312 files changed, 2622 insertions, 1594 deletions

diff --git a/Documentation/devicetree/bindings/mtd/tango-nand.txt b/Documentation/devicetree/bindings/mtd/tango-nand.txt
index ad5a02f2ac8c..cd1bf2ac9055 100644
--- a/Documentation/devicetree/bindings/mtd/tango-nand.txt
+++ b/Documentation/devicetree/bindings/mtd/tango-nand.txt
@@ -5,7 +5,7 @@ Required properties:
 - compatible: "sigma,smp8758-nand"
 - reg: address/size of nfc_reg, nfc_mem, and pbus_reg
 - dmas: reference to the DMA channel used by the controller
-- dma-names: "nfc_sbox"
+- dma-names: "rxtx"
 - clocks: reference to the system clock
 - #address-cells: <1>
 - #size-cells: <0>
@@ -17,9 +17,9 @@ Example:
 
         nandc: nand-controller@2c000 {
                 compatible = "sigma,smp8758-nand";
-                reg = <0x2c000 0x30 0x2d000 0x800 0x20000 0x1000>;
+                reg = <0x2c000 0x30>, <0x2d000 0x800>, <0x20000 0x1000>;
                 dmas = <&dma0 3>;
-                dma-names = "nfc_sbox";
+                dma-names = "rxtx";
                 clocks = <&clkgen SYS_CLK>;
                 #address-cells = <1>;
                 #size-cells = <0>;
diff --git a/Documentation/devicetree/bindings/net/ti,dp83867.txt b/Documentation/devicetree/bindings/net/ti,dp83867.txt
index 85bf945b898f..afe9630a5e7d 100644
--- a/Documentation/devicetree/bindings/net/ti,dp83867.txt
+++ b/Documentation/devicetree/bindings/net/ti,dp83867.txt
@@ -3,9 +3,11 @@
 Required properties:
         - reg - The ID number for the phy, usually a small integer
         - ti,rx-internal-delay - RGMII Receive Clock Delay - see dt-bindings/net/ti-dp83867.h
-                for applicable values
+                for applicable values. Required only if interface type is
+                PHY_INTERFACE_MODE_RGMII_ID or PHY_INTERFACE_MODE_RGMII_RXID
         - ti,tx-internal-delay - RGMII Transmit Clock Delay - see dt-bindings/net/ti-dp83867.h
-                for applicable values
+                for applicable values. Required only if interface type is
+                PHY_INTERFACE_MODE_RGMII_ID or PHY_INTERFACE_MODE_RGMII_TXID
         - ti,fifo-depth - Transmitt FIFO depth- see dt-bindings/net/ti-dp83867.h
                 for applicable values
 
diff --git a/Documentation/devicetree/bindings/spi/sh-msiof.txt b/Documentation/devicetree/bindings/spi/sh-msiof.txt
index da6614c63796..dc975064fa27 100644
--- a/Documentation/devicetree/bindings/spi/sh-msiof.txt
+++ b/Documentation/devicetree/bindings/spi/sh-msiof.txt
@@ -1,17 +1,23 @@
 Renesas MSIOF spi controller
 
 Required properties:
-- compatible           : "renesas,msiof-<soctype>" for SoCs,
-                         "renesas,sh-msiof" for SuperH, or
-                         "renesas,sh-mobile-msiof" for SH Mobile series.
-                         Examples with soctypes are:
-                         "renesas,msiof-r8a7790" (R-Car H2)
+- compatible           : "renesas,msiof-r8a7790" (R-Car H2)
                          "renesas,msiof-r8a7791" (R-Car M2-W)
                          "renesas,msiof-r8a7792" (R-Car V2H)
                          "renesas,msiof-r8a7793" (R-Car M2-N)
                          "renesas,msiof-r8a7794" (R-Car E2)
                          "renesas,msiof-r8a7796" (R-Car M3-W)
                          "renesas,msiof-sh73a0" (SH-Mobile AG5)
+                         "renesas,sh-mobile-msiof" (generic SH-Mobile compatibile device)
+                         "renesas,rcar-gen2-msiof" (generic R-Car Gen2 compatible device)
+                         "renesas,rcar-gen3-msiof" (generic R-Car Gen3 compatible device)
+                         "renesas,sh-msiof"      (deprecated)
+
+                         When compatible with the generic version, nodes
+                         must list the SoC-specific version corresponding
+                         to the platform first followed by the generic
+                         version.
+
 - reg                  : A list of offsets and lengths of the register sets for
                          the device.
                          If only one register set is present, it is to be used
@@ -61,7 +67,8 @@ Documentation/devicetree/bindings/pinctrl/renesas,*.
 Example:
 
         msiof0: spi@e6e20000 {
-                compatible = "renesas,msiof-r8a7791";
+                compatible = "renesas,msiof-r8a7791",
+                             "renesas,rcar-gen2-msiof";
                 reg = <0 0xe6e20000 0 0x0064>;
                 interrupts = <0 156 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&mstp0_clks R8A7791_CLK_MSIOF0>;
diff --git a/MAINTAINERS b/MAINTAINERS
index c36976d3bd1a..2fd11b439ab3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -976,6 +976,7 @@ M:	Russell King <linux@armlinux.org.uk>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.armlinux.org.uk/
 S:      Maintained
+T:      git git://git.armlinux.org.uk/~rmk/linux-arm.git
 F:      arch/arm/
 
 ARM SUB-ARCHITECTURES
@@ -1153,6 +1154,7 @@ ARM/CLKDEV SUPPORT
 M:      Russell King <linux@armlinux.org.uk>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
+T:      git git://git.armlinux.org.uk/~rmk/linux-arm.git clkdev
 F:      arch/arm/include/asm/clkdev.h
 F:      drivers/clk/clkdev.c
 
@@ -1688,6 +1690,7 @@ M:	Krzysztof Kozlowski <krzk@kernel.org>
 R:      Javier Martinez Canillas <javier@osg.samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
+Q:      https://patchwork.kernel.org/project/linux-samsung-soc/list/
 S:      Maintained
 F:      arch/arm/boot/dts/s3c*
 F:      arch/arm/boot/dts/s5p*
@@ -4097,12 +4100,18 @@ F:	drivers/gpu/drm/bridge/
 
 DRM DRIVER FOR BOCHS VIRTUAL GPU
 M:      Gerd Hoffmann <kraxel@redhat.com>
-S:      Odd Fixes
+L:      virtualization@lists.linux-foundation.org
+T:      git git://git.kraxel.org/linux drm-qemu
+S:      Maintained
 F:      drivers/gpu/drm/bochs/
 
 DRM DRIVER FOR QEMU'S CIRRUS DEVICE
 M:      Dave Airlie <airlied@redhat.com>
-S:      Odd Fixes
+M:      Gerd Hoffmann <kraxel@redhat.com>
+L:      virtualization@lists.linux-foundation.org
+T:      git git://git.kraxel.org/linux drm-qemu
+S:      Obsolete
+W:      https://www.kraxel.org/blog/2014/10/qemu-using-cirrus-considered-harmful/
 F:      drivers/gpu/drm/cirrus/
 
 RADEON and AMDGPU DRM DRIVERS
@@ -4295,7 +4304,10 @@ F:	Documentation/devicetree/bindings/display/renesas,du.txt
 
 DRM DRIVER FOR QXL VIRTUAL GPU
 M:      Dave Airlie <airlied@redhat.com>
-S:      Odd Fixes
+M:      Gerd Hoffmann <kraxel@redhat.com>
+L:      virtualization@lists.linux-foundation.org
+T:      git git://git.kraxel.org/linux drm-qemu
+S:      Maintained
 F:      drivers/gpu/drm/qxl/
 F:      include/uapi/drm/qxl_drm.h
 
@@ -7697,8 +7709,10 @@ F:	drivers/net/dsa/mv88e6xxx/
 F:      Documentation/devicetree/bindings/net/dsa/marvell.txt
 
 MARVELL ARMADA DRM SUPPORT
-M:      Russell King <rmk+kernel@armlinux.org.uk>
+M:      Russell King <linux@armlinux.org.uk>
 S:      Maintained
+T:      git git://git.armlinux.org.uk/~rmk/linux-arm.git drm-armada-devel
+T:      git git://git.armlinux.org.uk/~rmk/linux-arm.git drm-armada-fixes
 F:      drivers/gpu/drm/armada/
 F:      include/uapi/drm/armada_drm.h
 F:      Documentation/devicetree/bindings/display/armada/
@@ -8903,8 +8917,10 @@ S:	Supported
 F:      drivers/nfc/nxp-nci
 
 NXP TDA998X DRM DRIVER
-M:      Russell King <rmk+kernel@armlinux.org.uk>
+M:      Russell King <linux@armlinux.org.uk>
 S:      Supported
+T:      git git://git.armlinux.org.uk/~rmk/linux-arm.git drm-tda998x-devel
+T:      git git://git.armlinux.org.uk/~rmk/linux-arm.git drm-tda998x-fixes
 F:      drivers/gpu/drm/i2c/tda998x_drv.c
 F:      include/drm/i2c/tda998x.h
 
@@ -13085,6 +13101,7 @@ M:	David Airlie <airlied@linux.ie>
 M:      Gerd Hoffmann <kraxel@redhat.com>
 L:      dri-devel@lists.freedesktop.org
 L:      virtualization@lists.linux-foundation.org
+T:      git git://git.kraxel.org/linux drm-qemu
 S:      Maintained
 F:      drivers/gpu/drm/virtio/
 F:      include/uapi/linux/virtio_gpu.h
diff --git a/Makefile b/Makefile
index 96e2352d10a8..098840012b9b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 4
 PATCHLEVEL = 10
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
-NAME = Roaring Lionus
+EXTRAVERSION = -rc5
+NAME = Anniversary Edition
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index c75d29077e4a..283099c9560a 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -29,7 +29,7 @@ config ARC
         select HAVE_KPROBES
         select HAVE_KRETPROBES
         select HAVE_MEMBLOCK
-        select HAVE_MOD_ARCH_SPECIFIC if ARC_DW2_UNWIND
+        select HAVE_MOD_ARCH_SPECIFIC
         select HAVE_OPROFILE
         select HAVE_PERF_EVENTS
         select HANDLE_DOMAIN_IRQ
diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
index b3410ff6a62d..5008021fba98 100644
--- a/arch/arc/include/asm/cache.h
+++ b/arch/arc/include/asm/cache.h
@@ -67,7 +67,7 @@ extern unsigned long perip_base, perip_end;
 #define ARC_REG_IC_PTAG_HI      0x1F
 
 /* Bit val in IC_CTRL */
-#define IC_CTRL_CACHE_DISABLE   0x1
+#define IC_CTRL_DIS             0x1
 
 /* Data cache related Auxiliary registers */
 #define ARC_REG_DC_BCR          0x72    /* Build Config reg */
@@ -80,8 +80,9 @@ extern unsigned long perip_base, perip_end;
 #define ARC_REG_DC_PTAG_HI      0x5F
 
 /* Bit val in DC_CTRL */
-#define DC_CTRL_INV_MODE_FLUSH  0x40
-#define DC_CTRL_FLUSH_STATUS    0x100
+#define DC_CTRL_DIS             0x001
+#define DC_CTRL_INV_MODE_FLUSH  0x040
+#define DC_CTRL_FLUSH_STATUS    0x100
 
 /*System-level cache (L2 cache) related Auxiliary registers */
 #define ARC_REG_SLC_CFG         0x901
@@ -92,8 +93,8 @@ extern unsigned long perip_base, perip_end;
 #define ARC_REG_SLC_RGN_END     0x916
 
 /* Bit val in SLC_CONTROL */
+#define SLC_CTRL_DIS            0x001
 #define SLC_CTRL_IM             0x040
-#define SLC_CTRL_DISABLE        0x001
 #define SLC_CTRL_BUSY           0x100
 #define SLC_CTRL_RGN_OP_INV     0x200
 
diff --git a/arch/arc/include/asm/entry-arcv2.h b/arch/arc/include/asm/entry-arcv2.h
index b5ff87e6f4b7..aee1a77934cf 100644
--- a/arch/arc/include/asm/entry-arcv2.h
+++ b/arch/arc/include/asm/entry-arcv2.h
@@ -16,6 +16,7 @@
         ;
         ; Now manually save: r12, sp, fp, gp, r25
 
+        PUSH    r30
         PUSH    r12
 
         ; Saving pt_regs->sp correctly requires some extra work due to the way
@@ -72,6 +73,7 @@
         POPAX   AUX_USER_SP
 1:
         POP     r12
+        POP     r30
 
 .endm
 
diff --git a/arch/arc/include/asm/module.h b/arch/arc/include/asm/module.h
index 6e91d8b339c3..567590ea8f6c 100644
--- a/arch/arc/include/asm/module.h
+++ b/arch/arc/include/asm/module.h
@@ -14,13 +14,13 @@
 
 #include <asm-generic/module.h>
 
-#ifdef CONFIG_ARC_DW2_UNWIND
 struct mod_arch_specific {
+#ifdef CONFIG_ARC_DW2_UNWIND
         void *unw_info;
         int unw_sec_idx;
+#endif
         const char *secstr;
 };
-#endif
 
 #define MODULE_PROC_FAMILY "ARC700"
 
diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
index 69095da1fcfd..47111d565a95 100644
--- a/arch/arc/include/asm/ptrace.h
+++ b/arch/arc/include/asm/ptrace.h
@@ -84,7 +84,7 @@ struct pt_regs {
         unsigned long fp;
         unsigned long sp;       /* user/kernel sp depending on where we came from  */
 
-        unsigned long r12;
+        unsigned long r12, r30;
 
         /*------- Below list auto saved by h/w -----------*/
         unsigned long r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11;
diff --git a/arch/arc/include/asm/setup.h b/arch/arc/include/asm/setup.h
index cb954cdab070..c568a9df82b1 100644
--- a/arch/arc/include/asm/setup.h
+++ b/arch/arc/include/asm/setup.h
@@ -31,6 +31,7 @@ extern int root_mountflags, end_mem;
 
 void setup_processor(void);
 void __init setup_arch_memory(void);
+long __init arc_get_mem_sz(void);
 
 /* Helpers used in arc_*_mumbojumbo routines */
 #define IS_AVAIL1(v, s)         ((v) ? s : "")
diff --git a/arch/arc/kernel/intc-arcv2.c b/arch/arc/kernel/intc-arcv2.c
index 994dca7014db..ecef0fb0b66c 100644
--- a/arch/arc/kernel/intc-arcv2.c
+++ b/arch/arc/kernel/intc-arcv2.c
@@ -77,20 +77,20 @@ void arc_init_IRQ(void)
 
 static void arcv2_irq_mask(struct irq_data *data)
 {
-        write_aux_reg(AUX_IRQ_SELECT, data->irq);
+        write_aux_reg(AUX_IRQ_SELECT, data->hwirq);
         write_aux_reg(AUX_IRQ_ENABLE, 0);
 }
 
 static void arcv2_irq_unmask(struct irq_data *data)
 {
-        write_aux_reg(AUX_IRQ_SELECT, data->irq);
+        write_aux_reg(AUX_IRQ_SELECT, data->hwirq);
         write_aux_reg(AUX_IRQ_ENABLE, 1);
 }
 
 void arcv2_irq_enable(struct irq_data *data)
 {
         /* set default priority */
-        write_aux_reg(AUX_IRQ_SELECT, data->irq);
+        write_aux_reg(AUX_IRQ_SELECT, data->hwirq);
         write_aux_reg(AUX_IRQ_PRIORITY, ARCV2_IRQ_DEF_PRIO);
 
         /*
diff --git a/arch/arc/kernel/intc-compact.c b/arch/arc/kernel/intc-compact.c
index ce9deb953ca9..8c1fd5c00782 100644
--- a/arch/arc/kernel/intc-compact.c
+++ b/arch/arc/kernel/intc-compact.c
@@ -57,7 +57,7 @@ static void arc_irq_mask(struct irq_data *data)
         unsigned int ienb;
 
         ienb = read_aux_reg(AUX_IENABLE);
-        ienb &= ~(1 << data->irq);
+        ienb &= ~(1 << data->hwirq);
         write_aux_reg(AUX_IENABLE, ienb);
 }
 
@@ -66,7 +66,7 @@ static void arc_irq_unmask(struct irq_data *data)
         unsigned int ienb;
 
         ienb = read_aux_reg(AUX_IENABLE);
-        ienb |= (1 << data->irq);
+        ienb |= (1 << data->hwirq);
         write_aux_reg(AUX_IENABLE, ienb);
 }
 
diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c
index 560c4afc2af4..9274f8ade8c7 100644
--- a/arch/arc/kernel/mcip.c
+++ b/arch/arc/kernel/mcip.c
@@ -10,6 +10,7 @@
 
 #include <linux/smp.h>
 #include <linux/irq.h>
+#include <linux/irqchip/chained_irq.h>
 #include <linux/spinlock.h>
 #include <soc/arc/mcip.h>
 #include <asm/irqflags-arcv2.h>
@@ -221,10 +222,13 @@ static irq_hw_number_t idu_first_hwirq;
 static void idu_cascade_isr(struct irq_desc *desc)
 {
         struct irq_domain *idu_domain = irq_desc_get_handler_data(desc);
+        struct irq_chip *core_chip = irq_desc_get_chip(desc);
         irq_hw_number_t core_hwirq = irqd_to_hwirq(irq_desc_get_irq_data(desc));
         irq_hw_number_t idu_hwirq = core_hwirq - idu_first_hwirq;
 
+        chained_irq_enter(core_chip, desc);
         generic_handle_irq(irq_find_mapping(idu_domain, idu_hwirq));
+        chained_irq_exit(core_chip, desc);
 }
 
 static int idu_irq_map(struct irq_domain *d, unsigned int virq, irq_hw_number_t hwirq)
diff --git a/arch/arc/kernel/module.c b/arch/arc/kernel/module.c
index 42e964db2967..3d99a6091332 100644
--- a/arch/arc/kernel/module.c
+++ b/arch/arc/kernel/module.c
@@ -32,8 +32,8 @@ int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
 #ifdef CONFIG_ARC_DW2_UNWIND
         mod->arch.unw_sec_idx = 0;
         mod->arch.unw_info = NULL;
-        mod->arch.secstr = secstr;
 #endif
+        mod->arch.secstr = secstr;
         return 0;
 }
 
@@ -113,8 +113,10 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
 
         }
 
+#ifdef CONFIG_ARC_DW2_UNWIND
         if (strcmp(module->arch.secstr+sechdrs[tgtsec].sh_name, ".eh_frame") == 0)
                 module->arch.unw_sec_idx = tgtsec;
+#endif
 
         return 0;
 
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index ec86ac0e3321..d408fa21a07c 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -23,7 +23,7 @@
 
 static int l2_line_sz;
 static int ioc_exists;
-int slc_enable = 1, ioc_enable = 0;
+int slc_enable = 1, ioc_enable = 1;
 unsigned long perip_base = ARC_UNCACHED_ADDR_SPACE; /* legacy value for boot */
 unsigned long perip_end = 0xFFFFFFFF; /* legacy value */
 
@@ -271,7 +271,11 @@ void __cache_line_loop_v2(phys_addr_t paddr, unsigned long vaddr,
 
 /*
  * For ARC700 MMUv3 I-cache and D-cache flushes
- * Also reused for HS38 aliasing I-cache configuration
+ *  - ARC700 programming model requires paddr and vaddr be passed in seperate
+ *    AUX registers (*_IV*L and *_PTAG respectively) irrespective of whether the
+ *    caches actually alias or not.
+ * -  For HS38, only the aliasing I-cache configuration uses the PTAG reg
+ *    (non aliasing I-cache version doesn't; while D-cache can't possibly alias)
  */
 static inline
 void __cache_line_loop_v3(phys_addr_t paddr, unsigned long vaddr,
@@ -458,6 +462,21 @@ static inline void __dc_entire_op(const int op)
         __after_dc_op(op);
 }
 
+static inline void __dc_disable(void)
+{
+        const int r = ARC_REG_DC_CTRL;
+
+        __dc_entire_op(OP_FLUSH_N_INV);
+        write_aux_reg(r, read_aux_reg(r) | DC_CTRL_DIS);
+}
+
+static void __dc_enable(void)
+{
+        const int r = ARC_REG_DC_CTRL;
+
+        write_aux_reg(r, read_aux_reg(r) & ~DC_CTRL_DIS);
+}
+
 /* For kernel mappings cache operation: index is same as paddr */
 #define __dc_line_op_k(p, sz, op)       __dc_line_op(p, p, sz, op)
 
@@ -483,6 +502,8 @@ static inline void __dc_line_op(phys_addr_t paddr, unsigned long vaddr,
 #else
 
 #define __dc_entire_op(op)
+#define __dc_disable()
+#define __dc_enable()
 #define __dc_line_op(paddr, vaddr, sz, op)
 #define __dc_line_op_k(paddr, sz, op)
 
@@ -597,6 +618,40 @@ noinline void slc_op(phys_addr_t paddr, unsigned long sz, const int op)
 #endif
 }
 
+noinline static void slc_entire_op(const int op)
+{
+        unsigned int ctrl, r = ARC_REG_SLC_CTRL;
+
+        ctrl = read_aux_reg(r);
+
+        if (!(op & OP_FLUSH))           /* i.e. OP_INV */
+                ctrl &= ~SLC_CTRL_IM;   /* clear IM: Disable flush before Inv */
+        else
+                ctrl |= SLC_CTRL_IM;
+
+        write_aux_reg(r, ctrl);
+
+        write_aux_reg(ARC_REG_SLC_INVALIDATE, 1);
+
+        /* Important to wait for flush to complete */
+        while (read_aux_reg(r) & SLC_CTRL_BUSY);
+}
+
+static inline void arc_slc_disable(void)
+{
+        const int r = ARC_REG_SLC_CTRL;
+
+        slc_entire_op(OP_FLUSH_N_INV);
+        write_aux_reg(r, read_aux_reg(r) | SLC_CTRL_DIS);
+}
+
+static inline void arc_slc_enable(void)
+{
+        const int r = ARC_REG_SLC_CTRL;
+
+        write_aux_reg(r, read_aux_reg(r) & ~SLC_CTRL_DIS);
+}
+
 /***********************************************************
  * Exported APIs
  */
@@ -923,21 +978,54 @@ SYSCALL_DEFINE3(cacheflush, uint32_t, start, uint32_t, sz, uint32_t, flags)
         return 0;
 }
 
-void arc_cache_init(void)
+/*
+ * IO-Coherency (IOC) setup rules:
+ *
+ * 1. Needs to be at system level, so only once by Master core
+ *    Non-Masters need not be accessing caches at that time
+ *    - They are either HALT_ON_RESET and kick started much later or
+ *    - if run on reset, need to ensure that arc_platform_smp_wait_to_boot()
+ *      doesn't perturb caches or coherency unit
+ *
+ * 2. caches (L1 and SLC) need to be purged (flush+inv) before setting up IOC,
+ *    otherwise any straggler data might behave strangely post IOC enabling
+ *
+ * 3. All Caches need to be disabled when setting up IOC to elide any in-flight
+ *    Coherency transactions
+ */
+noinline void __init arc_ioc_setup(void)
 {
-        unsigned int __maybe_unused cpu = smp_processor_id();
-        char str[256];
+        unsigned int ap_sz;
 
-        printk(arc_cache_mumbojumbo(0, str, sizeof(str)));
+        /* Flush + invalidate + disable L1 dcache */
+        __dc_disable();
+
+        /* Flush + invalidate SLC */
+        if (read_aux_reg(ARC_REG_SLC_BCR))
+                slc_entire_op(OP_FLUSH_N_INV);
+
+        /* IOC Aperture start: TDB: handle non default CONFIG_LINUX_LINK_BASE */
+        write_aux_reg(ARC_REG_IO_COH_AP0_BASE, 0x80000);
 
         /*
-         * Only master CPU needs to execute rest of function:
-         *  - Assume SMP so all cores will have same cache config so
-         *    any geomtry checks will be same for all
-         *  - IOC setup / dma callbacks only need to be setup once
+         * IOC Aperture size:
+         *   decoded as 2 ^ (SIZE + 2) KB: so setting 0x11 implies 512M
+         * TBD: fix for PGU + 1GB of low mem
+         * TBD: fix for PAE
          */
-        if (cpu)
-                return;
+        ap_sz = order_base_2(arc_get_mem_sz()/1024) - 2;
+        write_aux_reg(ARC_REG_IO_COH_AP0_SIZE, ap_sz);
+
+        write_aux_reg(ARC_REG_IO_COH_PARTIAL, 1);
+        write_aux_reg(ARC_REG_IO_COH_ENABLE, 1);
+
+        /* Re-enable L1 dcache */
+        __dc_enable();
+}
+
+void __init arc_cache_init_master(void)
+{
+        unsigned int __maybe_unused cpu = smp_processor_id();
 
         if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE)) {
                 struct cpuinfo_arc_cache *ic = &cpuinfo_arc700[cpu].icache;
@@ -985,30 +1073,14 @@ void arc_cache_init(void)
                 }
         }
 
-        if (is_isa_arcv2() && l2_line_sz && !slc_enable) {
-
-                /* IM set : flush before invalidate */
-                write_aux_reg(ARC_REG_SLC_CTRL,
-                        read_aux_reg(ARC_REG_SLC_CTRL) | SLC_CTRL_IM);
+        /* Note that SLC disable not formally supported till HS 3.0 */
+        if (is_isa_arcv2() && l2_line_sz && !slc_enable)
+                arc_slc_disable();
 
-                write_aux_reg(ARC_REG_SLC_INVALIDATE, 1);
-
-                /* Important to wait for flush to complete */
-                while (read_aux_reg(ARC_REG_SLC_CTRL) & SLC_CTRL_BUSY);
-                write_aux_reg(ARC_REG_SLC_CTRL,
-                        read_aux_reg(ARC_REG_SLC_CTRL) | SLC_CTRL_DISABLE);
-        }
+        if (is_isa_arcv2() && ioc_enable)
+                arc_ioc_setup();
 
         if (is_isa_arcv2() && ioc_enable) {
-                /* IO coherency base - 0x8z */
-                write_aux_reg(ARC_REG_IO_COH_AP0_BASE, 0x80000);
-                /* IO coherency aperture size - 512Mb: 0x8z-0xAz */
-                write_aux_reg(ARC_REG_IO_COH_AP0_SIZE, 0x11);
-                /* Enable partial writes */
-                write_aux_reg(ARC_REG_IO_COH_PARTIAL, 1);
-                /* Enable IO coherency */
-                write_aux_reg(ARC_REG_IO_COH_ENABLE, 1);
-
                 __dma_cache_wback_inv = __dma_cache_wback_inv_ioc;
                 __dma_cache_inv = __dma_cache_inv_ioc;
                 __dma_cache_wback = __dma_cache_wback_ioc;
@@ -1022,3 +1094,20 @@ void arc_cache_init(void)
                 __dma_cache_wback = __dma_cache_wback_l1;
         }
 }
+
+void __ref arc_cache_init(void)
+{
+        unsigned int __maybe_unused cpu = smp_processor_id();
+        char str[256];
+
+        printk(arc_cache_mumbojumbo(0, str, sizeof(str)));
+
+        /*
+         * Only master CPU needs to execute rest of function:
+         *  - Assume SMP so all cores will have same cache config so
+         *    any geomtry checks will be same for all
+         *  - IOC setup / dma callbacks only need to be setup once
+         */
+        if (!cpu)
+                arc_cache_init_master();
+}
diff --git a/arch/arc/mm/init.c b/arch/arc/mm/init.c
index 399e2f223d25..8c9415ed6280 100644
--- a/arch/arc/mm/init.c
+++ b/arch/arc/mm/init.c
@@ -40,6 +40,11 @@ struct pglist_data node_data[MAX_NUMNODES] __read_mostly;
 EXPORT_SYMBOL(node_data);
 #endif
 
+long __init arc_get_mem_sz(void)
+{
+        return low_mem_sz;
+}
+
 /* User can over-ride above with "mem=nnn[KkMm]" in cmdline */
 static int __init setup_mem_sz(char *str)
 {
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index 7327250f0bb6..f10fe8526239 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -846,6 +846,7 @@ dtb-$(CONFIG_MACH_SUN8I) += \
         sun8i-a83t-allwinner-h8homlet-v2.dtb \
         sun8i-a83t-cubietruck-plus.dtb \
         sun8i-h3-bananapi-m2-plus.dtb \
+        sun8i-h3-nanopi-m1.dtb  \
         sun8i-h3-nanopi-neo.dtb \
         sun8i-h3-orangepi-2.dtb \
         sun8i-h3-orangepi-lite.dtb \
diff --git a/arch/arm/boot/dts/am335x-icev2.dts b/arch/arm/boot/dts/am335x-icev2.dts
index 1463df3b5b19..8ed46f9d79b7 100644
--- a/arch/arm/boot/dts/am335x-icev2.dts
+++ b/arch/arm/boot/dts/am335x-icev2.dts
@@ -170,7 +170,6 @@
                         AM33XX_IOPAD(0x8fc, PIN_INPUT_PULLUP | MUX_MODE0) /* (G16) mmc0_dat0.mmc0_dat0 */
                         AM33XX_IOPAD(0x900, PIN_INPUT_PULLUP | MUX_MODE0) /* (G17) mmc0_clk.mmc0_clk */
                         AM33XX_IOPAD(0x904, PIN_INPUT_PULLUP | MUX_MODE0) /* (G18) mmc0_cmd.mmc0_cmd */
-                        AM33XX_IOPAD(0x960, PIN_INPUT_PULLUP | MUX_MODE5) /* (C15) spi0_cs1.mmc0_sdcd */
                 >;
         };
 
diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
index b6142bda661e..15f07f9af3b3 100644
--- a/arch/arm/boot/dts/bcm-nsp.dtsi
+++ b/arch/arm/boot/dts/bcm-nsp.dtsi
@@ -160,7 +160,7 @@
 
         axi {
                 compatible = "simple-bus";
-                ranges = <0x00000000 0x18000000 0x0011c40a>;
+                ranges = <0x00000000 0x18000000 0x0011c40c>;
                 #address-cells = <1>;
                 #size-cells = <1>;
 
diff --git a/arch/arm/boot/dts/da850-evm.dts b/arch/arm/boot/dts/da850-evm.dts
index 41de15fe15a2..78492a0bbbab 100644
--- a/arch/arm/boot/dts/da850-evm.dts
+++ b/arch/arm/boot/dts/da850-evm.dts
@@ -99,6 +99,7 @@
                                 #size-cells = <1>;
                                 compatible = "m25p64";
                                 spi-max-frequency = <30000000>;
+                                m25p,fast-read;
                                 reg = <0>;
                                 partition@0 {
                                         label = "U-Boot-SPL";
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 1faf24acd521..5ba161679e01 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -1378,6 +1378,7 @@
                         phy-names = "sata-phy";
                         clocks = <&sata_ref_clk>;
                         ti,hwmods = "sata";
+                        ports-implemented = <0x1>;
                 };
 
                 rtc: rtc@48838000 {
diff --git a/arch/arm/boot/dts/dra72-evm-revc.dts b/arch/arm/boot/dts/dra72-evm-revc.dts
index c3d939c9666c..3f808a47df03 100644
--- a/arch/arm/boot/dts/dra72-evm-revc.dts
+++ b/arch/arm/boot/dts/dra72-evm-revc.dts
@@ -75,6 +75,6 @@
                 ti,rx-internal-delay = <DP83867_RGMIIDCTL_2_25_NS>;
                 ti,tx-internal-delay = <DP83867_RGMIIDCTL_250_PS>;
                 ti,fifo-depth = <DP83867_PHYCR_FIFO_DEPTH_8_B_NIB>;
-                ti,min-output-imepdance;
+                ti,min-output-impedance;
         };
 };
diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
index 34887a10c5f1..47ba97229a48 100644
--- a/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
@@ -319,8 +319,6 @@
                 compatible = "fsl,imx6q-nitrogen6_max-sgtl5000",
                              "fsl,imx-audio-sgtl5000";
                 model = "imx6q-nitrogen6_max-sgtl5000";
-                pinctrl-names = "default";
-                pinctrl-0 = <&pinctrl_sgtl5000>;
                 ssi-controller = <&ssi1>;
                 audio-codec = <&codec>;
                 audio-routing =
@@ -402,6 +400,8 @@
 
         codec: sgtl5000@0a {
                 compatible = "fsl,sgtl5000";
+                pinctrl-names = "default";
+                pinctrl-0 = <&pinctrl_sgtl5000>;
                 reg = <0x0a>;
                 clocks = <&clks IMX6QDL_CLK_CKO>;
                 VDDA-supply = <&reg_2p5v>;
diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
index d80f21abea62..31d4cc62dbc7 100644
--- a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
@@ -250,8 +250,6 @@
                 compatible = "fsl,imx6q-nitrogen6_som2-sgtl5000",
                              "fsl,imx-audio-sgtl5000";
                 model = "imx6q-nitrogen6_som2-sgtl5000";
-                pinctrl-names = "default";
-                pinctrl-0 = <&pinctrl_sgtl5000>;
                 ssi-controller = <&ssi1>;
                 audio-codec = <&codec>;
                 audio-routing =
@@ -320,6 +318,8 @@
 
         codec: sgtl5000@0a {
                 compatible = "fsl,sgtl5000";
+                pinctrl-names = "default";
+                pinctrl-0 = <&pinctrl_sgtl5000>;
                 reg = <0x0a>;
                 clocks = <&clks IMX6QDL_CLK_CKO>;
                 VDDA-supply = <&reg_2p5v>;
diff --git a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
index da8598402ab8..38faa90007d7 100644
--- a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
+++ b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
@@ -158,7 +158,7 @@
 &mmc1 {
         interrupts-extended = <&intc 83 &omap3_pmx_core 0x11a>;
         pinctrl-names = "default";
-        pinctrl-0 = <&mmc1_pins &mmc1_cd>;
+        pinctrl-0 = <&mmc1_pins>;
         wp-gpios = <&gpio4 30 GPIO_ACTIVE_HIGH>;                /* gpio_126 */
         cd-gpios = <&gpio4 14 IRQ_TYPE_LEVEL_LOW>;              /* gpio_110 */
         vmmc-supply = <&vmmc1>;
@@ -193,7 +193,8 @@
                         OMAP3_CORE1_IOPAD(0x214a, PIN_INPUT | MUX_MODE0)        /* sdmmc1_dat1.sdmmc1_dat1 */
                         OMAP3_CORE1_IOPAD(0x214c, PIN_INPUT | MUX_MODE0)        /* sdmmc1_dat2.sdmmc1_dat2 */
                         OMAP3_CORE1_IOPAD(0x214e, PIN_INPUT | MUX_MODE0)        /* sdmmc1_dat3.sdmmc1_dat3 */
-                        OMAP3_CORE1_IOPAD(0x2132, PIN_INPUT_PULLUP | MUX_MODE4) /* cam_strobe.gpio_126 sdmmc1_wp*/
+                        OMAP3_CORE1_IOPAD(0x2132, PIN_INPUT_PULLUP | MUX_MODE4) /* cam_strobe.gpio_126 */
+                        OMAP3_CORE1_IOPAD(0x212c, PIN_INPUT_PULLUP | MUX_MODE4) /* cam_d11.gpio_110 */
                 >;
         };
 
@@ -242,12 +243,6 @@
                         OMAP3_WKUP_IOPAD(0x2a16, PIN_OUTPUT | PIN_OFF_OUTPUT_LOW | MUX_MODE4)       /* sys_boot6.gpio_8 */
                 >;
         };
-
-        mmc1_cd: pinmux_mmc1_cd {
-                pinctrl-single,pins = <
-                        OMAP3_WKUP_IOPAD(0x212c, PIN_INPUT_PULLUP | MUX_MODE4)  /* cam_d11.gpio_110 */
-                >;
-        };
 };
 
 
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index 7cd92babc41a..0844737b72b2 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -988,6 +988,7 @@
                         phy-names = "sata-phy";
                         clocks = <&sata_ref_clk>;
                         ti,hwmods = "sata";
+                        ports-implemented = <0x1>;
                 };
 
                 dss: dss@58000000 {
diff --git a/arch/arm/boot/dts/qcom-mdm9615.dtsi b/arch/arm/boot/dts/qcom-mdm9615.dtsi
index 5ae4ec59e6ea..c852b69229c9 100644
--- a/arch/arm/boot/dts/qcom-mdm9615.dtsi
+++ b/arch/arm/boot/dts/qcom-mdm9615.dtsi
@@ -357,7 +357,7 @@
                 };
 
                 amba {
-                        compatible = "arm,amba-bus";
+                        compatible = "simple-bus";
                         #address-cells = <1>;
                         #size-cells = <1>;
                         ranges;
diff --git a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
index 735914f6ae44..7cae328398b1 100644
--- a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
+++ b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
@@ -140,6 +140,10 @@
         cpu-supply = <&reg_dcdc3>;
 };
 
+&de {
+        status = "okay";
+};
+
 &ehci0 {
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
index 2b26175d55d1..e78faaf9243c 100644
--- a/arch/arm/boot/dts/sun6i-a31.dtsi
+++ b/arch/arm/boot/dts/sun6i-a31.dtsi
@@ -234,6 +234,7 @@
         de: display-engine {
                 compatible = "allwinner,sun6i-a31-display-engine";
                 allwinner,pipelines = <&fe0>;
+                status = "disabled";
         };
 
         soc@01c00000 {
diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc.dts
index 5ea4915f6d75..10d307408f23 100644
--- a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc.dts
+++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc.dts
@@ -56,7 +56,7 @@
 };
 
 &pio {
-        mmc2_pins_nrst: mmc2@0 {
+        mmc2_pins_nrst: mmc2-rst-pin {
                 allwinner,pins = "PC16";
                 allwinner,function = "gpio_out";
                 allwinner,drive = <SUN4I_PINCTRL_10_MA>;
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index b01a43851294..028d2b70e3b5 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -471,7 +471,7 @@ CONFIG_MESON_WATCHDOG=y
 CONFIG_DW_WATCHDOG=y
 CONFIG_DIGICOLOR_WATCHDOG=y
 CONFIG_BCM2835_WDT=y
-CONFIG_BCM47XX_WATCHDOG=y
+CONFIG_BCM47XX_WDT=y
 CONFIG_BCM7038_WDT=m
 CONFIG_BCM_KONA_WDT=y
 CONFIG_MFD_ACT8945A=y
@@ -893,7 +893,7 @@ CONFIG_BCM2835_MBOX=y
 CONFIG_RASPBERRYPI_FIRMWARE=y
 CONFIG_EFI_VARS=m
 CONFIG_EFI_CAPSULE_LOADER=m
-CONFIG_CONFIG_BCM47XX_NVRAM=y
+CONFIG_BCM47XX_NVRAM=y
 CONFIG_BCM47XX_SPROM=y
 CONFIG_EXT4_FS=y
 CONFIG_AUTOFS4_FS=y
diff --git a/arch/arm/configs/s3c2410_defconfig b/arch/arm/configs/s3c2410_defconfig
index 4364040ed696..1e6c48dd7b11 100644
--- a/arch/arm/configs/s3c2410_defconfig
+++ b/arch/arm/configs/s3c2410_defconfig
@@ -86,9 +86,9 @@ CONFIG_IPV6_TUNNEL=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_DCCP=m
-CONFIG_NF_CT_PROTO_SCTP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_SCTP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
index 522b5feb4eaa..b62eaeb147aa 100644
--- a/arch/arm/include/asm/cputype.h
+++ b/arch/arm/include/asm/cputype.h
@@ -94,6 +94,9 @@
 #define ARM_CPU_XSCALE_ARCH_V2          0x4000
 #define ARM_CPU_XSCALE_ARCH_V3          0x6000
 
