--- a/drivers/pinctrl/pinctrl-pistachio.c
+++ b/drivers/pinctrl/pinctrl-pistachio.c
@@ -809,17 +809,17 @@ static const struct pistachio_pin_group pistachio_groups[] = {
                            PADS_FUNCTION_SELECT2, 12, 0x3),
         MFIO_MUX_PIN_GROUP(83, MIPS_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
                            PADS_FUNCTION_SELECT2, 14, 0x3),
-        MFIO_MUX_PIN_GROUP(84, SYS_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
+        MFIO_MUX_PIN_GROUP(84, AUDIO_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
                            PADS_FUNCTION_SELECT2, 16, 0x3),
-        MFIO_MUX_PIN_GROUP(85, WIFI_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
+        MFIO_MUX_PIN_GROUP(85, RPU_V_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
                            PADS_FUNCTION_SELECT2, 18, 0x3),
-        MFIO_MUX_PIN_GROUP(86, BT_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
+        MFIO_MUX_PIN_GROUP(86, RPU_L_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
                            PADS_FUNCTION_SELECT2, 20, 0x3),
-        MFIO_MUX_PIN_GROUP(87, RPU_V_PLL_LOCK, DREQ2, SOCIF_DEBUG,
+        MFIO_MUX_PIN_GROUP(87, SYS_PLL_LOCK, DREQ2, SOCIF_DEBUG,
                            PADS_FUNCTION_SELECT2, 22, 0x3),
-        MFIO_MUX_PIN_GROUP(88, RPU_L_PLL_LOCK, DREQ3, SOCIF_DEBUG,
+        MFIO_MUX_PIN_GROUP(88, WIFI_PLL_LOCK, DREQ3, SOCIF_DEBUG,
                            PADS_FUNCTION_SELECT2, 24, 0x3),
-        MFIO_MUX_PIN_GROUP(89, AUDIO_PLL_LOCK, DREQ4, DREQ5,
+        MFIO_MUX_PIN_GROUP(89, BT_PLL_LOCK, DREQ4, DREQ5,
                            PADS_FUNCTION_SELECT2, 26, 0x3),
         PIN_GROUP(TCK, "tck"),
         PIN_GROUP(TRSTN, "trstn"),
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
index ce483b03a263..f9d661e5c14a 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
@@ -485,12 +485,12 @@ static const struct sunxi_desc_pin sun8i_a23_pins[] = {
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 8),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* RTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* RTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 2, 8)),  /* PG_EINT8 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 9),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* CTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* CTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 2, 9)),  /* PG_EINT9 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 10),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
index 3040abe6f73a..3131cac2b76f 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
@@ -407,12 +407,12 @@ static const struct sunxi_desc_pin sun8i_a33_pins[] = {
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 8),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* RTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* RTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 1, 8)),  /* PG_EINT8 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 9),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* CTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* CTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 1, 9)),  /* PG_EINT9 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 10),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c
index f99b183d5296..374a8028fec7 100644
--- a/drivers/platform/olpc/olpc-ec.c
+++ b/drivers/platform/olpc/olpc-ec.c
@@ -1,6 +1,8 @@
 /*
  * Generic driver for the OLPC Embedded Controller.
  *
+ * Author: Andres Salomon <dilinger@queued.net>
+ *
  * Copyright (C) 2011-2012 One Laptop per Child Foundation.
  *
  * Licensed under the GPL v2 or later.
@@ -12,7 +14,7 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/workqueue.h>
-#include <linux/module.h>
+#include <linux/init.h>
 #include <linux/list.h>
 #include <linux/olpc-ec.h>
 #include <asm/olpc.h>
@@ -326,8 +328,4 @@ static int __init olpc_ec_init_module(void)
 {
         return platform_driver_register(&olpc_ec_plat_driver);
 }
-
 arch_initcall(olpc_ec_init_module);
-
-MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
-MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/intel_pmic_gpio.c b/drivers/platform/x86/intel_pmic_gpio.c
index 63b371d6ee55..91ae58510d92 100644
--- a/drivers/platform/x86/intel_pmic_gpio.c
+++ b/drivers/platform/x86/intel_pmic_gpio.c
@@ -1,6 +1,8 @@
 /* Moorestown PMIC GPIO (access through IPC) driver
  * Copyright (c) 2008 - 2009, Intel Corporation.
  *
+ * Author: Alek Du <alek.du@intel.com>
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
@@ -21,7 +23,6 @@
 
 #define pr_fmt(fmt) "%s: " fmt, __func__
 
-#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
@@ -322,9 +323,4 @@ static int __init platform_pmic_gpio_init(void)
 {
         return platform_driver_register(&platform_pmic_gpio_driver);
 }
-
 subsys_initcall(platform_pmic_gpio_init);
-
-MODULE_AUTHOR("Alek Du <alek.du@intel.com>");
-MODULE_DESCRIPTION("Intel Moorestown PMIC GPIO driver");
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 32f0f014a067..9d19b9a62011 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -1161,7 +1161,7 @@ static int tsi721_rio_map_inb_mem(struct rio_mport *mport, dma_addr_t lstart,
                 } else if (ibw_start < (ib_win->rstart + ib_win->size) &&
                            (ibw_start + ibw_size) > ib_win->rstart) {
                         /* Return error if address translation involved */
-                        if (direct && ib_win->xlat) {
+                        if (!direct || ib_win->xlat) {
                                 ret = -EFAULT;
                                 break;
                         }
diff --git a/drivers/regulator/max14577-regulator.c b/drivers/regulator/max14577-regulator.c
index b2daa6641417..c9ff26199711 100644
--- a/drivers/regulator/max14577-regulator.c
+++ b/drivers/regulator/max14577-regulator.c
@@ -2,7 +2,7 @@
  * max14577.c - Regulator driver for the Maxim 14577/77836
  *
  * Copyright (C) 2013,2014 Samsung Electronics
- * Krzysztof Kozlowski <k.kozlowski@samsung.com>
+ * Krzysztof Kozlowski <krzk@kernel.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -331,7 +331,7 @@ static void __exit max14577_regulator_exit(void)
 }
 module_exit(max14577_regulator_exit);
 
-MODULE_AUTHOR("Krzysztof Kozlowski <k.kozlowski@samsung.com>");
+MODULE_AUTHOR("Krzysztof Kozlowski <krzk@kernel.org>");
 MODULE_DESCRIPTION("Maxim 14577/77836 regulator driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:max14577-regulator");
diff --git a/drivers/regulator/max77693-regulator.c b/drivers/regulator/max77693-regulator.c
index de730fd3f8a5..cfbb9512e486 100644
--- a/drivers/regulator/max77693-regulator.c
+++ b/drivers/regulator/max77693-regulator.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2013-2015 Samsung Electronics
  * Jonghwa Lee <jonghwa3.lee@samsung.com>
- * Krzysztof Kozlowski <k.kozlowski.k@gmail.com>
+ * Krzysztof Kozlowski <krzk@kernel.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -314,5 +314,5 @@ module_exit(max77693_pmic_cleanup);
 
 MODULE_DESCRIPTION("MAXIM 77693/77843 regulator driver");
 MODULE_AUTHOR("Jonghwa Lee <jonghwa3.lee@samsung.com>");
-MODULE_AUTHOR("Krzysztof Kozlowski <k.kozlowski.k@gmail.com>");
+MODULE_AUTHOR("Krzysztof Kozlowski <krzk@kernel.org>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c
index 5022fa8d10c6..8ed46a9a55c8 100644
--- a/drivers/regulator/qcom_smd-regulator.c
+++ b/drivers/regulator/qcom_smd-regulator.c
@@ -178,20 +178,21 @@ static const struct regulator_desc pma8084_hfsmps = {
 static const struct regulator_desc pma8084_ftsmps = {
         .linear_ranges = (struct regulator_linear_range[]) {
                 REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
-                REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
+                REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
         },
         .n_linear_ranges = 2,
-        .n_voltages = 340,
+        .n_voltages = 262,
         .ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pma8084_pldo = {
         .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE(750000,  0,  30, 25000),
-                REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
+                REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
+                REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
+                REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
         },
-        .n_linear_ranges = 2,
-        .n_voltages = 100,
+        .n_linear_ranges = 3,
+        .n_voltages = 164,
         .ops = &rpm_smps_ldo_ops,
 };
 
@@ -221,29 +222,30 @@ static const struct regulator_desc pm8x41_hfsmps = {
 static const struct regulator_desc pm8841_ftsmps = {
         .linear_ranges = (struct regulator_linear_range[]) {
                 REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
-                REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
+                REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
         },
         .n_linear_ranges = 2,
-        .n_voltages = 340,
+        .n_voltages = 262,
         .ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pm8941_boost = {
         .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE(4000000, 0, 15, 100000),
+                REGULATOR_LINEAR_RANGE(4000000, 0, 30, 50000),
         },
         .n_linear_ranges = 1,
-        .n_voltages = 16,
+        .n_voltages = 31,
         .ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pm8941_pldo = {
         .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE( 750000,  0,  30, 25000),
-                REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
+                REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
+                REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
+                REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
         },
-        .n_linear_ranges = 2,
-        .n_voltages = 100,
+        .n_linear_ranges = 3,
+        .n_voltages = 164,
         .ops = &rpm_smps_ldo_ops,
 };
 
diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
index 83458f7a2824..6dc96c8dfe75 100644
--- a/drivers/scsi/constants.c
+++ b/drivers/scsi/constants.c
@@ -361,8 +361,9 @@ static const char * const snstext[] = {
 
 /* Get sense key string or NULL if not available */
 const char *
-scsi_sense_key_string(unsigned char key) {
-        if (key <= 0xE)
+scsi_sense_key_string(unsigned char key)
+{
+        if (key < ARRAY_SIZE(snstext))
                 return snstext[key];
         return NULL;
 }
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index eaccd651ccda..246456925335 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -246,6 +246,10 @@ static struct {
         {"IBM", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"SUN", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"DELL", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"STK", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"NETAPP", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"LSI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"ENGENIO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"SMSC", "USB 2 HS-CF", NULL, BLIST_SPARSELUN | BLIST_INQUIRY_36},
         {"SONY", "CD-ROM CDU-8001", NULL, BLIST_BORKEN},
         {"SONY", "TSL", NULL, BLIST_FORCELUN},          /* DDS3 & DDS4 autoloaders */
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index 3f0ff072184b..60b651bfaa01 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -341,22 +341,6 @@ static int do_sas_phy_delete(struct device *dev, void *data)
 }
 
 /**
- * is_sas_attached - check if device is SAS attached
- * @sdev: scsi device to check
- *
- * returns true if the device is SAS attached
- */
-int is_sas_attached(struct scsi_device *sdev)
-{
-        struct Scsi_Host *shost = sdev->host;
-
-        return shost->transportt->host_attrs.ac.class ==
-                &sas_host_class.class;
-}
-EXPORT_SYMBOL(is_sas_attached);
-
-
-/**
  * sas_remove_children  -  tear down a devices SAS data structures
  * @dev:        device belonging to the sas object
  *
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 0e8601aa877a..8c9a35c91705 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -587,7 +587,7 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,
 
         ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0);
 
-        if (is_sas_attached(sdev))
+        if (scsi_is_sas_rphy(&sdev->sdev_gendev))
                 efd.addr = sas_get_address(sdev);
 
         if (efd.addr) {
diff --git a/drivers/scsi/wd719x.c b/drivers/scsi/wd719x.c
index e3da1a2fdb66..2a9da2e0ea6b 100644
--- a/drivers/scsi/wd719x.c
+++ b/drivers/scsi/wd719x.c
@@ -962,7 +962,7 @@ static void wd719x_pci_remove(struct pci_dev *pdev)
         scsi_host_put(sh);
 }
 
-static DEFINE_PCI_DEVICE_TABLE(wd719x_pci_table) = {
+static const struct pci_device_id wd719x_pci_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_WD, 0x3296) },
         {}
 };
diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index 823cbc92d1e7..7a37090dabbe 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -720,8 +720,6 @@ static int img_spfi_remove(struct platform_device *pdev)
                 clk_disable_unprepare(spfi->sys_clk);
         }
 
-        spi_master_put(master);
-
         return 0;
 }
 
diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
index 0be89e052428..899d7a8f0889 100644
--- a/drivers/spi/spi-mt65xx.c
+++ b/drivers/spi/spi-mt65xx.c
@@ -685,7 +685,6 @@ static int mtk_spi_remove(struct platform_device *pdev)
         pm_runtime_disable(&pdev->dev);
 
         mtk_spi_reset(mdata);
-        spi_master_put(master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c
index f3df522db93b..58d2d48e16a5 100644
--- a/drivers/spi/spi-pxa2xx-pci.c
+++ b/drivers/spi/spi-pxa2xx-pci.c
@@ -214,6 +214,7 @@ static int pxa2xx_spi_pci_probe(struct pci_dev *dev,
                 return PTR_ERR(ssp->clk);
 
         memset(&pi, 0, sizeof(pi));
+        pi.fwnode = dev->dev.fwnode;
         pi.parent = &dev->dev;
         pi.name = "pxa2xx-spi";
         pi.id = ssp->port_id;
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index c338ef1136f6..7f1555621f8e 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -1030,7 +1030,6 @@ static int spi_qup_remove(struct platform_device *pdev)
 
         pm_runtime_put_noidle(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
-        spi_master_put(master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index 0f83ad1d5a58..1de3a772eb7d 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -262,6 +262,9 @@ static void sh_msiof_spi_set_clk_regs(struct sh_msiof_spi_priv *p,
 
         for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_div_table); k++) {
                 brps = DIV_ROUND_UP(div, sh_msiof_spi_div_table[k].div);
+                /* SCR_BRDV_DIV_1 is valid only if BRPS is x 1/1 or x 1/2 */
+                if (sh_msiof_spi_div_table[k].div == 1 && brps > 2)
+                        continue;
                 if (brps <= 32) /* max of brdv is 32 */
                         break;
         }
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 51ad42fad567..200ca228d885 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -960,7 +960,7 @@ static int spi_transfer_one_message(struct spi_master *master,
         struct spi_transfer *xfer;
         bool keep_cs = false;
         int ret = 0;
-        unsigned long ms = 1;
+        unsigned long long ms = 1;
         struct spi_statistics *statm = &master->statistics;
         struct spi_statistics *stats = &msg->spi->statistics;
 
@@ -991,9 +991,13 @@ static int spi_transfer_one_message(struct spi_master *master,
 
                         if (ret > 0) {
                                 ret = 0;
-                                ms = xfer->len * 8 * 1000 / xfer->speed_hz;
+                                ms = 8LL * 1000LL * xfer->len;
+                                do_div(ms, xfer->speed_hz);
                                 ms += ms + 100; /* some tolerance */
 
+                                if (ms > UINT_MAX)
+                                        ms = UINT_MAX;
+
                                 ms = wait_for_completion_timeout(&master->xfer_completion,
                                                                  msecs_to_jiffies(ms));
                         }
@@ -1159,6 +1163,7 @@ static void __spi_pump_messages(struct spi_master *master, bool in_kthread)
                 if (ret < 0) {
                         dev_err(&master->dev, "Failed to power device: %d\n",
                                 ret);
+                        mutex_unlock(&master->io_mutex);
                         return;
                 }
         }
@@ -1174,6 +1179,7 @@ static void __spi_pump_messages(struct spi_master *master, bool in_kthread)
 
                         if (master->auto_runtime_pm)
                                 pm_runtime_put(master->dev.parent);
+                        mutex_unlock(&master->io_mutex);
                         return;
                 }
         }
diff --git a/drivers/staging/comedi/drivers/adv_pci1760.c b/drivers/staging/comedi/drivers/adv_pci1760.c
index d7dd1e55e347..9f525ff7290c 100644
--- a/drivers/staging/comedi/drivers/adv_pci1760.c
+++ b/drivers/staging/comedi/drivers/adv_pci1760.c
@@ -196,6 +196,7 @@ static int pci1760_pwm_ns_to_div(unsigned int flags, unsigned int ns)
                 break;
         case CMDF_ROUND_DOWN:
                 divisor = ns / PCI1760_PWM_TIMEBASE;
+                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c
index 4ab186669f0c..ec5b9a23494d 100644
--- a/drivers/staging/comedi/drivers/comedi_test.c
+++ b/drivers/staging/comedi/drivers/comedi_test.c
@@ -56,11 +56,6 @@
 
 #define N_CHANS 8
 
-enum waveform_state_bits {
-        WAVEFORM_AI_RUNNING,
-        WAVEFORM_AO_RUNNING
-};
-
 /* Data unique to this driver */
 struct waveform_private {
         struct timer_list ai_timer;     /* timer for AI commands */
@@ -68,7 +63,6 @@ struct waveform_private {
         unsigned int wf_amplitude;      /* waveform amplitude in microvolts */
         unsigned int wf_period;         /* waveform period in microseconds */
         unsigned int wf_current;        /* current time in waveform period */
-        unsigned long state_bits;
         unsigned int ai_scan_period;    /* AI scan period in usec */
         unsigned int ai_convert_period; /* AI conversion period in usec */
         struct timer_list ao_timer;     /* timer for AO commands */
@@ -191,10 +185,6 @@ static void waveform_ai_timer(unsigned long arg)
         unsigned int nsamples;
         unsigned int time_increment;
 
-        /* check command is still active */
-        if (!test_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits))
-                return;
-
         now = ktime_to_us(ktime_get());
         nsamples = comedi_nsamples_left(s, UINT_MAX);
 
@@ -386,11 +376,6 @@ static int waveform_ai_cmd(struct comedi_device *dev,
          */
         devpriv->ai_timer.expires =
                 jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1;
-
-        /* mark command as active */
-        smp_mb__before_atomic();
-        set_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
         add_timer(&devpriv->ai_timer);
         return 0;
 }
@@ -400,11 +385,12 @@ static int waveform_ai_cancel(struct comedi_device *dev,
 {
         struct waveform_private *devpriv = dev->private;
 
-        /* mark command as no longer active */
-        clear_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
-        /* cannot call del_timer_sync() as may be called from timer routine */
-        del_timer(&devpriv->ai_timer);
+        if (in_softirq()) {
+                /* Assume we were called from the timer routine itself. */
+                del_timer(&devpriv->ai_timer);
+        } else {
+                del_timer_sync(&devpriv->ai_timer);
+        }
         return 0;
 }
 
@@ -436,10 +422,6 @@ static void waveform_ao_timer(unsigned long arg)
         u64 scans_since;
         unsigned int scans_avail = 0;
 
-        /* check command is still active */
-        if (!test_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits))
-                return;
-
         /* determine number of scan periods since last time */
         now = ktime_to_us(ktime_get());
         scans_since = now - devpriv->ao_last_scan_time;
@@ -518,11 +500,6 @@ static int waveform_ao_inttrig_start(struct comedi_device *dev,
         devpriv->ao_last_scan_time = ktime_to_us(ktime_get());
         devpriv->ao_timer.expires =
                 jiffies + usecs_to_jiffies(devpriv->ao_scan_period);
-
-        /* mark command as active */
-        smp_mb__before_atomic();
-        set_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
         add_timer(&devpriv->ao_timer);
 
         return 1;
@@ -608,11 +585,12 @@ static int waveform_ao_cancel(struct comedi_device *dev,
         struct waveform_private *devpriv = dev->private;
 
         s->async->inttrig = NULL;
-        /* mark command as no longer active */
-        clear_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
-        /* cannot call del_timer_sync() as may be called from timer routine */
-        del_timer(&devpriv->ao_timer);
+        if (in_softirq()) {
+                /* Assume we were called from the timer routine itself. */
+                del_timer(&devpriv->ao_timer);
+        } else {
+                del_timer_sync(&devpriv->ao_timer);
+        }
         return 0;
 }
 
diff --git a/drivers/staging/comedi/drivers/daqboard2000.c b/drivers/staging/comedi/drivers/daqboard2000.c
index 65daef0c00d5..0f4eb954aa80 100644
--- a/drivers/staging/comedi/drivers/daqboard2000.c
+++ b/drivers/staging/comedi/drivers/daqboard2000.c
@@ -634,7 +634,7 @@ static const void *daqboard2000_find_boardinfo(struct comedi_device *dev,
         const struct daq200_boardtype *board;
         int i;
 
-        if (pcidev->subsystem_device != PCI_VENDOR_ID_IOTECH)
+        if (pcidev->subsystem_vendor != PCI_VENDOR_ID_IOTECH)
                 return NULL;
 
         for (i = 0; i < ARRAY_SIZE(boardtypes); i++) {
diff --git a/drivers/staging/comedi/drivers/dt2811.c b/drivers/staging/comedi/drivers/dt2811.c
index 904f637797b6..8bbd93814340 100644
--- a/drivers/staging/comedi/drivers/dt2811.c
+++ b/drivers/staging/comedi/drivers/dt2811.c
@@ -588,8 +588,8 @@ static int dt2811_attach(struct comedi_device *dev, struct comedi_devconfig *it)
         s = &dev->subdevices[0];
         s->type         = COMEDI_SUBD_AI;
         s->subdev_flags = SDF_READABLE |
-                          (it->options[2] == 1) ? SDF_DIFF :
-                          (it->options[2] == 2) ? SDF_COMMON : SDF_GROUND;
+                          ((it->options[2] == 1) ? SDF_DIFF :
+                           (it->options[2] == 2) ? SDF_COMMON : SDF_GROUND);
         s->n_chan       = (it->options[2] == 1) ? 8 : 16;
         s->maxdata      = 0x0fff;
         s->range_table  = board->is_pgh ? &dt2811_pgh_ai_ranges
diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index 8dabb19519a5..0f97d7b611d7 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -2772,7 +2772,15 @@ static int ni_ao_inttrig(struct comedi_device *dev,
         int i;
         static const int timeout = 1000;
 
-        if (trig_num != cmd->start_arg)
+        /*
+         * Require trig_num == cmd->start_arg when cmd->start_src == TRIG_INT.
+         * For backwards compatibility, also allow trig_num == 0 when
+         * cmd->start_src != TRIG_INT (i.e. when cmd->start_src == TRIG_EXT);
+         * in that case, the internal trigger is being used as a pre-trigger
+         * before the external trigger.
+         */
+        if (!(trig_num == cmd->start_arg ||
+              (trig_num == 0 && cmd->start_src != TRIG_INT)))
                 return -EINVAL;
 
         /*
@@ -5480,7 +5488,7 @@ static int ni_E_init(struct comedi_device *dev,
                 s->maxdata      = (devpriv->is_m_series) ? 0xffffffff
                                                          : 0x00ffffff;
                 s->insn_read    = ni_tio_insn_read;
-                s->insn_write   = ni_tio_insn_read;
+                s->insn_write   = ni_tio_insn_write;
                 s->insn_config  = ni_tio_insn_config;
 #ifdef PCIDMA
                 if (dev->irq && devpriv->mite) {
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index 170ac980abcb..24c348d2f5bb 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -419,6 +419,7 @@ static ssize_t ad5933_store(struct device *dev,
         mutex_lock(&indio_dev->mlock);
         switch ((u32)this_attr->address) {
         case AD5933_OUT_RANGE:
+                ret = -EINVAL;
                 for (i = 0; i < 4; i++)
                         if (val == st->range_avail[i]) {
                                 st->ctrl_hb &= ~AD5933_CTRL_RANGE(0x3);
@@ -426,7 +427,6 @@ static ssize_t ad5933_store(struct device *dev,
                                 ret = ad5933_cmd(st, 0);
                                 break;
                         }
-                ret = -EINVAL;
                 break;
         case AD5933_IN_PGA_GAIN:
                 if (sysfs_streq(buf, "1")) {
diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c
index 3664bfd0178b..2c4dc69731e8 100644
--- a/drivers/staging/lustre/lustre/llite/namei.c
+++ b/drivers/staging/lustre/lustre/llite/namei.c
@@ -388,6 +388,7 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
         struct inode *inode = NULL;
         __u64 bits = 0;
         int rc = 0;
+        struct dentry *alias;
 
         /* NB 1 request reference will be taken away by ll_intent_lock()
          * when I return
@@ -412,26 +413,12 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
                  */
         }
 
-        /* Only hash *de if it is unhashed (new dentry).
-         * Atoimc_open may passing hashed dentries for open.
-         */
-        if (d_unhashed(*de)) {
-                struct dentry *alias;
-
-                alias = ll_splice_alias(inode, *de);
-                if (IS_ERR(alias)) {
-                        rc = PTR_ERR(alias);
-                        goto out;
-                }
-                *de = alias;
-        } else if (!it_disposition(it, DISP_LOOKUP_NEG)  &&
-                   !it_disposition(it, DISP_OPEN_CREATE)) {
-                /* With DISP_OPEN_CREATE dentry will be
-                 * instantiated in ll_create_it.
-                 */
-                LASSERT(!d_inode(*de));
-                d_instantiate(*de, inode);
+        alias = ll_splice_alias(inode, *de);
+        if (IS_ERR(alias)) {
+                rc = PTR_ERR(alias);
+                goto out;
         }
+        *de = alias;
 
         if (!it_disposition(it, DISP_LOOKUP_NEG)) {
                 /* we have lookup look - unhide dentry */
@@ -587,6 +574,24 @@ static int ll_atomic_open(struct inode *dir, struct dentry *dentry,
                dentry, PFID(ll_inode2fid(dir)), dir, file, open_flags, mode,
                *opened);
 
+        /* Only negative dentries enter here */
+        LASSERT(!d_inode(dentry));
+
+        if (!d_in_lookup(dentry)) {
+                /* A valid negative dentry that just passed revalidation,
+                 * there's little point to try and open it server-side,
+                 * even though there's a minuscle chance it might succeed.
+                 * Either way it's a valid race to just return -ENOENT here.
+                 */
+                if (!(open_flags & O_CREAT))
+                        return -ENOENT;
+
+                /* Otherwise we just unhash it to be rehashed afresh via
+                 * lookup if necessary
+                 */
+                d_drop(dentry);
+        }
+
         it = kzalloc(sizeof(*it), GFP_NOFS);
         if (!it)
                 return -ENOMEM;
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
index 0b1760cba6e3..78f524fcd214 100644
--- a/drivers/staging/wilc1000/host_interface.c
+++ b/drivers/staging/wilc1000/host_interface.c
@@ -3363,7 +3363,7 @@ int wilc_init(struct net_device *dev, struct host_if_drv **hif_drv_handler)
                 if (!hif_workqueue) {
                         netdev_err(vif->ndev, "Failed to create workqueue\n");
                         result = -ENOMEM;
-                        goto _fail_mq_;
+                        goto _fail_;
                 }
 
                 setup_timer(&periodic_rssi, GetPeriodicRSSI,
@@ -3391,7 +3391,6 @@ int wilc_init(struct net_device *dev, struct host_if_drv **hif_drv_handler)
 
         clients_count++;
 
-_fail_mq_:
         destroy_workqueue(hif_workqueue);
 _fail_:
         return result;
diff --git a/drivers/staging/wilc1000/linux_wlan.c b/drivers/staging/wilc1000/linux_wlan.c
index 3a66255f14fc..32215110d597 100644
--- a/drivers/staging/wilc1000/linux_wlan.c
+++ b/drivers/staging/wilc1000/linux_wlan.c
@@ -648,7 +648,7 @@ void wilc1000_wlan_deinit(struct net_device *dev)
                         mutex_unlock(&wl->hif_cs);
                 }
                 if (&wl->txq_event)
-                        wait_for_completion(&wl->txq_event);
+                        complete(&wl->txq_event);
 
                 wlan_deinitialize_threads(dev);
                 deinit_irq(dev);
diff --git a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
index 9092600a1794..2c2e8aca8305 100644
--- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
+++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
@@ -1191,7 +1191,7 @@ static int get_station(struct wiphy *wiphy, struct net_device *dev,
         struct wilc_priv *priv;
         struct wilc_vif *vif;
         u32 i = 0;
-        u32 associatedsta = 0;
+        u32 associatedsta = ~0;
         u32 inactive_time = 0;
         priv = wiphy_priv(wiphy);
         vif = netdev_priv(dev);
@@ -1204,7 +1204,7 @@ static int get_station(struct wiphy *wiphy, struct net_device *dev,
                         }
                 }
 
-                if (associatedsta == -1) {
+                if (associatedsta == ~0) {
                         netdev_err(dev, "sta required is not associated\n");
                         return -ENOENT;
                 }
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index 3788ed74c9ab..a32b41783b77 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -740,12 +740,22 @@ static int cpufreq_power2state(struct thermal_cooling_device *cdev,
 }
 
 /* Bind cpufreq callbacks to thermal cooling device ops */
+
 static struct thermal_cooling_device_ops cpufreq_cooling_ops = {
         .get_max_state = cpufreq_get_max_state,
         .get_cur_state = cpufreq_get_cur_state,
         .set_cur_state = cpufreq_set_cur_state,
 };
 
+static struct thermal_cooling_device_ops cpufreq_power_cooling_ops = {
+        .get_max_state          = cpufreq_get_max_state,
+        .get_cur_state          = cpufreq_get_cur_state,
+        .set_cur_state          = cpufreq_set_cur_state,
+        .get_requested_power    = cpufreq_get_requested_power,
+        .state2power            = cpufreq_state2power,
+        .power2state            = cpufreq_power2state,
+};
+
 /* Notifier for cpufreq policy change */
 static struct notifier_block thermal_cpufreq_notifier_block = {
         .notifier_call = cpufreq_thermal_notifier,
@@ -795,6 +805,7 @@ __cpufreq_cooling_register(struct device_node *np,
         struct cpumask temp_mask;
         unsigned int freq, i, num_cpus;
         int ret;
+        struct thermal_cooling_device_ops *cooling_ops;
 
         cpumask_and(&temp_mask, clip_cpus, cpu_online_mask);
         policy = cpufreq_cpu_get(cpumask_first(&temp_mask));
@@ -850,10 +861,6 @@ __cpufreq_cooling_register(struct device_node *np,
         cpumask_copy(&cpufreq_dev->allowed_cpus, clip_cpus);
 
         if (capacitance) {
-                cpufreq_cooling_ops.get_requested_power =
-                        cpufreq_get_requested_power;
-                cpufreq_cooling_ops.state2power = cpufreq_state2power;
-                cpufreq_cooling_ops.power2state = cpufreq_power2state;
                 cpufreq_dev->plat_get_static_power = plat_static_func;
 
                 ret = build_dyn_power_table(cpufreq_dev, capacitance);
@@ -861,6 +868,10 @@ __cpufreq_cooling_register(struct device_node *np,
                         cool_dev = ERR_PTR(ret);
                         goto free_table;
                 }
+
+                cooling_ops = &cpufreq_power_cooling_ops;
+        } else {
+                cooling_ops = &cpufreq_cooling_ops;
         }
 
         ret = get_idr(&cpufreq_idr, &cpufreq_dev->id);
@@ -885,7 +896,7 @@ __cpufreq_cooling_register(struct device_node *np,
                  cpufreq_dev->id);
 
         cool_dev = thermal_of_cooling_device_register(np, dev_name, cpufreq_dev,
-                                                      &cpufreq_cooling_ops);
+                                                      cooling_ops);
         if (IS_ERR(cool_dev))
                 goto remove_idr;
 
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index c5547bd711db..e473548b5d28 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -471,8 +471,6 @@ MODULE_DEVICE_TABLE(of, of_imx_thermal_match);
 
 static int imx_thermal_probe(struct platform_device *pdev)
 {
-        const struct of_device_id *of_id =
-                of_match_device(of_imx_thermal_match, &pdev->dev);
         struct imx_thermal_data *data;
         struct regmap *map;
         int measure_freq;
@@ -490,7 +488,7 @@ static int imx_thermal_probe(struct platform_device *pdev)
         }
         data->tempmon = map;
 
-        data->socdata = of_id->data;
+        data->socdata = of_device_get_match_data(&pdev->dev);
 
         /* make sure the IRQ flag is clear before enabling irq on i.MX6SX */
         if (data->socdata->version == TEMPMON_IMX6SX) {
diff --git a/drivers/thermal/int340x_thermal/int3406_thermal.c b/drivers/thermal/int340x_thermal/int3406_thermal.c
index a578cd257db4..1891f34ab7fc 100644
--- a/drivers/thermal/int340x_thermal/int3406_thermal.c
+++ b/drivers/thermal/int340x_thermal/int3406_thermal.c
@@ -225,7 +225,6 @@ static struct platform_driver int3406_thermal_driver = {
         .remove = int3406_thermal_remove,
         .driver = {
                    .name = "int3406 thermal",
-                   .owner = THIS_MODULE,
                    .acpi_match_table = int3406_thermal_match,
                    },
 };
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 71a339271fa5..5f817923f374 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -504,6 +504,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                 if (IS_ERR(priv->zone)) {
                         dev_err(dev, "can't register thermal zone\n");
                         ret = PTR_ERR(priv->zone);
+                        priv->zone = NULL;
                         goto error_unregister;
                 }
 
diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c
index 9c15344b657a..a8c20413dbda 100644
--- a/drivers/thunderbolt/nhi.c
+++ b/drivers/thunderbolt/nhi.c
@@ -651,6 +651,12 @@ static struct pci_device_id nhi_ids[] = {
         {
                 .class = PCI_CLASS_SYSTEM_OTHER << 8, .class_mask = ~0,
                 .vendor = PCI_VENDOR_ID_INTEL,
+                .device = PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_NHI,
+                .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID,
+        },
+        {
+                .class = PCI_CLASS_SYSTEM_OTHER << 8, .class_mask = ~0,
+                .vendor = PCI_VENDOR_ID_INTEL,
                 .device = PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_NHI,
                 .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID,
         },
diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index 1e116f53d6dd..9840fdecb73b 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -372,7 +372,9 @@ struct tb_switch *tb_switch_alloc(struct tb *tb, u64 route)
 
         if (sw->config.device_id != PCI_DEVICE_ID_INTEL_LIGHT_RIDGE &&
             sw->config.device_id != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C &&
-            sw->config.device_id != PCI_DEVICE_ID_INTEL_PORT_RIDGE)
+            sw->config.device_id != PCI_DEVICE_ID_INTEL_PORT_RIDGE &&
+            sw->config.device_id != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_BRIDGE &&
+            sw->config.device_id != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_BRIDGE)
                 tb_sw_warn(sw, "unsupported switch device id %#x\n",
                            sw->config.device_id);
 
diff --git a/drivers/tty/serial/8250/8250.h b/drivers/tty/serial/8250/8250.h
index 122e0e4029fe..1a16feac9a36 100644
--- a/drivers/tty/serial/8250/8250.h
+++ b/drivers/tty/serial/8250/8250.h
@@ -15,8 +15,6 @@
 #include <linux/serial_reg.h>
 #include <linux/dmaengine.h>
 
-#include "../serial_mctrl_gpio.h"
-
 struct uart_8250_dma {
         int (*tx_dma)(struct uart_8250_port *p);
         int (*rx_dma)(struct uart_8250_port *p);
@@ -133,43 +131,12 @@ void serial8250_em485_destroy(struct uart_8250_port *p);
 
 static inline void serial8250_out_MCR(struct uart_8250_port *up, int value)
 {
-        int mctrl_gpio = 0;
-
         serial_out(up, UART_MCR, value);
-
-        if (value & UART_MCR_RTS)
-                mctrl_gpio |= TIOCM_RTS;
-        if (value & UART_MCR_DTR)
-                mctrl_gpio |= TIOCM_DTR;
-
-        mctrl_gpio_set(up->gpios, mctrl_gpio);
 }
 
 static inline int serial8250_in_MCR(struct uart_8250_port *up)
 {
-        int mctrl, mctrl_gpio = 0;
-
-        mctrl = serial_in(up, UART_MCR);
-
-        /* save current MCR values */
-        if (mctrl & UART_MCR_RTS)
-                mctrl_gpio |= TIOCM_RTS;
-        if (mctrl & UART_MCR_DTR)
-                mctrl_gpio |= TIOCM_DTR;
-
-        mctrl_gpio = mctrl_gpio_get_outputs(up->gpios, &mctrl_gpio);
-
-        if (mctrl_gpio & TIOCM_RTS)
-                mctrl |= UART_MCR_RTS;
-        else
-                mctrl &= ~UART_MCR_RTS;
-
-        if (mctrl_gpio & TIOCM_DTR)
-                mctrl |= UART_MCR_DTR;
-        else
-                mctrl &= ~UART_MCR_DTR;
-
-        return mctrl;
+        return serial_in(up, UART_MCR);
 }
 
 #if defined(__alpha__) && !defined(CONFIG_PCI)
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 13ad5c3d2e68..dcf43f66404f 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -974,8 +974,6 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
 
         uart = serial8250_find_match_or_unused(&up->port);
         if (uart && uart->port.type != PORT_8250_CIR) {
-                struct mctrl_gpios *gpios;
-
                 if (uart->port.dev)
                         uart_remove_one_port(&serial8250_reg, &uart->port);
 
@@ -1013,13 +1011,6 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
                 if (up->port.flags & UPF_FIXED_TYPE)
                         uart->port.type = up->port.type;
 
-                gpios = mctrl_gpio_init(&uart->port, 0);
-                if (IS_ERR(gpios)) {
-                        if (PTR_ERR(gpios) != -ENOSYS)
-                                return PTR_ERR(gpios);
-                } else
-                        uart->gpios = gpios;
-
                 serial8250_set_defaults(uart);
 
                 /* Possibly override default I/O functions.  */
diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c
index 737b4b3957b0..0facc789fe7d 100644
--- a/drivers/tty/serial/8250/8250_fintek.c
+++ b/drivers/tty/serial/8250/8250_fintek.c
@@ -31,7 +31,7 @@
 #define IO_ADDR2 0x60
 #define LDN 0x7
 
-#define IRQ_MODE        0x70
+#define FINTEK_IRQ_MODE 0x70
 #define IRQ_SHARE       BIT(4)
 #define IRQ_MODE_MASK   (BIT(6) | BIT(5))
 #define IRQ_LEVEL_LOW   0
@@ -195,7 +195,7 @@ static int fintek_8250_set_irq_mode(struct fintek_8250 *pdata, bool level_mode)
         outb(LDN, pdata->base_port + ADDR_PORT);
         outb(pdata->index, pdata->base_port + DATA_PORT);
 
-        outb(IRQ_MODE, pdata->base_port + ADDR_PORT);
+        outb(FINTEK_IRQ_MODE, pdata->base_port + ADDR_PORT);
         tmp = inb(pdata->base_port + DATA_PORT);
 
         tmp &= ~IRQ_MODE_MASK;
diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c
index 339de9cd0866..20c5db2f4264 100644
--- a/drivers/tty/serial/8250/8250_mid.c
+++ b/drivers/tty/serial/8250/8250_mid.c
@@ -168,6 +168,9 @@ static void mid8250_set_termios(struct uart_port *p,
         unsigned long w = BIT(24) - 1;
         unsigned long mul, div;
 
+        /* Gracefully handle the B0 case: fall back to B9600 */
+        fuart = fuart ? fuart : 9600 * 16;
+
         if (mid->board->freq < fuart) {
                 /* Find prescaler value that satisfies Fuart < Fref */
                 if (mid->board->freq > baud)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index e14982f36a04..61ad6c3b20a0 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -134,21 +134,18 @@ static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl)
 
         serial8250_do_set_mctrl(port, mctrl);
 
-        if (IS_ERR_OR_NULL(mctrl_gpio_to_gpiod(up->gpios,
-                                                UART_GPIO_RTS))) {
-                /*
-                 * Turn off autoRTS if RTS is lowered and restore autoRTS
-                 * setting if RTS is raised
-                 */
-                lcr = serial_in(up, UART_LCR);
-                serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B);
-                if ((mctrl & TIOCM_RTS) && (port->status & UPSTAT_AUTORTS))
-                        priv->efr |= UART_EFR_RTS;
-                else
-                        priv->efr &= ~UART_EFR_RTS;
-                serial_out(up, UART_EFR, priv->efr);
-                serial_out(up, UART_LCR, lcr);
-        }
+        /*
+         * Turn off autoRTS if RTS is lowered and restore autoRTS setting
+         * if RTS is raised
+         */
+        lcr = serial_in(up, UART_LCR);
+        serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B);
+        if ((mctrl & TIOCM_RTS) && (port->status & UPSTAT_AUTORTS))
+                priv->efr |= UART_EFR_RTS;
+        else
+                priv->efr &= ~UART_EFR_RTS;
+        serial_out(up, UART_EFR, priv->efr);
+        serial_out(up, UART_LCR, lcr);
 }
 
 /*
@@ -449,9 +446,7 @@ static void omap_8250_set_termios(struct uart_port *port,
         priv->efr = 0;
         up->port.status &= ~(UPSTAT_AUTOCTS | UPSTAT_AUTORTS | UPSTAT_AUTOXOFF);
 
-        if (termios->c_cflag & CRTSCTS && up->port.flags & UPF_HARD_FLOW
-                && IS_ERR_OR_NULL(mctrl_gpio_to_gpiod(up->gpios,
-                                                        UART_GPIO_RTS))) {
+        if (termios->c_cflag & CRTSCTS && up->port.flags & UPF_HARD_FLOW) {
                 /* Enable AUTOCTS (autoRTS is enabled when RTS is raised) */
                 up->port.status |= UPSTAT_AUTOCTS | UPSTAT_AUTORTS;
                 priv->efr |= UART_EFR_CTS;
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 20ebaea5c414..bc51b32b2774 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1950,6 +1950,43 @@ pci_wch_ch38x_setup(struct serial_private *priv,
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7954        0x7954
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7958        0x7958
 
+#define PCI_VENDOR_ID_ACCESIO                   0x494f
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB     0x1051
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S      0x1053
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB     0x105C
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S      0x105E
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB   0x1091
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2    0x1093
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB   0x1099
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4    0x109B
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB    0x10D1
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM     0x10D3
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB    0x10DA
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM     0x10DC
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1    0x1108
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2    0x1110
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2    0x1111
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4    0x1118
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4    0x1119
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S       0x1152
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S       0x115A
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2     0x1190
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2    0x1191
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4     0x1198
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4    0x1199
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM      0x11D0
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4     0x105A
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4     0x105B
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8     0x106A
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM485_8     0x106B
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4     0x1098
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8     0x10A9
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM      0x10D9
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM      0x10E9
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM      0x11D8
+
+
+
 /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588
@@ -5113,6 +5150,108 @@ static struct pci_device_id serial_pci_tbl[] = {
                 0,
                 0, pbn_pericom_PI7C9X7958 },
         /*
+         * ACCES I/O Products quad
+         */
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_8,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        /*
          * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke)
          */
         {       PCI_VENDOR_ID_TOPIC, PCI_DEVICE_ID_TOPIC_TP560,
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 7481b95c6d84..bdfa659b9606 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -1618,8 +1618,6 @@ static void serial8250_disable_ms(struct uart_port *port)
         if (up->bugs & UART_BUG_NOMSR)
                 return;
 
-        mctrl_gpio_disable_ms(up->gpios);
-
         up->ier &= ~UART_IER_MSI;
         serial_port_out(port, UART_IER, up->ier);
 }
@@ -1632,8 +1630,6 @@ static void serial8250_enable_ms(struct uart_port *port)
         if (up->bugs & UART_BUG_NOMSR)
                 return;
 
-        mctrl_gpio_enable_ms(up->gpios);
-
         up->ier |= UART_IER_MSI;
 
         serial8250_rpm_get(up);
@@ -1917,8 +1913,7 @@ unsigned int serial8250_do_get_mctrl(struct uart_port *port)
                 ret |= TIOCM_DSR;
         if (status & UART_MSR_CTS)
                 ret |= TIOCM_CTS;
-
-        return mctrl_gpio_get(up->gpios, &ret);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(serial8250_do_get_mctrl);
 
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index c9ec839a5ddf..7c6f7afca5dd 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -6,7 +6,6 @@
 config SERIAL_8250
         tristate "8250/16550 and compatible serial support"
         select SERIAL_CORE
-        select SERIAL_MCTRL_GPIO if GPIOLIB
         ---help---
           This selects whether you want to include the driver for the standard
           serial ports.  The standard answer is Y.  People who might say N
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 065f5d97aa67..b93356834bb5 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -949,6 +949,15 @@ static int isr_setup_status_phase(struct ci_hdrc *ci)
         int retval;
         struct ci_hw_ep *hwep;
 
+        /*
+         * Unexpected USB controller behavior, caused by bad signal integrity
+         * or ground reference problems, can lead to isr_setup_status_phase
+         * being called with ci->status equal to NULL.
+         * If this situation occurs, you should review your USB hardware design.
+         */
+        if (WARN_ON_ONCE(!ci->status))
+                return -EPIPE;
+
         hwep = (ci->ep0_dir == TX) ? ci->ep0out : ci->ep0in;
         ci->status->context = ci;
         ci->status->complete = isr_setup_status_complete;
@@ -1596,8 +1605,11 @@ static int ci_udc_pullup(struct usb_gadget *_gadget, int is_on)
 {
         struct ci_hdrc *ci = container_of(_gadget, struct ci_hdrc, gadget);
 
-        /* Data+ pullup controlled by OTG state machine in OTG fsm mode */
-        if (ci_otg_is_fsm_mode(ci))
+        /*
+         * Data+ pullup controlled by OTG state machine in OTG fsm mode;
+         * and don't touch Data+ in host mode for dual role config.
+         */
+        if (ci_otg_is_fsm_mode(ci) || ci->role == CI_ROLE_HOST)
                 return 0;
 
         pm_runtime_get_sync(&ci->gadget.dev);
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 051163189810..15ce4ab11688 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -187,7 +187,7 @@ static const unsigned short high_speed_maxpacket_maxes[4] = {
         [USB_ENDPOINT_XFER_CONTROL] = 64,
         [USB_ENDPOINT_XFER_ISOC] = 1024,
         [USB_ENDPOINT_XFER_BULK] = 512,
-        [USB_ENDPOINT_XFER_INT] = 1023,
+        [USB_ENDPOINT_XFER_INT] = 1024,
 };
 static const unsigned short super_speed_maxpacket_maxes[4] = {
         [USB_ENDPOINT_XFER_CONTROL] = 512,
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index e6a6d67c8705..09c8d9ca61ae 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1709,11 +1709,17 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
         as->urb->start_frame = uurb->start_frame;
         as->urb->number_of_packets = number_of_packets;
         as->urb->stream_id = stream_id;
-        if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
-                        ps->dev->speed == USB_SPEED_HIGH)
-                as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
-        else
-                as->urb->interval = ep->desc.bInterval;
+
+        if (ep->desc.bInterval) {
+                if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
+                                ps->dev->speed == USB_SPEED_HIGH ||
+                                ps->dev->speed >= USB_SPEED_SUPER)
+                        as->urb->interval = 1 <<
+                                        min(15, ep->desc.bInterval - 1);
+                else
+                        as->urb->interval = ep->desc.bInterval;
+        }
+
         as->urb->context = as;
         as->urb->complete = async_completed;
         for (totlen = u = 0; u < number_of_packets; u++) {
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index 9fae0291cd69..d64551243789 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -868,6 +868,7 @@ struct dwc2_hsotg {
         void *priv;
         int     irq;
         struct clk *clk;
+        struct reset_control *reset;
 
         unsigned int queuing_high_bandwidth:1;
         unsigned int srp_success:1;
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index fc6f5251de5d..530959a8a6d1 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -45,6 +45,7 @@
 #include <linux/platform_device.h>
 #include <linux/phy/phy.h>
 #include <linux/platform_data/s3c-hsotg.h>
+#include <linux/reset.h>
 
 #include <linux/usb/of.h>
 
@@ -337,6 +338,24 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
 {
         int i, ret;
 
+        hsotg->reset = devm_reset_control_get_optional(hsotg->dev, "dwc2");
+        if (IS_ERR(hsotg->reset)) {
+                ret = PTR_ERR(hsotg->reset);
+                switch (ret) {
+                case -ENOENT:
+                case -ENOTSUPP:
+                        hsotg->reset = NULL;
+                        break;
+                default:
+                        dev_err(hsotg->dev, "error getting reset control %d\n",
+                                ret);
+                        return ret;
+                }
+        }
+
+        if (hsotg->reset)
+                reset_control_deassert(hsotg->reset);
+
         /* Set default UTMI width */
         hsotg->phyif = GUSBCFG_PHYIF16;
 
@@ -434,6 +453,9 @@ static int dwc2_driver_remove(struct platform_device *dev)
         if (hsotg->ll_hw_enabled)
                 dwc2_lowlevel_hw_disable(hsotg);
 
+        if (hsotg->reset)
+                reset_control_assert(hsotg->reset);
+
         return 0;
 }
 
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 946643157b78..35d092456bec 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1192,6 +1192,7 @@ static int dwc3_runtime_resume(struct device *dev)
         }
 
         pm_runtime_mark_last_busy(dev);
+        pm_runtime_put(dev);
 
         return 0;
 }
diff --git a/drivers/usb/dwc3/debug.h b/drivers/usb/dwc3/debug.h
index 22dfc3dd6a13..33ab2a203c1b 100644
--- a/drivers/usb/dwc3/debug.h
+++ b/drivers/usb/dwc3/debug.h
@@ -192,7 +192,7 @@ dwc3_ep_event_string(const struct dwc3_event_depevt *event)
         int ret;
 
         ret = sprintf(str, "ep%d%s: ", epnum >> 1,
-                        (epnum & 1) ? "in" : "in");
+                        (epnum & 1) ? "in" : "out");
         if (ret < 0)
                 return "UNKNOWN";
 
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 2eb84d6c24a6..6df0f5dad9a4 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -243,6 +243,15 @@ static int dwc3_pci_runtime_suspend(struct device *dev)
         return -EBUSY;
 }
 
+static int dwc3_pci_runtime_resume(struct device *dev)
+{
+        struct platform_device *dwc3 = dev_get_drvdata(dev);
+
+        return pm_runtime_get(&dwc3->dev);
+}
+#endif /* CONFIG_PM */
+
+#ifdef CONFIG_PM_SLEEP
 static int dwc3_pci_pm_dummy(struct device *dev)
 {
         /*
@@ -255,11 +264,11 @@ static int dwc3_pci_pm_dummy(struct device *dev)
          */
         return 0;
 }
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 
 static struct dev_pm_ops dwc3_pci_dev_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(dwc3_pci_pm_dummy, dwc3_pci_pm_dummy)
-        SET_RUNTIME_PM_OPS(dwc3_pci_runtime_suspend, dwc3_pci_pm_dummy,
+        SET_RUNTIME_PM_OPS(dwc3_pci_runtime_suspend, dwc3_pci_runtime_resume,
                 NULL)
 };
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 1f5597ef945d..122e64df2f4d 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1433,7 +1433,7 @@ static int dwc3_gadget_get_frame(struct usb_gadget *g)
 
 static int __dwc3_gadget_wakeup(struct dwc3 *dwc)
 {
-        unsigned long           timeout;
+        int                     retries;
 
         int                     ret;
         u32                     reg;
@@ -1484,9 +1484,9 @@ static int __dwc3_gadget_wakeup(struct dwc3 *dwc)
         }
 
         /* poll until Link State changes to ON */
-        timeout = jiffies + msecs_to_jiffies(100);
+        retries = 20000;
 
-        while (!time_after(jiffies, timeout)) {
+        while (retries--) {
                 reg = dwc3_readl(dwc->regs, DWC3_DSTS);
 
                 /* in HS, means ON */
diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
index d58bfc32be9e..007ec6e4a5d4 100644
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -341,11 +341,15 @@ static struct sk_buff *eem_wrap(struct gether *port, struct sk_buff *skb)
 {
         struct sk_buff  *skb2 = NULL;
         struct usb_ep   *in = port->in_ep;
-        int             padlen = 0;
-        u16             len = skb->len;
+        int             headroom, tailroom, padlen = 0;
+        u16             len;
 
-        int headroom = skb_headroom(skb);
-        int tailroom = skb_tailroom(skb);
+        if (!skb)
+                return NULL;
+
+        len = skb->len;
+        headroom = skb_headroom(skb);
+        tailroom = skb_tailroom(skb);
 
         /* When (len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) is 0,
          * stick two bytes of zero-length EEM packet on the end.
diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
index c8005823b190..16562e461121 100644
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -374,6 +374,9 @@ static struct sk_buff *rndis_add_header(struct gether *port,
 {
         struct sk_buff *skb2;
 
+        if (!skb)
+                return NULL;
+
         skb2 = skb_realloc_headroom(skb, sizeof(struct rndis_packet_msg_type));
         rndis_add_hdr(skb2);
 
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
index 6ded6345cd09..e0cd1e4c8892 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -375,10 +375,15 @@ __acquires(&port->port_lock)
 */
 {
         struct list_head        *pool = &port->write_pool;
-        struct usb_ep           *in = port->port_usb->in;
+        struct usb_ep           *in;
         int                     status = 0;
         bool                    do_tty_wake = false;
 
+        if (!port->port_usb)
+                return status;
+
+        in = port->port_usb->in;
+
         while (!port->write_busy && !list_empty(pool)) {
                 struct usb_request      *req;
                 int                     len;
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 934f83881c30..40c04bb25f2f 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -827,7 +827,7 @@ void usb_gadget_unmap_request_by_dev(struct device *dev,
                 return;
 
         if (req->num_mapped_sgs) {
-                dma_unmap_sg(dev, req->sg, req->num_mapped_sgs,
+                dma_unmap_sg(dev, req->sg, req->num_sgs,
                                 is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
 
                 req->num_mapped_sgs = 0;
diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
index cf8819a5c5b2..8bb011ea78f7 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
@@ -1878,11 +1878,8 @@ static int qe_get_frame(struct usb_gadget *gadget)
 
         tmp = in_be16(&udc->usb_param->frame_n);
         if (tmp & 0x8000)
-                tmp = tmp & 0x07ff;
-        else
-                tmp = -EINVAL;
-
-        return (int)tmp;
+                return tmp & 0x07ff;
+        return -EINVAL;
 }
 
 static int fsl_qe_start(struct usb_gadget *gadget,
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 93a3bec81df7..fb8fc34827ab 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -106,6 +106,7 @@
 
 /* DRD_CON */
 #define DRD_CON_PERI_CON        BIT(24)
+#define DRD_CON_VBOUT           BIT(0)
 
 /* USB_INT_ENA_1 and USB_INT_STA_1 */
 #define USB_INT_1_B3_PLLWKUP    BIT(31)
@@ -363,6 +364,7 @@ static void usb3_init_epc_registers(struct renesas_usb3 *usb3)
 {
         /* FIXME: How to change host / peripheral mode as well? */
         usb3_set_bit(usb3, DRD_CON_PERI_CON, USB3_DRD_CON);
+        usb3_clear_bit(usb3, DRD_CON_VBOUT, USB3_DRD_CON);
 
         usb3_write(usb3, ~0, USB3_USB_INT_STA_1);
         usb3_enable_irq_1(usb3, USB_INT_1_VBUS_CNG);
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index fd9fd12e4861..797137e26549 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -850,6 +850,10 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
         spin_lock_irqsave(&xhci->lock, flags);
 
         ep->stop_cmds_pending--;
+        if (xhci->xhc_state & XHCI_STATE_REMOVING) {
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                return;
+        }
         if (xhci->xhc_state & XHCI_STATE_DYING) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                                 "Stop EP timer ran, but another timer marked "
@@ -903,7 +907,7 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
         spin_unlock_irqrestore(&xhci->lock, flags);
         xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                         "Calling usb_hc_died()");
-        usb_hc_died(xhci_to_hcd(xhci)->primary_hcd);
+        usb_hc_died(xhci_to_hcd(xhci));
         xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                         "xHCI host controller is dead.");
 }
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index 192248f974ec..fe08e776fec3 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -290,6 +290,7 @@ int musb_hub_control(
         u32             temp;
         int             retval = 0;
         unsigned long   flags;
+        bool            start_musb = false;
 
         spin_lock_irqsave(&musb->lock, flags);
 
@@ -390,7 +391,7 @@ int musb_hub_control(
                          * logic relating to VBUS power-up.
                          */
                         if (!hcd->self.is_b_host && musb_has_gadget(musb))
-                                musb_start(musb);
+                                start_musb = true;
                         break;
                 case USB_PORT_FEAT_RESET:
                         musb_port_reset(musb, true);
@@ -451,5 +452,9 @@ error:
                 retval = -EPIPE;
         }
         spin_unlock_irqrestore(&musb->lock, flags);
+
+        if (start_musb)
+                musb_start(musb);
+
         return retval;
 }
diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c
index 980c9dee09eb..427efb5eebae 100644
--- a/drivers/usb/phy/phy-generic.c
+++ b/drivers/usb/phy/phy-generic.c
@@ -144,14 +144,18 @@ static irqreturn_t nop_gpio_vbus_thread(int irq, void *data)
 int usb_gen_phy_init(struct usb_phy *phy)
 {
         struct usb_phy_generic *nop = dev_get_drvdata(phy->dev);
+        int ret;
 
         if (!IS_ERR(nop->vcc)) {
                 if (regulator_enable(nop->vcc))
                         dev_err(phy->dev, "Failed to enable power\n");
         }
 
-        if (!IS_ERR(nop->clk))
-                clk_prepare_enable(nop->clk);
+        if (!IS_ERR(nop->clk)) {
+                ret = clk_prepare_enable(nop->clk);
+                if (ret)
+                        return ret;
+        }
 
         nop_reset(nop);
 
diff --git a/drivers/usb/renesas_usbhs/mod.c b/drivers/usb/renesas_usbhs/mod.c
index d4be5d594896..28965ef4f824 100644
--- a/drivers/usb/renesas_usbhs/mod.c
+++ b/drivers/usb/renesas_usbhs/mod.c
@@ -282,9 +282,16 @@ static irqreturn_t usbhs_interrupt(int irq, void *data)
         if (usbhs_mod_is_host(priv))
                 usbhs_write(priv, INTSTS1, ~irq_state.intsts1 & INTSTS1_MAGIC);
 
-        usbhs_write(priv, BRDYSTS, ~irq_state.brdysts);
+        /*
+         * The driver should not clear the xxxSTS after the line of
+         * "call irq callback functions" because each "if" statement is
+         * possible to call the callback function for avoiding any side effects.
+         */
+        if (irq_state.intsts0 & BRDY)
+                usbhs_write(priv, BRDYSTS, ~irq_state.brdysts);
         usbhs_write(priv, NRDYSTS, ~irq_state.nrdysts);
-        usbhs_write(priv, BEMPSTS, ~irq_state.bempsts);
+        if (irq_state.intsts0 & BEMP)
+                usbhs_write(priv, BEMPSTS, ~irq_state.bempsts);
 
         /*
          * call irq callback functions
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index 92bc83b92d10..c4c64740a3e7 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -1076,7 +1076,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv)
 
         gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED);
         dev_info(dev, "%stransceiver found\n",
-                 gpriv->transceiver ? "" : "no ");
+                 !IS_ERR(gpriv->transceiver) ? "" : "no ");
 
         /*
          * CAUTION
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 5608af4a369d..de9992b492b0 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -1252,7 +1252,7 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port,
 
         if (urb->transfer_buffer == NULL) {
                 urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
-                                               GFP_KERNEL);
+                                               GFP_ATOMIC);
                 if (!urb->transfer_buffer)
                         goto exit;
         }
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index ed378fb232e7..57426d703a09 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1340,8 +1340,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
         }
 
         if (urb->transfer_buffer == NULL) {
-                urb->transfer_buffer =
-                    kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL);
+                urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
+                                               GFP_ATOMIC);
                 if (!urb->transfer_buffer)
                         goto exit;
         }
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index bc472584a229..9894e341c6ac 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -525,6 +525,12 @@ static void option_instat_callback(struct urb *urb);
 #define VIATELECOM_VENDOR_ID                    0x15eb
 #define VIATELECOM_PRODUCT_CDS7                 0x0001
 
+/* WeTelecom products */
+#define WETELECOM_VENDOR_ID                     0x22de
+#define WETELECOM_PRODUCT_WMD200                0x6801
+#define WETELECOM_PRODUCT_6802                  0x6802
+#define WETELECOM_PRODUCT_WMD300                0x6803
+
 struct option_blacklist_info {
         /* bitmask of interface numbers blacklisted for send_setup */
         const unsigned long sendsetup;
@@ -1991,6 +1997,9 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                /* OLICARD300 - MT6225 */
         { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
         { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+        { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 9d6320e8ff3e..6e29d053843d 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -88,7 +88,7 @@ struct vhost_scsi_cmd {
         struct scatterlist *tvc_prot_sgl;
         struct page **tvc_upages;
         /* Pointer to response header iovec */
-        struct iovec *tvc_resp_iov;
+        struct iovec tvc_resp_iov;
         /* Pointer to vhost_scsi for our device */
         struct vhost_scsi *tvc_vhost;
         /* Pointer to vhost_virtqueue for the cmd */
@@ -547,7 +547,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
                 memcpy(v_rsp.sense, cmd->tvc_sense_buf,
                        se_cmd->scsi_sense_length);
 
-                iov_iter_init(&iov_iter, READ, cmd->tvc_resp_iov,
+                iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov,
                               cmd->tvc_in_iovs, sizeof(v_rsp));
                 ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter);
                 if (likely(ret == sizeof(v_rsp))) {
@@ -1044,7 +1044,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
                 }
                 cmd->tvc_vhost = vs;
                 cmd->tvc_vq = vq;
-                cmd->tvc_resp_iov = &vq->iov[out];
+                cmd->tvc_resp_iov = vq->iov[out];
                 cmd->tvc_in_iovs = in;
 
                 pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n",
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index e383ecdaca59..ed9c9eeedfe5 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -167,7 +167,7 @@ static bool vring_use_dma_api(struct virtio_device *vdev)
  * making all of the arch DMA ops work on the vring device itself
  * is a mess.  For now, we use the parent device for DMA ops.
  */
-struct device *vring_dma_dev(const struct vring_virtqueue *vq)
+static struct device *vring_dma_dev(const struct vring_virtqueue *vq)
 {
         return vq->vq.vdev->dev.parent;
 }
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 7487971f9f78..c1010f018bd8 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsigned msg_type,
                         rc = -ENOMEM;
                         goto out;
                 }
-        } else {
+        } else if (msg_type == XS_TRANSACTION_END) {
                 list_for_each_entry(trans, &u->transactions, list)
                         if (trans->handle.id == u->u.msg.tx_id)
                                 break;
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 7f6aff3f72eb..e5495f37c6ed 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -853,6 +853,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
                 current->flags |= PF_RANDOMIZE;
 
         setup_new_exec(bprm);
+        install_exec_creds(bprm);
 
         /* Do this so that we can load the interpreter, if need be.  We will
            change some of these later */
@@ -1044,7 +1045,6 @@ static int load_elf_binary(struct linux_binprm *bprm)
                 goto out;
 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 
-        install_exec_creds(bprm);
         retval = create_elf_tables(bprm, &loc->elf_ex,
                           load_addr, interp_load_addr);
         if (retval < 0)
diff --git a/fs/block_dev.c b/fs/block_dev.c
index c3cdde87cc8c..08ae99343d92 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -249,7 +249,8 @@ struct super_block *freeze_bdev(struct block_device *bdev)
                  * thaw_bdev drops it.
                  */
                 sb = get_super(bdev);
-                drop_super(sb);
+                if (sb)
+                        drop_super(sb);
                 mutex_unlock(&bdev->bd_fsfreeze_mutex);
                 return sb;
         }
@@ -646,7 +647,7 @@ static struct dentry *bd_mount(struct file_system_type *fs_type,
 {
         struct dentry *dent;
         dent = mount_pseudo(fs_type, "bdev:", &bdev_sops, NULL, BDEVFS_MAGIC);
-        if (dent)
+        if (!IS_ERR(dent))
                 dent->d_sb->s_iflags |= SB_I_CGROUPWB;
         return dent;
 }
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 2b88439c2ee8..455a6b2fd539 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -589,6 +589,7 @@ static void __merge_refs(struct list_head *head, int mode)
 
                         list_del(&ref2->list);
                         kmem_cache_free(btrfs_prelim_ref_cache, ref2);
+                        cond_resched();
                 }
 
         }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 2fe8f89091a3..33fe03551105 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -427,6 +427,7 @@ struct btrfs_space_info {
         struct list_head ro_bgs;
         struct list_head priority_tickets;
         struct list_head tickets;
+        u64 tickets_id;
 
         struct rw_semaphore groups_sem;
         /* for block groups in our same type */
@@ -1028,6 +1029,7 @@ struct btrfs_fs_info {
         struct btrfs_workqueue *qgroup_rescan_workers;
         struct completion qgroup_rescan_completion;
         struct btrfs_work qgroup_rescan_work;
+        bool qgroup_rescan_running;     /* protected by qgroup_rescan_lock */
 
         /* filesystem state */
         unsigned long fs_state;
@@ -1079,6 +1081,8 @@ struct btrfs_fs_info {
         struct list_head pinned_chunks;
 
         int creating_free_space_tree;
+        /* Used to record internally whether fs has been frozen */
+        int fs_frozen;
 };
 
 struct btrfs_subvolume_writers {
@@ -2578,7 +2582,7 @@ int btrfs_alloc_logged_file_extent(struct btrfs_trans_handle *trans,
                                    struct btrfs_root *root,
                                    u64 root_objectid, u64 owner, u64 offset,
                                    struct btrfs_key *ins);
-int btrfs_reserve_extent(struct btrfs_root *root, u64 num_bytes,
+int btrfs_reserve_extent(struct btrfs_root *root, u64 ram_bytes, u64 num_bytes,
                          u64 min_alloc_size, u64 empty_size, u64 hint_byte,
                          struct btrfs_key *ins, int is_data, int delalloc);
 int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
index d9ddcfc18c91..ac02e041464b 100644
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
@@ -541,7 +541,6 @@ add_delayed_ref_head(struct btrfs_fs_info *fs_info,
         struct btrfs_delayed_ref_head *existing;
         struct btrfs_delayed_ref_head *head_ref = NULL;
         struct btrfs_delayed_ref_root *delayed_refs;
-        struct btrfs_qgroup_extent_record *qexisting;
         int count_mod = 1;
         int must_insert_reserved = 0;
 
@@ -606,10 +605,8 @@ add_delayed_ref_head(struct btrfs_fs_info *fs_info,
                 qrecord->num_bytes = num_bytes;
                 qrecord->old_roots = NULL;
 
-                qexisting = btrfs_qgroup_insert_dirty_extent(fs_info,
-                                                             delayed_refs,
-                                                             qrecord);
-                if (qexisting)
+                if(btrfs_qgroup_insert_dirty_extent_nolock(fs_info,
+                                        delayed_refs, qrecord))
                         kfree(qrecord);
         }
 
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 59febfb8d04a..54bc8c7c6bcd 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -559,8 +559,29 @@ static noinline int check_leaf(struct btrfs_root *root,
         u32 nritems = btrfs_header_nritems(leaf);
         int slot;
 
-        if (nritems == 0)
+        if (nritems == 0) {
+                struct btrfs_root *check_root;
+
+                key.objectid = btrfs_header_owner(leaf);
+                key.type = BTRFS_ROOT_ITEM_KEY;
+                key.offset = (u64)-1;
+
+                check_root = btrfs_get_fs_root(root->fs_info, &key, false);
+                /*
+                 * The only reason we also check NULL here is that during
+                 * open_ctree() some roots has not yet been set up.
+                 */
+                if (!IS_ERR_OR_NULL(check_root)) {
+                        /* if leaf is the root, then it's fine */
+                        if (leaf->start !=
+                            btrfs_root_bytenr(&check_root->root_item)) {
+                                CORRUPT("non-root leaf's nritems is 0",
+                                        leaf, root, 0);
+                                return -EIO;
+                        }
+                }
                 return 0;
+        }
 
         /* Check the 0 item */
         if (btrfs_item_offset_nr(leaf, 0) + btrfs_item_size_nr(leaf, 0) !=
@@ -612,6 +633,19 @@ static noinline int check_leaf(struct btrfs_root *root,
         return 0;
 }
 
+static int check_node(struct btrfs_root *root, struct extent_buffer *node)
+{
+        unsigned long nr = btrfs_header_nritems(node);
+
+        if (nr == 0 || nr > BTRFS_NODEPTRS_PER_BLOCK(root)) {
+                btrfs_crit(root->fs_info,
+                           "corrupt node: block %llu root %llu nritems %lu",
+                           node->start, root->objectid, nr);
+                return -EIO;
+        }
+        return 0;
+}
+
 static int btree_readpage_end_io_hook(struct btrfs_io_bio *io_bio,
                                       u64 phy_offset, struct page *page,
                                       u64 start, u64 end, int mirror)
@@ -682,6 +716,9 @@ static int btree_readpage_end_io_hook(struct btrfs_io_bio *io_bio,
                 ret = -EIO;
         }
 
+        if (found_level > 0 && check_node(root, eb))
+                ret = -EIO;
+
         if (!ret)
                 set_extent_buffer_uptodate(eb);
 err:
@@ -1618,8 +1655,8 @@ fail:
         return ret;
 }
 
-static struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
-                                               u64 root_id)
+struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
+                                        u64 root_id)
 {
         struct btrfs_root *root;
 
@@ -2298,6 +2335,7 @@ static void btrfs_init_qgroup(struct btrfs_fs_info *fs_info)
         fs_info->quota_enabled = 0;
         fs_info->pending_quota_state = 0;
         fs_info->qgroup_ulist = NULL;
+        fs_info->qgroup_rescan_running = false;
         mutex_init(&fs_info->qgroup_rescan_lock);
 }
 
@@ -2624,6 +2662,7 @@ int open_ctree(struct super_block *sb,
         atomic_set(&fs_info->qgroup_op_seq, 0);
         atomic_set(&fs_info->reada_works_cnt, 0);
         atomic64_set(&fs_info->tree_mod_seq, 0);
+        fs_info->fs_frozen = 0;
         fs_info->sb = sb;
         fs_info->max_inline = BTRFS_DEFAULT_MAX_INLINE;
         fs_info->metadata_ratio = 0;
@@ -3739,8 +3778,15 @@ void btrfs_drop_and_free_fs_root(struct btrfs_fs_info *fs_info,
         if (btrfs_root_refs(&root->root_item) == 0)
                 synchronize_srcu(&fs_info->subvol_srcu);
 
-        if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state))
+        if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state)) {
                 btrfs_free_log(NULL, root);
+                if (root->reloc_root) {
+                        free_extent_buffer(root->reloc_root->node);
+                        free_extent_buffer(root->reloc_root->commit_root);
+                        btrfs_put_fs_root(root->reloc_root);
+                        root->reloc_root = NULL;
+                }
+        }
 
         if (root->free_ino_pinned)
                 __btrfs_remove_free_space_cache(root->free_ino_pinned);
@@ -3851,7 +3897,7 @@ void close_ctree(struct btrfs_root *root)
         smp_mb();
 
         /* wait for the qgroup rescan worker to stop */
-        btrfs_qgroup_wait_for_completion(fs_info);
+        btrfs_qgroup_wait_for_completion(fs_info, false);
 
         /* wait for the uuid_scan task to finish */
         down(&fs_info->uuid_tree_rescan_sem);
diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
index b3207a0e09f7..f19a982f5a4f 100644
--- a/fs/btrfs/disk-io.h
+++ b/fs/btrfs/disk-io.h
@@ -68,6 +68,8 @@ struct extent_buffer *btrfs_find_tree_block(struct btrfs_fs_info *fs_info,
 struct btrfs_root *btrfs_read_fs_root(struct btrfs_root *tree_root,
                                       struct btrfs_key *location);
 int btrfs_init_fs_root(struct btrfs_root *root);
+struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
+                                        u64 root_id);
 int btrfs_insert_fs_root(struct btrfs_fs_info *fs_info,
                          struct btrfs_root *root);
 void btrfs_free_fs_roots(struct btrfs_fs_info *fs_info);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 61b494e8e604..38c2df84cabd 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -60,21 +60,6 @@ enum {
         CHUNK_ALLOC_FORCE = 2,
 };
 
-/*
- * Control how reservations are dealt with.
- *
- * RESERVE_FREE - freeing a reservation.
- * RESERVE_ALLOC - allocating space and we need to update bytes_may_use for
- *   ENOSPC accounting
- * RESERVE_ALLOC_NO_ACCOUNT - allocating space and we should not update
- *   bytes_may_use as the ENOSPC accounting is done elsewhere
- */
-enum {
-        RESERVE_FREE = 0,
-        RESERVE_ALLOC = 1,
-        RESERVE_ALLOC_NO_ACCOUNT = 2,
-};
-
 static int update_block_group(struct btrfs_trans_handle *trans,
                               struct btrfs_root *root, u64 bytenr,
                               u64 num_bytes, int alloc);
@@ -104,9 +89,10 @@ static int find_next_key(struct btrfs_path *path, int level,
                          struct btrfs_key *key);
 static void dump_space_info(struct btrfs_space_info *info, u64 bytes,
                             int dump_block_groups);
-static int btrfs_update_reserved_bytes(struct btrfs_block_group_cache *cache,
-                                       u64 num_bytes, int reserve,
-                                       int delalloc);
+static int btrfs_add_reserved_bytes(struct btrfs_block_group_cache *cache,
+                                    u64 ram_bytes, u64 num_bytes, int delalloc);
+static int btrfs_free_reserved_bytes(struct btrfs_block_group_cache *cache,
+                                     u64 num_bytes, int delalloc);
 static int block_rsv_use_bytes(struct btrfs_block_rsv *block_rsv,
                                u64 num_bytes);
 int btrfs_pin_extent(struct btrfs_root *root,
@@ -3501,7 +3487,6 @@ again:
                 dcs = BTRFS_DC_SETUP;
         else if (ret == -ENOSPC)
                 set_bit(BTRFS_TRANS_CACHE_ENOSPC, &trans->transaction->flags);
-        btrfs_free_reserved_data_space(inode, 0, num_pages);
 
 out_put:
         iput(inode);
@@ -4472,6 +4457,15 @@ void check_system_chunk(struct btrfs_trans_handle *trans,
         }
 }
 
+/*
+ * If force is CHUNK_ALLOC_FORCE:
+ *    - return 1 if it successfully allocates a chunk,
+ *    - return errors including -ENOSPC otherwise.
+ * If force is NOT CHUNK_ALLOC_FORCE:
+ *    - return 0 if it doesn't need to allocate a new chunk,
+ *    - return 1 if it successfully allocates a chunk,
+ *    - return errors including -ENOSPC otherwise.
+ */
 static int do_chunk_alloc(struct btrfs_trans_handle *trans,
                           struct btrfs_root *extent_root, u64 flags, int force)
 {
@@ -4882,7 +4876,7 @@ static int flush_space(struct btrfs_root *root,
                                      btrfs_get_alloc_profile(root, 0),
                                      CHUNK_ALLOC_NO_FORCE);
                 btrfs_end_transaction(trans, root);
-                if (ret == -ENOSPC)
+                if (ret > 0 || ret == -ENOSPC)
                         ret = 0;
                 break;
         case COMMIT_TRANS:
@@ -4907,11 +4901,6 @@ btrfs_calc_reclaim_metadata_size(struct btrfs_root *root,
         u64 expected;
         u64 to_reclaim = 0;
 
-        to_reclaim = min_t(u64, num_online_cpus() * SZ_1M, SZ_16M);
-        if (can_overcommit(root, space_info, to_reclaim,
-                           BTRFS_RESERVE_FLUSH_ALL))
-                return 0;
-
         list_for_each_entry(ticket, &space_info->tickets, list)
                 to_reclaim += ticket->bytes;
         list_for_each_entry(ticket, &space_info->priority_tickets, list)
@@ -4919,6 +4908,11 @@ btrfs_calc_reclaim_metadata_size(struct btrfs_root *root,
         if (to_reclaim)
                 return to_reclaim;
 
+        to_reclaim = min_t(u64, num_online_cpus() * SZ_1M, SZ_16M);
+        if (can_overcommit(root, space_info, to_reclaim,
+                           BTRFS_RESERVE_FLUSH_ALL))
+                return 0;
+
         used = space_info->bytes_used + space_info->bytes_reserved +
                space_info->bytes_pinned + space_info->bytes_readonly +
                space_info->bytes_may_use;
@@ -4972,12 +4966,12 @@ static void wake_all_tickets(struct list_head *head)
  */
 static void btrfs_async_reclaim_metadata_space(struct work_struct *work)
 {
-        struct reserve_ticket *last_ticket = NULL;
         struct btrfs_fs_info *fs_info;
         struct btrfs_space_info *space_info;
         u64 to_reclaim;
         int flush_state;
         int commit_cycles = 0;
+        u64 last_tickets_id;
 
         fs_info = container_of(work, struct btrfs_fs_info, async_reclaim_work);
         space_info = __find_space_info(fs_info, BTRFS_BLOCK_GROUP_METADATA);
@@ -4990,8 +4984,7 @@ static void btrfs_async_reclaim_metadata_space(struct work_struct *work)
                 spin_unlock(&space_info->lock);
                 return;
         }
-        last_ticket = list_first_entry(&space_info->tickets,
-                                       struct reserve_ticket, list);
+        last_tickets_id = space_info->tickets_id;
         spin_unlock(&space_info->lock);
 
         flush_state = FLUSH_DELAYED_ITEMS_NR;
@@ -5011,10 +5004,10 @@ static void btrfs_async_reclaim_metadata_space(struct work_struct *work)
                                                               space_info);
                 ticket = list_first_entry(&space_info->tickets,
                                           struct reserve_ticket, list);
-                if (last_ticket == ticket) {
+                if (last_tickets_id == space_info->tickets_id) {
                         flush_state++;
                 } else {
-                        last_ticket = ticket;
+                        last_tickets_id = space_info->tickets_id;
                         flush_state = FLUSH_DELAYED_ITEMS_NR;
                         if (commit_cycles)
                                 commit_cycles--;
@@ -5390,6 +5383,7 @@ again:
                         list_del_init(&ticket->list);
                         num_bytes -= ticket->bytes;
                         ticket->bytes = 0;
+                        space_info->tickets_id++;
                         wake_up(&ticket->wait);
                 } else {
                         ticket->bytes -= num_bytes;
@@ -5432,6 +5426,7 @@ again:
                         num_bytes -= ticket->bytes;
                         space_info->bytes_may_use += ticket->bytes;
                         ticket->bytes = 0;
+                        space_info->tickets_id++;
                         wake_up(&ticket->wait);
                 } else {
                         trace_btrfs_space_reservation(fs_info, "space_info",
@@ -6497,19 +6492,15 @@ void btrfs_wait_block_group_reservations(struct btrfs_block_group_cache *bg)
 }
 
 /**
- * btrfs_update_reserved_bytes - update the block_group and space info counters
+ * btrfs_add_reserved_bytes - update the block_group and space info counters
  * @cache:      The cache we are manipulating
+ * @ram_bytes:  The number of bytes of file content, and will be same to
+ *              @num_bytes except for the compress path.
  * @num_bytes:  The number of bytes in question
- * @reserve:    One of the reservation enums
  * @delalloc:   The blocks are allocated for the delalloc write
  *
- * This is called by the allocator when it reserves space, or by somebody who is
- * freeing space that was never actually used on disk.  For example if you
- * reserve some space for a new leaf in transaction A and before transaction A
- * commits you free that leaf, you call this with reserve set to 0 in order to
- * clear the reservation.
- *
- * Metadata reservations should be called with RESERVE_ALLOC so we do the proper
+ * This is called by the allocator when it reserves space. Metadata
+ * reservations should be called with RESERVE_ALLOC so we do the proper
  * ENOSPC accounting.  For data we handle the reservation through clearing the
  * delalloc bits in the io_tree.  We have to do this since we could end up
  * allocating less disk space for the amount of data we have reserved in the
@@ -6519,44 +6510,63 @@ void btrfs_wait_block_group_reservations(struct btrfs_block_group_cache *bg)
  * make the reservation and return -EAGAIN, otherwise this function always
  * succeeds.
  */
-static int btrfs_update_reserved_bytes(struct btrfs_block_group_cache *cache,
-                                       u64 num_bytes, int reserve, int delalloc)
+static int btrfs_add_reserved_bytes(struct btrfs_block_group_cache *cache,
+                                    u64 ram_bytes, u64 num_bytes, int delalloc)
 {
         struct btrfs_space_info *space_info = cache->space_info;
         int ret = 0;
 
         spin_lock(&space_info->lock);
         spin_lock(&cache->lock);
-        if (reserve != RESERVE_FREE) {
-                if (cache->ro) {
-                        ret = -EAGAIN;
-                } else {
-                        cache->reserved += num_bytes;
-                        space_info->bytes_reserved += num_bytes;
-                        if (reserve == RESERVE_ALLOC) {
-                                trace_btrfs_space_reservation(cache->fs_info,
-                                                "space_info", space_info->flags,
-                                                num_bytes, 0);
-                                space_info->bytes_may_use -= num_bytes;
-                        }
-
-                        if (delalloc)
-                                cache->delalloc_bytes += num_bytes;
-                }
+        if (cache->ro) {
+                ret = -EAGAIN;
         } else {
-                if (cache->ro)
-                        space_info->bytes_readonly += num_bytes;
-                cache->reserved -= num_bytes;
-                space_info->bytes_reserved -= num_bytes;
+                cache->reserved += num_bytes;
+                space_info->bytes_reserved += num_bytes;
 
+                trace_btrfs_space_reservation(cache->fs_info,
+                                "space_info", space_info->flags,
+                                ram_bytes, 0);
+                space_info->bytes_may_use -= ram_bytes;
                 if (delalloc)
-                        cache->delalloc_bytes -= num_bytes;
+                        cache->delalloc_bytes += num_bytes;
         }
         spin_unlock(&cache->lock);
         spin_unlock(&space_info->lock);
         return ret;
 }
 
+/**
+ * btrfs_free_reserved_bytes - update the block_group and space info counters
+ * @cache:      The cache we are manipulating
+ * @num_bytes:  The number of bytes in question
+ * @delalloc:   The blocks are allocated for the delalloc write
+ *
+ * This is called by somebody who is freeing space that was never actually used
+ * on disk.  For example if you reserve some space for a new leaf in transaction
+ * A and before transaction A commits you free that leaf, you call this with
+ * reserve set to 0 in order to clear the reservation.
+ */
+
+static int btrfs_free_reserved_bytes(struct btrfs_block_group_cache *cache,
+                                     u64 num_bytes, int delalloc)
+{
+        struct btrfs_space_info *space_info = cache->space_info;
+        int ret = 0;
+
+        spin_lock(&space_info->lock);
+        spin_lock(&cache->lock);
+        if (cache->ro)
+                space_info->bytes_readonly += num_bytes;
+        cache->reserved -= num_bytes;
+        space_info->bytes_reserved -= num_bytes;
+
+        if (delalloc)
+                cache->delalloc_bytes -= num_bytes;
+        spin_unlock(&cache->lock);
+        spin_unlock(&space_info->lock);
+        return ret;
+}
 void btrfs_prepare_extent_commit(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root)
 {
@@ -7191,7 +7201,7 @@ void btrfs_free_tree_block(struct btrfs_trans_handle *trans,
                 WARN_ON(test_bit(EXTENT_BUFFER_DIRTY, &buf->bflags));
 
                 btrfs_add_free_space(cache, buf->start, buf->len);
-                btrfs_update_reserved_bytes(cache, buf->len, RESERVE_FREE, 0);
+                btrfs_free_reserved_bytes(cache, buf->len, 0);
                 btrfs_put_block_group(cache);
                 trace_btrfs_reserved_extent_free(root, buf->start, buf->len);
                 pin = 0;
@@ -7416,9 +7426,9 @@ btrfs_release_block_group(struct btrfs_block_group_cache *cache,
  * the free space extent currently.
  */
 static noinline int find_free_extent(struct btrfs_root *orig_root,
-                                     u64 num_bytes, u64 empty_size,
-                                     u64 hint_byte, struct btrfs_key *ins,
-                                     u64 flags, int delalloc)
+                                u64 ram_bytes, u64 num_bytes, u64 empty_size,
+                                u64 hint_byte, struct btrfs_key *ins,
+                                u64 flags, int delalloc)
 {
         int ret = 0;
         struct btrfs_root *root = orig_root->fs_info->extent_root;
@@ -7430,8 +7440,6 @@ static noinline int find_free_extent(struct btrfs_root *orig_root,
         struct btrfs_space_info *space_info;
         int loop = 0;
         int index = __get_raid_index(flags);
-        int alloc_type = (flags & BTRFS_BLOCK_GROUP_DATA) ?
-                RESERVE_ALLOC_NO_ACCOUNT : RESERVE_ALLOC;
         bool failed_cluster_refill = false;
         bool failed_alloc = false;
         bool use_cluster = true;
@@ -7763,8 +7771,8 @@ checks:
                                              search_start - offset);
                 BUG_ON(offset > search_start);
 
-                ret = btrfs_update_reserved_bytes(block_group, num_bytes,
-                                                  alloc_type, delalloc);
+                ret = btrfs_add_reserved_bytes(block_group, ram_bytes,
+                                num_bytes, delalloc);
                 if (ret == -EAGAIN) {
                         btrfs_add_free_space(block_group, offset, num_bytes);
                         goto loop;
@@ -7936,7 +7944,7 @@ again:
         up_read(&info->groups_sem);
 }
 
-int btrfs_reserve_extent(struct btrfs_root *root,
+int btrfs_reserve_extent(struct btrfs_root *root, u64 ram_bytes,
                          u64 num_bytes, u64 min_alloc_size,
                          u64 empty_size, u64 hint_byte,
                          struct btrfs_key *ins, int is_data, int delalloc)
@@ -7948,8 +7956,8 @@ int btrfs_reserve_extent(struct btrfs_root *root,
         flags = btrfs_get_alloc_profile(root, is_data);
 again:
         WARN_ON(num_bytes < root->sectorsize);
-        ret = find_free_extent(root, num_bytes, empty_size, hint_byte, ins,
-                               flags, delalloc);
+        ret = find_free_extent(root, ram_bytes, num_bytes, empty_size,
+                               hint_byte, ins, flags, delalloc);
         if (!ret && !is_data) {
                 btrfs_dec_block_group_reservations(root->fs_info,
                                                    ins->objectid);
@@ -7958,6 +7966,7 @@ again:
                         num_bytes = min(num_bytes >> 1, ins->offset);
                         num_bytes = round_down(num_bytes, root->sectorsize);
                         num_bytes = max(num_bytes, min_alloc_size);
+                        ram_bytes = num_bytes;
                         if (num_bytes == min_alloc_size)
                                 final_tried = true;
                         goto again;
@@ -7995,7 +8004,7 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root,
                 if (btrfs_test_opt(root->fs_info, DISCARD))
                         ret = btrfs_discard_extent(root, start, len, NULL);
                 btrfs_add_free_space(cache, start, len);
-                btrfs_update_reserved_bytes(cache, len, RESERVE_FREE, delalloc);
+                btrfs_free_reserved_bytes(cache, len, delalloc);
                 trace_btrfs_reserved_extent_free(root, start, len);
         }
 
@@ -8208,6 +8217,7 @@ int btrfs_alloc_logged_file_extent(struct btrfs_trans_handle *trans,
 {
         int ret;
         struct btrfs_block_group_cache *block_group;
+        struct btrfs_space_info *space_info;
 
         /*
          * Mixed block groups will exclude before processing the log so we only
@@ -8223,9 +8233,14 @@ int btrfs_alloc_logged_file_extent(struct btrfs_trans_handle *trans,
         if (!block_group)
                 return -EINVAL;
 
-        ret = btrfs_update_reserved_bytes(block_group, ins->offset,
-                                          RESERVE_ALLOC_NO_ACCOUNT, 0);
-        BUG_ON(ret); /* logic error */
+        space_info = block_group->space_info;
+        spin_lock(&space_info->lock);
+        spin_lock(&block_group->lock);
+        space_info->bytes_reserved += ins->offset;
+        block_group->reserved += ins->offset;
+        spin_unlock(&block_group->lock);
+        spin_unlock(&space_info->lock);
+
         ret = alloc_reserved_file_extent(trans, root, 0, root_objectid,
                                          0, owner, offset, ins, 1);
         btrfs_put_block_group(block_group);
@@ -8368,7 +8383,7 @@ struct extent_buffer *btrfs_alloc_tree_block(struct btrfs_trans_handle *trans,
         if (IS_ERR(block_rsv))
                 return ERR_CAST(block_rsv);
 
-        ret = btrfs_reserve_extent(root, blocksize, blocksize,
+        ret = btrfs_reserve_extent(root, blocksize, blocksize, blocksize,
                                    empty_size, hint, &ins, 0, 0);
         if (ret)
                 goto out_unuse;
@@ -8521,35 +8536,6 @@ reada:
         wc->reada_slot = slot;
 }
 
-/*
- * These may not be seen by the usual inc/dec ref code so we have to
- * add them here.
- */
-static int record_one_subtree_extent(struct btrfs_trans_handle *trans,
-                                     struct btrfs_root *root, u64 bytenr,
-                                     u64 num_bytes)
-{
-        struct btrfs_qgroup_extent_record *qrecord;
-        struct btrfs_delayed_ref_root *delayed_refs;
-
-        qrecord = kmalloc(sizeof(*qrecord), GFP_NOFS);
-        if (!qrecord)
-                return -ENOMEM;
-
-        qrecord->bytenr = bytenr;
-        qrecord->num_bytes = num_bytes;
-        qrecord->old_roots = NULL;
-
-        delayed_refs = &trans->transaction->delayed_refs;
-        spin_lock(&delayed_refs->lock);
-        if (btrfs_qgroup_insert_dirty_extent(trans->fs_info,
-                                             delayed_refs, qrecord))
-                kfree(qrecord);
-        spin_unlock(&delayed_refs->lock);
-
-        return 0;
-}
-
 static int account_leaf_items(struct btrfs_trans_handle *trans,
                               struct btrfs_root *root,
                               struct extent_buffer *eb)
@@ -8583,7 +8569,8 @@ static int account_leaf_items(struct btrfs_trans_handle *trans,
 
                 num_bytes = btrfs_file_extent_disk_num_bytes(eb, fi);
 
-                ret = record_one_subtree_extent(trans, root, bytenr, num_bytes);
+                ret = btrfs_qgroup_insert_dirty_extent(trans, root->fs_info,
+                                bytenr, num_bytes, GFP_NOFS);
                 if (ret)
                         return ret;
         }
@@ -8732,8 +8719,9 @@ walk_down:
                         btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
                         path->locks[level] = BTRFS_READ_LOCK_BLOCKING;
 
-                        ret = record_one_subtree_extent(trans, root, child_bytenr,
-                                                        root->nodesize);
+                        ret = btrfs_qgroup_insert_dirty_extent(trans,
+                                        root->fs_info, child_bytenr,
+                                        root->nodesize, GFP_NOFS);
                         if (ret)
                                 goto out;
                 }
@@ -9906,6 +9894,7 @@ static int find_first_block_group(struct btrfs_root *root,
                         } else {
                                 ret = 0;
                         }
+                        free_extent_map(em);
                         goto out;
                 }
                 path->slots[0]++;
@@ -9942,6 +9931,7 @@ void btrfs_put_block_group_cache(struct btrfs_fs_info *info)
                 block_group->iref = 0;
                 block_group->inode = NULL;
                 spin_unlock(&block_group->lock);
+                ASSERT(block_group->io_ctl.inode == NULL);
                 iput(inode);
                 last = block_group->key.objectid + block_group->key.offset;
                 btrfs_put_block_group(block_group);
@@ -9999,6 +9989,10 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
                         free_excluded_extents(info->extent_root, block_group);
 
                 btrfs_remove_free_space_cache(block_group);
+                ASSERT(list_empty(&block_group->dirty_list));
+                ASSERT(list_empty(&block_group->io_list));
+                ASSERT(list_empty(&block_group->bg_list));
+                ASSERT(atomic_read(&block_group->count) == 1);
                 btrfs_put_block_group(block_group);
 
                 spin_lock(&info->block_group_cache_lock);
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index bc2729a7612d..28cd88fccc7e 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -20,6 +20,7 @@
 #define EXTENT_DAMAGED          (1U << 14)
 #define EXTENT_NORESERVE        (1U << 15)
 #define EXTENT_QGROUP_RESERVED  (1U << 16)
+#define EXTENT_CLEAR_DATA_RESV  (1U << 17)
 #define EXTENT_IOBITS           (EXTENT_LOCKED | EXTENT_WRITEBACK)
 #define EXTENT_CTLBITS          (EXTENT_DO_ACCOUNTING | EXTENT_FIRST_DELALLOC)
 
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 5842423f8f47..fea31a4a6e36 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -2070,7 +2070,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
         }
         trans->sync = true;
 
-        btrfs_init_log_ctx(&ctx);
+        btrfs_init_log_ctx(&ctx, inode);
 
         ret = btrfs_log_dentry_safe(trans, root, dentry, start, end, &ctx);
         if (ret < 0) {
@@ -2675,6 +2675,7 @@ static long btrfs_fallocate(struct file *file, int mode,
 
         alloc_start = round_down(offset, blocksize);
         alloc_end = round_up(offset + len, blocksize);
+        cur_offset = alloc_start;
 
         /* Make sure we aren't being give some crap mode */
         if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
@@ -2767,7 +2768,6 @@ static long btrfs_fallocate(struct file *file, int mode,
 
         /* First, check if we exceed the qgroup limit */
         INIT_LIST_HEAD(&reserve_list);
-        cur_offset = alloc_start;
         while (1) {
                 em = btrfs_get_extent(inode, NULL, 0, cur_offset,
                                       alloc_end - cur_offset, 0);
@@ -2794,6 +2794,14 @@ static long btrfs_fallocate(struct file *file, int mode,
                                         last_byte - cur_offset);
                         if (ret < 0)
                                 break;
+                } else {
+                        /*
+                         * Do not need to reserve unwritten extent for this
+                         * range, free reserved data space first, otherwise
+                         * it'll result in false ENOSPC error.
+                         */
+                        btrfs_free_reserved_data_space(inode, cur_offset,
+                                last_byte - cur_offset);
                 }
                 free_extent_map(em);
                 cur_offset = last_byte;
@@ -2811,6 +2819,9 @@ static long btrfs_fallocate(struct file *file, int mode,
                                         range->start,
                                         range->len, 1 << inode->i_blkbits,
                                         offset + len, &alloc_hint);
+                else
+                        btrfs_free_reserved_data_space(inode, range->start,
+                                                       range->len);
                 list_del(&range->list);
                 kfree(range);
         }
@@ -2845,18 +2856,11 @@ out_unlock:
         unlock_extent_cached(&BTRFS_I(inode)->io_tree, alloc_start, locked_end,
                              &cached_state, GFP_KERNEL);
 out:
-        /*
-         * As we waited the extent range, the data_rsv_map must be empty
-         * in the range, as written data range will be released from it.
-         * And for prealloacted extent, it will also be released when
-         * its metadata is written.
-         * So this is completely used as cleanup.
-         */
-        btrfs_qgroup_free_data(inode, alloc_start, alloc_end - alloc_start);
         inode_unlock(inode);
         /* Let go of our reservation. */
-        btrfs_free_reserved_data_space(inode, alloc_start,
-                                       alloc_end - alloc_start);
+        if (ret != 0)
+                btrfs_free_reserved_data_space(inode, alloc_start,
+                                       alloc_end - cur_offset);
         return ret;
 }
 
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index aa6fabaee72e..359ee861b5a4 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -495,10 +495,9 @@ again:
         ret = btrfs_prealloc_file_range_trans(inode, trans, 0, 0, prealloc,
                                               prealloc, prealloc, &alloc_hint);
         if (ret) {
-                btrfs_delalloc_release_space(inode, 0, prealloc);
+                btrfs_delalloc_release_metadata(inode, prealloc);
                 goto out_put;
         }
-        btrfs_free_reserved_data_space(inode, 0, prealloc);
 
         ret = btrfs_write_out_ino_cache(root, trans, path, inode);
 out_put:
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 08dfc57e2270..e6811c42e41e 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -566,6 +566,8 @@ cont:
                                                      PAGE_SET_WRITEBACK |
                                                      page_error_op |
                                                      PAGE_END_WRITEBACK);
+                        btrfs_free_reserved_data_space_noquota(inode, start,
+                                                end - start + 1);
                         goto free_pages_out;
                 }
         }
@@ -742,7 +744,7 @@ retry:
                 lock_extent(io_tree, async_extent->start,
                             async_extent->start + async_extent->ram_size - 1);
 
-                ret = btrfs_reserve_extent(root,
+                ret = btrfs_reserve_extent(root, async_extent->ram_size,
                                            async_extent->compressed_size,
                                            async_extent->compressed_size,
                                            0, alloc_hint, &ins, 1, 1);
@@ -969,7 +971,8 @@ static noinline int cow_file_range(struct inode *inode,
                                      EXTENT_DEFRAG, PAGE_UNLOCK |
                                      PAGE_CLEAR_DIRTY | PAGE_SET_WRITEBACK |
                                      PAGE_END_WRITEBACK);
-
+                        btrfs_free_reserved_data_space_noquota(inode, start,
+                                                end - start + 1);
                         *nr_written = *nr_written +
                              (end - start + PAGE_SIZE) / PAGE_SIZE;
                         *page_started = 1;
@@ -989,7 +992,7 @@ static noinline int cow_file_range(struct inode *inode,
                 unsigned long op;
 
                 cur_alloc_size = disk_num_bytes;
-                ret = btrfs_reserve_extent(root, cur_alloc_size,
+                ret = btrfs_reserve_extent(root, cur_alloc_size, cur_alloc_size,
                                            root->sectorsize, 0, alloc_hint,
                                            &ins, 1, 1);
                 if (ret < 0)
@@ -1489,8 +1492,10 @@ out_check:
                 extent_clear_unlock_delalloc(inode, cur_offset,
                                              cur_offset + num_bytes - 1,
                                              locked_page, EXTENT_LOCKED |
-                                             EXTENT_DELALLOC, PAGE_UNLOCK |
-                                             PAGE_SET_PRIVATE2);
+                                             EXTENT_DELALLOC |
+                                             EXTENT_CLEAR_DATA_RESV,
+                                             PAGE_UNLOCK | PAGE_SET_PRIVATE2);
+
                 if (!nolock && nocow)
                         btrfs_end_write_no_snapshoting(root);
                 cur_offset = extent_end;
@@ -1807,7 +1812,9 @@ static void btrfs_clear_bit_hook(struct inode *inode,
                         return;
 
                 if (root->root_key.objectid != BTRFS_DATA_RELOC_TREE_OBJECTID
-                    && do_list && !(state->state & EXTENT_NORESERVE))
+                    && do_list && !(state->state & EXTENT_NORESERVE)
+                    && (*bits & (EXTENT_DO_ACCOUNTING |
+                    EXTENT_CLEAR_DATA_RESV)))
                         btrfs_free_reserved_data_space_noquota(inode,
                                         state->start, len);
 
@@ -7251,7 +7258,7 @@ static struct extent_map *btrfs_new_extent_direct(struct inode *inode,
         int ret;
 
         alloc_hint = get_extent_allocation_hint(inode, start, len);
-        ret = btrfs_reserve_extent(root, len, root->sectorsize, 0,
+        ret = btrfs_reserve_extent(root, len, len, root->sectorsize, 0,
                                    alloc_hint, &ins, 1, 1);
         if (ret)
                 return ERR_PTR(ret);
@@ -7751,6 +7758,13 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
                                 ret = PTR_ERR(em2);
                                 goto unlock_err;
                         }
+                        /*
+                         * For inode marked NODATACOW or extent marked PREALLOC,
+                         * use the existing or preallocated extent, so does not
+                         * need to adjust btrfs_space_info's bytes_may_use.
+                         */
+                        btrfs_free_reserved_data_space_noquota(inode,
+                                        start, len);
                         goto unlock;
                 }
         }
@@ -7785,7 +7799,6 @@ unlock:
                         i_size_write(inode, start + len);
 
                 adjust_dio_outstanding_extents(inode, dio_data, len);
-                btrfs_free_reserved_data_space(inode, start, len);
                 WARN_ON(dio_data->reserve < len);
                 dio_data->reserve -= len;
                 dio_data->unsubmitted_oe_range_end = start + len;
@@ -10306,6 +10319,7 @@ static int __btrfs_prealloc_file_range(struct inode *inode, int mode,
         u64 last_alloc = (u64)-1;
         int ret = 0;
         bool own_trans = true;
+        u64 end = start + num_bytes - 1;
 
         if (trans)
                 own_trans = false;
@@ -10327,8 +10341,8 @@ static int __btrfs_prealloc_file_range(struct inode *inode, int mode,
                  * sized chunks.
                  */
                 cur_bytes = min(cur_bytes, last_alloc);
-                ret = btrfs_reserve_extent(root, cur_bytes, min_size, 0,
-                                           *alloc_hint, &ins, 1, 0);
+                ret = btrfs_reserve_extent(root, cur_bytes, cur_bytes,
+                                min_size, 0, *alloc_hint, &ins, 1, 0);
                 if (ret) {
                         if (own_trans)
                                 btrfs_end_transaction(trans, root);
@@ -10414,6 +10428,9 @@ next:
                 if (own_trans)
                         btrfs_end_transaction(trans, root);
         }
+        if (cur_offset < end)
+                btrfs_free_reserved_data_space(inode, cur_offset,
+                        end - cur_offset + 1);
         return ret;
 }
 
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 14ed1e9e6bc8..b2a2da5893af 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -5084,7 +5084,7 @@ static long btrfs_ioctl_quota_rescan_wait(struct file *file, void __user *arg)
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        return btrfs_qgroup_wait_for_completion(root->fs_info);
+        return btrfs_qgroup_wait_for_completion(root->fs_info, true);
 }
 
 static long _btrfs_ioctl_set_received_subvol(struct file *file,
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 93ee1c18ef9d..8db2e29fdcf4 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -995,7 +995,7 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans,
                 goto out;
         fs_info->quota_enabled = 0;
         fs_info->pending_quota_state = 0;
-        btrfs_qgroup_wait_for_completion(fs_info);
+        btrfs_qgroup_wait_for_completion(fs_info, false);
         spin_lock(&fs_info->qgroup_lock);
         quota_root = fs_info->quota_root;
         fs_info->quota_root = NULL;
@@ -1453,10 +1453,9 @@ int btrfs_qgroup_prepare_account_extents(struct btrfs_trans_handle *trans,
         return ret;
 }
 
-struct btrfs_qgroup_extent_record *
-btrfs_qgroup_insert_dirty_extent(struct btrfs_fs_info *fs_info,
-                                 struct btrfs_delayed_ref_root *delayed_refs,
-                                 struct btrfs_qgroup_extent_record *record)
+int btrfs_qgroup_insert_dirty_extent_nolock(struct btrfs_fs_info *fs_info,
+                                struct btrfs_delayed_ref_root *delayed_refs,
+                                struct btrfs_qgroup_extent_record *record)
 {
         struct rb_node **p = &delayed_refs->dirty_extent_root.rb_node;
         struct rb_node *parent_node = NULL;
@@ -1475,12 +1474,42 @@ btrfs_qgroup_insert_dirty_extent(struct btrfs_fs_info *fs_info,
                 else if (bytenr > entry->bytenr)
                         p = &(*p)->rb_right;
                 else
-                        return entry;
+                        return 1;
         }
 
         rb_link_node(&record->node, parent_node, p);
         rb_insert_color(&record->node, &delayed_refs->dirty_extent_root);
-        return NULL;
+        return 0;
+}
+
+int btrfs_qgroup_insert_dirty_extent(struct btrfs_trans_handle *trans,
+                struct btrfs_fs_info *fs_info, u64 bytenr, u64 num_bytes,
+                gfp_t gfp_flag)
+{
+        struct btrfs_qgroup_extent_record *record;
+        struct btrfs_delayed_ref_root *delayed_refs;
+        int ret;
+
+        if (!fs_info->quota_enabled || bytenr == 0 || num_bytes == 0)
+                return 0;
+        if (WARN_ON(trans == NULL))
+                return -EINVAL;
+        record = kmalloc(sizeof(*record), gfp_flag);
+        if (!record)
+                return -ENOMEM;
+
+        delayed_refs = &trans->transaction->delayed_refs;
+        record->bytenr = bytenr;
+        record->num_bytes = num_bytes;
+        record->old_roots = NULL;
+
+        spin_lock(&delayed_refs->lock);
+        ret = btrfs_qgroup_insert_dirty_extent_nolock(fs_info, delayed_refs,
+                                                      record);
+        spin_unlock(&delayed_refs->lock);
+        if (ret > 0)
+                kfree(record);
+        return 0;
 }
 
 #define UPDATE_NEW      0
@@ -2303,6 +2332,10 @@ static void btrfs_qgroup_rescan_worker(struct btrfs_work *work)
         int err = -ENOMEM;
         int ret = 0;
 
+        mutex_lock(&fs_info->qgroup_rescan_lock);
+        fs_info->qgroup_rescan_running = true;
+        mutex_unlock(&fs_info->qgroup_rescan_lock);
+
         path = btrfs_alloc_path();
         if (!path)
                 goto out;
@@ -2369,6 +2402,9 @@ out:
         }
 
 done:
+        mutex_lock(&fs_info->qgroup_rescan_lock);
+        fs_info->qgroup_rescan_running = false;
+        mutex_unlock(&fs_info->qgroup_rescan_lock);
         complete_all(&fs_info->qgroup_rescan_completion);
 }
 
@@ -2487,20 +2523,26 @@ btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info)
         return 0;
 }
 
-int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info)
+int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info,
+                                     bool interruptible)
 {
         int running;
         int ret = 0;
 
         mutex_lock(&fs_info->qgroup_rescan_lock);
         spin_lock(&fs_info->qgroup_lock);
-        running = fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN;
+        running = fs_info->qgroup_rescan_running;
         spin_unlock(&fs_info->qgroup_lock);
         mutex_unlock(&fs_info->qgroup_rescan_lock);
 
-        if (running)
+        if (!running)
+                return 0;
+
+        if (interruptible)
                 ret = wait_for_completion_interruptible(
                                         &fs_info->qgroup_rescan_completion);
+        else
+                wait_for_completion(&fs_info->qgroup_rescan_completion);
 
         return ret;
 }
diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h
index 710887c06aaf..1bc64c864b62 100644
--- a/fs/btrfs/qgroup.h
+++ b/fs/btrfs/qgroup.h
@@ -46,7 +46,8 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans,
                         struct btrfs_fs_info *fs_info);
 int btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info);
 void btrfs_qgroup_rescan_resume(struct btrfs_fs_info *fs_info);
-int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info);
+int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info,
+                                     bool interruptible);
 int btrfs_add_qgroup_relation(struct btrfs_trans_handle *trans,
                               struct btrfs_fs_info *fs_info, u64 src, u64 dst);
 int btrfs_del_qgroup_relation(struct btrfs_trans_handle *trans,
@@ -63,10 +64,35 @@ void btrfs_free_qgroup_config(struct btrfs_fs_info *fs_info);
 struct btrfs_delayed_extent_op;
 int btrfs_qgroup_prepare_account_extents(struct btrfs_trans_handle *trans,
                                          struct btrfs_fs_info *fs_info);
-struct btrfs_qgroup_extent_record *
-btrfs_qgroup_insert_dirty_extent(struct btrfs_fs_info *fs_info,
-                                 struct btrfs_delayed_ref_root *delayed_refs,
-                                 struct btrfs_qgroup_extent_record *record);
+/*
+ * Insert one dirty extent record into @delayed_refs, informing qgroup to
+ * account that extent at commit trans time.
+ *
+ * No lock version, caller must acquire delayed ref lock and allocate memory.
+ *
+ * Return 0 for success insert
+ * Return >0 for existing record, caller can free @record safely.
+ * Error is not possible
+ */
+int btrfs_qgroup_insert_dirty_extent_nolock(
+                struct btrfs_fs_info *fs_info,
+                struct btrfs_delayed_ref_root *delayed_refs,
+                struct btrfs_qgroup_extent_record *record);
+
+/*
+ * Insert one dirty extent record into @delayed_refs, informing qgroup to
+ * account that extent at commit trans time.
+ *
+ * Better encapsulated version.
+ *
+ * Return 0 if the operation is done.
+ * Return <0 for error, like memory allocation failure or invalid parameter
+ * (NULL trans)
+ */
+int btrfs_qgroup_insert_dirty_extent(struct btrfs_trans_handle *trans,
+                struct btrfs_fs_info *fs_info, u64 bytenr, u64 num_bytes,
+                gfp_t gfp_flag);
+
 int
 btrfs_qgroup_account_extent(struct btrfs_trans_handle *trans,
                             struct btrfs_fs_info *fs_info,
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index b26a5aea41b4..c0c13dc6fe12 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -31,6 +31,7 @@
 #include "async-thread.h"
 #include "free-space-cache.h"
 #include "inode-map.h"
+#include "qgroup.h"
 
 /*
  * backref_node, mapping_node and tree_block start with this
@@ -3037,15 +3038,19 @@ int prealloc_file_extent_cluster(struct inode *inode,
         u64 num_bytes;
         int nr = 0;
         int ret = 0;
+        u64 prealloc_start = cluster->start - offset;
+        u64 prealloc_end = cluster->end - offset;
+        u64 cur_offset;
 
         BUG_ON(cluster->start != cluster->boundary[0]);
         inode_lock(inode);
 
-        ret = btrfs_check_data_free_space(inode, cluster->start,
-                                          cluster->end + 1 - cluster->start);
+        ret = btrfs_check_data_free_space(inode, prealloc_start,
+                                          prealloc_end + 1 - prealloc_start);
         if (ret)
                 goto out;
 
+        cur_offset = prealloc_start;
         while (nr < cluster->nr) {
                 start = cluster->boundary[nr] - offset;
                 if (nr + 1 < cluster->nr)
@@ -3055,16 +3060,21 @@ int prealloc_file_extent_cluster(struct inode *inode,
 
                 lock_extent(&BTRFS_I(inode)->io_tree, start, end);
                 num_bytes = end + 1 - start;
+                if (cur_offset < start)
+                        btrfs_free_reserved_data_space(inode, cur_offset,
+                                        start - cur_offset);
                 ret = btrfs_prealloc_file_range(inode, 0, start,
                                                 num_bytes, num_bytes,
                                                 end + 1, &alloc_hint);
+                cur_offset = end + 1;
                 unlock_extent(&BTRFS_I(inode)->io_tree, start, end);
                 if (ret)
                         break;
                 nr++;
         }
-        btrfs_free_reserved_data_space(inode, cluster->start,
-                                       cluster->end + 1 - cluster->start);
+        if (cur_offset < prealloc_end)
+                btrfs_free_reserved_data_space(inode, cur_offset,
+                                       prealloc_end + 1 - cur_offset);
 out:
         inode_unlock(inode);
         return ret;
@@ -3916,6 +3926,90 @@ int prepare_to_relocate(struct reloc_control *rc)
         return 0;
 }
 
+/*
+ * Qgroup fixer for data chunk relocation.
+ * The data relocation is done in the following steps
+ * 1) Copy data extents into data reloc tree
+ * 2) Create tree reloc tree(special snapshot) for related subvolumes
+ * 3) Modify file extents in tree reloc tree
+ * 4) Merge tree reloc tree with original fs tree, by swapping tree blocks
+ *
+ * The problem is, data and tree reloc tree are not accounted to qgroup,
+ * and 4) will only info qgroup to track tree blocks change, not file extents
+ * in the tree blocks.
+ *
+ * The good news is, related data extents are all in data reloc tree, so we
+ * only need to info qgroup to track all file extents in data reloc tree
+ * before commit trans.
+ */
+static int qgroup_fix_relocated_data_extents(struct btrfs_trans_handle *trans,
+                                             struct reloc_control *rc)
+{
+        struct btrfs_fs_info *fs_info = rc->extent_root->fs_info;
+        struct inode *inode = rc->data_inode;
+        struct btrfs_root *data_reloc_root = BTRFS_I(inode)->root;
+        struct btrfs_path *path;
+        struct btrfs_key key;
+        int ret = 0;
+
+        if (!fs_info->quota_enabled)
+                return 0;
+
+        /*
+         * Only for stage where we update data pointers the qgroup fix is
+         * valid.
+         * For MOVING_DATA stage, we will miss the timing of swapping tree
+         * blocks, and won't fix it.
+         */
+        if (!(rc->stage == UPDATE_DATA_PTRS && rc->extents_found))
+                return 0;
+
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+        key.objectid = btrfs_ino(inode);
+        key.type = BTRFS_EXTENT_DATA_KEY;
+        key.offset = 0;
+
+        ret = btrfs_search_slot(NULL, data_reloc_root, &key, path, 0, 0);
+        if (ret < 0)
+                goto out;
+
+        lock_extent(&BTRFS_I(inode)->io_tree, 0, (u64)-1);
+        while (1) {
+                struct btrfs_file_extent_item *fi;
+
+                btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
+                if (key.objectid > btrfs_ino(inode))
+                        break;
+                if (key.type != BTRFS_EXTENT_DATA_KEY)
+                        goto next;
+                fi = btrfs_item_ptr(path->nodes[0], path->slots[0],
+                                    struct btrfs_file_extent_item);
+                if (btrfs_file_extent_type(path->nodes[0], fi) !=
+                                BTRFS_FILE_EXTENT_REG)
+                        goto next;
+                ret = btrfs_qgroup_insert_dirty_extent(trans, fs_info,
+                        btrfs_file_extent_disk_bytenr(path->nodes[0], fi),
+                        btrfs_file_extent_disk_num_bytes(path->nodes[0], fi),
+                        GFP_NOFS);
+                if (ret < 0)
+                        break;
+next:
+                ret = btrfs_next_item(data_reloc_root, path);
+                if (ret < 0)
+                        break;
+                if (ret > 0) {
+                        ret = 0;
+                        break;
+                }
+        }
+        unlock_extent(&BTRFS_I(inode)->io_tree, 0 , (u64)-1);
+out:
+        btrfs_free_path(path);
+        return ret;
+}
+
 static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
 {
         struct rb_root blocks = RB_ROOT;
@@ -4102,10 +4196,18 @@ restart:
 
         /* get rid of pinned extents */
         trans = btrfs_join_transaction(rc->extent_root);
-        if (IS_ERR(trans))
+        if (IS_ERR(trans)) {
                 err = PTR_ERR(trans);
-        else
-                btrfs_commit_transaction(trans, rc->extent_root);
+                goto out_free;
+        }
+        ret = qgroup_fix_relocated_data_extents(trans, rc);
+        if (ret < 0) {
+                btrfs_abort_transaction(trans, ret);
+                if (!err)
+                        err = ret;
+                goto out_free;
+        }
+        btrfs_commit_transaction(trans, rc->extent_root);
 out_free:
         btrfs_free_block_rsv(rc->extent_root, rc->block_rsv);
         btrfs_free_path(path);
@@ -4468,10 +4570,16 @@ int btrfs_recover_relocation(struct btrfs_root *root)
         unset_reloc_control(rc);
 
         trans = btrfs_join_transaction(rc->extent_root);
-        if (IS_ERR(trans))
+        if (IS_ERR(trans)) {
                 err = PTR_ERR(trans);
-        else
-                err = btrfs_commit_transaction(trans, rc->extent_root);
+                goto out_free;
+        }
+        err = qgroup_fix_relocated_data_extents(trans, rc);
+        if (err < 0) {
+                btrfs_abort_transaction(trans, err);
+                goto out_free;
+        }
+        err = btrfs_commit_transaction(trans, rc->extent_root);
 out_free:
         kfree(rc);
 out:
diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index 7fd7e1830cfe..091296062456 100644
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -272,6 +272,23 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root)
                 root_key.objectid = key.offset;
                 key.offset++;
 
+                /*
+                 * The root might have been inserted already, as before we look
+                 * for orphan roots, log replay might have happened, which
+                 * triggers a transaction commit and qgroup accounting, which
+                 * in turn reads and inserts fs roots while doing backref
+                 * walking.
+                 */
+                root = btrfs_lookup_fs_root(tree_root->fs_info,
+                                            root_key.objectid);
+                if (root) {
+                        WARN_ON(!test_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED,
+                                          &root->state));
+                        if (btrfs_root_refs(&root->root_item) == 0)
+                                btrfs_add_dead_root(root);
+                        continue;
+                }
+
                 root = btrfs_read_fs_root(tree_root, &root_key);
                 err = PTR_ERR_OR_ZERO(root);
                 if (err && err != -ENOENT) {
@@ -310,16 +327,8 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root)
                 set_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, &root->state);
 
                 err = btrfs_insert_fs_root(root->fs_info, root);
-                /*
-                 * The root might have been inserted already, as before we look
-                 * for orphan roots, log replay might have happened, which
-                 * triggers a transaction commit and qgroup accounting, which
-                 * in turn reads and inserts fs roots while doing backref
-                 * walking.
-                 */
-                if (err == -EEXIST)
-                        err = 0;
                 if (err) {
+                        BUG_ON(err == -EEXIST);
                         btrfs_free_fs_root(root);
                         break;
                 }
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index efe129fe2678..a87675ffd02b 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -4268,10 +4268,12 @@ static int process_all_refs(struct send_ctx *sctx,
         }
         btrfs_release_path(path);
 
+        /*
+         * We don't actually care about pending_move as we are simply
+         * re-creating this inode and will be rename'ing it into place once we
+         * rename the parent directory.
+         */
         ret = process_recorded_refs(sctx, &pending_move);
-        /* Only applicable to an incremental send. */
-        ASSERT(pending_move == 0);
-
 out:
         btrfs_free_path(path);
         return ret;
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 864ce334f696..4071fe2bd098 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -2241,6 +2241,13 @@ static int btrfs_freeze(struct super_block *sb)
         struct btrfs_trans_handle *trans;
         struct btrfs_root *root = btrfs_sb(sb)->tree_root;
 
+        root->fs_info->fs_frozen = 1;
+        /*
+         * We don't need a barrier here, we'll wait for any transaction that
+         * could be in progress on other threads (and do delayed iputs that
+         * we want to avoid on a frozen filesystem), or do the commit
+         * ourselves.
+         */
         trans = btrfs_attach_transaction_barrier(root);
         if (IS_ERR(trans)) {
                 /* no transaction, don't bother */
@@ -2251,6 +2258,14 @@ static int btrfs_freeze(struct super_block *sb)
         return btrfs_commit_transaction(trans, root);
 }
 
+static int btrfs_unfreeze(struct super_block *sb)
+{
+        struct btrfs_root *root = btrfs_sb(sb)->tree_root;
+
+        root->fs_info->fs_frozen = 0;
+        return 0;
+}
+
 static int btrfs_show_devname(struct seq_file *m, struct dentry *root)
 {
         struct btrfs_fs_info *fs_info = btrfs_sb(root->d_sb);
@@ -2299,6 +2314,7 @@ static const struct super_operations btrfs_super_ops = {
         .statfs         = btrfs_statfs,
         .remount_fs     = btrfs_remount,
         .freeze_fs      = btrfs_freeze,
+        .unfreeze_fs    = btrfs_unfreeze,
 };
 
 static const struct file_operations btrfs_ctl_fops = {
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 9cca0a721961..95d41919d034 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -2278,8 +2278,13 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
         kmem_cache_free(btrfs_trans_handle_cachep, trans);
 