+/* Qualcomm implemented cores */
+#define ARM_CPU_PART_SCORPION           0x510002d0
+
 extern unsigned int processor_id;
 
 #ifdef CONFIG_CPU_CP15
diff --git a/arch/arm/include/asm/ftrace.h b/arch/arm/include/asm/ftrace.h
index bfe2a2f5a644..22b73112b75f 100644
--- a/arch/arm/include/asm/ftrace.h
+++ b/arch/arm/include/asm/ftrace.h
@@ -54,6 +54,24 @@ static inline void *return_address(unsigned int level)
 
 #define ftrace_return_address(n) return_address(n)
 
+#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
+
+static inline bool arch_syscall_match_sym_name(const char *sym,
+                                               const char *name)
+{
+        if (!strcmp(sym, "sys_mmap2"))
+                sym = "sys_mmap_pgoff";
+        else if (!strcmp(sym, "sys_statfs64_wrapper"))
+                sym = "sys_statfs64";
+        else if (!strcmp(sym, "sys_fstatfs64_wrapper"))
+                sym = "sys_fstatfs64";
+        else if (!strcmp(sym, "sys_arm_fadvise64_64"))
+                sym = "sys_fadvise64_64";
+
+        /* Ignore case since sym may start with "SyS" instead of "sys" */
+        return !strcasecmp(sym, name);
+}
+
 #endif /* ifndef __ASSEMBLY__ */
 
 #endif /* _ASM_ARM_FTRACE */
diff --git a/arch/arm/include/asm/virt.h b/arch/arm/include/asm/virt.h
index a2e75b84e2ae..6dae1956c74d 100644
--- a/arch/arm/include/asm/virt.h
+++ b/arch/arm/include/asm/virt.h
@@ -80,6 +80,11 @@ static inline bool is_kernel_in_hyp_mode(void)
         return false;
 }
 
+static inline bool has_vhe(void)
+{
+        return false;
+}
+
 /* The section containing the hypervisor idmap text */
 extern char __hyp_idmap_text_start[];
 extern char __hyp_idmap_text_end[];
diff --git a/arch/arm/include/asm/types.h b/arch/arm/include/uapi/asm/types.h
index a53cdb8f068c..9435a42f575e 100644
--- a/arch/arm/include/asm/types.h
+++ b/arch/arm/include/uapi/asm/types.h
@@ -1,5 +1,5 @@
-#ifndef _ASM_TYPES_H
-#define _ASM_TYPES_H
+#ifndef _UAPI_ASM_TYPES_H
+#define _UAPI_ASM_TYPES_H
 
 #include <asm-generic/int-ll64.h>
 
@@ -37,4 +37,4 @@
 #define __UINTPTR_TYPE__        unsigned long
 #endif
 
-#endif /* _ASM_TYPES_H */
+#endif /* _UAPI_ASM_TYPES_H */
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index 188180b5523d..be3b3fbd382f 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -1063,6 +1063,22 @@ static int __init arch_hw_breakpoint_init(void)
                 return 0;
         }
 
+        /*
+         * Scorpion CPUs (at least those in APQ8060) seem to set DBGPRSR.SPD
+         * whenever a WFI is issued, even if the core is not powered down, in
+         * violation of the architecture.  When DBGPRSR.SPD is set, accesses to
+         * breakpoint and watchpoint registers are treated as undefined, so
+         * this results in boot time and runtime failures when these are
+         * accessed and we unexpectedly take a trap.
+         *
+         * It's not clear if/how this can be worked around, so we blacklist
+         * Scorpion CPUs to avoid these issues.
+        */
+        if (read_cpuid_part() == ARM_CPU_PART_SCORPION) {
+                pr_info("Scorpion CPU detected. Hardware breakpoints and watchpoints disabled\n");
+                return 0;
+        }
+
         has_ossr = core_has_os_save_restore();
 
         /* Determine how many BRPs/WRPs are available. */
diff --git a/arch/arm/kernel/smp_tlb.c b/arch/arm/kernel/smp_tlb.c
index 22313cb53362..9af0701f7094 100644
--- a/arch/arm/kernel/smp_tlb.c
+++ b/arch/arm/kernel/smp_tlb.c
@@ -9,6 +9,7 @@
  */
 #include <linux/preempt.h>
 #include <linux/smp.h>
+#include <linux/uaccess.h>
 
 #include <asm/smp_plat.h>
 #include <asm/tlbflush.h>
@@ -40,8 +41,11 @@ static inline void ipi_flush_tlb_mm(void *arg)
 static inline void ipi_flush_tlb_page(void *arg)
 {
         struct tlb_args *ta = (struct tlb_args *)arg;
+        unsigned int __ua_flags = uaccess_save_and_enable();
 
         local_flush_tlb_page(ta->ta_vma, ta->ta_start);
+
+        uaccess_restore(__ua_flags);
 }
 
 static inline void ipi_flush_tlb_kernel_page(void *arg)
@@ -54,8 +58,11 @@ static inline void ipi_flush_tlb_kernel_page(void *arg)
 static inline void ipi_flush_tlb_range(void *arg)
 {
         struct tlb_args *ta = (struct tlb_args *)arg;
+        unsigned int __ua_flags = uaccess_save_and_enable();
 
         local_flush_tlb_range(ta->ta_vma, ta->ta_start, ta->ta_end);
+
+        uaccess_restore(__ua_flags);
 }
 
 static inline void ipi_flush_tlb_kernel_range(void *arg)
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 11676787ad49..9d7446456e0c 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -1099,6 +1099,9 @@ static void cpu_init_hyp_mode(void *dummy)
         __cpu_init_hyp_mode(pgd_ptr, hyp_stack_ptr, vector_ptr);
         __cpu_init_stage2();
 
+        if (is_kernel_in_hyp_mode())
+                kvm_timer_init_vhe();
+
         kvm_arm_init_debug();
 }
 
diff --git a/arch/arm/mach-omap1/dma.c b/arch/arm/mach-omap1/dma.c
index f6ba589cd312..c821c1d5610e 100644
--- a/arch/arm/mach-omap1/dma.c
+++ b/arch/arm/mach-omap1/dma.c
@@ -32,7 +32,6 @@
 #include "soc.h"
 
 #define OMAP1_DMA_BASE                  (0xfffed800)
-#define OMAP1_LOGICAL_DMA_CH_COUNT      17
 
 static u32 enable_1510_mode;
 
@@ -348,8 +347,6 @@ static int __init omap1_system_dma_init(void)
                 goto exit_iounmap;
         }
 
-        d->lch_count            = OMAP1_LOGICAL_DMA_CH_COUNT;
-
         /* Valid attributes for omap1 plus processors */
         if (cpu_is_omap15xx())
                 d->dev_caps = ENABLE_1510_MODE;
@@ -366,13 +363,14 @@ static int __init omap1_system_dma_init(void)
         d->dev_caps             |= CLEAR_CSR_ON_READ;
         d->dev_caps             |= IS_WORD_16;
 
-        if (cpu_is_omap15xx())
-                d->chan_count = 9;
-        else if (cpu_is_omap16xx() || cpu_is_omap7xx()) {
-                if (!(d->dev_caps & ENABLE_1510_MODE))
-                        d->chan_count = 16;
+        /* available logical channels */
+        if (cpu_is_omap15xx()) {
+                d->lch_count = 9;
+        } else {
+                if (d->dev_caps & ENABLE_1510_MODE)
+                        d->lch_count = 9;
                 else
-                        d->chan_count = 9;
+                        d->lch_count = 16;
         }
 
         p = dma_plat_info;
diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
index 477910a48448..70c004794880 100644
--- a/arch/arm/mach-omap2/pdata-quirks.c
+++ b/arch/arm/mach-omap2/pdata-quirks.c
@@ -161,7 +161,7 @@ static struct ti_st_plat_data wilink7_pdata = {
         .nshutdown_gpio = 162,
         .dev_name = "/dev/ttyO1",
         .flow_cntrl = 1,
-        .baud_rate = 300000,
+        .baud_rate = 3000000,
 };
 
 static struct platform_device wl128x_device = {
diff --git a/arch/arm/mach-ux500/pm.c b/arch/arm/mach-ux500/pm.c
index 8538910db202..a970e7fcba9e 100644
--- a/arch/arm/mach-ux500/pm.c
+++ b/arch/arm/mach-ux500/pm.c
@@ -134,8 +134,8 @@ bool prcmu_pending_irq(void)
  */
 bool prcmu_is_cpu_in_wfi(int cpu)
 {
-        return readl(PRCM_ARM_WFI_STANDBY) & cpu ? PRCM_ARM_WFI_STANDBY_WFI1 :
-                     PRCM_ARM_WFI_STANDBY_WFI0;
+        return readl(PRCM_ARM_WFI_STANDBY) &
+                (cpu ? PRCM_ARM_WFI_STANDBY_WFI1 : PRCM_ARM_WFI_STANDBY_WFI0);
 }
 
 /*
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
index 238fbeacd330..5d28e1cdc998 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
@@ -137,6 +137,10 @@
         };
 };
 
+&scpi_clocks {
+        status = "disabled";
+};
+
 &uart_AO {
         status = "okay";
         pinctrl-0 = <&uart_ao_a_pins>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
index 596240c38a9c..b35307321b63 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
@@ -55,7 +55,7 @@
                 mboxes = <&mailbox 1 &mailbox 2>;
                 shmem = <&cpu_scp_lpri &cpu_scp_hpri>;
 
-                clocks {
+                scpi_clocks: clocks {
                         compatible = "arm,scpi-clocks";
 
                         scpi_dvfs: scpi_clocks@0 {
diff --git a/arch/arm64/boot/dts/exynos/exynos5433.dtsi b/arch/arm64/boot/dts/exynos/exynos5433.dtsi
index 64226d5ae471..135890cd8a85 100644
--- a/arch/arm64/boot/dts/exynos/exynos5433.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos5433.dtsi
@@ -1367,7 +1367,7 @@
                 };
 
                 amba {
-                        compatible = "arm,amba-bus";
+                        compatible = "simple-bus";
                         #address-cells = <1>;
                         #size-cells = <1>;
                         ranges;
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts b/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts
index 358089687a69..ef1b9e573af0 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts
+++ b/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts
@@ -27,7 +27,7 @@
                 stdout-path = "serial0:115200n8";
         };
 
-        memory {
+        memory@0 {
                 device_type = "memory";
                 reg = <0x0 0x0 0x0 0x40000000>;
         };
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
index 68a908334c7b..54dc28351c8c 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
@@ -72,7 +72,7 @@
                              <1 10 0xf08>;
         };
 
-        amba_apu {
+        amba_apu: amba_apu@0 {
                 compatible = "simple-bus";
                 #address-cells = <2>;
                 #size-cells = <1>;
@@ -175,7 +175,7 @@
                 };
 
                 i2c0: i2c@ff020000 {
-                        compatible = "cdns,i2c-r1p10";
+                        compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
                         status = "disabled";
                         interrupt-parent = <&gic>;
                         interrupts = <0 17 4>;
@@ -185,7 +185,7 @@
                 };
 
                 i2c1: i2c@ff030000 {
-                        compatible = "cdns,i2c-r1p10";
+                        compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
                         status = "disabled";
                         interrupt-parent = <&gic>;
                         interrupts = <0 18 4>;
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index bfe632808d77..90c39a662379 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -222,7 +222,7 @@ static inline void *phys_to_virt(phys_addr_t x)
 #define _virt_addr_valid(kaddr) pfn_valid(__pa(kaddr) >> PAGE_SHIFT)
 #else
 #define __virt_to_pgoff(kaddr)  (((u64)(kaddr) & ~PAGE_OFFSET) / PAGE_SIZE * sizeof(struct page))
-#define __page_to_voff(page)    (((u64)(page) & ~VMEMMAP_START) * PAGE_SIZE / sizeof(struct page))
+#define __page_to_voff(kaddr)   (((u64)(kaddr) & ~VMEMMAP_START) * PAGE_SIZE / sizeof(struct page))
 
 #define page_to_virt(page)      ((void *)((__page_to_voff(page)) | PAGE_OFFSET))
 #define virt_to_page(vaddr)     ((struct page *)((__virt_to_pgoff(vaddr)) | VMEMMAP_START))
diff --git a/arch/arm64/include/asm/virt.h b/arch/arm64/include/asm/virt.h
index fea10736b11f..439f6b5d31f6 100644
--- a/arch/arm64/include/asm/virt.h
+++ b/arch/arm64/include/asm/virt.h
@@ -47,6 +47,7 @@
 #include <asm/ptrace.h>
 #include <asm/sections.h>
 #include <asm/sysreg.h>
+#include <asm/cpufeature.h>
 
 /*
  * __boot_cpu_mode records what mode CPUs were booted in.
@@ -80,6 +81,14 @@ static inline bool is_kernel_in_hyp_mode(void)
         return read_sysreg(CurrentEL) == CurrentEL_EL2;
 }
 
+static inline bool has_vhe(void)
+{
+        if (cpus_have_const_cap(ARM64_HAS_VIRT_HOST_EXTN))
+                return true;
+
+        return false;
+}
+
 #ifdef CONFIG_ARM64_VHE
 extern void verify_cpu_run_el(void);
 #else
diff --git a/arch/arm64/include/uapi/asm/ptrace.h b/arch/arm64/include/uapi/asm/ptrace.h
index b5c3933ed441..d1ff83dfe5de 100644
--- a/arch/arm64/include/uapi/asm/ptrace.h
+++ b/arch/arm64/include/uapi/asm/ptrace.h
@@ -77,6 +77,7 @@ struct user_fpsimd_state {
         __uint128_t     vregs[32];
         __u32           fpsr;
         __u32           fpcr;
+        __u32           __reserved[2];
 };
 
 struct user_hwdebug_state {
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 923841ffe4a9..43512d4d7df2 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -683,7 +683,7 @@ el0_inv:
         mov     x0, sp
         mov     x1, #BAD_SYNC
         mov     x2, x25
-        bl      bad_mode
+        bl      bad_el0_sync
         b       ret_to_user
 ENDPROC(el0_sync)
 
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index fc35e06ccaac..a22161ccf447 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -551,6 +551,8 @@ static int hw_break_set(struct task_struct *target,
         /* (address, ctrl) registers */
         limit = regset->n * regset->size;
         while (count && offset < limit) {
+                if (count < PTRACE_HBP_ADDR_SZ)
+                        return -EINVAL;
                 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &addr,
                                          offset, offset + PTRACE_HBP_ADDR_SZ);
                 if (ret)
@@ -560,6 +562,8 @@ static int hw_break_set(struct task_struct *target,
                         return ret;
                 offset += PTRACE_HBP_ADDR_SZ;
 
+                if (!count)
+                        break;
                 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl,
                                          offset, offset + PTRACE_HBP_CTRL_SZ);
                 if (ret)
@@ -596,7 +600,7 @@ static int gpr_set(struct task_struct *target, const struct user_regset *regset,
                    const void *kbuf, const void __user *ubuf)
 {
         int ret;
-        struct user_pt_regs newregs;
+        struct user_pt_regs newregs = task_pt_regs(target)->user_regs;
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &newregs, 0, -1);
         if (ret)
@@ -626,7 +630,8 @@ static int fpr_set(struct task_struct *target, const struct user_regset *regset,
                    const void *kbuf, const void __user *ubuf)
 {
         int ret;
-        struct user_fpsimd_state newstate;
+        struct user_fpsimd_state newstate =
+                target->thread.fpsimd_state.user_fpsimd;
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &newstate, 0, -1);
         if (ret)
@@ -650,7 +655,7 @@ static int tls_set(struct task_struct *target, const struct user_regset *regset,
                    const void *kbuf, const void __user *ubuf)
 {
         int ret;
-        unsigned long tls;
+        unsigned long tls = target->thread.tp_value;
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1);
         if (ret)
@@ -676,7 +681,8 @@ static int system_call_set(struct task_struct *target,
                            unsigned int pos, unsigned int count,
                            const void *kbuf, const void __user *ubuf)
 {
-        int syscallno, ret;
+        int syscallno = task_pt_regs(target)->syscallno;
+        int ret;
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &syscallno, 0, -1);
         if (ret)
@@ -948,7 +954,7 @@ static int compat_tls_set(struct task_struct *target,
                           const void __user *ubuf)
 {
         int ret;
-        compat_ulong_t tls;
+        compat_ulong_t tls = target->thread.tp_value;
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1);
         if (ret)
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 5b830be79c01..659b2e6b6cf7 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -604,17 +604,34 @@ const char *esr_get_class_string(u32 esr)
 }
 
 /*
- * bad_mode handles the impossible case in the exception vector.
+ * bad_mode handles the impossible case in the exception vector. This is always
+ * fatal.
  */
 asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr)
 {
-        siginfo_t info;
-        void __user *pc = (void __user *)instruction_pointer(regs);
         console_verbose();
 
         pr_crit("Bad mode in %s handler detected on CPU%d, code 0x%08x -- %s\n",
                 handler[reason], smp_processor_id(), esr,
                 esr_get_class_string(esr));
+
+        die("Oops - bad mode", regs, 0);
+        local_irq_disable();
+        panic("bad mode");
+}
+
+/*
+ * bad_el0_sync handles unexpected, but potentially recoverable synchronous
+ * exceptions taken from EL0. Unlike bad_mode, this returns.
+ */
+asmlinkage void bad_el0_sync(struct pt_regs *regs, int reason, unsigned int esr)
+{
+        siginfo_t info;
+        void __user *pc = (void __user *)instruction_pointer(regs);
+        console_verbose();
+
+        pr_crit("Bad EL0 synchronous exception detected on CPU%d, code 0x%08x -- %s\n",
+                smp_processor_id(), esr, esr_get_class_string(esr));
         __show_regs(regs);
 
         info.si_signo = SIGILL;
@@ -622,7 +639,10 @@ asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr)
         info.si_code  = ILL_ILLOPC;
         info.si_addr  = pc;
 
-        arm64_notify_die("Oops - bad mode", regs, &info, 0);
+        current->thread.fault_address = 0;
+        current->thread.fault_code = 0;
+
+        force_sig_info(info.si_signo, &info, current);
 }
 
 void __pte_error(const char *file, int line, unsigned long val)
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 716d1226ba69..380ebe705093 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -404,6 +404,8 @@ void __init mem_init(void)
         if (swiotlb_force == SWIOTLB_FORCE ||
             max_pfn > (arm64_dma_phys_limit >> PAGE_SHIFT))
                 swiotlb_init(1);
+        else
+                swiotlb_force = SWIOTLB_NO_FORCE;
 
         set_max_mapnr(pfn_to_page(max_pfn) - mem_map);
 
diff --git a/arch/powerpc/include/asm/book3s/64/hash-4k.h b/arch/powerpc/include/asm/book3s/64/hash-4k.h
index 1c64bc6330bc..0c4e470571ca 100644
--- a/arch/powerpc/include/asm/book3s/64/hash-4k.h
+++ b/arch/powerpc/include/asm/book3s/64/hash-4k.h
@@ -36,12 +36,13 @@
 #ifdef CONFIG_HUGETLB_PAGE
 static inline int hash__hugepd_ok(hugepd_t hpd)
 {
+        unsigned long hpdval = hpd_val(hpd);
         /*
          * if it is not a pte and have hugepd shift mask
          * set, then it is a hugepd directory pointer
          */
-        if (!(hpd.pd & _PAGE_PTE) &&
-            ((hpd.pd & HUGEPD_SHIFT_MASK) != 0))
+        if (!(hpdval & _PAGE_PTE) &&
+            ((hpdval & HUGEPD_SHIFT_MASK) != 0))
                 return true;
         return false;
 }
diff --git a/arch/powerpc/include/asm/book3s/64/hash.h b/arch/powerpc/include/asm/book3s/64/hash.h
index f61cad3de4e6..4c935f7504f7 100644
--- a/arch/powerpc/include/asm/book3s/64/hash.h
+++ b/arch/powerpc/include/asm/book3s/64/hash.h
@@ -201,6 +201,10 @@ extern int __meminit hash__vmemmap_create_mapping(unsigned long start,
                                               unsigned long phys);
 extern void hash__vmemmap_remove_mapping(unsigned long start,
                                      unsigned long page_size);
+
+int hash__create_section_mapping(unsigned long start, unsigned long end);
+int hash__remove_section_mapping(unsigned long start, unsigned long end);
+
 #endif /* !__ASSEMBLY__ */
 #endif /* __KERNEL__ */
 #endif /* _ASM_POWERPC_BOOK3S_64_HASH_H */
diff --git a/arch/powerpc/include/asm/hugetlb.h b/arch/powerpc/include/asm/hugetlb.h
index ede215167d1a..7f4025a6c69e 100644
--- a/arch/powerpc/include/asm/hugetlb.h
+++ b/arch/powerpc/include/asm/hugetlb.h
@@ -21,12 +21,12 @@ static inline pte_t *hugepd_page(hugepd_t hpd)
          * We have only four bits to encode, MMU page size
          */
         BUILD_BUG_ON((MMU_PAGE_COUNT - 1) > 0xf);
-        return __va(hpd.pd & HUGEPD_ADDR_MASK);
+        return __va(hpd_val(hpd) & HUGEPD_ADDR_MASK);
 }
 
 static inline unsigned int hugepd_mmu_psize(hugepd_t hpd)
 {
-        return (hpd.pd & HUGEPD_SHIFT_MASK) >> 2;
+        return (hpd_val(hpd) & HUGEPD_SHIFT_MASK) >> 2;
 }
 
 static inline unsigned int hugepd_shift(hugepd_t hpd)
@@ -52,18 +52,20 @@ static inline pte_t *hugepd_page(hugepd_t hpd)
 {
         BUG_ON(!hugepd_ok(hpd));
 #ifdef CONFIG_PPC_8xx
-        return (pte_t *)__va(hpd.pd & ~(_PMD_PAGE_MASK | _PMD_PRESENT_MASK));
+        return (pte_t *)__va(hpd_val(hpd) &
+                             ~(_PMD_PAGE_MASK | _PMD_PRESENT_MASK));
 #else
-        return (pte_t *)((hpd.pd & ~HUGEPD_SHIFT_MASK) | PD_HUGE);
+        return (pte_t *)((hpd_val(hpd) &
+                          ~HUGEPD_SHIFT_MASK) | PD_HUGE);
 #endif
 }
 
 static inline unsigned int hugepd_shift(hugepd_t hpd)
 {
 #ifdef CONFIG_PPC_8xx
-        return ((hpd.pd & _PMD_PAGE_MASK) >> 1) + 17;
+        return ((hpd_val(hpd) & _PMD_PAGE_MASK) >> 1) + 17;
 #else
-        return hpd.pd & HUGEPD_SHIFT_MASK;
+        return hpd_val(hpd) & HUGEPD_SHIFT_MASK;
 #endif
 }
 
diff --git a/arch/powerpc/include/asm/nohash/pgtable.h b/arch/powerpc/include/asm/nohash/pgtable.h
index 172849727054..0cd8a3852763 100644
--- a/arch/powerpc/include/asm/nohash/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/pgtable.h
@@ -227,9 +227,10 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
 static inline int hugepd_ok(hugepd_t hpd)
 {
 #ifdef CONFIG_PPC_8xx
-        return ((hpd.pd & 0x4) != 0);
+        return ((hpd_val(hpd) & 0x4) != 0);
 #else
-        return (hpd.pd > 0);
+        /* We clear the top bit to indicate hugepd */
+        return ((hpd_val(hpd) & PD_HUGE) ==  0);
 #endif
 }
 
diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
index 56398e7e6100..47120bf2670c 100644
--- a/arch/powerpc/include/asm/page.h
+++ b/arch/powerpc/include/asm/page.h
@@ -294,15 +294,12 @@ extern long long virt_phys_offset;
 #include <asm/pgtable-types.h>
 #endif
 
-typedef struct { signed long pd; } hugepd_t;
 
 #ifndef CONFIG_HUGETLB_PAGE
 #define is_hugepd(pdep)         (0)
 #define pgd_huge(pgd)           (0)
 #endif /* CONFIG_HUGETLB_PAGE */
 
-#define __hugepd(x) ((hugepd_t) { (x) })
-
 struct page;
 extern void clear_user_page(void *page, unsigned long vaddr, struct page *pg);
 extern void copy_user_page(void *to, void *from, unsigned long vaddr,
diff --git a/arch/powerpc/include/asm/perf_event_server.h b/arch/powerpc/include/asm/perf_event_server.h
index e157489ee7a1..ae0a23091a9b 100644
--- a/arch/powerpc/include/asm/perf_event_server.h
+++ b/arch/powerpc/include/asm/perf_event_server.h
@@ -65,6 +65,7 @@ struct power_pmu {
 #define PPMU_HAS_SSLOT          0x00000020 /* Has sampled slot in MMCRA */
 #define PPMU_HAS_SIER           0x00000040 /* Has SIER */
 #define PPMU_ARCH_207S          0x00000080 /* PMC is architecture v2.07S */
+#define PPMU_NO_SIAR            0x00000100 /* Do not use SIAR */
 
 /*
  * Values for flags to get_alternatives()
diff --git a/arch/powerpc/include/asm/pgtable-be-types.h b/arch/powerpc/include/asm/pgtable-be-types.h
index 49c0a5a80efa..9c0f5db5cf46 100644
--- a/arch/powerpc/include/asm/pgtable-be-types.h
+++ b/arch/powerpc/include/asm/pgtable-be-types.h
@@ -104,4 +104,12 @@ static inline bool pmd_xchg(pmd_t *pmdp, pmd_t old, pmd_t new)
         return pmd_raw(old) == prev;
 }
 
+typedef struct { __be64 pdbe; } hugepd_t;
+#define __hugepd(x) ((hugepd_t) { cpu_to_be64(x) })
+
+static inline unsigned long hpd_val(hugepd_t x)
+{
+        return be64_to_cpu(x.pdbe);
+}
+
 #endif /* _ASM_POWERPC_PGTABLE_BE_TYPES_H */
diff --git a/arch/powerpc/include/asm/pgtable-types.h b/arch/powerpc/include/asm/pgtable-types.h
index e7f4f3e0fcde..8bd3b13fe2fb 100644
--- a/arch/powerpc/include/asm/pgtable-types.h
+++ b/arch/powerpc/include/asm/pgtable-types.h
@@ -66,4 +66,11 @@ static inline bool pte_xchg(pte_t *ptep, pte_t old, pte_t new)
 }
 #endif
 
+typedef struct { unsigned long pd; } hugepd_t;
+#define __hugepd(x) ((hugepd_t) { (x) })
+static inline unsigned long hpd_val(hugepd_t x)
+{
+        return x.pd;
+}
+
 #endif /* _ASM_POWERPC_PGTABLE_TYPES_H */
diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
index c56ea8c84abb..c4ced1d01d57 100644
--- a/arch/powerpc/include/asm/ppc-opcode.h
+++ b/arch/powerpc/include/asm/ppc-opcode.h
@@ -157,7 +157,7 @@
 #define PPC_INST_MCRXR                  0x7c000400
 #define PPC_INST_MCRXR_MASK             0xfc0007fe
 #define PPC_INST_MFSPR_PVR              0x7c1f42a6
-#define PPC_INST_MFSPR_PVR_MASK         0xfc1fffff
+#define PPC_INST_MFSPR_PVR_MASK         0xfc1ffffe
 #define PPC_INST_MFTMR                  0x7c0002dc
 #define PPC_INST_MSGSND                 0x7c00019c
 #define PPC_INST_MSGCLR                 0x7c0001dc
@@ -174,13 +174,13 @@
 #define PPC_INST_RFDI                   0x4c00004e
 #define PPC_INST_RFMCI                  0x4c00004c
 #define PPC_INST_MFSPR_DSCR             0x7c1102a6
-#define PPC_INST_MFSPR_DSCR_MASK        0xfc1fffff
+#define PPC_INST_MFSPR_DSCR_MASK        0xfc1ffffe
 #define PPC_INST_MTSPR_DSCR             0x7c1103a6
-#define PPC_INST_MTSPR_DSCR_MASK        0xfc1fffff
+#define PPC_INST_MTSPR_DSCR_MASK        0xfc1ffffe
 #define PPC_INST_MFSPR_DSCR_USER        0x7c0302a6
-#define PPC_INST_MFSPR_DSCR_USER_MASK   0xfc1fffff
+#define PPC_INST_MFSPR_DSCR_USER_MASK   0xfc1ffffe
 #define PPC_INST_MTSPR_DSCR_USER        0x7c0303a6
-#define PPC_INST_MTSPR_DSCR_USER_MASK   0xfc1fffff
+#define PPC_INST_MTSPR_DSCR_USER_MASK   0xfc1ffffe
 #define PPC_INST_MFVSRD                 0x7c000066
 #define PPC_INST_MTVSRD                 0x7c000166
 #define PPC_INST_SLBFEE                 0x7c0007a7
diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
index 8180bfd7ab93..9de7f79e702b 100644
--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -298,9 +298,17 @@ void eeh_slot_error_detail(struct eeh_pe *pe, int severity)
          *
          * For pHyp, we have to enable IO for log retrieval. Otherwise,
          * 0xFF's is always returned from PCI config space.
+         *
+         * When the @severity is EEH_LOG_PERM, the PE is going to be
+         * removed. Prior to that, the drivers for devices included in
+         * the PE will be closed. The drivers rely on working IO path
+         * to bring the devices to quiet state. Otherwise, PCI traffic
+         * from those devices after they are removed is like to cause
+         * another unexpected EEH error.
          */
         if (!(pe->type & EEH_PE_PHB)) {
-                if (eeh_has_flag(EEH_ENABLE_IO_FOR_LOG))
+                if (eeh_has_flag(EEH_ENABLE_IO_FOR_LOG) ||
+                    severity == EEH_LOG_PERM)
                         eeh_pci_enable(pe, EEH_OPT_THAW_MMIO);
 
                 /*
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index e4744ff38a17..925a4ef90559 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -463,6 +463,10 @@ static int fpr_set(struct task_struct *target, const struct user_regset *regset,
 
         flush_fp_to_thread(target);
 
+        for (i = 0; i < 32 ; i++)
+                buf[i] = target->thread.TS_FPR(i);
+        buf[32] = target->thread.fp_state.fpscr;
+
         /* copy to local buffer then write that out */
         i = user_regset_copyin(&pos, &count, &kbuf, &ubuf, buf, 0, -1);
         if (i)
@@ -672,6 +676,9 @@ static int vsr_set(struct task_struct *target, const struct user_regset *regset,
         flush_altivec_to_thread(target);
         flush_vsx_to_thread(target);
 
+        for (i = 0; i < 32 ; i++)
+                buf[i] = target->thread.fp_state.fpr[i][TS_VSRLOWOFFSET];
+
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                  buf, 0, 32 * sizeof(double));
         if (!ret)
@@ -1019,6 +1026,10 @@ static int tm_cfpr_set(struct task_struct *target,
         flush_fp_to_thread(target);
         flush_altivec_to_thread(target);
 
+        for (i = 0; i < 32; i++)
+                buf[i] = target->thread.TS_CKFPR(i);
+        buf[32] = target->thread.ckfp_state.fpscr;
+
         /* copy to local buffer then write that out */
         i = user_regset_copyin(&pos, &count, &kbuf, &ubuf, buf, 0, -1);
         if (i)
@@ -1283,6 +1294,9 @@ static int tm_cvsx_set(struct task_struct *target,
         flush_altivec_to_thread(target);
         flush_vsx_to_thread(target);
 
+        for (i = 0; i < 32 ; i++)
+                buf[i] = target->thread.ckfp_state.fpr[i][TS_VSRLOWOFFSET];
+
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                  buf, 0, 32 * sizeof(double));
         if (!ret)
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 80334937e14f..67e19a0821be 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -747,7 +747,7 @@ static unsigned long __init htab_get_table_size(void)
 }
 
 #ifdef CONFIG_MEMORY_HOTPLUG
-int create_section_mapping(unsigned long start, unsigned long end)
+int hash__create_section_mapping(unsigned long start, unsigned long end)
 {
         int rc = htab_bolt_mapping(start, end, __pa(start),
                                    pgprot_val(PAGE_KERNEL), mmu_linear_psize,
@@ -761,7 +761,7 @@ int create_section_mapping(unsigned long start, unsigned long end)
         return rc;
 }
 
-int remove_section_mapping(unsigned long start, unsigned long end)
+int hash__remove_section_mapping(unsigned long start, unsigned long end)
 {
         int rc = htab_remove_mapping(start, end, mmu_linear_psize,
                                      mmu_kernel_ssize);
diff --git a/arch/powerpc/mm/hugetlbpage-hash64.c b/arch/powerpc/mm/hugetlbpage-hash64.c
index d5026f3800b6..37b5f91e381b 100644
--- a/arch/powerpc/mm/hugetlbpage-hash64.c
+++ b/arch/powerpc/mm/hugetlbpage-hash64.c
@@ -125,11 +125,14 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
 int hugepd_ok(hugepd_t hpd)
 {
         bool is_hugepd;
+        unsigned long hpdval;
+
+        hpdval = hpd_val(hpd);
 
         /*
          * We should not find this format in page directory, warn otherwise.
          */
-        is_hugepd = (((hpd.pd & 0x3) == 0x0) && ((hpd.pd & HUGEPD_SHIFT_MASK) != 0));
+        is_hugepd = (((hpdval & 0x3) == 0x0) && ((hpdval & HUGEPD_SHIFT_MASK) != 0));
         WARN(is_hugepd, "Found wrong page directory format\n");
         return 0;
 }
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 289df38fb7e0..8c3389cbcd12 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -53,7 +53,7 @@ static u64 gpage_freearray[MAX_NUMBER_GPAGES];
 static unsigned nr_gpages;
 #endif
 
-#define hugepd_none(hpd)        ((hpd).pd == 0)
+#define hugepd_none(hpd)        (hpd_val(hpd) == 0)
 
 pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
 {
@@ -103,24 +103,24 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t *hpdp,
         for (i = 0; i < num_hugepd; i++, hpdp++) {
                 if (unlikely(!hugepd_none(*hpdp)))
                         break;
-                else
+                else {
 #ifdef CONFIG_PPC_BOOK3S_64
-                        hpdp->pd = __pa(new) |
-                                   (shift_to_mmu_psize(pshift) << 2);
+                        *hpdp = __hugepd(__pa(new) |
+                                         (shift_to_mmu_psize(pshift) << 2));
 #elif defined(CONFIG_PPC_8xx)
-                        hpdp->pd = __pa(new) |
-                                   (pshift == PAGE_SHIFT_8M ? _PMD_PAGE_8M :
-                                                              _PMD_PAGE_512K) |
-                                   _PMD_PRESENT;
+                        *hpdp = __hugepd(__pa(new) |
+                                         (pshift == PAGE_SHIFT_8M ? _PMD_PAGE_8M :
+                                          _PMD_PAGE_512K) | _PMD_PRESENT);
 #else
                         /* We use the old format for PPC_FSL_BOOK3E */
-                        hpdp->pd = ((unsigned long)new & ~PD_HUGE) | pshift;
+                        *hpdp = __hugepd(((unsigned long)new & ~PD_HUGE) | pshift);
 #endif
+                }
         }
         /* If we bailed from the for loop early, an error occurred, clean up */
         if (i < num_hugepd) {
                 for (i = i - 1 ; i >= 0; i--, hpdp--)
-                        hpdp->pd = 0;
+                        *hpdp = __hugepd(0);
                 kmem_cache_free(cachep, new);
         }
         spin_unlock(&mm->page_table_lock);
@@ -454,7 +454,7 @@ static void free_hugepd_range(struct mmu_gather *tlb, hugepd_t *hpdp, int pdshif
                 return;
 
         for (i = 0; i < num_hugepd; i++, hpdp++)
-                hpdp->pd = 0;
+                *hpdp = __hugepd(0);
 
         if (shift >= pdshift)
                 hugepd_free(tlb, hugepte);
@@ -810,12 +810,8 @@ static int __init hugetlbpage_init(void)
                  * if we have pdshift and shift value same, we don't
                  * use pgt cache for hugepd.
                  */
-                if (pdshift > shift) {
+                if (pdshift > shift)
                         pgtable_cache_add(pdshift - shift, NULL);
-                        if (!PGT_CACHE(pdshift - shift))
-                                panic("hugetlbpage_init(): could not create "
-                                      "pgtable cache for %d bit pagesize\n", shift);
-                }
 #if defined(CONFIG_PPC_FSL_BOOK3E) || defined(CONFIG_PPC_8xx)
                 else if (!hugepte_cache) {
                         /*
@@ -852,9 +848,6 @@ static int __init hugetlbpage_init(void)
         else if (mmu_psize_defs[MMU_PAGE_2M].shift)
                 HPAGE_SHIFT = mmu_psize_defs[MMU_PAGE_2M].shift;
 #endif
-        else
-                panic("%s: Unable to set default huge page size\n", __func__);
-
         return 0;
 }
 
diff --git a/arch/powerpc/mm/init-common.c b/arch/powerpc/mm/init-common.c
index a175cd82ae8c..f2108c40e697 100644
--- a/arch/powerpc/mm/init-common.c
+++ b/arch/powerpc/mm/init-common.c
@@ -78,8 +78,12 @@ void pgtable_cache_add(unsigned shift, void (*ctor)(void *))
         align = max_t(unsigned long, align, minalign);
         name = kasprintf(GFP_KERNEL, "pgtable-2^%d", shift);
         new = kmem_cache_create(name, table_size, align, 0, ctor);
+        if (!new)
+                panic("Could not allocate pgtable cache for order %d", shift);
+
         kfree(name);
         pgtable_cache[shift - 1] = new;
+
         pr_debug("Allocated pgtable cache for order %d\n", shift);
 }
 
@@ -88,7 +92,7 @@ void pgtable_cache_init(void)
 {
         pgtable_cache_add(PGD_INDEX_SIZE, pgd_ctor);
 