+        /*
+         * If fs has been frozen, we can not handle delayed iputs, otherwise
+         * it'll result in deadlock about SB_FREEZE_FS.
+         */
         if (current != root->fs_info->transaction_kthread &&
-            current != root->fs_info->cleaner_kthread)
+            current != root->fs_info->cleaner_kthread &&
+            !root->fs_info->fs_frozen)
                 btrfs_run_delayed_iputs(root);
 
         return ret;
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index fff3f3efa436..ef9c55bc7907 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -27,6 +27,7 @@
 #include "backref.h"
 #include "hash.h"
 #include "compression.h"
+#include "qgroup.h"
 
 /* magic values for the inode_only field in btrfs_log_inode:
  *
@@ -680,6 +681,21 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
                 ins.type = BTRFS_EXTENT_ITEM_KEY;
                 offset = key->offset - btrfs_file_extent_offset(eb, item);
 
+                /*
+                 * Manually record dirty extent, as here we did a shallow
+                 * file extent item copy and skip normal backref update,
+                 * but modifying extent tree all by ourselves.
+                 * So need to manually record dirty extent for qgroup,
+                 * as the owner of the file extent changed from log tree
+                 * (doesn't affect qgroup) to fs/file tree(affects qgroup)
+                 */
+                ret = btrfs_qgroup_insert_dirty_extent(trans, root->fs_info,
+                                btrfs_file_extent_disk_bytenr(eb, item),
+                                btrfs_file_extent_disk_num_bytes(eb, item),
+                                GFP_NOFS);
+                if (ret < 0)
+                        goto out;
+
                 if (ins.objectid > 0) {
                         u64 csum_start;
                         u64 csum_end;
@@ -2807,7 +2823,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
          */
         mutex_unlock(&root->log_mutex);
 
-        btrfs_init_log_ctx(&root_log_ctx);
+        btrfs_init_log_ctx(&root_log_ctx, NULL);
 
         mutex_lock(&log_root_tree->log_mutex);
         atomic_inc(&log_root_tree->log_batch);
@@ -2851,6 +2867,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
 
         if (log_root_tree->log_transid_committed >= root_log_ctx.log_transid) {
                 blk_finish_plug(&plug);
+                list_del_init(&root_log_ctx.list);
                 mutex_unlock(&log_root_tree->log_mutex);
                 ret = root_log_ctx.log_ret;
                 goto out;
@@ -4741,7 +4758,8 @@ again:
                         if (ret < 0) {
                                 err = ret;
                                 goto out_unlock;
-                        } else if (ret > 0) {
+                        } else if (ret > 0 && ctx &&
+                                   other_ino != btrfs_ino(ctx->inode)) {
                                 struct btrfs_key inode_key;
                                 struct inode *other_inode;
 
diff --git a/fs/btrfs/tree-log.h b/fs/btrfs/tree-log.h
index a9f1b75d080d..ab858e31ccbc 100644
--- a/fs/btrfs/tree-log.h
+++ b/fs/btrfs/tree-log.h
@@ -30,15 +30,18 @@ struct btrfs_log_ctx {
         int log_transid;
         int io_err;
         bool log_new_dentries;
+        struct inode *inode;
         struct list_head list;
 };
 
-static inline void btrfs_init_log_ctx(struct btrfs_log_ctx *ctx)
+static inline void btrfs_init_log_ctx(struct btrfs_log_ctx *ctx,
+                                      struct inode *inode)
 {
         ctx->log_ret = 0;
         ctx->log_transid = 0;
         ctx->io_err = 0;
         ctx->log_new_dentries = false;
+        ctx->inode = inode;
         INIT_LIST_HEAD(&ctx->list);
 }
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 51f125508771..035efce603a9 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -834,10 +834,6 @@ static void __free_device(struct work_struct *work)
         struct btrfs_device *device;
 
         device = container_of(work, struct btrfs_device, rcu_work);
-
-        if (device->bdev)
-                blkdev_put(device->bdev, device->mode);
-
         rcu_string_free(device->name);
         kfree(device);
 }
@@ -852,6 +848,17 @@ static void free_device(struct rcu_head *head)
         schedule_work(&device->rcu_work);
 }
 
+static void btrfs_close_bdev(struct btrfs_device *device)
+{
+        if (device->bdev && device->writeable) {
+                sync_blockdev(device->bdev);
+                invalidate_bdev(device->bdev);
+        }
+
+        if (device->bdev)
+                blkdev_put(device->bdev, device->mode);
+}
+
 static void btrfs_close_one_device(struct btrfs_device *device)
 {
         struct btrfs_fs_devices *fs_devices = device->fs_devices;
@@ -870,10 +877,7 @@ static void btrfs_close_one_device(struct btrfs_device *device)
         if (device->missing)
                 fs_devices->missing_devices--;
 
-        if (device->bdev && device->writeable) {
-                sync_blockdev(device->bdev);
-                invalidate_bdev(device->bdev);
-        }
+        btrfs_close_bdev(device);
 
         new_device = btrfs_alloc_device(NULL, &device->devid,
                                         device->uuid);
@@ -1932,6 +1936,8 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path, u64 devid)
                 btrfs_sysfs_rm_device_link(root->fs_info->fs_devices, device);
         }
 
+        btrfs_close_bdev(device);
+
         call_rcu(&device->rcu, free_device);
 
         num_devices = btrfs_super_num_devices(root->fs_info->super_copy) - 1;
@@ -2025,6 +2031,9 @@ void btrfs_rm_dev_replace_free_srcdev(struct btrfs_fs_info *fs_info,
                 /* zero out the old super if it is writable */
                 btrfs_scratch_superblocks(srcdev->bdev, srcdev->name->str);
         }
+
+        btrfs_close_bdev(srcdev);
+
         call_rcu(&srcdev->rcu, free_device);
 
         /*
@@ -2080,6 +2089,8 @@ void btrfs_destroy_dev_replace_tgtdev(struct btrfs_fs_info *fs_info,
          * the device_list_mutex lock.
          */
         btrfs_scratch_superblocks(tgtdev->bdev, tgtdev->name->str);
+
+        btrfs_close_bdev(tgtdev);
         call_rcu(&tgtdev->rcu, free_device);
 }
 
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index c64a0b794d49..df4b3e6fa563 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -597,7 +597,7 @@ static bool need_reset_readdir(struct ceph_file_info *fi, loff_t new_pos)
         if (is_hash_order(new_pos)) {
                 /* no need to reset last_name for a forward seek when
                  * dentries are sotred in hash order */
-        } else if (fi->frag |= fpos_frag(new_pos)) {
+        } else if (fi->frag != fpos_frag(new_pos)) {
                 return true;
         }
         rinfo = fi->last_readdir ? &fi->last_readdir->r_reply_info : NULL;
diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index 0f9961eede1e..ed115acb5dee 100644
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -11,6 +11,7 @@
 #include <linux/random.h>
 #include <linux/string.h>
 #include <linux/fscrypto.h>
+#include <linux/mount.h>
 
 static int inode_has_encryption_context(struct inode *inode)
 {
@@ -92,26 +93,42 @@ static int create_encryption_context_from_policy(struct inode *inode,
         return inode->i_sb->s_cop->set_context(inode, &ctx, sizeof(ctx), NULL);
 }
 
-int fscrypt_process_policy(struct inode *inode,
+int fscrypt_process_policy(struct file *filp,
                                 const struct fscrypt_policy *policy)
 {
+        struct inode *inode = file_inode(filp);
+        int ret;
+
+        if (!inode_owner_or_capable(inode))
+                return -EACCES;
+
         if (policy->version != 0)
                 return -EINVAL;
 
+        ret = mnt_want_write_file(filp);
+        if (ret)
+                return ret;
+
         if (!inode_has_encryption_context(inode)) {
-                if (!inode->i_sb->s_cop->empty_dir)
-                        return -EOPNOTSUPP;
-                if (!inode->i_sb->s_cop->empty_dir(inode))
-                        return -ENOTEMPTY;
-                return create_encryption_context_from_policy(inode, policy);
+                if (!S_ISDIR(inode->i_mode))
+                        ret = -EINVAL;
+                else if (!inode->i_sb->s_cop->empty_dir)
+                        ret = -EOPNOTSUPP;
+                else if (!inode->i_sb->s_cop->empty_dir(inode))
+                        ret = -ENOTEMPTY;
+                else
+                        ret = create_encryption_context_from_policy(inode,
+                                                                    policy);
+        } else if (!is_encryption_context_consistent_with_policy(inode,
+                                                                 policy)) {
+                printk(KERN_WARNING
+                       "%s: Policy inconsistent with encryption context\n",
+                       __func__);
+                ret = -EINVAL;
         }
 
-        if (is_encryption_context_consistent_with_policy(inode, policy))
-                return 0;
-
-        printk(KERN_WARNING "%s: Policy inconsistent with encryption context\n",
-               __func__);
-        return -EINVAL;
+        mnt_drop_write_file(filp);
+        return ret;
 }
 EXPORT_SYMBOL(fscrypt_process_policy);
 
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index d116453b0276..79a5941c2474 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -585,7 +585,8 @@ struct dentry *devpts_pty_new(struct pts_fs_info *fsi, int index, void *priv)
  */
 void *devpts_get_priv(struct dentry *dentry)
 {
-        WARN_ON_ONCE(dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC);
+        if (dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC)
+                return NULL;
         return dentry->d_fsdata;
 }
 
diff --git a/fs/dlm/debug_fs.c b/fs/dlm/debug_fs.c
index eea64912c9c0..466f7d60edc2 100644
--- a/fs/dlm/debug_fs.c
+++ b/fs/dlm/debug_fs.c
@@ -607,20 +607,54 @@ static const struct file_operations format2_fops;
 static const struct file_operations format3_fops;
 static const struct file_operations format4_fops;
 
-static int table_open(struct inode *inode, struct file *file)
+static int table_open1(struct inode *inode, struct file *file)
 {
         struct seq_file *seq;
-        int ret = -1;
+        int ret;
 
-        if (file->f_op == &format1_fops)
-                ret = seq_open(file, &format1_seq_ops);
-        else if (file->f_op == &format2_fops)
-                ret = seq_open(file, &format2_seq_ops);
-        else if (file->f_op == &format3_fops)
-                ret = seq_open(file, &format3_seq_ops);
-        else if (file->f_op == &format4_fops)
-                ret = seq_open(file, &format4_seq_ops);
+        ret = seq_open(file, &format1_seq_ops);
+        if (ret)
+                return ret;
+
+        seq = file->private_data;
+        seq->private = inode->i_private; /* the dlm_ls */
+        return 0;
+}
+
+static int table_open2(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq;
+        int ret;
+
+        ret = seq_open(file, &format2_seq_ops);
+        if (ret)
+                return ret;
+
+        seq = file->private_data;
+        seq->private = inode->i_private; /* the dlm_ls */
+        return 0;
+}
+
+static int table_open3(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq;
+        int ret;
+
+        ret = seq_open(file, &format3_seq_ops);
+        if (ret)
+                return ret;
+
+        seq = file->private_data;
+        seq->private = inode->i_private; /* the dlm_ls */
+        return 0;
+}
+
+static int table_open4(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq;
+        int ret;
 
+        ret = seq_open(file, &format4_seq_ops);
         if (ret)
                 return ret;
 
@@ -631,7 +665,7 @@ static int table_open(struct inode *inode, struct file *file)
 
 static const struct file_operations format1_fops = {
         .owner   = THIS_MODULE,
-        .open    = table_open,
+        .open    = table_open1,
         .read    = seq_read,
         .llseek  = seq_lseek,
         .release = seq_release
@@ -639,7 +673,7 @@ static const struct file_operations format1_fops = {
 
 static const struct file_operations format2_fops = {
         .owner   = THIS_MODULE,
-        .open    = table_open,
+        .open    = table_open2,
         .read    = seq_read,
         .llseek  = seq_lseek,
         .release = seq_release
@@ -647,7 +681,7 @@ static const struct file_operations format2_fops = {
 
 static const struct file_operations format3_fops = {
         .owner   = THIS_MODULE,
-        .open    = table_open,
+        .open    = table_open3,
         .read    = seq_read,
         .llseek  = seq_lseek,
         .release = seq_release
@@ -655,7 +689,7 @@ static const struct file_operations format3_fops = {
 
 static const struct file_operations format4_fops = {
         .owner   = THIS_MODULE,
-        .open    = table_open,
+        .open    = table_open4,
         .read    = seq_read,
         .llseek  = seq_lseek,
         .release = seq_release
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 3131747199e1..c6ea25a190f8 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5466,8 +5466,6 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
                                                       sbi->s_want_extra_isize,
                                                       iloc, handle);
                         if (ret) {
-                                ext4_set_inode_state(inode,
-                                                     EXT4_STATE_NO_EXPAND);
                                 if (mnt_count !=
                                         le16_to_cpu(sbi->s_es->s_mnt_count)) {
                                         ext4_warning(inode->i_sb,
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 10686fd67fb4..1bb7df5e4536 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -776,7 +776,7 @@ resizefs_out:
                                    (struct fscrypt_policy __user *)arg,
                                    sizeof(policy)))
                         return -EFAULT;
-                return fscrypt_process_policy(inode, &policy);
+                return fscrypt_process_policy(filp, &policy);
 #else
                 return -EOPNOTSUPP;
 #endif
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 1c593aa0218e..3ec8708989ca 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2211,6 +2211,7 @@ void ext4_group_desc_csum_set(struct super_block *sb, __u32 block_group,
 
 /* Called at mount-time, super-block is locked */
 static int ext4_check_descriptors(struct super_block *sb,
+                                  ext4_fsblk_t sb_block,
                                   ext4_group_t *first_not_zeroed)
 {
         struct ext4_sb_info *sbi = EXT4_SB(sb);
@@ -2241,6 +2242,11 @@ static int ext4_check_descriptors(struct super_block *sb,
                         grp = i;
 
                 block_bitmap = ext4_block_bitmap(sb, gdp);
+                if (block_bitmap == sb_block) {
+                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+                                 "Block bitmap for group %u overlaps "
+                                 "superblock", i);
+                }
                 if (block_bitmap < first_block || block_bitmap > last_block) {
                         ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
                                "Block bitmap for group %u not in group "
@@ -2248,6 +2254,11 @@ static int ext4_check_descriptors(struct super_block *sb,
                         return 0;
                 }
                 inode_bitmap = ext4_inode_bitmap(sb, gdp);
+                if (inode_bitmap == sb_block) {
+                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+                                 "Inode bitmap for group %u overlaps "
+                                 "superblock", i);
+                }
                 if (inode_bitmap < first_block || inode_bitmap > last_block) {
                         ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
                                "Inode bitmap for group %u not in group "
@@ -2255,6 +2266,11 @@ static int ext4_check_descriptors(struct super_block *sb,
                         return 0;
                 }
                 inode_table = ext4_inode_table(sb, gdp);
+                if (inode_table == sb_block) {
+                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+                                 "Inode table for group %u overlaps "
+                                 "superblock", i);
+                }
                 if (inode_table < first_block ||
                     inode_table + sbi->s_itb_per_group - 1 > last_block) {
                         ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
@@ -3757,7 +3773,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                         goto failed_mount2;
                 }
         }
-        if (!ext4_check_descriptors(sb, &first_not_zeroed)) {
+        if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
                 ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
                 ret = -EFSCORRUPTED;
                 goto failed_mount2;
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 39e9cfb1b371..2eb935ca5d9e 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1353,15 +1353,19 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
         size_t min_offs, free;
         int total_ino;
         void *base, *start, *end;
-        int extra_isize = 0, error = 0, tried_min_extra_isize = 0;
+        int error = 0, tried_min_extra_isize = 0;
         int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize);
+        int isize_diff; /* How much do we need to grow i_extra_isize */
 
         down_write(&EXT4_I(inode)->xattr_sem);
+        /*
+         * Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty
+         */
+        ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND);
 retry:
-        if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) {
-                up_write(&EXT4_I(inode)->xattr_sem);
-                return 0;
-        }
+        isize_diff = new_extra_isize - EXT4_I(inode)->i_extra_isize;
+        if (EXT4_I(inode)->i_extra_isize >= new_extra_isize)
+                goto out;
 
         header = IHDR(inode, raw_inode);
         entry = IFIRST(header);
@@ -1382,7 +1386,7 @@ retry:
                 goto cleanup;
 
         free = ext4_xattr_free_space(last, &min_offs, base, &total_ino);
-        if (free >= new_extra_isize) {
+        if (free >= isize_diff) {
                 entry = IFIRST(header);
                 ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize
                                 - new_extra_isize, (void *)raw_inode +
@@ -1390,8 +1394,7 @@ retry:
                                 (void *)header, total_ino,
                                 inode->i_sb->s_blocksize);
                 EXT4_I(inode)->i_extra_isize = new_extra_isize;
-                error = 0;
-                goto cleanup;
+                goto out;
         }
 
         /*
@@ -1414,7 +1417,7 @@ retry:
                 end = bh->b_data + bh->b_size;
                 min_offs = end - base;
                 free = ext4_xattr_free_space(first, &min_offs, base, NULL);
-                if (free < new_extra_isize) {
+                if (free < isize_diff) {
                         if (!tried_min_extra_isize && s_min_extra_isize) {
                                 tried_min_extra_isize++;
                                 new_extra_isize = s_min_extra_isize;
@@ -1428,7 +1431,7 @@ retry:
                 free = inode->i_sb->s_blocksize;
         }
 
-        while (new_extra_isize > 0) {
+        while (isize_diff > 0) {
                 size_t offs, size, entry_size;
                 struct ext4_xattr_entry *small_entry = NULL;
                 struct ext4_xattr_info i = {
@@ -1459,7 +1462,7 @@ retry:
                         EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) +
                                         EXT4_XATTR_LEN(last->e_name_len);
                         if (total_size <= free && total_size < min_total_size) {
-                                if (total_size < new_extra_isize) {
+                                if (total_size < isize_diff) {
                                         small_entry = last;
                                 } else {
                                         entry = last;
@@ -1514,22 +1517,22 @@ retry:
                 error = ext4_xattr_ibody_set(handle, inode, &i, is);
                 if (error)
                         goto cleanup;
+                total_ino -= entry_size;
 
                 entry = IFIRST(header);
-                if (entry_size + EXT4_XATTR_SIZE(size) >= new_extra_isize)
-                        shift_bytes = new_extra_isize;
+                if (entry_size + EXT4_XATTR_SIZE(size) >= isize_diff)
+                        shift_bytes = isize_diff;
                 else
-                        shift_bytes = entry_size + size;
+                        shift_bytes = entry_size + EXT4_XATTR_SIZE(size);
                 /* Adjust the offsets and shift the remaining entries ahead */
-                ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize -
-                        shift_bytes, (void *)raw_inode +
-                        EXT4_GOOD_OLD_INODE_SIZE + extra_isize + shift_bytes,
-                        (void *)header, total_ino - entry_size,
-                        inode->i_sb->s_blocksize);
+                ext4_xattr_shift_entries(entry, -shift_bytes,
+                        (void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE +
+                        EXT4_I(inode)->i_extra_isize + shift_bytes,
+                        (void *)header, total_ino, inode->i_sb->s_blocksize);
 
-                extra_isize += shift_bytes;
-                new_extra_isize -= shift_bytes;
-                EXT4_I(inode)->i_extra_isize = extra_isize;
+                isize_diff -= shift_bytes;
+                EXT4_I(inode)->i_extra_isize += shift_bytes;
+                header = IHDR(inode, raw_inode);
 
                 i.name = b_entry_name;
                 i.value = buffer;
@@ -1551,6 +1554,8 @@ retry:
                 kfree(bs);
         }
         brelse(bh);
+out:
+        ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
         up_write(&EXT4_I(inode)->xattr_sem);
         return 0;
 
@@ -1562,6 +1567,10 @@ cleanup:
         kfree(is);
         kfree(bs);
         brelse(bh);
+        /*
+         * We deliberately leave EXT4_STATE_NO_EXPAND set here since inode
+         * size expansion failed.
+         */
         up_write(&EXT4_I(inode)->xattr_sem);
         return error;
 }
diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h
index 69dd3e6566e0..a92e783fa057 100644
--- a/fs/ext4/xattr.h
+++ b/fs/ext4/xattr.h
@@ -24,6 +24,7 @@
 #define EXT4_XATTR_INDEX_SYSTEM                 7
 #define EXT4_XATTR_INDEX_RICHACL                8
 #define EXT4_XATTR_INDEX_ENCRYPTION             9
+#define EXT4_XATTR_INDEX_HURD                   10 /* Reserved for Hurd */
 
 struct ext4_xattr_header {
         __le32  h_magic;        /* magic number for identification */
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index d64d2a515cb2..ccb401eebc11 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1699,11 +1699,11 @@ static int f2fs_write_end(struct file *file,
         trace_f2fs_write_end(inode, pos, len, copied);
 
         set_page_dirty(page);
-        f2fs_put_page(page, 1);
 
         if (pos + copied > i_size_read(inode))
                 f2fs_i_size_write(inode, pos + copied);
 
+        f2fs_put_page(page, 1);
         f2fs_update_time(F2FS_I_SB(inode), REQ_TIME);
         return copied;
 }
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 675fa79d86f6..14f5fe2b841e 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -538,7 +538,7 @@ struct f2fs_nm_info {
         /* NAT cache management */
         struct radix_tree_root nat_root;/* root of the nat entry cache */
         struct radix_tree_root nat_set_root;/* root of the nat set cache */
-        struct percpu_rw_semaphore nat_tree_lock;       /* protect nat_tree_lock */
+        struct rw_semaphore nat_tree_lock;      /* protect nat_tree_lock */
         struct list_head nat_entries;   /* cached nat entry list (clean) */
         unsigned int nat_cnt;           /* the # of cached nat entries */
         unsigned int dirty_nat_cnt;     /* total num of nat entries in set */
@@ -787,7 +787,7 @@ struct f2fs_sb_info {
         struct f2fs_checkpoint *ckpt;           /* raw checkpoint pointer */
         struct inode *meta_inode;               /* cache meta blocks */
         struct mutex cp_mutex;                  /* checkpoint procedure lock */
-        struct percpu_rw_semaphore cp_rwsem;            /* blocking FS operations */
+        struct rw_semaphore cp_rwsem;           /* blocking FS operations */
         struct rw_semaphore node_write;         /* locking node writes */
         wait_queue_head_t cp_wait;
         unsigned long last_time[MAX_TIME];      /* to store time in jiffies */
@@ -1074,22 +1074,22 @@ static inline void clear_ckpt_flags(struct f2fs_checkpoint *cp, unsigned int f)
 
 static inline void f2fs_lock_op(struct f2fs_sb_info *sbi)
 {
-        percpu_down_read(&sbi->cp_rwsem);
+        down_read(&sbi->cp_rwsem);
 }
 
 static inline void f2fs_unlock_op(struct f2fs_sb_info *sbi)
 {
-        percpu_up_read(&sbi->cp_rwsem);
+        up_read(&sbi->cp_rwsem);
 }
 
 static inline void f2fs_lock_all(struct f2fs_sb_info *sbi)
 {
-        percpu_down_write(&sbi->cp_rwsem);
+        down_write(&sbi->cp_rwsem);
 }
 
 static inline void f2fs_unlock_all(struct f2fs_sb_info *sbi)
 {
-        percpu_up_write(&sbi->cp_rwsem);
+        up_write(&sbi->cp_rwsem);
 }
 
 static inline int __get_cp_reason(struct f2fs_sb_info *sbi)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 0e493f63ea41..28f4f4cbb8d8 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1757,21 +1757,14 @@ static int f2fs_ioc_set_encryption_policy(struct file *filp, unsigned long arg)
 {
         struct fscrypt_policy policy;
         struct inode *inode = file_inode(filp);
-        int ret;
 
         if (copy_from_user(&policy, (struct fscrypt_policy __user *)arg,
                                                         sizeof(policy)))
                 return -EFAULT;
 
-        ret = mnt_want_write_file(filp);
-        if (ret)
-                return ret;
-
         f2fs_update_time(F2FS_I_SB(inode), REQ_TIME);
-        ret = fscrypt_process_policy(inode, &policy);
 
-        mnt_drop_write_file(filp);
-        return ret;
+        return fscrypt_process_policy(filp, &policy);
 }
 
 static int f2fs_ioc_get_encryption_policy(struct file *filp, unsigned long arg)
@@ -2086,15 +2079,19 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
         if (unlikely(f2fs_readonly(src->i_sb)))
                 return -EROFS;
 
-        if (S_ISDIR(src->i_mode) || S_ISDIR(dst->i_mode))
-                return -EISDIR;
+        if (!S_ISREG(src->i_mode) || !S_ISREG(dst->i_mode))
+                return -EINVAL;
 
         if (f2fs_encrypted_inode(src) || f2fs_encrypted_inode(dst))
                 return -EOPNOTSUPP;
 
         inode_lock(src);
-        if (src != dst)
-                inode_lock(dst);
+        if (src != dst) {
+                if (!inode_trylock(dst)) {
+                        ret = -EBUSY;
+                        goto out;
+                }
+        }
 
         ret = -EINVAL;
         if (pos_in + len > src->i_size || pos_in + len < pos_in)
@@ -2152,6 +2149,7 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
 out_unlock:
         if (src != dst)
                 inode_unlock(dst);
+out:
         inode_unlock(src);
         return ret;
 }
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index b2fa4b615925..f75d197d5beb 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -206,14 +206,14 @@ int need_dentry_mark(struct f2fs_sb_info *sbi, nid_t nid)
         struct nat_entry *e;
         bool need = false;
 
-        percpu_down_read(&nm_i->nat_tree_lock);
+        down_read(&nm_i->nat_tree_lock);
         e = __lookup_nat_cache(nm_i, nid);
         if (e) {
                 if (!get_nat_flag(e, IS_CHECKPOINTED) &&
                                 !get_nat_flag(e, HAS_FSYNCED_INODE))
                         need = true;
         }
-        percpu_up_read(&nm_i->nat_tree_lock);
+        up_read(&nm_i->nat_tree_lock);
         return need;
 }
 
@@ -223,11 +223,11 @@ bool is_checkpointed_node(struct f2fs_sb_info *sbi, nid_t nid)
         struct nat_entry *e;
         bool is_cp = true;
 
-        percpu_down_read(&nm_i->nat_tree_lock);
+        down_read(&nm_i->nat_tree_lock);
         e = __lookup_nat_cache(nm_i, nid);
         if (e && !get_nat_flag(e, IS_CHECKPOINTED))
                 is_cp = false;
-        percpu_up_read(&nm_i->nat_tree_lock);
+        up_read(&nm_i->nat_tree_lock);
         return is_cp;
 }
 
@@ -237,13 +237,13 @@ bool need_inode_block_update(struct f2fs_sb_info *sbi, nid_t ino)
         struct nat_entry *e;
         bool need_update = true;
 
-        percpu_down_read(&nm_i->nat_tree_lock);
+        down_read(&nm_i->nat_tree_lock);
         e = __lookup_nat_cache(nm_i, ino);
         if (e && get_nat_flag(e, HAS_LAST_FSYNC) &&
                         (get_nat_flag(e, IS_CHECKPOINTED) ||
                          get_nat_flag(e, HAS_FSYNCED_INODE)))
                 need_update = false;
-        percpu_up_read(&nm_i->nat_tree_lock);
+        up_read(&nm_i->nat_tree_lock);
         return need_update;
 }
 
@@ -284,7 +284,7 @@ static void set_node_addr(struct f2fs_sb_info *sbi, struct node_info *ni,
         struct f2fs_nm_info *nm_i = NM_I(sbi);
         struct nat_entry *e;
 
-        percpu_down_write(&nm_i->nat_tree_lock);
+        down_write(&nm_i->nat_tree_lock);
         e = __lookup_nat_cache(nm_i, ni->nid);
         if (!e) {
                 e = grab_nat_entry(nm_i, ni->nid);
@@ -334,7 +334,7 @@ static void set_node_addr(struct f2fs_sb_info *sbi, struct node_info *ni,
                         set_nat_flag(e, HAS_FSYNCED_INODE, true);
                 set_nat_flag(e, HAS_LAST_FSYNC, fsync_done);
         }
-        percpu_up_write(&nm_i->nat_tree_lock);
+        up_write(&nm_i->nat_tree_lock);
 }
 
 int try_to_free_nats(struct f2fs_sb_info *sbi, int nr_shrink)
@@ -342,7 +342,8 @@ int try_to_free_nats(struct f2fs_sb_info *sbi, int nr_shrink)
         struct f2fs_nm_info *nm_i = NM_I(sbi);
         int nr = nr_shrink;
 
-        percpu_down_write(&nm_i->nat_tree_lock);
+        if (!down_write_trylock(&nm_i->nat_tree_lock))
+                return 0;
 
         while (nr_shrink && !list_empty(&nm_i->nat_entries)) {
                 struct nat_entry *ne;
@@ -351,7 +352,7 @@ int try_to_free_nats(struct f2fs_sb_info *sbi, int nr_shrink)
                 __del_from_nat_cache(nm_i, ne);
                 nr_shrink--;
         }
-        percpu_up_write(&nm_i->nat_tree_lock);
+        up_write(&nm_i->nat_tree_lock);
         return nr - nr_shrink;
 }
 
@@ -373,13 +374,13 @@ void get_node_info(struct f2fs_sb_info *sbi, nid_t nid, struct node_info *ni)
         ni->nid = nid;
 
         /* Check nat cache */
-        percpu_down_read(&nm_i->nat_tree_lock);
+        down_read(&nm_i->nat_tree_lock);
         e = __lookup_nat_cache(nm_i, nid);
         if (e) {
                 ni->ino = nat_get_ino(e);
                 ni->blk_addr = nat_get_blkaddr(e);
                 ni->version = nat_get_version(e);
-                percpu_up_read(&nm_i->nat_tree_lock);
+                up_read(&nm_i->nat_tree_lock);
                 return;
         }
 
@@ -403,11 +404,11 @@ void get_node_info(struct f2fs_sb_info *sbi, nid_t nid, struct node_info *ni)
         node_info_from_raw_nat(ni, &ne);
         f2fs_put_page(page, 1);
 cache:
-        percpu_up_read(&nm_i->nat_tree_lock);
+        up_read(&nm_i->nat_tree_lock);
         /* cache nat entry */
-        percpu_down_write(&nm_i->nat_tree_lock);
+        down_write(&nm_i->nat_tree_lock);
         cache_nat_entry(sbi, nid, &ne);
-        percpu_up_write(&nm_i->nat_tree_lock);
+        up_write(&nm_i->nat_tree_lock);
 }
 
 /*
@@ -1788,7 +1789,7 @@ void build_free_nids(struct f2fs_sb_info *sbi)
         ra_meta_pages(sbi, NAT_BLOCK_OFFSET(nid), FREE_NID_PAGES,
                                                         META_NAT, true);
 
-        percpu_down_read(&nm_i->nat_tree_lock);
+        down_read(&nm_i->nat_tree_lock);
 
         while (1) {
                 struct page *page = get_current_nat_page(sbi, nid);
@@ -1820,7 +1821,7 @@ void build_free_nids(struct f2fs_sb_info *sbi)
                         remove_free_nid(nm_i, nid);
         }
         up_read(&curseg->journal_rwsem);
-        percpu_up_read(&nm_i->nat_tree_lock);
+        up_read(&nm_i->nat_tree_lock);
 
         ra_meta_pages(sbi, NAT_BLOCK_OFFSET(nm_i->next_scan_nid),
                                         nm_i->ra_nid_pages, META_NAT, false);
@@ -2209,7 +2210,7 @@ void flush_nat_entries(struct f2fs_sb_info *sbi)
         if (!nm_i->dirty_nat_cnt)
                 return;
 
-        percpu_down_write(&nm_i->nat_tree_lock);
+        down_write(&nm_i->nat_tree_lock);
 
         /*
          * if there are no enough space in journal to store dirty nat
@@ -2232,7 +2233,7 @@ void flush_nat_entries(struct f2fs_sb_info *sbi)
         list_for_each_entry_safe(set, tmp, &sets, set_list)
                 __flush_nat_entry_set(sbi, set);
 
-        percpu_up_write(&nm_i->nat_tree_lock);
+        up_write(&nm_i->nat_tree_lock);
 
         f2fs_bug_on(sbi, nm_i->dirty_nat_cnt);
 }
@@ -2268,8 +2269,7 @@ static int init_node_manager(struct f2fs_sb_info *sbi)
 
         mutex_init(&nm_i->build_lock);
         spin_lock_init(&nm_i->free_nid_list_lock);
-        if (percpu_init_rwsem(&nm_i->nat_tree_lock))
-                return -ENOMEM;
+        init_rwsem(&nm_i->nat_tree_lock);
 
         nm_i->next_scan_nid = le32_to_cpu(sbi->ckpt->next_free_nid);
         nm_i->bitmap_size = __bitmap_size(sbi, NAT_BITMAP);
@@ -2326,7 +2326,7 @@ void destroy_node_manager(struct f2fs_sb_info *sbi)
         spin_unlock(&nm_i->free_nid_list_lock);
 
         /* destroy nat cache */
-        percpu_down_write(&nm_i->nat_tree_lock);
+        down_write(&nm_i->nat_tree_lock);
         while ((found = __gang_lookup_nat_cache(nm_i,
                                         nid, NATVEC_SIZE, natvec))) {
                 unsigned idx;
@@ -2351,9 +2351,8 @@ void destroy_node_manager(struct f2fs_sb_info *sbi)
                         kmem_cache_free(nat_entry_set_slab, setvec[idx]);
                 }
         }
-        percpu_up_write(&nm_i->nat_tree_lock);
+        up_write(&nm_i->nat_tree_lock);
 
-        percpu_free_rwsem(&nm_i->nat_tree_lock);
         kfree(nm_i->nat_bitmap);
         sbi->nm_info = NULL;
         kfree(nm_i);
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 1b86d3f638ef..7f863a645ab1 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -706,8 +706,6 @@ static void destroy_percpu_info(struct f2fs_sb_info *sbi)
                 percpu_counter_destroy(&sbi->nr_pages[i]);
         percpu_counter_destroy(&sbi->alloc_valid_block_count);
         percpu_counter_destroy(&sbi->total_valid_inode_count);
-
-        percpu_free_rwsem(&sbi->cp_rwsem);
 }
 
 static void f2fs_put_super(struct super_block *sb)
@@ -1483,9 +1481,6 @@ static int init_percpu_info(struct f2fs_sb_info *sbi)
 {
         int i, err;
 
-        if (percpu_init_rwsem(&sbi->cp_rwsem))
-                return -ENOMEM;
-
         for (i = 0; i < NR_COUNT_TYPE; i++) {
                 err = percpu_counter_init(&sbi->nr_pages[i], 0, GFP_KERNEL);
                 if (err)
@@ -1686,6 +1681,7 @@ try_onemore:
                 sbi->write_io[i].bio = NULL;
         }
 
+        init_rwsem(&sbi->cp_rwsem);
         init_waitqueue_head(&sbi->cp_wait);
         init_sb_info(sbi);
 
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index f394aff59c36..3988b43c2f5a 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -530,13 +530,13 @@ void fuse_read_fill(struct fuse_req *req, struct file *file, loff_t pos,
         req->out.args[0].size = count;
 }
 
-static void fuse_release_user_pages(struct fuse_req *req, int write)
+static void fuse_release_user_pages(struct fuse_req *req, bool should_dirty)
 {
         unsigned i;
 
         for (i = 0; i < req->num_pages; i++) {
                 struct page *page = req->pages[i];
-                if (write)
+                if (should_dirty)
                         set_page_dirty_lock(page);
                 put_page(page);
         }
@@ -1320,6 +1320,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
                        loff_t *ppos, int flags)
 {
         int write = flags & FUSE_DIO_WRITE;
+        bool should_dirty = !write && iter_is_iovec(iter);
         int cuse = flags & FUSE_DIO_CUSE;
         struct file *file = io->file;
         struct inode *inode = file->f_mapping->host;
@@ -1363,7 +1364,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
                         nres = fuse_send_read(req, io, pos, nbytes, owner);
 
                 if (!io->async)
-                        fuse_release_user_pages(req, !write);
+                        fuse_release_user_pages(req, should_dirty);
                 if (req->out.h.error) {
                         err = req->out.h.error;
                         break;
diff --git a/fs/iomap.c b/fs/iomap.c
index 0342254646e3..706270f21b35 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -428,9 +428,12 @@ static int iomap_to_fiemap(struct fiemap_extent_info *fi,
                 break;
         }
 
+        if (iomap->flags & IOMAP_F_MERGED)
+                flags |= FIEMAP_EXTENT_MERGED;
+
         return fiemap_fill_next_extent(fi, iomap->offset,
                         iomap->blkno != IOMAP_NULL_BLOCK ? iomap->blkno << 9: 0,
-                        iomap->length, flags | FIEMAP_EXTENT_MERGED);
+                        iomap->length, flags);
 
 }
 
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index e1574008adc9..2bcb86e6e6ca 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -840,21 +840,35 @@ repeat:
         mutex_lock(&kernfs_mutex);
 
         list_for_each_entry(info, &kernfs_root(kn)->supers, node) {
+                struct kernfs_node *parent;
                 struct inode *inode;
-                struct dentry *dentry;
 
+                /*
+                 * We want fsnotify_modify() on @kn but as the
+                 * modifications aren't originating from userland don't
+                 * have the matching @file available.  Look up the inodes
+                 * and generate the events manually.
+                 */
                 inode = ilookup(info->sb, kn->ino);
                 if (!inode)
                         continue;
 
-                dentry = d_find_any_alias(inode);
-                if (dentry) {
-                        fsnotify_parent(NULL, dentry, FS_MODIFY);
-                        fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE,
-                                 NULL, 0);
-                        dput(dentry);
+                parent = kernfs_get_parent(kn);
+                if (parent) {
+                        struct inode *p_inode;
+
+                        p_inode = ilookup(info->sb, parent->ino);
+                        if (p_inode) {
+                                fsnotify(p_inode, FS_MODIFY | FS_EVENT_ON_CHILD,
+                                         inode, FSNOTIFY_EVENT_INODE, kn->name, 0);
+                                iput(p_inode);
+                        }
+
+                        kernfs_put(parent);
                 }
 
+                fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE,
+                         kn->name, 0);
                 iput(inode);
         }
 
diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
index f55a4e756047..217847679f0e 100644
--- a/fs/nfs/blocklayout/blocklayout.c
+++ b/fs/nfs/blocklayout/blocklayout.c
@@ -346,7 +346,7 @@ static void bl_write_cleanup(struct work_struct *work)
                         PAGE_SIZE - 1) & (loff_t)PAGE_MASK;
 
                 ext_tree_mark_written(bl, start >> SECTOR_SHIFT,
-                                        (end - start) >> SECTOR_SHIFT);
+                                        (end - start) >> SECTOR_SHIFT, end);
         }
 
         pnfs_ld_write_done(hdr);
diff --git a/fs/nfs/blocklayout/blocklayout.h b/fs/nfs/blocklayout/blocklayout.h
index 18e6fd0b9506..efc007f00742 100644
--- a/fs/nfs/blocklayout/blocklayout.h
+++ b/fs/nfs/blocklayout/blocklayout.h
@@ -141,6 +141,7 @@ struct pnfs_block_layout {
         struct rb_root          bl_ext_ro;
         spinlock_t              bl_ext_lock;   /* Protects list manipulation */
         bool                    bl_scsi_layout;
+        u64                     bl_lwb;
 };
 
 static inline struct pnfs_block_layout *
@@ -182,7 +183,7 @@ int ext_tree_insert(struct pnfs_block_layout *bl,
 int ext_tree_remove(struct pnfs_block_layout *bl, bool rw, sector_t start,
                 sector_t end);
 int ext_tree_mark_written(struct pnfs_block_layout *bl, sector_t start,
-                sector_t len);
+                sector_t len, u64 lwb);
 bool ext_tree_lookup(struct pnfs_block_layout *bl, sector_t isect,
                 struct pnfs_block_extent *ret, bool rw);
 int ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg);
diff --git a/fs/nfs/blocklayout/extent_tree.c b/fs/nfs/blocklayout/extent_tree.c
index 992bcb19c11e..c85fbfd2d0d9 100644
--- a/fs/nfs/blocklayout/extent_tree.c
+++ b/fs/nfs/blocklayout/extent_tree.c
@@ -402,7 +402,7 @@ ext_tree_split(struct rb_root *root, struct pnfs_block_extent *be,
 
 int
 ext_tree_mark_written(struct pnfs_block_layout *bl, sector_t start,
-                sector_t len)
+                sector_t len, u64 lwb)
 {
         struct rb_root *root = &bl->bl_ext_rw;
         sector_t end = start + len;
@@ -471,6 +471,8 @@ ext_tree_mark_written(struct pnfs_block_layout *bl, sector_t start,
                 }
         }
 out:
+        if (bl->bl_lwb < lwb)
+                bl->bl_lwb = lwb;
         spin_unlock(&bl->bl_ext_lock);
 
         __ext_put_deviceids(&tmp);
@@ -518,7 +520,7 @@ static __be32 *encode_scsi_range(struct pnfs_block_extent *be, __be32 *p)
 }
 
 static int ext_tree_encode_commit(struct pnfs_block_layout *bl, __be32 *p,
-                size_t buffer_size, size_t *count)
+                size_t buffer_size, size_t *count, __u64 *lastbyte)
 {
         struct pnfs_block_extent *be;
         int ret = 0;
@@ -542,6 +544,8 @@ static int ext_tree_encode_commit(struct pnfs_block_layout *bl, __be32 *p,
                         p = encode_block_extent(be, p);
                 be->be_tag = EXTENT_COMMITTING;
         }
+        *lastbyte = bl->bl_lwb - 1;
+        bl->bl_lwb = 0;
         spin_unlock(&bl->bl_ext_lock);
 
         return ret;
@@ -564,7 +568,7 @@ ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg)
         arg->layoutupdate_pages = &arg->layoutupdate_page;
 
 retry:
-        ret = ext_tree_encode_commit(bl, start_p + 1, buffer_size, &count);
+        ret = ext_tree_encode_commit(bl, start_p + 1, buffer_size, &count, &arg->lastbytewritten);
         if (unlikely(ret)) {
                 ext_tree_free_commitdata(arg, buffer_size);
 
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index a7f2e6e33305..52a28311e2a4 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -275,6 +275,7 @@ static int nfs_callback_up_net(int minorversion, struct svc_serv *serv,
 err_socks:
         svc_rpcb_cleanup(serv, net);
 err_bind:
+        nn->cb_users[minorversion]--;
         dprintk("NFS: Couldn't create callback socket: err = %d; "
                         "net = %p\n", ret, net);
         return ret;
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index c92a75e066a6..f953ef6b2f2e 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -454,11 +454,8 @@ static bool referring_call_exists(struct nfs_client *clp,
                                 ((u32 *)&rclist->rcl_sessionid.data)[3],
                                 ref->rc_sequenceid, ref->rc_slotid);
 
-                        spin_lock(&tbl->slot_tbl_lock);
-                        status = (test_bit(ref->rc_slotid, tbl->used_slots) &&
-                                  tbl->slots[ref->rc_slotid].seq_nr ==
-                                        ref->rc_sequenceid);
-                        spin_unlock(&tbl->slot_tbl_lock);
+                        status = nfs4_slot_wait_on_seqid(tbl, ref->rc_slotid,
+                                        ref->rc_sequenceid, HZ >> 1) < 0;
                         if (status)
                                 goto out;
                 }
@@ -487,7 +484,6 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
                 goto out;
 
         tbl = &clp->cl_session->bc_slot_table;
-        slot = tbl->slots + args->csa_slotid;
 
         /* Set up res before grabbing the spinlock */
         memcpy(&res->csr_sessionid, &args->csa_sessionid,
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 003ebce4bbc4..1e106780a237 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -426,7 +426,7 @@ EXPORT_SYMBOL_GPL(nfs_mark_client_ready);
  * Initialise the timeout values for a connection
  */
 void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
-                                    unsigned int timeo, unsigned int retrans)
+                                    int timeo, int retrans)
 {
         to->to_initval = timeo * HZ / 10;
         to->to_retries = retrans;
@@ -434,9 +434,9 @@ void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
         switch (proto) {
         case XPRT_TRANSPORT_TCP:
         case XPRT_TRANSPORT_RDMA:
-                if (to->to_retries == 0)
+                if (retrans == NFS_UNSPEC_RETRANS)
                         to->to_retries = NFS_DEF_TCP_RETRANS;
-                if (to->to_initval == 0)
+                if (timeo == NFS_UNSPEC_TIMEO || to->to_retries == 0)
                         to->to_initval = NFS_DEF_TCP_TIMEO * HZ / 10;
                 if (to->to_initval > NFS_MAX_TCP_TIMEOUT)
                         to->to_initval = NFS_MAX_TCP_TIMEOUT;
@@ -449,9 +449,9 @@ void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
                 to->to_exponential = 0;
                 break;
         case XPRT_TRANSPORT_UDP:
-                if (to->to_retries == 0)
+                if (retrans == NFS_UNSPEC_RETRANS)
                         to->to_retries = NFS_DEF_UDP_RETRANS;
-                if (!to->to_initval)
+                if (timeo == NFS_UNSPEC_TIMEO || to->to_initval == 0)
                         to->to_initval = NFS_DEF_UDP_TIMEO * HZ / 10;
                 if (to->to_initval > NFS_MAX_UDP_TIMEOUT)
                         to->to_initval = NFS_MAX_UDP_TIMEOUT;
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 7d620970f2e1..ca699ddc11c1 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -657,7 +657,10 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from)
         if (result <= 0)
                 goto out;
 
-        written = generic_write_sync(iocb, result);
+        result = generic_write_sync(iocb, result);
+        if (result < 0)
+                goto out;
+        written = result;
         iocb->ki_pos += written;
 
         /* Return error values */
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index e6206eaf2bdf..51b51369704c 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -37,6 +37,7 @@ ff_layout_alloc_layout_hdr(struct inode *inode, gfp_t gfp_flags)
         if (ffl) {
                 INIT_LIST_HEAD(&ffl->error_list);
                 INIT_LIST_HEAD(&ffl->mirrors);
+                ffl->last_report_time = ktime_get();
                 return &ffl->generic_hdr;
         } else
                 return NULL;
@@ -640,19 +641,18 @@ nfs4_ff_layoutstat_start_io(struct nfs4_ff_layout_mirror *mirror,
 {
         static const ktime_t notime = {0};
         s64 report_interval = FF_LAYOUTSTATS_REPORT_INTERVAL;
+        struct nfs4_flexfile_layout *ffl = FF_LAYOUT_FROM_HDR(mirror->layout);
 
         nfs4_ff_start_busy_timer(&layoutstat->busy_timer, now);
         if (ktime_equal(mirror->start_time, notime))
                 mirror->start_time = now;
-        if (ktime_equal(mirror->last_report_time, notime))
-                mirror->last_report_time = now;
         if (mirror->report_interval != 0)
                 report_interval = (s64)mirror->report_interval * 1000LL;
         else if (layoutstats_timer != 0)
                 report_interval = (s64)layoutstats_timer * 1000LL;
-        if (ktime_to_ms(ktime_sub(now, mirror->last_report_time)) >=
+        if (ktime_to_ms(ktime_sub(now, ffl->last_report_time)) >=
                         report_interval) {
-                mirror->last_report_time = now;
+                ffl->last_report_time = now;
                 return true;
         }
 
@@ -806,11 +806,14 @@ ff_layout_choose_best_ds_for_read(struct pnfs_layout_segment *lseg,
 {
         struct nfs4_ff_layout_segment *fls = FF_LAYOUT_LSEG(lseg);
         struct nfs4_pnfs_ds *ds;
+        bool fail_return = false;
         int idx;
 
         /* mirrors are sorted by efficiency */
         for (idx = start_idx; idx < fls->mirror_array_cnt; idx++) {
-                ds = nfs4_ff_layout_prepare_ds(lseg, idx, false);
+                if (idx+1 == fls->mirror_array_cnt)
+                        fail_return = true;
+                ds = nfs4_ff_layout_prepare_ds(lseg, idx, fail_return);
                 if (ds) {
                         *best_idx = idx;
                         return ds;
@@ -859,6 +862,7 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio,
         struct nfs4_pnfs_ds *ds;
         int ds_idx;
 
+retry:
         /* Use full layout for now */
         if (!pgio->pg_lseg)
                 ff_layout_pg_get_read(pgio, req, false);
@@ -871,10 +875,13 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio,
 
         ds = ff_layout_choose_best_ds_for_read(pgio->pg_lseg, 0, &ds_idx);
         if (!ds) {
-                if (ff_layout_no_fallback_to_mds(pgio->pg_lseg))
-                        goto out_pnfs;
-                else
+                if (!ff_layout_no_fallback_to_mds(pgio->pg_lseg))
                         goto out_mds;
+                pnfs_put_lseg(pgio->pg_lseg);
+                pgio->pg_lseg = NULL;
+                /* Sleep for 1 second before retrying */
+                ssleep(1);
+                goto retry;
         }
 
         mirror = FF_LAYOUT_COMP(pgio->pg_lseg, ds_idx);
@@ -890,12 +897,6 @@ out_mds:
         pnfs_put_lseg(pgio->pg_lseg);
         pgio->pg_lseg = NULL;
         nfs_pageio_reset_read_mds(pgio);
-        return;
-
-out_pnfs:
-        pnfs_set_lo_fail(pgio->pg_lseg);
-        pnfs_put_lseg(pgio->pg_lseg);
-        pgio->pg_lseg = NULL;
 }
 
 static void
@@ -909,6 +910,7 @@ ff_layout_pg_init_write(struct nfs_pageio_descriptor *pgio,
         int i;
         int status;
 
+retry:
         if (!pgio->pg_lseg) {
                 pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
                                                    req->wb_context,
@@ -940,10 +942,13 @@ ff_layout_pg_init_write(struct nfs_pageio_descriptor *pgio,
         for (i = 0; i < pgio->pg_mirror_count; i++) {
                 ds = nfs4_ff_layout_prepare_ds(pgio->pg_lseg, i, true);
                 if (!ds) {
-                        if (ff_layout_no_fallback_to_mds(pgio->pg_lseg))
-                                goto out_pnfs;
-                        else
+                        if (!ff_layout_no_fallback_to_mds(pgio->pg_lseg))
                                 goto out_mds;
+                        pnfs_put_lseg(pgio->pg_lseg);
+                        pgio->pg_lseg = NULL;
+                        /* Sleep for 1 second before retrying */
+                        ssleep(1);
+                        goto retry;
                 }
                 pgm = &pgio->pg_mirrors[i];
                 mirror = FF_LAYOUT_COMP(pgio->pg_lseg, i);
@@ -956,12 +961,6 @@ out_mds:
         pnfs_put_lseg(pgio->pg_lseg);
         pgio->pg_lseg = NULL;
         nfs_pageio_reset_write_mds(pgio);
-        return;
-
-out_pnfs:
-        pnfs_set_lo_fail(pgio->pg_lseg);
-        pnfs_put_lseg(pgio->pg_lseg);
-        pgio->pg_lseg = NULL;
 }
 
 static unsigned int
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index 1bcdb15d0c41..3ee0c9fcea76 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -84,7 +84,6 @@ struct nfs4_ff_layout_mirror {
         struct nfs4_ff_layoutstat       read_stat;
         struct nfs4_ff_layoutstat       write_stat;
         ktime_t                         start_time;
-        ktime_t                         last_report_time;
         u32                             report_interval;
 };
 
@@ -101,6 +100,7 @@ struct nfs4_flexfile_layout {
         struct pnfs_ds_commit_info commit_info;
         struct list_head        mirrors;
         struct list_head        error_list; /* nfs4_ff_layout_ds_err */
+        ktime_t                 last_report_time; /* Layoutstat report times */
 };
 
 static inline struct nfs4_flexfile_layout *
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 0aa36be71fce..f7a3f6b05369 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -17,8 +17,8 @@
 
 #define NFSDBG_FACILITY         NFSDBG_PNFS_LD
 
-static unsigned int dataserver_timeo = NFS4_DEF_DS_TIMEO;
-static unsigned int dataserver_retrans = NFS4_DEF_DS_RETRANS;
+static unsigned int dataserver_timeo = NFS_DEF_TCP_RETRANS;
+static unsigned int dataserver_retrans;
 
 void nfs4_ff_layout_put_deviceid(struct nfs4_ff_layout_ds *mirror_ds)
 {
@@ -379,7 +379,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
 
         devid = &mirror->mirror_ds->id_node;
         if (ff_layout_test_devid_unavailable(devid))
-                goto out;
+                goto out_fail;
 
         ds = mirror->mirror_ds->ds;
         /* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */
@@ -405,15 +405,16 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
                         mirror->mirror_ds->ds_versions[0].rsize = max_payload;
                 if (mirror->mirror_ds->ds_versions[0].wsize > max_payload)
                         mirror->mirror_ds->ds_versions[0].wsize = max_payload;
-        } else {
-                ff_layout_track_ds_error(FF_LAYOUT_FROM_HDR(lseg->pls_layout),
-                                         mirror, lseg->pls_range.offset,
-                                         lseg->pls_range.length, NFS4ERR_NXIO,
-                                         OP_ILLEGAL, GFP_NOIO);
-                if (fail_return || !ff_layout_has_available_ds(lseg))
-                        pnfs_error_mark_layout_for_return(ino, lseg);
-                ds = NULL;
+                goto out;
         }
+        ff_layout_track_ds_error(FF_LAYOUT_FROM_HDR(lseg->pls_layout),
+                                 mirror, lseg->pls_range.offset,
+                                 lseg->pls_range.length, NFS4ERR_NXIO,
+                                 OP_ILLEGAL, GFP_NOIO);
+out_fail:
+        if (fail_return || !ff_layout_has_available_ds(lseg))
+                pnfs_error_mark_layout_for_return(ino, lseg);
+        ds = NULL;
 out:
         return ds;
 }
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 7ce5e023c3c3..74935a19e4bf 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -58,6 +58,9 @@ struct nfs_clone_mount {
  */
 #define NFS_UNSPEC_PORT         (-1)
 
+#define NFS_UNSPEC_RETRANS      (UINT_MAX)
+#define NFS_UNSPEC_TIMEO        (UINT_MAX)
+
 /*
  * Maximum number of pages that readdir can use for creating
  * a vmapped array of pages.
@@ -156,7 +159,7 @@ struct nfs_client *nfs_get_client(const struct nfs_client_initdata *,
 int nfs_probe_fsinfo(struct nfs_server *server, struct nfs_fh *, struct nfs_fattr *);
 void nfs_server_insert_lists(struct nfs_server *);
 void nfs_server_remove_lists(struct nfs_server *);
-void nfs_init_timeout_values(struct rpc_timeout *, int, unsigned int, unsigned int);
+void nfs_init_timeout_values(struct rpc_timeout *to, int proto, int timeo, int retrans);
 int nfs_init_server_rpcclient(struct nfs_server *, const struct rpc_timeout *t,
                 rpc_authflavor_t);
 struct nfs_server *nfs_alloc_server(void);
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index 6f4752734804..64b43b4ad9dd 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -318,10 +318,22 @@ static void
 nfs42_layoutstat_prepare(struct rpc_task *task, void *calldata)
 {
         struct nfs42_layoutstat_data *data = calldata;
-        struct nfs_server *server = NFS_SERVER(data->args.inode);
+        struct inode *inode = data->inode;
+        struct nfs_server *server = NFS_SERVER(inode);
+        struct pnfs_layout_hdr *lo;
 
+        spin_lock(&inode->i_lock);
+        lo = NFS_I(inode)->layout;
+        if (!pnfs_layout_is_valid(lo)) {
+                spin_unlock(&inode->i_lock);
+                rpc_exit(task, 0);
+                return;
+        }
+        nfs4_stateid_copy(&data->args.stateid, &lo->plh_stateid);
+        spin_unlock(&inode->i_lock);
         nfs41_setup_sequence(nfs4_get_session(server), &data->args.seq_args,
                              &data->res.seq_res, task);
+
 }
 
 static void
@@ -341,11 +353,11 @@ nfs42_layoutstat_done(struct rpc_task *task, void *calldata)
         case -NFS4ERR_ADMIN_REVOKED:
         case -NFS4ERR_DELEG_REVOKED:
         case -NFS4ERR_STALE_STATEID:
-        case -NFS4ERR_OLD_STATEID:
         case -NFS4ERR_BAD_STATEID:
                 spin_lock(&inode->i_lock);
                 lo = NFS_I(inode)->layout;
-                if (lo && nfs4_stateid_match(&data->args.stateid,
+                if (pnfs_layout_is_valid(lo) &&
+                    nfs4_stateid_match(&data->args.stateid,
                                              &lo->plh_stateid)) {
                         LIST_HEAD(head);
 
@@ -359,11 +371,23 @@ nfs42_layoutstat_done(struct rpc_task *task, void *calldata)
                 } else
                         spin_unlock(&inode->i_lock);
                 break;
+        case -NFS4ERR_OLD_STATEID:
+                spin_lock(&inode->i_lock);
+                lo = NFS_I(inode)->layout;
+                if (pnfs_layout_is_valid(lo) &&
+                    nfs4_stateid_match_other(&data->args.stateid,
+                                        &lo->plh_stateid)) {
+                        /* Do we need to delay before resending? */
+                        if (!nfs4_stateid_is_newer(&lo->plh_stateid,
+                                                &data->args.stateid))
+                                rpc_delay(task, HZ);
+                        rpc_restart_call_prepare(task);
+                }
+                spin_unlock(&inode->i_lock);
+                break;
         case -ENOTSUPP:
         case -EOPNOTSUPP:
                 NFS_SERVER(inode)->caps &= ~NFS_CAP_LAYOUTSTATS;
-        default:
-                break;
         }
 
         dprintk("%s server returns %d\n", __func__, task->tk_status);
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 8d7d08d4f95f..cd3b7cfdde16 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -817,6 +817,11 @@ static int nfs4_set_client(struct nfs_server *server,
                 goto error;
         }
 
+        if (server->nfs_client == clp) {
+                error = -ELOOP;
+                goto error;
+        }
+
         /*
          * Query for the lease time on clientid setup or renewal
          *
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 1949bbd806eb..a9dec32ba9ba 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -634,15 +634,11 @@ out_sleep:
 }
 EXPORT_SYMBOL_GPL(nfs40_setup_sequence);
 
-static int nfs40_sequence_done(struct rpc_task *task,
-                               struct nfs4_sequence_res *res)
+static void nfs40_sequence_free_slot(struct nfs4_sequence_res *res)
 {
         struct nfs4_slot *slot = res->sr_slot;
         struct nfs4_slot_table *tbl;
 
-        if (slot == NULL)
-                goto out;
-
         tbl = slot->table;
         spin_lock(&tbl->slot_tbl_lock);
         if (!nfs41_wake_and_assign_slot(tbl, slot))
@@ -650,7 +646,13 @@ static int nfs40_sequence_done(struct rpc_task *task,
         spin_unlock(&tbl->slot_tbl_lock);
 
         res->sr_slot = NULL;
-out:
+}
+
+static int nfs40_sequence_done(struct rpc_task *task,
+                               struct nfs4_sequence_res *res)
+{
+        if (res->sr_slot != NULL)
+                nfs40_sequence_free_slot(res);
         return 1;
 }
 
@@ -666,6 +668,11 @@ static void nfs41_sequence_free_slot(struct nfs4_sequence_res *res)
         tbl = slot->table;
         session = tbl->session;
 
+        /* Bump the slot sequence number */
+        if (slot->seq_done)
+                slot->seq_nr++;
+        slot->seq_done = 0;
+
         spin_lock(&tbl->slot_tbl_lock);
         /* Be nice to the server: try to ensure that the last transmitted
          * value for highest_user_slotid <= target_highest_slotid
@@ -686,9 +693,12 @@ out_unlock:
         res->sr_slot = NULL;
         if (send_new_highest_used_slotid)
                 nfs41_notify_server(session->clp);
+        if (waitqueue_active(&tbl->slot_waitq))
+                wake_up_all(&tbl->slot_waitq);
 }
 
-int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
+static int nfs41_sequence_process(struct rpc_task *task,
+                struct nfs4_sequence_res *res)
 {
         struct nfs4_session *session;
         struct nfs4_slot *slot = res->sr_slot;
@@ -714,7 +724,7 @@ int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
         switch (res->sr_status) {
         case 0:
                 /* Update the slot's sequence and clientid lease timer */
-                ++slot->seq_nr;
+                slot->seq_done = 1;
                 clp = session->clp;
                 do_renew_lease(clp, res->sr_timestamp);
                 /* Check sequence flags */
@@ -769,16 +779,16 @@ int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
                 goto retry_nowait;
         default:
                 /* Just update the slot sequence no. */
-                ++slot->seq_nr;
+                slot->seq_done = 1;
         }
 out:
         /* The session may be reset by one of the error handlers. */
         dprintk("%s: Error %d free the slot \n", __func__, res->sr_status);
-        nfs41_sequence_free_slot(res);
 out_noaction:
         return ret;
 retry_nowait:
         if (rpc_restart_call_prepare(task)) {
+                nfs41_sequence_free_slot(res);
                 task->tk_status = 0;
                 ret = 0;
         }
@@ -789,8 +799,37 @@ out_retry:
         rpc_delay(task, NFS4_POLL_RETRY_MAX);
         return 0;
 }
+
+int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
+{
+        if (!nfs41_sequence_process(task, res))
+                return 0;
+        if (res->sr_slot != NULL)
+                nfs41_sequence_free_slot(res);
+        return 1;
+
+}
 EXPORT_SYMBOL_GPL(nfs41_sequence_done);
 
+static int nfs4_sequence_process(struct rpc_task *task, struct nfs4_sequence_res *res)
+{
+        if (res->sr_slot == NULL)
+                return 1;
+        if (res->sr_slot->table->session != NULL)
+                return nfs41_sequence_process(task, res);
+        return nfs40_sequence_done(task, res);
+}
+
+static void nfs4_sequence_free_slot(struct nfs4_sequence_res *res)
+{
+        if (res->sr_slot != NULL) {
+                if (res->sr_slot->table->session != NULL)
+                        nfs41_sequence_free_slot(res);
+                else
+                        nfs40_sequence_free_slot(res);
+        }
+}
+
 int nfs4_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
 {
         if (res->sr_slot == NULL)
@@ -920,6 +959,17 @@ static int nfs4_setup_sequence(const struct nfs_server *server,
                                     args, res, task);
 }
 
+static int nfs4_sequence_process(struct rpc_task *task, struct nfs4_sequence_res *res)
+{
+        return nfs40_sequence_done(task, res);
+}
+
+static void nfs4_sequence_free_slot(struct nfs4_sequence_res *res)
+{
+        if (res->sr_slot != NULL)
+                nfs40_sequence_free_slot(res);
+}
+
 int nfs4_sequence_done(struct rpc_task *task,
                        struct nfs4_sequence_res *res)
 {
@@ -1197,6 +1247,7 @@ static void nfs4_opendata_free(struct kref *kref)
         struct super_block *sb = p->dentry->d_sb;
 
         nfs_free_seqid(p->o_arg.seqid);
+        nfs4_sequence_free_slot(&p->o_res.seq_res);
         if (p->state != NULL)
                 nfs4_put_open_state(p->state);
         nfs4_put_state_owner(p->owner);
@@ -1656,9 +1707,14 @@ err:
 static struct nfs4_state *
 nfs4_opendata_to_nfs4_state(struct nfs4_opendata *data)
 {
+        struct nfs4_state *ret;
+
         if (data->o_arg.claim == NFS4_OPEN_CLAIM_PREVIOUS)
-                return _nfs4_opendata_reclaim_to_nfs4_state(data);
-        return _nfs4_opendata_to_nfs4_state(data);
+                ret =_nfs4_opendata_reclaim_to_nfs4_state(data);
+        else
+                ret = _nfs4_opendata_to_nfs4_state(data);
+        nfs4_sequence_free_slot(&data->o_res.seq_res);
+        return ret;
 }
 
 static struct nfs_open_context *nfs4_state_find_open_context(struct nfs4_state *state)
@@ -2056,7 +2112,7 @@ static void nfs4_open_done(struct rpc_task *task, void *calldata)
 
         data->rpc_status = task->tk_status;
 
-        if (!nfs4_sequence_done(task, &data->o_res.seq_res))
+        if (!nfs4_sequence_process(task, &data->o_res.seq_res))
                 return;
 
         if (task->tk_status == 0) {
@@ -7514,12 +7570,20 @@ static int _nfs4_proc_create_session(struct nfs_client *clp,
         status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
         trace_nfs4_create_session(clp, status);
 
+        switch (status) {
+        case -NFS4ERR_STALE_CLIENTID:
+        case -NFS4ERR_DELAY:
+        case -ETIMEDOUT:
+        case -EACCES:
+        case -EAGAIN:
+                goto out;
+        };
+
+        clp->cl_seqid++;
         if (!status) {
                 /* Verify the session's negotiated channel_attrs values */
                 status = nfs4_verify_channel_attrs(&args, &res);
                 /* Increment the clientid slot sequence id */
-                if (clp->cl_seqid == res.seqid)
-                        clp->cl_seqid++;
                 if (status)
                         goto out;
                 nfs4_update_session(session, &res);
@@ -7864,7 +7928,7 @@ static void nfs4_layoutget_done(struct rpc_task *task, void *calldata)
         struct nfs4_layoutget *lgp = calldata;
 
         dprintk("--> %s\n", __func__);
-        nfs41_sequence_done(task, &lgp->res.seq_res);
+        nfs41_sequence_process(task, &lgp->res.seq_res);
         dprintk("<-- %s\n", __func__);
 }
 
@@ -8080,6 +8144,7 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, long *timeout, gfp_t gfp_flags)
         /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
         if (status == 0 && lgp->res.layoutp->len)
                 lseg = pnfs_layout_process(lgp);
+        nfs4_sequence_free_slot(&lgp->res.seq_res);
         rpc_put_task(task);
         dprintk("<-- %s status=%d\n", __func__, status);
         if (status)
@@ -8106,7 +8171,7 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata)
 
         dprintk("--> %s\n", __func__);
 
-        if (!nfs41_sequence_done(task, &lrp->res.seq_res))
+        if (!nfs41_sequence_process(task, &lrp->res.seq_res))
                 return;
 
         server = NFS_SERVER(lrp->args.inode);
@@ -8118,6 +8183,7 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata)
         case -NFS4ERR_DELAY:
                 if (nfs4_async_handle_error(task, server, NULL, NULL) != -EAGAIN)
                         break;
+                nfs4_sequence_free_slot(&lrp->res.seq_res);
                 rpc_restart_call_prepare(task);
                 return;
         }
@@ -8132,12 +8198,16 @@ static void nfs4_layoutreturn_release(void *calldata)
 
         dprintk("--> %s\n", __func__);
         spin_lock(&lo->plh_inode->i_lock);
-        pnfs_mark_matching_lsegs_invalid(lo, &freeme, &lrp->args.range,
-                        be32_to_cpu(lrp->args.stateid.seqid));
-        if (lrp->res.lrs_present && pnfs_layout_is_valid(lo))
+        if (lrp->res.lrs_present) {
+                pnfs_mark_matching_lsegs_invalid(lo, &freeme,
+                                &lrp->args.range,
+                                be32_to_cpu(lrp->args.stateid.seqid));
                 pnfs_set_layout_stateid(lo, &lrp->res.stateid, true);
+        } else
+                pnfs_mark_layout_stateid_invalid(lo, &freeme);
         pnfs_clear_layoutreturn_waitbit(lo);
         spin_unlock(&lo->plh_inode->i_lock);
+        nfs4_sequence_free_slot(&lrp->res.seq_res);
         pnfs_free_lseg_list(&freeme);
         pnfs_put_layout_hdr(lrp->args.layout);
         nfs_iput_and_deactive(lrp->inode);
diff --git a/fs/nfs/nfs4session.c b/fs/nfs/nfs4session.c
index 332d06e64fa9..b62973045a3e 100644
--- a/fs/nfs/nfs4session.c
+++ b/fs/nfs/nfs4session.c
@@ -28,6 +28,7 @@ static void nfs4_init_slot_table(struct nfs4_slot_table *tbl, const char *queue)
         tbl->highest_used_slotid = NFS4_NO_SLOT;
         spin_lock_init(&tbl->slot_tbl_lock);
         rpc_init_priority_wait_queue(&tbl->slot_tbl_waitq, queue);
+        init_waitqueue_head(&tbl->slot_waitq);
         init_completion(&tbl->complete);
 }
 
@@ -172,6 +173,58 @@ struct nfs4_slot *nfs4_lookup_slot(struct nfs4_slot_table *tbl, u32 slotid)
         return ERR_PTR(-E2BIG);
 }
 
+static int nfs4_slot_get_seqid(struct nfs4_slot_table  *tbl, u32 slotid,
+                u32 *seq_nr)
+        __must_hold(&tbl->slot_tbl_lock)
+{
+        struct nfs4_slot *slot;
+
+        slot = nfs4_lookup_slot(tbl, slotid);
+        if (IS_ERR(slot))
+                return PTR_ERR(slot);
+        *seq_nr = slot->seq_nr;
+        return 0;
+}
+
+/*
+ * nfs4_slot_seqid_in_use - test if a slot sequence id is still in use
+ *
+ * Given a slot table, slot id and sequence number, determine if the
+ * RPC call in question is still in flight. This function is mainly
+ * intended for use by the callback channel.
+ */
+static bool nfs4_slot_seqid_in_use(struct nfs4_slot_table *tbl,
+                u32 slotid, u32 seq_nr)
+{
+        u32 cur_seq;
+        bool ret = false;
+
+        spin_lock(&tbl->slot_tbl_lock);
+        if (nfs4_slot_get_seqid(tbl, slotid, &cur_seq) == 0 &&
+            cur_seq == seq_nr && test_bit(slotid, tbl->used_slots))
+                ret = true;
+        spin_unlock(&tbl->slot_tbl_lock);
+        return ret;
+}
+
+/*
+ * nfs4_slot_wait_on_seqid - wait until a slot sequence id is complete
+ *
+ * Given a slot table, slot id and sequence number, wait until the
+ * corresponding RPC call completes. This function is mainly
+ * intended for use by the callback channel.
+ */
+int nfs4_slot_wait_on_seqid(struct nfs4_slot_table *tbl,
+                u32 slotid, u32 seq_nr,
+                unsigned long timeout)
+{
+        if (wait_event_timeout(tbl->slot_waitq,
+                        !nfs4_slot_seqid_in_use(tbl, slotid, seq_nr),
+                        timeout) == 0)
+                return -ETIMEDOUT;
+        return 0;
+}
+
 /*
  * nfs4_alloc_slot - efficiently look for a free slot
  *
diff --git a/fs/nfs/nfs4session.h b/fs/nfs/nfs4session.h
index 5b51298d1d03..f703b755351b 100644
--- a/fs/nfs/nfs4session.h
+++ b/fs/nfs/nfs4session.h
@@ -21,7 +21,8 @@ struct nfs4_slot {
         unsigned long           generation;
         u32                     slot_nr;
         u32                     seq_nr;
-        unsigned int            interrupted : 1;
+        unsigned int            interrupted : 1,
+                                seq_done : 1;
 };
 
 /* Sessions */
@@ -36,6 +37,7 @@ struct nfs4_slot_table {
         unsigned long   used_slots[SLOT_TABLE_SZ]; /* used/unused bitmap */
         spinlock_t      slot_tbl_lock;
         struct rpc_wait_queue   slot_tbl_waitq; /* allocators may wait here */
+        wait_queue_head_t       slot_waitq;     /* Completion wait on slot */
         u32             max_slots;              /* # slots in table */
         u32             max_slotid;             /* Max allowed slotid value */
         u32             highest_used_slotid;    /* sent to server on each SEQ.
@@ -78,6 +80,9 @@ extern int nfs4_setup_slot_table(struct nfs4_slot_table *tbl,
 extern void nfs4_shutdown_slot_table(struct nfs4_slot_table *tbl);
 extern struct nfs4_slot *nfs4_alloc_slot(struct nfs4_slot_table *tbl);
 extern struct nfs4_slot *nfs4_lookup_slot(struct nfs4_slot_table *tbl, u32 slotid);
+extern int nfs4_slot_wait_on_seqid(struct nfs4_slot_table *tbl,
+                u32 slotid, u32 seq_nr,
+                unsigned long timeout);
 extern bool nfs4_try_to_lock_slot(struct nfs4_slot_table *tbl, struct nfs4_slot *slot);
 extern void nfs4_free_slot(struct nfs4_slot_table *tbl, struct nfs4_slot *slot);
 extern void nfs4_slot_tbl_drain_complete(struct nfs4_slot_table *tbl);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 70806cae0d36..2c93a85eda51 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -365,7 +365,8 @@ pnfs_layout_remove_lseg(struct pnfs_layout_hdr *lo,
         /* Matched by pnfs_get_layout_hdr in pnfs_layout_insert_lseg */
         atomic_dec(&lo->plh_refcount);
         if (list_empty(&lo->plh_segs)) {
-                set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
+                if (atomic_read(&lo->plh_outstanding) == 0)
+                        set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
                 clear_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags);
         }
         rpc_wake_up(&NFS_SERVER(inode)->roc_rpcwaitq);
@@ -768,17 +769,32 @@ pnfs_destroy_all_layouts(struct nfs_client *clp)
         pnfs_destroy_layouts_byclid(clp, false);
 }
 
+static void
+pnfs_clear_layoutreturn_info(struct pnfs_layout_hdr *lo)
+{
+        lo->plh_return_iomode = 0;
+        lo->plh_return_seq = 0;
+        clear_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags);
+}
+
 /* update lo->plh_stateid with new if is more recent */
 void
 pnfs_set_layout_stateid(struct pnfs_layout_hdr *lo, const nfs4_stateid *new,
                         bool update_barrier)
 {
         u32 oldseq, newseq, new_barrier = 0;
-        bool invalid = !pnfs_layout_is_valid(lo);
 
         oldseq = be32_to_cpu(lo->plh_stateid.seqid);
         newseq = be32_to_cpu(new->seqid);
-        if (invalid || pnfs_seqid_is_newer(newseq, oldseq)) {
+
+        if (!pnfs_layout_is_valid(lo)) {
+                nfs4_stateid_copy(&lo->plh_stateid, new);
+                lo->plh_barrier = newseq;
+                pnfs_clear_layoutreturn_info(lo);
+                clear_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
+                return;
+        }
+        if (pnfs_seqid_is_newer(newseq, oldseq)) {
                 nfs4_stateid_copy(&lo->plh_stateid, new);
                 /*
                  * Because of wraparound, we want to keep the barrier
@@ -790,7 +806,7 @@ pnfs_set_layout_stateid(struct pnfs_layout_hdr *lo, const nfs4_stateid *new,
                 new_barrier = be32_to_cpu(new->seqid);
         else if (new_barrier == 0)
                 return;
-        if (invalid || pnfs_seqid_is_newer(new_barrier, lo->plh_barrier))
+        if (pnfs_seqid_is_newer(new_barrier, lo->plh_barrier))
                 lo->plh_barrier = new_barrier;
 }
 
@@ -886,19 +902,14 @@ void pnfs_clear_layoutreturn_waitbit(struct pnfs_layout_hdr *lo)
         rpc_wake_up(&NFS_SERVER(lo->plh_inode)->roc_rpcwaitq);
 }
 
-static void
-pnfs_clear_layoutreturn_info(struct pnfs_layout_hdr *lo)
-{
-        lo->plh_return_iomode = 0;
-        lo->plh_return_seq = 0;
-        clear_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags);
-}
-
 static bool
 pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo,
                 nfs4_stateid *stateid,
                 enum pnfs_iomode *iomode)
 {
+        /* Serialise LAYOUTGET/LAYOUTRETURN */
+        if (atomic_read(&lo->plh_outstanding) != 0)
+                return false;
         if (test_and_set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
                 return false;
         pnfs_get_layout_hdr(lo);
@@ -1555,6 +1566,7 @@ pnfs_update_layout(struct inode *ino,
         }
 
 lookup_again:
+        nfs4_client_recover_expired_lease(clp);
         first = false;
         spin_lock(&ino->i_lock);
         lo = pnfs_find_alloc_layout(ino, ctx, gfp_flags);
@@ -1797,16 +1809,11 @@ pnfs_layout_process(struct nfs4_layoutget *lgp)
                  */
                 pnfs_mark_layout_stateid_invalid(lo, &free_me);
 
-                nfs4_stateid_copy(&lo->plh_stateid, &res->stateid);
-                lo->plh_barrier = be32_to_cpu(res->stateid.seqid);
+                pnfs_set_layout_stateid(lo, &res->stateid, true);
         }
 
         pnfs_get_lseg(lseg);
         pnfs_layout_insert_lseg(lo, lseg, &free_me);
-        if (!pnfs_layout_is_valid(lo)) {
-                pnfs_clear_layoutreturn_info(lo);
-                clear_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
-        }
 
 
         if (res->return_on_close)
@@ -2510,7 +2517,6 @@ pnfs_report_layoutstat(struct inode *inode, gfp_t gfp_flags)
 
         data->args.fh = NFS_FH(inode);
         data->args.inode = inode;
-        nfs4_stateid_copy(&data->args.stateid, &hdr->plh_stateid);
         status = ld->prepare_layoutstats(&data->args);
         if (status)
                 goto out_free;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 18d446e1a82b..d39601381adf 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -923,6 +923,8 @@ static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(void)
 
         data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (data) {
+                data->timeo             = NFS_UNSPEC_TIMEO;
+                data->retrans           = NFS_UNSPEC_RETRANS;
                 data->acregmin          = NFS_DEF_ACREGMIN;
                 data->acregmax          = NFS_DEF_ACREGMAX;
                 data->acdirmin          = NFS_DEF_ACDIRMIN;
@@ -1189,6 +1191,19 @@ static int nfs_get_option_ul(substring_t args[], unsigned long *option)
         return rc;
 }
 
+static int nfs_get_option_ul_bound(substring_t args[], unsigned long *option,
+                unsigned long l_bound, unsigned long u_bound)
+{
+        int ret;
+
+        ret = nfs_get_option_ul(args, option);
+        if (ret != 0)
+                return ret;
+        if (*option < l_bound || *option > u_bound)
+                return -ERANGE;
+        return 0;
+}
+
 /*
  * Error-check and convert a string of mount options from user space into
  * a data structure.  The whole mount string is processed; bad options are
@@ -1352,12 +1367,12 @@ static int nfs_parse_mount_options(char *raw,
                         mnt->bsize = option;
                         break;
                 case Opt_timeo:
-                        if (nfs_get_option_ul(args, &option) || option == 0)
+                        if (nfs_get_option_ul_bound(args, &option, 1, INT_MAX))
                                 goto out_invalid_value;
                         mnt->timeo = option;
                         break;
                 case Opt_retrans:
-                        if (nfs_get_option_ul(args, &option) || option == 0)
+                        if (nfs_get_option_ul_bound(args, &option, 0, INT_MAX))
                                 goto out_invalid_value;
                         mnt->retrans = option;
                         break;
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 54e5d6681786..43fdc2765aea 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -80,6 +80,8 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
         }
 
         for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
+                if (ovl_is_private_xattr(name))
+                        continue;
 retry:
                 size = vfs_getxattr(old, name, value, value_size);
                 if (size == -ERANGE)
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 12bcd07b9e32..1560fdc09a5f 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -12,6 +12,8 @@
 #include <linux/xattr.h>
 #include <linux/security.h>
 #include <linux/cred.h>
+#include <linux/posix_acl.h>
+#include <linux/posix_acl_xattr.h>
 #include "overlayfs.h"
 
 void ovl_cleanup(struct inode *wdir, struct dentry *wdentry)
@@ -186,6 +188,9 @@ static int ovl_create_upper(struct dentry *dentry, struct inode *inode,
         struct dentry *newdentry;
         int err;
 
+        if (!hardlink && !IS_POSIXACL(udir))
+                stat->mode &= ~current_umask();
+
         inode_lock_nested(udir, I_MUTEX_PARENT);
         newdentry = lookup_one_len(dentry->d_name.name, upperdir,
                                    dentry->d_name.len);
@@ -335,6 +340,32 @@ out_free:
         return ret;
 }
 
+static int ovl_set_upper_acl(struct dentry *upperdentry, const char *name,
+                             const struct posix_acl *acl)
+{
+        void *buffer;
+        size_t size;
+        int err;
+
+        if (!IS_ENABLED(CONFIG_FS_POSIX_ACL) || !acl)
+                return 0;
+
+        size = posix_acl_to_xattr(NULL, acl, NULL, 0);
+        buffer = kmalloc(size, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
+
+        size = posix_acl_to_xattr(&init_user_ns, acl, buffer, size);
+        err = size;
+        if (err < 0)
+                goto out_free;
+
+        err = vfs_setxattr(upperdentry, name, buffer, size, XATTR_CREATE);
+out_free:
+        kfree(buffer);
+        return err;
+}
+
 static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
                                     struct kstat *stat, const char *link,
                                     struct dentry *hardlink)
@@ -346,10 +377,18 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
         struct dentry *upper;
         struct dentry *newdentry;
         int err;
+        struct posix_acl *acl, *default_acl;
 
         if (WARN_ON(!workdir))
                 return -EROFS;
 
+        if (!hardlink) {
+                err = posix_acl_create(dentry->d_parent->d_inode,
+                                       &stat->mode, &default_acl, &acl);
+                if (err)
+                        return err;
+        }
+
         err = ovl_lock_rename_workdir(workdir, upperdir);
         if (err)
                 goto out;
@@ -384,6 +423,17 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
                 if (err)
                         goto out_cleanup;
         }
+        if (!hardlink) {
+                err = ovl_set_upper_acl(newdentry, XATTR_NAME_POSIX_ACL_ACCESS,
+                                        acl);
+                if (err)
+                        goto out_cleanup;
+
+                err = ovl_set_upper_acl(newdentry, XATTR_NAME_POSIX_ACL_DEFAULT,
+                                        default_acl);
+                if (err)
+                        goto out_cleanup;
+        }
 
         if (!hardlink && S_ISDIR(stat->mode)) {
                 err = ovl_set_opaque(newdentry);
@@ -410,6 +460,10 @@ out_dput:
 out_unlock:
         unlock_rename(workdir, upperdir);
 out:
+        if (!hardlink) {
+                posix_acl_release(acl);
+                posix_acl_release(default_acl);
+        }
         return err;
 
 out_cleanup:
@@ -950,9 +1004,9 @@ const struct inode_operations ovl_dir_inode_operations = {
         .permission     = ovl_permission,
         .getattr        = ovl_dir_getattr,
         .setxattr       = generic_setxattr,
-        .getxattr       = ovl_getxattr,
+        .getxattr       = generic_getxattr,
         .listxattr      = ovl_listxattr,
-        .removexattr    = ovl_removexattr,
+        .removexattr    = generic_removexattr,
         .get_acl        = ovl_get_acl,
         .update_time    = ovl_update_time,
 };
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 1b885c156028..c75625c1efa3 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -10,6 +10,7 @@
 #include <linux/fs.h>
 #include <linux/slab.h>
 #include <linux/xattr.h>
+#include <linux/posix_acl.h>
 #include "overlayfs.h"
 
 static int ovl_copy_up_truncate(struct dentry *dentry)
@@ -191,32 +192,44 @@ static int ovl_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
         return err;
 }
 
-static bool ovl_is_private_xattr(const char *name)
+bool ovl_is_private_xattr(const char *name)
 {
-#define OVL_XATTR_PRE_NAME OVL_XATTR_PREFIX "."
-        return strncmp(name, OVL_XATTR_PRE_NAME,
-                       sizeof(OVL_XATTR_PRE_NAME) - 1) == 0;
+        return strncmp(name, OVL_XATTR_PREFIX,
+                       sizeof(OVL_XATTR_PREFIX) - 1) == 0;
 }
 
-int ovl_setxattr(struct dentry *dentry, struct inode *inode,
-                 const char *name, const void *value,
-                 size_t size, int flags)
+int ovl_xattr_set(struct dentry *dentry, const char *name, const void *value,
+                  size_t size, int flags)
 {
         int err;
-        struct dentry *upperdentry;
+        struct path realpath;
+        enum ovl_path_type type = ovl_path_real(dentry, &realpath);
         const struct cred *old_cred;
 
         err = ovl_want_write(dentry);
         if (err)
                 goto out;
 
+        if (!value && !OVL_TYPE_UPPER(type)) {
+                err = vfs_getxattr(realpath.dentry, name, NULL, 0);
+                if (err < 0)
+                        goto out_drop_write;
+        }
+
         err = ovl_copy_up(dentry);
         if (err)
                 goto out_drop_write;
 
-        upperdentry = ovl_dentry_upper(dentry);
+        if (!OVL_TYPE_UPPER(type))
+                ovl_path_upper(dentry, &realpath);
+
         old_cred = ovl_override_creds(dentry->d_sb);
-        err = vfs_setxattr(upperdentry, name, value, size, flags);
+        if (value)
+                err = vfs_setxattr(realpath.dentry, name, value, size, flags);
+        else {
+                WARN_ON(flags != XATTR_REPLACE);
+                err = vfs_removexattr(realpath.dentry, name);
+        }
         revert_creds(old_cred);
 
 out_drop_write:
@@ -225,16 +238,13 @@ out:
         return err;
 }
 
-ssize_t ovl_getxattr(struct dentry *dentry, struct inode *inode,
-                     const char *name, void *value, size_t size)
+int ovl_xattr_get(struct dentry *dentry, const char *name,
+                  void *value, size_t size)
 {
         struct dentry *realdentry = ovl_dentry_real(dentry);
         ssize_t res;
         const struct cred *old_cred;
 
-        if (ovl_is_private_xattr(name))
-                return -ENODATA;
-
         old_cred = ovl_override_creds(dentry->d_sb);
         res = vfs_getxattr(realdentry, name, value, size);
         revert_creds(old_cred);
@@ -245,7 +255,8 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
 {
         struct dentry *realdentry = ovl_dentry_real(dentry);
         ssize_t res;
-        int off;
+        size_t len;
+        char *s;
         const struct cred *old_cred;
 
         old_cred = ovl_override_creds(dentry->d_sb);
@@ -255,73 +266,39 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
                 return res;
 
         /* filter out private xattrs */
-        for (off = 0; off < res;) {
-                char *s = list + off;
-                size_t slen = strlen(s) + 1;
+        for (s = list, len = res; len;) {
+                size_t slen = strnlen(s, len) + 1;
 
-                BUG_ON(off + slen > res);
+                /* underlying fs providing us with an broken xattr list? */
+                if (WARN_ON(slen > len))
+                        return -EIO;
 
+                len -= slen;
                 if (ovl_is_private_xattr(s)) {
                         res -= slen;
-                        memmove(s, s + slen, res - off);
+                        memmove(s, s + slen, len);
                 } else {
-                        off += slen;
+                        s += slen;
                 }
         }
 
         return res;
 }
 
-int ovl_removexattr(struct dentry *dentry, const char *name)
-{
-        int err;
-        struct path realpath;
-        enum ovl_path_type type = ovl_path_real(dentry, &realpath);
-        const struct cred *old_cred;
-
-        err = ovl_want_write(dentry);
-        if (err)
-                goto out;
-
-        err = -ENODATA;
-        if (ovl_is_private_xattr(name))
-                goto out_drop_write;
-
-        if (!OVL_TYPE_UPPER(type)) {
-                err = vfs_getxattr(realpath.dentry, name, NULL, 0);
-                if (err < 0)
-                        goto out_drop_write;
-
-                err = ovl_copy_up(dentry);
-                if (err)
-                        goto out_drop_write;
-
-                ovl_path_upper(dentry, &realpath);
-        }
-
-        old_cred = ovl_override_creds(dentry->d_sb);
-        err = vfs_removexattr(realpath.dentry, name);
-        revert_creds(old_cred);
-out_drop_write:
-        ovl_drop_write(dentry);
-out:
-        return err;
-}
-
 struct posix_acl *ovl_get_acl(struct inode *inode, int type)
 {
         struct inode *realinode = ovl_inode_real(inode, NULL);
         const struct cred *old_cred;
         struct posix_acl *acl;
 
-        if (!IS_POSIXACL(realinode))
+        if (!IS_ENABLED(CONFIG_FS_POSIX_ACL) || !IS_POSIXACL(realinode))
                 return NULL;
 
         if (!realinode->i_op->get_acl)
                 return NULL;
 
         old_cred = ovl_override_creds(inode->i_sb);
-        acl = realinode->i_op->get_acl(realinode, type);
+        acl = get_acl(realinode, type);
         revert_creds(old_cred);
 
         return acl;
@@ -391,9 +368,9 @@ static const struct inode_operations ovl_file_inode_operations = {
         .permission     = ovl_permission,
         .getattr        = ovl_getattr,
         .setxattr       = generic_setxattr,
-        .getxattr       = ovl_getxattr,
+        .getxattr       = generic_getxattr,
         .listxattr      = ovl_listxattr,
-        .removexattr    = ovl_removexattr,
+        .removexattr    = generic_removexattr,
         .get_acl        = ovl_get_acl,
         .update_time    = ovl_update_time,
 };
@@ -404,9 +381,9 @@ static const struct inode_operations ovl_symlink_inode_operations = {
         .readlink       = ovl_readlink,
         .getattr        = ovl_getattr,
         .setxattr       = generic_setxattr,
-        .getxattr       = ovl_getxattr,
+        .getxattr       = generic_getxattr,
         .listxattr      = ovl_listxattr,
-        .removexattr    = ovl_removexattr,
+        .removexattr    = generic_removexattr,
         .update_time    = ovl_update_time,
 };
 
@@ -415,6 +392,9 @@ static void ovl_fill_inode(struct inode *inode, umode_t mode)
         inode->i_ino = get_next_ino();
         inode->i_mode = mode;
         inode->i_flags |= S_NOCMTIME;
+#ifdef CONFIG_FS_POSIX_ACL
+        inode->i_acl = inode->i_default_acl = ACL_DONT_CACHE;
+#endif
 
         mode &= S_IFMT;
         switch (mode) {
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index e4f5c9536bfe..5813ccff8cd9 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -24,8 +24,8 @@ enum ovl_path_type {
         (OVL_TYPE_MERGE(type) || !OVL_TYPE_UPPER(type))
 
 
-#define OVL_XATTR_PREFIX XATTR_TRUSTED_PREFIX "overlay"
-#define OVL_XATTR_OPAQUE OVL_XATTR_PREFIX ".opaque"
+#define OVL_XATTR_PREFIX XATTR_TRUSTED_PREFIX "overlay."
+#define OVL_XATTR_OPAQUE OVL_XATTR_PREFIX "opaque"
 
 #define OVL_ISUPPER_MASK 1UL
 
@@ -179,20 +179,21 @@ int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list);
 void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list);
 void ovl_cache_free(struct list_head *list);
 int ovl_check_d_type_supported(struct path *realpath);
+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
+                         struct dentry *dentry, int level);
 
 /* inode.c */
 int ovl_setattr(struct dentry *dentry, struct iattr *attr);
 int ovl_permission(struct inode *inode, int mask);
-int ovl_setxattr(struct dentry *dentry, struct inode *inode,
-                 const char *name, const void *value,
-                 size_t size, int flags);
-ssize_t ovl_getxattr(struct dentry *dentry, struct inode *inode,
-                     const char *name, void *value, size_t size);
+int ovl_xattr_set(struct dentry *dentry, const char *name, const void *value,
+                  size_t size, int flags);
+int ovl_xattr_get(struct dentry *dentry, const char *name,
+                  void *value, size_t size);
 ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
-int ovl_removexattr(struct dentry *dentry, const char *name);
 struct posix_acl *ovl_get_acl(struct inode *inode, int type);
 int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags);
 int ovl_update_time(struct inode *inode, struct timespec *ts, int flags);
+bool ovl_is_private_xattr(const char *name);
 
 struct inode *ovl_new_inode(struct super_block *sb, umode_t mode);
 struct inode *ovl_get_inode(struct super_block *sb, struct inode *realinode);
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index cf37fc76fc9f..f241b4ee3d8a 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -248,7 +248,7 @@ static inline int ovl_dir_read(struct path *realpath,
                         err = rdd->err;
         } while (!err && rdd->count);
 
-        if (!err && rdd->first_maybe_whiteout)
+        if (!err && rdd->first_maybe_whiteout && rdd->dentry)
                 err = ovl_check_whiteouts(realpath->dentry, rdd);
 
         fput(realfile);
@@ -606,3 +606,64 @@ int ovl_check_d_type_supported(struct path *realpath)
 
         return rdd.d_type_supported;
 }
+
+static void ovl_workdir_cleanup_recurse(struct path *path, int level)
+{
+        int err;
+        struct inode *dir = path->dentry->d_inode;
+        LIST_HEAD(list);
+        struct ovl_cache_entry *p;
+        struct ovl_readdir_data rdd = {
+                .ctx.actor = ovl_fill_merge,
+                .dentry = NULL,
+                .list = &list,
+                .root = RB_ROOT,
+                .is_lowest = false,
+        };
+
+        err = ovl_dir_read(path, &rdd);
+        if (err)
+                goto out;
+
+        inode_lock_nested(dir, I_MUTEX_PARENT);
+        list_for_each_entry(p, &list, l_node) {
+                struct dentry *dentry;
+
+                if (p->name[0] == '.') {
+                        if (p->len == 1)
+                                continue;
+                        if (p->len == 2 && p->name[1] == '.')
+                                continue;
+                }
+                dentry = lookup_one_len(p->name, path->dentry, p->len);
+                if (IS_ERR(dentry))
+                        continue;
+                if (dentry->d_inode)
+                        ovl_workdir_cleanup(dir, path->mnt, dentry, level);
+                dput(dentry);
+        }
+        inode_unlock(dir);
+out:
+        ovl_cache_free(&list);
+}
+
+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
+                         struct dentry *dentry, int level)
+{
+        int err;
+
+        if (!d_is_dir(dentry) || level > 1) {
+                ovl_cleanup(dir, dentry);
+                return;
+        }
+
+        err = ovl_do_rmdir(dir, dentry);
+        if (err) {
+                struct path path = { .mnt = mnt, .dentry = dentry };
+
+                inode_unlock(dir);
+                ovl_workdir_cleanup_recurse(&path, level + 1);
+                inode_lock_nested(dir, I_MUTEX_PARENT);
+                ovl_cleanup(dir, dentry);
+        }
+}
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 4036132842b5..e2a94a26767b 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -814,6 +814,10 @@ retry:
                 struct kstat stat = {
                         .mode = S_IFDIR | 0,
                 };
+                struct iattr attr = {
+                        .ia_valid = ATTR_MODE,
+                        .ia_mode = stat.mode,
+                };
 
                 if (work->d_inode) {
                         err = -EEXIST;
@@ -821,7 +825,7 @@ retry:
                                 goto out_dput;
 
                         retried = true;
-                        ovl_cleanup(dir, work);
+                        ovl_workdir_cleanup(dir, mnt, work, 0);
                         dput(work);
                         goto retry;
                 }
@@ -829,6 +833,21 @@ retry:
                 err = ovl_create_real(dir, work, &stat, NULL, NULL, true);
                 if (err)
                         goto out_dput;
+
+                err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT);
+                if (err && err != -ENODATA && err != -EOPNOTSUPP)
+                        goto out_dput;
+
+                err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS);
+                if (err && err != -ENODATA && err != -EOPNOTSUPP)
+                        goto out_dput;
+
+                /* Clear any inherited mode bits */
+                inode_lock(work->d_inode);
+                err = notify_change(work, &attr, NULL);
+                inode_unlock(work->d_inode);
+                if (err)
+                        goto out_dput;
         }
 out_unlock:
         inode_unlock(dir);
@@ -967,10 +986,19 @@ static unsigned int ovl_split_lowerdirs(char *str)
         return ctr;
 }
 
-static int ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
-                                   struct dentry *dentry, struct inode *inode,
-                                   const char *name, const void *value,
-                                   size_t size, int flags)
+static int __maybe_unused
+ovl_posix_acl_xattr_get(const struct xattr_handler *handler,
+                        struct dentry *dentry, struct inode *inode,
+                        const char *name, void *buffer, size_t size)
+{
+        return ovl_xattr_get(dentry, handler->name, buffer, size);
+}
+
+static int __maybe_unused
+ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
+                        struct dentry *dentry, struct inode *inode,
+                        const char *name, const void *value,
+                        size_t size, int flags)
 {
         struct dentry *workdir = ovl_workdir(dentry);
         struct inode *realinode = ovl_inode_real(inode, NULL);
@@ -998,19 +1026,22 @@ static int ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
 
         posix_acl_release(acl);
 
-        return ovl_setxattr(dentry, inode, handler->name, value, size, flags);
+        err = ovl_xattr_set(dentry, handler->name, value, size, flags);
+        if (!err)
+                ovl_copyattr(ovl_inode_real(inode, NULL), inode);
+
+        return err;
 
 out_acl_release:
         posix_acl_release(acl);
         return err;
 }
 
-static int ovl_other_xattr_set(const struct xattr_handler *handler,
-                               struct dentry *dentry, struct inode *inode,
-                               const char *name, const void *value,
-                               size_t size, int flags)
+static int ovl_own_xattr_get(const struct xattr_handler *handler,
+                             struct dentry *dentry, struct inode *inode,
+                             const char *name, void *buffer, size_t size)
 {
-        return ovl_setxattr(dentry, inode, name, value, size, flags);
+        return -EPERM;
 }
 
 static int ovl_own_xattr_set(const struct xattr_handler *handler,
@@ -1021,42 +1052,59 @@ static int ovl_own_xattr_set(const struct xattr_handler *handler,
         return -EPERM;
 }
 
-static const struct xattr_handler ovl_posix_acl_access_xattr_handler = {
+static int ovl_other_xattr_get(const struct xattr_handler *handler,
+                               struct dentry *dentry, struct inode *inode,
+                               const char *name, void *buffer, size_t size)
+{
+        return ovl_xattr_get(dentry, name, buffer, size);
+}
+
+static int ovl_other_xattr_set(const struct xattr_handler *handler,
+                               struct dentry *dentry, struct inode *inode,
+                               const char *name, const void *value,
+                               size_t size, int flags)
+{
+        return ovl_xattr_set(dentry, name, value, size, flags);
+}
+
+static const struct xattr_handler __maybe_unused
+ovl_posix_acl_access_xattr_handler = {
         .name = XATTR_NAME_POSIX_ACL_ACCESS,
         .flags = ACL_TYPE_ACCESS,
+        .get = ovl_posix_acl_xattr_get,
         .set = ovl_posix_acl_xattr_set,
 };
 
-static const struct xattr_handler ovl_posix_acl_default_xattr_handler = {
+static const struct xattr_handler __maybe_unused
+ovl_posix_acl_default_xattr_handler = {
         .name = XATTR_NAME_POSIX_ACL_DEFAULT,
         .flags = ACL_TYPE_DEFAULT,
+        .get = ovl_posix_acl_xattr_get,
         .set = ovl_posix_acl_xattr_set,
 };
 
 static const struct xattr_handler ovl_own_xattr_handler = {
         .prefix = OVL_XATTR_PREFIX,
+        .get = ovl_own_xattr_get,
         .set = ovl_own_xattr_set,
 };
 
 static const struct xattr_handler ovl_other_xattr_handler = {
         .prefix = "", /* catch all */
+        .get = ovl_other_xattr_get,
         .set = ovl_other_xattr_set,
 };
 
 static const struct xattr_handler *ovl_xattr_handlers[] = {
+#ifdef CONFIG_FS_POSIX_ACL
         &ovl_posix_acl_access_xattr_handler,
         &ovl_posix_acl_default_xattr_handler,
+#endif
         &ovl_own_xattr_handler,
         &ovl_other_xattr_handler,
         NULL
 };
 
-static const struct xattr_handler *ovl_xattr_noacl_handlers[] = {
-        &ovl_own_xattr_handler,
-        &ovl_other_xattr_handler,
-        NULL,
-};
-
 static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 {
         struct path upperpath = { NULL, NULL };
@@ -1132,7 +1180,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
         err = -EINVAL;
         stacklen = ovl_split_lowerdirs(lowertmp);
         if (stacklen > OVL_MAX_STACK) {
-                pr_err("overlayfs: too many lower directries, limit is %d\n",
+                pr_err("overlayfs: too many lower directories, limit is %d\n",
                        OVL_MAX_STACK);
                 goto out_free_lowertmp;
         } else if (!ufs->config.upperdir && stacklen == 1) {
@@ -1269,10 +1317,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 
         sb->s_magic = OVERLAYFS_SUPER_MAGIC;
         sb->s_op = &ovl_super_operations;
-        if (IS_ENABLED(CONFIG_FS_POSIX_ACL))
-                sb->s_xattr = ovl_xattr_handlers;
-        else
-                sb->s_xattr = ovl_xattr_noacl_handlers;
+        sb->s_xattr = ovl_xattr_handlers;
         sb->s_root = root_dentry;
         sb->s_fs_info = ufs;
         sb->s_flags |= MS_POSIXACL;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index e9ff186c723f..3b792ab3c0dc 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1556,18 +1556,13 @@ static const struct file_operations proc_pid_set_comm_operations = {
 static int proc_exe_link(struct dentry *dentry, struct path *exe_path)
 {
         struct task_struct *task;
-        struct mm_struct *mm;
         struct file *exe_file;
 
         task = get_proc_task(d_inode(dentry));
         if (!task)
                 return -ENOENT;
-        mm = get_task_mm(task);
+        exe_file = get_task_exe_file(task);
         put_task_struct(task);
-        if (!mm)
-                return -ENOENT;
-        exe_file = get_mm_exe_file(mm);
-        mmput(mm);
         if (exe_file) {
                 *exe_path = exe_file->f_path;
                 path_get(&exe_file->f_path);
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 187d84ef9de9..f6fa99eca515 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -581,6 +581,8 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
                 mss->anonymous_thp += HPAGE_PMD_SIZE;
         else if (PageSwapBacked(page))
                 mss->shmem_thp += HPAGE_PMD_SIZE;
+        else if (is_zone_device_page(page))
+                /* pass */;
         else
                 VM_BUG_ON_PAGE(1, page);
         smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd));
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 19f532e7d35e..6dc4296eed62 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -223,8 +223,10 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
                 size -= n;
                 buf += n;
                 copied += n;
-                if (!m->count)
+                if (!m->count) {
+                        m->from = 0;
                         m->index++;
+                }
                 if (!size)
                         goto Done;
         }
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index f35523d4fa3a..b803213d1307 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -114,9 +114,15 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf,
          * If buf != of->prealloc_buf, we don't know how
          * large it is, so cannot safely pass it to ->show
          */
-        if (pos || WARN_ON_ONCE(buf != of->prealloc_buf))
+        if (WARN_ON_ONCE(buf != of->prealloc_buf))
                 return 0;
         len = ops->show(kobj, of->kn->priv, buf);
+        if (pos) {
+                if (len <= pos)
+                        return 0;
+                len -= pos;
+                memmove(buf, buf + pos, len);
+        }
         return min(count, len);
 }
 
diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
index b45345d701e7..51157da3f76e 100644
--- a/fs/ubifs/tnc_commit.c
+++ b/fs/ubifs/tnc_commit.c
@@ -370,7 +370,7 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
 
         p = c->gap_lebs;
         do {
-                ubifs_assert(p < c->gap_lebs + sizeof(int) * c->lst.idx_lebs);
+                ubifs_assert(p < c->gap_lebs + c->lst.idx_lebs);
                 written = layout_leb_in_gaps(c, p);
                 if (written < 0) {
                         err = written;
diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
index e237811f09ce..11a004114eba 100644
--- a/fs/ubifs/xattr.c
+++ b/fs/ubifs/xattr.c
@@ -575,7 +575,8 @@ static int ubifs_xattr_get(const struct xattr_handler *handler,
         dbg_gen("xattr '%s', ino %lu ('%pd'), buf size %zd", name,
                 inode->i_ino, dentry, size);
 
-        return  __ubifs_getxattr(inode, name, buffer, size);
+        name = xattr_full_name(handler, name);
+        return __ubifs_getxattr(inode, name, buffer, size);
 }
 
 static int ubifs_xattr_set(const struct xattr_handler *handler,
@@ -586,6 +587,8 @@ static int ubifs_xattr_set(const struct xattr_handler *handler,
         dbg_gen("xattr '%s', host ino %lu ('%pd'), size %zd",
                 name, inode->i_ino, dentry, size);
 
+        name = xattr_full_name(handler, name);
+
         if (value)
                 return __ubifs_setxattr(inode, name, value, size, flags);
         else
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index 3dd8f1d54498..05b5243d89f6 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -2278,6 +2278,8 @@ xfs_alloc_log_agf(
                 offsetof(xfs_agf_t, agf_btreeblks),
                 offsetof(xfs_agf_t, agf_uuid),
                 offsetof(xfs_agf_t, agf_rmap_blocks),
+                /* needed so that we don't log the whole rest of the structure: */
+                offsetof(xfs_agf_t, agf_spare64),
                 sizeof(xfs_agf_t)
         };
 
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index b5c213a051cd..08569792fe20 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -1814,6 +1814,10 @@ xfs_btree_lookup(
 
         XFS_BTREE_STATS_INC(cur, lookup);
 
+        /* No such thing as a zero-level tree. */
+        if (cur->bc_nlevels == 0)
+                return -EFSCORRUPTED;
+
         block = NULL;
         keyno = 0;
 
@@ -4554,15 +4558,22 @@ xfs_btree_simple_query_range(
         if (error)
                 goto out;
 
+        /* Nothing?  See if there's anything to the right. */
+        if (!stat) {
+                error = xfs_btree_increment(cur, 0, &stat);
+                if (error)
+                        goto out;
+        }
+
         while (stat) {
                 /* Find the record. */
                 error = xfs_btree_get_rec(cur, &recp, &stat);
                 if (error || !stat)
                         break;
-                cur->bc_ops->init_high_key_from_rec(&rec_key, recp);
 
                 /* Skip if high_key(rec) < low_key. */
                 if (firstrec) {
+                        cur->bc_ops->init_high_key_from_rec(&rec_key, recp);
                         firstrec = false;
                         diff = cur->bc_ops->diff_two_keys(cur, low_key,
                                         &rec_key);
@@ -4571,6 +4582,7 @@ xfs_btree_simple_query_range(
                 }
 
                 /* Stop if high_key < low_key(rec). */
+                cur->bc_ops->init_key_from_rec(&rec_key, recp);
                 diff = cur->bc_ops->diff_two_keys(cur, &rec_key, high_key);
                 if (diff > 0)
                         break;
diff --git a/fs/xfs/libxfs/xfs_defer.c b/fs/xfs/libxfs/xfs_defer.c
index 054a2032fdb3..c221d0ecd52e 100644
--- a/fs/xfs/libxfs/xfs_defer.c
+++ b/fs/xfs/libxfs/xfs_defer.c
@@ -194,7 +194,7 @@ xfs_defer_trans_abort(
         /* Abort intent items. */
         list_for_each_entry(dfp, &dop->dop_pending, dfp_list) {
                 trace_xfs_defer_pending_abort(tp->t_mountp, dfp);
-                if (dfp->dfp_committed)
+                if (!dfp->dfp_done)
                         dfp->dfp_type->abort_intent(dfp->dfp_intent);
         }
 
@@ -290,7 +290,6 @@ xfs_defer_finish(
         struct xfs_defer_pending        *dfp;
         struct list_head                *li;
         struct list_head                *n;
-        void                            *done_item = NULL;
         void                            *state;
         int                             error = 0;
         void                            (*cleanup_fn)(struct xfs_trans *, void *, int);
@@ -309,19 +308,11 @@ xfs_defer_finish(
                 if (error)
                         goto out;
 
-                /* Mark all pending intents as committed. */
-                list_for_each_entry_reverse(dfp, &dop->dop_pending, dfp_list) {
-                        if (dfp->dfp_committed)
-                                break;
-                        trace_xfs_defer_pending_commit((*tp)->t_mountp, dfp);
-                        dfp->dfp_committed = true;
-                }
-
                 /* Log an intent-done item for the first pending item. */
                 dfp = list_first_entry(&dop->dop_pending,
                                 struct xfs_defer_pending, dfp_list);
                 trace_xfs_defer_pending_finish((*tp)->t_mountp, dfp);
-                done_item = dfp->dfp_type->create_done(*tp, dfp->dfp_intent,
+                dfp->dfp_done = dfp->dfp_type->create_done(*tp, dfp->dfp_intent,
                                 dfp->dfp_count);
                 cleanup_fn = dfp->dfp_type->finish_cleanup;
 
@@ -331,7 +322,7 @@ xfs_defer_finish(
                         list_del(li);
                         dfp->dfp_count--;
                         error = dfp->dfp_type->finish_item(*tp, dop, li,
-                                        done_item, &state);
+                                        dfp->dfp_done, &state);
                         if (error) {
                                 /*
                                  * Clean up after ourselves and jump out.
@@ -428,8 +419,8 @@ xfs_defer_add(
                 dfp = kmem_alloc(sizeof(struct xfs_defer_pending),
                                 KM_SLEEP | KM_NOFS);
                 dfp->dfp_type = defer_op_types[type];
-                dfp->dfp_committed = false;
                 dfp->dfp_intent = NULL;
+                dfp->dfp_done = NULL;
                 dfp->dfp_count = 0;
                 INIT_LIST_HEAD(&dfp->dfp_work);
                 list_add_tail(&dfp->dfp_list, &dop->dop_intake);
diff --git a/fs/xfs/libxfs/xfs_defer.h b/fs/xfs/libxfs/xfs_defer.h
index cc3981c48296..e96533d178cf 100644
--- a/fs/xfs/libxfs/xfs_defer.h
+++ b/fs/xfs/libxfs/xfs_defer.h
@@ -30,8 +30,8 @@ struct xfs_defer_op_type;
 struct xfs_defer_pending {
         const struct xfs_defer_op_type  *dfp_type;      /* function pointers */
         struct list_head                dfp_list;       /* pending items */
-        bool                            dfp_committed;  /* committed trans? */
         void                            *dfp_intent;    /* log intent item */
+        void                            *dfp_done;      /* log done item */
         struct list_head                dfp_work;       /* work items */
         unsigned int                    dfp_count;      /* # extent items */
 };
diff --git a/fs/xfs/libxfs/xfs_format.h b/fs/xfs/libxfs/xfs_format.h
index e6a8bea0f7ba..270fb5cf4fa1 100644
--- a/fs/xfs/libxfs/xfs_format.h
+++ b/fs/xfs/libxfs/xfs_format.h
@@ -674,7 +674,8 @@ typedef struct xfs_agf {
 #define XFS_AGF_BTREEBLKS       0x00000800
 #define XFS_AGF_UUID            0x00001000
 #define XFS_AGF_RMAP_BLOCKS     0x00002000
-#define XFS_AGF_NUM_BITS        14
+#define XFS_AGF_SPARE64         0x00004000
+#define XFS_AGF_NUM_BITS        15
 #define XFS_AGF_ALL_BITS        ((1 << XFS_AGF_NUM_BITS) - 1)
 
 #define XFS_AGF_FLAGS \
@@ -691,7 +692,8 @@ typedef struct xfs_agf {
         { XFS_AGF_LONGEST,      "LONGEST" }, \
         { XFS_AGF_BTREEBLKS,    "BTREEBLKS" }, \
         { XFS_AGF_UUID,         "UUID" }, \
-        { XFS_AGF_RMAP_BLOCKS,  "RMAP_BLOCKS" }
+        { XFS_AGF_RMAP_BLOCKS,  "RMAP_BLOCKS" }, \
+        { XFS_AGF_SPARE64,      "SPARE64" }
 
 /* disk block (xfs_daddr_t) in the AG */
 #define XFS_AGF_DADDR(mp)       ((xfs_daddr_t)(1 << (mp)->m_sectbb_log))
diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
index 0e3d4f5ec33c..4aecc5fefe96 100644
--- a/fs/xfs/libxfs/xfs_sb.c
+++ b/fs/xfs/libxfs/xfs_sb.c
@@ -583,7 +583,8 @@ xfs_sb_verify(
          * Only check the in progress field for the primary superblock as
          * mkfs.xfs doesn't clear it from secondary superblocks.
          */
-        return xfs_mount_validate_sb(mp, &sb, bp->b_bn == XFS_SB_DADDR,
+        return xfs_mount_validate_sb(mp, &sb,
+                                     bp->b_maps[0].bm_bn == XFS_SB_DADDR,
                                      check_version);
 }
 
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 607cc29bba21..b5b9bffe3520 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -1611,7 +1611,7 @@ xfs_wait_buftarg(
          */
         while (percpu_counter_sum(&btp->bt_io_count))
                 delay(100);
-        drain_workqueue(btp->bt_mount->m_buf_workqueue);
+        flush_workqueue(btp->bt_mount->m_buf_workqueue);
 
         /* loop until there is nothing left on the lru list. */
         while (list_lru_count(&btp->bt_lru)) {
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 24ef83ef04de..fd6be45b3a1e 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1574,9 +1574,16 @@ xfs_fs_fill_super(
                 }
         }
 
-        if (xfs_sb_version_hasrmapbt(&mp->m_sb))
+        if (xfs_sb_version_hasrmapbt(&mp->m_sb)) {
+                if (mp->m_sb.sb_rblocks) {
+                        xfs_alert(mp,
+        "EXPERIMENTAL reverse mapping btree not compatible with realtime device!");
+                        error = -EINVAL;
+                        goto out_filestream_unmount;
+                }
                 xfs_alert(mp,
         "EXPERIMENTAL reverse mapping btree feature enabled. Use at your own risk!");
+        }
 
         error = xfs_mountfs(mp);
         if (error)
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index 7e88bec3f359..d303a665dba9 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -2295,7 +2295,7 @@ DECLARE_EVENT_CLASS(xfs_defer_pending_class,
                 __entry->dev = mp ? mp->m_super->s_dev : 0;
                 __entry->type = dfp->dfp_type->type;
                 __entry->intent = dfp->dfp_intent;
-                __entry->committed = dfp->dfp_committed;
+                __entry->committed = dfp->dfp_done != NULL;
                 __entry->nr = dfp->dfp_count;
         ),
         TP_printk("dev %d:%d optype %d intent %p committed %d nr %d\n",
diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h
index 1bfa602958f2..6df9b0749671 100644
--- a/include/asm-generic/uaccess.h
+++ b/include/asm-generic/uaccess.h
@@ -72,6 +72,7 @@ struct exception_table_entry
 /* Returns 0 if exception not found and fixup otherwise.  */
 extern unsigned long search_exception_table(unsigned long);
 
+
 /*
  * architectures with an MMU should override these two
  */
@@ -230,14 +231,18 @@ extern int __put_user_bad(void) __attribute__((noreturn));
         might_fault();                                          \
         access_ok(VERIFY_READ, __p, sizeof(*ptr)) ?             \
                 __get_user((x), (__typeof__(*(ptr)) *)__p) :    \
-                -EFAULT;                                        \
+                ((x) = (__typeof__(*(ptr)))0,-EFAULT);          \
 })
 
 #ifndef __get_user_fn
 static inline int __get_user_fn(size_t size, const void __user *ptr, void *x)
 {
-        size = __copy_from_user(x, ptr, size);
-        return size ? -EFAULT : size;
+        size_t n = __copy_from_user(x, ptr, size);
+        if (unlikely(n)) {
+                memset(x + (size - n), 0, n);
+                return -EFAULT;
+        }
+        return 0;
 }
 
 #define __get_user_fn(sz, u, k) __get_user_fn(sz, u, k)
@@ -257,11 +262,13 @@ extern int __get_user_bad(void) __attribute__((noreturn));
 static inline long copy_from_user(void *to,
                 const void __user * from, unsigned long n)
 {
+        unsigned long res = n;
         might_fault();
-        if (access_ok(VERIFY_READ, from, n))
-                return __copy_from_user(to, from, n);
-        else
-                return n;
+        if (likely(access_ok(VERIFY_READ, from, n)))
+                res = __copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
 static inline long copy_to_user(void __user *to,
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 4d8452c2384b..c5eaf2f80a4c 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -1056,7 +1056,7 @@ static inline struct fwnode_handle *acpi_get_next_subnode(struct device *dev,
         return NULL;
 }
 
-#define ACPI_DECLARE_PROBE_ENTRY(table, name, table_id, subtable, validate, data, fn) \
+#define ACPI_DECLARE_PROBE_ENTRY(table, name, table_id, subtable, valid, data, fn) \
         static const void * __acpi_table_##name[]                       \
                 __attribute__((unused))                                 \
                  = { (void *) table_id,                                 \
diff --git a/include/linux/bio.h b/include/linux/bio.h
index 59ffaa68b11b..23ddf4b46a9b 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -71,7 +71,8 @@ static inline bool bio_has_data(struct bio *bio)
 {
         if (bio &&
             bio->bi_iter.bi_size &&
-            bio_op(bio) != REQ_OP_DISCARD)
+            bio_op(bio) != REQ_OP_DISCARD &&
+            bio_op(bio) != REQ_OP_SECURE_ERASE)
                 return true;
 
         return false;
@@ -79,7 +80,9 @@ static inline bool bio_has_data(struct bio *bio)
 
 static inline bool bio_no_advance_iter(struct bio *bio)
 {
-        return bio_op(bio) == REQ_OP_DISCARD || bio_op(bio) == REQ_OP_WRITE_SAME;
+        return bio_op(bio) == REQ_OP_DISCARD ||
+               bio_op(bio) == REQ_OP_SECURE_ERASE ||
+               bio_op(bio) == REQ_OP_WRITE_SAME;
 }
 
 static inline bool bio_is_rw(struct bio *bio)
@@ -199,6 +202,9 @@ static inline unsigned bio_segments(struct bio *bio)
         if (bio_op(bio) == REQ_OP_DISCARD)
                 return 1;
 
+        if (bio_op(bio) == REQ_OP_SECURE_ERASE)
+                return 1;
+
         if (bio_op(bio) == REQ_OP_WRITE_SAME)
                 return 1;
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 2c210b6a7bcf..e79055c8b577 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -882,7 +882,7 @@ static inline unsigned int blk_rq_cur_sectors(const struct request *rq)
 static inline unsigned int blk_queue_get_max_sectors(struct request_queue *q,
                                                      int op)
 {
-        if (unlikely(op == REQ_OP_DISCARD))
+        if (unlikely(op == REQ_OP_DISCARD || op == REQ_OP_SECURE_ERASE))
                 return min(q->limits.max_discard_sectors, UINT_MAX >> 9);
 
         if (unlikely(op == REQ_OP_WRITE_SAME))
@@ -913,7 +913,9 @@ static inline unsigned int blk_rq_get_max_sectors(struct request *rq,
         if (unlikely(rq->cmd_type != REQ_TYPE_FS))
                 return q->limits.max_hw_sectors;
 