-        if (PMD_INDEX_SIZE && !PGT_CACHE(PMD_INDEX_SIZE))
+        if (PMD_CACHE_INDEX && !PGT_CACHE(PMD_CACHE_INDEX))
                 pgtable_cache_add(PMD_CACHE_INDEX, pmd_ctor);
         /*
          * In all current configs, when the PUD index exists it's the
@@ -97,11 +101,4 @@ void pgtable_cache_init(void)
          */
         if (PUD_INDEX_SIZE && !PGT_CACHE(PUD_INDEX_SIZE))
                 pgtable_cache_add(PUD_INDEX_SIZE, pud_ctor);
-
-        if (!PGT_CACHE(PGD_INDEX_SIZE))
-                panic("Couldn't allocate pgd cache");
-        if (PMD_INDEX_SIZE && !PGT_CACHE(PMD_INDEX_SIZE))
-                panic("Couldn't allocate pmd pgtable caches");
-        if (PUD_INDEX_SIZE && !PGT_CACHE(PUD_INDEX_SIZE))
-                panic("Couldn't allocate pud pgtable caches");
 }
diff --git a/arch/powerpc/mm/pgtable-book3s64.c b/arch/powerpc/mm/pgtable-book3s64.c
index ebf9782bacf9..653ff6c74ebe 100644
--- a/arch/powerpc/mm/pgtable-book3s64.c
+++ b/arch/powerpc/mm/pgtable-book3s64.c
@@ -126,3 +126,21 @@ void mmu_cleanup_all(void)
         else if (mmu_hash_ops.hpte_clear_all)
                 mmu_hash_ops.hpte_clear_all();
 }
+
+#ifdef CONFIG_MEMORY_HOTPLUG
+int create_section_mapping(unsigned long start, unsigned long end)
+{
+        if (radix_enabled())
+                return -ENODEV;
+
+        return hash__create_section_mapping(start, end);
+}
+
+int remove_section_mapping(unsigned long start, unsigned long end)
+{
+        if (radix_enabled())
+                return -ENODEV;
+
+        return hash__remove_section_mapping(start, end);
+}
+#endif /* CONFIG_MEMORY_HOTPLUG */
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index fd3e4034c04d..270eb9b74e2e 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -295,6 +295,8 @@ static inline void perf_read_regs(struct pt_regs *regs)
          */
         if (TRAP(regs) != 0xf00)
                 use_siar = 0;
+        else if ((ppmu->flags & PPMU_NO_SIAR))
+                use_siar = 0;
         else if (marked)
                 use_siar = 1;
         else if ((ppmu->flags & PPMU_NO_CONT_SAMPLING))
diff --git a/arch/powerpc/perf/power9-events-list.h b/arch/powerpc/perf/power9-events-list.h
index 6447dc1c3d89..929b56d47ad9 100644
--- a/arch/powerpc/perf/power9-events-list.h
+++ b/arch/powerpc/perf/power9-events-list.h
@@ -16,7 +16,7 @@ EVENT(PM_CYC,					0x0001e)
 EVENT(PM_ICT_NOSLOT_CYC,                        0x100f8)
 EVENT(PM_CMPLU_STALL,                           0x1e054)
 EVENT(PM_INST_CMPL,                             0x00002)
-EVENT(PM_BRU_CMPL,                              0x40060)
+EVENT(PM_BRU_CMPL,                              0x10012)
 EVENT(PM_BR_MPRED_CMPL,                         0x400f6)
 
 /* All L1 D cache load references counted at finish, gated by reject */
diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
index 346010e8d463..7332634e18c9 100644
--- a/arch/powerpc/perf/power9-pmu.c
+++ b/arch/powerpc/perf/power9-pmu.c
@@ -384,7 +384,7 @@ static struct power_pmu power9_isa207_pmu = {
         .bhrb_filter_map        = power9_bhrb_filter_map,
         .get_constraint         = isa207_get_constraint,
         .disable_pmc            = isa207_disable_pmc,
-        .flags                  = PPMU_HAS_SIER | PPMU_ARCH_207S,
+        .flags                  = PPMU_NO_SIAR | PPMU_ARCH_207S,
         .n_generic              = ARRAY_SIZE(power9_generic_events),
         .generic_events         = power9_generic_events,
         .cache_events           = &power9_cache_events,
diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
index d38e86fd5720..60c57657c772 100644
--- a/arch/powerpc/sysdev/xics/icp-opal.c
+++ b/arch/powerpc/sysdev/xics/icp-opal.c
@@ -20,6 +20,7 @@
 #include <asm/xics.h>
 #include <asm/io.h>
 #include <asm/opal.h>
+#include <asm/kvm_ppc.h>
 
 static void icp_opal_teardown_cpu(void)
 {
@@ -39,7 +40,26 @@ static void icp_opal_flush_ipi(void)
          * Should we be flagging idle loop instead?
          * Or creating some task to be scheduled?
          */
-        opal_int_eoi((0x00 << 24) | XICS_IPI);
+        if (opal_int_eoi((0x00 << 24) | XICS_IPI) > 0)
+                force_external_irq_replay();
+}
+
+static unsigned int icp_opal_get_xirr(void)
+{
+        unsigned int kvm_xirr;
+        __be32 hw_xirr;
+        int64_t rc;
+
+        /* Handle an interrupt latched by KVM first */
+        kvm_xirr = kvmppc_get_xics_latch();
+        if (kvm_xirr)
+                return kvm_xirr;
+
+        /* Then ask OPAL */
+        rc = opal_int_get_xirr(&hw_xirr, false);
+        if (rc < 0)
+                return 0;
+        return be32_to_cpu(hw_xirr);
 }
 
 static unsigned int icp_opal_get_irq(void)
@@ -47,12 +67,8 @@ static unsigned int icp_opal_get_irq(void)
         unsigned int xirr;
         unsigned int vec;
         unsigned int irq;
-        int64_t rc;
 
-        rc = opal_int_get_xirr(&xirr, false);
-        if (rc < 0)
-                return 0;
-        xirr = be32_to_cpu(xirr);
+        xirr = icp_opal_get_xirr();
         vec = xirr & 0x00ffffff;
         if (vec == XICS_IRQ_SPURIOUS)
                 return 0;
@@ -67,7 +83,8 @@ static unsigned int icp_opal_get_irq(void)
         xics_mask_unknown_vec(vec);
 
         /* We might learn about it later, so EOI it */
-        opal_int_eoi(xirr);
+        if (opal_int_eoi(xirr) > 0)
+                force_external_irq_replay();
 
         return 0;
 }
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index e659daffe368..e00975361fec 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -69,7 +69,7 @@ CONFIG_CMA=y
 CONFIG_CMA_DEBUG=y
 CONFIG_CMA_DEBUGFS=y
 CONFIG_MEM_SOFT_DIRTY=y
-CONFIG_ZPOOL=m
+CONFIG_ZSWAP=y
 CONFIG_ZBUD=m
 CONFIG_ZSMALLOC=m
 CONFIG_ZSMALLOC_STAT=y
@@ -141,8 +141,6 @@ CONFIG_NF_CONNTRACK_SECMARK=y
 CONFIG_NF_CONNTRACK_EVENTS=y
 CONFIG_NF_CONNTRACK_TIMEOUT=y
 CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CT_PROTO_DCCP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
@@ -159,13 +157,12 @@ CONFIG_NF_TABLES=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_AUDIT=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
@@ -219,7 +216,6 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
-CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -258,7 +254,6 @@ CONFIG_IP_VS_NQ=m
 CONFIG_IP_VS_FTP=m
 CONFIG_IP_VS_PE_SIP=m
 CONFIG_NF_CONNTRACK_IPV4=m
-# CONFIG_NF_CONNTRACK_PROC_COMPAT is not set
 CONFIG_NF_TABLES_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NF_TABLES_ARP=m
@@ -436,7 +431,6 @@ CONFIG_EQUALIZER=m
 CONFIG_IFB=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
-CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_TUN=m
 CONFIG_VETH=m
@@ -480,6 +474,7 @@ CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXT4_ENCRYPTION=y
 CONFIG_JBD2_DEBUG=y
 CONFIG_JFS_FS=m
 CONFIG_JFS_POSIX_ACL=y
@@ -592,14 +587,12 @@ CONFIG_LOCK_STAT=y
 CONFIG_DEBUG_LOCKDEP=y
 CONFIG_DEBUG_ATOMIC_SLEEP=y
 CONFIG_DEBUG_LOCKING_API_SELFTESTS=y
-CONFIG_DEBUG_LIST=y
 CONFIG_DEBUG_SG=y
 CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_DEBUG_CREDENTIALS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=300
 CONFIG_NOTIFIER_ERROR_INJECTION=m
-CONFIG_CPU_NOTIFIER_ERROR_INJECT=m
 CONFIG_PM_NOTIFIER_ERROR_INJECT=m
 CONFIG_FAULT_INJECTION=y
 CONFIG_FAILSLAB=y
@@ -618,6 +611,7 @@ CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
 CONFIG_UPROBE_EVENT=y
 CONFIG_FUNCTION_PROFILER=y
+CONFIG_HIST_TRIGGERS=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_LKDTM=m
 CONFIG_TEST_LIST_SORT=y
@@ -630,6 +624,7 @@ CONFIG_TEST_STRING_HELPERS=y
 CONFIG_TEST_KSTRTOX=y
 CONFIG_DMA_API_DEBUG=y
 CONFIG_TEST_BPF=m
+CONFIG_BUG_ON_DATA_CORRUPTION=y
 CONFIG_S390_PTDUMP=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
@@ -640,16 +635,18 @@ CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
 CONFIG_SECURITY_SELINUX_DISABLE=y
 CONFIG_IMA=y
 CONFIG_IMA_APPRAISE=y
+CONFIG_CRYPTO_RSA=m
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_USER=m
-# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_GCM=m
-CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
-CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_KEYWRAP=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -673,11 +670,13 @@ CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
-CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
+CONFIG_CRYPTO_USER_API_RNG=m
+CONFIG_CRYPTO_USER_API_AEAD=m
 CONFIG_ZCRYPT=m
 CONFIG_CRYPTO_SHA1_S390=m
 CONFIG_CRYPTO_SHA256_S390=m
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index 95ceac50bc65..f05d2d6e1087 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -12,6 +12,7 @@ CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_NUMA_BALANCING=y
+# CONFIG_NUMA_BALANCING_DEFAULT_ENABLED is not set
 CONFIG_MEMCG=y
 CONFIG_MEMCG_SWAP=y
 CONFIG_BLK_CGROUP=y
@@ -54,8 +55,9 @@ CONFIG_SOLARIS_X86_PARTITION=y
 CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_DEFAULT_DEADLINE=y
+CONFIG_LIVEPATCH=y
 CONFIG_TUNE_ZEC12=y
-CONFIG_NR_CPUS=256
+CONFIG_NR_CPUS=512
 CONFIG_NUMA=y
 CONFIG_HZ_100=y
 CONFIG_MEMORY_HOTPLUG=y
@@ -65,6 +67,7 @@ CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_CLEANCACHE=y
 CONFIG_FRONTSWAP=y
 CONFIG_CMA=y
+CONFIG_MEM_SOFT_DIRTY=y
 CONFIG_ZSWAP=y
 CONFIG_ZBUD=m
 CONFIG_ZSMALLOC=m
@@ -136,8 +139,6 @@ CONFIG_NF_CONNTRACK_SECMARK=y
 CONFIG_NF_CONNTRACK_EVENTS=y
 CONFIG_NF_CONNTRACK_TIMEOUT=y
 CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CT_PROTO_DCCP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
@@ -154,13 +155,12 @@ CONFIG_NF_TABLES=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_AUDIT=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
@@ -214,7 +214,6 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
-CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -253,7 +252,6 @@ CONFIG_IP_VS_NQ=m
 CONFIG_IP_VS_FTP=m
 CONFIG_IP_VS_PE_SIP=m
 CONFIG_NF_CONNTRACK_IPV4=m
-# CONFIG_NF_CONNTRACK_PROC_COMPAT is not set
 CONFIG_NF_TABLES_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NF_TABLES_ARP=m
@@ -430,7 +428,6 @@ CONFIG_EQUALIZER=m
 CONFIG_IFB=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
-CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_TUN=m
 CONFIG_VETH=m
@@ -460,6 +457,7 @@ CONFIG_HW_RANDOM_VIRTIO=m
 CONFIG_RAW_DRIVER=m
 CONFIG_HANGCHECK_TIMER=m
 CONFIG_TN3270_FS=y
+# CONFIG_HWMON is not set
 CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_NOWAYOUT=y
 CONFIG_SOFT_WATCHDOG=m
@@ -473,6 +471,7 @@ CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXT4_ENCRYPTION=y
 CONFIG_JBD2_DEBUG=y
 CONFIG_JFS_FS=m
 CONFIG_JFS_POSIX_ACL=y
@@ -495,6 +494,7 @@ CONFIG_AUTOFS4_FS=m
 CONFIG_FUSE_FS=y
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
+CONFIG_OVERLAY_FS_REDIRECT_DIR=y
 CONFIG_FSCACHE=m
 CONFIG_CACHEFILES=m
 CONFIG_ISO9660_FS=y
@@ -551,25 +551,27 @@ CONFIG_FRAME_WARN=1024
 CONFIG_UNUSED_SYMBOLS=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_MEMORY_INIT=y
-CONFIG_MEMORY_NOTIFIER_ERROR_INJECT=m
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_TIMER_STATS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
-CONFIG_NOTIFIER_ERROR_INJECTION=m
-CONFIG_CPU_NOTIFIER_ERROR_INJECT=m
-CONFIG_PM_NOTIFIER_ERROR_INJECT=m
 CONFIG_LATENCYTOP=y
+CONFIG_SCHED_TRACER=y
+CONFIG_FTRACE_SYSCALLS=y
+CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-# CONFIG_KPROBE_EVENT is not set
+CONFIG_UPROBE_EVENT=y
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_HIST_TRIGGERS=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_LKDTM=m
-CONFIG_RBTREE_TEST=m
-CONFIG_INTERVAL_TREE_TEST=m
 CONFIG_PERCPU_TEST=m
 CONFIG_ATOMIC64_SELFTEST=y
 CONFIG_TEST_BPF=m
+CONFIG_BUG_ON_DATA_CORRUPTION=y
 CONFIG_S390_PTDUMP=y
+CONFIG_PERSISTENT_KEYRINGS=y
+CONFIG_BIG_KEYS=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
@@ -577,18 +579,25 @@ CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
 CONFIG_SECURITY_SELINUX_DISABLE=y
+CONFIG_INTEGRITY_SIGNATURE=y
+CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
 CONFIG_IMA=y
+CONFIG_IMA_WRITE_POLICY=y
 CONFIG_IMA_APPRAISE=y
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_USER=m
 # CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set
+CONFIG_CRYPTO_PCRYPT=m
 CONFIG_CRYPTO_CRYPTD=m
+CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_GCM=m
-CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
-CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_KEYWRAP=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -598,6 +607,7 @@ CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_ANUBIS=m
@@ -612,10 +622,13 @@ CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
+CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
+CONFIG_CRYPTO_USER_API_RNG=m
+CONFIG_CRYPTO_USER_API_AEAD=m
 CONFIG_ZCRYPT=m
 CONFIG_CRYPTO_SHA1_S390=m
 CONFIG_CRYPTO_SHA256_S390=m
@@ -624,9 +637,6 @@ CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
-CONFIG_ASYMMETRIC_KEY_TYPE=y
-CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
-CONFIG_X509_CERTIFICATE_PARSER=m
 CONFIG_CRC7=m
 CONFIG_CRC8=m
 CONFIG_CORDIC=m
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index bc7b176f5795..2cf87343b590 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -65,6 +65,7 @@ CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_CLEANCACHE=y
 CONFIG_FRONTSWAP=y
 CONFIG_CMA=y
+CONFIG_MEM_SOFT_DIRTY=y
 CONFIG_ZSWAP=y
 CONFIG_ZBUD=m
 CONFIG_ZSMALLOC=m
@@ -136,8 +137,6 @@ CONFIG_NF_CONNTRACK_SECMARK=y
 CONFIG_NF_CONNTRACK_EVENTS=y
 CONFIG_NF_CONNTRACK_TIMEOUT=y
 CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CT_PROTO_DCCP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
@@ -154,13 +153,12 @@ CONFIG_NF_TABLES=m
 CONFIG_NFT_EXTHDR=m
 CONFIG_NFT_META=m
 CONFIG_NFT_CT=m
-CONFIG_NFT_RBTREE=m
-CONFIG_NFT_HASH=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_AUDIT=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
@@ -214,7 +212,6 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
-CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -253,7 +250,6 @@ CONFIG_IP_VS_NQ=m
 CONFIG_IP_VS_FTP=m
 CONFIG_IP_VS_PE_SIP=m
 CONFIG_NF_CONNTRACK_IPV4=m
-# CONFIG_NF_CONNTRACK_PROC_COMPAT is not set
 CONFIG_NF_TABLES_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NF_TABLES_ARP=m
@@ -430,7 +426,6 @@ CONFIG_EQUALIZER=m
 CONFIG_IFB=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
-CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_TUN=m
 CONFIG_VETH=m
@@ -474,6 +469,7 @@ CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXT4_ENCRYPTION=y
 CONFIG_JBD2_DEBUG=y
 CONFIG_JFS_FS=m
 CONFIG_JFS_POSIX_ACL=y
@@ -496,6 +492,7 @@ CONFIG_AUTOFS4_FS=m
 CONFIG_FUSE_FS=y
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
+CONFIG_OVERLAY_FS_REDIRECT_DIR=y
 CONFIG_FSCACHE=m
 CONFIG_CACHEFILES=m
 CONFIG_ISO9660_FS=y
@@ -563,12 +560,16 @@ CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
 CONFIG_UPROBE_EVENT=y
 CONFIG_FUNCTION_PROFILER=y
+CONFIG_HIST_TRIGGERS=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_LKDTM=m
 CONFIG_PERCPU_TEST=m
 CONFIG_ATOMIC64_SELFTEST=y
 CONFIG_TEST_BPF=m
+CONFIG_BUG_ON_DATA_CORRUPTION=y
 CONFIG_S390_PTDUMP=y
+CONFIG_PERSISTENT_KEYRINGS=y
+CONFIG_BIG_KEYS=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
@@ -576,18 +577,25 @@ CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
 CONFIG_SECURITY_SELINUX_DISABLE=y
+CONFIG_INTEGRITY_SIGNATURE=y
+CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
 CONFIG_IMA=y
+CONFIG_IMA_WRITE_POLICY=y
 CONFIG_IMA_APPRAISE=y
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_USER=m
 # CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set
+CONFIG_CRYPTO_PCRYPT=m
 CONFIG_CRYPTO_CRYPTD=m
+CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_GCM=m
-CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
-CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_KEYWRAP=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -597,6 +605,7 @@ CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_ANUBIS=m
@@ -611,10 +620,13 @@ CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
+CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
+CONFIG_CRYPTO_USER_API_RNG=m
+CONFIG_CRYPTO_USER_API_AEAD=m
 CONFIG_ZCRYPT=m
 CONFIG_CRYPTO_SHA1_S390=m
 CONFIG_CRYPTO_SHA256_S390=m
@@ -623,9 +635,6 @@ CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
-CONFIG_ASYMMETRIC_KEY_TYPE=y
-CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
-CONFIG_X509_CERTIFICATE_PARSER=m
 CONFIG_CRC7=m
 CONFIG_CRC8=m
 CONFIG_CORDIC=m
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 2d40ef0a6295..d00e368fb5e6 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -38,7 +38,6 @@ CONFIG_JUMP_LABEL=y
 CONFIG_STATIC_KEYS_SELFTEST=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
-CONFIG_MODVERSIONS=y
 CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
@@ -130,8 +129,11 @@ CONFIG_DUMMY=m
 CONFIG_EQUALIZER=m
 CONFIG_TUN=m
 CONFIG_VIRTIO_NET=y
+# CONFIG_NET_VENDOR_ALACRITECH is not set
+# CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
+CONFIG_DEVKMEM=y
 CONFIG_RAW_DRIVER=m
 CONFIG_VIRTIO_BALLOON=y
 CONFIG_EXT4_FS=y
@@ -183,7 +185,6 @@ CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_KPROBES_SANITY_TEST=y
 CONFIG_S390_PTDUMP=y
 CONFIG_CRYPTO_CRYPTD=m
-CONFIG_CRYPTO_AUTHENC=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_GCM=m
diff --git a/arch/s390/include/asm/ctl_reg.h b/arch/s390/include/asm/ctl_reg.h
index d7697ab802f6..8e136b88cdf4 100644
--- a/arch/s390/include/asm/ctl_reg.h
+++ b/arch/s390/include/asm/ctl_reg.h
@@ -15,7 +15,9 @@
         BUILD_BUG_ON(sizeof(addrtype) != (high - low + 1) * sizeof(long));\
         asm volatile(                                                   \
                 "       lctlg   %1,%2,%0\n"                             \
-                : : "Q" (*(addrtype *)(&array)), "i" (low), "i" (high));\
+                :                                                       \
+                : "Q" (*(addrtype *)(&array)), "i" (low), "i" (high)    \
+                : "memory");                                            \
 }
 
 #define __ctl_store(array, low, high) {                                 \
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index bec71e902be3..6484a250021e 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -916,7 +916,7 @@ static int kvm_s390_get_machine(struct kvm *kvm, struct kvm_device_attr *attr)
         memcpy(&mach->fac_mask, kvm->arch.model.fac_mask,
                S390_ARCH_FAC_LIST_SIZE_BYTE);
         memcpy((unsigned long *)&mach->fac_list, S390_lowcore.stfle_fac_list,
-               S390_ARCH_FAC_LIST_SIZE_BYTE);
+               sizeof(S390_lowcore.stfle_fac_list));
         if (copy_to_user((void __user *)attr->addr, mach, sizeof(*mach)))
                 ret = -EFAULT;
         kfree(mach);
@@ -1437,7 +1437,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 
         /* Populate the facility mask initially. */
         memcpy(kvm->arch.model.fac_mask, S390_lowcore.stfle_fac_list,
-               S390_ARCH_FAC_LIST_SIZE_BYTE);
+               sizeof(S390_lowcore.stfle_fac_list));
         for (i = 0; i < S390_ARCH_FAC_LIST_SIZE_U64; i++) {
                 if (i < kvm_s390_fac_list_mask_size())
                         kvm->arch.model.fac_mask[i] &= kvm_s390_fac_list_mask[i];
diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
index 05612a2529c8..496e60391fac 100644
--- a/arch/x86/events/amd/ibs.c
+++ b/arch/x86/events/amd/ibs.c
@@ -1010,7 +1010,7 @@ static __init int amd_ibs_init(void)
          * all online cpus.
          */
         cpuhp_setup_state(CPUHP_AP_PERF_X86_AMD_IBS_STARTING,
-                          "perf/x86/amd/ibs:STARTING",
+                          "perf/x86/amd/ibs:starting",
                           x86_pmu_amd_ibs_starting_cpu,
                           x86_pmu_amd_ibs_dying_cpu);
 
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index d611cab214a6..eb1484c86bb4 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3176,13 +3176,16 @@ static void intel_pmu_cpu_starting(int cpu)
 
         if (x86_pmu.flags & PMU_FL_EXCL_CNTRS) {
                 for_each_cpu(i, topology_sibling_cpumask(cpu)) {
+                        struct cpu_hw_events *sibling;
                         struct intel_excl_cntrs *c;
 
-                        c = per_cpu(cpu_hw_events, i).excl_cntrs;
+                        sibling = &per_cpu(cpu_hw_events, i);
+                        c = sibling->excl_cntrs;
                         if (c && c->core_id == core_id) {
                                 cpuc->kfree_on_online[1] = cpuc->excl_cntrs;
                                 cpuc->excl_cntrs = c;
-                                cpuc->excl_thread_id = 1;
+                                if (!sibling->excl_thread_id)
+                                        cpuc->excl_thread_id = 1;
                                 break;
                         }
                 }
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 945e512a112a..1e35dd06b090 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1875,6 +1875,7 @@ static struct irq_chip ioapic_chip __read_mostly = {
         .irq_ack                = irq_chip_ack_parent,
         .irq_eoi                = ioapic_ack_level,
         .irq_set_affinity       = ioapic_set_affinity,
+        .irq_retrigger          = irq_chip_retrigger_hierarchy,
         .flags                  = IRQCHIP_SKIP_SET_WAKE,
 };
 
@@ -1886,6 +1887,7 @@ static struct irq_chip ioapic_ir_chip __read_mostly = {
         .irq_ack                = irq_chip_ack_parent,
         .irq_eoi                = ioapic_ir_ack_level,
         .irq_set_affinity       = ioapic_set_affinity,
+        .irq_retrigger          = irq_chip_retrigger_hierarchy,
         .flags                  = IRQCHIP_SKIP_SET_WAKE,
 };
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 57d8a856cdc5..d153be8929a6 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6171,7 +6171,8 @@ static int emulator_fix_hypercall(struct x86_emulate_ctxt *ctxt)
 
         kvm_x86_ops->patch_hypercall(vcpu, instruction);
 
-        return emulator_write_emulated(ctxt, rip, instruction, 3, NULL);
+        return emulator_write_emulated(ctxt, rip, instruction, 3,
+                &ctxt->exception);
 }
 
 static int dm_request_for_irq_injection(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index 3cd69832d7f4..3961103e9176 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -114,6 +114,16 @@ static const struct dmi_system_id pci_crs_quirks[] __initconst = {
                         DMI_MATCH(DMI_BIOS_VERSION, "6JET85WW (1.43 )"),
                 },
         },
+        /* https://bugzilla.kernel.org/show_bug.cgi?id=42606 */
+        {
+                .callback = set_nouse_crs,
+                .ident = "Supermicro X8DTH",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Supermicro"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X8DTH-i/6/iF/6F"),
+                        DMI_MATCH(DMI_BIOS_VERSION, "2.0a"),
+                },
+        },
 
         /* https://bugzilla.kernel.org/show_bug.cgi?id=15362 */
         {
diff --git a/block/blk-mq.c b/block/blk-mq.c
index a8e67a155d04..c3400b5444a7 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -912,7 +912,6 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
 static void blk_mq_process_rq_list(struct blk_mq_hw_ctx *hctx)
 {
         LIST_HEAD(rq_list);
-        LIST_HEAD(driver_list);
 
         if (unlikely(blk_mq_hctx_stopped(hctx)))
                 return;
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 50a2020b5b72..9fd06eeb1a17 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -271,7 +271,7 @@ static inline int sock_send_bvec(struct nbd_device *nbd, int index,
 static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
 {
         struct request *req = blk_mq_rq_from_pdu(cmd);
-        int result, flags;
+        int result;
         struct nbd_request request;
         unsigned long size = blk_rq_bytes(req);
         struct bio *bio;
@@ -310,7 +310,6 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
         if (type != NBD_CMD_WRITE)
                 return 0;
 
-        flags = 0;
         bio = req->bio;
         while (bio) {
                 struct bio *next = bio->bi_next;
@@ -319,9 +318,8 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
 
                 bio_for_each_segment(bvec, bio, iter) {
                         bool is_last = !next && bio_iter_last(bvec, iter);
+                        int flags = is_last ? 0 : MSG_MORE;
 
-                        if (is_last)
-                                flags = MSG_MORE;
                         dev_dbg(nbd_to_dev(nbd), "request %p: sending %d bytes data\n",
                                 cmd, bvec.bv_len);
                         result = sock_send_bvec(nbd, index, &bvec, flags);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 8b00e79c2683..17857beb4892 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1862,7 +1862,7 @@ static void config_work_handler(struct work_struct *work)
 {
         struct ports_device *portdev;
 
-        portdev = container_of(work, struct ports_device, control_work);
+        portdev = container_of(work, struct ports_device, config_work);
         if (!use_multiport(portdev)) {
                 struct virtio_device *vdev;
                 struct port *port;
diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
index 8c8b495cbf0d..cdc092a1d9ef 100644
--- a/drivers/clk/samsung/clk-exynos5420.c
+++ b/drivers/clk/samsung/clk-exynos5420.c
@@ -586,7 +586,7 @@ static const struct samsung_gate_clock exynos5800_gate_clks[] __initconst = {
         GATE(CLK_ACLK550_CAM, "aclk550_cam", "mout_user_aclk550_cam",
                                 GATE_BUS_TOP, 24, 0, 0),
         GATE(CLK_ACLK432_SCALER, "aclk432_scaler", "mout_user_aclk432_scaler",
-                                GATE_BUS_TOP, 27, 0, 0),
+                                GATE_BUS_TOP, 27, CLK_IS_CRITICAL, 0),
 };
 
 static const struct samsung_mux_clock exynos5420_mux_clks[] __initconst = {
@@ -956,20 +956,20 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = {
         GATE(CLK_SMMU_G2D, "smmu_g2d", "aclk333_g2d", GATE_IP_G2D, 7, 0, 0),
 
         GATE(0, "aclk200_fsys", "mout_user_aclk200_fsys",
-                        GATE_BUS_FSYS0, 9, CLK_IGNORE_UNUSED, 0),
+                        GATE_BUS_FSYS0, 9, CLK_IS_CRITICAL, 0),
         GATE(0, "aclk200_fsys2", "mout_user_aclk200_fsys2",
                         GATE_BUS_FSYS0, 10, CLK_IGNORE_UNUSED, 0),
 
         GATE(0, "aclk333_g2d", "mout_user_aclk333_g2d",
                         GATE_BUS_TOP, 0, CLK_IGNORE_UNUSED, 0),
         GATE(0, "aclk266_g2d", "mout_user_aclk266_g2d",
-                        GATE_BUS_TOP, 1, CLK_IGNORE_UNUSED, 0),
+                        GATE_BUS_TOP, 1, CLK_IS_CRITICAL, 0),
         GATE(0, "aclk300_jpeg", "mout_user_aclk300_jpeg",
                         GATE_BUS_TOP, 4, CLK_IGNORE_UNUSED, 0),
         GATE(0, "aclk333_432_isp0", "mout_user_aclk333_432_isp0",
                         GATE_BUS_TOP, 5, 0, 0),
         GATE(0, "aclk300_gscl", "mout_user_aclk300_gscl",
-                        GATE_BUS_TOP, 6, CLK_IGNORE_UNUSED, 0),
+                        GATE_BUS_TOP, 6, CLK_IS_CRITICAL, 0),
         GATE(0, "aclk333_432_gscl", "mout_user_aclk333_432_gscl",
                         GATE_BUS_TOP, 7, CLK_IGNORE_UNUSED, 0),
         GATE(0, "aclk333_432_isp", "mout_user_aclk333_432_isp",
@@ -983,20 +983,20 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = {
         GATE(0, "aclk166", "mout_user_aclk166",
                         GATE_BUS_TOP, 14, CLK_IGNORE_UNUSED, 0),
         GATE(CLK_ACLK333, "aclk333", "mout_user_aclk333",
-                        GATE_BUS_TOP, 15, CLK_IGNORE_UNUSED, 0),
+                        GATE_BUS_TOP, 15, CLK_IS_CRITICAL, 0),
         GATE(0, "aclk400_isp", "mout_user_aclk400_isp",
                         GATE_BUS_TOP, 16, 0, 0),
         GATE(0, "aclk400_mscl", "mout_user_aclk400_mscl",
                         GATE_BUS_TOP, 17, 0, 0),
         GATE(0, "aclk200_disp1", "mout_user_aclk200_disp1",
-                        GATE_BUS_TOP, 18, 0, 0),
+                        GATE_BUS_TOP, 18, CLK_IS_CRITICAL, 0),
         GATE(CLK_SCLK_MPHY_IXTAL24, "sclk_mphy_ixtal24", "mphy_refclk_ixtal24",
                         GATE_BUS_TOP, 28, 0, 0),
         GATE(CLK_SCLK_HSIC_12M, "sclk_hsic_12m", "ff_hsic_12m",
                         GATE_BUS_TOP, 29, 0, 0),
 
         GATE(0, "aclk300_disp1", "mout_user_aclk300_disp1",
-                        SRC_MASK_TOP2, 24, 0, 0),
+                        SRC_MASK_TOP2, 24, CLK_IS_CRITICAL, 0),
 
         GATE(CLK_MAU_EPLL, "mau_epll", "mout_mau_epll_clk",
                         SRC_MASK_TOP7, 20, 0, 0),
diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index 4da1dc2278bd..670ff0f25b67 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -495,6 +495,7 @@ static int exynos4_mct_dying_cpu(unsigned int cpu)
         if (mct_int_type == MCT_INT_SPI) {
                 if (evt->irq != -1)
                         disable_irq_nosync(evt->irq);
+                exynos4_mct_write(0x1, mevt->base + MCT_L_INT_CSTAT_OFFSET);
         } else {
                 disable_percpu_irq(mct_irqs[MCT_L0_IRQ]);
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
index 9999dc71b998..ccb5e02e7b20 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -2512,6 +2512,8 @@ static int dce_v10_0_cursor_move_locked(struct drm_crtc *crtc,
 
         WREG32(mmCUR_POSITION + amdgpu_crtc->crtc_offset, (x << 16) | y);
         WREG32(mmCUR_HOT_SPOT + amdgpu_crtc->crtc_offset, (xorigin << 16) | yorigin);
+        WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
+               ((amdgpu_crtc->cursor_width - 1) << 16) | (amdgpu_crtc->cursor_height - 1));
 
         return 0;
 }
@@ -2537,7 +2539,6 @@ static int dce_v10_0_crtc_cursor_set2(struct drm_crtc *crtc,
                                       int32_t hot_y)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
         struct drm_gem_object *obj;
         struct amdgpu_bo *aobj;
         int ret;
@@ -2578,7 +2579,9 @@ static int dce_v10_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
         dce_v10_0_lock_cursor(crtc, true);
 
-        if (hot_x != amdgpu_crtc->cursor_hot_x ||
+        if (width != amdgpu_crtc->cursor_width ||
+            height != amdgpu_crtc->cursor_height ||
+            hot_x != amdgpu_crtc->cursor_hot_x ||
             hot_y != amdgpu_crtc->cursor_hot_y) {
                 int x, y;
 
@@ -2587,16 +2590,10 @@ static int dce_v10_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
                 dce_v10_0_cursor_move_locked(crtc, x, y);
 
-                amdgpu_crtc->cursor_hot_x = hot_x;
-                amdgpu_crtc->cursor_hot_y = hot_y;
-        }
-
-        if (width != amdgpu_crtc->cursor_width ||
-            height != amdgpu_crtc->cursor_height) {
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (width - 1) << 16 | (height - 1));
                 amdgpu_crtc->cursor_width = width;
                 amdgpu_crtc->cursor_height = height;
+                amdgpu_crtc->cursor_hot_x = hot_x;
+                amdgpu_crtc->cursor_hot_y = hot_y;
         }
 
         dce_v10_0_show_cursor(crtc);
@@ -2620,7 +2617,6 @@ unpin:
 static void dce_v10_0_cursor_reset(struct drm_crtc *crtc)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
 
         if (amdgpu_crtc->cursor_bo) {
                 dce_v10_0_lock_cursor(crtc, true);
@@ -2628,10 +2624,6 @@ static void dce_v10_0_cursor_reset(struct drm_crtc *crtc)
                 dce_v10_0_cursor_move_locked(crtc, amdgpu_crtc->cursor_x,
                                              amdgpu_crtc->cursor_y);
 
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (amdgpu_crtc->cursor_width - 1) << 16 |
-                       (amdgpu_crtc->cursor_height - 1));
-
                 dce_v10_0_show_cursor(crtc);
 
                 dce_v10_0_lock_cursor(crtc, false);
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
index 2006abbbfb62..a7af5b33a5e3 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -2532,6 +2532,8 @@ static int dce_v11_0_cursor_move_locked(struct drm_crtc *crtc,
 
         WREG32(mmCUR_POSITION + amdgpu_crtc->crtc_offset, (x << 16) | y);
         WREG32(mmCUR_HOT_SPOT + amdgpu_crtc->crtc_offset, (xorigin << 16) | yorigin);
+        WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
+               ((amdgpu_crtc->cursor_width - 1) << 16) | (amdgpu_crtc->cursor_height - 1));
 
         return 0;
 }
@@ -2557,7 +2559,6 @@ static int dce_v11_0_crtc_cursor_set2(struct drm_crtc *crtc,
                                       int32_t hot_y)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
         struct drm_gem_object *obj;
         struct amdgpu_bo *aobj;
         int ret;
@@ -2598,7 +2599,9 @@ static int dce_v11_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
         dce_v11_0_lock_cursor(crtc, true);
 
-        if (hot_x != amdgpu_crtc->cursor_hot_x ||
+        if (width != amdgpu_crtc->cursor_width ||
+            height != amdgpu_crtc->cursor_height ||
+            hot_x != amdgpu_crtc->cursor_hot_x ||
             hot_y != amdgpu_crtc->cursor_hot_y) {
                 int x, y;
 
@@ -2607,16 +2610,10 @@ static int dce_v11_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
                 dce_v11_0_cursor_move_locked(crtc, x, y);
 
-                amdgpu_crtc->cursor_hot_x = hot_x;
-                amdgpu_crtc->cursor_hot_y = hot_y;
-        }
-
-        if (width != amdgpu_crtc->cursor_width ||
-            height != amdgpu_crtc->cursor_height) {
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (width - 1) << 16 | (height - 1));
                 amdgpu_crtc->cursor_width = width;
                 amdgpu_crtc->cursor_height = height;
+                amdgpu_crtc->cursor_hot_x = hot_x;
+                amdgpu_crtc->cursor_hot_y = hot_y;
         }
 
         dce_v11_0_show_cursor(crtc);
@@ -2640,7 +2637,6 @@ unpin:
 static void dce_v11_0_cursor_reset(struct drm_crtc *crtc)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
 
         if (amdgpu_crtc->cursor_bo) {
                 dce_v11_0_lock_cursor(crtc, true);
@@ -2648,10 +2644,6 @@ static void dce_v11_0_cursor_reset(struct drm_crtc *crtc)
                 dce_v11_0_cursor_move_locked(crtc, amdgpu_crtc->cursor_x,
                                              amdgpu_crtc->cursor_y);
 
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (amdgpu_crtc->cursor_width - 1) << 16 |
-                       (amdgpu_crtc->cursor_height - 1));
-
                 dce_v11_0_show_cursor(crtc);
 
                 dce_v11_0_lock_cursor(crtc, false);
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
index b4e4ec630e8c..39df6a50637f 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
@@ -1859,6 +1859,8 @@ static int dce_v6_0_cursor_move_locked(struct drm_crtc *crtc,
         struct amdgpu_device *adev = crtc->dev->dev_private;
         int xorigin = 0, yorigin = 0;
 
+        int w = amdgpu_crtc->cursor_width;
+
         amdgpu_crtc->cursor_x = x;
         amdgpu_crtc->cursor_y = y;
 
@@ -1878,6 +1880,8 @@ static int dce_v6_0_cursor_move_locked(struct drm_crtc *crtc,
 
         WREG32(mmCUR_POSITION + amdgpu_crtc->crtc_offset, (x << 16) | y);
         WREG32(mmCUR_HOT_SPOT + amdgpu_crtc->crtc_offset, (xorigin << 16) | yorigin);
+        WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
+               ((w - 1) << 16) | (amdgpu_crtc->cursor_height - 1));
 
         return 0;
 }
@@ -1903,7 +1907,6 @@ static int dce_v6_0_crtc_cursor_set2(struct drm_crtc *crtc,
                                      int32_t hot_y)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
         struct drm_gem_object *obj;
         struct amdgpu_bo *aobj;
         int ret;
@@ -1944,7 +1947,9 @@ static int dce_v6_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
         dce_v6_0_lock_cursor(crtc, true);
 
-        if (hot_x != amdgpu_crtc->cursor_hot_x ||
+        if (width != amdgpu_crtc->cursor_width ||
+            height != amdgpu_crtc->cursor_height ||
+            hot_x != amdgpu_crtc->cursor_hot_x ||
             hot_y != amdgpu_crtc->cursor_hot_y) {
                 int x, y;
 
@@ -1953,16 +1958,10 @@ static int dce_v6_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
                 dce_v6_0_cursor_move_locked(crtc, x, y);
 
-                amdgpu_crtc->cursor_hot_x = hot_x;
-                amdgpu_crtc->cursor_hot_y = hot_y;
-        }
-
-        if (width != amdgpu_crtc->cursor_width ||
-            height != amdgpu_crtc->cursor_height) {
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (width - 1) << 16 | (height - 1));
                 amdgpu_crtc->cursor_width = width;
                 amdgpu_crtc->cursor_height = height;
+                amdgpu_crtc->cursor_hot_x = hot_x;
+                amdgpu_crtc->cursor_hot_y = hot_y;
         }
 
         dce_v6_0_show_cursor(crtc);
@@ -1986,7 +1985,6 @@ unpin:
 static void dce_v6_0_cursor_reset(struct drm_crtc *crtc)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
 
         if (amdgpu_crtc->cursor_bo) {
                 dce_v6_0_lock_cursor(crtc, true);
@@ -1994,10 +1992,6 @@ static void dce_v6_0_cursor_reset(struct drm_crtc *crtc)
                 dce_v6_0_cursor_move_locked(crtc, amdgpu_crtc->cursor_x,
                                             amdgpu_crtc->cursor_y);
 
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (amdgpu_crtc->cursor_width - 1) << 16 |
-                       (amdgpu_crtc->cursor_height - 1));
-
                 dce_v6_0_show_cursor(crtc);
                 dce_v6_0_lock_cursor(crtc, false);
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
index 584abe834a3c..28102bb1704d 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -2363,6 +2363,8 @@ static int dce_v8_0_cursor_move_locked(struct drm_crtc *crtc,
 
         WREG32(mmCUR_POSITION + amdgpu_crtc->crtc_offset, (x << 16) | y);
         WREG32(mmCUR_HOT_SPOT + amdgpu_crtc->crtc_offset, (xorigin << 16) | yorigin);
+        WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
+               ((amdgpu_crtc->cursor_width - 1) << 16) | (amdgpu_crtc->cursor_height - 1));
 
         return 0;
 }
@@ -2388,7 +2390,6 @@ static int dce_v8_0_crtc_cursor_set2(struct drm_crtc *crtc,
                                      int32_t hot_y)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
         struct drm_gem_object *obj;
         struct amdgpu_bo *aobj;
         int ret;
@@ -2429,7 +2430,9 @@ static int dce_v8_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
         dce_v8_0_lock_cursor(crtc, true);
 
-        if (hot_x != amdgpu_crtc->cursor_hot_x ||
+        if (width != amdgpu_crtc->cursor_width ||
+            height != amdgpu_crtc->cursor_height ||
+            hot_x != amdgpu_crtc->cursor_hot_x ||
             hot_y != amdgpu_crtc->cursor_hot_y) {
                 int x, y;
 
@@ -2438,16 +2441,10 @@ static int dce_v8_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
                 dce_v8_0_cursor_move_locked(crtc, x, y);
 
-                amdgpu_crtc->cursor_hot_x = hot_x;
-                amdgpu_crtc->cursor_hot_y = hot_y;
-        }
-
-        if (width != amdgpu_crtc->cursor_width ||
-            height != amdgpu_crtc->cursor_height) {
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (width - 1) << 16 | (height - 1));
                 amdgpu_crtc->cursor_width = width;
                 amdgpu_crtc->cursor_height = height;
+                amdgpu_crtc->cursor_hot_x = hot_x;
+                amdgpu_crtc->cursor_hot_y = hot_y;
         }
 
         dce_v8_0_show_cursor(crtc);
@@ -2471,7 +2468,6 @@ unpin:
 static void dce_v8_0_cursor_reset(struct drm_crtc *crtc)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
 
         if (amdgpu_crtc->cursor_bo) {
                 dce_v8_0_lock_cursor(crtc, true);
@@ -2479,10 +2475,6 @@ static void dce_v8_0_cursor_reset(struct drm_crtc *crtc)
                 dce_v8_0_cursor_move_locked(crtc, amdgpu_crtc->cursor_x,
                                             amdgpu_crtc->cursor_y);
 
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (amdgpu_crtc->cursor_width - 1) << 16 |
-                       (amdgpu_crtc->cursor_height - 1));
-
                 dce_v8_0_show_cursor(crtc);
 
                 dce_v8_0_lock_cursor(crtc, false);
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index 45a573e63d4a..e2b0b1646f99 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -44,6 +44,7 @@ MODULE_FIRMWARE("radeon/tahiti_mc.bin");
 MODULE_FIRMWARE("radeon/pitcairn_mc.bin");
 MODULE_FIRMWARE("radeon/verde_mc.bin");
 MODULE_FIRMWARE("radeon/oland_mc.bin");
+MODULE_FIRMWARE("radeon/si58_mc.bin");
 
 #define MC_SEQ_MISC0__MT__MASK   0xf0000000
 #define MC_SEQ_MISC0__MT__GDDR1  0x10000000
@@ -113,6 +114,7 @@ static int gmc_v6_0_init_microcode(struct amdgpu_device *adev)
         const char *chip_name;
         char fw_name[30];
         int err;
+        bool is_58_fw = false;
 
         DRM_DEBUG("\n");
 
@@ -135,7 +137,14 @@ static int gmc_v6_0_init_microcode(struct amdgpu_device *adev)
         default: BUG();
         }
 
-        snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", chip_name);
+        /* this memory configuration requires special firmware */
+        if (((RREG32(mmMC_SEQ_MISC0) & 0xff000000) >> 24) == 0x58)
+                is_58_fw = true;
+
+        if (is_58_fw)
+                snprintf(fw_name, sizeof(fw_name), "radeon/si58_mc.bin");
+        else
+                snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", chip_name);
         err = request_firmware(&adev->mc.fw, fw_name, adev->dev);
         if (err)
                 goto out;
@@ -463,19 +472,11 @@ static int gmc_v6_0_gart_enable(struct amdgpu_device *adev)
         WREG32(mmVM_CONTEXT1_CNTL,
                VM_CONTEXT1_CNTL__ENABLE_CONTEXT_MASK |
                (1UL << VM_CONTEXT1_CNTL__PAGE_TABLE_DEPTH__SHIFT) |
-               ((amdgpu_vm_block_size - 9) << VM_CONTEXT1_CNTL__PAGE_TABLE_BLOCK_SIZE__SHIFT) |
-               VM_CONTEXT1_CNTL__RANGE_PROTECTION_FAULT_ENABLE_INTERRUPT_MASK |
-               VM_CONTEXT1_CNTL__RANGE_PROTECTION_FAULT_ENABLE_DEFAULT_MASK |
-               VM_CONTEXT1_CNTL__DUMMY_PAGE_PROTECTION_FAULT_ENABLE_INTERRUPT_MASK |
-               VM_CONTEXT1_CNTL__DUMMY_PAGE_PROTECTION_FAULT_ENABLE_DEFAULT_MASK |
-               VM_CONTEXT1_CNTL__PDE0_PROTECTION_FAULT_ENABLE_INTERRUPT_MASK |
-               VM_CONTEXT1_CNTL__PDE0_PROTECTION_FAULT_ENABLE_DEFAULT_MASK |
-               VM_CONTEXT1_CNTL__VALID_PROTECTION_FAULT_ENABLE_INTERRUPT_MASK |
-               VM_CONTEXT1_CNTL__VALID_PROTECTION_FAULT_ENABLE_DEFAULT_MASK |
-               VM_CONTEXT1_CNTL__READ_PROTECTION_FAULT_ENABLE_INTERRUPT_MASK |
-               VM_CONTEXT1_CNTL__READ_PROTECTION_FAULT_ENABLE_DEFAULT_MASK |
-               VM_CONTEXT1_CNTL__WRITE_PROTECTION_FAULT_ENABLE_INTERRUPT_MASK |
-               VM_CONTEXT1_CNTL__WRITE_PROTECTION_FAULT_ENABLE_DEFAULT_MASK);
+               ((amdgpu_vm_block_size - 9) << VM_CONTEXT1_CNTL__PAGE_TABLE_BLOCK_SIZE__SHIFT));
+        if (amdgpu_vm_fault_stop == AMDGPU_VM_FAULT_STOP_ALWAYS)
+                gmc_v6_0_set_fault_enable_default(adev, false);
+        else
+                gmc_v6_0_set_fault_enable_default(adev, true);
 
         gmc_v6_0_gart_flush_gpu_tlb(adev, 0);
         dev_info(adev->dev, "PCIE GART of %uM enabled (table at 0x%016llX).\n",
@@ -754,7 +755,10 @@ static int gmc_v6_0_late_init(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        return amdgpu_irq_get(adev, &adev->mc.vm_fault, 0);
+        if (amdgpu_vm_fault_stop != AMDGPU_VM_FAULT_STOP_ALWAYS)
+                return amdgpu_irq_get(adev, &adev->mc.vm_fault, 0);
+        else
+                return 0;
 }
 
 static int gmc_v6_0_sw_init(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index 10bedfac27b8..6e150db8f380 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -64,6 +64,7 @@ MODULE_FIRMWARE("radeon/oland_smc.bin");
 MODULE_FIRMWARE("radeon/oland_k_smc.bin");
 MODULE_FIRMWARE("radeon/hainan_smc.bin");
 MODULE_FIRMWARE("radeon/hainan_k_smc.bin");
+MODULE_FIRMWARE("radeon/banks_k_2_smc.bin");
 
 union power_info {
         struct _ATOM_POWERPLAY_INFO info;
@@ -3487,17 +3488,6 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
                     (adev->pdev->device == 0x6817) ||
                     (adev->pdev->device == 0x6806))
                         max_mclk = 120000;
-        } else if (adev->asic_type == CHIP_OLAND) {
-                if ((adev->pdev->revision == 0xC7) ||
-                    (adev->pdev->revision == 0x80) ||
-                    (adev->pdev->revision == 0x81) ||
-                    (adev->pdev->revision == 0x83) ||
-                    (adev->pdev->revision == 0x87) ||
-                    (adev->pdev->device == 0x6604) ||
-                    (adev->pdev->device == 0x6605)) {
-                        max_sclk = 75000;
-                        max_mclk = 80000;
-                }
         } else if (adev->asic_type == CHIP_HAINAN) {
                 if ((adev->pdev->revision == 0x81) ||
                     (adev->pdev->revision == 0x83) ||
@@ -3506,7 +3496,6 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
                     (adev->pdev->device == 0x6665) ||
                     (adev->pdev->device == 0x6667)) {
                         max_sclk = 75000;
-                        max_mclk = 80000;
                 }
         }
         /* Apply dpm quirks */
@@ -7713,10 +7702,11 @@ static int si_dpm_init_microcode(struct amdgpu_device *adev)
                         ((adev->pdev->device == 0x6660) ||
                         (adev->pdev->device == 0x6663) ||
                         (adev->pdev->device == 0x6665) ||
-                        (adev->pdev->device == 0x6667))) ||
-                    ((adev->pdev->revision == 0xc3) &&
-                        (adev->pdev->device == 0x6665)))
+                         (adev->pdev->device == 0x6667))))
                         chip_name = "hainan_k";
+                else if ((adev->pdev->revision == 0xc3) &&
+                         (adev->pdev->device == 0x6665))
+                        chip_name = "banks_k_2";
                 else
                         chip_name = "hainan";
                 break;
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
index 96444e4d862a..7fb9137dd89b 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
@@ -40,13 +40,14 @@
 #include "smu/smu_7_0_1_sh_mask.h"
 
 static void uvd_v4_2_mc_resume(struct amdgpu_device *adev);
-static void uvd_v4_2_init_cg(struct amdgpu_device *adev);
 static void uvd_v4_2_set_ring_funcs(struct amdgpu_device *adev);
 static void uvd_v4_2_set_irq_funcs(struct amdgpu_device *adev);
 static int uvd_v4_2_start(struct amdgpu_device *adev);
 static void uvd_v4_2_stop(struct amdgpu_device *adev);
 static int uvd_v4_2_set_clockgating_state(void *handle,
                                 enum amd_clockgating_state state);
+static void uvd_v4_2_set_dcm(struct amdgpu_device *adev,
+                             bool sw_mode);
 /**
  * uvd_v4_2_ring_get_rptr - get read pointer
  *
@@ -140,7 +141,8 @@ static int uvd_v4_2_sw_fini(void *handle)
 
         return r;
 }
-
+static void uvd_v4_2_enable_mgcg(struct amdgpu_device *adev,
+                                 bool enable);
 /**
  * uvd_v4_2_hw_init - start and test UVD block
  *
@@ -155,8 +157,7 @@ static int uvd_v4_2_hw_init(void *handle)
         uint32_t tmp;
         int r;
 
-        uvd_v4_2_init_cg(adev);
-        uvd_v4_2_set_clockgating_state(adev, AMD_CG_STATE_GATE);
+        uvd_v4_2_enable_mgcg(adev, true);
         amdgpu_asic_set_uvd_clocks(adev, 10000, 10000);
         r = uvd_v4_2_start(adev);
         if (r)
@@ -266,11 +267,13 @@ static int uvd_v4_2_start(struct amdgpu_device *adev)
         struct amdgpu_ring *ring = &adev->uvd.ring;
         uint32_t rb_bufsz;
         int i, j, r;
-
         /* disable byte swapping */
         u32 lmi_swap_cntl = 0;
         u32 mp_swap_cntl = 0;
 
+        WREG32(mmUVD_CGC_GATE, 0);
+        uvd_v4_2_set_dcm(adev, true);
+
         uvd_v4_2_mc_resume(adev);
 
         /* disable interupt */
@@ -406,6 +409,8 @@ static void uvd_v4_2_stop(struct amdgpu_device *adev)
 
         /* Unstall UMC and register bus */
         WREG32_P(mmUVD_LMI_CTRL2, 0, ~(1 << 8));
+
+        uvd_v4_2_set_dcm(adev, false);
 }
 
 /**
@@ -619,19 +624,6 @@ static void uvd_v4_2_set_dcm(struct amdgpu_device *adev,
         WREG32_UVD_CTX(ixUVD_CGC_CTRL2, tmp2);
 }
 
-static void uvd_v4_2_init_cg(struct amdgpu_device *adev)
-{
-        bool hw_mode = true;
-
-        if (hw_mode) {
-                uvd_v4_2_set_dcm(adev, false);
-        } else {
-                u32 tmp = RREG32(mmUVD_CGC_CTRL);
-                tmp &= ~UVD_CGC_CTRL__DYN_CLOCK_MODE_MASK;
-                WREG32(mmUVD_CGC_CTRL, tmp);
-        }
-}
-
 static bool uvd_v4_2_is_idle(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
@@ -685,17 +677,6 @@ static int uvd_v4_2_process_interrupt(struct amdgpu_device *adev,
 static int uvd_v4_2_set_clockgating_state(void *handle,
                                           enum amd_clockgating_state state)
 {
-        bool gate = false;
-        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-
-        if (!(adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG))
-                return 0;
-
-        if (state == AMD_CG_STATE_GATE)
-                gate = true;
-
-        uvd_v4_2_enable_mgcg(adev, gate);
-
         return 0;
 }
 
@@ -711,9 +692,6 @@ static int uvd_v4_2_set_powergating_state(void *handle,
          */
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (!(adev->pg_flags & AMD_PG_SUPPORT_UVD))
-                return 0;
-
         if (state == AMD_PG_STATE_GATE) {
                 uvd_v4_2_stop(adev);
                 return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index 5fb0b7f5c065..37ca685e5a9a 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -43,9 +43,13 @@
 
 #define GRBM_GFX_INDEX__VCE_INSTANCE__SHIFT     0x04
 #define GRBM_GFX_INDEX__VCE_INSTANCE_MASK       0x10
+#define GRBM_GFX_INDEX__VCE_ALL_PIPE            0x07
+
 #define mmVCE_LMI_VCPU_CACHE_40BIT_BAR0 0x8616
 #define mmVCE_LMI_VCPU_CACHE_40BIT_BAR1 0x8617
 #define mmVCE_LMI_VCPU_CACHE_40BIT_BAR2 0x8618
+#define mmGRBM_GFX_INDEX_DEFAULT 0xE0000000
+
 #define VCE_STATUS_VCPU_REPORT_FW_LOADED_MASK   0x02
 
 #define VCE_V3_0_FW_SIZE        (384 * 1024)
@@ -54,6 +58,9 @@
 
 #define FW_52_8_3       ((52 << 24) | (8 << 16) | (3 << 8))
 
+#define GET_VCE_INSTANCE(i)  ((i) << GRBM_GFX_INDEX__VCE_INSTANCE__SHIFT \
+                                        | GRBM_GFX_INDEX__VCE_ALL_PIPE)
+
 static void vce_v3_0_mc_resume(struct amdgpu_device *adev, int idx);
 static void vce_v3_0_set_ring_funcs(struct amdgpu_device *adev);
 static void vce_v3_0_set_irq_funcs(struct amdgpu_device *adev);
@@ -175,7 +182,7 @@ static void vce_v3_0_set_vce_sw_clock_gating(struct amdgpu_device *adev,
                 WREG32(mmVCE_UENC_CLOCK_GATING_2, data);
 
                 data = RREG32(mmVCE_UENC_REG_CLOCK_GATING);
-                data &= ~0xffc00000;
+                data &= ~0x3ff;
                 WREG32(mmVCE_UENC_REG_CLOCK_GATING, data);
 
                 data = RREG32(mmVCE_UENC_DMA_DCLK_CTRL);
@@ -249,7 +256,7 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
                 if (adev->vce.harvest_config & (1 << idx))
                         continue;
 
-                WREG32_FIELD(GRBM_GFX_INDEX, VCE_INSTANCE, idx);
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(idx));
                 vce_v3_0_mc_resume(adev, idx);
                 WREG32_FIELD(VCE_STATUS, JOB_BUSY, 1);
 
@@ -273,7 +280,7 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
                 }
         }
 
-        WREG32_FIELD(GRBM_GFX_INDEX, VCE_INSTANCE, 0);
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
         mutex_unlock(&adev->grbm_idx_mutex);
 
         return 0;
@@ -288,7 +295,7 @@ static int vce_v3_0_stop(struct amdgpu_device *adev)
                 if (adev->vce.harvest_config & (1 << idx))
                         continue;
 
-                WREG32_FIELD(GRBM_GFX_INDEX, VCE_INSTANCE, idx);
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(idx));
 
                 if (adev->asic_type >= CHIP_STONEY)
                         WREG32_P(mmVCE_VCPU_CNTL, 0, ~0x200001);
@@ -306,7 +313,7 @@ static int vce_v3_0_stop(struct amdgpu_device *adev)
                         vce_v3_0_set_vce_sw_clock_gating(adev, false);
         }
 
-        WREG32_FIELD(GRBM_GFX_INDEX, VCE_INSTANCE, 0);
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
         mutex_unlock(&adev->grbm_idx_mutex);
 
         return 0;
@@ -586,17 +593,17 @@ static bool vce_v3_0_check_soft_reset(void *handle)
          * VCE team suggest use bit 3--bit 6 for busy status check
          */
         mutex_lock(&adev->grbm_idx_mutex);
-        WREG32_FIELD(GRBM_GFX_INDEX, INSTANCE_INDEX, 0);
+        WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(0));
         if (RREG32(mmVCE_STATUS) & AMDGPU_VCE_STATUS_BUSY_MASK) {
                 srbm_soft_reset = REG_SET_FIELD(srbm_soft_reset, SRBM_SOFT_RESET, SOFT_RESET_VCE0, 1);
                 srbm_soft_reset = REG_SET_FIELD(srbm_soft_reset, SRBM_SOFT_RESET, SOFT_RESET_VCE1, 1);
         }
-        WREG32_FIELD(GRBM_GFX_INDEX, INSTANCE_INDEX, 0x10);
+        WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(1));
         if (RREG32(mmVCE_STATUS) & AMDGPU_VCE_STATUS_BUSY_MASK) {
                 srbm_soft_reset = REG_SET_FIELD(srbm_soft_reset, SRBM_SOFT_RESET, SOFT_RESET_VCE0, 1);
                 srbm_soft_reset = REG_SET_FIELD(srbm_soft_reset, SRBM_SOFT_RESET, SOFT_RESET_VCE1, 1);
         }
-        WREG32_FIELD(GRBM_GFX_INDEX, INSTANCE_INDEX, 0);
+        WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(0));
         mutex_unlock(&adev->grbm_idx_mutex);
 
         if (srbm_soft_reset) {
@@ -734,7 +741,7 @@ static int vce_v3_0_set_clockgating_state(void *handle,
                 if (adev->vce.harvest_config & (1 << i))
                         continue;
 
-                WREG32_FIELD(GRBM_GFX_INDEX, VCE_INSTANCE, i);
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(i));
 
                 if (enable) {
                         /* initialize VCE_CLOCK_GATING_A: Clock ON/OFF delay */
@@ -753,7 +760,7 @@ static int vce_v3_0_set_clockgating_state(void *handle,
                 vce_v3_0_set_vce_sw_clock_gating(adev, enable);
         }
 
-        WREG32_FIELD(GRBM_GFX_INDEX, VCE_INSTANCE, 0);
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
         mutex_unlock(&adev->grbm_idx_mutex);
 
         return 0;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c
index b0c63c5f54c9..6bb79c94cb9f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c
@@ -200,7 +200,7 @@ int cz_dpm_powergate_vce(struct pp_hwmgr *hwmgr, bool bgate)
                                 cgs_set_clockgating_state(
                                                         hwmgr->device,
                                                         AMD_IP_BLOCK_TYPE_VCE,
-                                                        AMD_CG_STATE_UNGATE);
+                                                        AMD_CG_STATE_GATE);
                                 cgs_set_powergating_state(
                                                         hwmgr->device,
                                                         AMD_IP_BLOCK_TYPE_VCE,
@@ -218,7 +218,7 @@ int cz_dpm_powergate_vce(struct pp_hwmgr *hwmgr, bool bgate)
                                 cgs_set_clockgating_state(
                                                         hwmgr->device,
                                                         AMD_IP_BLOCK_TYPE_VCE,
-                                                        AMD_PG_STATE_GATE);
+                                                        AMD_PG_STATE_UNGATE);
                                 cz_dpm_update_vce_dpm(hwmgr);
                                 cz_enable_disable_vce_dpm(hwmgr, true);
                                 return 0;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
index 4b14f259a147..0fb4e8c8f5e1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
@@ -1402,14 +1402,22 @@ int  cz_dpm_update_vce_dpm(struct pp_hwmgr *hwmgr)
                                              cz_hwmgr->vce_dpm.hard_min_clk,
                                                 PPSMC_MSG_SetEclkHardMin));
         } else {
-                /*EPR# 419220 -HW limitation to to */
-                cz_hwmgr->vce_dpm.hard_min_clk = hwmgr->vce_arbiter.ecclk;
-                smum_send_msg_to_smc_with_parameter(hwmgr->smumgr,
-                                            PPSMC_MSG_SetEclkHardMin,
-                                            cz_get_eclk_level(hwmgr,
-                                     cz_hwmgr->vce_dpm.hard_min_clk,
-                                          PPSMC_MSG_SetEclkHardMin));
-
+                /*Program HardMin based on the vce_arbiter.ecclk */
+                if (hwmgr->vce_arbiter.ecclk == 0) {
+                        smum_send_msg_to_smc_with_parameter(hwmgr->smumgr,
+                                            PPSMC_MSG_SetEclkHardMin, 0);
+                /* disable ECLK DPM 0. Otherwise VCE could hang if
+                 * switching SCLK from DPM 0 to 6/7 */
+                        smum_send_msg_to_smc_with_parameter(hwmgr->smumgr,
+                                        PPSMC_MSG_SetEclkSoftMin, 1);
+                } else {
+                        cz_hwmgr->vce_dpm.hard_min_clk = hwmgr->vce_arbiter.ecclk;
+                        smum_send_msg_to_smc_with_parameter(hwmgr->smumgr,
+                                                PPSMC_MSG_SetEclkHardMin,
+                                                cz_get_eclk_level(hwmgr,
+                                                cz_hwmgr->vce_dpm.hard_min_clk,
+                                                PPSMC_MSG_SetEclkHardMin));
+                }
         }
         return 0;
 }
diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
index eb9bf8786c24..18eefdcbf1ba 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
@@ -1382,6 +1382,7 @@ int analogix_dp_bind(struct device *dev, struct drm_device *drm_dev,
 
         pm_runtime_enable(dev);
 
+        pm_runtime_get_sync(dev);
         phy_power_on(dp->phy);
 
         analogix_dp_init_dp(dp);
@@ -1414,9 +1415,15 @@ int analogix_dp_bind(struct device *dev, struct drm_device *drm_dev,
                 goto err_disable_pm_runtime;
         }
 
+        phy_power_off(dp->phy);
+        pm_runtime_put(dev);
+
         return 0;
 
 err_disable_pm_runtime:
+
+        phy_power_off(dp->phy);
+        pm_runtime_put(dev);
         pm_runtime_disable(dev);
 
         return ret;
diff --git a/drivers/gpu/drm/cirrus/Kconfig b/drivers/gpu/drm/cirrus/Kconfig
index 04b3c161dfae..7f4cc6e172ab 100644
--- a/drivers/gpu/drm/cirrus/Kconfig
+++ b/drivers/gpu/drm/cirrus/Kconfig
@@ -7,3 +7,12 @@ config DRM_CIRRUS_QEMU
          This is a KMS driver for emulated cirrus device in qemu.
          It is *NOT* intended for real cirrus devices. This requires
          the modesetting userspace X.org driver.
+
+         Cirrus is obsolete, the hardware was designed in the 90ies
+         and can't keep up with todays needs.  More background:
+         https://www.kraxel.org/blog/2014/10/qemu-using-cirrus-considered-harmful/
+
+         Better alternatives are:
+           - stdvga (DRM_BOCHS, qemu -vga std, default in qemu 2.2+)
+           - qxl (DRM_QXL, qemu -vga qxl, works best with spice)
+           - virtio (DRM_VIRTIO_GPU), qemu -vga virtio)
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index ac6a35212501..e6b19bc9021a 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1460,6 +1460,13 @@ drm_mode_create_from_cmdline_mode(struct drm_device *dev,
                 return NULL;
 
         mode->type |= DRM_MODE_TYPE_USERDEF;
+        /* fix up 1368x768: GFT/CVT can't express 1366 width due to alignment */
+        if (cmd->xres == 1366 && mode->hdisplay == 1368) {
+                mode->hdisplay = 1366;
+                mode->hsync_start--;
+                mode->hsync_end--;
+                drm_mode_set_name(mode);
+        }
         drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
         return mode;
 }
diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
index ac953f037be7..b452a7ccd84b 100644
--- a/drivers/gpu/drm/drm_probe_helper.c
+++ b/drivers/gpu/drm/drm_probe_helper.c
@@ -115,24 +115,27 @@ static int drm_helper_probe_add_cmdline_mode(struct drm_connector *connector)
 
 #define DRM_OUTPUT_POLL_PERIOD (10*HZ)
 /**
- * drm_kms_helper_poll_enable_locked - re-enable output polling.
+ * drm_kms_helper_poll_enable - re-enable output polling.
  * @dev: drm_device
  *
- * This function re-enables the output polling work without
- * locking the mode_config mutex.
+ * This function re-enables the output polling work, after it has been
+ * temporarily disabled using drm_kms_helper_poll_disable(), for example over
+ * suspend/resume.
  *
- * This is like drm_kms_helper_poll_enable() however it is to be
- * called from a context where the mode_config mutex is locked
- * already.
+ * Drivers can call this helper from their device resume implementation. It is
+ * an error to call this when the output polling support has not yet been set
+ * up.
+ *
+ * Note that calls to enable and disable polling must be strictly ordered, which
+ * is automatically the case when they're only call from suspend/resume
+ * callbacks.
  */
-void drm_kms_helper_poll_enable_locked(struct drm_device *dev)
+void drm_kms_helper_poll_enable(struct drm_device *dev)
 {
         bool poll = false;
         struct drm_connector *connector;
         unsigned long delay = DRM_OUTPUT_POLL_PERIOD;
 
-        WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
-
         if (!dev->mode_config.poll_enabled || !drm_kms_helper_poll)
                 return;
 
@@ -143,14 +146,24 @@ void drm_kms_helper_poll_enable_locked(struct drm_device *dev)
         }
 
         if (dev->mode_config.delayed_event) {
+                /*
+                 * FIXME:
+                 *
+                 * Use short (1s) delay to handle the initial delayed event.
+                 * This delay should not be needed, but Optimus/nouveau will
+                 * fail in a mysterious way if the delayed event is handled as
+                 * soon as possible like it is done in
+                 * drm_helper_probe_single_connector_modes() in case the poll
+                 * was enabled before.
+                 */
                 poll = true;
-                delay = 0;
+                delay = HZ;
         }
 
         if (poll)
                 schedule_delayed_work(&dev->mode_config.output_poll_work, delay);
 }
-EXPORT_SYMBOL(drm_kms_helper_poll_enable_locked);
+EXPORT_SYMBOL(drm_kms_helper_poll_enable);
 
 static enum drm_connector_status
 drm_connector_detect(struct drm_connector *connector, bool force)
@@ -277,7 +290,7 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
 
         /* Re-enable polling in case the global poll config changed. */
         if (drm_kms_helper_poll != dev->mode_config.poll_running)
-                drm_kms_helper_poll_enable_locked(dev);
+                drm_kms_helper_poll_enable(dev);
 
         dev->mode_config.poll_running = drm_kms_helper_poll;
 
@@ -469,8 +482,12 @@ out:
  * This function disables the output polling work.
  *
  * Drivers can call this helper from their device suspend implementation. It is
- * not an error to call this even when output polling isn't enabled or arlready
- * disabled.
+ * not an error to call this even when output polling isn't enabled or already
+ * disabled. Polling is re-enabled by calling drm_kms_helper_poll_enable().
+ *
+ * Note that calls to enable and disable polling must be strictly ordered, which
+ * is automatically the case when they're only call from suspend/resume
+ * callbacks.
  */
 void drm_kms_helper_poll_disable(struct drm_device *dev)
 {
@@ -481,24 +498,6 @@ void drm_kms_helper_poll_disable(struct drm_device *dev)
 EXPORT_SYMBOL(drm_kms_helper_poll_disable);
 
 /**
- * drm_kms_helper_poll_enable - re-enable output polling.
- * @dev: drm_device
- *
- * This function re-enables the output polling work.
- *
- * Drivers can call this helper from their device resume implementation. It is
- * an error to call this when the output polling support has not yet been set
- * up.
- */
-void drm_kms_helper_poll_enable(struct drm_device *dev)
-{
-        mutex_lock(&dev->mode_config.mutex);
-        drm_kms_helper_poll_enable_locked(dev);
-        mutex_unlock(&dev->mode_config.mutex);
-}
-EXPORT_SYMBOL(drm_kms_helper_poll_enable);
-
-/**
  * drm_kms_helper_poll_init - initialize and enable output polling
  * @dev: drm_device
  *
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
index 169ac96e8f08..fe0e85b41310 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
@@ -116,9 +116,14 @@ static int etnaviv_iommu_find_iova(struct etnaviv_iommu *mmu,
                 struct list_head list;
                 bool found;
 
+                /*
+                 * XXX: The DRM_MM_SEARCH_BELOW is really a hack to trick
+                 * drm_mm into giving out a low IOVA after address space
+                 * rollover. This needs a proper fix.
+                 */
                 ret = drm_mm_insert_node_in_range(&mmu->mm, node,
                         size, 0, mmu->last_iova, ~0UL,
-                        DRM_MM_SEARCH_DEFAULT);
+                        mmu->last_iova ? DRM_MM_SEARCH_DEFAULT : DRM_MM_SEARCH_BELOW);
 
                 if (ret != -ENOSPC)
                         break;
diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
index 6ca1f3117fe8..75eeb831ed6a 100644
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -46,7 +46,8 @@ enum decon_flag_bits {
         BIT_CLKS_ENABLED,
         BIT_IRQS_ENABLED,
         BIT_WIN_UPDATED,
-        BIT_SUSPENDED
+        BIT_SUSPENDED,
+        BIT_REQUEST_UPDATE
 };
 
 struct decon_context {
@@ -141,12 +142,6 @@ static void decon_commit(struct exynos_drm_crtc *crtc)
                 m->crtc_vsync_end = m->crtc_vsync_start + 1;
         }
 
-        decon_set_bits(ctx, DECON_VIDCON0, VIDCON0_ENVID, 0);
-
-        /* enable clock gate */
-        val = CMU_CLKGAGE_MODE_SFR_F | CMU_CLKGAGE_MODE_MEM_F;
-        writel(val, ctx->addr + DECON_CMU);
-
         if (ctx->out_type & (IFTYPE_I80 | I80_HW_TRG))
                 decon_setup_trigger(ctx);
 
@@ -315,6 +310,7 @@ static void decon_update_plane(struct exynos_drm_crtc *crtc,
 
         /* window enable */
         decon_set_bits(ctx, DECON_WINCONx(win), WINCONx_ENWIN_F, ~0);
+        set_bit(BIT_REQUEST_UPDATE, &ctx->flags);
 }
 
 static void decon_disable_plane(struct exynos_drm_crtc *crtc,
@@ -327,6 +323,7 @@ static void decon_disable_plane(struct exynos_drm_crtc *crtc,
                 return;
 
         decon_set_bits(ctx, DECON_WINCONx(win), WINCONx_ENWIN_F, 0);
+        set_bit(BIT_REQUEST_UPDATE, &ctx->flags);
 }
 
 static void decon_atomic_flush(struct exynos_drm_crtc *crtc)
@@ -340,8 +337,8 @@ static void decon_atomic_flush(struct exynos_drm_crtc *crtc)
         for (i = ctx->first_win; i < WINDOWS_NR; i++)
                 decon_shadow_protect_win(ctx, i, false);
 
-        /* standalone update */
-        decon_set_bits(ctx, DECON_UPDATE, STANDALONE_UPDATE_F, ~0);
+        if (test_and_clear_bit(BIT_REQUEST_UPDATE, &ctx->flags))
+                decon_set_bits(ctx, DECON_UPDATE, STANDALONE_UPDATE_F, ~0);
 
         if (ctx->out_type & IFTYPE_I80)
                 set_bit(BIT_WIN_UPDATED, &ctx->flags);
diff --git a/drivers/gpu/drm/i915/gvt/aperture_gm.c b/drivers/gpu/drm/i915/gvt/aperture_gm.c
index 0d41ebc4aea6..f7bce8603958 100644
--- a/drivers/gpu/drm/i915/gvt/aperture_gm.c
+++ b/drivers/gpu/drm/i915/gvt/aperture_gm.c
@@ -37,13 +37,6 @@
 #include "i915_drv.h"
 #include "gvt.h"
 
-#define MB_TO_BYTES(mb) ((mb) << 20ULL)
-#define BYTES_TO_MB(b) ((b) >> 20ULL)
-
-#define HOST_LOW_GM_SIZE MB_TO_BYTES(128)
-#define HOST_HIGH_GM_SIZE MB_TO_BYTES(384)
-#define HOST_FENCE 4
-
 static int alloc_gm(struct intel_vgpu *vgpu, bool high_gm)
 {
         struct intel_gvt *gvt = vgpu->gvt;
@@ -165,6 +158,14 @@ void intel_vgpu_write_fence(struct intel_vgpu *vgpu,
         POSTING_READ(fence_reg_lo);
 }
 
+static void _clear_vgpu_fence(struct intel_vgpu *vgpu)
+{
+        int i;
+
+        for (i = 0; i < vgpu_fence_sz(vgpu); i++)
+                intel_vgpu_write_fence(vgpu, i, 0);
+}
+
 static void free_vgpu_fence(struct intel_vgpu *vgpu)
 {
         struct intel_gvt *gvt = vgpu->gvt;
@@ -178,9 +179,9 @@ static void free_vgpu_fence(struct intel_vgpu *vgpu)
         intel_runtime_pm_get(dev_priv);
 
         mutex_lock(&dev_priv->drm.struct_mutex);
+        _clear_vgpu_fence(vgpu);
         for (i = 0; i < vgpu_fence_sz(vgpu); i++) {
                 reg = vgpu->fence.regs[i];
-                intel_vgpu_write_fence(vgpu, i, 0);
                 list_add_tail(&reg->link,
                               &dev_priv->mm.fence_list);
         }
@@ -208,13 +209,14 @@ static int alloc_vgpu_fence(struct intel_vgpu *vgpu)
                         continue;
                 list_del(pos);
                 vgpu->fence.regs[i] = reg;
-                intel_vgpu_write_fence(vgpu, i, 0);
                 if (++i == vgpu_fence_sz(vgpu))
                         break;
         }
         if (i != vgpu_fence_sz(vgpu))
                 goto out_free_fence;
 
+        _clear_vgpu_fence(vgpu);
+
         mutex_unlock(&dev_priv->drm.struct_mutex);
         intel_runtime_pm_put(dev_priv);
         return 0;
@@ -314,6 +316,22 @@ void intel_vgpu_free_resource(struct intel_vgpu *vgpu)
 }
 
 /**
+ * intel_vgpu_reset_resource - reset resource state owned by a vGPU
+ * @vgpu: a vGPU
+ *
+ * This function is used to reset resource state owned by a vGPU.
+ *
+ */
+void intel_vgpu_reset_resource(struct intel_vgpu *vgpu)
+{
+        struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
+
+        intel_runtime_pm_get(dev_priv);
+        _clear_vgpu_fence(vgpu);
+        intel_runtime_pm_put(dev_priv);
+}
+
+/**
  * intel_alloc_vgpu_resource - allocate HW resource for a vGPU
  * @vgpu: vGPU
  * @param: vGPU creation params
diff --git a/drivers/gpu/drm/i915/gvt/cfg_space.c b/drivers/gpu/drm/i915/gvt/cfg_space.c
index 711c31c8d8b4..4a6a2ed65732 100644
--- a/drivers/gpu/drm/i915/gvt/cfg_space.c
+++ b/drivers/gpu/drm/i915/gvt/cfg_space.c
@@ -282,3 +282,77 @@ int intel_vgpu_emulate_cfg_write(struct intel_vgpu *vgpu, unsigned int offset,
         }
         return 0;
 }
+
+/**
+ * intel_vgpu_init_cfg_space - init vGPU configuration space when create vGPU
+ *
+ * @vgpu: a vGPU
+ * @primary: is the vGPU presented as primary
+ *
+ */
+void intel_vgpu_init_cfg_space(struct intel_vgpu *vgpu,
+                               bool primary)
+{
+        struct intel_gvt *gvt = vgpu->gvt;
+        const struct intel_gvt_device_info *info = &gvt->device_info;
+        u16 *gmch_ctl;
+        int i;
+
+        memcpy(vgpu_cfg_space(vgpu), gvt->firmware.cfg_space,
+               info->cfg_space_size);
+
+        if (!primary) {
+                vgpu_cfg_space(vgpu)[PCI_CLASS_DEVICE] =
+                        INTEL_GVT_PCI_CLASS_VGA_OTHER;
+                vgpu_cfg_space(vgpu)[PCI_CLASS_PROG] =
+                        INTEL_GVT_PCI_CLASS_VGA_OTHER;
+        }
+
+        /* Show guest that there isn't any stolen memory.*/
+        gmch_ctl = (u16 *)(vgpu_cfg_space(vgpu) + INTEL_GVT_PCI_GMCH_CONTROL);
+        *gmch_ctl &= ~(BDW_GMCH_GMS_MASK << BDW_GMCH_GMS_SHIFT);
+
+        intel_vgpu_write_pci_bar(vgpu, PCI_BASE_ADDRESS_2,
+                                 gvt_aperture_pa_base(gvt), true);
+
+        vgpu_cfg_space(vgpu)[PCI_COMMAND] &= ~(PCI_COMMAND_IO
+                                             | PCI_COMMAND_MEMORY
+                                             | PCI_COMMAND_MASTER);
+        /*
+         * Clear the bar upper 32bit and let guest to assign the new value
+         */
+        memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_1, 0, 4);
+        memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_3, 0, 4);
+        memset(vgpu_cfg_space(vgpu) + INTEL_GVT_PCI_OPREGION, 0, 4);
+
+        for (i = 0; i < INTEL_GVT_MAX_BAR_NUM; i++) {
+                vgpu->cfg_space.bar[i].size = pci_resource_len(
+                                              gvt->dev_priv->drm.pdev, i * 2);
+                vgpu->cfg_space.bar[i].tracked = false;
+        }
+}
+
+/**
+ * intel_vgpu_reset_cfg_space - reset vGPU configuration space
+ *
+ * @vgpu: a vGPU
+ *
+ */
+void intel_vgpu_reset_cfg_space(struct intel_vgpu *vgpu)
+{
+        u8 cmd = vgpu_cfg_space(vgpu)[PCI_COMMAND];
+        bool primary = vgpu_cfg_space(vgpu)[PCI_CLASS_DEVICE] !=
+                                INTEL_GVT_PCI_CLASS_VGA_OTHER;
+
+        if (cmd & PCI_COMMAND_MEMORY) {
+                trap_gttmmio(vgpu, false);
+                map_aperture(vgpu, false);
+        }
+
+        /**
+         * Currently we only do such reset when vGPU is not
+         * owned by any VM, so we simply restore entire cfg
+         * space to default value.
+         */
+        intel_vgpu_init_cfg_space(vgpu, primary);
+}
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 6c5fdf5b2ce2..47dec4acf7ff 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -240,15 +240,8 @@ static inline int get_pse_type(int type)
 static u64 read_pte64(struct drm_i915_private *dev_priv, unsigned long index)
 {
         void __iomem *addr = (gen8_pte_t __iomem *)dev_priv->ggtt.gsm + index;
-        u64 pte;
 