-        if (!q->limits.chunk_sectors || (req_op(rq) == REQ_OP_DISCARD))
+        if (!q->limits.chunk_sectors ||
+            req_op(rq) == REQ_OP_DISCARD ||
+            req_op(rq) == REQ_OP_SECURE_ERASE)
                 return blk_queue_get_max_sectors(q, req_op(rq));
 
         return min(blk_max_size_offset(q, offset),
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index e2949397c19b..573c5a18908f 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -158,7 +158,7 @@
 #define __compiler_offsetof(a, b)                                       \
         __builtin_offsetof(a, b)
 
-#if GCC_VERSION >= 40100 && GCC_VERSION < 40600
+#if GCC_VERSION >= 40100
 # define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
 #endif
 
@@ -242,7 +242,11 @@
  */
 #define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0)
 
-#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
+/*
+ * sparse (__CHECKER__) pretends to be gcc, but can't do constant
+ * folding in __builtin_bswap*() (yet), so don't set these for it.
+ */
+#if defined(CONFIG_ARCH_USE_BUILTIN_BSWAP) && !defined(__CHECKER__)
 #if GCC_VERSION >= 40400
 #define __HAVE_BUILTIN_BSWAP32__
 #define __HAVE_BUILTIN_BSWAP64__
@@ -250,7 +254,7 @@
 #if GCC_VERSION >= 40800
 #define __HAVE_BUILTIN_BSWAP16__
 #endif
-#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */
+#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP && !__CHECKER__ */
 
 #if GCC_VERSION >= 50000
 #define KASAN_ABI_VERSION 4
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 436aa4e42221..668569844d37 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -527,13 +527,14 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
  * object's lifetime is managed by something other than RCU.  That
  * "something other" might be reference counting or simple immortality.
  *
- * The seemingly unused size_t variable is to validate @p is indeed a pointer
- * type by making sure it can be dereferenced.
+ * The seemingly unused variable ___typecheck_p validates that @p is
+ * indeed a pointer type by using a pointer to typeof(*p) as the type.
+ * Taking a pointer to typeof(*p) again is needed in case p is void *.
  */
 #define lockless_dereference(p) \
 ({ \
         typeof(p) _________p1 = READ_ONCE(p); \
-        size_t __maybe_unused __size_of_ptr = sizeof(*(p)); \
+        typeof(*(p)) *___typecheck_p __maybe_unused; \
         smp_read_barrier_depends(); /* Dependency order vs. p above. */ \
         (_________p1); \
 })
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 7f5a58225385..0148a3046b48 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -118,6 +118,15 @@ typedef struct {
         u32 imagesize;
 } efi_capsule_header_t;
 
+struct efi_boot_memmap {
+        efi_memory_desc_t       **map;
+        unsigned long           *map_size;
+        unsigned long           *desc_size;
+        u32                     *desc_ver;
+        unsigned long           *key_ptr;
+        unsigned long           *buff_size;
+};
+
 /*
  * EFI capsule flags
  */
@@ -946,7 +955,7 @@ extern int efi_memattr_apply_permissions(struct mm_struct *mm,
 /* Iterate through an efi_memory_map */
 #define for_each_efi_memory_desc_in_map(m, md)                             \
         for ((md) = (m)->map;                                              \
-             ((void *)(md) + (m)->desc_size) <= (m)->map_end;              \
+             (md) && ((void *)(md) + (m)->desc_size) <= (m)->map_end;      \
              (md) = (void *)(md) + (m)->desc_size)
 
 /**
@@ -1371,11 +1380,7 @@ char *efi_convert_cmdline(efi_system_table_t *sys_table_arg,
                           efi_loaded_image_t *image, int *cmd_line_len);
 
 efi_status_t efi_get_memory_map(efi_system_table_t *sys_table_arg,
-                                efi_memory_desc_t **map,
-                                unsigned long *map_size,
-                                unsigned long *desc_size,
-                                u32 *desc_ver,
-                                unsigned long *key_ptr);
+                                struct efi_boot_memmap *map);
 
 efi_status_t efi_low_alloc(efi_system_table_t *sys_table_arg,
                            unsigned long size, unsigned long align,
@@ -1457,4 +1462,14 @@ extern void efi_call_virt_check_flags(unsigned long flags, const char *call);
         arch_efi_call_virt_teardown();                                  \
 })
 
+typedef efi_status_t (*efi_exit_boot_map_processing)(
+        efi_system_table_t *sys_table_arg,
+        struct efi_boot_memmap *map,
+        void *priv);
+
+efi_status_t efi_exit_boot_services(efi_system_table_t *sys_table,
+                                    void *handle,
+                                    struct efi_boot_memmap *map,
+                                    void *priv,
+                                    efi_exit_boot_map_processing priv_func);
 #endif /* _LINUX_EFI_H */
diff --git a/include/linux/fence.h b/include/linux/fence.h
index 8cc719a63728..2ac6fa5f4712 100644
--- a/include/linux/fence.h
+++ b/include/linux/fence.h
@@ -49,8 +49,6 @@ struct fence_cb;
  * @timestamp: Timestamp when the fence was signaled.
  * @status: Optional, only valid if < 0, must be set before calling
  * fence_signal, indicates that the fence has completed with an error.
- * @child_list: list of children fences
- * @active_list: list of active fences
  *
  * the flags member must be manipulated and read using the appropriate
  * atomic ops (bit_*), so taking the spinlock will not be needed most
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 3523bf62f328..901e25d495cc 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -574,6 +574,7 @@ static inline void mapping_allow_writable(struct address_space *mapping)
 
 struct posix_acl;
 #define ACL_NOT_CACHED ((void *)(-1))
+#define ACL_DONT_CACHE ((void *)(-3))
 
 static inline struct posix_acl *
 uncached_acl_sentinel(struct task_struct *task)
diff --git a/include/linux/fscrypto.h b/include/linux/fscrypto.h
index cfa6cde25f8e..76cff18bb032 100644
--- a/include/linux/fscrypto.h
+++ b/include/linux/fscrypto.h
@@ -274,8 +274,7 @@ extern void fscrypt_restore_control_page(struct page *);
 extern int fscrypt_zeroout_range(struct inode *, pgoff_t, sector_t,
                                                 unsigned int);
 /* policy.c */
-extern int fscrypt_process_policy(struct inode *,
-                                        const struct fscrypt_policy *);
+extern int fscrypt_process_policy(struct file *, const struct fscrypt_policy *);
 extern int fscrypt_get_policy(struct inode *, struct fscrypt_policy *);
 extern int fscrypt_has_permitted_context(struct inode *, struct inode *);
 extern int fscrypt_inherit_context(struct inode *, struct inode *,
@@ -345,7 +344,7 @@ static inline int fscrypt_notsupp_zeroout_range(struct inode *i, pgoff_t p,
 }
 
 /* policy.c */
-static inline int fscrypt_notsupp_process_policy(struct inode *i,
+static inline int fscrypt_notsupp_process_policy(struct file *f,
                                 const struct fscrypt_policy *p)
 {
         return -EOPNOTSUPP;
diff --git a/include/linux/host1x.h b/include/linux/host1x.h
index d2ba7d334039..1ffbf2a8cb99 100644
--- a/include/linux/host1x.h
+++ b/include/linux/host1x.h
@@ -304,6 +304,8 @@ struct tegra_mipi_device;
 
 struct tegra_mipi_device *tegra_mipi_request(struct device *device);
 void tegra_mipi_free(struct tegra_mipi_device *device);
+int tegra_mipi_enable(struct tegra_mipi_device *device);
+int tegra_mipi_disable(struct tegra_mipi_device *device);
 int tegra_mipi_calibrate(struct tegra_mipi_device *device);
 
 #endif
diff --git a/include/linux/iio/sw_trigger.h b/include/linux/iio/sw_trigger.h
index 5198f8ed08a4..c97eab67558f 100644
--- a/include/linux/iio/sw_trigger.h
+++ b/include/linux/iio/sw_trigger.h
@@ -62,7 +62,7 @@ void iio_swt_group_init_type_name(struct iio_sw_trigger *t,
                                   const char *name,
                                   struct config_item_type *type)
 {
-#ifdef CONFIG_CONFIGFS_FS
+#if IS_ENABLED(CONFIG_CONFIGFS_FS)
         config_group_init_type_name(&t->group, name, type);
 #endif
 }
diff --git a/include/linux/iomap.h b/include/linux/iomap.h
index 3267df461012..3d70ece10313 100644
--- a/include/linux/iomap.h
+++ b/include/linux/iomap.h
@@ -19,6 +19,11 @@ struct vm_fault;
 #define IOMAP_UNWRITTEN 0x04    /* blocks allocated @blkno in unwritten state */
 
 /*
+ * Flags for iomap mappings:
+ */
+#define IOMAP_F_MERGED  0x01    /* contains multiple blocks/extents */
+
+/*
  * Magic value for blkno:
  */
 #define IOMAP_NULL_BLOCK -1LL   /* blkno is not valid */
@@ -27,7 +32,8 @@ struct iomap {
         sector_t                blkno;  /* 1st sector of mapping, 512b units */
         loff_t                  offset; /* file offset of mapping, bytes */
         u64                     length; /* length of mapping, bytes */
-        int                     type;   /* type of mapping */
+        u16                     type;   /* type of mapping */
+        u16                     flags;  /* flags for mapping */
         struct block_device     *bdev;  /* block device for I/O */
 };
 
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index 56b0b7ec66aa..99ac022edc60 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -337,6 +337,7 @@
  */
 #define E_ITS_MOVI_UNMAPPED_INTERRUPT           0x010107
 #define E_ITS_MOVI_UNMAPPED_COLLECTION          0x010109
+#define E_ITS_INT_UNMAPPED_INTERRUPT            0x010307
 #define E_ITS_CLEAR_UNMAPPED_INTERRUPT          0x010507
 #define E_ITS_MAPD_DEVICE_OOR                   0x010801
 #define E_ITS_MAPC_PROCNUM_OOR                  0x010902
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index 4429d255c8ab..5e5b2969d931 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -195,6 +195,7 @@ static inline bool vma_migratable(struct vm_area_struct *vma)
 }
 
 extern int mpol_misplaced(struct page *, struct vm_area_struct *, unsigned long);
+extern void mpol_put_task_policy(struct task_struct *);
 
 #else
 
@@ -297,5 +298,8 @@ static inline int mpol_misplaced(struct page *page, struct vm_area_struct *vma,
         return -1; /* no node preference */
 }
 
+static inline void mpol_put_task_policy(struct task_struct *task)
+{
+}
 #endif /* CONFIG_NUMA */
 #endif
diff --git a/include/linux/mfd/da8xx-cfgchip.h b/include/linux/mfd/da8xx-cfgchip.h
new file mode 100644
index 000000000000..304985e288d2
--- /dev/null
+++ b/include/linux/mfd/da8xx-cfgchip.h
@@ -0,0 +1,153 @@
+/*
+ * TI DaVinci DA8xx CHIPCFGx registers for syscon consumers.
+ *
+ * Copyright (C) 2016 David Lechner <david@lechnology.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef __LINUX_MFD_DA8XX_CFGCHIP_H
+#define __LINUX_MFD_DA8XX_CFGCHIP_H
+
+#include <linux/bitops.h>
+
+/* register offset (32-bit registers) */
+#define CFGCHIP(n)                              ((n) * 4)
+
+/* CFGCHIP0 (PLL0/EDMA3_0) register bits */
+#define CFGCHIP0_PLL_MASTER_LOCK                BIT(4)
+#define CFGCHIP0_EDMA30TC1DBS(n)                ((n) << 2)
+#define CFGCHIP0_EDMA30TC1DBS_MASK              CFGCHIP0_EDMA30TC1DBS(0x3)
+#define CFGCHIP0_EDMA30TC1DBS_16                CFGCHIP0_EDMA30TC1DBS(0x0)
+#define CFGCHIP0_EDMA30TC1DBS_32                CFGCHIP0_EDMA30TC1DBS(0x1)
+#define CFGCHIP0_EDMA30TC1DBS_64                CFGCHIP0_EDMA30TC1DBS(0x2)
+#define CFGCHIP0_EDMA30TC0DBS(n)                ((n) << 0)
+#define CFGCHIP0_EDMA30TC0DBS_MASK              CFGCHIP0_EDMA30TC0DBS(0x3)
+#define CFGCHIP0_EDMA30TC0DBS_16                CFGCHIP0_EDMA30TC0DBS(0x0)
+#define CFGCHIP0_EDMA30TC0DBS_32                CFGCHIP0_EDMA30TC0DBS(0x1)
+#define CFGCHIP0_EDMA30TC0DBS_64                CFGCHIP0_EDMA30TC0DBS(0x2)
+
+/* CFGCHIP1 (eCAP/HPI/EDMA3_1/eHRPWM TBCLK/McASP0 AMUTEIN) register bits */
+#define CFGCHIP1_CAP2SRC(n)                     ((n) << 27)
+#define CFGCHIP1_CAP2SRC_MASK                   CFGCHIP1_CAP2SRC(0x1f)
+#define CFGCHIP1_CAP2SRC_ECAP_PIN               CFGCHIP1_CAP2SRC(0x0)
+#define CFGCHIP1_CAP2SRC_MCASP0_TX              CFGCHIP1_CAP2SRC(0x1)
+#define CFGCHIP1_CAP2SRC_MCASP0_RX              CFGCHIP1_CAP2SRC(0x2)
+#define CFGCHIP1_CAP2SRC_EMAC_C0_RX_THRESHOLD   CFGCHIP1_CAP2SRC(0x7)
+#define CFGCHIP1_CAP2SRC_EMAC_C0_RX             CFGCHIP1_CAP2SRC(0x8)
+#define CFGCHIP1_CAP2SRC_EMAC_C0_TX             CFGCHIP1_CAP2SRC(0x9)
+#define CFGCHIP1_CAP2SRC_EMAC_C0_MISC           CFGCHIP1_CAP2SRC(0xa)
+#define CFGCHIP1_CAP2SRC_EMAC_C1_RX_THRESHOLD   CFGCHIP1_CAP2SRC(0xb)
+#define CFGCHIP1_CAP2SRC_EMAC_C1_RX             CFGCHIP1_CAP2SRC(0xc)
+#define CFGCHIP1_CAP2SRC_EMAC_C1_TX             CFGCHIP1_CAP2SRC(0xd)
+#define CFGCHIP1_CAP2SRC_EMAC_C1_MISC           CFGCHIP1_CAP2SRC(0xe)
+#define CFGCHIP1_CAP2SRC_EMAC_C2_RX_THRESHOLD   CFGCHIP1_CAP2SRC(0xf)
+#define CFGCHIP1_CAP2SRC_EMAC_C2_RX             CFGCHIP1_CAP2SRC(0x10)
+#define CFGCHIP1_CAP2SRC_EMAC_C2_TX             CFGCHIP1_CAP2SRC(0x11)
+#define CFGCHIP1_CAP2SRC_EMAC_C2_MISC           CFGCHIP1_CAP2SRC(0x12)
+#define CFGCHIP1_CAP1SRC(n)                     ((n) << 22)
+#define CFGCHIP1_CAP1SRC_MASK                   CFGCHIP1_CAP1SRC(0x1f)
+#define CFGCHIP1_CAP1SRC_ECAP_PIN               CFGCHIP1_CAP1SRC(0x0)
+#define CFGCHIP1_CAP1SRC_MCASP0_TX              CFGCHIP1_CAP1SRC(0x1)
+#define CFGCHIP1_CAP1SRC_MCASP0_RX              CFGCHIP1_CAP1SRC(0x2)
+#define CFGCHIP1_CAP1SRC_EMAC_C0_RX_THRESHOLD   CFGCHIP1_CAP1SRC(0x7)
+#define CFGCHIP1_CAP1SRC_EMAC_C0_RX             CFGCHIP1_CAP1SRC(0x8)
+#define CFGCHIP1_CAP1SRC_EMAC_C0_TX             CFGCHIP1_CAP1SRC(0x9)
+#define CFGCHIP1_CAP1SRC_EMAC_C0_MISC           CFGCHIP1_CAP1SRC(0xa)
+#define CFGCHIP1_CAP1SRC_EMAC_C1_RX_THRESHOLD   CFGCHIP1_CAP1SRC(0xb)
+#define CFGCHIP1_CAP1SRC_EMAC_C1_RX             CFGCHIP1_CAP1SRC(0xc)
+#define CFGCHIP1_CAP1SRC_EMAC_C1_TX             CFGCHIP1_CAP1SRC(0xd)
+#define CFGCHIP1_CAP1SRC_EMAC_C1_MISC           CFGCHIP1_CAP1SRC(0xe)
+#define CFGCHIP1_CAP1SRC_EMAC_C2_RX_THRESHOLD   CFGCHIP1_CAP1SRC(0xf)
+#define CFGCHIP1_CAP1SRC_EMAC_C2_RX             CFGCHIP1_CAP1SRC(0x10)
+#define CFGCHIP1_CAP1SRC_EMAC_C2_TX             CFGCHIP1_CAP1SRC(0x11)
+#define CFGCHIP1_CAP1SRC_EMAC_C2_MISC           CFGCHIP1_CAP1SRC(0x12)
+#define CFGCHIP1_CAP0SRC(n)                     ((n) << 17)
+#define CFGCHIP1_CAP0SRC_MASK                   CFGCHIP1_CAP0SRC(0x1f)
+#define CFGCHIP1_CAP0SRC_ECAP_PIN               CFGCHIP1_CAP0SRC(0x0)
+#define CFGCHIP1_CAP0SRC_MCASP0_TX              CFGCHIP1_CAP0SRC(0x1)
+#define CFGCHIP1_CAP0SRC_MCASP0_RX              CFGCHIP1_CAP0SRC(0x2)
+#define CFGCHIP1_CAP0SRC_EMAC_C0_RX_THRESHOLD   CFGCHIP1_CAP0SRC(0x7)
+#define CFGCHIP1_CAP0SRC_EMAC_C0_RX             CFGCHIP1_CAP0SRC(0x8)
+#define CFGCHIP1_CAP0SRC_EMAC_C0_TX             CFGCHIP1_CAP0SRC(0x9)
+#define CFGCHIP1_CAP0SRC_EMAC_C0_MISC           CFGCHIP1_CAP0SRC(0xa)
+#define CFGCHIP1_CAP0SRC_EMAC_C1_RX_THRESHOLD   CFGCHIP1_CAP0SRC(0xb)
+#define CFGCHIP1_CAP0SRC_EMAC_C1_RX             CFGCHIP1_CAP0SRC(0xc)
+#define CFGCHIP1_CAP0SRC_EMAC_C1_TX             CFGCHIP1_CAP0SRC(0xd)
+#define CFGCHIP1_CAP0SRC_EMAC_C1_MISC           CFGCHIP1_CAP0SRC(0xe)
+#define CFGCHIP1_CAP0SRC_EMAC_C2_RX_THRESHOLD   CFGCHIP1_CAP0SRC(0xf)
+#define CFGCHIP1_CAP0SRC_EMAC_C2_RX             CFGCHIP1_CAP0SRC(0x10)
+#define CFGCHIP1_CAP0SRC_EMAC_C2_TX             CFGCHIP1_CAP0SRC(0x11)
+#define CFGCHIP1_CAP0SRC_EMAC_C2_MISC           CFGCHIP1_CAP0SRC(0x12)
+#define CFGCHIP1_HPIBYTEAD                      BIT(16)
+#define CFGCHIP1_HPIENA                         BIT(15)
+#define CFGCHIP0_EDMA31TC0DBS(n)                ((n) << 13)
+#define CFGCHIP0_EDMA31TC0DBS_MASK              CFGCHIP0_EDMA31TC0DBS(0x3)
+#define CFGCHIP0_EDMA31TC0DBS_16                CFGCHIP0_EDMA31TC0DBS(0x0)
+#define CFGCHIP0_EDMA31TC0DBS_32                CFGCHIP0_EDMA31TC0DBS(0x1)
+#define CFGCHIP0_EDMA31TC0DBS_64                CFGCHIP0_EDMA31TC0DBS(0x2)
+#define CFGCHIP1_TBCLKSYNC                      BIT(12)
+#define CFGCHIP1_AMUTESEL0(n)                   ((n) << 0)
+#define CFGCHIP1_AMUTESEL0_MASK                 CFGCHIP1_AMUTESEL0(0xf)
+#define CFGCHIP1_AMUTESEL0_LOW                  CFGCHIP1_AMUTESEL0(0x0)
+#define CFGCHIP1_AMUTESEL0_BANK_0               CFGCHIP1_AMUTESEL0(0x1)
+#define CFGCHIP1_AMUTESEL0_BANK_1               CFGCHIP1_AMUTESEL0(0x2)
+#define CFGCHIP1_AMUTESEL0_BANK_2               CFGCHIP1_AMUTESEL0(0x3)
+#define CFGCHIP1_AMUTESEL0_BANK_3               CFGCHIP1_AMUTESEL0(0x4)
+#define CFGCHIP1_AMUTESEL0_BANK_4               CFGCHIP1_AMUTESEL0(0x5)
+#define CFGCHIP1_AMUTESEL0_BANK_5               CFGCHIP1_AMUTESEL0(0x6)
+#define CFGCHIP1_AMUTESEL0_BANK_6               CFGCHIP1_AMUTESEL0(0x7)
+#define CFGCHIP1_AMUTESEL0_BANK_7               CFGCHIP1_AMUTESEL0(0x8)
+
+/* CFGCHIP2 (USB PHY) register bits */
+#define CFGCHIP2_PHYCLKGD                       BIT(17)
+#define CFGCHIP2_VBUSSENSE                      BIT(16)
+#define CFGCHIP2_RESET                          BIT(15)
+#define CFGCHIP2_OTGMODE(n)                     ((n) << 13)
+#define CFGCHIP2_OTGMODE_MASK                   CFGCHIP2_OTGMODE(0x3)
+#define CFGCHIP2_OTGMODE_NO_OVERRIDE            CFGCHIP2_OTGMODE(0x0)
+#define CFGCHIP2_OTGMODE_FORCE_HOST             CFGCHIP2_OTGMODE(0x1)
+#define CFGCHIP2_OTGMODE_FORCE_DEVICE           CFGCHIP2_OTGMODE(0x2)
+#define CFGCHIP2_OTGMODE_FORCE_HOST_VBUS_LOW    CFGCHIP2_OTGMODE(0x3)
+#define CFGCHIP2_USB1PHYCLKMUX                  BIT(12)
+#define CFGCHIP2_USB2PHYCLKMUX                  BIT(11)
+#define CFGCHIP2_PHYPWRDN                       BIT(10)
+#define CFGCHIP2_OTGPWRDN                       BIT(9)
+#define CFGCHIP2_DATPOL                         BIT(8)
+#define CFGCHIP2_USB1SUSPENDM                   BIT(7)
+#define CFGCHIP2_PHY_PLLON                      BIT(6)
+#define CFGCHIP2_SESENDEN                       BIT(5)
+#define CFGCHIP2_VBDTCTEN                       BIT(4)
+#define CFGCHIP2_REFFREQ(n)                     ((n) << 0)
+#define CFGCHIP2_REFFREQ_MASK                   CFGCHIP2_REFFREQ(0xf)
+#define CFGCHIP2_REFFREQ_12MHZ                  CFGCHIP2_REFFREQ(0x1)
+#define CFGCHIP2_REFFREQ_24MHZ                  CFGCHIP2_REFFREQ(0x2)
+#define CFGCHIP2_REFFREQ_48MHZ                  CFGCHIP2_REFFREQ(0x3)
+#define CFGCHIP2_REFFREQ_19_2MHZ                CFGCHIP2_REFFREQ(0x4)
+#define CFGCHIP2_REFFREQ_38_4MHZ                CFGCHIP2_REFFREQ(0x5)
+#define CFGCHIP2_REFFREQ_13MHZ                  CFGCHIP2_REFFREQ(0x6)
+#define CFGCHIP2_REFFREQ_26MHZ                  CFGCHIP2_REFFREQ(0x7)
+#define CFGCHIP2_REFFREQ_20MHZ                  CFGCHIP2_REFFREQ(0x8)
+#define CFGCHIP2_REFFREQ_40MHZ                  CFGCHIP2_REFFREQ(0x9)
+
+/* CFGCHIP3 (EMAC/uPP/PLL1/ASYNC3/PRU/DIV4.5/EMIFA) register bits */
+#define CFGCHIP3_RMII_SEL                       BIT(8)
+#define CFGCHIP3_UPP_TX_CLKSRC                  BIT(6)
+#define CFGCHIP3_PLL1_MASTER_LOCK               BIT(5)
+#define CFGCHIP3_ASYNC3_CLKSRC                  BIT(4)
+#define CFGCHIP3_PRUEVTSEL                      BIT(3)
+#define CFGCHIP3_DIV45PENA                      BIT(2)
+#define CFGCHIP3_EMA_CLKSRC                     BIT(1)
+
+/* CFGCHIP4 (McASP0 AMUNTEIN) register bits */
+#define CFGCHIP4_AMUTECLR0                      BIT(0)
+
+#endif /* __LINUX_MFD_DA8XX_CFGCHIP_H */
diff --git a/include/linux/mfd/ti_am335x_tscadc.h b/include/linux/mfd/ti_am335x_tscadc.h
index 2567a87872b0..7f55b8b41032 100644
--- a/include/linux/mfd/ti_am335x_tscadc.h
+++ b/include/linux/mfd/ti_am335x_tscadc.h
@@ -138,16 +138,16 @@
 /*
  * time in us for processing a single channel, calculated as follows:
  *
- * num cycles = open delay + (sample delay + conv time) * averaging
+ * max num cycles = open delay + (sample delay + conv time) * averaging
  *
- * num cycles: 152 + (1 + 13) * 16 = 376
+ * max num cycles: 262143 + (255 + 13) * 16 = 266431
  *
  * clock frequency: 26MHz / 8 = 3.25MHz
  * clock period: 1 / 3.25MHz = 308ns
  *
- * processing time: 376 * 308ns = 116us
+ * max processing time: 266431 * 308ns = 83ms(approx)
  */
-#define IDLE_TIMEOUT 116 /* microsec */
+#define IDLE_TIMEOUT 83 /* milliseconds */
 
 #define TSCADC_CELLS            2
 
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 21bc4557b67a..d1f9a581aca8 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -6710,9 +6710,10 @@ struct mlx5_ifc_pude_reg_bits {
 };
 
 struct mlx5_ifc_ptys_reg_bits {
-        u8         an_disable_cap[0x1];
+        u8         reserved_at_0[0x1];
         u8         an_disable_admin[0x1];
-        u8         reserved_at_2[0x6];
+        u8         an_disable_cap[0x1];
+        u8         reserved_at_3[0x5];
         u8         local_port[0x8];
         u8         reserved_at_10[0xd];
         u8         proto_mask[0x3];
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 08ed53eeedd5..ef815b9cd426 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -2014,6 +2014,7 @@ extern void mm_drop_all_locks(struct mm_struct *mm);
 
 extern void set_mm_exe_file(struct mm_struct *mm, struct file *new_exe_file);
 extern struct file *get_mm_exe_file(struct mm_struct *mm);
+extern struct file *get_task_exe_file(struct task_struct *task);
 
 extern bool may_expand_vm(struct mm_struct *, vm_flags_t, unsigned long npages);
 extern void vm_stat_account(struct mm_struct *, vm_flags_t, long npages);
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index d572b78b65e1..7f2ae99e5daf 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -828,9 +828,21 @@ unsigned long __init node_memmap_size_bytes(int, unsigned long, unsigned long);
  */
 #define zone_idx(zone)          ((zone) - (zone)->zone_pgdat->node_zones)
 
-static inline int populated_zone(struct zone *zone)
+/*
+ * Returns true if a zone has pages managed by the buddy allocator.
+ * All the reclaim decisions have to use this function rather than
+ * populated_zone(). If the whole zone is reserved then we can easily
+ * end up with populated_zone() && !managed_zone().
+ */
+static inline bool managed_zone(struct zone *zone)
+{
+        return zone->managed_pages;
+}
+
+/* Returns true if a zone has memory */
+static inline bool populated_zone(struct zone *zone)
 {
-        return (!!zone->present_pages);
+        return zone->present_pages;
 }
 
 extern int movable_zone;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3a788bf0affd..e8d79d4ebcfe 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3267,6 +3267,7 @@ static inline void napi_free_frags(struct napi_struct *napi)
         napi->skb = NULL;
 }
 
+bool netdev_is_rx_handler_busy(struct net_device *dev);
 int netdev_rx_handler_register(struct net_device *dev,
                                rx_handler_func_t *rx_handler,
                                void *rx_handler_data);
diff --git a/include/linux/netfilter/nfnetlink_acct.h b/include/linux/netfilter/nfnetlink_acct.h
index 80ca889b164e..664da0048625 100644
--- a/include/linux/netfilter/nfnetlink_acct.h
+++ b/include/linux/netfilter/nfnetlink_acct.h
@@ -15,6 +15,6 @@ struct nf_acct;
 struct nf_acct *nfnl_acct_find_get(struct net *net, const char *filter_name);
 void nfnl_acct_put(struct nf_acct *acct);
 void nfnl_acct_update(const struct sk_buff *skb, struct nf_acct *nfacct);
-extern int nfnl_acct_overquota(const struct sk_buff *skb,
-                              struct nf_acct *nfacct);
+int nfnl_acct_overquota(struct net *net, const struct sk_buff *skb,
+                        struct nf_acct *nfacct);
 #endif /* _NFNL_ACCT_H */
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index d8b37bab2887..7676557ce357 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -794,7 +794,7 @@ struct nvmf_connect_command {
 };
 
 struct nvmf_connect_data {
-        uuid_le         hostid;
+        uuid_be         hostid;
         __le16          cntlid;
         char            resv4[238];
         char            subsysnqn[NVMF_NQN_FIELD_LEN];
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 2599a980340f..0ab835965669 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -683,15 +683,6 @@ struct pci_driver {
 #define to_pci_driver(drv) container_of(drv, struct pci_driver, driver)
 
 /**
- * DEFINE_PCI_DEVICE_TABLE - macro used to describe a pci device table
- * @_table: device table name
- *
- * This macro is deprecated and should not be used in new code.
- */
-#define DEFINE_PCI_DEVICE_TABLE(_table) \
-        const struct pci_device_id _table[]
-
-/**
  * PCI_DEVICE - macro used to describe a specific pci device
  * @vend: the 16 bit PCI Vendor ID
  * @dev: the 16 bit PCI Device ID
@@ -1251,10 +1242,12 @@ resource_size_t pcibios_iov_resource_alignment(struct pci_dev *dev, int resno);
 int pci_set_vga_state(struct pci_dev *pdev, bool decode,
                       unsigned int command_bits, u32 flags);
 
-#define PCI_IRQ_NOLEGACY        (1 << 0) /* don't use legacy interrupts */
-#define PCI_IRQ_NOMSI           (1 << 1) /* don't use MSI interrupts */
-#define PCI_IRQ_NOMSIX          (1 << 2) /* don't use MSI-X interrupts */
-#define PCI_IRQ_NOAFFINITY      (1 << 3) /* don't auto-assign affinity */
+#define PCI_IRQ_LEGACY          (1 << 0) /* allow legacy interrupts */
+#define PCI_IRQ_MSI             (1 << 1) /* allow MSI interrupts */
+#define PCI_IRQ_MSIX            (1 << 2) /* allow MSI-X interrupts */
+#define PCI_IRQ_AFFINITY        (1 << 3) /* auto-assign affinity */
+#define PCI_IRQ_ALL_TYPES \
+        (PCI_IRQ_LEGACY | PCI_IRQ_MSI | PCI_IRQ_MSIX)
 
 /* kmem_cache style wrapper around pci_alloc_consistent() */
 
diff --git a/include/linux/serial_8250.h b/include/linux/serial_8250.h
index 923266cd294a..48ec7651989b 100644
--- a/include/linux/serial_8250.h
+++ b/include/linux/serial_8250.h
@@ -111,7 +111,6 @@ struct uart_8250_port {
                                                  *   if no_console_suspend
                                                  */
         unsigned char           probe;
-        struct mctrl_gpios      *gpios;
 #define UART_PROBE_RSA  (1 << 0)
 
         /*
diff --git a/include/linux/smc91x.h b/include/linux/smc91x.h
index 76199b75d584..e302c447e057 100644
--- a/include/linux/smc91x.h
+++ b/include/linux/smc91x.h
@@ -1,6 +1,16 @@
 #ifndef __SMC91X_H__
 #define __SMC91X_H__
 
+/*
+ * These bits define which access sizes a platform can support, rather
+ * than the maximal access size.  So, if your platform can do 16-bit
+ * and 32-bit accesses to the SMC91x device, but not 8-bit, set both
+ * SMC91X_USE_16BIT and SMC91X_USE_32BIT.
+ *
+ * The SMC91x driver requires at least one of SMC91X_USE_8BIT or
+ * SMC91X_USE_16BIT to be supported - just setting SMC91X_USE_32BIT is
+ * an invalid configuration.
+ */
 #define SMC91X_USE_8BIT (1 << 0)
 #define SMC91X_USE_16BIT (1 << 1)
 #define SMC91X_USE_32BIT (1 << 2)
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 697e160c78d0..a4f7203a9017 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -42,6 +42,8 @@ extern int proc_dostring(struct ctl_table *, int,
                          void __user *, size_t *, loff_t *);
 extern int proc_dointvec(struct ctl_table *, int,
                          void __user *, size_t *, loff_t *);
+extern int proc_douintvec(struct ctl_table *, int,
+                         void __user *, size_t *, loff_t *);
 extern int proc_dointvec_minmax(struct ctl_table *, int,
                                 void __user *, size_t *, loff_t *);
 extern int proc_dointvec_jiffies(struct ctl_table *, int,
diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
index cbd8990e2e77..2b5b10eed74f 100644
--- a/include/linux/thread_info.h
+++ b/include/linux/thread_info.h
@@ -118,10 +118,11 @@ static inline int arch_within_stack_frames(const void * const stack,
 extern void __check_object_size(const void *ptr, unsigned long n,
                                         bool to_user);
 
-static inline void check_object_size(const void *ptr, unsigned long n,
-                                     bool to_user)
+static __always_inline void check_object_size(const void *ptr, unsigned long n,
+                                              bool to_user)
 {
-        __check_object_size(ptr, n, to_user);
+        if (!__builtin_constant_p(n))
+                __check_object_size(ptr, n, to_user);
 }
 #else
 static inline void check_object_size(const void *ptr, unsigned long n,
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 9b4c418bebd8..fd60eccb59a6 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -52,7 +52,7 @@ struct unix_sock {
         struct sock             sk;
         struct unix_address     *addr;
         struct path             path;
-        struct mutex            readlock;
+        struct mutex            iolock, bindlock;
         struct sock             *peer;
         struct list_head        link;
         atomic_long_t           inflight;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 9c23f4d33e06..beb7610d64e9 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1102,6 +1102,7 @@ struct station_info {
         struct cfg80211_tid_stats pertid[IEEE80211_NUM_TIDS + 1];
 };
 
+#if IS_ENABLED(CONFIG_CFG80211)
 /**
  * cfg80211_get_station - retrieve information about a given station
  * @dev: the device where the station is supposed to be connected to
@@ -1114,6 +1115,14 @@ struct station_info {
  */
 int cfg80211_get_station(struct net_device *dev, const u8 *mac_addr,
                          struct station_info *sinfo);
+#else
+static inline int cfg80211_get_station(struct net_device *dev,
+                                       const u8 *mac_addr,
+                                       struct station_info *sinfo)
+{
+        return -ENOENT;
+}
+#endif
 
 /**
  * enum monitor_flags - monitor flags
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 4079fc18ffe4..7d4a72e75f33 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -111,6 +111,7 @@ struct fib_info {
         unsigned char           fib_scope;
         unsigned char           fib_type;
         __be32                  fib_prefsrc;
+        u32                     fib_tb_id;
         u32                     fib_priority;
         u32                     *fib_metrics;
 #define fib_mtu fib_metrics[RTAX_MTU-1]
@@ -319,7 +320,7 @@ void fib_flush_external(struct net *net);
 /* Exported by fib_semantics.c */
 int ip_fib_check_default(__be32 gw, struct net_device *dev);
 int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force);
-int fib_sync_down_addr(struct net *net, __be32 local);
+int fib_sync_down_addr(struct net_device *dev, __be32 local);
 int fib_sync_up(struct net_device *dev, unsigned int nh_flags);
 
 extern u32 fib_multipath_secret __read_mostly;
diff --git a/include/net/netfilter/nft_meta.h b/include/net/netfilter/nft_meta.h
index d27588c8dbd9..1139cde0fdc5 100644
--- a/include/net/netfilter/nft_meta.h
+++ b/include/net/netfilter/nft_meta.h
@@ -36,4 +36,8 @@ void nft_meta_set_eval(const struct nft_expr *expr,
 void nft_meta_set_destroy(const struct nft_ctx *ctx,
                           const struct nft_expr *expr);
 
+int nft_meta_set_validate(const struct nft_ctx *ctx,
+                          const struct nft_expr *expr,
+                          const struct nft_data **data);
+
 #endif
diff --git a/include/net/netfilter/nft_reject.h b/include/net/netfilter/nft_reject.h
index 60fa1530006b..02e28c529b29 100644
--- a/include/net/netfilter/nft_reject.h
+++ b/include/net/netfilter/nft_reject.h
@@ -8,6 +8,10 @@ struct nft_reject {
 
 extern const struct nla_policy nft_reject_policy[];
 
+int nft_reject_validate(const struct nft_ctx *ctx,
+                        const struct nft_expr *expr,
+                        const struct nft_data **data);
+
 int nft_reject_init(const struct nft_ctx *ctx,
                     const struct nft_expr *expr,
                     const struct nlattr * const tb[]);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index c00e7d51bb18..7717302cab91 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1523,6 +1523,8 @@ static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unli
 {
         if (sk->sk_send_head == skb_unlinked)
                 sk->sk_send_head = NULL;
+        if (tcp_sk(sk)->highest_sack == skb_unlinked)
+                tcp_sk(sk)->highest_sack = NULL;
 }
 
 static inline void tcp_init_send_head(struct sock *sk)
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 8e90dd28bb75..e1f96737c2a1 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -2115,22 +2115,17 @@ static inline bool ib_is_udata_cleared(struct ib_udata *udata,
                                        size_t len)
 {
         const void __user *p = udata->inbuf + offset;
-        bool ret = false;
+        bool ret;
         u8 *buf;
 
         if (len > USHRT_MAX)
                 return false;
 
-        buf = kmalloc(len, GFP_KERNEL);
-        if (!buf)
+        buf = memdup_user(p, len);
+        if (IS_ERR(buf))
                 return false;
 
-        if (copy_from_user(buf, p, len))
-                goto free;
-
         ret = !memchr_inv(buf, 0, len);
-
-free:
         kfree(buf);
         return ret;
 }
diff --git a/include/scsi/scsi_transport_sas.h b/include/scsi/scsi_transport_sas.h
index 13c0b2ba1b6c..73d870918939 100644
--- a/include/scsi/scsi_transport_sas.h
+++ b/include/scsi/scsi_transport_sas.h
@@ -11,12 +11,12 @@ struct sas_rphy;
 struct request;
 
 #if !IS_ENABLED(CONFIG_SCSI_SAS_ATTRS)
-static inline int is_sas_attached(struct scsi_device *sdev)
+static inline int scsi_is_sas_rphy(const struct device *sdev)
 {
         return 0;
 }
 #else
-extern int is_sas_attached(struct scsi_device *sdev);
+extern int scsi_is_sas_rphy(const struct device *);
 #endif
 
 static inline int sas_protocol_ata(enum sas_protocol proto)
@@ -202,7 +202,6 @@ extern int sas_rphy_add(struct sas_rphy *);
 extern void sas_rphy_remove(struct sas_rphy *);
 extern void sas_rphy_delete(struct sas_rphy *);
 extern void sas_rphy_unlink(struct sas_rphy *);
-extern int scsi_is_sas_rphy(const struct device *);
 
 struct sas_port *sas_port_alloc(struct device *, int);
 struct sas_port *sas_port_alloc_num(struct device *);
diff --git a/include/uapi/linux/atm_zatm.h b/include/uapi/linux/atm_zatm.h
index 9c9c6ad55f14..5cd4d4d2dd1d 100644
--- a/include/uapi/linux/atm_zatm.h
+++ b/include/uapi/linux/atm_zatm.h
@@ -14,6 +14,7 @@
 
 #include <linux/atmapi.h>
 #include <linux/atmioc.h>
+#include <linux/time.h>
 
 #define ZATM_GETPOOL    _IOW('a',ATMIOC_SARPRV+1,struct atmif_sioc)
                                                 /* get pool statistics */
diff --git a/include/uapi/linux/if_pppol2tp.h b/include/uapi/linux/if_pppol2tp.h
index 163e8adac2d6..4bd1f55d6377 100644
--- a/include/uapi/linux/if_pppol2tp.h
+++ b/include/uapi/linux/if_pppol2tp.h
@@ -16,7 +16,8 @@
 #define _UAPI__LINUX_IF_PPPOL2TP_H
 
 #include <linux/types.h>
-
+#include <linux/in.h>
+#include <linux/in6.h>
 
 /* Structure used to connect() the socket to a particular tunnel UDP
  * socket over IPv4.
diff --git a/include/uapi/linux/if_pppox.h b/include/uapi/linux/if_pppox.h
index e128769331b5..d37bbb17a007 100644
--- a/include/uapi/linux/if_pppox.h
+++ b/include/uapi/linux/if_pppox.h
@@ -21,8 +21,11 @@
 #include <asm/byteorder.h>
 
 #include <linux/socket.h>
+#include <linux/if.h>
 #include <linux/if_ether.h>
 #include <linux/if_pppol2tp.h>
+#include <linux/in.h>
+#include <linux/in6.h>
 
 /* For user-space programs to pick up these definitions
  * which they wouldn't get otherwise without defining __KERNEL__
diff --git a/include/uapi/linux/if_tunnel.h b/include/uapi/linux/if_tunnel.h
index 1046f5515174..777b6cdb1b7b 100644
--- a/include/uapi/linux/if_tunnel.h
+++ b/include/uapi/linux/if_tunnel.h
@@ -2,6 +2,9 @@
 #define _UAPI_IF_TUNNEL_H_
 
 #include <linux/types.h>
+#include <linux/if.h>
+#include <linux/ip.h>
+#include <linux/in6.h>
 #include <asm/byteorder.h>
 
 
diff --git a/include/uapi/linux/ipx.h b/include/uapi/linux/ipx.h
index 3d48014cdd71..30f031db12f6 100644
--- a/include/uapi/linux/ipx.h
+++ b/include/uapi/linux/ipx.h
@@ -1,11 +1,13 @@
 #ifndef _IPX_H_
 #define _IPX_H_
+#include <linux/libc-compat.h>  /* for compatibility with glibc netipx/ipx.h */
 #include <linux/types.h>
 #include <linux/sockios.h>
 #include <linux/socket.h>
 #define IPX_NODE_LEN    6
 #define IPX_MTU         576
 
+#if __UAPI_DEF_SOCKADDR_IPX
 struct sockaddr_ipx {
         __kernel_sa_family_t sipx_family;
         __be16          sipx_port;
@@ -14,6 +16,7 @@ struct sockaddr_ipx {
         __u8            sipx_type;
         unsigned char   sipx_zero;      /* 16 byte fill */
 };
+#endif /* __UAPI_DEF_SOCKADDR_IPX */
 
 /*
  * So we can fit the extra info for SIOCSIFADDR into the address nicely
@@ -23,12 +26,15 @@ struct sockaddr_ipx {
 #define IPX_DLTITF      0
 #define IPX_CRTITF      1
 
+#if __UAPI_DEF_IPX_ROUTE_DEFINITION
 struct ipx_route_definition {
         __be32        ipx_network;
         __be32        ipx_router_network;
         unsigned char ipx_router_node[IPX_NODE_LEN];
 };
+#endif /* __UAPI_DEF_IPX_ROUTE_DEFINITION */
 
+#if __UAPI_DEF_IPX_INTERFACE_DEFINITION
 struct ipx_interface_definition {
         __be32        ipx_network;
         unsigned char ipx_device[16];
@@ -45,16 +51,20 @@ struct ipx_interface_definition {
 #define IPX_INTERNAL            2
         unsigned char ipx_node[IPX_NODE_LEN];
 };
-        
+#endif /* __UAPI_DEF_IPX_INTERFACE_DEFINITION */
+
+#if __UAPI_DEF_IPX_CONFIG_DATA
 struct ipx_config_data {
         unsigned char   ipxcfg_auto_select_primary;
         unsigned char   ipxcfg_auto_create_interfaces;
 };
+#endif /* __UAPI_DEF_IPX_CONFIG_DATA */
 
 /*
  * OLD Route Definition for backward compatibility.
  */
 
+#if __UAPI_DEF_IPX_ROUTE_DEF
 struct ipx_route_def {
         __be32          ipx_network;
         __be32          ipx_router_network;
@@ -67,6 +77,7 @@ struct ipx_route_def {
 #define IPX_RT_BLUEBOOK         2
 #define IPX_RT_ROUTED           1
 };
+#endif /* __UAPI_DEF_IPX_ROUTE_DEF */
 
 #define SIOCAIPXITFCRT          (SIOCPROTOPRIVATE)
 #define SIOCAIPXPRISLT          (SIOCPROTOPRIVATE + 1)
diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
index e4f048ee7043..44b8a6bd5fe1 100644
--- a/include/uapi/linux/libc-compat.h
+++ b/include/uapi/linux/libc-compat.h
@@ -139,6 +139,25 @@
 
 #endif /* _NETINET_IN_H */
 
+/* Coordinate with glibc netipx/ipx.h header. */
+#if defined(__NETIPX_IPX_H)
+
+#define __UAPI_DEF_SOCKADDR_IPX                 0
+#define __UAPI_DEF_IPX_ROUTE_DEFINITION         0
+#define __UAPI_DEF_IPX_INTERFACE_DEFINITION     0
+#define __UAPI_DEF_IPX_CONFIG_DATA              0
+#define __UAPI_DEF_IPX_ROUTE_DEF                0
+
+#else /* defined(__NETIPX_IPX_H) */
+
+#define __UAPI_DEF_SOCKADDR_IPX                 1
+#define __UAPI_DEF_IPX_ROUTE_DEFINITION         1
+#define __UAPI_DEF_IPX_INTERFACE_DEFINITION     1
+#define __UAPI_DEF_IPX_CONFIG_DATA              1
+#define __UAPI_DEF_IPX_ROUTE_DEF                1
+
+#endif /* defined(__NETIPX_IPX_H) */
+
 /* Definitions for xattr.h */
 #if defined(_SYS_XATTR_H)
 #define __UAPI_DEF_XATTR                0
@@ -179,6 +198,13 @@
 #define __UAPI_DEF_IN6_PKTINFO          1
 #define __UAPI_DEF_IP6_MTUINFO          1
 
+/* Definitions for ipx.h */
+#define __UAPI_DEF_SOCKADDR_IPX                 1
+#define __UAPI_DEF_IPX_ROUTE_DEFINITION         1
+#define __UAPI_DEF_IPX_INTERFACE_DEFINITION     1
+#define __UAPI_DEF_IPX_CONFIG_DATA              1
+#define __UAPI_DEF_IPX_ROUTE_DEF                1
+
 /* Definitions for xattr.h */
 #define __UAPI_DEF_XATTR                1
 
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index d95a3018f6a1..54c3b4f4aceb 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -583,7 +583,7 @@ enum ovs_userspace_attr {
 #define OVS_USERSPACE_ATTR_MAX (__OVS_USERSPACE_ATTR_MAX - 1)
 
 struct ovs_action_trunc {
-        uint32_t max_len; /* Max packet size in bytes. */
+        __u32 max_len; /* Max packet size in bytes. */
 };
 
 /**
@@ -632,8 +632,8 @@ enum ovs_hash_alg {
  * @hash_basis: basis used for computing hash.
  */
 struct ovs_action_hash {
-        uint32_t  hash_alg;     /* One of ovs_hash_alg. */
-        uint32_t  hash_basis;
+        __u32  hash_alg;     /* One of ovs_hash_alg. */
+        __u32  hash_basis;
 };
 
 /**
diff --git a/include/xen/xen-ops.h b/include/xen/xen-ops.h
index 9a37c541822f..b5486e648607 100644
--- a/include/xen/xen-ops.h
+++ b/include/xen/xen-ops.h
@@ -9,8 +9,8 @@
 
 DECLARE_PER_CPU(struct vcpu_info *, xen_vcpu);
 
-DECLARE_PER_CPU(int, xen_vcpu_id);
-static inline int xen_vcpu_nr(int cpu)
+DECLARE_PER_CPU(uint32_t, xen_vcpu_id);
+static inline uint32_t xen_vcpu_nr(int cpu)
 {
         return per_cpu(xen_vcpu_id, cpu);
 }
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index d6709eb70970..0d302a87f21b 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -19,6 +19,7 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
+#include <linux/file.h>
 #include <linux/kernel.h>
 #include <linux/audit.h>
 #include <linux/kthread.h>
@@ -544,10 +545,11 @@ int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
         unsigned long ino;
         dev_t dev;
 
-        rcu_read_lock();
-        exe_file = rcu_dereference(tsk->mm->exe_file);
+        exe_file = get_task_exe_file(tsk);
+        if (!exe_file)
+                return 0;
         ino = exe_file->f_inode->i_ino;
         dev = exe_file->f_inode->i_sb->s_dev;
-        rcu_read_unlock();
+        fput(exe_file);
         return audit_mark_compare(mark, ino, dev);
 }
diff --git a/kernel/configs/tiny.config b/kernel/configs/tiny.config
index c2de56ab0fce..7fa0c4ae6394 100644
--- a/kernel/configs/tiny.config
+++ b/kernel/configs/tiny.config
@@ -1,4 +1,12 @@
+# CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+# CONFIG_KERNEL_GZIP is not set
+# CONFIG_KERNEL_BZIP2 is not set
+# CONFIG_KERNEL_LZMA is not set
 CONFIG_KERNEL_XZ=y
+# CONFIG_KERNEL_LZO is not set
+# CONFIG_KERNEL_LZ4 is not set
 CONFIG_OPTIMIZE_INLINING=y
+# CONFIG_SLAB is not set
+# CONFIG_SLUB is not set
 CONFIG_SLOB=y
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index c7fd2778ed50..c27e53326bef 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -2069,6 +2069,20 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css)
         mutex_unlock(&cpuset_mutex);
 }
 
+/*
+ * Make sure the new task conform to the current state of its parent,
+ * which could have been changed by cpuset just after it inherits the
+ * state from the parent and before it sits on the cgroup's task list.
+ */
+void cpuset_fork(struct task_struct *task)
+{
+        if (task_css_is_root(task, cpuset_cgrp_id))
+                return;
+
+        set_cpus_allowed_ptr(task, &current->cpus_allowed);
+        task->mems_allowed = current->mems_allowed;
+}
+
 struct cgroup_subsys cpuset_cgrp_subsys = {
         .css_alloc      = cpuset_css_alloc,
         .css_online     = cpuset_css_online,
@@ -2079,6 +2093,7 @@ struct cgroup_subsys cpuset_cgrp_subsys = {
         .attach         = cpuset_attach,
         .post_attach    = cpuset_post_attach,
         .bind           = cpuset_bind,
+        .fork           = cpuset_fork,
         .legacy_cftypes = files,
         .early_init     = true,
 };
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 5650f5317e0c..a54f2c2cdb20 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2496,11 +2496,11 @@ static int __perf_event_stop(void *info)
         return 0;
 }
 
-static int perf_event_restart(struct perf_event *event)
+static int perf_event_stop(struct perf_event *event, int restart)
 {
         struct stop_event_data sd = {
                 .event          = event,
-                .restart        = 1,
+                .restart        = restart,
         };
         int ret = 0;
 
@@ -3549,10 +3549,18 @@ static int perf_event_read(struct perf_event *event, bool group)
                         .group = group,
                         .ret = 0,
                 };
-                ret = smp_call_function_single(event->oncpu, __perf_event_read, &data, 1);
-                /* The event must have been read from an online CPU: */
-                WARN_ON_ONCE(ret);
-                ret = ret ? : data.ret;
+                /*
+                 * Purposely ignore the smp_call_function_single() return
+                 * value.
+                 *
+                 * If event->oncpu isn't a valid CPU it means the event got
+                 * scheduled out and that will have updated the event count.
+                 *
+                 * Therefore, either way, we'll have an up-to-date event count
+                 * after this.
+                 */
+                (void)smp_call_function_single(event->oncpu, __perf_event_read, &data, 1);
+                ret = data.ret;
         } else if (event->state == PERF_EVENT_STATE_INACTIVE) {
                 struct perf_event_context *ctx = event->ctx;
                 unsigned long flags;
@@ -4837,6 +4845,19 @@ static void ring_buffer_attach(struct perf_event *event,
                 spin_unlock_irqrestore(&rb->event_lock, flags);
         }
 
+        /*
+         * Avoid racing with perf_mmap_close(AUX): stop the event
+         * before swizzling the event::rb pointer; if it's getting
+         * unmapped, its aux_mmap_count will be 0 and it won't
+         * restart. See the comment in __perf_pmu_output_stop().
+         *
+         * Data will inevitably be lost when set_output is done in
+         * mid-air, but then again, whoever does it like this is
+         * not in for the data anyway.
+         */
+        if (has_aux(event))
+                perf_event_stop(event, 0);
+
         rcu_assign_pointer(event->rb, rb);
 
         if (old_rb) {
@@ -6112,7 +6133,7 @@ static void perf_event_addr_filters_exec(struct perf_event *event, void *data)
         raw_spin_unlock_irqrestore(&ifh->lock, flags);
 
         if (restart)
-                perf_event_restart(event);
+                perf_event_stop(event, 1);
 }
 
 void perf_event_exec(void)
@@ -6156,7 +6177,13 @@ static void __perf_event_output_stop(struct perf_event *event, void *data)
 
         /*
          * In case of inheritance, it will be the parent that links to the
-         * ring-buffer, but it will be the child that's actually using it:
+         * ring-buffer, but it will be the child that's actually using it.
+         *
+         * We are using event::rb to determine if the event should be stopped,
+         * however this may race with ring_buffer_attach() (through set_output),
+         * which will make us skip the event that actually needs to be stopped.
+         * So ring_buffer_attach() has to stop an aux event before re-assigning
+         * its rb pointer.
          */
         if (rcu_dereference(parent->rb) == rb)
                 ro->err = __perf_event_stop(&sd);
@@ -6166,7 +6193,7 @@ static int __perf_pmu_output_stop(void *info)
 {
         struct perf_event *event = info;
         struct pmu *pmu = event->pmu;
-        struct perf_cpu_context *cpuctx = get_cpu_ptr(pmu->pmu_cpu_context);
+        struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
         struct remote_output ro = {
                 .rb     = event->rb,
         };
@@ -6670,7 +6697,7 @@ static void __perf_addr_filters_adjust(struct perf_event *event, void *data)
         raw_spin_unlock_irqrestore(&ifh->lock, flags);
 
         if (restart)
-                perf_event_restart(event);
+                perf_event_stop(event, 1);
 }
 
 /*
@@ -7859,7 +7886,7 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
         mmput(mm);
 
 restart:
-        perf_event_restart(event);
+        perf_event_stop(event, 1);
 }
 
 /*
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index ae9b90dc9a5a..257fa460b846 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -330,15 +330,22 @@ void *perf_aux_output_begin(struct perf_output_handle *handle,
         if (!rb)
                 return NULL;
 
-        if (!rb_has_aux(rb) || !atomic_inc_not_zero(&rb->aux_refcount))
+        if (!rb_has_aux(rb))
                 goto err;
 
         /*
-         * If rb::aux_mmap_count is zero (and rb_has_aux() above went through),
-         * the aux buffer is in perf_mmap_close(), about to get freed.
+         * If aux_mmap_count is zero, the aux buffer is in perf_mmap_close(),
+         * about to get freed, so we leave immediately.
+         *
+         * Checking rb::aux_mmap_count and rb::refcount has to be done in
+         * the same order, see perf_mmap_close. Otherwise we end up freeing
+         * aux pages in this path, which is a bug, because in_atomic().
          */
         if (!atomic_read(&rb->aux_mmap_count))
-                goto err_put;
+                goto err;
+
+        if (!atomic_inc_not_zero(&rb->aux_refcount))
+                goto err;
 
         /*
          * Nesting is not supported for AUX area, make sure nested
diff --git a/kernel/exit.c b/kernel/exit.c
index 2f974ae042a6..091a78be3b09 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -848,12 +848,7 @@ void do_exit(long code)
         TASKS_RCU(preempt_enable());
         exit_notify(tsk, group_dead);
         proc_exit_connector(tsk);
-#ifdef CONFIG_NUMA
-        task_lock(tsk);
-        mpol_put(tsk->mempolicy);
-        tsk->mempolicy = NULL;
-        task_unlock(tsk);
-#endif
+        mpol_put_task_policy(tsk);
 #ifdef CONFIG_FUTEX
         if (unlikely(current->pi_state_cache))
                 kfree(current->pi_state_cache);
diff --git a/kernel/fork.c b/kernel/fork.c
index 9b85f6b2cdcd..0c240fd5beba 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -855,6 +855,29 @@ struct file *get_mm_exe_file(struct mm_struct *mm)
 EXPORT_SYMBOL(get_mm_exe_file);
 
 /**
+ * get_task_exe_file - acquire a reference to the task's executable file
+ *
+ * Returns %NULL if task's mm (if any) has no associated executable file or
+ * this is a kernel thread with borrowed mm (see the comment above get_task_mm).
+ * User must release file via fput().
+ */
+struct file *get_task_exe_file(struct task_struct *task)
+{
+        struct file *exe_file = NULL;
+        struct mm_struct *mm;
+
+        task_lock(task);
+        mm = task->mm;
+        if (mm) {
+                if (!(task->flags & PF_KTHREAD))
+                        exe_file = get_mm_exe_file(mm);
+        }
+        task_unlock(task);
+        return exe_file;
+}
+EXPORT_SYMBOL(get_task_exe_file);
+
+/**
  * get_task_mm - acquire a reference to the task's mm
  *
  * Returns %NULL if the task has no mm.  Checks PF_KTHREAD (meaning
@@ -969,14 +992,12 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
         deactivate_mm(tsk, mm);
 
         /*
-         * If we're exiting normally, clear a user-space tid field if
-         * requested.  We leave this alone when dying by signal, to leave
-         * the value intact in a core dump, and to save the unnecessary
-         * trouble, say, a killed vfork parent shouldn't touch this mm.
-         * Userland only wants this done for a sys_exit.
+         * Signal userspace if we're not exiting with a core dump
+         * because we want to leave the value intact for debugging
+         * purposes.
          */
         if (tsk->clear_child_tid) {
-                if (!(tsk->flags & PF_SIGNALED) &&
+                if (!(tsk->signal->flags & SIGNAL_GROUP_COREDUMP) &&
                     atomic_read(&mm->mm_users) > 1) {
                         /*
                          * We don't check the error code - if userspace has
@@ -1460,7 +1481,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         p->real_start_time = ktime_get_boot_ns();
         p->io_context = NULL;
         p->audit_context = NULL;
-        threadgroup_change_begin(current);
         cgroup_fork(p);
 #ifdef CONFIG_NUMA
         p->mempolicy = mpol_dup(p->mempolicy);
@@ -1612,6 +1632,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         INIT_LIST_HEAD(&p->thread_group);
         p->task_works = NULL;
 
+        threadgroup_change_begin(current);
         /*
          * Ensure that the cgroup subsystem policies allow the new process to be
          * forked. It should be noted the the new process's css_set can be changed
@@ -1712,6 +1733,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 bad_fork_cancel_cgroup:
         cgroup_cancel_fork(p);
 bad_fork_free_pid:
+        threadgroup_change_end(current);
         if (pid != &init_struct_pid)
                 free_pid(pid);
 bad_fork_cleanup_thread:
@@ -1744,7 +1766,6 @@ bad_fork_cleanup_policy:
         mpol_put(p->mempolicy);
 bad_fork_cleanup_threadgroup_lock:
 #endif
-        threadgroup_change_end(current);
         delayacct_tsk_free(p);
 bad_fork_cleanup_count:
         atomic_dec(&p->cred->user->processes);
diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c
index f68959341c0f..32f6cfcff212 100644
--- a/kernel/irq/affinity.c
+++ b/kernel/irq/affinity.c
@@ -39,6 +39,7 @@ struct cpumask *irq_create_affinity_mask(unsigned int *nr_vecs)
                 return NULL;
         }
 
+        get_online_cpus();
         if (max_vecs >= num_online_cpus()) {
                 cpumask_copy(affinity_mask, cpu_online_mask);
                 *nr_vecs = num_online_cpus();
@@ -56,6 +57,7 @@ struct cpumask *irq_create_affinity_mask(unsigned int *nr_vecs)
                 }
                 *nr_vecs = vecs;
         }
+        put_online_cpus();
 
         return affinity_mask;
 }
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index b4c1bc7c9ca2..637389088b3f 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -820,6 +820,17 @@ __irq_do_set_handler(struct irq_desc *desc, irq_flow_handler_t handle,
         desc->name = name;
 
         if (handle != handle_bad_irq && is_chained) {
+                /*
+                 * We're about to start this interrupt immediately,
+                 * hence the need to set the trigger configuration.
+                 * But the .set_type callback may have overridden the
+                 * flow handler, ignoring that we're dealing with a
+                 * chained interrupt. Reset it immediately because we
+                 * do know better.
+                 */
+                __irq_set_trigger(desc, irqd_get_trigger_type(&desc->irq_data));
+                desc->handle_irq = handle;
+
                 irq_settings_set_noprobe(desc);
                 irq_settings_set_norequest(desc);
                 irq_settings_set_nothread(desc);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 73a2b786b5e9..9530fcd27704 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1681,8 +1681,10 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler,
         action->dev_id = dev_id;
 
         retval = irq_chip_pm_get(&desc->irq_data);
-        if (retval < 0)
+        if (retval < 0) {
+                kfree(action);
                 return retval;
+        }
 
         chip_bus_lock(desc);
         retval = __setup_irq(irq, desc, action);
@@ -1985,8 +1987,10 @@ int request_percpu_irq(unsigned int irq, irq_handler_t handler,
         action->percpu_dev_id = dev_id;
 
         retval = irq_chip_pm_get(&desc->irq_data);
-        if (retval < 0)
+        if (retval < 0) {
+                kfree(action);
                 return retval;
+        }
 
         chip_bus_lock(desc);
         retval = __setup_irq(irq, desc, action);
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 503bc2d348e5..037c321c5618 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -887,7 +887,10 @@ int kexec_load_purgatory(struct kimage *image, unsigned long min,
         return 0;
 out:
         vfree(pi->sechdrs);
+        pi->sechdrs = NULL;
+
         vfree(pi->purgatory_buf);
+        pi->purgatory_buf = NULL;
         return ret;
 }
 
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 251d16b4cb41..b501e390bb34 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -247,6 +247,7 @@ static void devm_memremap_pages_release(struct device *dev, void *data)
         align_start = res->start & ~(SECTION_SIZE - 1);
         align_size = ALIGN(resource_size(res), SECTION_SIZE);
         arch_remove_memory(align_start, align_size);
+        untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
         pgmap_radix_release(res);
         dev_WARN_ONCE(dev, pgmap->altmap && pgmap->altmap->alloc,
                         "%s: failed to free all reserved pages\n", __func__);
@@ -282,6 +283,7 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
                 struct percpu_ref *ref, struct vmem_altmap *altmap)
 {
         resource_size_t key, align_start, align_size, align_end;
+        pgprot_t pgprot = PAGE_KERNEL;
         struct dev_pagemap *pgmap;
         struct page_map *page_map;
         int error, nid, is_ram;
@@ -351,6 +353,11 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
         if (nid < 0)
                 nid = numa_mem_id();
 
+        error = track_pfn_remap(NULL, &pgprot, PHYS_PFN(align_start), 0,
+                        align_size);
+        if (error)
+                goto err_pfn_remap;
+
         error = arch_add_memory(nid, align_start, align_size, true);
         if (error)
                 goto err_add_memory;
@@ -371,6 +378,8 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
         return __va(res->start);
 
  err_add_memory:
+        untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
+ err_pfn_remap:
  err_radix:
         pgmap_radix_release(res);
         devres_free(page_map);
diff --git a/kernel/power/qos.c b/kernel/power/qos.c
index 97b0df71303e..168ff442ebde 100644
--- a/kernel/power/qos.c
+++ b/kernel/power/qos.c
@@ -482,7 +482,16 @@ void pm_qos_update_request(struct pm_qos_request *req,
                 return;
         }
 
-        cancel_delayed_work_sync(&req->work);
+        /*
+         * This function may be called very early during boot, for example,
+         * from of_clk_init(), where irq needs to stay disabled.
+         * cancel_delayed_work_sync() assumes that irq is enabled on
+         * invocation and re-enables it on return.  Avoid calling it until
+         * workqueue is initialized.
+         */
+        if (keventd_up())
+                cancel_delayed_work_sync(&req->work);
+
         __pm_qos_update_request(req, new_value);
 }
 EXPORT_SYMBOL_GPL(pm_qos_update_request);
diff --git a/kernel/printk/braille.c b/kernel/printk/braille.c
index 276762f3a460..d5760c42f042 100644
--- a/kernel/printk/braille.c
+++ b/kernel/printk/braille.c
@@ -9,10 +9,10 @@
 
 char *_braille_console_setup(char **str, char **brl_options)
 {
-        if (!memcmp(*str, "brl,", 4)) {
+        if (!strncmp(*str, "brl,", 4)) {
                 *brl_options = "";
                 *str += 4;
-        } else if (!memcmp(str, "brl=", 4)) {
+        } else if (!strncmp(*str, "brl=", 4)) {
                 *brl_options = *str + 4;
                 *str = strchr(*brl_options, ',');
                 if (!*str)
diff --git a/kernel/printk/nmi.c b/kernel/printk/nmi.c
index b69eb8a2876f..16bab471c7e2 100644
--- a/kernel/printk/nmi.c
+++ b/kernel/printk/nmi.c
@@ -99,27 +99,33 @@ again:
         return add;
 }
 
-/*
- * printk one line from the temporary buffer from @start index until
- * and including the @end index.
- */
-static void print_nmi_seq_line(struct nmi_seq_buf *s, int start, int end)
+static void printk_nmi_flush_line(const char *text, int len)
 {
-        const char *buf = s->buffer + start;
-
         /*
          * The buffers are flushed in NMI only on panic.  The messages must
          * go only into the ring buffer at this stage.  Consoles will get
          * explicitly called later when a crashdump is not generated.
          */
         if (in_nmi())
-                printk_deferred("%.*s", (end - start) + 1, buf);
+                printk_deferred("%.*s", len, text);
         else
-                printk("%.*s", (end - start) + 1, buf);
+                printk("%.*s", len, text);
 
 }
 
 /*
+ * printk one line from the temporary buffer from @start index until
+ * and including the @end index.
+ */
+static void printk_nmi_flush_seq_line(struct nmi_seq_buf *s,
+                                        int start, int end)
+{
+        const char *buf = s->buffer + start;
+
+        printk_nmi_flush_line(buf, (end - start) + 1);
+}
+
+/*
  * Flush data from the associated per_CPU buffer. The function
  * can be called either via IRQ work or independently.
  */
@@ -150,9 +156,11 @@ more:
          * the buffer an unexpected way. If we printed something then
          * @len must only increase.
          */
-        if (i && i >= len)
-                pr_err("printk_nmi_flush: internal error: i=%d >= len=%zu\n",
-                       i, len);
+        if (i && i >= len) {
+                const char *msg = "printk_nmi_flush: internal error\n";
+
+                printk_nmi_flush_line(msg, strlen(msg));
+        }
 
         if (!len)
                 goto out; /* Someone else has already flushed the buffer. */
@@ -166,14 +174,14 @@ more:
         /* Print line by line. */
         for (; i < size; i++) {
                 if (s->buffer[i] == '\n') {
-                        print_nmi_seq_line(s, last_i, i);
+                        printk_nmi_flush_seq_line(s, last_i, i);
                         last_i = i + 1;
                 }
         }
         /* Check if there was a partial line. */
         if (last_i < size) {
-                print_nmi_seq_line(s, last_i, size - 1);
-                pr_cont("\n");
+                printk_nmi_flush_seq_line(s, last_i, size - 1);
+                printk_nmi_flush_line("\n", strlen("\n"));
         }
 
         /*
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 3d91b63dd2f6..0b6238f18da2 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2016,6 +2016,28 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
         success = 1; /* we're going to change ->state */
         cpu = task_cpu(p);
 
+        /*
+         * Ensure we load p->on_rq _after_ p->state, otherwise it would
+         * be possible to, falsely, observe p->on_rq == 0 and get stuck
+         * in smp_cond_load_acquire() below.
+         *
+         * sched_ttwu_pending()                 try_to_wake_up()
+         *   [S] p->on_rq = 1;                  [L] P->state
+         *       UNLOCK rq->lock  -----.
+         *                              \
+         *                               +---   RMB
+         * schedule()                   /
+         *       LOCK rq->lock    -----'
+         *       UNLOCK rq->lock
+         *
+         * [task p]
+         *   [S] p->state = UNINTERRUPTIBLE     [L] p->on_rq
+         *
+         * Pairs with the UNLOCK+LOCK on rq->lock from the
+         * last wakeup of our task and the schedule that got our task
+         * current.
+         */
+        smp_rmb();
         if (p->on_rq && ttwu_remote(p, wake_flags))
                 goto stat;
 
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index ef6c6c3f9d8a..0db7c8a2afe2 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -605,12 +605,16 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
                 ptrace_event(PTRACE_EVENT_SECCOMP, data);
                 /*
                  * The delivery of a fatal signal during event
-                 * notification may silently skip tracer notification.
-                 * Terminating the task now avoids executing a system
-                 * call that may not be intended.
+                 * notification may silently skip tracer notification,
+                 * which could leave us with a potentially unmodified
+                 * syscall that the tracer would have liked to have
+                 * changed. Since the process is about to die, we just
+                 * force the syscall to be skipped and let the signal
+                 * kill the process and correctly handle any tracer exit
+                 * notifications.
                  */
                 if (fatal_signal_pending(current))
-                        do_exit(SIGSYS);
+                        goto skip;
                 /* Check if the tracer forced the syscall to be skipped. */
                 this_syscall = syscall_get_nr(current, task_pt_regs(current));
                 if (this_syscall < 0)
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index b43d0b27c1fe..a13bbdaab47d 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2140,6 +2140,21 @@ static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp,
         return 0;
 }
 
+static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp,
+                                 int *valp,
+                                 int write, void *data)
+{
+        if (write) {
+                if (*negp)
+                        return -EINVAL;
+                *valp = *lvalp;
+        } else {
+                unsigned int val = *valp;
+                *lvalp = (unsigned long)val;
+        }
+        return 0;
+}
+
 static const char proc_wspace_sep[] = { ' ', '\t', '\n' };
 
 static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
@@ -2259,8 +2274,27 @@ static int do_proc_dointvec(struct ctl_table *table, int write,
 int proc_dointvec(struct ctl_table *table, int write,
                      void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-    return do_proc_dointvec(table,write,buffer,lenp,ppos,
-                            NULL,NULL);
+        return do_proc_dointvec(table, write, buffer, lenp, ppos, NULL, NULL);
+}
+
+/**
+ * proc_douintvec - read a vector of unsigned integers
+ * @table: the sysctl table
+ * @write: %TRUE if this is a write to the sysctl file
+ * @buffer: the user buffer
+ * @lenp: the size of the user buffer
+ * @ppos: file position
+ *
+ * Reads/writes up to table->maxlen/sizeof(unsigned int) unsigned integer
+ * values from/to the user buffer, treated as an ASCII string.
+ *
+ * Returns 0 on success.
+ */
+int proc_douintvec(struct ctl_table *table, int write,
+                     void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        return do_proc_dointvec(table, write, buffer, lenp, ppos,
+                                do_proc_douintvec_conv, NULL);
 }
 
 /*
@@ -2858,6 +2892,12 @@ int proc_dointvec(struct ctl_table *table, int write,
         return -ENOSYS;
 }
 
+int proc_douintvec(struct ctl_table *table, int write,
+                  void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        return -ENOSYS;
+}
+
 int proc_dointvec_minmax(struct ctl_table *table, int write,
                     void __user *buffer, size_t *lenp, loff_t *ppos)
 {
@@ -2903,6 +2943,7 @@ int proc_doulongvec_ms_jiffies_minmax(struct ctl_table *table, int write,
  * exception granted :-)
  */
 EXPORT_SYMBOL(proc_dointvec);
+EXPORT_SYMBOL(proc_douintvec);
 EXPORT_SYMBOL(proc_dointvec_jiffies);
 EXPORT_SYMBOL(proc_dointvec_minmax);
 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 204fdc86863d..2ec7c00228f3 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -908,10 +908,11 @@ static void __tick_nohz_idle_enter(struct tick_sched *ts)
         ktime_t now, expires;
         int cpu = smp_processor_id();
 
+        now = tick_nohz_start_idle(ts);
+
         if (can_stop_idle_tick(cpu, ts)) {
                 int was_stopped = ts->tick_stopped;
 
-                now = tick_nohz_start_idle(ts);
                 ts->idle_calls++;
 
                 expires = tick_nohz_stop_sched_tick(ts, now, cpu);
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 3b65746c7f15..e07fb093f819 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -401,7 +401,10 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf)
         do {
                 seq = raw_read_seqcount_latch(&tkf->seq);
                 tkr = tkf->base + (seq & 0x01);
-                now = ktime_to_ns(tkr->base) + timekeeping_get_ns(tkr);
+                now = ktime_to_ns(tkr->base);
+
+                now += clocksource_delta(tkr->read(tkr->clock),
+                                         tkr->cycle_last, tkr->mask);
         } while (read_seqcount_retry(&tkf->seq, seq));
 
         return now;
diff --git a/kernel/time/timekeeping_debug.c b/kernel/time/timekeeping_debug.c
index f6bd65236712..107310a6f36f 100644
--- a/kernel/time/timekeeping_debug.c
+++ b/kernel/time/timekeeping_debug.c
@@ -23,7 +23,9 @@
 
 #include "timekeeping_internal.h"
 
-static unsigned int sleep_time_bin[32] = {0};
+#define NUM_BINS 32
+
+static unsigned int sleep_time_bin[NUM_BINS] = {0};
 
 static int tk_debug_show_sleep_time(struct seq_file *s, void *data)
 {
@@ -69,6 +71,9 @@ late_initcall(tk_debug_sleep_time_init);
 
 void tk_debug_account_sleep_time(struct timespec64 *t)
 {
-        sleep_time_bin[fls(t->tv_sec)]++;
+        /* Cap bin index so we don't overflow the array */
+        int bin = min(fls(t->tv_sec), NUM_BINS-1);
+
+        sleep_time_bin[bin]++;
 }
 
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 7598e6ca817a..dbafc5df03f3 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -223,7 +223,7 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
         what |= MASK_TC_BIT(op_flags, META);
         what |= MASK_TC_BIT(op_flags, PREFLUSH);
         what |= MASK_TC_BIT(op_flags, FUA);
-        if (op == REQ_OP_DISCARD)
+        if (op == REQ_OP_DISCARD || op == REQ_OP_SECURE_ERASE)
                 what |= BLK_TC_ACT(BLK_TC_DISCARD);
         if (op == REQ_OP_FLUSH)
                 what |= BLK_TC_ACT(BLK_TC_FLUSH);
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 2307d7c89dac..2e2cca509231 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1686,24 +1686,6 @@ config LATENCYTOP
           Enable this option if you want to use the LatencyTOP tool
           to find out which userspace is blocking on what kernel operations.
 
-config ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
-        bool
-
-config DEBUG_STRICT_USER_COPY_CHECKS
-        bool "Strict user copy size checks"
-        depends on ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
-        depends on DEBUG_KERNEL && !TRACE_BRANCH_PROFILING
-        help
-          Enabling this option turns a certain set of sanity checks for user
-          copy operations into compile time failures.
-
-          The copy_from_user() etc checks are there to help test if there
-          are sufficient security checks on the length argument of
-          the copy operation, by having gcc prove that the argument is
-          within bounds.
-
-          If unsure, say N.
-
 source kernel/trace/Kconfig
 
 menu "Runtime Testing"
diff --git a/lib/Makefile b/lib/Makefile
index cfa68eb269e4..5dc77a8ec297 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -24,7 +24,6 @@ lib-y := ctype.o string.o vsprintf.o cmdline.o \
          is_single_threaded.o plist.o decompress.o kobject_uevent.o \
          earlycpio.o seq_buf.o nmi_backtrace.o nodemask.o
 
-obj-$(CONFIG_ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS) += usercopy.o
 lib-$(CONFIG_MMU) += ioremap.o
 lib-$(CONFIG_SMP) += cpumask.o
 lib-$(CONFIG_HAS_DMA) += dma-noop.o
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 5ba520b544d7..56054e541a0f 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -77,17 +77,18 @@ static int alloc_bucket_locks(struct rhashtable *ht, struct bucket_table *tbl,
         size = min_t(unsigned int, size, tbl->size >> 1);
 
         if (sizeof(spinlock_t) != 0) {
+                tbl->locks = NULL;
 #ifdef CONFIG_NUMA
                 if (size * sizeof(spinlock_t) > PAGE_SIZE &&
                     gfp == GFP_KERNEL)
                         tbl->locks = vmalloc(size * sizeof(spinlock_t));
-                else
 #endif
                 if (gfp != GFP_KERNEL)
                         gfp |= __GFP_NOWARN | __GFP_NORETRY;
 
-                tbl->locks = kmalloc_array(size, sizeof(spinlock_t),
-                                           gfp);
+                if (!tbl->locks)
+                        tbl->locks = kmalloc_array(size, sizeof(spinlock_t),
+                                                   gfp);
                 if (!tbl->locks)
                         return -ENOMEM;
                 for (i = 0; i < size; i++)
diff --git a/lib/test_hash.c b/lib/test_hash.c
index 66c5fc8351e8..cac20c5fb304 100644
--- a/lib/test_hash.c
+++ b/lib/test_hash.c
@@ -143,7 +143,7 @@ static int __init
 test_hash_init(void)
 {
         char buf[SIZE+1];
-        u32 string_or = 0, hash_or[2][33] = { 0 };
+        u32 string_or = 0, hash_or[2][33] = { { 0, } };
         unsigned tests = 0;
         unsigned long long h64 = 0;
         int i, j;
@@ -219,21 +219,27 @@ test_hash_init(void)
         }
 
         /* Issue notices about skipped tests. */
-#ifndef HAVE_ARCH__HASH_32
-        pr_info("__hash_32() has no arch implementation to test.");
-#elif HAVE_ARCH__HASH_32 != 1
+#ifdef HAVE_ARCH__HASH_32
+#if HAVE_ARCH__HASH_32 != 1
         pr_info("__hash_32() is arch-specific; not compared to generic.");
 #endif
-#ifndef HAVE_ARCH_HASH_32
-        pr_info("hash_32() has no arch implementation to test.");
-#elif HAVE_ARCH_HASH_32 != 1
+#else
+        pr_info("__hash_32() has no arch implementation to test.");
+#endif
+#ifdef HAVE_ARCH_HASH_32
+#if HAVE_ARCH_HASH_32 != 1
         pr_info("hash_32() is arch-specific; not compared to generic.");
 #endif
-#ifndef HAVE_ARCH_HASH_64
-        pr_info("hash_64() has no arch implementation to test.");
-#elif HAVE_ARCH_HASH_64 != 1
+#else
+        pr_info("hash_32() has no arch implementation to test.");
+#endif
+#ifdef HAVE_ARCH_HASH_64
+#if HAVE_ARCH_HASH_64 != 1
         pr_info("hash_64() is arch-specific; not compared to generic.");
 #endif
+#else
+        pr_info("hash_64() has no arch implementation to test.");
+#endif
 
         pr_notice("%u tests passed.", tests);
 
diff --git a/lib/usercopy.c b/lib/usercopy.c
deleted file mode 100644
index 4f5b1ddbcd25..000000000000
--- a/lib/usercopy.c
+++ /dev/null
@@ -1,9 +0,0 @@
-#include <linux/export.h>
-#include <linux/bug.h>
-#include <linux/uaccess.h>
-
-void copy_from_user_overflow(void)
-{
-        WARN(1, "Buffer overflow detected!\n");
-}
-EXPORT_SYMBOL(copy_from_user_overflow);
diff --git a/mm/Kconfig b/mm/Kconfig
index 78a23c5c302d..be0ee11fa0d9 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -262,7 +262,14 @@ config COMPACTION
         select MIGRATION
         depends on MMU
         help
-          Allows the compaction of memory for the allocation of huge pages.
+          Compaction is the only memory management component to form
+          high order (larger physically contiguous) memory blocks
+          reliably. The page allocator relies on compaction heavily and
+          the lack of the feature can lead to unexpected OOM killer
+          invocations for high order memory requests. You shouldn't
+          disable this option unless there really is a strong reason for
+          it and then we would be really interested to hear about that at
+          linux-mm@kvack.org.
 
 #
 # support for page migration
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 2373f0a7d340..a6abd76baa72 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1078,7 +1078,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
                 goto out;
 
         page = pmd_page(*pmd);
-        VM_BUG_ON_PAGE(!PageHead(page), page);
+        VM_BUG_ON_PAGE(!PageHead(page) && !is_zone_device_page(page), page);
         if (flags & FOLL_TOUCH)
                 touch_pmd(vma, addr, pmd);
         if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
@@ -1116,7 +1116,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
         }
 skip_mlock:
         page += (addr & ~HPAGE_PMD_MASK) >> PAGE_SHIFT;
-        VM_BUG_ON_PAGE(!PageCompound(page), page);
+        VM_BUG_ON_PAGE(!PageCompound(page) && !is_zone_device_page(page), page);
         if (flags & FOLL_GET)
                 get_page(page);
 
@@ -1512,7 +1512,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
         struct page *page;
         pgtable_t pgtable;
         pmd_t _pmd;
-        bool young, write, dirty;
+        bool young, write, dirty, soft_dirty;
         unsigned long addr;
         int i;
 
@@ -1546,6 +1546,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
         write = pmd_write(*pmd);
         young = pmd_young(*pmd);
         dirty = pmd_dirty(*pmd);
+        soft_dirty = pmd_soft_dirty(*pmd);
 
         pmdp_huge_split_prepare(vma, haddr, pmd);
         pgtable = pgtable_trans_huge_withdraw(mm, pmd);
@@ -1562,6 +1563,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
                         swp_entry_t swp_entry;
                         swp_entry = make_migration_entry(page + i, write);
                         entry = swp_entry_to_pte(swp_entry);
+                        if (soft_dirty)
+                                entry = pte_swp_mksoft_dirty(entry);
                 } else {
                         entry = mk_pte(page + i, vma->vm_page_prot);
                         entry = maybe_mkwrite(entry, vma);
@@ -1569,6 +1572,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
                                 entry = pte_wrprotect(entry);
                         if (!young)
                                 entry = pte_mkold(entry);
+                        if (soft_dirty)
+                                entry = pte_mksoft_dirty(entry);
                 }
                 if (dirty)
                         SetPageDirty(page + i);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 2ff0289ad061..9a6a51a7c416 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4082,24 +4082,6 @@ static void mem_cgroup_id_get_many(struct mem_cgroup *memcg, unsigned int n)
         atomic_add(n, &memcg->id.ref);
 }
 
-static struct mem_cgroup *mem_cgroup_id_get_online(struct mem_cgroup *memcg)
-{
-        while (!atomic_inc_not_zero(&memcg->id.ref)) {
-                /*
-                 * The root cgroup cannot be destroyed, so it's refcount must
-                 * always be >= 1.
-                 */
-                if (WARN_ON_ONCE(memcg == root_mem_cgroup)) {
-                        VM_BUG_ON(1);
-                        break;
-                }
-                memcg = parent_mem_cgroup(memcg);
-                if (!memcg)
-                        memcg = root_mem_cgroup;
-        }
-        return memcg;
-}
-
 static void mem_cgroup_id_put_many(struct mem_cgroup *memcg, unsigned int n)
 {
         if (atomic_sub_and_test(n, &memcg->id.ref)) {
@@ -5821,6 +5803,24 @@ static int __init mem_cgroup_init(void)
 subsys_initcall(mem_cgroup_init);
 
 #ifdef CONFIG_MEMCG_SWAP
+static struct mem_cgroup *mem_cgroup_id_get_online(struct mem_cgroup *memcg)
+{
+        while (!atomic_inc_not_zero(&memcg->id.ref)) {
+                /*
+                 * The root cgroup cannot be destroyed, so it's refcount must
+                 * always be >= 1.
+                 */
+                if (WARN_ON_ONCE(memcg == root_mem_cgroup)) {
+                        VM_BUG_ON(1);
+                        break;
+                }
+                memcg = parent_mem_cgroup(memcg);
+                if (!memcg)
+                        memcg = root_mem_cgroup;
+        }
+        return memcg;
+}
+
 /**
  * mem_cgroup_swapout - transfer a memsw charge to swap
  * @page: page whose memsw charge to transfer
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index d8c4e38fb5f4..2da72a5b6ecc 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2336,6 +2336,23 @@ out:
         return ret;
 }
 
+/*
+ * Drop the (possibly final) reference to task->mempolicy.  It needs to be
+ * dropped after task->mempolicy is set to NULL so that any allocation done as
+ * part of its kmem_cache_free(), such as by KASAN, doesn't reference a freed
+ * policy.
+ */
+void mpol_put_task_policy(struct task_struct *task)
+{
+        struct mempolicy *pol;
+
+        task_lock(task);
+        pol = task->mempolicy;
+        task->mempolicy = NULL;
+        task_unlock(task);
+        mpol_put(pol);
+}
+
 static void sp_delete(struct shared_policy *sp, struct sp_node *n)
 {
         pr_debug("deleting %lx-l%lx\n", n->start, n->end);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 3fbe73a6fe4b..a2214c64ed3c 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3137,54 +3137,6 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
         return NULL;
 }
 
-static inline bool
-should_compact_retry(struct alloc_context *ac, int order, int alloc_flags,
-                     enum compact_result compact_result,
-                     enum compact_priority *compact_priority,
-                     int compaction_retries)
-{
-        int max_retries = MAX_COMPACT_RETRIES;
-
-        if (!order)
-                return false;
-
-        /*
-         * compaction considers all the zone as desperately out of memory
-         * so it doesn't really make much sense to retry except when the
-         * failure could be caused by insufficient priority
-         */
-        if (compaction_failed(compact_result)) {
-                if (*compact_priority > MIN_COMPACT_PRIORITY) {
-                        (*compact_priority)--;
-                        return true;
-                }
-                return false;
-        }
-
-        /*
-         * make sure the compaction wasn't deferred or didn't bail out early
-         * due to locks contention before we declare that we should give up.
-         * But do not retry if the given zonelist is not suitable for
-         * compaction.
-         */
-        if (compaction_withdrawn(compact_result))
-                return compaction_zonelist_suitable(ac, order, alloc_flags);
-
-        /*
-         * !costly requests are much more important than __GFP_REPEAT
-         * costly ones because they are de facto nofail and invoke OOM
-         * killer to move on while costly can fail and users are ready
-         * to cope with that. 1/4 retries is rather arbitrary but we
-         * would need much more detailed feedback from compaction to
-         * make a better decision.
-         */
-        if (order > PAGE_ALLOC_COSTLY_ORDER)
-                max_retries /= 4;
-        if (compaction_retries <= max_retries)
-                return true;
-
-        return false;
-}
 #else
 static inline struct page *
 __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
@@ -3195,6 +3147,8 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
         return NULL;
 }
 
+#endif /* CONFIG_COMPACTION */
+
 static inline bool
 should_compact_retry(struct alloc_context *ac, unsigned int order, int alloc_flags,
                      enum compact_result compact_result,
@@ -3221,7 +3175,6 @@ should_compact_retry(struct alloc_context *ac, unsigned int order, int alloc_fla
         }
         return false;
 }
-#endif /* CONFIG_COMPACTION */
 
 /* Perform direct synchronous page reclaim */
 static int
@@ -4407,7 +4360,7 @@ static int build_zonelists_node(pg_data_t *pgdat, struct zonelist *zonelist,
         do {
                 zone_type--;
                 zone = pgdat->node_zones + zone_type;
-                if (populated_zone(zone)) {
+                if (managed_zone(zone)) {
                         zoneref_set_zone(zone,
                                 &zonelist->_zonerefs[nr_zones++]);
                         check_highest_zone(zone_type);
@@ -4645,7 +4598,7 @@ static void build_zonelists_in_zone_order(pg_data_t *pgdat, int nr_nodes)
                 for (j = 0; j < nr_nodes; j++) {
                         node = node_order[j];
                         z = &NODE_DATA(node)->node_zones[zone_type];
-                        if (populated_zone(z)) {
+                        if (managed_zone(z)) {
                                 zoneref_set_zone(z,
                                         &zonelist->_zonerefs[pos++]);
                                 check_highest_zone(zone_type);
diff --git a/mm/readahead.c b/mm/readahead.c
index 65ec288dc057..c8a955b1297e 100644
--- a/mm/readahead.c
+++ b/mm/readahead.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/dax.h>
 #include <linux/gfp.h>
 #include <linux/export.h>
 #include <linux/blkdev.h>
@@ -544,6 +545,14 @@ do_readahead(struct address_space *mapping, struct file *filp,
         if (!mapping || !mapping->a_ops)
                 return -EINVAL;
 
+        /*
+         * Readahead doesn't make sense for DAX inodes, but we don't want it
+         * to report a failure either.  Instead, we just return success and
+         * don't do any work.
+         */
+        if (dax_mapping(mapping))
+                return 0;
+
         return force_page_cache_readahead(mapping, filp, index, nr);
 }
 
diff --git a/mm/usercopy.c b/mm/usercopy.c
index 8ebae91a6b55..089328f2b920 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -83,7 +83,7 @@ static bool overlaps(const void *ptr, unsigned long n, unsigned long low,
         unsigned long check_high = check_low + n;
 
         /* Does not overlap if entirely above or entirely below. */
-        if (check_low >= high || check_high < low)
+        if (check_low >= high || check_high <= low)
                 return false;
 
         return true;
@@ -124,7 +124,7 @@ static inline const char *check_kernel_text_object(const void *ptr,
 static inline const char *check_bogus_address(const void *ptr, unsigned long n)
 {
         /* Reject if object wraps past end of memory. */
-        if (ptr + n < ptr)
+        if ((unsigned long)ptr + n < (unsigned long)ptr)
                 return "<wrapped address>";
 
         /* Reject if NULL or ZERO-allocation. */
@@ -134,31 +134,16 @@ static inline const char *check_bogus_address(const void *ptr, unsigned long n)
         return NULL;
 }
 
-static inline const char *check_heap_object(const void *ptr, unsigned long n,
-                                            bool to_user)
+/* Checks for allocs that are marked in some way as spanning multiple pages. */
+static inline const char *check_page_span(const void *ptr, unsigned long n,
+                                          struct page *page, bool to_user)
 {
-        struct page *page, *endpage;
+#ifdef CONFIG_HARDENED_USERCOPY_PAGESPAN
         const void *end = ptr + n - 1;
+        struct page *endpage;
         bool is_reserved, is_cma;
 
         /*
-         * Some architectures (arm64) return true for virt_addr_valid() on
-         * vmalloced addresses. Work around this by checking for vmalloc
-         * first.
-         */
-        if (is_vmalloc_addr(ptr))
-                return NULL;
-
-        if (!virt_addr_valid(ptr))
-                return NULL;
-
-        page = virt_to_head_page(ptr);
-
-        /* Check slab allocator for flags and size. */
-        if (PageSlab(page))
-                return __check_heap_object(ptr, n, page);
-
-        /*
          * Sometimes the kernel data regions are not marked Reserved (see
          * check below). And sometimes [_sdata,_edata) does not cover
          * rodata and/or bss, so check each range explicitly.
@@ -186,7 +171,7 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n,
                    ((unsigned long)end & (unsigned long)PAGE_MASK)))
                 return NULL;
 
-        /* Allow if start and end are inside the same compound page. */
+        /* Allow if fully inside the same compound (__GFP_COMP) page. */
         endpage = virt_to_head_page(end);
         if (likely(endpage == page))
                 return NULL;
@@ -199,20 +184,44 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n,
         is_reserved = PageReserved(page);
         is_cma = is_migrate_cma_page(page);
         if (!is_reserved && !is_cma)
-                goto reject;
+                return "<spans multiple pages>";
 
         for (ptr += PAGE_SIZE; ptr <= end; ptr += PAGE_SIZE) {
                 page = virt_to_head_page(ptr);
                 if (is_reserved && !PageReserved(page))
-                        goto reject;
+                        return "<spans Reserved and non-Reserved pages>";
                 if (is_cma && !is_migrate_cma_page(page))
-                        goto reject;
+                        return "<spans CMA and non-CMA pages>";
         }
+#endif
 
         return NULL;
+}
+
+static inline const char *check_heap_object(const void *ptr, unsigned long n,
+                                            bool to_user)
+{
+        struct page *page;
+
+        /*
+         * Some architectures (arm64) return true for virt_addr_valid() on
+         * vmalloced addresses. Work around this by checking for vmalloc
+         * first.
+         */
+        if (is_vmalloc_addr(ptr))
+                return NULL;
+
+        if (!virt_addr_valid(ptr))
+                return NULL;
+
+        page = virt_to_head_page(ptr);
+
+        /* Check slab allocator for flags and size. */
+        if (PageSlab(page))
+                return __check_heap_object(ptr, n, page);
 
-reject:
-        return "<spans multiple pages>";
+        /* Verify object does not incorrectly span multiple pages. */
+        return check_page_span(ptr, n, page, to_user);
 }
 
 /*
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 374d95d04178..b1e12a1ea9cf 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1665,7 +1665,7 @@ static bool inactive_reclaimable_pages(struct lruvec *lruvec,
 
         for (zid = sc->reclaim_idx; zid >= 0; zid--) {
                 zone = &pgdat->node_zones[zid];
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                         continue;
 
                 if (zone_page_state_snapshot(zone, NR_ZONE_LRU_BASE +
@@ -2036,7 +2036,7 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
                 struct zone *zone = &pgdat->node_zones[zid];
                 unsigned long inactive_zone, active_zone;
 
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                         continue;
 
                 inactive_zone = zone_page_state(zone,
@@ -2171,7 +2171,7 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg,
 
                 for (z = 0; z < MAX_NR_ZONES; z++) {
                         struct zone *zone = &pgdat->node_zones[z];
-                        if (!populated_zone(zone))
+                        if (!managed_zone(zone))
                                 continue;
 
                         total_high_wmark += high_wmark_pages(zone);
@@ -2510,7 +2510,7 @@ static inline bool should_continue_reclaim(struct pglist_data *pgdat,
         /* If compaction would go ahead or the allocation would succeed, stop */
         for (z = 0; z <= sc->reclaim_idx; z++) {
                 struct zone *zone = &pgdat->node_zones[z];
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                         continue;
 
                 switch (compaction_suitable(zone, sc->order, 0, sc->reclaim_idx)) {
@@ -2840,7 +2840,7 @@ static bool pfmemalloc_watermark_ok(pg_data_t *pgdat)
 
         for (i = 0; i <= ZONE_NORMAL; i++) {
                 zone = &pgdat->node_zones[i];
-                if (!populated_zone(zone) ||
+                if (!managed_zone(zone) ||
                     pgdat_reclaimable_pages(pgdat) == 0)
                         continue;
 
@@ -3141,7 +3141,7 @@ static bool prepare_kswapd_sleep(pg_data_t *pgdat, int order, int classzone_idx)
         for (i = 0; i <= classzone_idx; i++) {
                 struct zone *zone = pgdat->node_zones + i;
 
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                         continue;
 
                 if (!zone_balanced(zone, order, classzone_idx))
@@ -3169,7 +3169,7 @@ static bool kswapd_shrink_node(pg_data_t *pgdat,
         sc->nr_to_reclaim = 0;
         for (z = 0; z <= sc->reclaim_idx; z++) {
                 zone = pgdat->node_zones + z;
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                         continue;
 
                 sc->nr_to_reclaim += max(high_wmark_pages(zone), SWAP_CLUSTER_MAX);
@@ -3242,7 +3242,7 @@ static int balance_pgdat(pg_data_t *pgdat, int order, int classzone_idx)
                 if (buffer_heads_over_limit) {
                         for (i = MAX_NR_ZONES - 1; i >= 0; i--) {
                                 zone = pgdat->node_zones + i;
-                                if (!populated_zone(zone))
+                                if (!managed_zone(zone))
                                         continue;
 
                                 sc.reclaim_idx = i;
@@ -3262,7 +3262,7 @@ static int balance_pgdat(pg_data_t *pgdat, int order, int classzone_idx)
                  */
                 for (i = classzone_idx; i >= 0; i--) {
                         zone = pgdat->node_zones + i;
-                        if (!populated_zone(zone))
+                        if (!managed_zone(zone))
                                 continue;
 
                         if (zone_balanced(zone, sc.order, classzone_idx))
@@ -3508,7 +3508,7 @@ void wakeup_kswapd(struct zone *zone, int order, enum zone_type classzone_idx)
         pg_data_t *pgdat;
         int z;
 
-        if (!populated_zone(zone))
+        if (!managed_zone(zone))
                 return;
 
         if (!cpuset_zone_allowed(zone, GFP_KERNEL | __GFP_HARDWALL))
@@ -3522,7 +3522,7 @@ void wakeup_kswapd(struct zone *zone, int order, enum zone_type classzone_idx)
         /* Only wake kswapd if all zones are unbalanced */
         for (z = 0; z <= classzone_idx; z++) {
                 zone = pgdat->node_zones + z;
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                         continue;
 
                 if (zone_balanced(zone, order, classzone_idx))
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index ece45e0683fd..0b5f729d08d2 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -250,7 +250,7 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 
         skb_free_datagram(sk, skb);
 
-        if (msg->msg_flags & MSG_TRUNC)
+        if (flags & MSG_TRUNC)
                 copied = skblen;
 
         return err ? : copied;
diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
index c045b3c54768..b0e23dfc5c34 100644
--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c
@@ -262,6 +262,8 @@ int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req,
                 break;
         }
 
+        kfree_skb(hdev->req_skb);
+        hdev->req_skb = NULL;
         hdev->req_status = hdev->req_result = 0;
 
         BT_DBG("%s end: err %d", hdev->name, err);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 6ef8a01a9ad4..96f04b7b9556 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1091,7 +1091,7 @@ static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg,
 
         skb_free_datagram(sk, skb);
 
-        if (msg->msg_flags & MSG_TRUNC)
+        if (flags & MSG_TRUNC)
                 copied = skblen;
 
         return err ? : copied;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 54ceb1f2cc9a..d4cad29b033f 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -32,6 +32,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/crc16.h>
+#include <linux/filter.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -5835,6 +5836,9 @@ static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
                 if (chan->sdu)
                         break;
 
+                if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
+                        break;
+
                 chan->sdu_len = get_unaligned_le16(skb->data);
                 skb_pull(skb, L2CAP_SDULEN_SIZE);
 
@@ -6610,6 +6614,10 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
                 goto drop;
         }
 
+        if ((chan->mode == L2CAP_MODE_ERTM ||
+             chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
+                goto drop;
+
         if (!control->sframe) {
                 int err;
 
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 1842141baedb..a8ba752732c9 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1019,7 +1019,7 @@ static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
                 goto done;
 
         if (pi->rx_busy_skb) {
-                if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
+                if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
                         pi->rx_busy_skb = NULL;
                 else
                         goto done;
@@ -1270,7 +1270,17 @@ static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
                 goto done;
         }
 
-        err = sock_queue_rcv_skb(sk, skb);
+        if (chan->mode != L2CAP_MODE_ERTM &&
+            chan->mode != L2CAP_MODE_STREAMING) {
+                /* Even if no filter is attached, we could potentially
+                 * get errors from security modules, etc.
+                 */
+                err = sk_filter(sk, skb);
+                if (err)
+                        goto done;
+        }
+
+        err = __sock_queue_rcv_skb(sk, skb);
 
         /* For ERTM, handle one skb that doesn't fit into the recv
          * buffer.  This is important to do because the data frames
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 8e486203d133..abe11f085479 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -80,13 +80,10 @@ static void br_do_proxy_arp(struct sk_buff *skb, struct net_bridge *br,
 
         BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
 
-        if (dev->flags & IFF_NOARP)
+        if ((dev->flags & IFF_NOARP) ||
+            !pskb_may_pull(skb, arp_hdr_len(dev)))
                 return;
 
-        if (!pskb_may_pull(skb, arp_hdr_len(dev))) {
-                dev->stats.tx_dropped++;
-                return;
-        }
         parp = arp_hdr(skb);
 
         if (parp->ar_pro != htons(ETH_P_IP) ||
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index a5423a1eec05..c5fea9393946 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1138,7 +1138,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
                 } else {
                         err = br_ip6_multicast_add_group(br, port,
                                                          &grec->grec_mca, vid);
-                        if (!err)
+                        if (err)
                                 break;
                 }
         }
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index cceac5bb658f..0833c251aef7 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -368,6 +368,8 @@ ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 
         match = xt_find_match(NFPROTO_BRIDGE, m->u.name, 0);
         if (IS_ERR(match) || match->family != NFPROTO_BRIDGE) {
+                if (!IS_ERR(match))
+                        module_put(match->me);
                 request_module("ebt_%s", m->u.name);
                 match = xt_find_match(NFPROTO_BRIDGE, m->u.name, 0);
         }
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
index 4b901d9f2e7c..ad47a921b701 100644
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -86,6 +86,7 @@ static const struct nft_expr_ops nft_meta_bridge_set_ops = {
         .init           = nft_meta_set_init,
         .destroy        = nft_meta_set_destroy,
         .dump           = nft_meta_set_dump,
+        .validate       = nft_meta_set_validate,
 };
 
 static const struct nft_expr_ops *
diff --git a/net/core/dev.c b/net/core/dev.c
index dd6ce598de89..ea6312057a71 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3975,6 +3975,22 @@ sch_handle_ingress(struct sk_buff *skb, struct packet_type **pt_prev, int *ret,
 }
 
 /**
+ *      netdev_is_rx_handler_busy - check if receive handler is registered
+ *      @dev: device to check
+ *
+ *      Check if a receive handler is already registered for a given device.
+ *      Return true if there one.
+ *
+ *      The caller must hold the rtnl_mutex.
+ */
+bool netdev_is_rx_handler_busy(struct net_device *dev)
+{
+        ASSERT_RTNL();
+        return dev && rtnl_dereference(dev->rx_handler);
+}
+EXPORT_SYMBOL_GPL(netdev_is_rx_handler_busy);
+
+/**
  *      netdev_rx_handler_register - register receive handler
  *      @dev: device to register a handler for
  *      @rx_handler: receive handler to register
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 61ad43f61c5e..52742a02814f 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -680,11 +680,13 @@ EXPORT_SYMBOL_GPL(__skb_get_hash_symmetric);
 void __skb_get_hash(struct sk_buff *skb)
 {
         struct flow_keys keys;
+        u32 hash;
 
         __flow_hash_secret_init();
 
-        __skb_set_sw_hash(skb, ___skb_get_hash(skb, &keys, hashrnd),
-                          flow_keys_have_l4(&keys));
+        hash = ___skb_get_hash(skb, &keys, hashrnd);
+
+        __skb_set_sw_hash(skb, hash, flow_keys_have_l4(&keys));
 }
 EXPORT_SYMBOL(__skb_get_hash);
 
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 415e117967c7..062a67ca9a21 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -2232,7 +2232,7 @@ static struct devinet_sysctl_table {
 };
 
 static int __devinet_sysctl_register(struct net *net, char *dev_name,
-                                        struct ipv4_devconf *p)
+                                     int ifindex, struct ipv4_devconf *p)
 {
         int i;
         struct devinet_sysctl_table *t;
@@ -2255,6 +2255,8 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name,
                 goto free;
 
         p->sysctl = t;
+
+        inet_netconf_notify_devconf(net, NETCONFA_ALL, ifindex, p);
         return 0;
 
 free:
@@ -2286,7 +2288,7 @@ static int devinet_sysctl_register(struct in_device *idev)
         if (err)
                 return err;
         err = __devinet_sysctl_register(dev_net(idev->dev), idev->dev->name,
-                                        &idev->cnf);
+                                        idev->dev->ifindex, &idev->cnf);
         if (err)
                 neigh_sysctl_unregister(idev->arp_parms);
         return err;
@@ -2347,11 +2349,12 @@ static __net_init int devinet_init_net(struct net *net)
         }
 
 #ifdef CONFIG_SYSCTL
-        err = __devinet_sysctl_register(net, "all", all);
+        err = __devinet_sysctl_register(net, "all", NETCONFA_IFINDEX_ALL, all);
         if (err < 0)
                 goto err_reg_all;
 
-        err = __devinet_sysctl_register(net, "default", dflt);
+        err = __devinet_sysctl_register(net, "default",
+                                        NETCONFA_IFINDEX_DEFAULT, dflt);
         if (err < 0)
                 goto err_reg_dflt;
 
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index ef2ebeb89d0f..1b25daf8c7f1 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -509,6 +509,7 @@ static int rtentry_to_fib_config(struct net *net, int cmd, struct rtentry *rt,
                 if (!dev)
                         return -ENODEV;
                 cfg->fc_oif = dev->ifindex;
+                cfg->fc_table = l3mdev_fib_table(dev);
                 if (colon) {
                         struct in_ifaddr *ifa;
                         struct in_device *in_dev = __in_dev_get_rtnl(dev);
@@ -1027,7 +1028,7 @@ no_promotions:
                          * First of all, we scan fib_info list searching
                          * for stray nexthop entries, then ignite fib_flush.
                          */
-                        if (fib_sync_down_addr(dev_net(dev), ifa->ifa_local))
+                        if (fib_sync_down_addr(dev, ifa->ifa_local))
                                 fib_flush(dev_net(dev));
                 }
         }
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 539fa264e67d..e9f56225e53f 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1057,6 +1057,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
         fi->fib_priority = cfg->fc_priority;
         fi->fib_prefsrc = cfg->fc_prefsrc;
         fi->fib_type = cfg->fc_type;
+        fi->fib_tb_id = cfg->fc_table;
 
         fi->fib_nhs = nhs;
         change_nexthops(fi) {
@@ -1337,18 +1338,21 @@ nla_put_failure:
  *   referring to it.
  * - device went down -> we must shutdown all nexthops going via it.
  */
-int fib_sync_down_addr(struct net *net, __be32 local)
+int fib_sync_down_addr(struct net_device *dev, __be32 local)
 {
         int ret = 0;
         unsigned int hash = fib_laddr_hashfn(local);
         struct hlist_head *head = &fib_info_laddrhash[hash];
+        struct net *net = dev_net(dev);
+        int tb_id = l3mdev_fib_table(dev);
         struct fib_info *fi;
 
         if (!fib_info_laddrhash || local == 0)
                 return 0;
 
         hlist_for_each_entry(fi, head, fib_lhash) {
-                if (!net_eq(fi->fib_net, net))
+                if (!net_eq(fi->fib_net, net) ||
+                    fi->fib_tb_id != tb_id)
                         continue;
                 if (fi->fib_prefsrc == local) {
                         fi->fib_flags |= RTNH_F_DEAD;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index febca0f1008c..e2ffc2a5c7db 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -249,7 +249,7 @@ static inline unsigned long get_index(t_key key, struct key_vector *kv)
  * index into the parent's child array. That is, they will be used to find
  * 'n' among tp's children.
  *
- * The bits from (n->pos + n->bits) to (tn->pos - 1) - "S" - are skipped bits
+ * The bits from (n->pos + n->bits) to (tp->pos - 1) - "S" - are skipped bits
  * for the node n.
  *
  * All the bits we have seen so far are significant to the node n. The rest
@@ -258,7 +258,7 @@ static inline unsigned long get_index(t_key key, struct key_vector *kv)
  * The bits from (n->pos) to (n->pos + n->bits - 1) - "C" - are the index into
  * n's child array, and will of course be different for each child.
  *
- * The rest of the bits, from 0 to (n->pos + n->bits), are completely unknown
+ * The rest of the bits, from 0 to (n->pos -1) - "u" - are completely unknown
  * at this point.
  */
 
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 9d847c302551..0f227db0e9ac 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -73,9 +73,11 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
         skb_dst_set(skb, &rt->dst);
         memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 
-        if (skb_iif && proto == IPPROTO_UDP) {
-                /* Arrived from an ingress interface and got udp encapuslated.
-                 * The encapsulated network segment length may exceed dst mtu.
+        if (skb_iif && !(df & htons(IP_DF))) {
+                /* Arrived from an ingress interface, got encapsulated, with
+                 * fragmentation of encapulating frames allowed.
+                 * If skb is gso, the resulting encapsulated network segments
+                 * may exceed dst mtu.
                  * Allow IP Fragmentation of segments.
                  */
                 IPCB(skb)->flags |= IPSKB_FRAG_SEGS;
diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
index c24f41c816b3..2c2553b9026c 100644
--- a/net/ipv4/netfilter/nft_reject_ipv4.c
+++ b/net/ipv4/netfilter/nft_reject_ipv4.c
@@ -46,6 +46,7 @@ static const struct nft_expr_ops nft_reject_ipv4_ops = {
         .eval           = nft_reject_ipv4_eval,
         .init           = nft_reject_init,
         .dump           = nft_reject_dump,
+        .validate       = nft_reject_validate,
 };
 
 static struct nft_expr_type nft_reject_ipv4_type __read_mostly = {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 032a96d78c99..ffbb218de520 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3193,7 +3193,6 @@ int tcp_abort(struct sock *sk, int err)
                         local_bh_enable();
                         return 0;
                 }
-                sock_gen_put(sk);
                 return -EOPNOTSUPP;
         }
 
@@ -3222,7 +3221,6 @@ int tcp_abort(struct sock *sk, int err)
         bh_unlock_sock(sk);
         local_bh_enable();
         release_sock(sk);
-        sock_put(sk);
         return 0;
 }
 EXPORT_SYMBOL_GPL(tcp_abort);
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index 4d610934fb39..a748c74aa8b7 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -54,11 +54,16 @@ static int tcp_diag_destroy(struct sk_buff *in_skb,
 {
         struct net *net = sock_net(in_skb->sk);
         struct sock *sk = inet_diag_find_one_icsk(net, &tcp_hashinfo, req);
+        int err;
 
         if (IS_ERR(sk))
                 return PTR_ERR(sk);
 
-        return sock_diag_destroy(sk, ECONNABORTED);
+        err = sock_diag_destroy(sk, ECONNABORTED);
+
+        sock_gen_put(sk);
+
+        return err;
 }
 #endif
 
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 54d9f9b0120f..4e777a3243f9 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -150,6 +150,7 @@ void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb)
         tp->segs_in = 0;
         tcp_segs_in(tp, skb);
         __skb_pull(skb, tcp_hdrlen(skb));
+        sk_forced_mem_schedule(sk, skb->truesize);
         skb_set_owner_r(skb, sk);
 
         TCP_SKB_CB(skb)->seq++;
@@ -226,6 +227,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
         tcp_fastopen_add_skb(child, skb);
 
         tcp_rsk(req)->rcv_nxt = tp->rcv_nxt;
+        tp->rcv_wup = tp->rcv_nxt;
         /* tcp_conn_request() is sending the SYNACK,
          * and queues the child into listener accept queue.
          */
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 32b048e524d6..7158d4f8dae4 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -814,8 +814,14 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
         u32 seq = (sk->sk_state == TCP_LISTEN) ? tcp_rsk(req)->snt_isn + 1 :
                                              tcp_sk(sk)->snd_nxt;
 
+        /* RFC 7323 2.3
+         * The window field (SEG.WND) of every outgoing segment, with the
+         * exception of <SYN> segments, MUST be right-shifted by
+         * Rcv.Wind.Shift bits:
+         */
         tcp_v4_send_ack(sock_net(sk), skb, seq,
-                        tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
+                        tcp_rsk(req)->rcv_nxt,
+                        req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
                         tcp_time_stamp,
                         req->ts_recent,
                         0,
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index 028eb046ea40..9c5fc973267f 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -76,7 +76,7 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 acked)
         if (!tcp_is_cwnd_limited(sk))
                 return;
 
-        if (tp->snd_cwnd <= tp->snd_ssthresh)
+        if (tcp_in_slow_start(tp))
                 tcp_slow_start(tp, acked);
 
         else if (!yeah->doing_reno_now) {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index e61f7cd65d08..5fdcb8d108d4 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1182,13 +1182,13 @@ out:
  *      @sk: socket
  *
  *      Drops all bad checksum frames, until a valid one is found.
- *      Returns the length of found skb, or 0 if none is found.
+ *      Returns the length of found skb, or -1 if none is found.
  */
-static unsigned int first_packet_length(struct sock *sk)
+static int first_packet_length(struct sock *sk)
 {
         struct sk_buff_head list_kill, *rcvq = &sk->sk_receive_queue;
         struct sk_buff *skb;
-        unsigned int res;
+        int res;
 
         __skb_queue_head_init(&list_kill);
 
@@ -1203,7 +1203,7 @@ static unsigned int first_packet_length(struct sock *sk)
                 __skb_unlink(skb, rcvq);
                 __skb_queue_tail(&list_kill, skb);
         }
-        res = skb ? skb->len : 0;
+        res = skb ? skb->len : -1;
         spin_unlock_bh(&rcvq->lock);
 
         if (!skb_queue_empty(&list_kill)) {
@@ -1232,7 +1232,7 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 
         case SIOCINQ:
         {
-                unsigned int amount = first_packet_length(sk);
+                int amount = max_t(int, 0, first_packet_length(sk));
 
                 return put_user(amount, (int __user *)arg);
         }
@@ -2184,7 +2184,7 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
 
         /* Check for false positives due to checksum errors */
         if ((mask & POLLRDNORM) && !(file->f_flags & O_NONBLOCK) &&
-            !(sk->sk_shutdown & RCV_SHUTDOWN) && !first_packet_length(sk))
+            !(sk->sk_shutdown & RCV_SHUTDOWN) && first_packet_length(sk) == -1)
                 mask &= ~(POLLIN | POLLRDNORM);
 
         return mask;
@@ -2216,7 +2216,6 @@ struct proto udp_prot = {
         .sysctl_wmem       = &sysctl_udp_wmem_min,
         .sysctl_rmem       = &sysctl_udp_rmem_min,
         .obj_size          = sizeof(struct udp_sock),
-        .slab_flags        = SLAB_DESTROY_BY_RCU,
         .h.udp_table       = &udp_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udp_setsockopt,
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index 3b3efbda48e1..2eea073e27ef 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -55,7 +55,6 @@ struct proto 	udplite_prot = {
         .unhash            = udp_lib_unhash,
         .get_port          = udp_v4_get_port,
         .obj_size          = sizeof(struct udp_sock),
-        .slab_flags        = SLAB_DESTROY_BY_RCU,
         .h.udp_table       = &udplite_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udp_setsockopt,
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index b644a23c3db0..41f5b504a782 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -29,7 +29,7 @@ static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4,
         memset(fl4, 0, sizeof(*fl4));
         fl4->daddr = daddr->a4;
         fl4->flowi4_tos = tos;
-        fl4->flowi4_oif = oif;
+        fl4->flowi4_oif = l3mdev_master_ifindex_by_index(net, oif);
         if (saddr)
                 fl4->saddr = saddr->a4;
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index df8425fcbc2c..2f1f5d439788 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -778,7 +778,14 @@ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
         }
 
         if (p == &net->ipv6.devconf_all->forwarding) {
+                int old_dflt = net->ipv6.devconf_dflt->forwarding;
+
                 net->ipv6.devconf_dflt->forwarding = newf;
+                if ((!newf) ^ (!old_dflt))
+                        inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
+                                                     NETCONFA_IFINDEX_DEFAULT,
+                                                     net->ipv6.devconf_dflt);
+
                 addrconf_forward_change(net, newf);
                 if ((!newf) ^ (!old))
                         inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
@@ -1872,7 +1879,6 @@ static int addrconf_dad_end(struct inet6_ifaddr *ifp)
 
 void addrconf_dad_failure(struct inet6_ifaddr *ifp)
 {
-        struct in6_addr addr;
         struct inet6_dev *idev = ifp->idev;
         struct net *net = dev_net(ifp->idev->dev);
 
@@ -1934,18 +1940,6 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
                 in6_ifa_put(ifp2);
 lock_errdad:
                 spin_lock_bh(&ifp->lock);
-        } else if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6) {
-                addr.s6_addr32[0] = htonl(0xfe800000);
-                addr.s6_addr32[1] = 0;
-
-                if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
-                    ipv6_addr_equal(&ifp->addr, &addr)) {
-                        /* DAD failed for link-local based on MAC address */
-                        idev->cnf.disable_ipv6 = 1;
-
-                        pr_info("%s: IPv6 being disabled!\n",
-                                ifp->idev->dev->name);
-                }
         }
 
 errdad:
@@ -1954,6 +1948,7 @@ errdad:
         spin_unlock_bh(&ifp->lock);
 
         addrconf_mod_dad_work(ifp, 0);
+        in6_ifa_put(ifp);
 }
 
 /* Join to solicited addr multicast group.
@@ -3821,6 +3816,7 @@ static void addrconf_dad_work(struct work_struct *w)
                                                 dad_work);
         struct inet6_dev *idev = ifp->idev;
         struct in6_addr mcaddr;
+        bool disable_ipv6 = false;
 
         enum {
                 DAD_PROCESS,
@@ -3837,6 +3833,24 @@ static void addrconf_dad_work(struct work_struct *w)
         } else if (ifp->state == INET6_IFADDR_STATE_ERRDAD) {
                 action = DAD_ABORT;
                 ifp->state = INET6_IFADDR_STATE_POSTDAD;
+
+                if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6 &&
+                    !(ifp->flags & IFA_F_STABLE_PRIVACY)) {
+                        struct in6_addr addr;
+
+                        addr.s6_addr32[0] = htonl(0xfe800000);
+                        addr.s6_addr32[1] = 0;
+
+                        if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
+                            ipv6_addr_equal(&ifp->addr, &addr)) {
+                                /* DAD failed for link-local based on MAC */
+                                idev->cnf.disable_ipv6 = 1;
+
+                                pr_info("%s: IPv6 being disabled!\n",
+                                        ifp->idev->dev->name);
+                                disable_ipv6 = true;
+                        }
+                }
         }
         spin_unlock_bh(&ifp->lock);
 