-#ifdef readq
-        pte = readq(addr);
-#else
-        pte = ioread32(addr);
-        pte |= (u64)ioread32(addr + 4) << 32;
-#endif
-        return pte;
+        return readq(addr);
 }
 
 static void write_pte64(struct drm_i915_private *dev_priv,
@@ -256,12 +249,8 @@ static void write_pte64(struct drm_i915_private *dev_priv,
 {
         void __iomem *addr = (gen8_pte_t __iomem *)dev_priv->ggtt.gsm + index;
 
-#ifdef writeq
         writeq(pte, addr);
-#else
-        iowrite32((u32)pte, addr);
-        iowrite32(pte >> 32, addr + 4);
-#endif
+
         I915_WRITE(GFX_FLSH_CNTL_GEN6, GFX_FLSH_CNTL_EN);
         POSTING_READ(GFX_FLSH_CNTL_GEN6);
 }
@@ -1380,8 +1369,7 @@ static int gen8_mm_alloc_page_table(struct intel_vgpu_mm *mm)
                         info->gtt_entry_size;
                 mem = kzalloc(mm->has_shadow_page_table ?
                         mm->page_table_entry_size * 2
-                                : mm->page_table_entry_size,
-                        GFP_ATOMIC);
+                                : mm->page_table_entry_size, GFP_KERNEL);
                 if (!mem)
                         return -ENOMEM;
                 mm->virtual_page_table = mem;
@@ -1532,7 +1520,7 @@ struct intel_vgpu_mm *intel_vgpu_create_mm(struct intel_vgpu *vgpu,
         struct intel_vgpu_mm *mm;
         int ret;
 
-        mm = kzalloc(sizeof(*mm), GFP_ATOMIC);
+        mm = kzalloc(sizeof(*mm), GFP_KERNEL);
         if (!mm) {
                 ret = -ENOMEM;
                 goto fail;
@@ -1886,30 +1874,27 @@ static int alloc_scratch_pages(struct intel_vgpu *vgpu,
         struct intel_gvt_gtt_pte_ops *ops = vgpu->gvt->gtt.pte_ops;
         int page_entry_num = GTT_PAGE_SIZE >>
                                 vgpu->gvt->device_info.gtt_entry_size_shift;
-        struct page *scratch_pt;
+        void *scratch_pt;
         unsigned long mfn;
         int i;
-        void *p;
 
         if (WARN_ON(type < GTT_TYPE_PPGTT_PTE_PT || type >= GTT_TYPE_MAX))
                 return -EINVAL;
 
-        scratch_pt = alloc_page(GFP_KERNEL | GFP_ATOMIC | __GFP_ZERO);
+        scratch_pt = (void *)get_zeroed_page(GFP_KERNEL);
         if (!scratch_pt) {
                 gvt_err("fail to allocate scratch page\n");
                 return -ENOMEM;
         }
 
-        p = kmap_atomic(scratch_pt);
-        mfn = intel_gvt_hypervisor_virt_to_mfn(p);
+        mfn = intel_gvt_hypervisor_virt_to_mfn(scratch_pt);
         if (mfn == INTEL_GVT_INVALID_ADDR) {
-                gvt_err("fail to translate vaddr:0x%llx\n", (u64)p);
-                kunmap_atomic(p);
-                __free_page(scratch_pt);
+                gvt_err("fail to translate vaddr:0x%lx\n", (unsigned long)scratch_pt);
+                free_page((unsigned long)scratch_pt);
                 return -EFAULT;
         }
         gtt->scratch_pt[type].page_mfn = mfn;
-        gtt->scratch_pt[type].page = scratch_pt;
+        gtt->scratch_pt[type].page = virt_to_page(scratch_pt);
         gvt_dbg_mm("vgpu%d create scratch_pt: type %d mfn=0x%lx\n",
                         vgpu->id, type, mfn);
 
@@ -1918,7 +1903,7 @@ static int alloc_scratch_pages(struct intel_vgpu *vgpu,
          * scratch_pt[type] indicate the scratch pt/scratch page used by the
          * 'type' pt.
          * e.g. scratch_pt[GTT_TYPE_PPGTT_PDE_PT] is used by
-         * GTT_TYPE_PPGTT_PDE_PT level pt, that means this scatch_pt it self
+         * GTT_TYPE_PPGTT_PDE_PT level pt, that means this scratch_pt it self
          * is GTT_TYPE_PPGTT_PTE_PT, and full filled by scratch page mfn.
          */
         if (type > GTT_TYPE_PPGTT_PTE_PT && type < GTT_TYPE_MAX) {
@@ -1936,11 +1921,9 @@ static int alloc_scratch_pages(struct intel_vgpu *vgpu,
                         se.val64 |= PPAT_CACHED_INDEX;
 
                 for (i = 0; i < page_entry_num; i++)
-                        ops->set_entry(p, &se, i, false, 0, vgpu);
+                        ops->set_entry(scratch_pt, &se, i, false, 0, vgpu);
         }
 
-        kunmap_atomic(p);
-
         return 0;
 }
 
@@ -2208,7 +2191,7 @@ int intel_vgpu_g2v_destroy_ppgtt_mm(struct intel_vgpu *vgpu,
 int intel_gvt_init_gtt(struct intel_gvt *gvt)
 {
         int ret;
-        void *page_addr;
+        void *page;
 
         gvt_dbg_core("init gtt\n");
 
@@ -2221,17 +2204,14 @@ int intel_gvt_init_gtt(struct intel_gvt *gvt)
                 return -ENODEV;
         }
 
-        gvt->gtt.scratch_ggtt_page =
-                alloc_page(GFP_KERNEL | GFP_ATOMIC | __GFP_ZERO);
-        if (!gvt->gtt.scratch_ggtt_page) {
+        page = (void *)get_zeroed_page(GFP_KERNEL);
+        if (!page) {
                 gvt_err("fail to allocate scratch ggtt page\n");
                 return -ENOMEM;
         }
+        gvt->gtt.scratch_ggtt_page = virt_to_page(page);
 
-        page_addr = page_address(gvt->gtt.scratch_ggtt_page);
-
-        gvt->gtt.scratch_ggtt_mfn =
-                intel_gvt_hypervisor_virt_to_mfn(page_addr);
+        gvt->gtt.scratch_ggtt_mfn = intel_gvt_hypervisor_virt_to_mfn(page);
         if (gvt->gtt.scratch_ggtt_mfn == INTEL_GVT_INVALID_ADDR) {
                 gvt_err("fail to translate scratch ggtt page\n");
                 __free_page(gvt->gtt.scratch_ggtt_page);
@@ -2297,3 +2277,30 @@ void intel_vgpu_reset_ggtt(struct intel_vgpu *vgpu)
         for (offset = 0; offset < num_entries; offset++)
                 ops->set_entry(NULL, &e, index + offset, false, 0, vgpu);
 }
+
+/**
+ * intel_vgpu_reset_gtt - reset the all GTT related status
+ * @vgpu: a vGPU
+ * @dmlr: true for vGPU Device Model Level Reset, false for GT Reset
+ *
+ * This function is called from vfio core to reset reset all
+ * GTT related status, including GGTT, PPGTT, scratch page.
+ *
+ */
+void intel_vgpu_reset_gtt(struct intel_vgpu *vgpu, bool dmlr)
+{
+        int i;
+
+        ppgtt_free_all_shadow_page(vgpu);
+        if (!dmlr)
+                return;
+
+        intel_vgpu_reset_ggtt(vgpu);
+
+        /* clear scratch page for security */
+        for (i = GTT_TYPE_PPGTT_PTE_PT; i < GTT_TYPE_MAX; i++) {
+                if (vgpu->gtt.scratch_pt[i].page != NULL)
+                        memset(page_address(vgpu->gtt.scratch_pt[i].page),
+                                0, PAGE_SIZE);
+        }
+}
diff --git a/drivers/gpu/drm/i915/gvt/gtt.h b/drivers/gpu/drm/i915/gvt/gtt.h
index b315ab3593ec..f88eb5e89bea 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.h
+++ b/drivers/gpu/drm/i915/gvt/gtt.h
@@ -208,6 +208,7 @@ extern void intel_vgpu_clean_gtt(struct intel_vgpu *vgpu);
 void intel_vgpu_reset_ggtt(struct intel_vgpu *vgpu);
 
 extern int intel_gvt_init_gtt(struct intel_gvt *gvt);
+extern void intel_vgpu_reset_gtt(struct intel_vgpu *vgpu, bool dmlr);
 extern void intel_gvt_clean_gtt(struct intel_gvt *gvt);
 
 extern struct intel_vgpu_mm *intel_gvt_find_ppgtt_mm(struct intel_vgpu *vgpu,
diff --git a/drivers/gpu/drm/i915/gvt/gvt.c b/drivers/gpu/drm/i915/gvt/gvt.c
index 398877c3d2fd..e6bf5c533fbe 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.c
+++ b/drivers/gpu/drm/i915/gvt/gvt.c
@@ -201,6 +201,8 @@ void intel_gvt_clean_device(struct drm_i915_private *dev_priv)
         intel_gvt_hypervisor_host_exit(&dev_priv->drm.pdev->dev, gvt);
         intel_gvt_clean_vgpu_types(gvt);
 
+        idr_destroy(&gvt->vgpu_idr);
+
         kfree(dev_priv->gvt);
         dev_priv->gvt = NULL;
 }
@@ -237,6 +239,8 @@ int intel_gvt_init_device(struct drm_i915_private *dev_priv)
 
         gvt_dbg_core("init gvt device\n");
 
+        idr_init(&gvt->vgpu_idr);
+
         mutex_init(&gvt->lock);
         gvt->dev_priv = dev_priv;
 
@@ -244,7 +248,7 @@ int intel_gvt_init_device(struct drm_i915_private *dev_priv)
 
         ret = intel_gvt_setup_mmio_info(gvt);
         if (ret)
-                return ret;
+                goto out_clean_idr;
 
         ret = intel_gvt_load_firmware(gvt);
         if (ret)
@@ -313,6 +317,8 @@ out_free_firmware:
         intel_gvt_free_firmware(gvt);
 out_clean_mmio_info:
         intel_gvt_clean_mmio_info(gvt);
+out_clean_idr:
+        idr_destroy(&gvt->vgpu_idr);
         kfree(gvt);
         return ret;
 }
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index 0af17016f33f..e227caf5859e 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -323,6 +323,7 @@ struct intel_vgpu_creation_params {
 
 int intel_vgpu_alloc_resource(struct intel_vgpu *vgpu,
                               struct intel_vgpu_creation_params *param);
+void intel_vgpu_reset_resource(struct intel_vgpu *vgpu);
 void intel_vgpu_free_resource(struct intel_vgpu *vgpu);
 void intel_vgpu_write_fence(struct intel_vgpu *vgpu,
         u32 fence, u64 value);
@@ -375,6 +376,8 @@ void intel_gvt_clean_vgpu_types(struct intel_gvt *gvt);
 struct intel_vgpu *intel_gvt_create_vgpu(struct intel_gvt *gvt,
                                          struct intel_vgpu_type *type);
 void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu);
+void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
+                                 unsigned int engine_mask);
 void intel_gvt_reset_vgpu(struct intel_vgpu *vgpu);
 
 
@@ -411,6 +414,10 @@ int intel_gvt_ggtt_index_g2h(struct intel_vgpu *vgpu, unsigned long g_index,
 int intel_gvt_ggtt_h2g_index(struct intel_vgpu *vgpu, unsigned long h_index,
                              unsigned long *g_index);
 
+void intel_vgpu_init_cfg_space(struct intel_vgpu *vgpu,
+                bool primary);
+void intel_vgpu_reset_cfg_space(struct intel_vgpu *vgpu);
+
 int intel_vgpu_emulate_cfg_read(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes);
 
@@ -424,7 +431,6 @@ void intel_vgpu_clean_opregion(struct intel_vgpu *vgpu);
 int intel_vgpu_init_opregion(struct intel_vgpu *vgpu, u32 gpa);
 
 int intel_vgpu_emulate_opregion_request(struct intel_vgpu *vgpu, u32 swsci);
-int setup_vgpu_mmio(struct intel_vgpu *vgpu);
 void populate_pvinfo_page(struct intel_vgpu *vgpu);
 
 struct intel_gvt_ops {
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 522809710312..ab2ea157da4c 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -93,7 +93,8 @@ static void write_vreg(struct intel_vgpu *vgpu, unsigned int offset,
 static int new_mmio_info(struct intel_gvt *gvt,
                 u32 offset, u32 flags, u32 size,
                 u32 addr_mask, u32 ro_mask, u32 device,
-                void *read, void *write)
+                int (*read)(struct intel_vgpu *, unsigned int, void *, unsigned int),
+                int (*write)(struct intel_vgpu *, unsigned int, void *, unsigned int))
 {
         struct intel_gvt_mmio_info *info, *p;
         u32 start, end, i;
@@ -219,7 +220,7 @@ static int mul_force_wake_write(struct intel_vgpu *vgpu,
                 default:
                         /*should not hit here*/
                         gvt_err("invalid forcewake offset 0x%x\n", offset);
-                        return 1;
+                        return -EINVAL;
                 }
         } else {
                 ack_reg_offset = FORCEWAKE_ACK_HSW_REG;
@@ -230,77 +231,45 @@ static int mul_force_wake_write(struct intel_vgpu *vgpu,
         return 0;
 }
 
-static int handle_device_reset(struct intel_vgpu *vgpu, unsigned int offset,
-                void *p_data, unsigned int bytes, unsigned long bitmap)
-{
-        struct intel_gvt_workload_scheduler *scheduler =
-                &vgpu->gvt->scheduler;
-
-        vgpu->resetting = true;
-
-        intel_vgpu_stop_schedule(vgpu);
-        /*
-         * The current_vgpu will set to NULL after stopping the
-         * scheduler when the reset is triggered by current vgpu.
-         */
-        if (scheduler->current_vgpu == NULL) {
-                mutex_unlock(&vgpu->gvt->lock);
-                intel_gvt_wait_vgpu_idle(vgpu);
-                mutex_lock(&vgpu->gvt->lock);
-        }
-
-        intel_vgpu_reset_execlist(vgpu, bitmap);
-
-        /* full GPU reset */
-        if (bitmap == 0xff) {
-                mutex_unlock(&vgpu->gvt->lock);
-                intel_vgpu_clean_gtt(vgpu);
-                mutex_lock(&vgpu->gvt->lock);
-                setup_vgpu_mmio(vgpu);
-                populate_pvinfo_page(vgpu);
-                intel_vgpu_init_gtt(vgpu);
-        }
-
-        vgpu->resetting = false;
-
-        return 0;
-}
-
 static int gdrst_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
-                void *p_data, unsigned int bytes)
+                            void *p_data, unsigned int bytes)
 {
+        unsigned int engine_mask = 0;
         u32 data;
-        u64 bitmap = 0;
 
         write_vreg(vgpu, offset, p_data, bytes);
         data = vgpu_vreg(vgpu, offset);
 
         if (data & GEN6_GRDOM_FULL) {
                 gvt_dbg_mmio("vgpu%d: request full GPU reset\n", vgpu->id);
-                bitmap = 0xff;
-        }
-        if (data & GEN6_GRDOM_RENDER) {
-                gvt_dbg_mmio("vgpu%d: request RCS reset\n", vgpu->id);
-                bitmap |= (1 << RCS);
-        }
-        if (data & GEN6_GRDOM_MEDIA) {
-                gvt_dbg_mmio("vgpu%d: request VCS reset\n", vgpu->id);
-                bitmap |= (1 << VCS);
-        }
-        if (data & GEN6_GRDOM_BLT) {
-                gvt_dbg_mmio("vgpu%d: request BCS Reset\n", vgpu->id);
-                bitmap |= (1 << BCS);
-        }
-        if (data & GEN6_GRDOM_VECS) {
-                gvt_dbg_mmio("vgpu%d: request VECS Reset\n", vgpu->id);
-                bitmap |= (1 << VECS);
-        }
-        if (data & GEN8_GRDOM_MEDIA2) {
-                gvt_dbg_mmio("vgpu%d: request VCS2 Reset\n", vgpu->id);
-                if (HAS_BSD2(vgpu->gvt->dev_priv))
-                        bitmap |= (1 << VCS2);
+                engine_mask = ALL_ENGINES;
+        } else {
+                if (data & GEN6_GRDOM_RENDER) {
+                        gvt_dbg_mmio("vgpu%d: request RCS reset\n", vgpu->id);
+                        engine_mask |= (1 << RCS);
+                }
+                if (data & GEN6_GRDOM_MEDIA) {
+                        gvt_dbg_mmio("vgpu%d: request VCS reset\n", vgpu->id);
+                        engine_mask |= (1 << VCS);
+                }
+                if (data & GEN6_GRDOM_BLT) {
+                        gvt_dbg_mmio("vgpu%d: request BCS Reset\n", vgpu->id);
+                        engine_mask |= (1 << BCS);
+                }
+                if (data & GEN6_GRDOM_VECS) {
+                        gvt_dbg_mmio("vgpu%d: request VECS Reset\n", vgpu->id);
+                        engine_mask |= (1 << VECS);
+                }
+                if (data & GEN8_GRDOM_MEDIA2) {
+                        gvt_dbg_mmio("vgpu%d: request VCS2 Reset\n", vgpu->id);
+                        if (HAS_BSD2(vgpu->gvt->dev_priv))
+                                engine_mask |= (1 << VCS2);
+                }
         }
-        return handle_device_reset(vgpu, offset, p_data, bytes, bitmap);
+
+        intel_gvt_reset_vgpu_locked(vgpu, false, engine_mask);
+
+        return 0;
 }
 
 static int gmbus_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
@@ -974,7 +943,7 @@ static int sbi_data_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
         return 0;
 }
 
-static bool sbi_ctl_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
+static int sbi_ctl_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes)
 {
         u32 data;
@@ -1366,7 +1335,6 @@ static int ring_mode_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
 static int gvt_reg_tlb_control_handler(struct intel_vgpu *vgpu,
                 unsigned int offset, void *p_data, unsigned int bytes)
 {
-        int rc = 0;
         unsigned int id = 0;
 
         write_vreg(vgpu, offset, p_data, bytes);
@@ -1389,12 +1357,11 @@ static int gvt_reg_tlb_control_handler(struct intel_vgpu *vgpu,
                 id = VECS;
                 break;
         default:
-                rc = -EINVAL;
-                break;
+                return -EINVAL;
         }
         set_bit(id, (void *)vgpu->tlb_handle_pending);
 
-        return rc;
+        return 0;
 }
 
 static int ring_reset_ctl_write(struct intel_vgpu *vgpu,
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index faaae07ae487..0c9234a87a20 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -398,6 +398,7 @@ static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
         struct intel_vgpu_type *type;
         struct device *pdev;
         void *gvt;
+        int ret;
 
         pdev = mdev_parent_dev(mdev);
         gvt = kdev_to_i915(pdev)->gvt;
@@ -406,13 +407,15 @@ static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
         if (!type) {
                 gvt_err("failed to find type %s to create\n",
                                                 kobject_name(kobj));
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
         }
 
         vgpu = intel_gvt_ops->vgpu_create(gvt, type);
         if (IS_ERR_OR_NULL(vgpu)) {
-                gvt_err("create intel vgpu failed\n");
-                return -EINVAL;
+                ret = vgpu == NULL ? -EFAULT : PTR_ERR(vgpu);
+                gvt_err("failed to create intel vgpu: %d\n", ret);
+                goto out;
         }
 
         INIT_WORK(&vgpu->vdev.release_work, intel_vgpu_release_work);
@@ -422,7 +425,10 @@ static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
 
         gvt_dbg_core("intel_vgpu_create succeeded for mdev: %s\n",
                      dev_name(mdev_dev(mdev)));
-        return 0;
+        ret = 0;
+
+out:
+        return ret;
 }
 
 static int intel_vgpu_remove(struct mdev_device *mdev)
diff --git a/drivers/gpu/drm/i915/gvt/mmio.c b/drivers/gpu/drm/i915/gvt/mmio.c
index 09c9450a1946..4df078bc5d04 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.c
+++ b/drivers/gpu/drm/i915/gvt/mmio.c
@@ -125,25 +125,12 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
         if (WARN_ON(!reg_is_mmio(gvt, offset + bytes - 1)))
                 goto err;
 
-        mmio = intel_gvt_find_mmio_info(gvt, rounddown(offset, 4));
-        if (!mmio && !vgpu->mmio.disable_warn_untrack) {
-                gvt_err("vgpu%d: read untracked MMIO %x len %d val %x\n",
-                                vgpu->id, offset, bytes, *(u32 *)p_data);
-
-                if (offset == 0x206c) {
-                        gvt_err("------------------------------------------\n");
-                        gvt_err("vgpu%d: likely triggers a gfx reset\n",
-                        vgpu->id);
-                        gvt_err("------------------------------------------\n");
-                        vgpu->mmio.disable_warn_untrack = true;
-                }
-        }
-
         if (!intel_gvt_mmio_is_unalign(gvt, offset)) {
                 if (WARN_ON(!IS_ALIGNED(offset, bytes)))
                         goto err;
         }
 
+        mmio = intel_gvt_find_mmio_info(gvt, rounddown(offset, 4));
         if (mmio) {
                 if (!intel_gvt_mmio_is_unalign(gvt, mmio->offset)) {
                         if (WARN_ON(offset + bytes > mmio->offset + mmio->size))
@@ -152,9 +139,23 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
                                 goto err;
                 }
                 ret = mmio->read(vgpu, offset, p_data, bytes);
-        } else
+        } else {
                 ret = intel_vgpu_default_mmio_read(vgpu, offset, p_data, bytes);
 
+                if (!vgpu->mmio.disable_warn_untrack) {
+                        gvt_err("vgpu%d: read untracked MMIO %x(%dB) val %x\n",
+                                vgpu->id, offset, bytes, *(u32 *)p_data);
+
+                        if (offset == 0x206c) {
+                                gvt_err("------------------------------------------\n");
+                                gvt_err("vgpu%d: likely triggers a gfx reset\n",
+                                        vgpu->id);
+                                gvt_err("------------------------------------------\n");
+                                vgpu->mmio.disable_warn_untrack = true;
+                        }
+                }
+        }
+
         if (ret)
                 goto err;
 
@@ -302,3 +303,56 @@ err:
         mutex_unlock(&gvt->lock);
         return ret;
 }
+
+
+/**
+ * intel_vgpu_reset_mmio - reset virtual MMIO space
+ * @vgpu: a vGPU
+ *
+ */
+void intel_vgpu_reset_mmio(struct intel_vgpu *vgpu)
+{
+        struct intel_gvt *gvt = vgpu->gvt;
+        const struct intel_gvt_device_info *info = &gvt->device_info;
+
+        memcpy(vgpu->mmio.vreg, gvt->firmware.mmio, info->mmio_size);
+        memcpy(vgpu->mmio.sreg, gvt->firmware.mmio, info->mmio_size);
+
+        vgpu_vreg(vgpu, GEN6_GT_THREAD_STATUS_REG) = 0;
+
+        /* set the bit 0:2(Core C-State ) to C0 */
+        vgpu_vreg(vgpu, GEN6_GT_CORE_STATUS) = 0;
+}
+
+/**
+ * intel_vgpu_init_mmio - init MMIO  space
+ * @vgpu: a vGPU
+ *
+ * Returns:
+ * Zero on success, negative error code if failed
+ */
+int intel_vgpu_init_mmio(struct intel_vgpu *vgpu)
+{
+        const struct intel_gvt_device_info *info = &vgpu->gvt->device_info;
+
+        vgpu->mmio.vreg = vzalloc(info->mmio_size * 2);
+        if (!vgpu->mmio.vreg)
+                return -ENOMEM;
+
+        vgpu->mmio.sreg = vgpu->mmio.vreg + info->mmio_size;
+
+        intel_vgpu_reset_mmio(vgpu);
+
+        return 0;
+}
+
+/**
+ * intel_vgpu_clean_mmio - clean MMIO space
+ * @vgpu: a vGPU
+ *
+ */
+void intel_vgpu_clean_mmio(struct intel_vgpu *vgpu)
+{
+        vfree(vgpu->mmio.vreg);
+        vgpu->mmio.vreg = vgpu->mmio.sreg = NULL;
+}
diff --git a/drivers/gpu/drm/i915/gvt/mmio.h b/drivers/gpu/drm/i915/gvt/mmio.h
index 87d5b5e366a3..3bc620f56f35 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.h
+++ b/drivers/gpu/drm/i915/gvt/mmio.h
@@ -86,6 +86,10 @@ struct intel_gvt_mmio_info *intel_gvt_find_mmio_info(struct intel_gvt *gvt,
         *offset; \
 })
 
+int intel_vgpu_init_mmio(struct intel_vgpu *vgpu);
+void intel_vgpu_reset_mmio(struct intel_vgpu *vgpu);
+void intel_vgpu_clean_mmio(struct intel_vgpu *vgpu);
+
 int intel_vgpu_gpa_to_mmio_offset(struct intel_vgpu *vgpu, u64 gpa);
 
 int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, u64 pa,
diff --git a/drivers/gpu/drm/i915/gvt/opregion.c b/drivers/gpu/drm/i915/gvt/opregion.c
index 81cd921770c6..d9fb41ab7119 100644
--- a/drivers/gpu/drm/i915/gvt/opregion.c
+++ b/drivers/gpu/drm/i915/gvt/opregion.c
@@ -36,9 +36,9 @@ static int init_vgpu_opregion(struct intel_vgpu *vgpu, u32 gpa)
                         vgpu->id))
                 return -EINVAL;
 
-        vgpu_opregion(vgpu)->va = (void *)__get_free_pages(GFP_ATOMIC |
-                        GFP_DMA32 | __GFP_ZERO,
-                        INTEL_GVT_OPREGION_PORDER);
+        vgpu_opregion(vgpu)->va = (void *)__get_free_pages(GFP_KERNEL |
+                        __GFP_ZERO,
+                        get_order(INTEL_GVT_OPREGION_SIZE));
 
         if (!vgpu_opregion(vgpu)->va)
                 return -ENOMEM;
@@ -97,7 +97,7 @@ void intel_vgpu_clean_opregion(struct intel_vgpu *vgpu)
         if (intel_gvt_host.hypervisor_type == INTEL_GVT_HYPERVISOR_XEN) {
                 map_vgpu_opregion(vgpu, false);
                 free_pages((unsigned long)vgpu_opregion(vgpu)->va,
-                                INTEL_GVT_OPREGION_PORDER);
+                                get_order(INTEL_GVT_OPREGION_SIZE));
 
                 vgpu_opregion(vgpu)->va = NULL;
         }
diff --git a/drivers/gpu/drm/i915/gvt/reg.h b/drivers/gpu/drm/i915/gvt/reg.h
index 0dfe789d8f02..fbd023a16f18 100644
--- a/drivers/gpu/drm/i915/gvt/reg.h
+++ b/drivers/gpu/drm/i915/gvt/reg.h
@@ -50,8 +50,7 @@
 #define INTEL_GVT_OPREGION_PARM                   0x204
 
 #define INTEL_GVT_OPREGION_PAGES        2
-#define INTEL_GVT_OPREGION_PORDER       1
-#define INTEL_GVT_OPREGION_SIZE         (2 * 4096)
+#define INTEL_GVT_OPREGION_SIZE         (INTEL_GVT_OPREGION_PAGES * PAGE_SIZE)
 
 #define VGT_SPRSTRIDE(pipe)     _PIPE(pipe, _SPRA_STRIDE, _PLANE_STRIDE_2_B)
 
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 4db242250235..e91885dffeff 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -350,13 +350,15 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
 {
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct intel_vgpu_workload *workload;
+        struct intel_vgpu *vgpu;
         int event;
 
         mutex_lock(&gvt->lock);
 
         workload = scheduler->current_workload[ring_id];
+        vgpu = workload->vgpu;
 
-        if (!workload->status && !workload->vgpu->resetting) {
+        if (!workload->status && !vgpu->resetting) {
                 wait_event(workload->shadow_ctx_status_wq,
                            !atomic_read(&workload->shadow_ctx_active));
 
@@ -364,8 +366,7 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
 
                 for_each_set_bit(event, workload->pending_events,
                                  INTEL_GVT_EVENT_MAX)
-                        intel_vgpu_trigger_virtual_event(workload->vgpu,
-                                        event);
+                        intel_vgpu_trigger_virtual_event(vgpu, event);
         }
 
         gvt_dbg_sched("ring id %d complete workload %p status %d\n",
@@ -373,11 +374,10 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
 
         scheduler->current_workload[ring_id] = NULL;
 
-        atomic_dec(&workload->vgpu->running_workload_num);
-
         list_del_init(&workload->list);
         workload->complete(workload);
 
+        atomic_dec(&vgpu->running_workload_num);
         wake_up(&scheduler->workload_complete_wq);
         mutex_unlock(&gvt->lock);
 }
@@ -459,11 +459,11 @@ complete:
                 gvt_dbg_sched("will complete workload %p\n, status: %d\n",
                                 workload, workload->status);
 
-                complete_current_workload(gvt, ring_id);
-
                 if (workload->req)
                         i915_gem_request_put(fetch_and_zero(&workload->req));
 
+                complete_current_workload(gvt, ring_id);
+
                 if (need_force_wake)
                         intel_uncore_forcewake_put(gvt->dev_priv,
                                         FORCEWAKE_ALL);
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index 536d2b9d5777..7295bc8e12fb 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -35,79 +35,6 @@
 #include "gvt.h"
 #include "i915_pvinfo.h"
 
-static void clean_vgpu_mmio(struct intel_vgpu *vgpu)
-{
-        vfree(vgpu->mmio.vreg);
-        vgpu->mmio.vreg = vgpu->mmio.sreg = NULL;
-}
-
-int setup_vgpu_mmio(struct intel_vgpu *vgpu)
-{
-        struct intel_gvt *gvt = vgpu->gvt;
-        const struct intel_gvt_device_info *info = &gvt->device_info;
-
-        if (vgpu->mmio.vreg)
-                memset(vgpu->mmio.vreg, 0, info->mmio_size * 2);
-        else {
-                vgpu->mmio.vreg = vzalloc(info->mmio_size * 2);
-                if (!vgpu->mmio.vreg)
-                        return -ENOMEM;
-        }
-
-        vgpu->mmio.sreg = vgpu->mmio.vreg + info->mmio_size;
-
-        memcpy(vgpu->mmio.vreg, gvt->firmware.mmio, info->mmio_size);
-        memcpy(vgpu->mmio.sreg, gvt->firmware.mmio, info->mmio_size);
-
-        vgpu_vreg(vgpu, GEN6_GT_THREAD_STATUS_REG) = 0;
-
-        /* set the bit 0:2(Core C-State ) to C0 */
-        vgpu_vreg(vgpu, GEN6_GT_CORE_STATUS) = 0;
-        return 0;
-}
-
-static void setup_vgpu_cfg_space(struct intel_vgpu *vgpu,
-        struct intel_vgpu_creation_params *param)
-{
-        struct intel_gvt *gvt = vgpu->gvt;
-        const struct intel_gvt_device_info *info = &gvt->device_info;
-        u16 *gmch_ctl;
-        int i;
-
-        memcpy(vgpu_cfg_space(vgpu), gvt->firmware.cfg_space,
-               info->cfg_space_size);
-
-        if (!param->primary) {
-                vgpu_cfg_space(vgpu)[PCI_CLASS_DEVICE] =
-                        INTEL_GVT_PCI_CLASS_VGA_OTHER;
-                vgpu_cfg_space(vgpu)[PCI_CLASS_PROG] =
-                        INTEL_GVT_PCI_CLASS_VGA_OTHER;
-        }
-
-        /* Show guest that there isn't any stolen memory.*/
-        gmch_ctl = (u16 *)(vgpu_cfg_space(vgpu) + INTEL_GVT_PCI_GMCH_CONTROL);
-        *gmch_ctl &= ~(BDW_GMCH_GMS_MASK << BDW_GMCH_GMS_SHIFT);
-
-        intel_vgpu_write_pci_bar(vgpu, PCI_BASE_ADDRESS_2,
-                                 gvt_aperture_pa_base(gvt), true);
-
-        vgpu_cfg_space(vgpu)[PCI_COMMAND] &= ~(PCI_COMMAND_IO
-                                             | PCI_COMMAND_MEMORY
-                                             | PCI_COMMAND_MASTER);
-        /*
-         * Clear the bar upper 32bit and let guest to assign the new value
-         */
-        memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_1, 0, 4);
-        memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_3, 0, 4);
-        memset(vgpu_cfg_space(vgpu) + INTEL_GVT_PCI_OPREGION, 0, 4);
-
-        for (i = 0; i < INTEL_GVT_MAX_BAR_NUM; i++) {
-                vgpu->cfg_space.bar[i].size = pci_resource_len(
-                                              gvt->dev_priv->drm.pdev, i * 2);
-                vgpu->cfg_space.bar[i].tracked = false;
-        }
-}
-
 void populate_pvinfo_page(struct intel_vgpu *vgpu)
 {
         /* setup the ballooning information */
@@ -177,7 +104,7 @@ int intel_gvt_init_vgpu_types(struct intel_gvt *gvt)
                 if (low_avail / min_low == 0)
                         break;
                 gvt->types[i].low_gm_size = min_low;
-                gvt->types[i].high_gm_size = 3 * gvt->types[i].low_gm_size;
+                gvt->types[i].high_gm_size = max((min_low<<3), MB_TO_BYTES(384U));
                 gvt->types[i].fence = 4;
                 gvt->types[i].max_instance = low_avail / min_low;
                 gvt->types[i].avail_instance = gvt->types[i].max_instance;
@@ -217,7 +144,7 @@ static void intel_gvt_update_vgpu_types(struct intel_gvt *gvt)
          */
         low_gm_avail = MB_TO_BYTES(256) - HOST_LOW_GM_SIZE -
                 gvt->gm.vgpu_allocated_low_gm_size;
-        high_gm_avail = MB_TO_BYTES(256) * 3 - HOST_HIGH_GM_SIZE -
+        high_gm_avail = MB_TO_BYTES(256) * 8UL - HOST_HIGH_GM_SIZE -
                 gvt->gm.vgpu_allocated_high_gm_size;
         fence_avail = gvt_fence_sz(gvt) - HOST_FENCE -
                 gvt->fence.vgpu_allocated_fence_num;
@@ -268,7 +195,7 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
         intel_vgpu_clean_gtt(vgpu);
         intel_gvt_hypervisor_detach_vgpu(vgpu);
         intel_vgpu_free_resource(vgpu);
-        clean_vgpu_mmio(vgpu);
+        intel_vgpu_clean_mmio(vgpu);
         vfree(vgpu);
 
         intel_gvt_update_vgpu_types(gvt);
@@ -300,11 +227,11 @@ static struct intel_vgpu *__intel_gvt_create_vgpu(struct intel_gvt *gvt,
         vgpu->gvt = gvt;
         bitmap_zero(vgpu->tlb_handle_pending, I915_NUM_ENGINES);
 
-        setup_vgpu_cfg_space(vgpu, param);
+        intel_vgpu_init_cfg_space(vgpu, param->primary);
 
-        ret = setup_vgpu_mmio(vgpu);
+        ret = intel_vgpu_init_mmio(vgpu);
         if (ret)
-                goto out_free_vgpu;
+                goto out_clean_idr;
 
         ret = intel_vgpu_alloc_resource(vgpu, param);
         if (ret)
@@ -354,7 +281,9 @@ out_detach_hypervisor_vgpu:
 out_clean_vgpu_resource:
         intel_vgpu_free_resource(vgpu);
 out_clean_vgpu_mmio:
-        clean_vgpu_mmio(vgpu);
+        intel_vgpu_clean_mmio(vgpu);
+out_clean_idr:
+        idr_remove(&gvt->vgpu_idr, vgpu->id);
 out_free_vgpu:
         vfree(vgpu);
         mutex_unlock(&gvt->lock);
@@ -398,7 +327,75 @@ struct intel_vgpu *intel_gvt_create_vgpu(struct intel_gvt *gvt,
 }
 