@@ -3844,7 +3858,10 @@ static void addrconf_dad_work(struct work_struct *w)
                 addrconf_dad_begin(ifp);
                 goto out;
         } else if (action == DAD_ABORT) {
+                in6_ifa_hold(ifp);
                 addrconf_dad_stop(ifp, 1);
+                if (disable_ipv6)
+                        addrconf_ifdown(idev->dev, 0);
                 goto out;
         }
 
@@ -6017,7 +6034,7 @@ static const struct ctl_table addrconf_sysctl[] = {
 static int __addrconf_sysctl_register(struct net *net, char *dev_name,
                 struct inet6_dev *idev, struct ipv6_devconf *p)
 {
-        int i;
+        int i, ifindex;
         struct ctl_table *table;
         char path[sizeof("net/ipv6/conf/") + IFNAMSIZ];
 
@@ -6037,6 +6054,13 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
         if (!p->sysctl_header)
                 goto free;
 
+        if (!strcmp(dev_name, "all"))
+                ifindex = NETCONFA_IFINDEX_ALL;
+        else if (!strcmp(dev_name, "default"))
+                ifindex = NETCONFA_IFINDEX_DEFAULT;
+        else
+                ifindex = idev->dev->ifindex;
+        inet6_netconf_notify_devconf(net, NETCONFA_ALL, ifindex, p);
         return 0;
 
 free:
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 7b0481e3738f..888543debe4e 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1174,6 +1174,7 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 encap_limit = t->parms.encap_limit;
 
         memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_IPIP;
 
         dsfield = ipv4_get_dsfield(iph);
 
@@ -1233,6 +1234,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 encap_limit = t->parms.encap_limit;
 
         memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_IPV6;
 
         dsfield = ipv6_get_dsfield(ipv6h);
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
diff --git a/net/ipv6/netfilter/nft_reject_ipv6.c b/net/ipv6/netfilter/nft_reject_ipv6.c
index 533cd5719c59..92bda9908bb9 100644
--- a/net/ipv6/netfilter/nft_reject_ipv6.c
+++ b/net/ipv6/netfilter/nft_reject_ipv6.c
@@ -47,6 +47,7 @@ static const struct nft_expr_ops nft_reject_ipv6_ops = {
         .eval           = nft_reject_ipv6_eval,
         .init           = nft_reject_init,
         .dump           = nft_reject_dump,
+        .validate       = nft_reject_validate,
 };
 
 static struct nft_expr_type nft_reject_ipv6_type __read_mostly = {
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 0900352c924c..0e983b694ee8 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -126,8 +126,10 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         rt = (struct rt6_info *) dst;
 
         np = inet6_sk(sk);
-        if (!np)
-                return -EBADF;
+        if (!np) {
+                err = -EBADF;
+                goto dst_err_out;
+        }
 
         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
                 fl6.flowi6_oif = np->mcast_oif;
@@ -163,6 +165,9 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         }
         release_sock(sk);
 
+dst_err_out:
+        dst_release(dst);
+
         if (err)
                 return err;
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 33df8b8575cc..94f4f89d73e7 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -944,9 +944,15 @@ static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
          */
+        /* RFC 7323 2.3
+         * The window field (SEG.WND) of every outgoing segment, with the
+         * exception of <SYN> segments, MUST be right-shifted by
+         * Rcv.Wind.Shift bits:
+         */
         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
-                        tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
+                        tcp_rsk(req)->rcv_nxt,
+                        req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
                         tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
                         0, 0);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 81e2f98b958d..19ac3a1c308d 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1460,7 +1460,6 @@ struct proto udpv6_prot = {
         .sysctl_wmem       = &sysctl_udp_wmem_min,
         .sysctl_rmem       = &sysctl_udp_rmem_min,
         .obj_size          = sizeof(struct udp6_sock),
-        .slab_flags        = SLAB_DESTROY_BY_RCU,
         .h.udp_table       = &udp_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udpv6_setsockopt,
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 9cf097e206e9..fd6ef414899b 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -50,7 +50,6 @@ struct proto udplitev6_prot = {
         .unhash            = udp_lib_unhash,
         .get_port          = udp_v6_get_port,
         .obj_size          = sizeof(struct udp6_sock),
-        .slab_flags        = SLAB_DESTROY_BY_RCU,
         .h.udp_table       = &udplite_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udpv6_setsockopt,
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 0eaab1fa6be5..00a2d40677d6 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -23,6 +23,7 @@ int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb)
 
 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
 {
+        XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
         XFRM_SPI_SKB_CB(skb)->family = AF_INET6;
         XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
         return xfrm_input(skb, nexthdr, spi, 0);
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 6cc97003e4a9..70a86adad875 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -36,7 +36,7 @@ static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif,
         int err;
 
         memset(&fl6, 0, sizeof(fl6));
-        fl6.flowi6_oif = oif;
+        fl6.flowi6_oif = l3mdev_master_ifindex_by_index(net, oif);
         fl6.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF;
         memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));
         if (saddr)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index cb39e05b166c..411693288648 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -13,6 +13,7 @@
 #include <linux/socket.h>
 #include <linux/uaccess.h>
 #include <linux/workqueue.h>
+#include <linux/syscalls.h>
 #include <net/kcm.h>
 #include <net/netns/generic.h>
 #include <net/sock.h>
@@ -2029,7 +2030,7 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         if (copy_to_user((void __user *)arg, &info,
                                          sizeof(info))) {
                                 err = -EFAULT;
-                                sock_release(newsock);
+                                sys_close(info.fd);
                         }
                 }
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 1e40dacaa137..a2ed3bda4ddc 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1855,6 +1855,9 @@ static __net_exit void l2tp_exit_net(struct net *net)
                 (void)l2tp_tunnel_delete(tunnel);
         }
         rcu_read_unlock_bh();
+
+        flush_workqueue(l2tp_wq);
+        rcu_barrier();
 }
 
 static struct pernet_operations l2tp_net_ops = {
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index d9560aa2dba3..232cb92033e8 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -856,7 +856,7 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
         error = -ENOTCONN;
         if (sk == NULL)
                 goto end;
-        if (sk->sk_state != PPPOX_CONNECTED)
+        if (!(sk->sk_state & PPPOX_CONNECTED))
                 goto end;
 
         error = -EBADF;
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index b5d28f14b9cf..afca7d103684 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -333,10 +333,11 @@ ieee80211_tdls_chandef_vht_upgrade(struct ieee80211_sub_if_data *sdata,
         if (!uc.center_freq1)
                 return;
 
-        /* proceed to downgrade the chandef until usable or the same */
+        /* proceed to downgrade the chandef until usable or the same as AP BW */
         while (uc.width > max_width ||
-               !cfg80211_reg_can_beacon_relax(sdata->local->hw.wiphy, &uc,
-                                              sdata->wdev.iftype))
+               (uc.width > sta->tdls_chandef.width &&
+                !cfg80211_reg_can_beacon_relax(sdata->local->hw.wiphy, &uc,
+                                               sdata->wdev.iftype)))
                 ieee80211_chandef_downgrade(&uc);
 
         if (!cfg80211_chandef_identical(&uc, &sta->tdls_chandef)) {
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 958a1455ca7f..9f267c3ffb39 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -205,6 +205,7 @@ static int ct_seq_show(struct seq_file *s, void *v)
         struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
         const struct nf_conntrack_l3proto *l3proto;
         const struct nf_conntrack_l4proto *l4proto;
+        struct net *net = seq_file_net(s);
         int ret = 0;
 
         NF_CT_ASSERT(ct);
@@ -215,6 +216,9 @@ static int ct_seq_show(struct seq_file *s, void *v)
         if (NF_CT_DIRECTION(hash))
                 goto release;
 
+        if (!net_eq(nf_ct_net(ct), net))
+                goto release;
+
         l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
         NF_CT_ASSERT(l3proto);
         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
diff --git a/net/netfilter/nf_tables_netdev.c b/net/netfilter/nf_tables_netdev.c
index 5eefe4a355c6..75d696f11045 100644
--- a/net/netfilter/nf_tables_netdev.c
+++ b/net/netfilter/nf_tables_netdev.c
@@ -30,7 +30,6 @@ nft_netdev_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
         if (!iph)
                 return;
 
-        iph = ip_hdr(skb);
         if (iph->ihl < 5 || iph->version != 4)
                 return;
 
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 1b4de4bd6958..d44d89b56127 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -326,14 +326,14 @@ static int nfnl_acct_try_del(struct nf_acct *cur)
 {
         int ret = 0;
 
-        /* we want to avoid races with nfnl_acct_find_get. */
-        if (atomic_dec_and_test(&cur->refcnt)) {
+        /* We want to avoid races with nfnl_acct_put. So only when the current
+         * refcnt is 1, we decrease it to 0.
+         */
+        if (atomic_cmpxchg(&cur->refcnt, 1, 0) == 1) {
                 /* We are protected by nfnl mutex. */
                 list_del_rcu(&cur->head);
                 kfree_rcu(cur, rcu_head);
         } else {
-                /* still in use, restore reference counter. */
-                atomic_inc(&cur->refcnt);
                 ret = -EBUSY;
         }
         return ret;
@@ -343,12 +343,12 @@ static int nfnl_acct_del(struct net *net, struct sock *nfnl,
                          struct sk_buff *skb, const struct nlmsghdr *nlh,
                          const struct nlattr * const tb[])
 {
-        char *acct_name;
-        struct nf_acct *cur;
+        struct nf_acct *cur, *tmp;
         int ret = -ENOENT;
+        char *acct_name;
 
         if (!tb[NFACCT_NAME]) {
-                list_for_each_entry(cur, &net->nfnl_acct_list, head)
+                list_for_each_entry_safe(cur, tmp, &net->nfnl_acct_list, head)
                         nfnl_acct_try_del(cur);
 
                 return 0;
@@ -443,7 +443,7 @@ void nfnl_acct_update(const struct sk_buff *skb, struct nf_acct *nfacct)
 }
 EXPORT_SYMBOL_GPL(nfnl_acct_update);
 
-static void nfnl_overquota_report(struct nf_acct *nfacct)
+static void nfnl_overquota_report(struct net *net, struct nf_acct *nfacct)
 {
         int ret;
         struct sk_buff *skb;
@@ -458,11 +458,12 @@ static void nfnl_overquota_report(struct nf_acct *nfacct)
                 kfree_skb(skb);
                 return;
         }
-        netlink_broadcast(init_net.nfnl, skb, 0, NFNLGRP_ACCT_QUOTA,
+        netlink_broadcast(net->nfnl, skb, 0, NFNLGRP_ACCT_QUOTA,
                           GFP_ATOMIC);
 }
 
-int nfnl_acct_overquota(const struct sk_buff *skb, struct nf_acct *nfacct)
+int nfnl_acct_overquota(struct net *net, const struct sk_buff *skb,
+                        struct nf_acct *nfacct)
 {
         u64 now;
         u64 *quota;
@@ -480,7 +481,7 @@ int nfnl_acct_overquota(const struct sk_buff *skb, struct nf_acct *nfacct)
 
         if (now >= *quota &&
             !test_and_set_bit(NFACCT_OVERQUOTA_BIT, &nfacct->flags)) {
-                nfnl_overquota_report(nfacct);
+                nfnl_overquota_report(net, nfacct);
         }
 
         return ret;
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 4cdcd969b64c..139e0867e56e 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -98,31 +98,28 @@ static int cttimeout_new_timeout(struct net *net, struct sock *ctnl,
                 break;
         }
 
-        l4proto = nf_ct_l4proto_find_get(l3num, l4num);
-
-        /* This protocol is not supportted, skip. */
-        if (l4proto->l4proto != l4num) {
-                ret = -EOPNOTSUPP;
-                goto err_proto_put;
-        }
-
         if (matching) {
                 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
                         /* You cannot replace one timeout policy by another of
                          * different kind, sorry.
                          */
                         if (matching->l3num != l3num ||
-                            matching->l4proto->l4proto != l4num) {
-                                ret = -EINVAL;
-                                goto err_proto_put;
-                        }
-
-                        ret = ctnl_timeout_parse_policy(&matching->data,
-                                                        l4proto, net,
-                                                        cda[CTA_TIMEOUT_DATA]);
-                        return ret;
+                            matching->l4proto->l4proto != l4num)
+                                return -EINVAL;
+
+                        return ctnl_timeout_parse_policy(&matching->data,
+                                                         matching->l4proto, net,
+                                                         cda[CTA_TIMEOUT_DATA]);
                 }
-                ret = -EBUSY;
+
+                return -EBUSY;
+        }
+
+        l4proto = nf_ct_l4proto_find_get(l3num, l4num);
+
+        /* This protocol is not supportted, skip. */
+        if (l4proto->l4proto != l4num) {
+                ret = -EOPNOTSUPP;
                 goto err_proto_put;
         }
 
@@ -305,7 +302,16 @@ static void ctnl_untimeout(struct net *net, struct ctnl_timeout *timeout)
         const struct hlist_nulls_node *nn;
         unsigned int last_hsize;
         spinlock_t *lock;
-        int i;
+        int i, cpu;
+
+        for_each_possible_cpu(cpu) {
+                struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
+
+                spin_lock_bh(&pcpu->lock);
+                hlist_nulls_for_each_entry(h, nn, &pcpu->unconfirmed, hnnode)
+                        untimeout(h, timeout);
+                spin_unlock_bh(&pcpu->lock);
+        }
 
         local_bh_disable();
 restart:
@@ -330,16 +336,16 @@ static int ctnl_timeout_try_del(struct net *net, struct ctnl_timeout *timeout)
 {
         int ret = 0;
 
-        /* we want to avoid races with nf_ct_timeout_find_get. */
-        if (atomic_dec_and_test(&timeout->refcnt)) {
+        /* We want to avoid races with ctnl_timeout_put. So only when the
+         * current refcnt is 1, we decrease it to 0.
+         */
+        if (atomic_cmpxchg(&timeout->refcnt, 1, 0) == 1) {
                 /* We are protected by nfnl mutex. */
                 list_del_rcu(&timeout->head);
                 nf_ct_l4proto_put(timeout->l4proto);
                 ctnl_untimeout(net, timeout);
                 kfree_rcu(timeout, rcu_head);
         } else {
-                /* still in use, restore reference counter. */
-                atomic_inc(&timeout->refcnt);
                 ret = -EBUSY;
         }
         return ret;
@@ -350,12 +356,13 @@ static int cttimeout_del_timeout(struct net *net, struct sock *ctnl,
                                  const struct nlmsghdr *nlh,
                                  const struct nlattr * const cda[])
 {
-        struct ctnl_timeout *cur;
+        struct ctnl_timeout *cur, *tmp;
         int ret = -ENOENT;
         char *name;
 
         if (!cda[CTA_TIMEOUT_NAME]) {
-                list_for_each_entry(cur, &net->nfct_timeout_list, head)
+                list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list,
+                                         head)
                         ctnl_timeout_try_del(net, cur);
 
                 return 0;
@@ -543,7 +550,9 @@ err:
 
 static void ctnl_timeout_put(struct ctnl_timeout *timeout)
 {
-        atomic_dec(&timeout->refcnt);
+        if (atomic_dec_and_test(&timeout->refcnt))
+                kfree_rcu(timeout, rcu_head);
+
         module_put(THIS_MODULE);
 }
 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
@@ -591,7 +600,9 @@ static void __net_exit cttimeout_net_exit(struct net *net)
         list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list, head) {
                 list_del_rcu(&cur->head);
                 nf_ct_l4proto_put(cur->l4proto);
-                kfree_rcu(cur, rcu_head);
+
+                if (atomic_dec_and_test(&cur->refcnt))
+                        kfree_rcu(cur, rcu_head);
         }
 }
 
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index cbcfdfb586a6..6577db524ef6 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -1147,6 +1147,7 @@ MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ULOG);
 MODULE_ALIAS_NF_LOGGER(AF_INET, 1);
 MODULE_ALIAS_NF_LOGGER(AF_INET6, 1);
 MODULE_ALIAS_NF_LOGGER(AF_BRIDGE, 1);
+MODULE_ALIAS_NF_LOGGER(3, 1); /* NFPROTO_ARP */
 
 module_init(nfnetlink_log_init);
 module_exit(nfnetlink_log_fini);
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 2863f3493038..8a6bc7630912 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -291,10 +291,16 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
 }
 EXPORT_SYMBOL_GPL(nft_meta_get_init);
 
-static int nft_meta_set_init_pkttype(const struct nft_ctx *ctx)
+int nft_meta_set_validate(const struct nft_ctx *ctx,
+                          const struct nft_expr *expr,
+                          const struct nft_data **data)
 {
+        struct nft_meta *priv = nft_expr_priv(expr);
         unsigned int hooks;
 
+        if (priv->key != NFT_META_PKTTYPE)
+                return 0;
+
         switch (ctx->afi->family) {
         case NFPROTO_BRIDGE:
                 hooks = 1 << NF_BR_PRE_ROUTING;
@@ -308,6 +314,7 @@ static int nft_meta_set_init_pkttype(const struct nft_ctx *ctx)
 
         return nft_chain_validate_hooks(ctx->chain, hooks);
 }
+EXPORT_SYMBOL_GPL(nft_meta_set_validate);
 
 int nft_meta_set_init(const struct nft_ctx *ctx,
                       const struct nft_expr *expr,
@@ -327,15 +334,16 @@ int nft_meta_set_init(const struct nft_ctx *ctx,
                 len = sizeof(u8);
                 break;
         case NFT_META_PKTTYPE:
-                err = nft_meta_set_init_pkttype(ctx);
-                if (err)
-                        return err;
                 len = sizeof(u8);
                 break;
         default:
                 return -EOPNOTSUPP;
         }
 
+        err = nft_meta_set_validate(ctx, expr, NULL);
+        if (err < 0)
+                return err;
+
         priv->sreg = nft_parse_register(tb[NFTA_META_SREG]);
         err = nft_validate_register_load(priv->sreg, len);
         if (err < 0)
@@ -407,6 +415,7 @@ static const struct nft_expr_ops nft_meta_set_ops = {
         .init           = nft_meta_set_init,
         .destroy        = nft_meta_set_destroy,
         .dump           = nft_meta_set_dump,
+        .validate       = nft_meta_set_validate,
 };
 
 static const struct nft_expr_ops *
diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c
index 0522fc9bfb0a..c64de3f7379d 100644
--- a/net/netfilter/nft_reject.c
+++ b/net/netfilter/nft_reject.c
@@ -26,11 +26,27 @@ const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
 };
 EXPORT_SYMBOL_GPL(nft_reject_policy);
 
+int nft_reject_validate(const struct nft_ctx *ctx,
+                        const struct nft_expr *expr,
+                        const struct nft_data **data)
+{
+        return nft_chain_validate_hooks(ctx->chain,
+                                        (1 << NF_INET_LOCAL_IN) |
+                                        (1 << NF_INET_FORWARD) |
+                                        (1 << NF_INET_LOCAL_OUT));
+}
+EXPORT_SYMBOL_GPL(nft_reject_validate);
+
 int nft_reject_init(const struct nft_ctx *ctx,
                     const struct nft_expr *expr,
                     const struct nlattr * const tb[])
 {
         struct nft_reject *priv = nft_expr_priv(expr);
+        int err;
+
+        err = nft_reject_validate(ctx, expr, NULL);
+        if (err < 0)
+                return err;
 
         if (tb[NFTA_REJECT_TYPE] == NULL)
                 return -EINVAL;
diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c
index 759ca5248a3d..e79d9ca2ffee 100644
--- a/net/netfilter/nft_reject_inet.c
+++ b/net/netfilter/nft_reject_inet.c
@@ -66,7 +66,11 @@ static int nft_reject_inet_init(const struct nft_ctx *ctx,
                                 const struct nlattr * const tb[])
 {
         struct nft_reject *priv = nft_expr_priv(expr);
-        int icmp_code;
+        int icmp_code, err;
+
+        err = nft_reject_validate(ctx, expr, NULL);
+        if (err < 0)
+                return err;
 
         if (tb[NFTA_REJECT_TYPE] == NULL)
                 return -EINVAL;
@@ -124,6 +128,7 @@ static const struct nft_expr_ops nft_reject_inet_ops = {
         .eval           = nft_reject_inet_eval,
         .init           = nft_reject_inet_init,
         .dump           = nft_reject_inet_dump,
+        .validate       = nft_reject_validate,
 };
 
 static struct nft_expr_type nft_reject_inet_type __read_mostly = {
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index 7f4414d26a66..663c4c3c9072 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -127,6 +127,8 @@ nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp,
                                                     daddr, dport,
                                                     in->ifindex);
 
+                        if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))
+                                sk = NULL;
                         /* NOTE: we return listeners even if bound to
                          * 0.0.0.0, those are filtered out in
                          * xt_socket, since xt_TPROXY needs 0 bound
@@ -195,6 +197,8 @@ nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp,
                                                    daddr, ntohs(dport),
                                                    in->ifindex);
 
+                        if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))
+                                sk = NULL;
                         /* NOTE: we return listeners even if bound to
                          * 0.0.0.0, those are filtered out in
                          * xt_socket, since xt_TPROXY needs 0 bound
diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c
index 3048a7e3a90a..cf327593852a 100644
--- a/net/netfilter/xt_nfacct.c
+++ b/net/netfilter/xt_nfacct.c
@@ -26,7 +26,7 @@ static bool nfacct_mt(const struct sk_buff *skb, struct xt_action_param *par)
 
         nfnl_acct_update(skb, info->nfacct);
 
-        overquota = nfnl_acct_overquota(skb, info->nfacct);
+        overquota = nfnl_acct_overquota(par->net, skb, info->nfacct);
 
         return overquota == NFACCT_UNDERQUOTA ? false : true;
 }
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 141a06eeb1e5..e87cd81315e1 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -53,7 +53,7 @@ int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen, const void *dval)
         u32 *tlv = (u32 *)(skbdata);
         u16 totlen = nla_total_size(dlen);      /*alignment + hdr */
         char *dptr = (char *)tlv + NLA_HDRLEN;
-        u32 htlv = attrtype << 16 | totlen;
+        u32 htlv = attrtype << 16 | dlen;
 
         *tlv = htonl(htlv);
         memset(dptr, 0, totlen - NLA_HDRLEN);
@@ -135,7 +135,7 @@ EXPORT_SYMBOL_GPL(ife_release_meta_gen);
 
 int ife_validate_meta_u32(void *val, int len)
 {
-        if (len == 4)
+        if (len == sizeof(u32))
                 return 0;
 
         return -EINVAL;
@@ -144,8 +144,8 @@ EXPORT_SYMBOL_GPL(ife_validate_meta_u32);
 
 int ife_validate_meta_u16(void *val, int len)
 {
-        /* length will include padding */
-        if (len == NLA_ALIGN(2))
+        /* length will not include padding */
+        if (len == sizeof(u16))
                 return 0;
 
         return -EINVAL;
@@ -652,12 +652,14 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
                 u8 *tlvdata = (u8 *)tlv;
                 u16 mtype = tlv->type;
                 u16 mlen = tlv->len;
+                u16 alen;
 
                 mtype = ntohs(mtype);
                 mlen = ntohs(mlen);
+                alen = NLA_ALIGN(mlen);
 
-                if (find_decode_metaid(skb, ife, mtype, (mlen - 4),
-                                       (void *)(tlvdata + 4))) {
+                if (find_decode_metaid(skb, ife, mtype, (mlen - NLA_HDRLEN),
+                                       (void *)(tlvdata + NLA_HDRLEN))) {
                         /* abuse overlimits to count when we receive metadata
                          * but dont have an ops for it
                          */
@@ -666,8 +668,8 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
                         ife->tcf_qstats.overlimits++;
                 }
 
-                tlvdata += mlen;
-                ifehdrln -= mlen;
+                tlvdata += alen;
+                ifehdrln -= alen;
                 tlv = (struct meta_tlvhdr *)tlvdata;
         }
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index e95b67cd5718..657c13362b19 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -643,18 +643,19 @@ struct Qdisc *qdisc_create_dflt(struct netdev_queue *dev_queue,
         struct Qdisc *sch;
 
         if (!try_module_get(ops->owner))
-                goto errout;
+                return NULL;
 
         sch = qdisc_alloc(dev_queue, ops);
-        if (IS_ERR(sch))
-                goto errout;
+        if (IS_ERR(sch)) {
+                module_put(ops->owner);
+                return NULL;
+        }
         sch->parent = parentid;
 
         if (!ops->init || ops->init(sch, NULL) == 0)
                 return sch;
 
         qdisc_destroy(sch);
-errout:
         return NULL;
 }
 EXPORT_SYMBOL(qdisc_create_dflt);
diff --git a/net/sctp/input.c b/net/sctp/input.c
index c182db7d691f..69444d32ecda 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -119,7 +119,13 @@ int sctp_rcv(struct sk_buff *skb)
                        skb_transport_offset(skb))
                 goto discard_it;
 
-        if (!pskb_may_pull(skb, sizeof(struct sctphdr)))
+        /* If the packet is fragmented and we need to do crc checking,
+         * it's better to just linearize it otherwise crc computing
+         * takes longer.
+         */
+        if ((!(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) &&
+             skb_linearize(skb)) ||
+            !pskb_may_pull(skb, sizeof(struct sctphdr)))
                 goto discard_it;
 
         /* Pull up the IP header. */
@@ -1177,9 +1183,6 @@ static struct sctp_association *__sctp_rcv_lookup_harder(struct net *net,
         if ((skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) == SKB_GSO_SCTP)
                 return NULL;
 
-        if (skb_linearize(skb))
-                return NULL;
-
         ch = (sctp_chunkhdr_t *) skb->data;
 
         /* The code below will attempt to walk the chunk and extract
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index c30ddb0f3190..6437aa97cfd7 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -170,19 +170,6 @@ next_chunk:
 
                 chunk = list_entry(entry, struct sctp_chunk, list);
 
-                /* Linearize if it's not GSO */
-                if ((skb_shinfo(chunk->skb)->gso_type & SKB_GSO_SCTP) != SKB_GSO_SCTP &&
-                    skb_is_nonlinear(chunk->skb)) {
-                        if (skb_linearize(chunk->skb)) {
-                                __SCTP_INC_STATS(dev_net(chunk->skb->dev), SCTP_MIB_IN_PKT_DISCARDS);
-                                sctp_chunk_free(chunk);
-                                goto next_chunk;
-                        }
-
-                        /* Update sctp_hdr as it probably changed */
-                        chunk->sctp_hdr = sctp_hdr(chunk->skb);
-                }
-
                 if ((skb_shinfo(chunk->skb)->gso_type & SKB_GSO_SCTP) == SKB_GSO_SCTP) {
                         /* GSO-marked skbs but without frags, handle
                          * them normally
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 1f1682b9a6a8..31b7bc35895d 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -878,7 +878,7 @@ static sctp_xmit_t sctp_packet_will_fit(struct sctp_packet *packet,
                                         struct sctp_chunk *chunk,
                                         u16 chunk_len)
 {
-        size_t psize, pmtu;
+        size_t psize, pmtu, maxsize;
         sctp_xmit_t retval = SCTP_XMIT_OK;
 
         psize = packet->size;
@@ -906,6 +906,17 @@ static sctp_xmit_t sctp_packet_will_fit(struct sctp_packet *packet,
                         goto out;
                 }
 
+                /* Similarly, if this chunk was built before a PMTU
+                 * reduction, we have to fragment it at IP level now. So
+                 * if the packet already contains something, we need to
+                 * flush.
+                 */
+                maxsize = pmtu - packet->overhead;
+                if (packet->auth)
+                        maxsize -= WORD_ROUND(packet->auth->skb->len);
+                if (chunk_len > maxsize)
+                        retval = SCTP_XMIT_PMTU_FULL;
+
                 /* It is also okay to fragment if the chunk we are
                  * adding is a control chunk, but only if current packet
                  * is not a GSO one otherwise it causes fragmentation of
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
index bb691538adc8..f3508aa75815 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -424,11 +424,13 @@ static int sctp_diag_dump_one(struct sk_buff *in_skb,
                 paddr.v4.sin_family = AF_INET;
         } else {
                 laddr.v6.sin6_port = req->id.idiag_sport;
-                memcpy(&laddr.v6.sin6_addr, req->id.idiag_src, 64);
+                memcpy(&laddr.v6.sin6_addr, req->id.idiag_src,
+                       sizeof(laddr.v6.sin6_addr));
                 laddr.v6.sin6_family = AF_INET6;
 
                 paddr.v6.sin6_port = req->id.idiag_dport;
-                memcpy(&paddr.v6.sin6_addr, req->id.idiag_dst, 64);
+                memcpy(&paddr.v6.sin6_addr, req->id.idiag_dst,
+                       sizeof(paddr.v6.sin6_addr));
                 paddr.v6.sin6_family = AF_INET6;
         }
 
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 7f79fb7dc6a0..66f23b376fa0 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -453,7 +453,7 @@ static struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
         struct rpc_xprt_switch *xps;
 
         if (args->bc_xprt && args->bc_xprt->xpt_bc_xps) {
-                WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
+                WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
                 xps = args->bc_xprt->xpt_bc_xps;
                 xprt_switch_get(xps);
         } else {
@@ -520,7 +520,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
         char servername[48];
 
         if (args->bc_xprt) {
-                WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
+                WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
                 xprt = args->bc_xprt->xpt_bc_xprt;
                 if (xprt) {
                         xprt_get(xprt);
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 536d0be3f61b..799cce6cbe45 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -51,6 +51,7 @@
 #include <linux/slab.h>
 #include <linux/prefetch.h>
 #include <linux/sunrpc/addr.h>
+#include <linux/sunrpc/svc_rdma.h>
 #include <asm/bitops.h>
 #include <linux/module.h> /* try_module_get()/module_put() */
 
@@ -923,7 +924,7 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
         }
 
         INIT_LIST_HEAD(&buf->rb_recv_bufs);
-        for (i = 0; i < buf->rb_max_requests; i++) {
+        for (i = 0; i < buf->rb_max_requests + RPCRDMA_MAX_BC_REQUESTS; i++) {
                 struct rpcrdma_rep *rep;
 
                 rep = rpcrdma_create_rep(r_xprt);
@@ -1018,6 +1019,7 @@ rpcrdma_buffer_destroy(struct rpcrdma_buffer *buf)
                 rep = rpcrdma_buffer_get_rep_locked(buf);
                 rpcrdma_destroy_rep(ia, rep);
         }
+        buf->rb_send_count = 0;
 
         spin_lock(&buf->rb_reqslock);
         while (!list_empty(&buf->rb_allreqs)) {
@@ -1032,6 +1034,7 @@ rpcrdma_buffer_destroy(struct rpcrdma_buffer *buf)
                 spin_lock(&buf->rb_reqslock);
         }
         spin_unlock(&buf->rb_reqslock);
+        buf->rb_recv_count = 0;
 
         rpcrdma_destroy_mrs(buf);
 }
@@ -1074,8 +1077,27 @@ rpcrdma_put_mw(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mw *mw)
         spin_unlock(&buf->rb_mwlock);
 }
 
+static struct rpcrdma_rep *
+rpcrdma_buffer_get_rep(struct rpcrdma_buffer *buffers)
+{
+        /* If an RPC previously completed without a reply (say, a
+         * credential problem or a soft timeout occurs) then hold off
+         * on supplying more Receive buffers until the number of new
+         * pending RPCs catches up to the number of posted Receives.
+         */
+        if (unlikely(buffers->rb_send_count < buffers->rb_recv_count))
+                return NULL;
+
+        if (unlikely(list_empty(&buffers->rb_recv_bufs)))
+                return NULL;
+        buffers->rb_recv_count++;
+        return rpcrdma_buffer_get_rep_locked(buffers);
+}
+
 /*
  * Get a set of request/reply buffers.
+ *
+ * Reply buffer (if available) is attached to send buffer upon return.
  */
 struct rpcrdma_req *
 rpcrdma_buffer_get(struct rpcrdma_buffer *buffers)
@@ -1085,21 +1107,15 @@ rpcrdma_buffer_get(struct rpcrdma_buffer *buffers)
         spin_lock(&buffers->rb_lock);
         if (list_empty(&buffers->rb_send_bufs))
                 goto out_reqbuf;
+        buffers->rb_send_count++;
         req = rpcrdma_buffer_get_req_locked(buffers);
-        if (list_empty(&buffers->rb_recv_bufs))
-                goto out_repbuf;
-        req->rl_reply = rpcrdma_buffer_get_rep_locked(buffers);
+        req->rl_reply = rpcrdma_buffer_get_rep(buffers);
         spin_unlock(&buffers->rb_lock);
         return req;
 
 out_reqbuf:
         spin_unlock(&buffers->rb_lock);
-        pr_warn("rpcrdma: out of request buffers (%p)\n", buffers);
-        return NULL;
-out_repbuf:
-        list_add(&req->rl_free, &buffers->rb_send_bufs);
-        spin_unlock(&buffers->rb_lock);
-        pr_warn("rpcrdma: out of reply buffers (%p)\n", buffers);
+        pr_warn("RPC:       %s: out of request buffers\n", __func__);
         return NULL;
 }
 
@@ -1117,9 +1133,12 @@ rpcrdma_buffer_put(struct rpcrdma_req *req)
         req->rl_reply = NULL;
 
         spin_lock(&buffers->rb_lock);
+        buffers->rb_send_count--;
         list_add_tail(&req->rl_free, &buffers->rb_send_bufs);
-        if (rep)
+        if (rep) {
+                buffers->rb_recv_count--;
                 list_add_tail(&rep->rr_list, &buffers->rb_recv_bufs);
+        }
         spin_unlock(&buffers->rb_lock);
 }
 
@@ -1133,8 +1152,7 @@ rpcrdma_recv_buffer_get(struct rpcrdma_req *req)
         struct rpcrdma_buffer *buffers = req->rl_buffer;
 
         spin_lock(&buffers->rb_lock);
-        if (!list_empty(&buffers->rb_recv_bufs))
-                req->rl_reply = rpcrdma_buffer_get_rep_locked(buffers);
+        req->rl_reply = rpcrdma_buffer_get_rep(buffers);
         spin_unlock(&buffers->rb_lock);
 }
 
@@ -1148,6 +1166,7 @@ rpcrdma_recv_buffer_put(struct rpcrdma_rep *rep)
         struct rpcrdma_buffer *buffers = &rep->rr_rxprt->rx_buf;
 
         spin_lock(&buffers->rb_lock);
+        buffers->rb_recv_count--;
         list_add_tail(&rep->rr_list, &buffers->rb_recv_bufs);
         spin_unlock(&buffers->rb_lock);
 }
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index 670fad57153a..a71b0f5897d8 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -321,6 +321,7 @@ struct rpcrdma_buffer {
         char                    *rb_pool;
 
         spinlock_t              rb_lock;        /* protect buf lists */
+        int                     rb_send_count, rb_recv_count;
         struct list_head        rb_send_bufs;
         struct list_head        rb_recv_bufs;
         u32                     rb_max_requests;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 8ede3bc52481..bf168838a029 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1074,7 +1074,7 @@ static void xs_udp_data_receive(struct sock_xprt *transport)
                 skb = skb_recv_datagram(sk, 0, 1, &err);
                 if (skb != NULL) {
                         xs_udp_data_read_skb(&transport->xprt, sk, skb);
-                        skb_free_datagram(sk, skb);
+                        skb_free_datagram_locked(sk, skb);
                         continue;
                 }
                 if (!test_and_clear_bit(XPRT_SOCK_DATA_READY, &transport->sock_state))
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 6b626a64b517..a04fe9be1c60 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -62,6 +62,8 @@ static void publ_to_item(struct distr_item *i, struct publication *p)
 
 /**
  * named_prepare_buf - allocate & initialize a publication message
+ *
+ * The buffer returned is of size INT_H_SIZE + payload size
  */
 static struct sk_buff *named_prepare_buf(struct net *net, u32 type, u32 size,
                                          u32 dest)
@@ -141,9 +143,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
         struct publication *publ;
         struct sk_buff *skb = NULL;
         struct distr_item *item = NULL;
-        uint msg_dsz = (tipc_node_get_mtu(net, dnode, 0) / ITEM_SIZE) *
-                        ITEM_SIZE;
-        uint msg_rem = msg_dsz;
+        u32 msg_dsz = ((tipc_node_get_mtu(net, dnode, 0) - INT_H_SIZE) /
+                        ITEM_SIZE) * ITEM_SIZE;
+        u32 msg_rem = msg_dsz;
 
         list_for_each_entry(publ, pls, local_list) {
                 /* Prepare next buffer: */
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index b016c011970b..ae7e14cae085 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -396,10 +396,13 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
         tuncfg.encap_destroy = NULL;
         setup_udp_tunnel_sock(net, ub->ubsock, &tuncfg);
 
-        if (enable_mcast(ub, remote))
+        err = enable_mcast(ub, remote);
+        if (err)
                 goto err;
         return 0;
 err:
+        if (ub->ubsock)
+                udp_tunnel_sock_release(ub->ubsock);
         kfree(ub);
         return err;
 }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index f1dffe84f0d5..8309687a56b0 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -661,11 +661,11 @@ static int unix_set_peek_off(struct sock *sk, int val)
 {
         struct unix_sock *u = unix_sk(sk);
 
-        if (mutex_lock_interruptible(&u->readlock))
+        if (mutex_lock_interruptible(&u->iolock))
                 return -EINTR;
 
         sk->sk_peek_off = val;
-        mutex_unlock(&u->readlock);
+        mutex_unlock(&u->iolock);
 
         return 0;
 }
@@ -779,7 +779,8 @@ static struct sock *unix_create1(struct net *net, struct socket *sock, int kern)
         spin_lock_init(&u->lock);
         atomic_long_set(&u->inflight, 0);
         INIT_LIST_HEAD(&u->link);
-        mutex_init(&u->readlock); /* single task reading lock */
+        mutex_init(&u->iolock); /* single task reading lock */
+        mutex_init(&u->bindlock); /* single task binding lock */
         init_waitqueue_head(&u->peer_wait);
         init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay);
         unix_insert_socket(unix_sockets_unbound(sk), sk);
@@ -848,7 +849,7 @@ static int unix_autobind(struct socket *sock)
         int err;
         unsigned int retries = 0;
 
-        err = mutex_lock_interruptible(&u->readlock);
+        err = mutex_lock_interruptible(&u->bindlock);
         if (err)
                 return err;
 
@@ -895,7 +896,7 @@ retry:
         spin_unlock(&unix_table_lock);
         err = 0;
 
-out:    mutex_unlock(&u->readlock);
+out:    mutex_unlock(&u->bindlock);
         return err;
 }
 
@@ -954,20 +955,32 @@ fail:
         return NULL;
 }
 
-static int unix_mknod(struct dentry *dentry, const struct path *path, umode_t mode,
-                      struct path *res)
+static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
 {
-        int err;
+        struct dentry *dentry;
+        struct path path;
+        int err = 0;
+        /*
+         * Get the parent directory, calculate the hash for last
+         * component.
+         */
+        dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
+        err = PTR_ERR(dentry);
+        if (IS_ERR(dentry))
+                return err;
 
-        err = security_path_mknod(path, dentry, mode, 0);
+        /*
+         * All right, let's create it.
+         */
+        err = security_path_mknod(&path, dentry, mode, 0);
         if (!err) {
-                err = vfs_mknod(d_inode(path->dentry), dentry, mode, 0);
+                err = vfs_mknod(d_inode(path.dentry), dentry, mode, 0);
                 if (!err) {
-                        res->mnt = mntget(path->mnt);
+                        res->mnt = mntget(path.mnt);
                         res->dentry = dget(dentry);
                 }
         }
-
+        done_path_create(&path, dentry);
         return err;
 }
 
@@ -978,12 +991,10 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct unix_sock *u = unix_sk(sk);
         struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
         char *sun_path = sunaddr->sun_path;
-        int err, name_err;
+        int err;
         unsigned int hash;
         struct unix_address *addr;
         struct hlist_head *list;
-        struct path path;
-        struct dentry *dentry;
 
         err = -EINVAL;
         if (sunaddr->sun_family != AF_UNIX)
@@ -999,34 +1010,14 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 goto out;
         addr_len = err;
 
-        name_err = 0;
-        dentry = NULL;
-        if (sun_path[0]) {
-                /* Get the parent directory, calculate the hash for last
-                 * component.
-                 */
-                dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
-
-                if (IS_ERR(dentry)) {
-                        /* delay report until after 'already bound' check */
-                        name_err = PTR_ERR(dentry);
-                        dentry = NULL;
-                }
-        }
-
-        err = mutex_lock_interruptible(&u->readlock);
+        err = mutex_lock_interruptible(&u->bindlock);
         if (err)
-                goto out_path;
+                goto out;
 
         err = -EINVAL;
         if (u->addr)
                 goto out_up;
 
-        if (name_err) {
-                err = name_err == -EEXIST ? -EADDRINUSE : name_err;
-                goto out_up;
-        }
-
         err = -ENOMEM;
         addr = kmalloc(sizeof(*addr)+addr_len, GFP_KERNEL);
         if (!addr)
@@ -1037,11 +1028,11 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         addr->hash = hash ^ sk->sk_type;
         atomic_set(&addr->refcnt, 1);
 
-        if (dentry) {
-                struct path u_path;
+        if (sun_path[0]) {
+                struct path path;
                 umode_t mode = S_IFSOCK |
                        (SOCK_INODE(sock)->i_mode & ~current_umask());
-                err = unix_mknod(dentry, &path, mode, &u_path);
+                err = unix_mknod(sun_path, mode, &path);
                 if (err) {
                         if (err == -EEXIST)
                                 err = -EADDRINUSE;
@@ -1049,9 +1040,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                         goto out_up;
                 }
                 addr->hash = UNIX_HASH_SIZE;
-                hash = d_real_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1);
+                hash = d_real_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE - 1);
                 spin_lock(&unix_table_lock);
-                u->path = u_path;
+                u->path = path;
                 list = &unix_socket_table[hash];
         } else {
                 spin_lock(&unix_table_lock);
@@ -1073,11 +1064,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 out_unlock:
         spin_unlock(&unix_table_lock);
 out_up:
-        mutex_unlock(&u->readlock);
-out_path:
-        if (dentry)
-                done_path_create(&path, dentry);
-
+        mutex_unlock(&u->bindlock);
 out:
         return err;
 }
@@ -1969,17 +1956,17 @@ static ssize_t unix_stream_sendpage(struct socket *socket, struct page *page,
         if (false) {
 alloc_skb:
                 unix_state_unlock(other);
-                mutex_unlock(&unix_sk(other)->readlock);
+                mutex_unlock(&unix_sk(other)->iolock);
                 newskb = sock_alloc_send_pskb(sk, 0, 0, flags & MSG_DONTWAIT,
                                               &err, 0);
                 if (!newskb)
                         goto err;
         }
 
-        /* we must acquire readlock as we modify already present
+        /* we must acquire iolock as we modify already present
          * skbs in the sk_receive_queue and mess with skb->len
          */
-        err = mutex_lock_interruptible(&unix_sk(other)->readlock);
+        err = mutex_lock_interruptible(&unix_sk(other)->iolock);
         if (err) {
                 err = flags & MSG_DONTWAIT ? -EAGAIN : -ERESTARTSYS;
                 goto err;
@@ -2046,7 +2033,7 @@ alloc_skb:
         }
 
         unix_state_unlock(other);
-        mutex_unlock(&unix_sk(other)->readlock);
+        mutex_unlock(&unix_sk(other)->iolock);
 
         other->sk_data_ready(other);
         scm_destroy(&scm);
@@ -2055,7 +2042,7 @@ alloc_skb:
 err_state_unlock:
         unix_state_unlock(other);
 err_unlock:
-        mutex_unlock(&unix_sk(other)->readlock);
+        mutex_unlock(&unix_sk(other)->iolock);
 err:
         kfree_skb(newskb);
         if (send_sigpipe && !(flags & MSG_NOSIGNAL))
@@ -2123,7 +2110,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
         timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 
         do {
-                mutex_lock(&u->readlock);
+                mutex_lock(&u->iolock);
 
                 skip = sk_peek_offset(sk, flags);
                 skb = __skb_try_recv_datagram(sk, flags, &peeked, &skip, &err,
@@ -2131,14 +2118,14 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
                 if (skb)
                         break;
 
-                mutex_unlock(&u->readlock);
+                mutex_unlock(&u->iolock);
 
                 if (err != -EAGAIN)
                         break;
         } while (timeo &&
                  !__skb_wait_for_more_packets(sk, &err, &timeo, last));
 
-        if (!skb) { /* implies readlock unlocked */
+        if (!skb) { /* implies iolock unlocked */
                 unix_state_lock(sk);
                 /* Signal EOF on disconnected non-blocking SEQPACKET socket. */
                 if (sk->sk_type == SOCK_SEQPACKET && err == -EAGAIN &&
@@ -2203,7 +2190,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
 
 out_free:
         skb_free_datagram(sk, skb);
-        mutex_unlock(&u->readlock);
+        mutex_unlock(&u->iolock);
 out:
         return err;
 }
@@ -2298,7 +2285,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state)
         /* Lock the socket to prevent queue disordering
          * while sleeps in memcpy_tomsg
          */
-        mutex_lock(&u->readlock);
+        mutex_lock(&u->iolock);
 
         if (flags & MSG_PEEK)
                 skip = sk_peek_offset(sk, flags);
@@ -2340,7 +2327,7 @@ again:
                                 break;
                         }
 
-                        mutex_unlock(&u->readlock);
+                        mutex_unlock(&u->iolock);
 
                         timeo = unix_stream_data_wait(sk, timeo, last,
                                                       last_len);
@@ -2351,7 +2338,7 @@ again:
                                 goto out;
                         }
 
-                        mutex_lock(&u->readlock);
+                        mutex_lock(&u->iolock);
                         goto redo;
 unlock:
                         unix_state_unlock(sk);
@@ -2454,7 +2441,7 @@ unlock:
                 }
         } while (size);
 
-        mutex_unlock(&u->readlock);
+        mutex_unlock(&u->iolock);
         if (state->msg)
                 scm_recv(sock, state->msg, &scm, flags);
         else
@@ -2495,9 +2482,9 @@ static ssize_t skb_unix_socket_splice(struct sock *sk,
         int ret;
         struct unix_sock *u = unix_sk(sk);
 
-        mutex_unlock(&u->readlock);
+        mutex_unlock(&u->iolock);
         ret = splice_to_pipe(pipe, spd);
-        mutex_lock(&u->readlock);
+        mutex_lock(&u->iolock);
 
         return ret;
 }
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index dbb2738e356a..6250b1cfcde5 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -958,29 +958,8 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                         return private(dev, iwr, cmd, info, handler);
         }
         /* Old driver API : call driver ioctl handler */
-        if (dev->netdev_ops->ndo_do_ioctl) {
-#ifdef CONFIG_COMPAT
-                if (info->flags & IW_REQUEST_FLAG_COMPAT) {
-                        int ret = 0;
-                        struct iwreq iwr_lcl;
-                        struct compat_iw_point *iwp_compat = (void *) &iwr->u.data;
-
-                        memcpy(&iwr_lcl, iwr, sizeof(struct iwreq));
-                        iwr_lcl.u.data.pointer = compat_ptr(iwp_compat->pointer);
-                        iwr_lcl.u.data.length = iwp_compat->length;
-                        iwr_lcl.u.data.flags = iwp_compat->flags;
-
-                        ret = dev->netdev_ops->ndo_do_ioctl(dev, (void *) &iwr_lcl, cmd);
-
-                        iwp_compat->pointer = ptr_to_compat(iwr_lcl.u.data.pointer);
-                        iwp_compat->length = iwr_lcl.u.data.length;
-                        iwp_compat->flags = iwr_lcl.u.data.flags;
-
-                        return ret;
-                } else
-#endif
-                        return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
-        }
+        if (dev->netdev_ops->ndo_do_ioctl)
+                return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
         return -EOPNOTSUPP;
 }
 
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 1c4ad477ce93..6e3f0254d8a1 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -207,15 +207,15 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
         family = XFRM_SPI_SKB_CB(skb)->family;
 
         /* if tunnel is present override skb->mark value with tunnel i_key */
-        if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) {
-                switch (family) {
-                case AF_INET:
+        switch (family) {
+        case AF_INET:
+                if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
                         mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4->parms.i_key);
-                        break;
-                case AF_INET6:
+                break;
+        case AF_INET6:
+                if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
                         mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6->parms.i_key);
-                        break;
-                }
+                break;
         }
 
         /* Allocate new secpath or COW existing one. */
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b5e665b3cfb0..45f9cf97ea25 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -626,6 +626,10 @@ static void xfrm_hash_rebuild(struct work_struct *work)
 
         /* re-insert all policies by order of creation */
         list_for_each_entry_reverse(policy, &net->xfrm.policy_all, walk.all) {
+                if (xfrm_policy_id2dir(policy->index) >= XFRM_POLICY_MAX) {
+                        /* skip socket policies */
+                        continue;
+                }
                 newpos = NULL;
                 chain = policy_hash_bysel(net, &policy->selector,
                                           policy->family,
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d516845e16e3..cb65d916a345 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -896,7 +896,8 @@ static int xfrm_dump_sa_done(struct netlink_callback *cb)
         struct sock *sk = cb->skb->sk;
         struct net *net = sock_net(sk);
 
-        xfrm_state_walk_done(walk, net);
+        if (cb->args[0])
+                xfrm_state_walk_done(walk, net);
         return 0;
 }
 
@@ -921,8 +922,6 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
                 u8 proto = 0;
                 int err;
 
-                cb->args[0] = 1;
-
                 err = nlmsg_parse(cb->nlh, 0, attrs, XFRMA_MAX,
                                   xfrma_policy);
                 if (err < 0)
@@ -939,6 +938,7 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
                         proto = nla_get_u8(attrs[XFRMA_PROTO]);
 
                 xfrm_state_walk_init(walk, proto, filter);
+                cb->args[0] = 1;
         }
 
         (void) xfrm_state_walk(net, walk, dump_one_state, &info);
@@ -2051,9 +2051,6 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (up->hard) {
                 xfrm_policy_delete(xp, p->dir);
                 xfrm_audit_policy_delete(xp, 1, true);
-        } else {
-                // reset the timers here?
-                WARN(1, "Don't know what to do with soft policy expire\n");
         }
         km_policy_expired(xp, p->dir, up->hard, nlh->nlmsg_pid);
 
@@ -2117,7 +2114,7 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         err = verify_newpolicy_info(&ua->policy);
         if (err)
-                goto bad_policy;
+                goto free_state;
 
         /*   build an XP */
         xp = xfrm_policy_construct(net, &ua->policy, attrs, &err);
@@ -2149,8 +2146,6 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         return 0;
 
-bad_policy:
-        WARN(1, "BAD policy passed\n");
 free_state:
         kfree(x);
 nomem:
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 4de3cc42fc50..206a6b346a8d 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3570,15 +3570,6 @@ sub process {
                         }
                 }
 
-# check for uses of DEFINE_PCI_DEVICE_TABLE
-                if ($line =~ /\bDEFINE_PCI_DEVICE_TABLE\s*\(\s*(\w+)\s*\)\s*=/) {
-                        if (WARN("DEFINE_PCI_DEVICE_TABLE",
-                                 "Prefer struct pci_device_id over deprecated DEFINE_PCI_DEVICE_TABLE\n" . $herecurr) &&
-                            $fix) {
-                                $fixed[$fixlinenr] =~ s/\b(?:static\s+|)DEFINE_PCI_DEVICE_TABLE\s*\(\s*(\w+)\s*\)\s*=\s*/static const struct pci_device_id $1\[\] = /;
-                        }
-                }
-
 # check for new typedefs, only function parameters and sparse annotations
 # make sense.
                 if ($line =~ /\btypedef\s/ &&
diff --git a/scripts/get_maintainer.pl b/scripts/get_maintainer.pl
index 49a00d54b835..aed4511f0304 100755
--- a/scripts/get_maintainer.pl
+++ b/scripts/get_maintainer.pl
@@ -2136,9 +2136,11 @@ sub vcs_file_exists {
 
     my $cmd = $VCS_cmds{"file_exists_cmd"};
     $cmd =~ s/(\$\w+)/$1/eeg;           # interpolate $cmd
-
+    $cmd .= " 2>&1";
     $exists = &{$VCS_cmds{"execute_cmd"}}($cmd);
 
+    return 0 if ($? != 0);
+
     return $exists;
 }
 
diff --git a/scripts/package/builddeb b/scripts/package/builddeb
index e1c09e2f9be7..8ea9fd2b6573 100755
--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -332,7 +332,9 @@ if grep -q '^CONFIG_STACK_VALIDATION=y' $KCONFIG_CONFIG ; then
         (cd $objtree; find tools/objtool -type f -executable) >> "$objtree/debian/hdrobjfiles"
 fi
 (cd $objtree; find arch/$SRCARCH/include Module.symvers include scripts -type f) >> "$objtree/debian/hdrobjfiles"
-(cd $objtree; find scripts/gcc-plugins -name \*.so -o -name gcc-common.h) >> "$objtree/debian/hdrobjfiles"
+if grep -q '^CONFIG_GCC_PLUGINS=y' $KCONFIG_CONFIG ; then
+        (cd $objtree; find scripts/gcc-plugins -name \*.so -o -name gcc-common.h) >> "$objtree/debian/hdrobjfiles"
+fi
 destdir=$kernel_headers_dir/usr/src/linux-headers-$version
 mkdir -p "$destdir"
 (cd $srctree; tar -c -f - -T -) < "$objtree/debian/hdrsrcfiles" | (cd $destdir; tar -xf -)
diff --git a/scripts/tags.sh b/scripts/tags.sh
index ed7eef24ef89..b3775a9604ea 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -206,7 +206,6 @@ regex_c=(
         '/\<DEFINE_PER_CPU_SHARED_ALIGNED([^,]*, *\([[:alnum:]_]*\)/\1/v/'
         '/\<DECLARE_WAIT_QUEUE_HEAD(\([[:alnum:]_]*\)/\1/v/'
         '/\<DECLARE_\(TASKLET\|WORK\|DELAYED_WORK\)(\([[:alnum:]_]*\)/\2/v/'
-        '/\<DEFINE_PCI_DEVICE_TABLE(\([[:alnum:]_]*\)/\1/v/'
         '/\(^\s\)OFFSET(\([[:alnum:]_]*\)/\2/v/'
         '/\(^\s\)DEFINE(\([[:alnum:]_]*\)/\2/v/'
         '/\<DEFINE_HASHTABLE(\([[:alnum:]_]*\)/\1/v/'
diff --git a/security/Kconfig b/security/Kconfig
index da10d9b573a4..118f4549404e 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -147,6 +147,17 @@ config HARDENED_USERCOPY
           or are part of the kernel text. This kills entire classes
           of heap overflow exploits and similar kernel memory exposures.
 