 /**
- * intel_gvt_reset_vgpu - reset a virtual GPU
+ * intel_gvt_reset_vgpu_locked - reset a virtual GPU by DMLR or GT reset
+ * @vgpu: virtual GPU
+ * @dmlr: vGPU Device Model Level Reset or GT Reset
+ * @engine_mask: engines to reset for GT reset
+ *
+ * This function is called when user wants to reset a virtual GPU through
+ * device model reset or GT reset. The caller should hold the gvt lock.
+ *
+ * vGPU Device Model Level Reset (DMLR) simulates the PCI level reset to reset
+ * the whole vGPU to default state as when it is created. This vGPU function
+ * is required both for functionary and security concerns.The ultimate goal
+ * of vGPU FLR is that reuse a vGPU instance by virtual machines. When we
+ * assign a vGPU to a virtual machine we must isse such reset first.
+ *
+ * Full GT Reset and Per-Engine GT Reset are soft reset flow for GPU engines
+ * (Render, Blitter, Video, Video Enhancement). It is defined by GPU Spec.
+ * Unlike the FLR, GT reset only reset particular resource of a vGPU per
+ * the reset request. Guest driver can issue a GT reset by programming the
+ * virtual GDRST register to reset specific virtual GPU engine or all
+ * engines.
+ *
+ * The parameter dev_level is to identify if we will do DMLR or GT reset.
+ * The parameter engine_mask is to specific the engines that need to be
+ * resetted. If value ALL_ENGINES is given for engine_mask, it means
+ * the caller requests a full GT reset that we will reset all virtual
+ * GPU engines. For FLR, engine_mask is ignored.
+ */
+void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
+                                 unsigned int engine_mask)
+{
+        struct intel_gvt *gvt = vgpu->gvt;
+        struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
+
+        gvt_dbg_core("------------------------------------------\n");
+        gvt_dbg_core("resseting vgpu%d, dmlr %d, engine_mask %08x\n",
+                     vgpu->id, dmlr, engine_mask);
+        vgpu->resetting = true;
+
+        intel_vgpu_stop_schedule(vgpu);
+        /*
+         * The current_vgpu will set to NULL after stopping the
+         * scheduler when the reset is triggered by current vgpu.
+         */
+        if (scheduler->current_vgpu == NULL) {
+                mutex_unlock(&gvt->lock);
+                intel_gvt_wait_vgpu_idle(vgpu);
+                mutex_lock(&gvt->lock);
+        }
+
+        intel_vgpu_reset_execlist(vgpu, dmlr ? ALL_ENGINES : engine_mask);
+
+        /* full GPU reset or device model level reset */
+        if (engine_mask == ALL_ENGINES || dmlr) {
+                intel_vgpu_reset_gtt(vgpu, dmlr);
+                intel_vgpu_reset_resource(vgpu);
+                intel_vgpu_reset_mmio(vgpu);
+                populate_pvinfo_page(vgpu);
+
+                if (dmlr)
+                        intel_vgpu_reset_cfg_space(vgpu);
+        }
+
+        vgpu->resetting = false;
+        gvt_dbg_core("reset vgpu%d done\n", vgpu->id);
+        gvt_dbg_core("------------------------------------------\n");
+}
+
+/**
+ * intel_gvt_reset_vgpu - reset a virtual GPU (Function Level)
  * @vgpu: virtual GPU
  *
  * This function is called when user wants to reset a virtual GPU.
@@ -406,4 +403,7 @@ struct intel_vgpu *intel_gvt_create_vgpu(struct intel_gvt *gvt,
  */
 void intel_gvt_reset_vgpu(struct intel_vgpu *vgpu)
 {
+        mutex_lock(&vgpu->gvt->lock);
+        intel_gvt_reset_vgpu_locked(vgpu, true, 0);
+        mutex_unlock(&vgpu->gvt->lock);
 }
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 3dd7fc662859..4b23a7814713 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -595,47 +595,21 @@ i915_gem_phys_pwrite(struct drm_i915_gem_object *obj,
                      struct drm_i915_gem_pwrite *args,
                      struct drm_file *file)
 {
-        struct drm_device *dev = obj->base.dev;
         void *vaddr = obj->phys_handle->vaddr + args->offset;
         char __user *user_data = u64_to_user_ptr(args->data_ptr);
-        int ret;
 
         /* We manually control the domain here and pretend that it
          * remains coherent i.e. in the GTT domain, like shmem_pwrite.
          */
-        lockdep_assert_held(&obj->base.dev->struct_mutex);
-        ret = i915_gem_object_wait(obj,
-                                   I915_WAIT_INTERRUPTIBLE |
-                                   I915_WAIT_LOCKED |
-                                   I915_WAIT_ALL,
-                                   MAX_SCHEDULE_TIMEOUT,
-                                   to_rps_client(file));
-        if (ret)
-                return ret;
-
         intel_fb_obj_invalidate(obj, ORIGIN_CPU);
-        if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
-                unsigned long unwritten;
-
-                /* The physical object once assigned is fixed for the lifetime
-                 * of the obj, so we can safely drop the lock and continue
-                 * to access vaddr.
-                 */
-                mutex_unlock(&dev->struct_mutex);
-                unwritten = copy_from_user(vaddr, user_data, args->size);
-                mutex_lock(&dev->struct_mutex);
-                if (unwritten) {
-                        ret = -EFAULT;
-                        goto out;
-                }
-        }
+        if (copy_from_user(vaddr, user_data, args->size))
+                return -EFAULT;
 
         drm_clflush_virt_range(vaddr, args->size);
-        i915_gem_chipset_flush(to_i915(dev));
+        i915_gem_chipset_flush(to_i915(obj->base.dev));
 
-out:
         intel_fb_obj_flush(obj, false, ORIGIN_CPU);
-        return ret;
+        return 0;
 }
 
 void *i915_gem_object_alloc(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index bd08814b015c..d534a316a16e 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -199,6 +199,7 @@ found:
         }
 
         /* Unbinding will emit any required flushes */
+        ret = 0;
         while (!list_empty(&eviction_list)) {
                 vma = list_first_entry(&eviction_list,
                                        struct i915_vma,
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3dc8724df400..8d702cf1a616 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2967,6 +2967,9 @@ int skl_check_plane_surface(struct intel_plane_state *plane_state)
         unsigned int rotation = plane_state->base.rotation;
         int ret;
 
+        if (!plane_state->base.visible)
+                return 0;
+
         /* Rotate src coordinates to match rotated GTT view */
         if (drm_rotation_90_or_270(rotation))
                 drm_rect_rotate(&plane_state->base.src,
diff --git a/drivers/gpu/drm/i915/intel_hotplug.c b/drivers/gpu/drm/i915/intel_hotplug.c
index 3d546c019de0..b62e3f8ad415 100644
--- a/drivers/gpu/drm/i915/intel_hotplug.c
+++ b/drivers/gpu/drm/i915/intel_hotplug.c
@@ -180,7 +180,7 @@ static void intel_hpd_irq_storm_disable(struct drm_i915_private *dev_priv)
 
         /* Enable polling and queue hotplug re-enabling. */
         if (hpd_disabled) {
-                drm_kms_helper_poll_enable_locked(dev);
+                drm_kms_helper_poll_enable(dev);
                 mod_delayed_work(system_wq, &dev_priv->hotplug.reenable_work,
                                  msecs_to_jiffies(HPD_STORM_REENABLE_DELAY));
         }
@@ -511,7 +511,7 @@ static void i915_hpd_poll_init_work(struct work_struct *work)
         }
 
         if (enabled)
-                drm_kms_helper_poll_enable_locked(dev);
+                drm_kms_helper_poll_enable(dev);
 
         mutex_unlock(&dev->mode_config.mutex);
 
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index d4961fa20c73..beabc17e7c8a 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -979,18 +979,8 @@ static inline int gen8_emit_flush_coherentl3_wa(struct intel_engine_cs *engine,
                                                 uint32_t *batch,
                                                 uint32_t index)
 {
-        struct drm_i915_private *dev_priv = engine->i915;
         uint32_t l3sqc4_flush = (0x40400000 | GEN8_LQSC_FLUSH_COHERENT_LINES);
 
-        /*
-         * WaDisableLSQCROPERFforOCL:kbl
-         * This WA is implemented in skl_init_clock_gating() but since
-         * this batch updates GEN8_L3SQCREG4 with default value we need to
-         * set this bit here to retain the WA during flush.
-         */
-        if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_E0))
-                l3sqc4_flush |= GEN8_LQSC_RO_PERF_DIS;
-
         wa_ctx_emit(batch, index, (MI_STORE_REGISTER_MEM_GEN8 |
                                    MI_SRM_LRM_GLOBAL_GTT));
         wa_ctx_emit_reg(batch, index, GEN8_L3SQCREG4);
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index aeb637dc1fdf..91cb4c422ad5 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -1095,14 +1095,6 @@ static int kbl_init_workarounds(struct intel_engine_cs *engine)
                 WA_SET_BIT_MASKED(HDC_CHICKEN0,
                                   HDC_FENCE_DEST_SLM_DISABLE);
 
-        /* GEN8_L3SQCREG4 has a dependency with WA batch so any new changes
-         * involving this register should also be added to WA batch as required.
-         */
-        if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_E0))
-                /* WaDisableLSQCROPERFforOCL:kbl */
-                I915_WRITE(GEN8_L3SQCREG4, I915_READ(GEN8_L3SQCREG4) |
-                           GEN8_LQSC_RO_PERF_DIS);
-
         /* WaToEnableHwFixForPushConstHWBug:kbl */
         if (IS_KBL_REVID(dev_priv, KBL_REVID_C0, REVID_FOREVER))
                 WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2,
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index 14ff87686a36..686a580c711a 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -345,7 +345,6 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
 {
         struct adreno_platform_config *config = pdev->dev.platform_data;
         struct msm_gpu *gpu = &adreno_gpu->base;
-        struct msm_mmu *mmu;
         int ret;
 
         adreno_gpu->funcs = funcs;
@@ -385,8 +384,8 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
                 return ret;
         }
 
-        mmu = gpu->aspace->mmu;
-        if (mmu) {
+        if (gpu->aspace && gpu->aspace->mmu) {
+                struct msm_mmu *mmu = gpu->aspace->mmu;
                 ret = mmu->funcs->attach(mmu, iommu_ports,
                                 ARRAY_SIZE(iommu_ports));
                 if (ret)
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
index 5f6cd8745dbc..c396d459a9d0 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
@@ -119,13 +119,7 @@ static void mdp5_prepare_commit(struct msm_kms *kms, struct drm_atomic_state *st
 
 static void mdp5_complete_commit(struct msm_kms *kms, struct drm_atomic_state *state)
 {
-        int i;
         struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
-        struct drm_plane *plane;
-        struct drm_plane_state *plane_state;
-
-        for_each_plane_in_state(state, plane, plane_state, i)
-                mdp5_plane_complete_commit(plane, plane_state);
 
         if (mdp5_kms->smp)
                 mdp5_smp_complete_commit(mdp5_kms->smp, &mdp5_kms->state->smp);
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
index 17b0cc101171..cdfc63d90c7b 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
@@ -104,8 +104,6 @@ struct mdp5_plane_state {
 
         /* assigned by crtc blender */
         enum mdp_mixer_stage_id stage;
-
-        bool pending : 1;
 };
 #define to_mdp5_plane_state(x) \
                 container_of(x, struct mdp5_plane_state, base)
@@ -232,8 +230,6 @@ int mdp5_irq_domain_init(struct mdp5_kms *mdp5_kms);
 void mdp5_irq_domain_fini(struct mdp5_kms *mdp5_kms);
 
 uint32_t mdp5_plane_get_flush(struct drm_plane *plane);
-void mdp5_plane_complete_commit(struct drm_plane *plane,
-        struct drm_plane_state *state);
 enum mdp5_pipe mdp5_plane_pipe(struct drm_plane *plane);
 struct drm_plane *mdp5_plane_init(struct drm_device *dev, bool primary);
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
index c099da7bc212..25d9d0a97156 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
@@ -179,7 +179,6 @@ mdp5_plane_atomic_print_state(struct drm_printer *p,
         drm_printf(p, "\tzpos=%u\n", pstate->zpos);
         drm_printf(p, "\talpha=%u\n", pstate->alpha);
         drm_printf(p, "\tstage=%s\n", stage2name(pstate->stage));
-        drm_printf(p, "\tpending=%u\n", pstate->pending);
 }
 
 static void mdp5_plane_reset(struct drm_plane *plane)
@@ -220,8 +219,6 @@ mdp5_plane_duplicate_state(struct drm_plane *plane)
         if (mdp5_state && mdp5_state->base.fb)
                 drm_framebuffer_reference(mdp5_state->base.fb);
 
-        mdp5_state->pending = false;
-
         return &mdp5_state->base;
 }
 
@@ -288,13 +285,6 @@ static int mdp5_plane_atomic_check(struct drm_plane *plane,
         DBG("%s: check (%d -> %d)", plane->name,
                         plane_enabled(old_state), plane_enabled(state));
 
-        /* We don't allow faster-than-vblank updates.. if we did add this
-         * some day, we would need to disallow in cases where hwpipe
-         * changes
-         */
-        if (WARN_ON(to_mdp5_plane_state(old_state)->pending))
-                return -EBUSY;
-
         max_width = config->hw->lm.max_width << 16;
         max_height = config->hw->lm.max_height << 16;
 
@@ -370,12 +360,9 @@ static void mdp5_plane_atomic_update(struct drm_plane *plane,
                                      struct drm_plane_state *old_state)
 {
         struct drm_plane_state *state = plane->state;
-        struct mdp5_plane_state *mdp5_state = to_mdp5_plane_state(state);
 
         DBG("%s: update", plane->name);
 
-        mdp5_state->pending = true;
-
         if (plane_enabled(state)) {
                 int ret;
 
@@ -851,15 +838,6 @@ uint32_t mdp5_plane_get_flush(struct drm_plane *plane)
         return pstate->hwpipe->flush_mask;
 }
 
-/* called after vsync in thread context */
-void mdp5_plane_complete_commit(struct drm_plane *plane,
-        struct drm_plane_state *state)
-{
-        struct mdp5_plane_state *pstate = to_mdp5_plane_state(plane->state);
-
-        pstate->pending = false;
-}
-
 /* initialize plane */
 struct drm_plane *mdp5_plane_init(struct drm_device *dev, bool primary)
 {
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index d8bc59c7e261..8098677a3916 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -294,6 +294,8 @@ put_iova(struct drm_gem_object *obj)
         WARN_ON(!mutex_is_locked(&dev->struct_mutex));
 
         for (id = 0; id < ARRAY_SIZE(msm_obj->domain); id++) {
+                if (!priv->aspace[id])
+                        continue;
                 msm_gem_unmap_vma(priv->aspace[id],
                                 &msm_obj->domain[id], msm_obj->sgt);
         }
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index e8a38d296855..414776811e71 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -114,6 +114,9 @@ MODULE_FIRMWARE("radeon/hainan_mc.bin");
 MODULE_FIRMWARE("radeon/hainan_rlc.bin");
 MODULE_FIRMWARE("radeon/hainan_smc.bin");
 MODULE_FIRMWARE("radeon/hainan_k_smc.bin");
+MODULE_FIRMWARE("radeon/banks_k_2_smc.bin");
+
+MODULE_FIRMWARE("radeon/si58_mc.bin");
 
 static u32 si_get_cu_active_bitmap(struct radeon_device *rdev, u32 se, u32 sh);
 static void si_pcie_gen3_enable(struct radeon_device *rdev);
@@ -1650,6 +1653,8 @@ static int si_init_microcode(struct radeon_device *rdev)
         int err;
         int new_fw = 0;
         bool new_smc = false;
+        bool si58_fw = false;
+        bool banks2_fw = false;
 
         DRM_DEBUG("\n");
 
@@ -1727,10 +1732,11 @@ static int si_init_microcode(struct radeon_device *rdev)
                      ((rdev->pdev->device == 0x6660) ||
                       (rdev->pdev->device == 0x6663) ||
                       (rdev->pdev->device == 0x6665) ||
-                      (rdev->pdev->device == 0x6667))) ||
-                    ((rdev->pdev->revision == 0xc3) &&
-                     (rdev->pdev->device == 0x6665)))
+                      (rdev->pdev->device == 0x6667))))
                         new_smc = true;
+                else if ((rdev->pdev->revision == 0xc3) &&
+                         (rdev->pdev->device == 0x6665))
+                        banks2_fw = true;
                 new_chip_name = "hainan";
                 pfp_req_size = SI_PFP_UCODE_SIZE * 4;
                 me_req_size = SI_PM4_UCODE_SIZE * 4;
@@ -1742,6 +1748,10 @@ static int si_init_microcode(struct radeon_device *rdev)
         default: BUG();
         }
 
+        /* this memory configuration requires special firmware */
+        if (((RREG32(MC_SEQ_MISC0) & 0xff000000) >> 24) == 0x58)
+                si58_fw = true;
+
         DRM_INFO("Loading %s Microcode\n", new_chip_name);
 
         snprintf(fw_name, sizeof(fw_name), "radeon/%s_pfp.bin", new_chip_name);
@@ -1845,7 +1855,10 @@ static int si_init_microcode(struct radeon_device *rdev)
                 }
         }
 
-        snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", new_chip_name);
+        if (si58_fw)
+                snprintf(fw_name, sizeof(fw_name), "radeon/si58_mc.bin");
+        else
+                snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", new_chip_name);
         err = request_firmware(&rdev->mc_fw, fw_name, rdev->dev);
         if (err) {
                 snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc2.bin", chip_name);
@@ -1876,7 +1889,9 @@ static int si_init_microcode(struct radeon_device *rdev)
                 }
         }
 
-        if (new_smc)
+        if (banks2_fw)
+                snprintf(fw_name, sizeof(fw_name), "radeon/banks_k_2_smc.bin");
+        else if (new_smc)
                 snprintf(fw_name, sizeof(fw_name), "radeon/%s_k_smc.bin", new_chip_name);
         else
                 snprintf(fw_name, sizeof(fw_name), "radeon/%s_smc.bin", new_chip_name);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 13ba73fd9b68..2944916f7102 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -3008,17 +3008,6 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                     (rdev->pdev->device == 0x6817) ||
                     (rdev->pdev->device == 0x6806))
                         max_mclk = 120000;
-        } else if (rdev->family == CHIP_OLAND) {
-                if ((rdev->pdev->revision == 0xC7) ||
-                    (rdev->pdev->revision == 0x80) ||
-                    (rdev->pdev->revision == 0x81) ||
-                    (rdev->pdev->revision == 0x83) ||
-                    (rdev->pdev->revision == 0x87) ||
-                    (rdev->pdev->device == 0x6604) ||
-                    (rdev->pdev->device == 0x6605)) {
-                        max_sclk = 75000;
-                        max_mclk = 80000;
-                }
         } else if (rdev->family == CHIP_HAINAN) {
                 if ((rdev->pdev->revision == 0x81) ||
                     (rdev->pdev->revision == 0x83) ||
@@ -3027,7 +3016,6 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                     (rdev->pdev->device == 0x6665) ||
                     (rdev->pdev->device == 0x6667)) {
                         max_sclk = 75000;
-                        max_mclk = 80000;
                 }
         }
         /* Apply dpm quirks */
diff --git a/drivers/gpu/drm/virtio/virtgpu_fb.c b/drivers/gpu/drm/virtio/virtgpu_fb.c
index dd21f950e129..cde9f3758106 100644
--- a/drivers/gpu/drm/virtio/virtgpu_fb.c
+++ b/drivers/gpu/drm/virtio/virtgpu_fb.c
@@ -331,7 +331,7 @@ static int virtio_gpufb_create(struct drm_fb_helper *helper,
         info->fbops = &virtio_gpufb_ops;
         info->pixmap.flags = FB_PIXMAP_SYSTEM;
 
-        info->screen_base = obj->vmap;
+        info->screen_buffer = obj->vmap;
         info->screen_size = obj->gem_base.size;
         drm_fb_helper_fill_fix(info, fb->pitches[0], fb->depth);
         drm_fb_helper_fill_var(info, &vfbdev->helper,
diff --git a/drivers/hid/hid-corsair.c b/drivers/hid/hid-corsair.c
index 717704e9ae07..c0303f61c26a 100644
--- a/drivers/hid/hid-corsair.c
+++ b/drivers/hid/hid-corsair.c
@@ -148,26 +148,36 @@ static enum led_brightness k90_backlight_get(struct led_classdev *led_cdev)
         struct usb_interface *usbif = to_usb_interface(dev->parent);
         struct usb_device *usbdev = interface_to_usbdev(usbif);
         int brightness;
-        char data[8];
+        char *data;
+
+        data = kmalloc(8, GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
 
         ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
                               K90_REQUEST_STATUS,
                               USB_DIR_IN | USB_TYPE_VENDOR |
                               USB_RECIP_DEVICE, 0, 0, data, 8,
                               USB_CTRL_SET_TIMEOUT);
-        if (ret < 0) {
+        if (ret < 5) {
                 dev_warn(dev, "Failed to get K90 initial state (error %d).\n",
                          ret);
-                return -EIO;
+                ret = -EIO;
+                goto out;
         }
         brightness = data[4];
         if (brightness < 0 || brightness > 3) {
                 dev_warn(dev,
                          "Read invalid backlight brightness: %02hhx.\n",
                          data[4]);
-                return -EIO;
+                ret = -EIO;
+                goto out;
         }
-        return brightness;
+        ret = brightness;
+out:
+        kfree(data);
+
+        return ret;
 }
 
 static enum led_brightness k90_record_led_get(struct led_classdev *led_cdev)
@@ -253,17 +263,22 @@ static ssize_t k90_show_macro_mode(struct device *dev,
         struct usb_interface *usbif = to_usb_interface(dev->parent);
         struct usb_device *usbdev = interface_to_usbdev(usbif);
         const char *macro_mode;
-        char data[8];
+        char *data;
+
+        data = kmalloc(2, GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
 
         ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
                               K90_REQUEST_GET_MODE,
                               USB_DIR_IN | USB_TYPE_VENDOR |
                               USB_RECIP_DEVICE, 0, 0, data, 2,
                               USB_CTRL_SET_TIMEOUT);
-        if (ret < 0) {
+        if (ret < 1) {
                 dev_warn(dev, "Failed to get K90 initial mode (error %d).\n",
                          ret);
-                return -EIO;
+                ret = -EIO;
+                goto out;
         }
 
         switch (data[0]) {
@@ -277,10 +292,15 @@ static ssize_t k90_show_macro_mode(struct device *dev,
         default:
                 dev_warn(dev, "K90 in unknown mode: %02hhx.\n",
                          data[0]);
-                return -EIO;
+                ret = -EIO;
+                goto out;
         }
 
-        return snprintf(buf, PAGE_SIZE, "%s\n", macro_mode);
+        ret = snprintf(buf, PAGE_SIZE, "%s\n", macro_mode);
+out:
+        kfree(data);
+
+        return ret;
 }
 
 static ssize_t k90_store_macro_mode(struct device *dev,
@@ -320,26 +340,36 @@ static ssize_t k90_show_current_profile(struct device *dev,
         struct usb_interface *usbif = to_usb_interface(dev->parent);
         struct usb_device *usbdev = interface_to_usbdev(usbif);
         int current_profile;
-        char data[8];
+        char *data;
+
+        data = kmalloc(8, GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
 
         ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
                               K90_REQUEST_STATUS,
                               USB_DIR_IN | USB_TYPE_VENDOR |
                               USB_RECIP_DEVICE, 0, 0, data, 8,
                               USB_CTRL_SET_TIMEOUT);
-        if (ret < 0) {
+        if (ret < 8) {
                 dev_warn(dev, "Failed to get K90 initial state (error %d).\n",
                          ret);
-                return -EIO;
+                ret = -EIO;
+                goto out;
         }
         current_profile = data[7];
         if (current_profile < 1 || current_profile > 3) {
                 dev_warn(dev, "Read invalid current profile: %02hhx.\n",
                          data[7]);
-                return -EIO;
+                ret = -EIO;
+                goto out;
         }
 
-        return snprintf(buf, PAGE_SIZE, "%d\n", current_profile);
+        ret = snprintf(buf, PAGE_SIZE, "%d\n", current_profile);
+out:
+        kfree(data);
+
+        return ret;
 }
 
 static ssize_t k90_store_current_profile(struct device *dev,
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index b9779bcbd140..8aeca038cc73 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -740,6 +740,11 @@ static int wacom_add_shared_data(struct hid_device *hdev)
                 return retval;
         }
 
+        if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH)
+                wacom_wac->shared->touch = hdev;
+        else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN)
+                wacom_wac->shared->pen = hdev;
+
 out:
         mutex_unlock(&wacom_udev_list_lock);
         return retval;
@@ -2036,10 +2041,6 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
         if (error)
                 goto fail;
 
-        error = wacom_add_shared_data(hdev);
-        if (error)
-                goto fail;
-
         /*
          * Bamboo Pad has a generic hid handling for the Pen, and we switch it
          * into debug mode for the touch part.
@@ -2080,10 +2081,9 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
 
         wacom_update_name(wacom, wireless ? " (WL)" : "");
 
-        if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH)
-                wacom_wac->shared->touch = hdev;
-        else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN)
-                wacom_wac->shared->pen = hdev;
+        error = wacom_add_shared_data(hdev);
+        if (error)
+                goto fail;
 
         if (!(features->device_type & WACOM_DEVICETYPE_WL_MONITOR) &&
              (features->quirks & WACOM_QUIRK_BATTERY)) {
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index b1a9a3ca6d56..0884dc9554fd 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2187,6 +2187,16 @@ void wacom_wac_report(struct hid_device *hdev, struct hid_report *report)
 
         wacom_report_events(hdev, report);
 
+        /*
+         * Non-input reports may be sent prior to the device being
+         * completely initialized. Since only their events need
+         * to be processed, exit after 'wacom_report_events' has
+         * been called to prevent potential crashes in the report-
+         * processing functions.
+         */
+        if (report->type != HID_INPUT_REPORT)
+                return;
+
         if (WACOM_PAD_FIELD(field)) {
                 wacom_wac_pad_battery_report(hdev, report);
                 if (wacom->wacom_wac.pad_input)
diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
index b11c3455b040..e6ea8503f40c 100644
--- a/drivers/mmc/core/mmc_ops.c
+++ b/drivers/mmc/core/mmc_ops.c
@@ -506,9 +506,6 @@ static int mmc_poll_for_busy(struct mmc_card *card, unsigned int timeout_ms,
                 }
         } while (busy);
 
-        if (host->ops->card_busy && send_status)
-                return mmc_switch_status(card);
-
         return 0;
 }
 
@@ -577,24 +574,26 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value,
         if (!use_busy_signal)
                 goto out;
 
-        /* Switch to new timing before poll and check switch status. */
-        if (timing)
-                mmc_set_timing(host, timing);
-
         /*If SPI or used HW busy detection above, then we don't need to poll. */
         if (((host->caps & MMC_CAP_WAIT_WHILE_BUSY) && use_r1b_resp) ||
-                mmc_host_is_spi(host)) {
-                if (send_status)
-                        err = mmc_switch_status(card);
+                mmc_host_is_spi(host))
                 goto out_tim;
-        }
 
         /* Let's try to poll to find out when the command is completed. */
         err = mmc_poll_for_busy(card, timeout_ms, send_status, retry_crc_err);
+        if (err)
+                goto out;
 
 out_tim:
-        if (err && timing)
-                mmc_set_timing(host, old_timing);
+        /* Switch to new timing before check switch status. */
+        if (timing)
+                mmc_set_timing(host, timing);
+
+        if (send_status) {
+                err = mmc_switch_status(card);
+                if (err && timing)
+                        mmc_set_timing(host, old_timing);
+        }
 out:
         mmc_retune_release(host);
 
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index b352760c041e..09739352834c 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -578,13 +578,15 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)
 {
         struct meson_host *host = dev_id;
         struct mmc_request *mrq;
-        struct mmc_command *cmd = host->cmd;
+        struct mmc_command *cmd;
         u32 irq_en, status, raw_status;
         irqreturn_t ret = IRQ_HANDLED;
 
         if (WARN_ON(!host))
                 return IRQ_NONE;
 
+        cmd = host->cmd;
+
         mrq = host->mrq;
 
         if (WARN_ON(!mrq))
@@ -670,10 +672,10 @@ static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id)
         int ret = IRQ_HANDLED;
 
         if (WARN_ON(!mrq))
-                ret = IRQ_NONE;
+                return IRQ_NONE;
 
         if (WARN_ON(!cmd))
-                ret = IRQ_NONE;
+                return IRQ_NONE;
 
         data = cmd->data;
         if (data) {
diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
index 44ecebd1ea8c..c8b8ac66ff7e 100644
--- a/drivers/mmc/host/mxs-mmc.c
+++ b/drivers/mmc/host/mxs-mmc.c
@@ -309,6 +309,9 @@ static void mxs_mmc_ac(struct mxs_mmc_host *host)
         cmd0 = BF_SSP(cmd->opcode, CMD0_CMD);
         cmd1 = cmd->arg;
 
+        if (cmd->opcode == MMC_STOP_TRANSMISSION)
+                cmd0 |= BM_SSP_CMD0_APPEND_8CYC;
+
         if (host->sdio_irq_en) {
                 ctrl0 |= BM_SSP_CTRL0_SDIO_IRQ_CHECK;
                 cmd0 |= BM_SSP_CMD0_CONT_CLKING_EN | BM_SSP_CMD0_SLOW_CLKING_EN;
@@ -417,8 +420,7 @@ static void mxs_mmc_adtc(struct mxs_mmc_host *host)
                        ssp->base + HW_SSP_BLOCK_SIZE);
         }
 
-        if ((cmd->opcode == MMC_STOP_TRANSMISSION) ||
-            (cmd->opcode == SD_IO_RW_EXTENDED))
+        if (cmd->opcode == SD_IO_RW_EXTENDED)
                 cmd0 |= BM_SSP_CMD0_APPEND_8CYC;
 
         cmd1 = cmd->arg;
diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
index 160f695cc09c..278a5a435ab7 100644
--- a/drivers/mmc/host/sdhci-acpi.c
+++ b/drivers/mmc/host/sdhci-acpi.c
@@ -395,7 +395,8 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
         /* Power on the SDHCI controller and its children */
         acpi_device_fix_up_power(device);
         list_for_each_entry(child, &device->children, node)
-                acpi_device_fix_up_power(child);
+                if (child->status.present && child->status.enabled)
+                        acpi_device_fix_up_power(child);
 
         if (acpi_bus_get_status(device) || !device->status.present)
                 return -ENODEV;
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 353a9ddf6b97..9ce5dcb4abd0 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -426,6 +426,7 @@ config MTD_NAND_ORION
 
 config MTD_NAND_OXNAS
         tristate "NAND Flash support for Oxford Semiconductor SoC"
+        depends on HAS_IOMEM
         help
           This enables the NAND flash controller on Oxford Semiconductor SoCs.
 
@@ -540,7 +541,7 @@ config MTD_NAND_FSMC
           Flexible Static Memory Controller (FSMC)
 
 config MTD_NAND_XWAY
-        tristate "Support for NAND on Lantiq XWAY SoC"
+        bool "Support for NAND on Lantiq XWAY SoC"
         depends on LANTIQ && SOC_TYPE_XWAY
         help
           Enables support for NAND Flash chips on Lantiq XWAY SoCs. NAND is attached
diff --git a/drivers/mtd/nand/lpc32xx_mlc.c b/drivers/mtd/nand/lpc32xx_mlc.c
index 5553a5d9efd1..846a66c1b133 100644
--- a/drivers/mtd/nand/lpc32xx_mlc.c
+++ b/drivers/mtd/nand/lpc32xx_mlc.c
@@ -775,7 +775,7 @@ static int lpc32xx_nand_probe(struct platform_device *pdev)
         init_completion(&host->comp_controller);
 
         host->irq = platform_get_irq(pdev, 0);
-        if ((host->irq < 0) || (host->irq >= NR_IRQS)) {
+        if (host->irq < 0) {
                 dev_err(&pdev->dev, "failed to get platform irq\n");
                 res = -EINVAL;
                 goto err_exit3;
diff --git a/drivers/mtd/nand/tango_nand.c b/drivers/mtd/nand/tango_nand.c
index 28c7f474be77..4a5e948c62df 100644
--- a/drivers/mtd/nand/tango_nand.c
+++ b/drivers/mtd/nand/tango_nand.c
@@ -632,11 +632,13 @@ static int tango_nand_probe(struct platform_device *pdev)
         if (IS_ERR(nfc->pbus_base))
                 return PTR_ERR(nfc->pbus_base);
 
+        writel_relaxed(MODE_RAW, nfc->pbus_base + PBUS_PAD_MODE);
+
         clk = clk_get(&pdev->dev, NULL);
         if (IS_ERR(clk))
                 return PTR_ERR(clk);
 
-        nfc->chan = dma_request_chan(&pdev->dev, "nfc_sbox");
+        nfc->chan = dma_request_chan(&pdev->dev, "rxtx");
         if (IS_ERR(nfc->chan))
                 return PTR_ERR(nfc->chan);
 
diff --git a/drivers/mtd/nand/xway_nand.c b/drivers/mtd/nand/xway_nand.c
index 1f2948c0c458..895101a5e686 100644
--- a/drivers/mtd/nand/xway_nand.c
+++ b/drivers/mtd/nand/xway_nand.c
@@ -232,7 +232,6 @@ static const struct of_device_id xway_nand_match[] = {
         { .compatible = "lantiq,nand-xway" },
         {},
 };
-MODULE_DEVICE_TABLE(of, xway_nand_match);
 
 static struct platform_driver xway_nand_driver = {
         .probe  = xway_nand_probe,
@@ -243,6 +242,4 @@ static struct platform_driver xway_nand_driver = {
         },
 };
 
-module_platform_driver(xway_nand_driver);
-
-MODULE_LICENSE("GPL");
+builtin_platform_driver(xway_nand_driver);
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 7e8cf213fd81..744ed6ddaf37 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -710,11 +710,8 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
         unsigned int c_index, last_c_index, last_tx_cn, num_tx_cbs;
         unsigned int pkts_compl = 0, bytes_compl = 0;
         struct bcm_sysport_cb *cb;
-        struct netdev_queue *txq;
         u32 hw_ind;
 
-        txq = netdev_get_tx_queue(ndev, ring->index);
-
         /* Compute how many descriptors have been processed since last call */
         hw_ind = tdma_readl(priv, TDMA_DESC_RING_PROD_CONS_INDEX(ring->index));
         c_index = (hw_ind >> RING_CONS_INDEX_SHIFT) & RING_CONS_INDEX_MASK;
@@ -745,9 +742,6 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
 
         ring->c_index = c_index;
 
-        if (netif_tx_queue_stopped(txq) && pkts_compl)
-                netif_tx_wake_queue(txq);
-
         netif_dbg(priv, tx_done, ndev,
                   "ring=%d c_index=%d pkts_compl=%d, bytes_compl=%d\n",
                   ring->index, ring->c_index, pkts_compl, bytes_compl);
@@ -759,16 +753,33 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
 static unsigned int bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
                                            struct bcm_sysport_tx_ring *ring)
 {
+        struct netdev_queue *txq;
         unsigned int released;
         unsigned long flags;
 
+        txq = netdev_get_tx_queue(priv->netdev, ring->index);
+
         spin_lock_irqsave(&ring->lock, flags);
         released = __bcm_sysport_tx_reclaim(priv, ring);
+        if (released)
+                netif_tx_wake_queue(txq);
+
         spin_unlock_irqrestore(&ring->lock, flags);
 
         return released;
 }
 
+/* Locked version of the per-ring TX reclaim, but does not wake the queue */
+static void bcm_sysport_tx_clean(struct bcm_sysport_priv *priv,
+                                 struct bcm_sysport_tx_ring *ring)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&ring->lock, flags);
+        __bcm_sysport_tx_reclaim(priv, ring);
+        spin_unlock_irqrestore(&ring->lock, flags);
+}
+
 static int bcm_sysport_tx_poll(struct napi_struct *napi, int budget)
 {
         struct bcm_sysport_tx_ring *ring =
@@ -1252,7 +1263,7 @@ static void bcm_sysport_fini_tx_ring(struct bcm_sysport_priv *priv,
         napi_disable(&ring->napi);
         netif_napi_del(&ring->napi);
 
-        bcm_sysport_tx_reclaim(priv, ring);
+        bcm_sysport_tx_clean(priv, ring);
 
         kfree(ring->cbs);
         ring->cbs = NULL;
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index 9211c750e064..2f85b64f01fa 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -47,8 +47,9 @@ struct lmac {
 struct bgx {
         u8                      bgx_id;
         struct  lmac            lmac[MAX_LMAC_PER_BGX];
-        int                     lmac_count;
+        u8                      lmac_count;
         u8                      max_lmac;
+        u8                      acpi_lmac_idx;
         void __iomem            *reg_base;
         struct pci_dev          *pdev;
         bool                    is_dlm;
@@ -1143,13 +1144,13 @@ static acpi_status bgx_acpi_register_phy(acpi_handle handle,
         if (acpi_bus_get_device(handle, &adev))
                 goto out;
 
-        acpi_get_mac_address(dev, adev, bgx->lmac[bgx->lmac_count].mac);
+        acpi_get_mac_address(dev, adev, bgx->lmac[bgx->acpi_lmac_idx].mac);
 
-        SET_NETDEV_DEV(&bgx->lmac[bgx->lmac_count].netdev, dev);
+        SET_NETDEV_DEV(&bgx->lmac[bgx->acpi_lmac_idx].netdev, dev);
 
-        bgx->lmac[bgx->lmac_count].lmacid = bgx->lmac_count;
+        bgx->lmac[bgx->acpi_lmac_idx].lmacid = bgx->acpi_lmac_idx;
+        bgx->acpi_lmac_idx++; /* move to next LMAC */
 out:
-        bgx->lmac_count++;
         return AE_OK;
 }
 
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 0e74529a4209..30e855004c57 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1118,7 +1118,7 @@ int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
 err:
         mutex_unlock(&adapter->mcc_lock);
 
-         if (status == MCC_STATUS_UNAUTHORIZED_REQUEST)
+         if (base_status(status) == MCC_STATUS_UNAUTHORIZED_REQUEST)
                 status = -EPERM;
 
         return status;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index ec010ced6c99..1a7f8ad7b9c6 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -318,6 +318,13 @@ static int be_mac_addr_set(struct net_device *netdev, void *p)
         if (ether_addr_equal(addr->sa_data, adapter->dev_mac))
                 return 0;
 
+        /* BE3 VFs without FILTMGMT privilege are not allowed to set its MAC
+         * address
+         */
+        if (BEx_chip(adapter) && be_virtfn(adapter) &&
+            !check_privilege(adapter, BE_PRIV_FILTMGMT))
+                return -EPERM;
+
         /* if device is not running, copy MAC to netdev->dev_addr */
         if (!netif_running(netdev))
                 goto done;
@@ -3609,7 +3616,11 @@ static void be_rx_qs_destroy(struct be_adapter *adapter)
 
 static void be_disable_if_filters(struct be_adapter *adapter)
 {
-        be_dev_mac_del(adapter, adapter->pmac_id[0]);
+        /* Don't delete MAC on BE3 VFs without FILTMGMT privilege  */
+        if (!BEx_chip(adapter) || !be_virtfn(adapter) ||
+            check_privilege(adapter, BE_PRIV_FILTMGMT))
+                be_dev_mac_del(adapter, adapter->pmac_id[0]);
+
         be_clear_uc_list(adapter);
         be_clear_mc_list(adapter);
 
@@ -3762,8 +3773,9 @@ static int be_enable_if_filters(struct be_adapter *adapter)
         if (status)
                 return status;
 
-        /* For BE3 VFs, the PF programs the initial MAC address */
-        if (!(BEx_chip(adapter) && be_virtfn(adapter))) {
+        /* Don't add MAC on BE3 VFs without FILTMGMT privilege */
+        if (!BEx_chip(adapter) || !be_virtfn(adapter) ||
+            check_privilege(adapter, BE_PRIV_FILTMGMT)) {
                 status = be_dev_mac_add(adapter, adapter->netdev->dev_addr);
                 if (status)
                         return status;
diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c
index a849da92f857..6b8635378f1f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cq.c
@@ -101,13 +101,19 @@ void mlx4_cq_completion(struct mlx4_dev *dev, u32 cqn)
 {
         struct mlx4_cq *cq;
 
+        rcu_read_lock();
         cq = radix_tree_lookup(&mlx4_priv(dev)->cq_table.tree,
                                cqn & (dev->caps.num_cqs - 1));
+        rcu_read_unlock();
+
         if (!cq) {
                 mlx4_dbg(dev, "Completion event for bogus CQ %08x\n", cqn);
                 return;
         }
 
+        /* Acessing the CQ outside of rcu_read_lock is safe, because
+         * the CQ is freed only after interrupt handling is completed.
+         */
         ++cq->arm_sn;
 
         cq->comp(cq);
@@ -118,23 +124,19 @@ void mlx4_cq_event(struct mlx4_dev *dev, u32 cqn, int event_type)
         struct mlx4_cq_table *cq_table = &mlx4_priv(dev)->cq_table;
         struct mlx4_cq *cq;
 
-        spin_lock(&cq_table->lock);
-
+        rcu_read_lock();
         cq = radix_tree_lookup(&cq_table->tree, cqn & (dev->caps.num_cqs - 1));
-        if (cq)
-                atomic_inc(&cq->refcount);
-
-        spin_unlock(&cq_table->lock);
+        rcu_read_unlock();
 
         if (!cq) {
-                mlx4_warn(dev, "Async event for bogus CQ %08x\n", cqn);
+                mlx4_dbg(dev, "Async event for bogus CQ %08x\n", cqn);
                 return;
         }
 
+        /* Acessing the CQ outside of rcu_read_lock is safe, because
+         * the CQ is freed only after interrupt handling is completed.
+         */
         cq->event(cq, event_type);
-
-        if (atomic_dec_and_test(&cq->refcount))
-                complete(&cq->free);
 }
 
 static int mlx4_SW2HW_CQ(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *mailbox,
@@ -301,9 +303,9 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent,
         if (err)
                 return err;
 
-        spin_lock_irq(&cq_table->lock);
+        spin_lock(&cq_table->lock);
         err = radix_tree_insert(&cq_table->tree, cq->cqn, cq);
-        spin_unlock_irq(&cq_table->lock);
+        spin_unlock(&cq_table->lock);
         if (err)
                 goto err_icm;
 
@@ -349,9 +351,9 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent,
         return 0;
 
 err_radix:
-        spin_lock_irq(&cq_table->lock);
+        spin_lock(&cq_table->lock);
         radix_tree_delete(&cq_table->tree, cq->cqn);
-        spin_unlock_irq(&cq_table->lock);
+        spin_unlock(&cq_table->lock);
 
 err_icm:
         mlx4_cq_free_icm(dev, cq->cqn);
@@ -370,15 +372,15 @@ void mlx4_cq_free(struct mlx4_dev *dev, struct mlx4_cq *cq)
         if (err)
                 mlx4_warn(dev, "HW2SW_CQ failed (%d) for CQN %06x\n", err, cq->cqn);
 
+        spin_lock(&cq_table->lock);
+        radix_tree_delete(&cq_table->tree, cq->cqn);
+        spin_unlock(&cq_table->lock);
+
         synchronize_irq(priv->eq_table.eq[MLX4_CQ_TO_EQ_VECTOR(cq->vector)].irq);
         if (priv->eq_table.eq[MLX4_CQ_TO_EQ_VECTOR(cq->vector)].irq !=
             priv->eq_table.eq[MLX4_EQ_ASYNC].irq)
                 synchronize_irq(priv->eq_table.eq[MLX4_EQ_ASYNC].irq);
 
-        spin_lock_irq(&cq_table->lock);
-        radix_tree_delete(&cq_table->tree, cq->cqn);
-        spin_unlock_irq(&cq_table->lock);
-
         if (atomic_dec_and_test(&cq->refcount))
                 complete(&cq->free);
         wait_for_completion(&cq->free);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 4910d9af1933..761f8b12399c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1748,8 +1748,11 @@ int mlx4_en_start_port(struct net_device *dev)
         /* Process all completions if exist to prevent
          * the queues freezing if they are full
          */
-        for (i = 0; i < priv->rx_ring_num; i++)
+        for (i = 0; i < priv->rx_ring_num; i++) {
+                local_bh_disable();
                 napi_schedule(&priv->rx_cq[i]->napi);
+                local_bh_enable();
+        }
 
         netif_tx_start_all_queues(dev);
         netif_device_attach(dev);
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index cd3638e6fe25..0509996957d9 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -554,8 +554,9 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq)
                         break;
 
                 case MLX4_EVENT_TYPE_SRQ_LIMIT:
-                        mlx4_dbg(dev, "%s: MLX4_EVENT_TYPE_SRQ_LIMIT\n",
-                                 __func__);
+                        mlx4_dbg(dev, "%s: MLX4_EVENT_TYPE_SRQ_LIMIT. srq_no=0x%x, eq 0x%x\n",
+                                 __func__, be32_to_cpu(eqe->event.srq.srqn),
+                                 eq->eqn);
                 case MLX4_EVENT_TYPE_SRQ_CATAS_ERROR:
                         if (mlx4_is_master(dev)) {
                                 /* forward only to slave owning the SRQ */
@@ -570,15 +571,19 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq)
                                                   eq->eqn, eq->cons_index, ret);
                                         break;
                                 }
-                                mlx4_warn(dev, "%s: slave:%d, srq_no:0x%x, event: %02x(%02x)\n",
-                                          __func__, slave,
-                                          be32_to_cpu(eqe->event.srq.srqn),
-                                          eqe->type, eqe->subtype);
+                                if (eqe->type ==
+                                    MLX4_EVENT_TYPE_SRQ_CATAS_ERROR)
+                                        mlx4_warn(dev, "%s: slave:%d, srq_no:0x%x, event: %02x(%02x)\n",
+                                                  __func__, slave,
+                                                  be32_to_cpu(eqe->event.srq.srqn),
+                                                  eqe->type, eqe->subtype);
 
                                 if (!ret && slave != dev->caps.function) {
-                                        mlx4_warn(dev, "%s: sending event %02x(%02x) to slave:%d\n",
-                                                  __func__, eqe->type,
-                                                  eqe->subtype, slave);
+                                        if (eqe->type ==
+                                            MLX4_EVENT_TYPE_SRQ_CATAS_ERROR)
+                                                mlx4_warn(dev, "%s: sending event %02x(%02x) to slave:%d\n",
+                                                          __func__, eqe->type,
+                                                          eqe->subtype, slave);
                                         mlx4_slave_event(dev, slave, eqe);
                                         break;
                                 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 56185a0b827d..1822382212ee 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -2980,6 +2980,9 @@ int mlx4_RST2INIT_QP_wrapper(struct mlx4_dev *dev, int slave,
                 put_res(dev, slave, srqn, RES_SRQ);
                 qp->srq = srq;
         }
+
+        /* Save param3 for dynamic changes from VST back to VGT */
+        qp->param3 = qpc->param3;
         put_res(dev, slave, rcqn, RES_CQ);
         put_res(dev, slave, mtt_base, RES_MTT);
         res_end_move(dev, slave, RES_QP, qpn);
@@ -3772,7 +3775,6 @@ int mlx4_INIT2RTR_QP_wrapper(struct mlx4_dev *dev, int slave,
         int qpn = vhcr->in_modifier & 0x7fffff;
         struct res_qp *qp;
         u8 orig_sched_queue;
-        __be32  orig_param3 = qpc->param3;
         u8 orig_vlan_control = qpc->pri_path.vlan_control;
         u8 orig_fvl_rx = qpc->pri_path.fvl_rx;
         u8 orig_pri_path_fl = qpc->pri_path.fl;
@@ -3814,7 +3816,6 @@ out:
          */
         if (!err) {
                 qp->sched_queue = orig_sched_queue;
-                qp->param3      = orig_param3;
                 qp->vlan_control = orig_vlan_control;
                 qp->fvl_rx      =  orig_fvl_rx;
                 qp->pri_path_fl = orig_pri_path_fl;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 118cea5e5489..46bef6a26a8c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -668,9 +668,12 @@ static int mlx5e_route_lookup_ipv4(struct mlx5e_priv *priv,
         int ttl;
 
 #if IS_ENABLED(CONFIG_INET)
+        int ret;
+
         rt = ip_route_output_key(dev_net(mirred_dev), fl4);
-        if (IS_ERR(rt))
-                return PTR_ERR(rt);
+        ret = PTR_ERR_OR_ZERO(rt);
+        if (ret)
+                return ret;
 #else
         return -EOPNOTSUPP;
 #endif
@@ -741,8 +744,8 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
         struct flowi4 fl4 = {};
         char *encap_header;
         int encap_size;
-        __be32 saddr = 0;
-        int ttl = 0;
+        __be32 saddr;
+        int ttl;
         int err;
 
         encap_header = kzalloc(max_encap_size, GFP_KERNEL);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
index d147ddd97997..0af3338bfcb4 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
@@ -209,21 +209,21 @@ MLXSW_ITEM32(pci, eqe, owner, 0x0C, 0, 1);
 /* pci_eqe_cmd_token
  * Command completion event - token
  */
-MLXSW_ITEM32(pci, eqe, cmd_token, 0x08, 16, 16);
+MLXSW_ITEM32(pci, eqe, cmd_token, 0x00, 16, 16);
 
 /* pci_eqe_cmd_status
  * Command completion event - status
  */
-MLXSW_ITEM32(pci, eqe, cmd_status, 0x08, 0, 8);
+MLXSW_ITEM32(pci, eqe, cmd_status, 0x00, 0, 8);
 
 /* pci_eqe_cmd_out_param_h
  * Command completion event - output parameter - higher part
  */
-MLXSW_ITEM32(pci, eqe, cmd_out_param_h, 0x0C, 0, 32);
+MLXSW_ITEM32(pci, eqe, cmd_out_param_h, 0x04, 0, 32);
 
 /* pci_eqe_cmd_out_param_l
  * Command completion event - output parameter - lower part
  */
-MLXSW_ITEM32(pci, eqe, cmd_out_param_l, 0x10, 0, 32);
+MLXSW_ITEM32(pci, eqe, cmd_out_param_l, 0x08, 0, 32);
 
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index d768c7b6c6d6..003093abb170 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -684,6 +684,7 @@ static netdev_tx_t mlxsw_sp_port_xmit(struct sk_buff *skb,
                         dev_kfree_skb_any(skb_orig);
                         return NETDEV_TX_OK;
                 }
+                dev_consume_skb_any(skb_orig);
         }
 
         if (eth_skb_pad(skb)) {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
index 150ccf5192a9..2e88115e8735 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
@@ -345,6 +345,7 @@ static netdev_tx_t mlxsw_sx_port_xmit(struct sk_buff *skb,
                         dev_kfree_skb_any(skb_orig);
                         return NETDEV_TX_OK;
                 }
+                dev_consume_skb_any(skb_orig);
         }
         mlxsw_sx_txhdr_construct(skb, &tx_info);
         /* TX header is consumed by HW on the way so we shouldn't count its
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-phy.c b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
index 99a14df28b96..2851b4c56570 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-phy.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
@@ -201,6 +201,13 @@ int emac_phy_config(struct platform_device *pdev, struct emac_adapter *adpt)
                 else
                         adpt->phydev = mdiobus_get_phy(mii_bus, phy_addr);
 
+                /* of_phy_find_device() claims a reference to the phydev,
+                 * so we do that here manually as well. When the driver
+                 * later unloads, it can unilaterally drop the reference
+                 * without worrying about ACPI vs DT.
+                 */
+                if (adpt->phydev)
+                        get_device(&adpt->phydev->mdio.dev);
         } else {
                 struct device_node *phy_np;
 
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 422289c232bc..f46d300bd585 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -719,8 +719,7 @@ static int emac_probe(struct platform_device *pdev)
 err_undo_napi:
         netif_napi_del(&adpt->rx_q.napi);
 err_undo_mdiobus:
-        if (!has_acpi_companion(&pdev->dev))
-                put_device(&adpt->phydev->mdio.dev);
+        put_device(&adpt->phydev->mdio.dev);
         mdiobus_unregister(adpt->mii_bus);
 err_undo_clocks:
         emac_clks_teardown(adpt);
@@ -740,8 +739,7 @@ static int emac_remove(struct platform_device *pdev)
 
         emac_clks_teardown(adpt);
 
-        if (!has_acpi_companion(&pdev->dev))
-                put_device(&adpt->phydev->mdio.dev);
+        put_device(&adpt->phydev->mdio.dev);
         mdiobus_unregister(adpt->mii_bus);
         free_netdev(netdev);
 
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 92d7692c840d..89ac1e3f6175 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -926,14 +926,10 @@ static int ravb_poll(struct napi_struct *napi, int budget)
         /* Receive error message handling */
         priv->rx_over_errors =  priv->stats[RAVB_BE].rx_over_errors;
         priv->rx_over_errors += priv->stats[RAVB_NC].rx_over_errors;
-        if (priv->rx_over_errors != ndev->stats.rx_over_errors) {
+        if (priv->rx_over_errors != ndev->stats.rx_over_errors)
                 ndev->stats.rx_over_errors = priv->rx_over_errors;
-                netif_err(priv, rx_err, ndev, "Receive Descriptor Empty\n");
-        }
-        if (priv->rx_fifo_errors != ndev->stats.rx_fifo_errors) {
+        if (priv->rx_fifo_errors != ndev->stats.rx_fifo_errors)
                 ndev->stats.rx_fifo_errors = priv->rx_fifo_errors;
-                netif_err(priv, rx_err, ndev, "Receive FIFO Overflow\n");
-        }
 out:
         return budget - quota;
 }
@@ -1508,6 +1504,19 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         buffer = PTR_ALIGN(priv->tx_align[q], DPTR_ALIGN) +
                  entry / NUM_TX_DESC * DPTR_ALIGN;
         len = PTR_ALIGN(skb->data, DPTR_ALIGN) - skb->data;
+        /* Zero length DMA descriptors are problematic as they seem to
+         * terminate DMA transfers. Avoid them by simply using a length of
+         * DPTR_ALIGN (4) when skb data is aligned to DPTR_ALIGN.
+         *
+         * As skb is guaranteed to have at least ETH_ZLEN (60) bytes of
+         * data by the call to skb_put_padto() above this is safe with
+         * respect to both the length of the first DMA descriptor (len)
+         * overflowing the available data and the length of the second DMA
+         * descriptor (skb->len - len) being negative.
+         */
+        if (len == 0)
+                len = DPTR_ALIGN;
+
         memcpy(buffer, skb->data, len);
         dma_addr = dma_map_single(ndev->dev.parent, buffer, len, DMA_TO_DEVICE);
         if (dma_mapping_error(ndev->dev.parent, dma_addr))
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index a276a32d57f2..e3f6389e1b01 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3326,9 +3326,9 @@ int stmmac_dvr_probe(struct device *device,
             (priv->plat->maxmtu >= ndev->min_mtu))
                 ndev->max_mtu = priv->plat->maxmtu;
         else if (priv->plat->maxmtu < ndev->min_mtu)
-                netdev_warn(priv->dev,
-                            "%s: warning: maxmtu having invalid value (%d)\n",
-                            __func__, priv->plat->maxmtu);
+                dev_warn(priv->device,
+                         "%s: warning: maxmtu having invalid value (%d)\n",
+                         __func__, priv->plat->maxmtu);
 
         if (flow_ctrl)
                 priv->flow_ctrl = FLOW_AUTO;    /* RX/TX pause on */
@@ -3340,7 +3340,8 @@ int stmmac_dvr_probe(struct device *device,
          */
         if ((priv->synopsys_id >= DWMAC_CORE_3_50) && (!priv->plat->riwt_off)) {
                 priv->use_riwt = 1;
-                netdev_info(priv->dev, "Enable RX Mitigation via HW Watchdog Timer\n");
+                dev_info(priv->device,
+                         "Enable RX Mitigation via HW Watchdog Timer\n");
         }
 
         netif_napi_add(ndev, &priv->napi, stmmac_poll, 64);
@@ -3366,17 +3367,17 @@ int stmmac_dvr_probe(struct device *device,
                 /* MDIO bus Registration */
                 ret = stmmac_mdio_register(ndev);
                 if (ret < 0) {
-                        netdev_err(priv->dev,
-                                   "%s: MDIO bus (id: %d) registration failed",
-                                   __func__, priv->plat->bus_id);
+                        dev_err(priv->device,
+                                "%s: MDIO bus (id: %d) registration failed",
+                                __func__, priv->plat->bus_id);
                         goto error_mdio_register;
                 }
         }
 
         ret = register_netdev(ndev);
         if (ret) {
-                netdev_err(priv->dev, "%s: ERROR %i registering the device\n",
-                           __func__, ret);
+                dev_err(priv->device, "%s: ERROR %i registering the device\n",
+                        __func__, ret);
                 goto error_netdev_register;
         }
 
diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c
index 77c88fcf2b86..9b8a30bf939b 100644
--- a/drivers/net/ethernet/ti/cpmac.c
+++ b/drivers/net/ethernet/ti/cpmac.c
@@ -1210,7 +1210,7 @@ int cpmac_init(void)
                 goto fail_alloc;
         }
 
-#warning FIXME: unhardcode gpio&reset bits
+        /* FIXME: unhardcode gpio&reset bits */
         ar7_gpio_disable(26);
         ar7_gpio_disable(27);
         ar7_device_reset(AR7_RESET_BIT_CPMAC_LO);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index c9414c054852..fcab8019dda0 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -659,6 +659,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
          * policy filters on the host). Deliver these via the VF
          * interface in the guest.
          */
+        rcu_read_lock();
         vf_netdev = rcu_dereference(net_device_ctx->vf_netdev);
         if (vf_netdev && (vf_netdev->flags & IFF_UP))
                 net = vf_netdev;
@@ -667,6 +668,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
         skb = netvsc_alloc_recv_skb(net, packet, csum_info, *data, vlan_tci);
         if (unlikely(!skb)) {
                 ++net->stats.rx_dropped;
+                rcu_read_unlock();
                 return NVSP_STAT_FAIL;
         }
 
@@ -696,6 +698,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
          * TODO - use NAPI?
          */
         netif_rx(skb);
+        rcu_read_unlock();
 
         return 0;
 }
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index 46d53a6c8cf8..76ba7ecfe142 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -1715,9 +1715,9 @@ static int at86rf230_probe(struct spi_device *spi)
         /* Reset */
         if (gpio_is_valid(rstn)) {
                 udelay(1);
-                gpio_set_value(rstn, 0);
+                gpio_set_value_cansleep(rstn, 0);
                 udelay(1);
-                gpio_set_value(rstn, 1);
+                gpio_set_value_cansleep(rstn, 1);
                 usleep_range(120, 240);
         }
 
diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c
index 1253f864737a..ef688518ad77 100644
--- a/drivers/net/ieee802154/atusb.c
+++ b/drivers/net/ieee802154/atusb.c
@@ -117,13 +117,26 @@ static int atusb_read_reg(struct atusb *atusb, uint8_t reg)
 {
         struct usb_device *usb_dev = atusb->usb_dev;
         int ret;
+        uint8_t *buffer;
         uint8_t value;
 
+        buffer = kmalloc(1, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
+
         dev_dbg(&usb_dev->dev, "atusb: reg = 0x%x\n", reg);
         ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0),
                                 ATUSB_REG_READ, ATUSB_REQ_FROM_DEV,
-                                0, reg, &value, 1, 1000);
-        return ret >= 0 ? value : ret;
+                                0, reg, buffer, 1, 1000);
+
+        if (ret >= 0) {
+                value = buffer[0];
+                kfree(buffer);
+                return value;
+        } else {
+                kfree(buffer);
+                return ret;
+        }
 }
 
 static int atusb_write_subreg(struct atusb *atusb, uint8_t reg, uint8_t mask,
@@ -549,13 +562,6 @@ static int
 atusb_set_frame_retries(struct ieee802154_hw *hw, s8 retries)
 {
         struct atusb *atusb = hw->priv;
-        struct device *dev = &atusb->usb_dev->dev;
-
-        if (atusb->fw_ver_maj == 0 && atusb->fw_ver_min < 3) {
-                dev_info(dev, "Automatic frame retransmission is only available from "
-                        "firmware version 0.3. Please update if you want this feature.");
-                return -EINVAL;
-        }
 
         return atusb_write_subreg(atusb, SR_MAX_FRAME_RETRIES, retries);
 }
@@ -608,9 +614,13 @@ static const struct ieee802154_ops atusb_ops = {
 static int atusb_get_and_show_revision(struct atusb *atusb)
 {
         struct usb_device *usb_dev = atusb->usb_dev;
-        unsigned char buffer[3];
+        unsigned char *buffer;
         int ret;
 
+        buffer = kmalloc(3, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
+
         /* Get a couple of the ATMega Firmware values */
         ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0),
                                 ATUSB_ID, ATUSB_REQ_FROM_DEV, 0, 0,
@@ -631,15 +641,20 @@ static int atusb_get_and_show_revision(struct atusb *atusb)
                 dev_info(&usb_dev->dev, "Please update to version 0.2 or newer");
         }
 
+        kfree(buffer);
         return ret;
 }
 
 static int atusb_get_and_show_build(struct atusb *atusb)
 {
         struct usb_device *usb_dev = atusb->usb_dev;
-        char build[ATUSB_BUILD_SIZE + 1];
+        char *build;
         int ret;
 
+        build = kmalloc(ATUSB_BUILD_SIZE + 1, GFP_KERNEL);
+        if (!build)
+                return -ENOMEM;
+
         ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0),
                                 ATUSB_BUILD, ATUSB_REQ_FROM_DEV, 0, 0,
                                 build, ATUSB_BUILD_SIZE, 1000);
@@ -648,6 +663,7 @@ static int atusb_get_and_show_build(struct atusb *atusb)
                 dev_info(&usb_dev->dev, "Firmware: build %s\n", build);
         }
 
+        kfree(build);
         return ret;
 }
 
@@ -698,7 +714,7 @@ fail:
 static int atusb_set_extended_addr(struct atusb *atusb)
 {
         struct usb_device *usb_dev = atusb->usb_dev;
-        unsigned char buffer[IEEE802154_EXTENDED_ADDR_LEN];
+        unsigned char *buffer;
         __le64 extended_addr;
         u64 addr;
         int ret;
@@ -710,12 +726,20 @@ static int atusb_set_extended_addr(struct atusb *atusb)
                 return 0;
         }
 
+        buffer = kmalloc(IEEE802154_EXTENDED_ADDR_LEN, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
+
         /* Firmware is new enough so we fetch the address from EEPROM */
         ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0),
                                 ATUSB_EUI64_READ, ATUSB_REQ_FROM_DEV, 0, 0,
                                 buffer, IEEE802154_EXTENDED_ADDR_LEN, 1000);
-        if (ret < 0)
-                dev_err(&usb_dev->dev, "failed to fetch extended address\n");
+        if (ret < 0) {
+                dev_err(&usb_dev->dev, "failed to fetch extended address, random address set\n");
+                ieee802154_random_extended_addr(&atusb->hw->phy->perm_extended_addr);
+                kfree(buffer);
+                return ret;
+        }
 
         memcpy(&extended_addr, buffer, IEEE802154_EXTENDED_ADDR_LEN);
         /* Check if read address is not empty and the unicast bit is set correctly */
@@ -729,6 +753,7 @@ static int atusb_set_extended_addr(struct atusb *atusb)
                         &addr);
         }
 
+        kfree(buffer);
         return ret;
 }
 
@@ -770,8 +795,7 @@ static int atusb_probe(struct usb_interface *interface,
 
         hw->parent = &usb_dev->dev;
         hw->flags = IEEE802154_HW_TX_OMIT_CKSUM | IEEE802154_HW_AFILT |
-                    IEEE802154_HW_PROMISCUOUS | IEEE802154_HW_CSMA_PARAMS |
-                    IEEE802154_HW_FRAME_RETRIES;
+                    IEEE802154_HW_PROMISCUOUS | IEEE802154_HW_CSMA_PARAMS;
 
         hw->phy->flags = WPAN_PHY_FLAG_TXPOWER | WPAN_PHY_FLAG_CCA_ED_LEVEL |
                          WPAN_PHY_FLAG_CCA_MODE;
@@ -800,6 +824,9 @@ static int atusb_probe(struct usb_interface *interface,
         atusb_get_and_show_build(atusb);
         atusb_set_extended_addr(atusb);
 
+        if (atusb->fw_ver_maj >= 0 && atusb->fw_ver_min >= 3)
+                hw->flags |= IEEE802154_HW_FRAME_RETRIES;
+
         ret = atusb_get_and_clear_error(atusb);
         if (ret) {
                 dev_err(&atusb->usb_dev->dev,
diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
index e84ae084e259..ca1b462bf7b2 100644
--- a/drivers/net/phy/dp83867.c
+++ b/drivers/net/phy/dp83867.c
@@ -132,12 +132,16 @@ static int dp83867_of_init(struct phy_device *phydev)
 
         ret = of_property_read_u32(of_node, "ti,rx-internal-delay",
                                    &dp83867->rx_id_delay);
-        if (ret)
+        if (ret &&
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID ||
+             phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID))
                 return ret;
 
         ret = of_property_read_u32(of_node, "ti,tx-internal-delay",
                                    &dp83867->tx_id_delay);
-        if (ret)
+        if (ret &&
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID ||
+             phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID))
                 return ret;
 
         return of_property_read_u32(of_node, "ti,fifo-depth",
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index be418563cb18..f3b48ad90865 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -1730,7 +1730,7 @@ static u8 r8152_rx_csum(struct r8152 *tp, struct rx_desc *rx_desc)
         u8 checksum = CHECKSUM_NONE;
         u32 opts2, opts3;
 
-        if (tp->version == RTL_VER_01 || tp->version == RTL_VER_02)
+        if (!(tp->netdev->features & NETIF_F_RXCSUM))
                 goto return_result;
 
         opts2 = le32_to_cpu(rx_desc->opts2);
@@ -4356,6 +4356,11 @@ static int rtl8152_probe(struct usb_interface *intf,
                                 NETIF_F_HIGHDMA | NETIF_F_FRAGLIST |
                                 NETIF_F_IPV6_CSUM | NETIF_F_TSO6;
 
+        if (tp->version == RTL_VER_01) {
+                netdev->features &= ~NETIF_F_RXCSUM;
+                netdev->hw_features &= ~NETIF_F_RXCSUM;
+        }
+
         netdev->ethtool_ops = &ops;
         netif_set_gso_max_size(netdev, RTL_LIMITED_TSO_SIZE);
 
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index bb70dd5723b5..ca7196c40060 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1798,7 +1798,7 @@ static int vxlan_build_skb(struct sk_buff *skb, struct dst_entry *dst,
 static struct rtable *vxlan_get_route(struct vxlan_dev *vxlan, struct net_device *dev,
                                       struct vxlan_sock *sock4,
                                       struct sk_buff *skb, int oif, u8 tos,
-                                      __be32 daddr, __be32 *saddr,
+                                      __be32 daddr, __be32 *saddr, __be16 dport, __be16 sport,
                                       struct dst_cache *dst_cache,
                                       const struct ip_tunnel_info *info)
 {
@@ -1824,6 +1824,8 @@ static struct rtable *vxlan_get_route(struct vxlan_dev *vxlan, struct net_device
         fl4.flowi4_proto = IPPROTO_UDP;
         fl4.daddr = daddr;
         fl4.saddr = *saddr;
+        fl4.fl4_dport = dport;
+        fl4.fl4_sport = sport;
 
         rt = ip_route_output_key(vxlan->net, &fl4);
         if (likely(!IS_ERR(rt))) {
@@ -1851,6 +1853,7 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
                                           __be32 label,
                                           const struct in6_addr *daddr,
                                           struct in6_addr *saddr,
+                                          __be16 dport, __be16 sport,
                                           struct dst_cache *dst_cache,
                                           const struct ip_tunnel_info *info)
 {
@@ -1877,6 +1880,8 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
         fl6.flowlabel = ip6_make_flowinfo(RT_TOS(tos), label);
         fl6.flowi6_mark = skb->mark;
         fl6.flowi6_proto = IPPROTO_UDP;
+        fl6.fl6_dport = dport;
+        fl6.fl6_sport = sport;
 
         err = ipv6_stub->ipv6_dst_lookup(vxlan->net,
                                          sock6->sock->sk,
@@ -2068,6 +2073,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                                      rdst ? rdst->remote_ifindex : 0, tos,
                                      dst->sin.sin_addr.s_addr,
                                      &src->sin.sin_addr.s_addr,
+                                     dst_port, src_port,
                                      dst_cache, info);
                 if (IS_ERR(rt)) {
                         err = PTR_ERR(rt);
@@ -2104,6 +2110,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                                         rdst ? rdst->remote_ifindex : 0, tos,
                                         label, &dst->sin6.sin6_addr,
                                         &src->sin6.sin6_addr,
+                                        dst_port, src_port,
                                         dst_cache, info);
                 if (IS_ERR(ndst)) {
                         err = PTR_ERR(ndst);
@@ -2430,7 +2437,7 @@ static int vxlan_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 
                 rt = vxlan_get_route(vxlan, dev, sock4, skb, 0, info->key.tos,
                                      info->key.u.ipv4.dst,
-                                     &info->key.u.ipv4.src, NULL, info);
+                                     &info->key.u.ipv4.src, dport, sport, NULL, info);
                 if (IS_ERR(rt))
                         return PTR_ERR(rt);
                 ip_rt_put(rt);
@@ -2441,7 +2448,7 @@ static int vxlan_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 
                 ndst = vxlan6_get_route(vxlan, dev, sock6, skb, 0, info->key.tos,
                                         info->key.label, &info->key.u.ipv6.dst,
-                                        &info->key.u.ipv6.src, NULL, info);
+                                        &info->key.u.ipv6.src, dport, sport, NULL, info);
                 if (IS_ERR(ndst))
                         return PTR_ERR(ndst);
                 dst_release(ndst);
diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
index 6307088b375f..a518cb1b59d4 100644
--- a/drivers/nvdimm/namespace_devs.c
+++ b/drivers/nvdimm/namespace_devs.c
@@ -957,6 +957,7 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
 {
         resource_size_t allocated = 0, available = 0;
         struct nd_region *nd_region = to_nd_region(dev->parent);
+        struct nd_namespace_common *ndns = to_ndns(dev);
         struct nd_mapping *nd_mapping;
         struct nvdimm_drvdata *ndd;
         struct nd_label_id label_id;
@@ -964,7 +965,7 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
         u8 *uuid = NULL;
         int rc, i;
 
-        if (dev->driver || to_ndns(dev)->claim)
+        if (dev->driver || ndns->claim)
                 return -EBUSY;
 
         if (is_namespace_pmem(dev)) {
@@ -1034,20 +1035,16 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
 
                 nd_namespace_pmem_set_resource(nd_region, nspm,
                                 val * nd_region->ndr_mappings);
-        } else if (is_namespace_blk(dev)) {
-                struct nd_namespace_blk *nsblk = to_nd_namespace_blk(dev);
-
-                /*
-                 * Try to delete the namespace if we deleted all of its
-                 * allocation, this is not the seed device for the
-                 * region, and it is not actively claimed by a btt
-                 * instance.
-                 */
-                if (val == 0 && nd_region->ns_seed != dev
-                                && !nsblk->common.claim)
-                        nd_device_unregister(dev, ND_ASYNC);
         }
 
+        /*
+         * Try to delete the namespace if we deleted all of its
+         * allocation, this is not the seed device for the region, and
+         * it is not actively claimed by a btt instance.
+         */
+        if (val == 0 && nd_region->ns_seed != dev && !ndns->claim)
+                nd_device_unregister(dev, ND_ASYNC);
+
         return rc;
 }
 
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 7282d7495bf1..5b536be5a12e 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -90,7 +90,9 @@ static int read_pmem(struct page *page, unsigned int off,
 
         rc = memcpy_from_pmem(mem + off, pmem_addr, len);
         kunmap_atomic(mem);
-        return rc;
+        if (rc)
+                return -EIO;
+        return 0;
 }
 
 static int pmem_do_bvec(struct pmem_device *pmem, struct page *page,
diff --git a/drivers/pci/host/pci-xgene-msi.c b/drivers/pci/host/pci-xgene-msi.c
index 1f38d0836751..f1b633bce525 100644
--- a/drivers/pci/host/pci-xgene-msi.c
+++ b/drivers/pci/host/pci-xgene-msi.c
@@ -517,7 +517,7 @@ static int xgene_msi_probe(struct platform_device *pdev)
 
         rc = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "pci/xgene:online",
                                xgene_msi_hwirq_alloc, NULL);
-        if (rc)
+        if (rc < 0)
                 goto err_cpuhp;
         pci_xgene_online = rc;
         rc = cpuhp_setup_state(CPUHP_PCI_XGENE_DEAD, "pci/xgene:dead", NULL,
diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
index bed19994c1e9..af8f6e92e885 100644
--- a/drivers/pci/host/pcie-designware.c
+++ b/drivers/pci/host/pcie-designware.c
@@ -807,11 +807,6 @@ void dw_pcie_setup_rc(struct pcie_port *pp)
 {
         u32 val;
 
-        /* get iATU unroll support */
-        pp->iatu_unroll_enabled = dw_pcie_iatu_unroll_enabled(pp);
-        dev_dbg(pp->dev, "iATU unroll: %s\n",
-                pp->iatu_unroll_enabled ? "enabled" : "disabled");
-
         /* set the number of lanes */
         val = dw_pcie_readl_rc(pp, PCIE_PORT_LINK_CONTROL);
         val &= ~PORT_LINK_MODE_MASK;
@@ -882,6 +877,11 @@ void dw_pcie_setup_rc(struct pcie_port *pp)
          * we should not program the ATU here.
          */
         if (!pp->ops->rd_other_conf) {
+                /* get iATU unroll support */
+                pp->iatu_unroll_enabled = dw_pcie_iatu_unroll_enabled(pp);
+                dev_dbg(pp->dev, "iATU unroll: %s\n",
+                        pp->iatu_unroll_enabled ? "enabled" : "disabled");
+
                 dw_pcie_prog_outbound_atu(pp, PCIE_ATU_REGION_INDEX0,
                                           PCIE_ATU_TYPE_MEM, pp->mem_base,
                                           pp->mem_bus_addr, pp->mem_size);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index e164b5c9f0f0..204960e70333 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1169,6 +1169,7 @@ void set_pcie_port_type(struct pci_dev *pdev)
         pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
         if (!pos)
                 return;
+
         pdev->pcie_cap = pos;
         pci_read_config_word(pdev, pos + PCI_EXP_FLAGS, &reg16);
         pdev->pcie_flags_reg = reg16;
@@ -1176,13 +1177,14 @@ void set_pcie_port_type(struct pci_dev *pdev)
         pdev->pcie_mpss = reg16 & PCI_EXP_DEVCAP_PAYLOAD;
 
         /*
-         * A Root Port is always the upstream end of a Link.  No PCIe
-         * component has two Links.  Two Links are connected by a Switch
-         * that has a Port on each Link and internal logic to connect the
-         * two Ports.
+         * A Root Port or a PCI-to-PCIe bridge is always the upstream end
+         * of a Link.  No PCIe component has two Links.  Two Links are
+         * connected by a Switch that has a Port on each Link and internal
+         * logic to connect the two Ports.
          */
         type = pci_pcie_type(pdev);
-        if (type == PCI_EXP_TYPE_ROOT_PORT)
+        if (type == PCI_EXP_TYPE_ROOT_PORT ||
+            type == PCI_EXP_TYPE_PCIE_BRIDGE)
                 pdev->has_secondary_link = 1;
         else if (type == PCI_EXP_TYPE_UPSTREAM ||
                  type == PCI_EXP_TYPE_DOWNSTREAM) {
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index 639ed4e6afd1..070c4da95f48 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -145,6 +145,7 @@ static struct airq_info *airq_areas[MAX_AIRQ_AREAS];
 #define CCW_CMD_WRITE_CONF 0x21
 #define CCW_CMD_WRITE_STATUS 0x31
 #define CCW_CMD_READ_VQ_CONF 0x32
+#define CCW_CMD_READ_STATUS 0x72
 #define CCW_CMD_SET_IND_ADAPTER 0x73
 #define CCW_CMD_SET_VIRTIO_REV 0x83
 
@@ -160,6 +161,7 @@ static struct airq_info *airq_areas[MAX_AIRQ_AREAS];
 #define VIRTIO_CCW_DOING_SET_CONF_IND 0x04000000
 #define VIRTIO_CCW_DOING_SET_IND_ADAPTER 0x08000000
 #define VIRTIO_CCW_DOING_SET_VIRTIO_REV 0x10000000
+#define VIRTIO_CCW_DOING_READ_STATUS 0x20000000
 #define VIRTIO_CCW_INTPARM_MASK 0xffff0000
 
 static struct virtio_ccw_device *to_vc_device(struct virtio_device *vdev)
@@ -452,7 +454,7 @@ static void virtio_ccw_del_vq(struct virtqueue *vq, struct ccw1 *ccw)
          * This may happen on device detach.
          */
         if (ret && (ret != -ENODEV))
-                dev_warn(&vq->vdev->dev, "Error %d while deleting queue %d",
+                dev_warn(&vq->vdev->dev, "Error %d while deleting queue %d\n",
                          ret, index);
 
         vring_del_virtqueue(vq);
@@ -892,6 +894,28 @@ out_free:
 static u8 virtio_ccw_get_status(struct virtio_device *vdev)
 {
         struct virtio_ccw_device *vcdev = to_vc_device(vdev);
+        u8 old_status = *vcdev->status;
+        struct ccw1 *ccw;
+
+        if (vcdev->revision < 1)
+                return *vcdev->status;
+
+        ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+        if (!ccw)
+                return old_status;
+
+        ccw->cmd_code = CCW_CMD_READ_STATUS;
+        ccw->flags = 0;
+        ccw->count = sizeof(*vcdev->status);
+        ccw->cda = (__u32)(unsigned long)vcdev->status;
+        ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_READ_STATUS);
+/*
+ * If the channel program failed (should only happen if the device
+ * was hotunplugged, and then we clean up via the machine check
+ * handler anyway), vcdev->status was not overwritten and we just
+ * return the old status, which is fine.
+*/
+        kfree(ccw);
 
         return *vcdev->status;
 }
@@ -920,7 +944,7 @@ static void virtio_ccw_set_status(struct virtio_device *vdev, u8 status)
         kfree(ccw);
 }
 
-static struct virtio_config_ops virtio_ccw_config_ops = {
+static const struct virtio_config_ops virtio_ccw_config_ops = {
         .get_features = virtio_ccw_get_features,
         .finalize_features = virtio_ccw_finalize_features,
         .get = virtio_ccw_get_config,
@@ -987,6 +1011,7 @@ static void virtio_ccw_check_activity(struct virtio_ccw_device *vcdev,
                 case VIRTIO_CCW_DOING_READ_CONFIG:
                 case VIRTIO_CCW_DOING_WRITE_CONFIG:
                 case VIRTIO_CCW_DOING_WRITE_STATUS:
+                case VIRTIO_CCW_DOING_READ_STATUS:
                 case VIRTIO_CCW_DOING_SET_VQ:
                 case VIRTIO_CCW_DOING_SET_IND:
                 case VIRTIO_CCW_DOING_SET_CONF_IND:
diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c
index a9a00169ad91..b2e8c0dfc79c 100644
--- a/drivers/scsi/bfa/bfad_bsg.c
+++ b/drivers/scsi/bfa/bfad_bsg.c
@@ -3363,7 +3363,7 @@ bfad_im_bsg_els_ct_request(struct bsg_job *job)
         struct bfad_fcxp    *drv_fcxp;
         struct bfa_fcs_lport_s *fcs_port;
         struct bfa_fcs_rport_s *fcs_rport;
-        struct fc_bsg_request *bsg_request = bsg_request;
+        struct fc_bsg_request *bsg_request = job->request;
         struct fc_bsg_reply *bsg_reply = job->reply;
         uint32_t command_type = bsg_request->msgcode;
         unsigned long flags;
diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
index 8fb5c54c7dd3..99b747cedbeb 100644
--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
@@ -46,6 +46,7 @@
 