+config HARDENED_USERCOPY_PAGESPAN
+        bool "Refuse to copy allocations that span multiple pages"
+        depends on HARDENED_USERCOPY
+        depends on EXPERT
+        help
+          When a multi-page allocation is done without __GFP_COMP,
+          hardened usercopy will reject attempts to copy it. There are,
+          however, several cases of this in the kernel that have not all
+          been removed. This config is intended to be used only while
+          trying to find such users.
+
 source security/selinux/Kconfig
 source security/smack/Kconfig
 source security/tomoyo/Kconfig
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 795437b10082..b450a27588c8 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -1633,11 +1633,13 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
                 return -EBUSY;
         }
         list_add_tail(&rmidi->list, &snd_rawmidi_devices);
+        mutex_unlock(&register_mutex);
         err = snd_register_device(SNDRV_DEVICE_TYPE_RAWMIDI,
                                   rmidi->card, rmidi->device,
                                   &snd_rawmidi_f_ops, rmidi, &rmidi->dev);
         if (err < 0) {
                 rmidi_err(rmidi, "unable to register\n");
+                mutex_lock(&register_mutex);
                 list_del(&rmidi->list);
                 mutex_unlock(&register_mutex);
                 return err;
@@ -1645,6 +1647,7 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
         if (rmidi->ops && rmidi->ops->dev_register &&
             (err = rmidi->ops->dev_register(rmidi)) < 0) {
                 snd_unregister_device(&rmidi->dev);
+                mutex_lock(&register_mutex);
                 list_del(&rmidi->list);
                 mutex_unlock(&register_mutex);
                 return err;
@@ -1677,7 +1680,6 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
                 }
         }
 #endif /* CONFIG_SND_OSSEMUL */
-        mutex_unlock(&register_mutex);
         sprintf(name, "midi%d", rmidi->device);
         entry = snd_info_create_card_entry(rmidi->card, name, rmidi->card->proc_root);
         if (entry) {
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 9a6157ea6881..fc144f43faa6 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -35,6 +35,9 @@
 #include <sound/initval.h>
 #include <linux/kmod.h>
 
+/* internal flags */
+#define SNDRV_TIMER_IFLG_PAUSED         0x00010000
+
 #if IS_ENABLED(CONFIG_SND_HRTIMER)
 #define DEFAULT_TIMER_LIMIT 4
 #else
@@ -294,8 +297,21 @@ int snd_timer_open(struct snd_timer_instance **ti,
                 get_device(&timer->card->card_dev);
         timeri->slave_class = tid->dev_sclass;
         timeri->slave_id = slave_id;
-        if (list_empty(&timer->open_list_head) && timer->hw.open)
-                timer->hw.open(timer);
+
+        if (list_empty(&timer->open_list_head) && timer->hw.open) {
+                int err = timer->hw.open(timer);
+                if (err) {
+                        kfree(timeri->owner);
+                        kfree(timeri);
+
+                        if (timer->card)
+                                put_device(&timer->card->card_dev);
+                        module_put(timer->module);
+                        mutex_unlock(&register_mutex);
+                        return err;
+                }
+        }
+
         list_add_tail(&timeri->open_list, &timer->open_list_head);
         snd_timer_check_master(timeri);
         mutex_unlock(&register_mutex);
@@ -526,6 +542,10 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop)
                 }
         }
         timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
+        if (stop)
+                timeri->flags &= ~SNDRV_TIMER_IFLG_PAUSED;
+        else
+                timeri->flags |= SNDRV_TIMER_IFLG_PAUSED;
         snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
                           SNDRV_TIMER_EVENT_CONTINUE);
  unlock:
@@ -587,6 +607,10 @@ int snd_timer_stop(struct snd_timer_instance *timeri)
  */
 int snd_timer_continue(struct snd_timer_instance *timeri)
 {
+        /* timer can continue only after pause */
+        if (!(timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
+                return -EINVAL;
+
         if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
                 return snd_timer_start_slave(timeri, false);
         else
@@ -813,6 +837,7 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,
         timer->tmr_subdevice = tid->subdevice;
         if (id)
                 strlcpy(timer->id, id, sizeof(timer->id));
+        timer->sticks = 1;
         INIT_LIST_HEAD(&timer->device_list);
         INIT_LIST_HEAD(&timer->open_list_head);
         INIT_LIST_HEAD(&timer->active_list_head);
@@ -1817,6 +1842,9 @@ static int snd_timer_user_continue(struct file *file)
         tu = file->private_data;
         if (!tu->timeri)
                 return -EBADFD;
+        /* start timer instead of continue if it's not used before */
+        if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
+                return snd_timer_user_start(file);
         tu->timeri->lost = 0;
         return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0;
 }
@@ -1958,6 +1986,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                 tu->qused--;
                 spin_unlock_irq(&tu->qlock);
 
+                mutex_lock(&tu->ioctl_lock);
                 if (tu->tread) {
                         if (copy_to_user(buffer, &tu->tqueue[qhead],
                                          sizeof(struct snd_timer_tread)))
@@ -1967,6 +1996,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                                          sizeof(struct snd_timer_read)))
                                 err = -EFAULT;
                 }
+                mutex_unlock(&tu->ioctl_lock);
 
                 spin_lock_irq(&tu->qlock);
                 if (err < 0)
diff --git a/sound/firewire/fireworks/fireworks.h b/sound/firewire/fireworks/fireworks.h
index 03ed35237e2b..d73c12b8753d 100644
--- a/sound/firewire/fireworks/fireworks.h
+++ b/sound/firewire/fireworks/fireworks.h
@@ -108,7 +108,6 @@ struct snd_efw {
         u8 *resp_buf;
         u8 *pull_ptr;
         u8 *push_ptr;
-        unsigned int resp_queues;
 };
 
 int snd_efw_transaction_cmd(struct fw_unit *unit,
diff --git a/sound/firewire/fireworks/fireworks_hwdep.c b/sound/firewire/fireworks/fireworks_hwdep.c
index 33df8655fe81..2e1d9a23920c 100644
--- a/sound/firewire/fireworks/fireworks_hwdep.c
+++ b/sound/firewire/fireworks/fireworks_hwdep.c
@@ -25,6 +25,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
 {
         unsigned int length, till_end, type;
         struct snd_efw_transaction *t;
+        u8 *pull_ptr;
         long count = 0;
 
         if (remained < sizeof(type) + sizeof(struct snd_efw_transaction))
@@ -38,8 +39,17 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
         buf += sizeof(type);
 
         /* write into buffer as many responses as possible */
-        while (efw->resp_queues > 0) {
-                t = (struct snd_efw_transaction *)(efw->pull_ptr);
+        spin_lock_irq(&efw->lock);
+
+        /*
+         * When another task reaches here during this task's access to user
+         * space, it picks up current position in buffer and can read the same
+         * series of responses.
+         */
+        pull_ptr = efw->pull_ptr;
+
+        while (efw->push_ptr != pull_ptr) {
+                t = (struct snd_efw_transaction *)(pull_ptr);
                 length = be32_to_cpu(t->length) * sizeof(__be32);
 
                 /* confirm enough space for this response */
@@ -49,26 +59,39 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
                 /* copy from ring buffer to user buffer */
                 while (length > 0) {
                         till_end = snd_efw_resp_buf_size -
-                                (unsigned int)(efw->pull_ptr - efw->resp_buf);
+                                (unsigned int)(pull_ptr - efw->resp_buf);
                         till_end = min_t(unsigned int, length, till_end);
 
-                        if (copy_to_user(buf, efw->pull_ptr, till_end))
+                        spin_unlock_irq(&efw->lock);
+
+                        if (copy_to_user(buf, pull_ptr, till_end))
                                 return -EFAULT;
 
-                        efw->pull_ptr += till_end;
-                        if (efw->pull_ptr >= efw->resp_buf +
-                                             snd_efw_resp_buf_size)
-                                efw->pull_ptr -= snd_efw_resp_buf_size;
+                        spin_lock_irq(&efw->lock);
+
+                        pull_ptr += till_end;
+                        if (pull_ptr >= efw->resp_buf + snd_efw_resp_buf_size)
+                                pull_ptr -= snd_efw_resp_buf_size;
 
                         length -= till_end;
                         buf += till_end;
                         count += till_end;
                         remained -= till_end;
                 }
-
-                efw->resp_queues--;
         }
 
+        /*
+         * All of tasks can read from the buffer nearly simultaneously, but the
+         * last position for each task is different depending on the length of
+         * given buffer. Here, for simplicity, a position of buffer is set by
+         * the latest task. It's better for a listening application to allow one
+         * thread to read from the buffer. Unless, each task can read different
+         * sequence of responses depending on variation of buffer length.
+         */
+        efw->pull_ptr = pull_ptr;
+
+        spin_unlock_irq(&efw->lock);
+
         return count;
 }
 
@@ -76,14 +99,17 @@ static long
 hwdep_read_locked(struct snd_efw *efw, char __user *buf, long count,
                   loff_t *offset)
 {
-        union snd_firewire_event event;
+        union snd_firewire_event event = {
+                .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
+        };
 
-        memset(&event, 0, sizeof(event));
+        spin_lock_irq(&efw->lock);
 
-        event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
         event.lock_status.status = (efw->dev_lock_count > 0);
         efw->dev_lock_changed = false;
 
+        spin_unlock_irq(&efw->lock);
+
         count = min_t(long, count, sizeof(event.lock_status));
 
         if (copy_to_user(buf, &event, count))
@@ -98,10 +124,15 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
 {
         struct snd_efw *efw = hwdep->private_data;
         DEFINE_WAIT(wait);
+        bool dev_lock_changed;
+        bool queued;
 
         spin_lock_irq(&efw->lock);
 
-        while ((!efw->dev_lock_changed) && (efw->resp_queues == 0)) {
+        dev_lock_changed = efw->dev_lock_changed;
+        queued = efw->push_ptr != efw->pull_ptr;
+
+        while (!dev_lock_changed && !queued) {
                 prepare_to_wait(&efw->hwdep_wait, &wait, TASK_INTERRUPTIBLE);
                 spin_unlock_irq(&efw->lock);
                 schedule();
@@ -109,15 +140,17 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
                 if (signal_pending(current))
                         return -ERESTARTSYS;
                 spin_lock_irq(&efw->lock);
+                dev_lock_changed = efw->dev_lock_changed;
+                queued = efw->push_ptr != efw->pull_ptr;
         }
 
-        if (efw->dev_lock_changed)
+        spin_unlock_irq(&efw->lock);
+
+        if (dev_lock_changed)
                 count = hwdep_read_locked(efw, buf, count, offset);
-        else if (efw->resp_queues > 0)
+        else if (queued)
                 count = hwdep_read_resp_buf(efw, buf, count, offset);
 
-        spin_unlock_irq(&efw->lock);
-
         return count;
 }
 
@@ -160,7 +193,7 @@ hwdep_poll(struct snd_hwdep *hwdep, struct file *file, poll_table *wait)
         poll_wait(file, &efw->hwdep_wait, wait);
 
         spin_lock_irq(&efw->lock);
-        if (efw->dev_lock_changed || (efw->resp_queues > 0))
+        if (efw->dev_lock_changed || efw->pull_ptr != efw->push_ptr)
                 events = POLLIN | POLLRDNORM;
         else
                 events = 0;
diff --git a/sound/firewire/fireworks/fireworks_proc.c b/sound/firewire/fireworks/fireworks_proc.c
index 0639dcb13f7d..beb0a0ffee57 100644
--- a/sound/firewire/fireworks/fireworks_proc.c
+++ b/sound/firewire/fireworks/fireworks_proc.c
@@ -188,8 +188,8 @@ proc_read_queues_state(struct snd_info_entry *entry,
         else
                 consumed = (unsigned int)(efw->push_ptr - efw->pull_ptr);
 
-        snd_iprintf(buffer, "%d %d/%d\n",
-                    efw->resp_queues, consumed, snd_efw_resp_buf_size);
+        snd_iprintf(buffer, "%d/%d\n",
+                    consumed, snd_efw_resp_buf_size);
 }
 
 static void
diff --git a/sound/firewire/fireworks/fireworks_transaction.c b/sound/firewire/fireworks/fireworks_transaction.c
index f550808d1784..36a08ba51ec7 100644
--- a/sound/firewire/fireworks/fireworks_transaction.c
+++ b/sound/firewire/fireworks/fireworks_transaction.c
@@ -121,11 +121,11 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
         size_t capacity, till_end;
         struct snd_efw_transaction *t;
 
-        spin_lock_irq(&efw->lock);
-
         t = (struct snd_efw_transaction *)data;
         length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
 
+        spin_lock_irq(&efw->lock);
+
         if (efw->push_ptr < efw->pull_ptr)
                 capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
         else
@@ -155,7 +155,6 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
         }
 
         /* for hwdep */
-        efw->resp_queues++;
         wake_up(&efw->hwdep_wait);
 
         *rcode = RCODE_COMPLETE;
diff --git a/sound/firewire/tascam/tascam-hwdep.c b/sound/firewire/tascam/tascam-hwdep.c
index 131267c3a042..106406cbfaa3 100644
--- a/sound/firewire/tascam/tascam-hwdep.c
+++ b/sound/firewire/tascam/tascam-hwdep.c
@@ -16,31 +16,14 @@
 
 #include "tascam.h"
 
-static long hwdep_read_locked(struct snd_tscm *tscm, char __user *buf,
-                              long count)
-{
-        union snd_firewire_event event;
-
-        memset(&event, 0, sizeof(event));
-
-        event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
-        event.lock_status.status = (tscm->dev_lock_count > 0);
-        tscm->dev_lock_changed = false;
-
-        count = min_t(long, count, sizeof(event.lock_status));
-
-        if (copy_to_user(buf, &event, count))
-                return -EFAULT;
-
-        return count;
-}
-
 static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
                        loff_t *offset)
 {
         struct snd_tscm *tscm = hwdep->private_data;
         DEFINE_WAIT(wait);
-        union snd_firewire_event event;
+        union snd_firewire_event event = {
+                .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
+        };
 
         spin_lock_irq(&tscm->lock);
 
@@ -54,10 +37,16 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
                 spin_lock_irq(&tscm->lock);
         }
 
-        memset(&event, 0, sizeof(event));
-        count = hwdep_read_locked(tscm, buf, count);
+        event.lock_status.status = (tscm->dev_lock_count > 0);
+        tscm->dev_lock_changed = false;
+
         spin_unlock_irq(&tscm->lock);
 
+        count = min_t(long, count, sizeof(event.lock_status));
+
+        if (copy_to_user(buf, &event, count))
+                return -EFAULT;
+
         return count;
 }
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 574b1b48996f..575cefd8cc4a 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4828,7 +4828,7 @@ enum {
         ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
         ALC292_FIXUP_TPT440_DOCK,
         ALC292_FIXUP_TPT440,
-        ALC283_FIXUP_BXBT2807_MIC,
+        ALC283_FIXUP_HEADSET_MIC,
         ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED,
         ALC282_FIXUP_ASPIRE_V5_PINS,
         ALC280_FIXUP_HP_GPIO4,
@@ -4855,6 +4855,7 @@ enum {
         ALC221_FIXUP_HP_FRONT_MIC,
         ALC292_FIXUP_TPT460,
         ALC298_FIXUP_SPK_VOLUME,
+        ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -5321,7 +5322,7 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC292_FIXUP_TPT440_DOCK,
         },
-        [ALC283_FIXUP_BXBT2807_MIC] = {
+        [ALC283_FIXUP_HEADSET_MIC] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
                         { 0x19, 0x04a110f0 },
@@ -5516,6 +5517,15 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
         },
+        [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x1b, 0x90170151 },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -5560,6 +5570,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
         SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
         SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+        SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
         SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
         SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
         SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
@@ -5651,7 +5662,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
         SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
         SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
-        SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_BXBT2807_MIC),
+        SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
@@ -5894,6 +5906,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x12, 0x90a60170},
                 {0x14, 0x90170120},
                 {0x21, 0x02211030}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell Inspiron 5468", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60180},
+                {0x14, 0x90170120},
+                {0x21, 0x02211030}),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC256_STANDARD_PINS),
         SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
index 54c09acd3fed..16e459aedffe 100644
--- a/sound/soc/atmel/atmel_ssc_dai.c
+++ b/sound/soc/atmel/atmel_ssc_dai.c
@@ -299,8 +299,9 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream,
         clk_enable(ssc_p->ssc->clk);
         ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk);
 
-        /* Reset the SSC to keep it at a clean status */
-        ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST));
+        /* Reset the SSC unless initialized to keep it in a clean state */
+        if (!ssc_p->initialized)
+                ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST));
 
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
                 dir = 0;
diff --git a/sound/soc/codecs/da7213.c b/sound/soc/codecs/da7213.c
index e5527bc570ae..bcf1834c5648 100644
--- a/sound/soc/codecs/da7213.c
+++ b/sound/soc/codecs/da7213.c
@@ -1247,8 +1247,8 @@ static int da7213_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
                 return -EINVAL;
         }
 
-        /* By default only 32 BCLK per WCLK is supported */
-        dai_clk_mode |= DA7213_DAI_BCLKS_PER_WCLK_32;
+        /* By default only 64 BCLK per WCLK is supported */
+        dai_clk_mode |= DA7213_DAI_BCLKS_PER_WCLK_64;
 
         snd_soc_write(codec, DA7213_DAI_CLK_MODE, dai_clk_mode);
         snd_soc_update_bits(codec, DA7213_DAI_CTRL, DA7213_DAI_FORMAT_MASK,
diff --git a/sound/soc/codecs/max98371.c b/sound/soc/codecs/max98371.c
index cf0a39bb631a..02352ed8961c 100644
--- a/sound/soc/codecs/max98371.c
+++ b/sound/soc/codecs/max98371.c
@@ -412,6 +412,7 @@ static int max98371_i2c_remove(struct i2c_client *client)
 
 static const struct i2c_device_id max98371_i2c_id[] = {
         { "max98371", 0 },
+        { }
 };
 
 MODULE_DEVICE_TABLE(i2c, max98371_i2c_id);
diff --git a/sound/soc/codecs/nau8825.c b/sound/soc/codecs/nau8825.c
index 5c9707ac4bbf..2e59a85e360b 100644
--- a/sound/soc/codecs/nau8825.c
+++ b/sound/soc/codecs/nau8825.c
@@ -212,31 +212,6 @@ static const unsigned short logtable[256] = {
         0xfa2f, 0xfaea, 0xfba5, 0xfc60, 0xfd1a, 0xfdd4, 0xfe8e, 0xff47
 };
 
-static struct snd_soc_dai *nau8825_get_codec_dai(struct nau8825 *nau8825)
-{
-        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(nau8825->dapm);
-        struct snd_soc_component *component = &codec->component;
-        struct snd_soc_dai *codec_dai, *_dai;
-
-        list_for_each_entry_safe(codec_dai, _dai, &component->dai_list, list) {
-                if (!strncmp(codec_dai->name, NUVOTON_CODEC_DAI,
-                        strlen(NUVOTON_CODEC_DAI)))
-                        return codec_dai;
-        }
-        return NULL;
-}
-
-static bool nau8825_dai_is_active(struct nau8825 *nau8825)
-{
-        struct snd_soc_dai *codec_dai = nau8825_get_codec_dai(nau8825);
-
-        if (codec_dai) {
-                if (codec_dai->playback_active || codec_dai->capture_active)
-                        return true;
-        }
-        return false;
-}
-
 /**
  * nau8825_sema_acquire - acquire the semaphore of nau88l25
  * @nau8825:  component to register the codec private data with
@@ -250,19 +225,26 @@ static bool nau8825_dai_is_active(struct nau8825 *nau8825)
  * Acquires the semaphore without jiffies. If no more tasks are allowed
  * to acquire the semaphore, calling this function will put the task to
  * sleep until the semaphore is released.
- * It returns if the semaphore was acquired.
+ * If the semaphore is not released within the specified number of jiffies,
+ * this function returns -ETIME.
+ * If the sleep is interrupted by a signal, this function will return -EINTR.
+ * It returns 0 if the semaphore was acquired successfully.
  */
-static void nau8825_sema_acquire(struct nau8825 *nau8825, long timeout)
+static int nau8825_sema_acquire(struct nau8825 *nau8825, long timeout)
 {
         int ret;
 
-        if (timeout)
+        if (timeout) {
                 ret = down_timeout(&nau8825->xtalk_sem, timeout);
-        else
+                if (ret < 0)
+                        dev_warn(nau8825->dev, "Acquire semaphone timeout\n");
+        } else {
                 ret = down_interruptible(&nau8825->xtalk_sem);
+                if (ret < 0)
+                        dev_warn(nau8825->dev, "Acquire semaphone fail\n");
+        }
 
-        if (ret < 0)
-                dev_warn(nau8825->dev, "Acquire semaphone fail\n");
+        return ret;
 }
 
 /**
@@ -1205,6 +1187,8 @@ static int nau8825_hw_params(struct snd_pcm_substream *substream,
         struct nau8825 *nau8825 = snd_soc_codec_get_drvdata(codec);
         unsigned int val_len = 0;
 
+        nau8825_sema_acquire(nau8825, 2 * HZ);
+
         switch (params_width(params)) {
         case 16:
                 val_len |= NAU8825_I2S_DL_16;
@@ -1225,6 +1209,9 @@ static int nau8825_hw_params(struct snd_pcm_substream *substream,
         regmap_update_bits(nau8825->regmap, NAU8825_REG_I2S_PCM_CTRL1,
                 NAU8825_I2S_DL_MASK, val_len);
 
+        /* Release the semaphone. */
+        nau8825_sema_release(nau8825);
+
         return 0;
 }
 
@@ -1234,6 +1221,8 @@ static int nau8825_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
         struct nau8825 *nau8825 = snd_soc_codec_get_drvdata(codec);
         unsigned int ctrl1_val = 0, ctrl2_val = 0;
 
+        nau8825_sema_acquire(nau8825, 2 * HZ);
+
         switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
         case SND_SOC_DAIFMT_CBM_CFM:
                 ctrl2_val |= NAU8825_I2S_MS_MASTER;
@@ -1282,6 +1271,9 @@ static int nau8825_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
         regmap_update_bits(nau8825->regmap, NAU8825_REG_I2S_PCM_CTRL2,
                 NAU8825_I2S_MS_MASK, ctrl2_val);
 
+        /* Release the semaphone. */
+        nau8825_sema_release(nau8825);
+
         return 0;
 }
 
@@ -1611,8 +1603,11 @@ static irqreturn_t nau8825_interrupt(int irq, void *data)
                                          * cess and restore changes if process
                                          * is ongoing when ejection.
                                          */
+                                        int ret;
                                         nau8825->xtalk_protect = true;
-                                        nau8825_sema_acquire(nau8825, 0);
+                                        ret = nau8825_sema_acquire(nau8825, 0);
+                                        if (ret < 0)
+                                                nau8825->xtalk_protect = false;
                                 }
                                 /* Startup cross talk detection process */
                                 nau8825->xtalk_state = NAU8825_XTALK_PREPARE;
@@ -2238,23 +2233,14 @@ static int __maybe_unused nau8825_suspend(struct snd_soc_codec *codec)
 static int __maybe_unused nau8825_resume(struct snd_soc_codec *codec)
 {
         struct nau8825 *nau8825 = snd_soc_codec_get_drvdata(codec);
+        int ret;
 
         regcache_cache_only(nau8825->regmap, false);
         regcache_sync(nau8825->regmap);
-        if (nau8825_is_jack_inserted(nau8825->regmap)) {
-                /* If the jack is inserted, we need to check whether the play-
-                 * back is active before suspend. If active, the driver has to
-                 * raise the protection for cross talk function to avoid the
-                 * playback recovers before cross talk process finish. Other-
-                 * wise, the playback will be interfered by cross talk func-
-                 * tion. It is better to apply hardware related parameters
-                 * before starting playback or record.
-                 */
-                if (nau8825_dai_is_active(nau8825)) {
-                        nau8825->xtalk_protect = true;
-                        nau8825_sema_acquire(nau8825, 0);
-                }
-        }
+        nau8825->xtalk_protect = true;
+        ret = nau8825_sema_acquire(nau8825, 0);
+        if (ret < 0)
+                nau8825->xtalk_protect = false;
         enable_irq(nau8825->irq);
 
         return 0;
diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
index a67ea10f41a1..f2664396be6f 100644
--- a/sound/soc/codecs/wm2000.c
+++ b/sound/soc/codecs/wm2000.c
@@ -581,7 +581,7 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000,
         if (anc_transitions[i].dest == ANC_OFF)
                 clk_disable_unprepare(wm2000->mclk);
 
-        return ret;
+        return 0;
 }
 
 static int wm2000_anc_set_mode(struct wm2000_priv *wm2000)
diff --git a/sound/soc/generic/Makefile b/sound/soc/generic/Makefile
index 45602ca8536e..2d53c8d70705 100644
--- a/sound/soc/generic/Makefile
+++ b/sound/soc/generic/Makefile
@@ -1,5 +1,5 @@
-obj-$(CONFIG_SND_SIMPLE_CARD_UTILS) := simple-card-utils.o
-
+snd-soc-simple-card-utils-objs  := simple-card-utils.o
 snd-soc-simple-card-objs        := simple-card.o
 
-obj-$(CONFIG_SND_SIMPLE_CARD)   += snd-soc-simple-card.o
+obj-$(CONFIG_SND_SIMPLE_CARD_UTILS)     += snd-soc-simple-card-utils.o
+obj-$(CONFIG_SND_SIMPLE_CARD)           += snd-soc-simple-card.o
diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c
index d89a9a1b2471..9599de69a880 100644
--- a/sound/soc/generic/simple-card-utils.c
+++ b/sound/soc/generic/simple-card-utils.c
@@ -7,6 +7,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#include <linux/module.h>
 #include <linux/of.h>
 #include <sound/simple_card_utils.h>
 
@@ -95,3 +96,8 @@ int asoc_simple_card_parse_card_name(struct snd_soc_card *card,
         return 0;
 }
 EXPORT_SYMBOL_GPL(asoc_simple_card_parse_card_name);
+
+/* Module information */
+MODULE_AUTHOR("Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>");
+MODULE_DESCRIPTION("ALSA SoC Simple Card Utils");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/intel/skylake/skl-sst-utils.c b/sound/soc/intel/skylake/skl-sst-utils.c
index 25fcb796bd86..ddcb52a51854 100644
--- a/sound/soc/intel/skylake/skl-sst-utils.c
+++ b/sound/soc/intel/skylake/skl-sst-utils.c
@@ -123,6 +123,11 @@ int snd_skl_get_module_info(struct skl_sst *ctx, u8 *uuid,
 
         uuid_mod = (uuid_le *)uuid;
 
+        if (list_empty(&ctx->uuid_list)) {
+                dev_err(ctx->dev, "Module list is empty\n");
+                return -EINVAL;
+        }
+
         list_for_each_entry(module, &ctx->uuid_list, list) {
                 if (uuid_le_cmp(*uuid_mod, module->uuid) == 0) {
                         dfw_config->module_id = module->id;
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index cd59536a761d..e3e764167765 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -672,8 +672,10 @@ static int skl_probe(struct pci_dev *pci,
 
         skl->nhlt = skl_nhlt_init(bus->dev);
 
-        if (skl->nhlt == NULL)
+        if (skl->nhlt == NULL) {
+                err = -ENODEV;
                 goto out_free;
+        }
 
         skl_nhlt_update_topology_bin(skl);
 
diff --git a/sound/soc/omap/omap-abe-twl6040.c b/sound/soc/omap/omap-abe-twl6040.c
index 0843a68f277c..f61b3b58083b 100644
--- a/sound/soc/omap/omap-abe-twl6040.c
+++ b/sound/soc/omap/omap-abe-twl6040.c
@@ -38,10 +38,10 @@
 struct abe_twl6040 {
         int     jack_detection; /* board can detect jack events */
         int     mclk_freq;      /* MCLK frequency speed for twl6040 */
-
-        struct platform_device *dmic_codec_dev;
 };
 
+struct platform_device *dmic_codec_dev;
+
 static int omap_abe_hw_params(struct snd_pcm_substream *substream,
         struct snd_pcm_hw_params *params)
 {
@@ -258,8 +258,6 @@ static int omap_abe_probe(struct platform_device *pdev)
         if (priv == NULL)
                 return -ENOMEM;
 
-        priv->dmic_codec_dev = ERR_PTR(-EINVAL);
-
         if (snd_soc_of_parse_card_name(card, "ti,model")) {
                 dev_err(&pdev->dev, "Card name is not provided\n");
                 return -ENODEV;
@@ -284,13 +282,6 @@ static int omap_abe_probe(struct platform_device *pdev)
                 num_links = 2;
                 abe_twl6040_dai_links[1].cpu_of_node = dai_node;
                 abe_twl6040_dai_links[1].platform_of_node = dai_node;
-
-                priv->dmic_codec_dev = platform_device_register_simple(
-                                                "dmic-codec", -1, NULL, 0);
-                if (IS_ERR(priv->dmic_codec_dev)) {
-                        dev_err(&pdev->dev, "Can't instantiate dmic-codec\n");
-                        return PTR_ERR(priv->dmic_codec_dev);
-                }
         } else {
                 num_links = 1;
         }
@@ -299,16 +290,14 @@ static int omap_abe_probe(struct platform_device *pdev)
         of_property_read_u32(node, "ti,mclk-freq", &priv->mclk_freq);
         if (!priv->mclk_freq) {
                 dev_err(&pdev->dev, "MCLK frequency not provided\n");
-                ret = -EINVAL;
-                goto err_unregister;
+                return -EINVAL;
         }
 
         card->fully_routed = 1;
 
         if (!priv->mclk_freq) {
                 dev_err(&pdev->dev, "MCLK frequency missing\n");
-                ret = -ENODEV;
-                goto err_unregister;
+                return -ENODEV;
         }
 
         card->dai_link = abe_twl6040_dai_links;
@@ -317,17 +306,9 @@ static int omap_abe_probe(struct platform_device *pdev)
         snd_soc_card_set_drvdata(card, priv);
 
         ret = snd_soc_register_card(card);
-        if (ret) {
+        if (ret)
                 dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
                         ret);
-                goto err_unregister;
-        }
-
-        return 0;
-
-err_unregister:
-        if (!IS_ERR(priv->dmic_codec_dev))
-                platform_device_unregister(priv->dmic_codec_dev);
 
         return ret;
 }
@@ -335,13 +316,9 @@ err_unregister:
 static int omap_abe_remove(struct platform_device *pdev)
 {
         struct snd_soc_card *card = platform_get_drvdata(pdev);
-        struct abe_twl6040 *priv = snd_soc_card_get_drvdata(card);
 
         snd_soc_unregister_card(card);
 
-        if (!IS_ERR(priv->dmic_codec_dev))
-                platform_device_unregister(priv->dmic_codec_dev);
-
         return 0;
 }
 
@@ -361,7 +338,33 @@ static struct platform_driver omap_abe_driver = {
         .remove = omap_abe_remove,
 };
 
-module_platform_driver(omap_abe_driver);
+static int __init omap_abe_init(void)
+{
+        int ret;
+
+        dmic_codec_dev = platform_device_register_simple("dmic-codec", -1, NULL,
+                                                         0);
+        if (IS_ERR(dmic_codec_dev)) {
+                pr_err("%s: dmic-codec device registration failed\n", __func__);
+                return PTR_ERR(dmic_codec_dev);
+        }
+
+        ret = platform_driver_register(&omap_abe_driver);
+        if (ret) {
+                pr_err("%s: platform driver registration failed\n", __func__);
+                platform_device_unregister(dmic_codec_dev);
+        }
+
+        return ret;
+}
+module_init(omap_abe_init);
+
+static void __exit omap_abe_exit(void)
+{
+        platform_driver_unregister(&omap_abe_driver);
+        platform_device_unregister(dmic_codec_dev);
+}
+module_exit(omap_abe_exit);
 
 MODULE_AUTHOR("Misael Lopez Cruz <misael.lopez@ti.com>");
 MODULE_DESCRIPTION("ALSA SoC for OMAP boards with ABE and twl6040 codec");
diff --git a/sound/soc/omap/omap-mcpdm.c b/sound/soc/omap/omap-mcpdm.c
index e7cdc51fd806..64609c77a79d 100644
--- a/sound/soc/omap/omap-mcpdm.c
+++ b/sound/soc/omap/omap-mcpdm.c
@@ -31,7 +31,6 @@
 #include <linux/err.h>
 #include <linux/io.h>
 #include <linux/irq.h>
-#include <linux/clk.h>
 #include <linux/slab.h>
 #include <linux/pm_runtime.h>
 #include <linux/of_device.h>
@@ -55,7 +54,6 @@ struct omap_mcpdm {
         unsigned long phys_base;
         void __iomem *io_base;
         int irq;
-        struct clk *pdmclk;
 
         struct mutex mutex;
 
@@ -390,15 +388,14 @@ static int omap_mcpdm_probe(struct snd_soc_dai *dai)
         struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
         int ret;
 
-        clk_prepare_enable(mcpdm->pdmclk);
         pm_runtime_enable(mcpdm->dev);
 
         /* Disable lines while request is ongoing */
         pm_runtime_get_sync(mcpdm->dev);
         omap_mcpdm_write(mcpdm, MCPDM_REG_CTRL, 0x00);
 
-        ret = devm_request_irq(mcpdm->dev, mcpdm->irq, omap_mcpdm_irq_handler,
-                                0, "McPDM", (void *)mcpdm);
+        ret = request_irq(mcpdm->irq, omap_mcpdm_irq_handler, 0, "McPDM",
+                          (void *)mcpdm);
 
         pm_runtime_put_sync(mcpdm->dev);
 
@@ -423,9 +420,9 @@ static int omap_mcpdm_remove(struct snd_soc_dai *dai)
 {
         struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
 
+        free_irq(mcpdm->irq, (void *)mcpdm);
         pm_runtime_disable(mcpdm->dev);
 
-        clk_disable_unprepare(mcpdm->pdmclk);
         return 0;
 }
 
@@ -445,8 +442,6 @@ static int omap_mcpdm_suspend(struct snd_soc_dai *dai)
                 mcpdm->pm_active_count++;
         }
 
-        clk_disable_unprepare(mcpdm->pdmclk);
-
         return 0;
 }
 
@@ -454,8 +449,6 @@ static int omap_mcpdm_resume(struct snd_soc_dai *dai)
 {
         struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
 
-        clk_prepare_enable(mcpdm->pdmclk);
-
         if (mcpdm->pm_active_count) {
                 while (mcpdm->pm_active_count--)
                         pm_runtime_get_sync(mcpdm->dev);
@@ -549,15 +542,6 @@ static int asoc_mcpdm_probe(struct platform_device *pdev)
 
         mcpdm->dev = &pdev->dev;
 
-        mcpdm->pdmclk = devm_clk_get(&pdev->dev, "pdmclk");
-        if (IS_ERR(mcpdm->pdmclk)) {
-                if (PTR_ERR(mcpdm->pdmclk) == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
-                dev_warn(&pdev->dev, "Error getting pdmclk (%ld)!\n",
-                         PTR_ERR(mcpdm->pdmclk));
-                mcpdm->pdmclk = NULL;
-        }
-
         ret =  devm_snd_soc_register_component(&pdev->dev,
                                                &omap_mcpdm_component,
                                                &omap_mcpdm_dai, 1);
diff --git a/sound/soc/samsung/s3c24xx_uda134x.c b/sound/soc/samsung/s3c24xx_uda134x.c
index 50849e137fc0..92e88bca386e 100644
--- a/sound/soc/samsung/s3c24xx_uda134x.c
+++ b/sound/soc/samsung/s3c24xx_uda134x.c
@@ -58,10 +58,12 @@ static struct platform_device *s3c24xx_uda134x_snd_device;
 
 static int s3c24xx_uda134x_startup(struct snd_pcm_substream *substream)
 {
-        int ret = 0;
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
 #ifdef ENFORCE_RATES
         struct snd_pcm_runtime *runtime = substream->runtime;
 #endif
+        int ret = 0;
 
         mutex_lock(&clk_lock);
         pr_debug("%s %d\n", __func__, clk_users);
@@ -71,8 +73,7 @@ static int s3c24xx_uda134x_startup(struct snd_pcm_substream *substream)
                         printk(KERN_ERR "%s cannot get xtal\n", __func__);
                         ret = PTR_ERR(xtal);
                 } else {
-                        pclk = clk_get(&s3c24xx_uda134x_snd_device->dev,
-                                       "pclk");
+                        pclk = clk_get(cpu_dai->dev, "iis");
                         if (IS_ERR(pclk)) {
                                 printk(KERN_ERR "%s cannot get pclk\n",
                                        __func__);
diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
index e39f916d0f2f..969a5169de25 100644
--- a/sound/soc/sh/rcar/src.c
+++ b/sound/soc/sh/rcar/src.c
@@ -226,8 +226,12 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
         ifscr = 0;
         fsrate = 0;
         if (fin != fout) {
+                u64 n;
+
                 ifscr = 1;
-                fsrate = 0x0400000 / fout * fin;
+                n = (u64)0x0400000 * fin;
+                do_div(n, fout);
+                fsrate = n;
         }
 
         /*
diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
index d2df46c14c68..bf7b52fce597 100644
--- a/sound/soc/soc-compress.c
+++ b/sound/soc/soc-compress.c
@@ -121,7 +121,7 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream)
 
                 dpcm_be_disconnect(fe, stream);
                 fe->dpcm[stream].runtime = NULL;
-                goto fe_err;
+                goto path_err;
         }
 
         dpcm_clear_pending_state(fe, stream);
@@ -136,6 +136,8 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream)
 
         return 0;
 
+path_err:
+        dpcm_path_put(&list);
 fe_err:
         if (fe->dai_link->compr_ops && fe->dai_link->compr_ops->shutdown)
                 fe->dai_link->compr_ops->shutdown(cstream);
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 16369cad4803..4afa8dba5e98 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1056,7 +1056,7 @@ static int soc_bind_dai_link(struct snd_soc_card *card,
         if (!rtd->platform) {
                 dev_err(card->dev, "ASoC: platform %s not registered\n",
                         dai_link->platform_name);
-                return -EPROBE_DEFER;
+                goto _err_defer;
         }
 
         soc_add_pcm_runtime(card, rtd);
@@ -2083,14 +2083,13 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card)
         /* remove auxiliary devices */
         soc_remove_aux_devices(card);
 
+        snd_soc_dapm_free(&card->dapm);
         soc_cleanup_card_debugfs(card);
 
         /* remove the card */
         if (card->remove)
                 card->remove(card);
 
-        snd_soc_dapm_free(&card->dapm);
-
         snd_card_free(card->snd_card);
         return 0;
 
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 8698c26773b3..d908ff8f9755 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3493,6 +3493,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
         const struct snd_soc_pcm_stream *config = w->params + w->params_select;
         struct snd_pcm_substream substream;
         struct snd_pcm_hw_params *params = NULL;
+        struct snd_pcm_runtime *runtime = NULL;
         u64 fmt;
         int ret;
 
@@ -3541,6 +3542,14 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
 
         memset(&substream, 0, sizeof(substream));
 
+        /* Allocate a dummy snd_pcm_runtime for startup() and other ops() */
+        runtime = kzalloc(sizeof(*runtime), GFP_KERNEL);
+        if (!runtime) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        substream.runtime = runtime;
+
         switch (event) {
         case SND_SOC_DAPM_PRE_PMU:
                 substream.stream = SNDRV_PCM_STREAM_CAPTURE;
@@ -3606,6 +3615,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
         }
 
 out:
+        kfree(runtime);
         kfree(params);
         return ret;
 }
diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
index 204cc074adb9..41aa3355e920 100644
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -55,7 +55,6 @@ static int snd_line6_impulse_volume_put(struct snd_kcontrol *kcontrol,
                 err = line6_pcm_acquire(line6pcm, LINE6_STREAM_IMPULSE);
                 if (err < 0) {
                         line6pcm->impulse_volume = 0;
-                        line6_pcm_release(line6pcm, LINE6_STREAM_IMPULSE);
                         return err;
                 }
         } else {
@@ -211,7 +210,9 @@ static void line6_stream_stop(struct snd_line6_pcm *line6pcm, int direction,
         spin_lock_irqsave(&pstr->lock, flags);
         clear_bit(type, &pstr->running);
         if (!pstr->running) {
+                spin_unlock_irqrestore(&pstr->lock, flags);
                 line6_unlink_audio_urbs(line6pcm, pstr);
+                spin_lock_irqsave(&pstr->lock, flags);
                 if (direction == SNDRV_PCM_STREAM_CAPTURE) {
                         line6pcm->prev_fbuf = NULL;
                         line6pcm->prev_fsize = 0;
diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c
index daf81d169a42..45dd34874f43 100644
--- a/sound/usb/line6/pod.c
+++ b/sound/usb/line6/pod.c
@@ -244,8 +244,8 @@ static int pod_set_system_param_int(struct usb_line6_pod *pod, int value,
 static ssize_t serial_number_show(struct device *dev,
                                   struct device_attribute *attr, char *buf)
 {
-        struct usb_interface *interface = to_usb_interface(dev);
-        struct usb_line6_pod *pod = usb_get_intfdata(interface);
+        struct snd_card *card = dev_to_snd_card(dev);
+        struct usb_line6_pod *pod = card->private_data;
 
         return sprintf(buf, "%u\n", pod->serial_number);
 }
@@ -256,8 +256,8 @@ static ssize_t serial_number_show(struct device *dev,
 static ssize_t firmware_version_show(struct device *dev,
                                      struct device_attribute *attr, char *buf)
 {
-        struct usb_interface *interface = to_usb_interface(dev);
-        struct usb_line6_pod *pod = usb_get_intfdata(interface);
+        struct snd_card *card = dev_to_snd_card(dev);
+        struct usb_line6_pod *pod = card->private_data;
 
         return sprintf(buf, "%d.%02d\n", pod->firmware_version / 100,
                        pod->firmware_version % 100);
@@ -269,8 +269,8 @@ static ssize_t firmware_version_show(struct device *dev,
 static ssize_t device_id_show(struct device *dev,
                               struct device_attribute *attr, char *buf)
 {
-        struct usb_interface *interface = to_usb_interface(dev);
-        struct usb_line6_pod *pod = usb_get_intfdata(interface);
+        struct snd_card *card = dev_to_snd_card(dev);
+        struct usb_line6_pod *pod = card->private_data;
 
         return sprintf(buf, "%d\n", pod->device_id);
 }
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 6cf1f3597455..152292e5ee2b 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1141,6 +1141,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
         case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
         case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
         case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
+        case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
         case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
         case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
         case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */
diff --git a/tools/gpio/gpio-event-mon.c b/tools/gpio/gpio-event-mon.c
index 448ed96b3b4f..1c14c2595158 100644
--- a/tools/gpio/gpio-event-mon.c
+++ b/tools/gpio/gpio-event-mon.c
@@ -1,5 +1,5 @@
 /*
- * gpio-hammer - example swiss army knife to shake GPIO lines on a system
+ * gpio-event-mon - monitor GPIO line events from userspace
  *
  * Copyright (C) 2016 Linus Walleij
  *
diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
index 0e8a1f7a292d..f39c0e9c0d5c 100644
--- a/tools/iio/iio_generic_buffer.c
+++ b/tools/iio/iio_generic_buffer.c
@@ -348,7 +348,7 @@ int main(int argc, char **argv)
         int notrigger = 0;
         char *dummy;
 
-        struct iio_channel_info *channels;
+        struct iio_channel_info *channels = NULL;
 
         register_cleanup();
 
@@ -456,7 +456,7 @@ int main(int argc, char **argv)
 
         if (notrigger) {
                 printf("trigger-less mode selected\n");
-        } if (trig_num >= 0) {
+        } else if (trig_num >= 0) {
                 char *trig_dev_name;
                 ret = asprintf(&trig_dev_name, "%strigger%d", iio_dir, trig_num);
                 if (ret < 0) {
diff --git a/tools/include/linux/string.h b/tools/include/linux/string.h
index b96879477311..f436d2420a18 100644
--- a/tools/include/linux/string.h
+++ b/tools/include/linux/string.h
@@ -8,7 +8,11 @@ void *memdup(const void *src, size_t len);
 
 int strtobool(const char *s, bool *res);
 
-#ifdef __GLIBC__
+/*
+ * glibc based builds needs the extern while uClibc doesn't.
+ * However uClibc headers also define __GLIBC__ hence the hack below
+ */
+#if defined(__GLIBC__) && !defined(__UCLIBC__)
 extern size_t strlcpy(char *dest, const char *src, size_t size);
 #endif
 
diff --git a/tools/lguest/lguest.c b/tools/lguest/lguest.c
index d9836c5eb694..11c8d9bc762e 100644
--- a/tools/lguest/lguest.c
+++ b/tools/lguest/lguest.c
@@ -3266,6 +3266,9 @@ int main(int argc, char *argv[])
                 }
         }
 
+        /* If we exit via err(), this kills all the threads, restores tty. */
+        atexit(cleanup_devices);
+
         /* We always have a console device, and it's always device 1. */
         setup_console();
 
@@ -3369,9 +3372,6 @@ int main(int argc, char *argv[])
         /* Ensure that we terminate if a device-servicing child dies. */
         signal(SIGCHLD, kill_launcher);
 
-        /* If we exit via err(), this kills all the threads, restores tty. */
-        atexit(cleanup_devices);
-
         /* If requested, chroot to a directory */
         if (chroot_path) {
                 if (chroot(chroot_path) != 0)
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index d9b80ef881cd..21fd573106ed 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -507,17 +507,17 @@ static int __perf_evsel__hw_cache_name(u64 config, char *bf, size_t size)
         u8 op, result, type = (config >>  0) & 0xff;
         const char *err = "unknown-ext-hardware-cache-type";
 
-        if (type > PERF_COUNT_HW_CACHE_MAX)
+        if (type >= PERF_COUNT_HW_CACHE_MAX)
                 goto out_err;
 
         op = (config >>  8) & 0xff;
         err = "unknown-ext-hardware-cache-op";
-        if (op > PERF_COUNT_HW_CACHE_OP_MAX)
+        if (op >= PERF_COUNT_HW_CACHE_OP_MAX)
                 goto out_err;
 
         result = (config >> 16) & 0xff;
         err = "unknown-ext-hardware-cache-result";
-        if (result > PERF_COUNT_HW_CACHE_RESULT_MAX)
+        if (result >= PERF_COUNT_HW_CACHE_RESULT_MAX)
                 goto out_err;
 
         err = "invalid-cache";
diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
index cf5e250bc78e..783a53fb7a4e 100644
--- a/tools/perf/util/unwind-libdw.c
+++ b/tools/perf/util/unwind-libdw.c
@@ -66,7 +66,7 @@ static int entry(u64 ip, struct unwind_info *ui)
         if (__report_module(&al, ip, ui))
                 return -1;
 
-        e->ip  = ip;
+        e->ip  = al.addr;
         e->map = al.map;
         e->sym = al.sym;
 
diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c
index 97c0f8fc5561..20c2e5743903 100644
--- a/tools/perf/util/unwind-libunwind-local.c
+++ b/tools/perf/util/unwind-libunwind-local.c
@@ -542,7 +542,7 @@ static int entry(u64 ip, struct thread *thread,
         thread__find_addr_location(thread, PERF_RECORD_MISC_USER,
                                    MAP__FUNCTION, ip, &al);
 
-        e.ip = ip;
+        e.ip = al.addr;
         e.map = al.map;
         e.sym = al.sym;
 
diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
index 4fde8c7dfcfe..77e6ccf14901 100644
--- a/virt/kvm/arm/arch_timer.c
+++ b/virt/kvm/arm/arch_timer.c
@@ -33,6 +33,7 @@
 static struct timecounter *timecounter;
 static struct workqueue_struct *wqueue;
 static unsigned int host_vtimer_irq;
+static u32 host_vtimer_irq_flags;
 
 void kvm_timer_vcpu_put(struct kvm_vcpu *vcpu)
 {
@@ -365,7 +366,7 @@ void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu)
 
 static void kvm_timer_init_interrupt(void *info)
 {
-        enable_percpu_irq(host_vtimer_irq, 0);
+        enable_percpu_irq(host_vtimer_irq, host_vtimer_irq_flags);
 }
 
 int kvm_arm_timer_set_reg(struct kvm_vcpu *vcpu, u64 regid, u64 value)
@@ -432,6 +433,14 @@ int kvm_timer_hyp_init(void)
         }
         host_vtimer_irq = info->virtual_irq;
 
+        host_vtimer_irq_flags = irq_get_trigger_type(host_vtimer_irq);
+        if (host_vtimer_irq_flags != IRQF_TRIGGER_HIGH &&
+            host_vtimer_irq_flags != IRQF_TRIGGER_LOW) {
+                kvm_err("Invalid trigger for IRQ%d, assuming level low\n",
+                        host_vtimer_irq);
+                host_vtimer_irq_flags = IRQF_TRIGGER_LOW;
+        }
+
         err = request_percpu_irq(host_vtimer_irq, kvm_arch_timer_handler,
                                  "kvm guest timer", kvm_get_running_vcpus());
         if (err) {
diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
index 07411cf967b9..4660a7d04eea 100644
--- a/virt/kvm/arm/vgic/vgic-its.c
+++ b/virt/kvm/arm/vgic/vgic-its.c
@@ -51,7 +51,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid)
 
         irq = kzalloc(sizeof(struct vgic_irq), GFP_KERNEL);
         if (!irq)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         INIT_LIST_HEAD(&irq->lpi_list);
         INIT_LIST_HEAD(&irq->ap_list);
@@ -441,39 +441,63 @@ static unsigned long vgic_mmio_read_its_idregs(struct kvm *kvm,
  * Find the target VCPU and the LPI number for a given devid/eventid pair
  * and make this IRQ pending, possibly injecting it.
  * Must be called with the its_lock mutex held.
+ * Returns 0 on success, a positive error value for any ITS mapping
+ * related errors and negative error values for generic errors.
  */
-static void vgic_its_trigger_msi(struct kvm *kvm, struct vgic_its *its,
-                                 u32 devid, u32 eventid)
+static int vgic_its_trigger_msi(struct kvm *kvm, struct vgic_its *its,
+                                u32 devid, u32 eventid)
 {
+        struct kvm_vcpu *vcpu;
         struct its_itte *itte;
 
         if (!its->enabled)
-                return;
+                return -EBUSY;
 
         itte = find_itte(its, devid, eventid);
-        /* Triggering an unmapped IRQ gets silently dropped. */
-        if (itte && its_is_collection_mapped(itte->collection)) {
-                struct kvm_vcpu *vcpu;
-
-                vcpu = kvm_get_vcpu(kvm, itte->collection->target_addr);
-                if (vcpu && vcpu->arch.vgic_cpu.lpis_enabled) {
-                        spin_lock(&itte->irq->irq_lock);
-                        itte->irq->pending = true;
-                        vgic_queue_irq_unlock(kvm, itte->irq);
-                }
-        }
+        if (!itte || !its_is_collection_mapped(itte->collection))
+                return E_ITS_INT_UNMAPPED_INTERRUPT;
+
+        vcpu = kvm_get_vcpu(kvm, itte->collection->target_addr);
+        if (!vcpu)
+                return E_ITS_INT_UNMAPPED_INTERRUPT;
+
+        if (!vcpu->arch.vgic_cpu.lpis_enabled)
+                return -EBUSY;
+
+        spin_lock(&itte->irq->irq_lock);
+        itte->irq->pending = true;
+        vgic_queue_irq_unlock(kvm, itte->irq);
+
+        return 0;
+}
+
+static struct vgic_io_device *vgic_get_its_iodev(struct kvm_io_device *dev)
+{
+        struct vgic_io_device *iodev;
+
+        if (dev->ops != &kvm_io_gic_ops)
+                return NULL;
+
+        iodev = container_of(dev, struct vgic_io_device, dev);
+
+        if (iodev->iodev_type != IODEV_ITS)
+                return NULL;
+
+        return iodev;
 }
 
 /*
  * Queries the KVM IO bus framework to get the ITS pointer from the given
  * doorbell address.
  * We then call vgic_its_trigger_msi() with the decoded data.
+ * According to the KVM_SIGNAL_MSI API description returns 1 on success.
  */
 int vgic_its_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
 {
         u64 address;
         struct kvm_io_device *kvm_io_dev;
         struct vgic_io_device *iodev;
+        int ret;
 
         if (!vgic_has_its(kvm))
                 return -ENODEV;
@@ -485,15 +509,28 @@ int vgic_its_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
 
         kvm_io_dev = kvm_io_bus_get_dev(kvm, KVM_MMIO_BUS, address);
         if (!kvm_io_dev)
-                return -ENODEV;
+                return -EINVAL;
 
-        iodev = container_of(kvm_io_dev, struct vgic_io_device, dev);
+        iodev = vgic_get_its_iodev(kvm_io_dev);
+        if (!iodev)
+                return -EINVAL;
 
         mutex_lock(&iodev->its->its_lock);
-        vgic_its_trigger_msi(kvm, iodev->its, msi->devid, msi->data);
+        ret = vgic_its_trigger_msi(kvm, iodev->its, msi->devid, msi->data);
         mutex_unlock(&iodev->its->its_lock);
 
-        return 0;
+        if (ret < 0)
+                return ret;
+
+        /*
+         * KVM_SIGNAL_MSI demands a return value > 0 for success and 0
+         * if the guest has blocked the MSI. So we map any LPI mapping
+         * related error to that.
+         */
+        if (ret)
+                return 0;
+        else
+                return 1;
 }
 
 /* Requires the its_lock to be held. */
@@ -502,7 +539,8 @@ static void its_free_itte(struct kvm *kvm, struct its_itte *itte)
         list_del(&itte->itte_list);
 
         /* This put matches the get in vgic_add_lpi. */
-        vgic_put_irq(kvm, itte->irq);
+        if (itte->irq)
+                vgic_put_irq(kvm, itte->irq);
 
         kfree(itte);
 }
@@ -697,6 +735,7 @@ static int vgic_its_cmd_handle_mapi(struct kvm *kvm, struct vgic_its *its,
         struct its_device *device;
         struct its_collection *collection, *new_coll = NULL;
         int lpi_nr;
+        struct vgic_irq *irq;
 
         device = find_its_device(its, device_id);
         if (!device)
@@ -710,6 +749,10 @@ static int vgic_its_cmd_handle_mapi(struct kvm *kvm, struct vgic_its *its,
             lpi_nr >= max_lpis_propbaser(kvm->arch.vgic.propbaser))
                 return E_ITS_MAPTI_PHYSICALID_OOR;
 
+        /* If there is an existing mapping, behavior is UNPREDICTABLE. */
+        if (find_itte(its, device_id, event_id))
+                return 0;
+
         collection = find_collection(its, coll_id);
         if (!collection) {
                 int ret = vgic_its_alloc_collection(its, &collection, coll_id);
@@ -718,22 +761,28 @@ static int vgic_its_cmd_handle_mapi(struct kvm *kvm, struct vgic_its *its,
                 new_coll = collection;
         }
 
-        itte = find_itte(its, device_id, event_id);
+        itte = kzalloc(sizeof(struct its_itte), GFP_KERNEL);
         if (!itte) {
-                itte = kzalloc(sizeof(struct its_itte), GFP_KERNEL);
-                if (!itte) {
-                        if (new_coll)
-                                vgic_its_free_collection(its, coll_id);
-                        return -ENOMEM;
-                }
-
-                itte->event_id  = event_id;
-                list_add_tail(&itte->itte_list, &device->itt_head);
+                if (new_coll)
+                        vgic_its_free_collection(its, coll_id);
+                return -ENOMEM;
         }
 
+        itte->event_id  = event_id;
+        list_add_tail(&itte->itte_list, &device->itt_head);
+
         itte->collection = collection;
         itte->lpi = lpi_nr;
-        itte->irq = vgic_add_lpi(kvm, lpi_nr);
+
+        irq = vgic_add_lpi(kvm, lpi_nr);
+        if (IS_ERR(irq)) {
+                if (new_coll)
+                        vgic_its_free_collection(its, coll_id);
+                its_free_itte(kvm, itte);
+                return PTR_ERR(irq);
+        }
+        itte->irq = irq;
+
         update_affinity_itte(kvm, itte);
 
         /*
@@ -981,9 +1030,7 @@ static int vgic_its_cmd_handle_int(struct kvm *kvm, struct vgic_its *its,
         u32 msi_data = its_cmd_get_id(its_cmd);
         u64 msi_devid = its_cmd_get_deviceid(its_cmd);
 
-        vgic_its_trigger_msi(kvm, its, msi_devid, msi_data);
-
-        return 0;
+        return vgic_its_trigger_msi(kvm, its, msi_devid, msi_data);
 }
 
 /*
@@ -1288,13 +1335,13 @@ void vgic_enable_lpis(struct kvm_vcpu *vcpu)
                 its_sync_lpi_pending_table(vcpu);
 }
 
-static int vgic_its_init_its(struct kvm *kvm, struct vgic_its *its)
+static int vgic_register_its_iodev(struct kvm *kvm, struct vgic_its *its)
 {
         struct vgic_io_device *iodev = &its->iodev;
         int ret;
 
-        if (its->initialized)
-                return 0;
+        if (!its->initialized)
+                return -EBUSY;
 
         if (IS_VGIC_ADDR_UNDEF(its->vgic_its_base))
                 return -ENXIO;
@@ -1311,9 +1358,6 @@ static int vgic_its_init_its(struct kvm *kvm, struct vgic_its *its)
                                       KVM_VGIC_V3_ITS_SIZE, &iodev->dev);
         mutex_unlock(&kvm->slots_lock);
 
-        if (!ret)
-                its->initialized = true;
-
         return ret;
 }
 
@@ -1435,9 +1479,6 @@ static int vgic_its_set_attr(struct kvm_device *dev,
                 if (type != KVM_VGIC_ITS_ADDR_TYPE)
                         return -ENODEV;
 
-                if (its->initialized)
-                        return -EBUSY;
-
                 if (copy_from_user(&addr, uaddr, sizeof(addr)))
                         return -EFAULT;
 
@@ -1453,7 +1494,9 @@ static int vgic_its_set_attr(struct kvm_device *dev,
         case KVM_DEV_ARM_VGIC_GRP_CTRL:
                 switch (attr->attr) {
                 case KVM_DEV_ARM_VGIC_CTRL_INIT:
-                        return vgic_its_init_its(dev->kvm, its);
+                        its->initialized = true;
+
+                        return 0;
                 }
                 break;
         }
@@ -1498,3 +1541,30 @@ int kvm_vgic_register_its_device(void)
         return kvm_register_device_ops(&kvm_arm_vgic_its_ops,
                                        KVM_DEV_TYPE_ARM_VGIC_ITS);
 }
+
+/*
+ * Registers all ITSes with the kvm_io_bus framework.
+ * To follow the existing VGIC initialization sequence, this has to be
+ * done as late as possible, just before the first VCPU runs.
+ */
+int vgic_register_its_iodevs(struct kvm *kvm)
+{
+        struct kvm_device *dev;
+        int ret = 0;
+
+        list_for_each_entry(dev, &kvm->devices, vm_node) {
+                if (dev->ops != &kvm_arm_vgic_its_ops)
+                        continue;
+
+                ret = vgic_register_its_iodev(kvm, dev->private);
+                if (ret)
+                        return ret;
+                /*
+                 * We don't need to care about tearing down previously
+                 * registered ITSes, as the kvm_io_bus framework removes
+                 * them for us if the VM gets destroyed.
+                 */
+        }
+
+        return ret;
+}
diff --git a/virt/kvm/arm/vgic/vgic-mmio-v3.c b/virt/kvm/arm/vgic/vgic-mmio-v3.c
index ff668e0dd586..90d81811fdda 100644
--- a/virt/kvm/arm/vgic/vgic-mmio-v3.c
+++ b/virt/kvm/arm/vgic/vgic-mmio-v3.c
@@ -306,16 +306,19 @@ static void vgic_mmio_write_propbase(struct kvm_vcpu *vcpu,
 {
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
         struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
-        u64 propbaser = dist->propbaser;
+        u64 old_propbaser, propbaser;
 
         /* Storing a value with LPIs already enabled is undefined */
         if (vgic_cpu->lpis_enabled)
                 return;
 
-        propbaser = update_64bit_reg(propbaser, addr & 4, len, val);
-        propbaser = vgic_sanitise_propbaser(propbaser);
-
-        dist->propbaser = propbaser;
+        do {
+                old_propbaser = dist->propbaser;
+                propbaser = old_propbaser;
+                propbaser = update_64bit_reg(propbaser, addr & 4, len, val);
+                propbaser = vgic_sanitise_propbaser(propbaser);
+        } while (cmpxchg64(&dist->propbaser, old_propbaser,
+                           propbaser) != old_propbaser);
 }
 
 static unsigned long vgic_mmio_read_pendbase(struct kvm_vcpu *vcpu,
@@ -331,16 +334,19 @@ static void vgic_mmio_write_pendbase(struct kvm_vcpu *vcpu,
                                      unsigned long val)
 {
         struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
-        u64 pendbaser = vgic_cpu->pendbaser;
+        u64 old_pendbaser, pendbaser;
 
         /* Storing a value with LPIs already enabled is undefined */
         if (vgic_cpu->lpis_enabled)
                 return;
 
-        pendbaser = update_64bit_reg(pendbaser, addr & 4, len, val);
-        pendbaser = vgic_sanitise_pendbaser(pendbaser);
-
-        vgic_cpu->pendbaser = pendbaser;
+        do {
+                old_pendbaser = vgic_cpu->pendbaser;
+                pendbaser = old_pendbaser;
+                pendbaser = update_64bit_reg(pendbaser, addr & 4, len, val);
+                pendbaser = vgic_sanitise_pendbaser(pendbaser);
+        } while (cmpxchg64(&vgic_cpu->pendbaser, old_pendbaser,
+                           pendbaser) != old_pendbaser);
 }
 
 /*
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 0506543df38a..9f0dae397d9c 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -289,6 +289,14 @@ int vgic_v3_map_resources(struct kvm *kvm)
                 goto out;
         }
 
+        if (vgic_has_its(kvm)) {
+                ret = vgic_register_its_iodevs(kvm);
+                if (ret) {
+                        kvm_err("Unable to register VGIC ITS MMIO regions\n");
+                        goto out;
+                }
+        }
+
         dist->ready = true;
 
 out:
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index e7aeac719e09..e83b7fe4baae 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -117,17 +117,17 @@ static void vgic_irq_release(struct kref *ref)
 
 void vgic_put_irq(struct kvm *kvm, struct vgic_irq *irq)
 {
-        struct vgic_dist *dist;
+        struct vgic_dist *dist = &kvm->arch.vgic;
 
         if (irq->intid < VGIC_MIN_LPI)
                 return;
 
-        if (!kref_put(&irq->refcount, vgic_irq_release))
+        spin_lock(&dist->lpi_list_lock);
+        if (!kref_put(&irq->refcount, vgic_irq_release)) {
+                spin_unlock(&dist->lpi_list_lock);
                 return;
+        };
 
-        dist = &kvm->arch.vgic;
-
-        spin_lock(&dist->lpi_list_lock);
         list_del(&irq->lpi_list);
         dist->lpi_list_count--;
         spin_unlock(&dist->lpi_list_lock);
diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h
index 1d8e21d5c13f..6c4625c46368 100644
--- a/virt/kvm/arm/vgic/vgic.h
+++ b/virt/kvm/arm/vgic/vgic.h
@@ -84,6 +84,7 @@ void vgic_v3_enable(struct kvm_vcpu *vcpu);
 int vgic_v3_probe(const struct gic_kvm_info *info);
 int vgic_v3_map_resources(struct kvm *kvm);
 int vgic_register_redist_iodevs(struct kvm *kvm, gpa_t dist_base_address);
+int vgic_register_its_iodevs(struct kvm *kvm);
 bool vgic_has_its(struct kvm *kvm);
 int kvm_vgic_register_its_device(void);
 void vgic_enable_lpis(struct kvm_vcpu *vcpu);
@@ -140,6 +141,11 @@ static inline int vgic_register_redist_iodevs(struct kvm *kvm,
         return -ENODEV;
 }
 
+static inline int vgic_register_its_iodevs(struct kvm *kvm)
+{
+        return -ENODEV;
+}
+
 static inline bool vgic_has_its(struct kvm *kvm)
 {
         return false;