 #define INITIAL_SRP_LIMIT       800
 #define DEFAULT_MAX_SECTORS     256
+#define MAX_TXU                 1024 * 1024
 
 static uint max_vdma_size = MAX_H_COPY_RDMA;
 
@@ -1391,7 +1392,7 @@ static long ibmvscsis_adapter_info(struct scsi_info *vscsi,
         }
 
         info = dma_alloc_coherent(&vscsi->dma_dev->dev, sizeof(*info), &token,
-                                  GFP_KERNEL);
+                                  GFP_ATOMIC);
         if (!info) {
                 dev_err(&vscsi->dev, "bad dma_alloc_coherent %p\n",
                         iue->target);
@@ -1443,7 +1444,7 @@ static long ibmvscsis_adapter_info(struct scsi_info *vscsi,
         info->mad_version = cpu_to_be32(MAD_VERSION_1);
         info->os_type = cpu_to_be32(LINUX);
         memset(&info->port_max_txu[0], 0, sizeof(info->port_max_txu));
-        info->port_max_txu[0] = cpu_to_be32(128 * PAGE_SIZE);
+        info->port_max_txu[0] = cpu_to_be32(MAX_TXU);
 
         dma_wmb();
         rc = h_copy_rdma(sizeof(*info), vscsi->dds.window[LOCAL].liobn,
@@ -1509,7 +1510,7 @@ static int ibmvscsis_cap_mad(struct scsi_info *vscsi, struct iu_entry *iue)
         }
 
         cap = dma_alloc_coherent(&vscsi->dma_dev->dev, olen, &token,
-                                 GFP_KERNEL);
+                                 GFP_ATOMIC);
         if (!cap) {
                 dev_err(&vscsi->dev, "bad dma_alloc_coherent %p\n",
                         iue->target);
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 236e4e51d161..7b6bd8ed0d0b 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -3590,12 +3590,14 @@ lpfc_els_free_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *elsiocb)
                 } else {
                         buf_ptr1 = (struct lpfc_dmabuf *) elsiocb->context2;
                         lpfc_els_free_data(phba, buf_ptr1);
+                        elsiocb->context2 = NULL;
                 }
         }
 
         if (elsiocb->context3) {
                 buf_ptr = (struct lpfc_dmabuf *) elsiocb->context3;
                 lpfc_els_free_bpl(phba, buf_ptr);
+                elsiocb->context3 = NULL;
         }
         lpfc_sli_release_iocbq(phba, elsiocb);
         return 0;
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 4faa7672fc1d..a78a3df68f67 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -5954,18 +5954,25 @@ lpfc_sli4_alloc_resource_identifiers(struct lpfc_hba *phba)
 
  free_vfi_bmask:
         kfree(phba->sli4_hba.vfi_bmask);
+        phba->sli4_hba.vfi_bmask = NULL;
  free_xri_ids:
         kfree(phba->sli4_hba.xri_ids);
+        phba->sli4_hba.xri_ids = NULL;
  free_xri_bmask:
         kfree(phba->sli4_hba.xri_bmask);
+        phba->sli4_hba.xri_bmask = NULL;
  free_vpi_ids:
         kfree(phba->vpi_ids);
+        phba->vpi_ids = NULL;
  free_vpi_bmask:
         kfree(phba->vpi_bmask);
+        phba->vpi_bmask = NULL;
  free_rpi_ids:
         kfree(phba->sli4_hba.rpi_ids);
+        phba->sli4_hba.rpi_ids = NULL;
  free_rpi_bmask:
         kfree(phba->sli4_hba.rpi_bmask);
+        phba->sli4_hba.rpi_bmask = NULL;
  err_exit:
         return rc;
 }
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h
index 394fe1338d09..dcb33f4fa687 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.h
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.h
@@ -393,6 +393,7 @@ struct MPT3SAS_TARGET {
  * @eedp_enable: eedp support enable bit
  * @eedp_type: 0(type_1), 1(type_2), 2(type_3)
  * @eedp_block_length: block size
+ * @ata_command_pending: SATL passthrough outstanding for device
  */
 struct MPT3SAS_DEVICE {
         struct MPT3SAS_TARGET *sas_target;
@@ -404,6 +405,17 @@ struct MPT3SAS_DEVICE {
         u8      ignore_delay_remove;
         /* Iopriority Command Handling */
         u8      ncq_prio_enable;
+        /*
+         * Bug workaround for SATL handling: the mpt2/3sas firmware
+         * doesn't return BUSY or TASK_SET_FULL for subsequent
+         * commands while a SATL pass through is in operation as the
+         * spec requires, it simply does nothing with them until the
+         * pass through completes, causing them possibly to timeout if
+         * the passthrough is a long executing command (like format or
+         * secure erase).  This variable allows us to do the right
+         * thing while a SATL command is pending.
+         */
+        unsigned long ata_command_pending;
 
 };
 
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index b5c966e319d3..75f3fce1c867 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -3899,9 +3899,18 @@ _scsih_temp_threshold_events(struct MPT3SAS_ADAPTER *ioc,
         }
 }
 
-static inline bool ata_12_16_cmd(struct scsi_cmnd *scmd)
+static int _scsih_set_satl_pending(struct scsi_cmnd *scmd, bool pending)
 {
-        return (scmd->cmnd[0] == ATA_12 || scmd->cmnd[0] == ATA_16);
+        struct MPT3SAS_DEVICE *priv = scmd->device->hostdata;
+
+        if (scmd->cmnd[0] != ATA_12 && scmd->cmnd[0] != ATA_16)
+                return 0;
+
+        if (pending)
+                return test_and_set_bit(0, &priv->ata_command_pending);
+
+        clear_bit(0, &priv->ata_command_pending);
+        return 0;
 }
 
 /**
@@ -3925,9 +3934,7 @@ _scsih_flush_running_cmds(struct MPT3SAS_ADAPTER *ioc)
                 if (!scmd)
                         continue;
                 count++;
-                if (ata_12_16_cmd(scmd))
-                        scsi_internal_device_unblock(scmd->device,
-                                                        SDEV_RUNNING);
+                _scsih_set_satl_pending(scmd, false);
                 mpt3sas_base_free_smid(ioc, smid);
                 scsi_dma_unmap(scmd);
                 if (ioc->pci_error_recovery)
@@ -4063,13 +4070,6 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
         if (ioc->logging_level & MPT_DEBUG_SCSI)
                 scsi_print_command(scmd);
 
-        /*
-         * Lock the device for any subsequent command until command is
-         * done.
-         */
-        if (ata_12_16_cmd(scmd))
-                scsi_internal_device_block(scmd->device);
-
         sas_device_priv_data = scmd->device->hostdata;
         if (!sas_device_priv_data || !sas_device_priv_data->sas_target) {
                 scmd->result = DID_NO_CONNECT << 16;
@@ -4083,6 +4083,19 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
                 return 0;
         }
 
+        /*
+         * Bug work around for firmware SATL handling.  The loop
+         * is based on atomic operations and ensures consistency
+         * since we're lockless at this point
+         */
+        do {
+                if (test_bit(0, &sas_device_priv_data->ata_command_pending)) {
+                        scmd->result = SAM_STAT_BUSY;
+                        scmd->scsi_done(scmd);
+                        return 0;
+                }
+        } while (_scsih_set_satl_pending(scmd, true));
+
         sas_target_priv_data = sas_device_priv_data->sas_target;
 
         /* invalid device handle */
@@ -4650,8 +4663,7 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
         if (scmd == NULL)
                 return 1;
 
-        if (ata_12_16_cmd(scmd))
-                scsi_internal_device_unblock(scmd->device, SDEV_RUNNING);
+        _scsih_set_satl_pending(scmd, false);
 
         mpi_request = mpt3sas_base_get_msg_frame(ioc, smid);
 
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 47eb4d545d13..f201f4099620 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -243,12 +243,15 @@ qla2x00_sysfs_read_optrom(struct file *filp, struct kobject *kobj,
         struct qla_hw_data *ha = vha->hw;
         ssize_t rval = 0;
 
+        mutex_lock(&ha->optrom_mutex);
+
         if (ha->optrom_state != QLA_SREADING)
-                return 0;
+                goto out;
 
-        mutex_lock(&ha->optrom_mutex);
         rval = memory_read_from_buffer(buf, count, &off, ha->optrom_buffer,
             ha->optrom_region_size);
+
+out:
         mutex_unlock(&ha->optrom_mutex);
 
         return rval;
@@ -263,14 +266,19 @@ qla2x00_sysfs_write_optrom(struct file *filp, struct kobject *kobj,
             struct device, kobj)));
         struct qla_hw_data *ha = vha->hw;
 
-        if (ha->optrom_state != QLA_SWRITING)
+        mutex_lock(&ha->optrom_mutex);
+
+        if (ha->optrom_state != QLA_SWRITING) {
+                mutex_unlock(&ha->optrom_mutex);
                 return -EINVAL;
-        if (off > ha->optrom_region_size)
+        }
+        if (off > ha->optrom_region_size) {
+                mutex_unlock(&ha->optrom_mutex);
                 return -ERANGE;
+        }
         if (off + count > ha->optrom_region_size)
                 count = ha->optrom_region_size - off;
 
-        mutex_lock(&ha->optrom_mutex);
         memcpy(&ha->optrom_buffer[off], buf, count);
         mutex_unlock(&ha->optrom_mutex);
 
@@ -753,7 +761,6 @@ qla2x00_issue_logo(struct file *filp, struct kobject *kobj,
         struct scsi_qla_host *vha = shost_priv(dev_to_shost(container_of(kobj,
             struct device, kobj)));
         int type;
-        int rval = 0;
         port_id_t did;
 
         type = simple_strtol(buf, NULL, 10);
@@ -767,7 +774,7 @@ qla2x00_issue_logo(struct file *filp, struct kobject *kobj,
 
         ql_log(ql_log_info, vha, 0x70e4, "%s: %d\n", __func__, type);
 
-        rval = qla24xx_els_dcmd_iocb(vha, ELS_DCMD_LOGO, did);
+        qla24xx_els_dcmd_iocb(vha, ELS_DCMD_LOGO, did);
         return count;
 }
 
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index f7df01b76714..5b1287a63c49 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -1556,7 +1556,8 @@ typedef struct {
 struct atio {
         uint8_t         entry_type;             /* Entry type. */
         uint8_t         entry_count;            /* Entry count. */
-        uint8_t         data[58];
+        __le16          attr_n_length;
+        uint8_t         data[56];
         uint32_t        signature;
 #define ATIO_PROCESSED 0xDEADDEAD               /* Signature */
 };
@@ -2732,7 +2733,7 @@ struct isp_operations {
 #define QLA_MSIX_FW_MODE(m)     (((m) & (BIT_7|BIT_8|BIT_9)) >> 7)
 #define QLA_MSIX_FW_MODE_1(m)   (QLA_MSIX_FW_MODE(m) == 1)
 
-#define QLA_MSIX_DEFAULT                0x00
+#define QLA_BASE_VECTORS        2 /* default + RSP */
 #define QLA_MSIX_RSP_Q                  0x01
 #define QLA_ATIO_VECTOR         0x02
 #define QLA_MSIX_QPAIR_MULTIQ_RSP_Q     0x03
@@ -2754,7 +2755,6 @@ struct qla_msix_entry {
         uint16_t entry;
         char name[30];
         void *handle;
-        struct irq_affinity_notify irq_notify;
         int cpuid;
 };
 
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 632d5f30386a..7b6317c8c2e9 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1191,7 +1191,7 @@ qla24xx_reset_risc(scsi_qla_host_t *vha)
 
         /* Wait for soft-reset to complete. */
         RD_REG_DWORD(&reg->ctrl_status);
-        for (cnt = 0; cnt < 6000000; cnt++) {
+        for (cnt = 0; cnt < 60; cnt++) {
                 barrier();
                 if ((RD_REG_DWORD(&reg->ctrl_status) &
                     CSRX_ISP_SOFT_RESET) == 0)
@@ -1234,7 +1234,7 @@ qla24xx_reset_risc(scsi_qla_host_t *vha)
         RD_REG_DWORD(&reg->hccr);
 
         RD_REG_WORD(&reg->mailbox0);
-        for (cnt = 6000000; RD_REG_WORD(&reg->mailbox0) != 0 &&
+        for (cnt = 60; RD_REG_WORD(&reg->mailbox0) != 0 &&
             rval == QLA_SUCCESS; cnt--) {
                 barrier();
                 if (cnt)
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 5093ca9b02ec..dc88a09f9043 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -19,10 +19,6 @@ static void qla2x00_status_entry(scsi_qla_host_t *, struct rsp_que *, void *);
 static void qla2x00_status_cont_entry(struct rsp_que *, sts_cont_entry_t *);
 static void qla2x00_error_entry(scsi_qla_host_t *, struct rsp_que *,
         sts_entry_t *);
-static void qla_irq_affinity_notify(struct irq_affinity_notify *,
-    const cpumask_t *);
-static void qla_irq_affinity_release(struct kref *);
-
 
 /**
  * qla2100_intr_handler() - Process interrupts for the ISP2100 and ISP2200.
@@ -2496,6 +2492,10 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
         if (pkt->entry_status & RF_BUSY)
                 res = DID_BUS_BUSY << 16;
 
+        if (pkt->entry_type == NOTIFY_ACK_TYPE &&
+            pkt->handle == QLA_TGT_SKIP_HANDLE)
+                return;
+
         sp = qla2x00_get_sp_from_handle(vha, func, req, pkt);
         if (sp) {
                 sp->done(ha, sp, res);
@@ -2572,14 +2572,6 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,
         if (!vha->flags.online)
                 return;
 
-        if (rsp->msix && rsp->msix->cpuid != smp_processor_id()) {
-                /* if kernel does not notify qla of IRQ's CPU change,
-                 * then set it here.
-                 */
-                rsp->msix->cpuid = smp_processor_id();
-                ha->tgt.rspq_vector_cpuid = rsp->msix->cpuid;
-        }
-
         while (rsp->ring_ptr->signature != RESPONSE_PROCESSED) {
                 pkt = (struct sts_entry_24xx *)rsp->ring_ptr;
 
@@ -3018,13 +3010,20 @@ static struct qla_init_msix_entry qla82xx_msix_entries[] = {
 static int
 qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
 {
-#define MIN_MSIX_COUNT  2
         int i, ret;
         struct qla_msix_entry *qentry;
         scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev);
+        struct irq_affinity desc = {
+                .pre_vectors = QLA_BASE_VECTORS,
+        };
+
+        if (QLA_TGT_MODE_ENABLED() && IS_ATIO_MSIX_CAPABLE(ha))
+                desc.pre_vectors++;
+
+        ret = pci_alloc_irq_vectors_affinity(ha->pdev, QLA_BASE_VECTORS,
+                        ha->msix_count, PCI_IRQ_MSIX | PCI_IRQ_AFFINITY,
+                        &desc);
 
-        ret = pci_alloc_irq_vectors(ha->pdev, MIN_MSIX_COUNT, ha->msix_count,
-                                    PCI_IRQ_MSIX | PCI_IRQ_AFFINITY);
         if (ret < 0) {
                 ql_log(ql_log_fatal, vha, 0x00c7,
                     "MSI-X: Failed to enable support, "
@@ -3069,13 +3068,10 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
                 qentry->have_irq = 0;
                 qentry->in_use = 0;
                 qentry->handle = NULL;
-                qentry->irq_notify.notify  = qla_irq_affinity_notify;
-                qentry->irq_notify.release = qla_irq_affinity_release;
-                qentry->cpuid = -1;
         }
 
         /* Enable MSI-X vectors for the base queue */
-        for (i = 0; i < (QLA_MSIX_RSP_Q + 1); i++) {
+        for (i = 0; i < QLA_BASE_VECTORS; i++) {
                 qentry = &ha->msix_entries[i];
                 qentry->handle = rsp;
                 rsp->msix = qentry;
@@ -3093,18 +3089,6 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
                         goto msix_register_fail;
                 qentry->have_irq = 1;
                 qentry->in_use = 1;
-
-                /* Register for CPU affinity notification. */
-                irq_set_affinity_notifier(qentry->vector, &qentry->irq_notify);
-
-                /* Schedule work (ie. trigger a notification) to read cpu
-                 * mask for this specific irq.
-                 * kref_get is required because
-                * irq_affinity_notify() will do
-                * kref_put().
-                */
-                kref_get(&qentry->irq_notify.kref);
-                schedule_work(&qentry->irq_notify.work);
         }
 
         /*
@@ -3301,49 +3285,3 @@ int qla25xx_request_irq(struct qla_hw_data *ha, struct qla_qpair *qpair,
         msix->handle = qpair;
         return ret;
 }
-
-
-/* irq_set_affinity/irqbalance will trigger notification of cpu mask update */
-static void qla_irq_affinity_notify(struct irq_affinity_notify *notify,
-        const cpumask_t *mask)
-{
-        struct qla_msix_entry *e =
-                container_of(notify, struct qla_msix_entry, irq_notify);
-        struct qla_hw_data *ha;
-        struct scsi_qla_host *base_vha;
-        struct rsp_que *rsp = e->handle;
-
-        /* user is recommended to set mask to just 1 cpu */
-        e->cpuid = cpumask_first(mask);
-
-        ha = rsp->hw;
-        base_vha = pci_get_drvdata(ha->pdev);
-
-        ql_dbg(ql_dbg_init, base_vha, 0xffff,
-            "%s: host %ld : vector %d cpu %d \n", __func__,
-            base_vha->host_no, e->vector, e->cpuid);
-
-        if (e->have_irq) {
-                if ((IS_QLA83XX(ha) || IS_QLA27XX(ha)) &&
-                    (e->entry == QLA83XX_RSPQ_MSIX_ENTRY_NUMBER)) {
-                        ha->tgt.rspq_vector_cpuid = e->cpuid;
-                        ql_dbg(ql_dbg_init, base_vha, 0xffff,
-                            "%s: host%ld: rspq vector %d cpu %d  runtime change\n",
-                            __func__, base_vha->host_no, e->vector, e->cpuid);
-                }
-        }
-}
-
-static void qla_irq_affinity_release(struct kref *ref)
-{
-        struct irq_affinity_notify *notify =
-                container_of(ref, struct irq_affinity_notify, kref);
-        struct qla_msix_entry *e =
-                container_of(notify, struct qla_msix_entry, irq_notify);
-        struct rsp_que *rsp = e->handle;
-        struct scsi_qla_host *base_vha = pci_get_drvdata(rsp->hw->pdev);
-
-        ql_dbg(ql_dbg_init, base_vha, 0xffff,
-                "%s: host%ld: vector %d cpu %d\n", __func__,
-            base_vha->host_no, e->vector, e->cpuid);
-}
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 2819ceb96041..67f64db390b0 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -10,7 +10,7 @@
 #include <linux/delay.h>
 #include <linux/gfp.h>
 
-struct rom_cmd {
+static struct rom_cmd {
         uint16_t cmd;
 } rom_cmds[] = {
         { MBC_LOAD_RAM },
@@ -101,12 +101,12 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
                 return QLA_FUNCTION_TIMEOUT;
         }
 
-         /* if PCI error, then avoid mbx processing.*/
-         if (test_bit(PCI_ERR, &base_vha->dpc_flags)) {
+        /* if PCI error, then avoid mbx processing.*/
+        if (test_bit(PCI_ERR, &base_vha->dpc_flags)) {
                 ql_log(ql_log_warn, vha, 0x1191,
                     "PCI error, exiting.\n");
                 return QLA_FUNCTION_TIMEOUT;
-         }
+        }
 
         reg = ha->iobase;
         io_lock_on = base_vha->flags.init_done;
@@ -323,20 +323,33 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
                 }
         } else {
 
-                uint16_t mb0;
-                uint32_t ictrl;
+                uint16_t mb[8];
+                uint32_t ictrl, host_status, hccr;
                 uint16_t        w;
 
                 if (IS_FWI2_CAPABLE(ha)) {
-                        mb0 = RD_REG_WORD(&reg->isp24.mailbox0);
+                        mb[0] = RD_REG_WORD(&reg->isp24.mailbox0);
+                        mb[1] = RD_REG_WORD(&reg->isp24.mailbox1);
+                        mb[2] = RD_REG_WORD(&reg->isp24.mailbox2);
+                        mb[3] = RD_REG_WORD(&reg->isp24.mailbox3);
+                        mb[7] = RD_REG_WORD(&reg->isp24.mailbox7);
                         ictrl = RD_REG_DWORD(&reg->isp24.ictrl);
+                        host_status = RD_REG_DWORD(&reg->isp24.host_status);
+                        hccr = RD_REG_DWORD(&reg->isp24.hccr);
+
+                        ql_log(ql_log_warn, vha, 0x1119,
+                            "MBX Command timeout for cmd %x, iocontrol=%x jiffies=%lx "
+                            "mb[0-3]=[0x%x 0x%x 0x%x 0x%x] mb7 0x%x host_status 0x%x hccr 0x%x\n",
+                            command, ictrl, jiffies, mb[0], mb[1], mb[2], mb[3],
+                            mb[7], host_status, hccr);
+
                 } else {
-                        mb0 = RD_MAILBOX_REG(ha, &reg->isp, 0);
+                        mb[0] = RD_MAILBOX_REG(ha, &reg->isp, 0);
                         ictrl = RD_REG_WORD(&reg->isp.ictrl);
+                        ql_dbg(ql_dbg_mbx + ql_dbg_buffer, vha, 0x1119,
+                            "MBX Command timeout for cmd %x, iocontrol=%x jiffies=%lx "
+                            "mb[0]=0x%x\n", command, ictrl, jiffies, mb[0]);
                 }
-                ql_dbg(ql_dbg_mbx + ql_dbg_buffer, vha, 0x1119,
-                    "MBX Command timeout for cmd %x, iocontrol=%x jiffies=%lx "
-                    "mb[0]=0x%x\n", command, ictrl, jiffies, mb0);
                 ql_dump_regs(ql_dbg_mbx + ql_dbg_buffer, vha, 0x1019);
 
                 /* Capture FW dump only, if PCI device active */
@@ -684,7 +697,6 @@ qla_set_exlogin_mem_cfg(scsi_qla_host_t *vha, dma_addr_t phys_addr)
         mbx_cmd_t       mc;
         mbx_cmd_t       *mcp = &mc;
         struct qla_hw_data *ha = vha->hw;
-        int configured_count;
 
         ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x111a,
             "Entered %s.\n", __func__);
@@ -707,7 +719,6 @@ qla_set_exlogin_mem_cfg(scsi_qla_host_t *vha, dma_addr_t phys_addr)
                 /*EMPTY*/
                 ql_dbg(ql_dbg_mbx, vha, 0x111b, "Failed=%x.\n", rval);
         } else {
-                configured_count = mcp->mb[11];
                 ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x118c,
                     "Done %s.\n", __func__);
         }
diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
index 54380b434b30..0a1723cc08cf 100644
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -42,6 +42,11 @@ static int qla82xx_crb_table_initialized;
         (crb_addr_xform[QLA82XX_HW_PX_MAP_CRB_##name] = \
         QLA82XX_HW_CRB_HUB_AGT_ADR_##name << 20)
 
+const int MD_MIU_TEST_AGT_RDDATA[] = {
+        0x410000A8, 0x410000AC,
+        0x410000B8, 0x410000BC
+};
+
 static void qla82xx_crb_addr_transform_setup(void)
 {
         qla82xx_crb_addr_transform(XDMA);
diff --git a/drivers/scsi/qla2xxx/qla_nx.h b/drivers/scsi/qla2xxx/qla_nx.h
index 6201dce3553b..77624eac95a4 100644
--- a/drivers/scsi/qla2xxx/qla_nx.h
+++ b/drivers/scsi/qla2xxx/qla_nx.h
@@ -1176,8 +1176,7 @@ struct qla82xx_md_entry_queue {
 #define MD_MIU_TEST_AGT_ADDR_LO         0x41000094
 #define MD_MIU_TEST_AGT_ADDR_HI         0x41000098
 
-static const int MD_MIU_TEST_AGT_RDDATA[] = { 0x410000A8, 0x410000AC,
-        0x410000B8, 0x410000BC };
+extern const int MD_MIU_TEST_AGT_RDDATA[4];
 
 #define CRB_NIU_XG_PAUSE_CTL_P0        0x1
 #define CRB_NIU_XG_PAUSE_CTL_P1        0x8
diff --git a/drivers/scsi/qla2xxx/qla_nx2.c b/drivers/scsi/qla2xxx/qla_nx2.c
index 007192d7bad8..dc1ec9b61027 100644
--- a/drivers/scsi/qla2xxx/qla_nx2.c
+++ b/drivers/scsi/qla2xxx/qla_nx2.c
@@ -15,6 +15,23 @@
 
 #define TIMEOUT_100_MS 100
 
+static const uint32_t qla8044_reg_tbl[] = {
+        QLA8044_PEG_HALT_STATUS1,
+        QLA8044_PEG_HALT_STATUS2,
+        QLA8044_PEG_ALIVE_COUNTER,
+        QLA8044_CRB_DRV_ACTIVE,
+        QLA8044_CRB_DEV_STATE,
+        QLA8044_CRB_DRV_STATE,
+        QLA8044_CRB_DRV_SCRATCH,
+        QLA8044_CRB_DEV_PART_INFO1,
+        QLA8044_CRB_IDC_VER_MAJOR,
+        QLA8044_FW_VER_MAJOR,
+        QLA8044_FW_VER_MINOR,
+        QLA8044_FW_VER_SUB,
+        QLA8044_CMDPEG_STATE,
+        QLA8044_ASIC_TEMP,
+};
+
 /* 8044 Flash Read/Write functions */
 uint32_t
 qla8044_rd_reg(struct qla_hw_data *ha, ulong addr)
diff --git a/drivers/scsi/qla2xxx/qla_nx2.h b/drivers/scsi/qla2xxx/qla_nx2.h
index 02fe3c4cdf55..83c1b7e17c80 100644
--- a/drivers/scsi/qla2xxx/qla_nx2.h
+++ b/drivers/scsi/qla2xxx/qla_nx2.h
@@ -535,23 +535,6 @@ enum qla_regs {
 #define CRB_CMDPEG_CHECK_RETRY_COUNT    60
 #define CRB_CMDPEG_CHECK_DELAY          500
 
-static const uint32_t qla8044_reg_tbl[] = {
-        QLA8044_PEG_HALT_STATUS1,
-        QLA8044_PEG_HALT_STATUS2,
-        QLA8044_PEG_ALIVE_COUNTER,
-        QLA8044_CRB_DRV_ACTIVE,
-        QLA8044_CRB_DEV_STATE,
-        QLA8044_CRB_DRV_STATE,
-        QLA8044_CRB_DRV_SCRATCH,
-        QLA8044_CRB_DEV_PART_INFO1,
-        QLA8044_CRB_IDC_VER_MAJOR,
-        QLA8044_FW_VER_MAJOR,
-        QLA8044_FW_VER_MINOR,
-        QLA8044_FW_VER_SUB,
-        QLA8044_CMDPEG_STATE,
-        QLA8044_ASIC_TEMP,
-};
-
 /* MiniDump Structures */
 
 /* Driver_code is for driver to write some info about the entry
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 8521cfe302e9..0a000ecf0881 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -466,7 +466,7 @@ static void qla2x00_free_queues(struct qla_hw_data *ha)
                         continue;
 
                 rsp = ha->rsp_q_map[cnt];
-                clear_bit(cnt, ha->req_qid_map);
+                clear_bit(cnt, ha->rsp_qid_map);
                 ha->rsp_q_map[cnt] =  NULL;
                 spin_unlock_irqrestore(&ha->hardware_lock, flags);
                 qla2x00_free_rsp_que(ha, rsp);
@@ -3662,7 +3662,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
                                 sizeof(struct ct6_dsd), 0,
                                 SLAB_HWCACHE_ALIGN, NULL);
                         if (!ctx_cachep)
-                                goto fail_free_gid_list;
+                                goto fail_free_srb_mempool;
                 }
                 ha->ctx_mempool = mempool_create_slab_pool(SRB_MIN_REQ,
                         ctx_cachep);
@@ -3815,7 +3815,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
         ha->loop_id_map = kzalloc(BITS_TO_LONGS(LOOPID_MAP_SIZE) * sizeof(long),
             GFP_KERNEL);
         if (!ha->loop_id_map)
-                goto fail_async_pd;
+                goto fail_loop_id_map;
         else {
                 qla2x00_set_reserved_loop_ids(ha);
                 ql_dbg_pci(ql_dbg_init, ha->pdev, 0x0123,
@@ -3824,6 +3824,8 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
 
         return 0;
 
+fail_loop_id_map:
+        dma_pool_free(ha->s_dma_pool, ha->async_pd, ha->async_pd_dma);
 fail_async_pd:
         dma_pool_free(ha->s_dma_pool, ha->ex_init_cb, ha->ex_init_cb_dma);
 fail_ex_init_cb:
@@ -3851,6 +3853,10 @@ fail_free_ms_iocb:
         dma_pool_free(ha->s_dma_pool, ha->ms_iocb, ha->ms_iocb_dma);
         ha->ms_iocb = NULL;
         ha->ms_iocb_dma = 0;
+
+        if (ha->sns_cmd)
+                dma_free_coherent(&ha->pdev->dev, sizeof(struct sns_cmd_pkt),
+                    ha->sns_cmd, ha->sns_cmd_dma);
 fail_dma_pool:
         if (IS_QLA82XX(ha) || ql2xenabledif) {
                 dma_pool_destroy(ha->fcp_cmnd_dma_pool);
@@ -3868,10 +3874,12 @@ fail_free_nvram:
         kfree(ha->nvram);
         ha->nvram = NULL;
 fail_free_ctx_mempool:
-        mempool_destroy(ha->ctx_mempool);
+        if (ha->ctx_mempool)
+                mempool_destroy(ha->ctx_mempool);
         ha->ctx_mempool = NULL;
 fail_free_srb_mempool:
-        mempool_destroy(ha->srb_mempool);
+        if (ha->srb_mempool)
+                mempool_destroy(ha->srb_mempool);
         ha->srb_mempool = NULL;
 fail_free_gid_list:
         dma_free_coherent(&ha->pdev->dev, qla2x00_gid_list_size(ha),
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index bff9689f5ca9..e4fda84b959e 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -668,11 +668,9 @@ static int qlt_reset(struct scsi_qla_host *vha, void *iocb, int mcmd)
 {
         struct qla_hw_data *ha = vha->hw;
         struct qla_tgt_sess *sess = NULL;
-        uint32_t unpacked_lun, lun = 0;
         uint16_t loop_id;
         int res = 0;
         struct imm_ntfy_from_isp *n = (struct imm_ntfy_from_isp *)iocb;
-        struct atio_from_isp *a = (struct atio_from_isp *)iocb;
         unsigned long flags;
 
         loop_id = le16_to_cpu(n->u.isp24.nport_handle);
@@ -725,11 +723,7 @@ static int qlt_reset(struct scsi_qla_host *vha, void *iocb, int mcmd)
             "loop_id %d)\n", vha->host_no, sess, sess->port_name,
             mcmd, loop_id);
 
-        lun = a->u.isp24.fcp_cmnd.lun;
-        unpacked_lun = scsilun_to_int((struct scsi_lun *)&lun);
-
-        return qlt_issue_task_mgmt(sess, unpacked_lun, mcmd,
-            iocb, QLA24XX_MGMT_SEND_NACK);
+        return qlt_issue_task_mgmt(sess, 0, mcmd, iocb, QLA24XX_MGMT_SEND_NACK);
 }
 
 /* ha->tgt.sess_lock supposed to be held on entry */
@@ -3067,7 +3061,7 @@ static int __qlt_send_term_imm_notif(struct scsi_qla_host *vha,
 
         pkt->entry_type = NOTIFY_ACK_TYPE;
         pkt->entry_count = 1;
-        pkt->handle = QLA_TGT_SKIP_HANDLE | CTIO_COMPLETION_HANDLE_MARK;
+        pkt->handle = QLA_TGT_SKIP_HANDLE;
 
         nack = (struct nack_to_isp *)pkt;
         nack->ox_id = ntfy->ox_id;
@@ -3110,6 +3104,9 @@ static void qlt_send_term_imm_notif(struct scsi_qla_host *vha,
 #if 0   /* Todo  */
                 if (rc == -ENOMEM)
                         qlt_alloc_qfull_cmd(vha, imm, 0, 0);
+#else
+                if (rc) {
+                }
 #endif
                 goto done;
         }
@@ -6457,12 +6454,29 @@ qlt_24xx_process_atio_queue(struct scsi_qla_host *vha, uint8_t ha_locked)
         if (!vha->flags.online)
                 return;
 
-        while (ha->tgt.atio_ring_ptr->signature != ATIO_PROCESSED) {
+        while ((ha->tgt.atio_ring_ptr->signature != ATIO_PROCESSED) ||
+            fcpcmd_is_corrupted(ha->tgt.atio_ring_ptr)) {
                 pkt = (struct atio_from_isp *)ha->tgt.atio_ring_ptr;
                 cnt = pkt->u.raw.entry_count;
 
-                qlt_24xx_atio_pkt_all_vps(vha, (struct atio_from_isp *)pkt,
-                    ha_locked);
+                if (unlikely(fcpcmd_is_corrupted(ha->tgt.atio_ring_ptr))) {
+                        /*
+                         * This packet is corrupted. The header + payload
+                         * can not be trusted. There is no point in passing
+                         * it further up.
+                         */
+                        ql_log(ql_log_warn, vha, 0xffff,
+                            "corrupted fcp frame SID[%3phN] OXID[%04x] EXCG[%x] %64phN\n",
+                            pkt->u.isp24.fcp_hdr.s_id,
+                            be16_to_cpu(pkt->u.isp24.fcp_hdr.ox_id),
+                            le32_to_cpu(pkt->u.isp24.exchange_addr), pkt);
+
+                        adjust_corrupted_atio(pkt);
+                        qlt_send_term_exchange(vha, NULL, pkt, ha_locked, 0);
+                } else {
+                        qlt_24xx_atio_pkt_all_vps(vha,
+                            (struct atio_from_isp *)pkt, ha_locked);
+                }
 
                 for (i = 0; i < cnt; i++) {
                         ha->tgt.atio_ring_index++;
@@ -6545,6 +6559,13 @@ qlt_24xx_config_nvram_stage1(struct scsi_qla_host *vha, struct nvram_24xx *nv)
 
                 /* Disable Full Login after LIP */
                 nv->host_p &= cpu_to_le32(~BIT_10);
+
+                /*
+                 * clear BIT 15 explicitly as we have seen at least
+                 * a couple of instances where this was set and this
+                 * was causing the firmware to not be initialized.
+                 */
+                nv->firmware_options_1 &= cpu_to_le32(~BIT_15);
                 /* Enable target PRLI control */
                 nv->firmware_options_2 |= cpu_to_le32(BIT_14);
         } else {
@@ -6560,9 +6581,6 @@ qlt_24xx_config_nvram_stage1(struct scsi_qla_host *vha, struct nvram_24xx *nv)
                 return;
         }
 
-        /* out-of-order frames reassembly */
-        nv->firmware_options_3 |= BIT_6|BIT_9;
-
         if (ha->tgt.enable_class_2) {
                 if (vha->flags.init_done)
                         fc_host_supported_classes(vha->host) =
@@ -6629,11 +6647,17 @@ qlt_81xx_config_nvram_stage1(struct scsi_qla_host *vha, struct nvram_81xx *nv)
                 /* Disable ini mode, if requested */
                 if (!qla_ini_mode_enabled(vha))
                         nv->firmware_options_1 |= cpu_to_le32(BIT_5);
-
                 /* Disable Full Login after LIP */
                 nv->firmware_options_1 &= cpu_to_le32(~BIT_13);
                 /* Enable initial LIP */
                 nv->firmware_options_1 &= cpu_to_le32(~BIT_9);
+                /*
+                 * clear BIT 15 explicitly as we have seen at
+                 * least a couple of instances where this was set
+                 * and this was causing the firmware to not be
+                 * initialized.
+                 */
+                nv->firmware_options_1 &= cpu_to_le32(~BIT_15);
                 if (ql2xtgt_tape_enable)
                         /* Enable FC tape support */
                         nv->firmware_options_2 |= cpu_to_le32(BIT_12);
@@ -6658,9 +6682,6 @@ qlt_81xx_config_nvram_stage1(struct scsi_qla_host *vha, struct nvram_81xx *nv)
                 return;
         }
 
-        /* out-of-order frames reassembly */
-        nv->firmware_options_3 |= BIT_6|BIT_9;
-
         if (ha->tgt.enable_class_2) {
                 if (vha->flags.init_done)
                         fc_host_supported_classes(vha->host) =
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index f26c5f60eedd..0824a8164a24 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -427,13 +427,33 @@ struct atio_from_isp {
                 struct {
                         uint8_t  entry_type;    /* Entry type. */
                         uint8_t  entry_count;   /* Entry count. */
-                        uint8_t  data[58];
+                        __le16   attr_n_length;
+#define FCP_CMD_LENGTH_MASK 0x0fff
+#define FCP_CMD_LENGTH_MIN  0x38
+                        uint8_t  data[56];
                         uint32_t signature;
 #define ATIO_PROCESSED 0xDEADDEAD               /* Signature */
                 } raw;
         } u;
 } __packed;
 
+static inline int fcpcmd_is_corrupted(struct atio *atio)
+{
+        if (atio->entry_type == ATIO_TYPE7 &&
+            (le16_to_cpu(atio->attr_n_length & FCP_CMD_LENGTH_MASK) <
+            FCP_CMD_LENGTH_MIN))
+                return 1;
+        else
+                return 0;
+}
+
+/* adjust corrupted atio so we won't trip over the same entry again. */
+static inline void adjust_corrupted_atio(struct atio_from_isp *atio)
+{
+        atio->u.raw.attr_n_length = cpu_to_le16(FCP_CMD_LENGTH_MIN);
+        atio->u.isp24.fcp_cmnd.add_cdb_len = 0;
+}
+
 #define CTIO_TYPE7 0x12 /* Continue target I/O entry (for 24xx) */
 
 /*
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index 36935c9ed669..8a58ef3adab4 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -433,6 +433,18 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
                                 count++;
                         }
                 }
+        } else if (QLA_TGT_MODE_ENABLED() &&
+            ent->t263.queue_type == T263_QUEUE_TYPE_ATIO) {
+                struct qla_hw_data *ha = vha->hw;
+                struct atio *atr = ha->tgt.atio_ring;
+
+                if (atr || !buf) {
+                        length = ha->tgt.atio_q_length;
+                        qla27xx_insert16(0, buf, len);
+                        qla27xx_insert16(length, buf, len);
+                        qla27xx_insertbuf(atr, length * sizeof(*atr), buf, len);
+                        count++;
+                }
         } else {
                 ql_dbg(ql_dbg_misc, vha, 0xd026,
                     "%s: unknown queue %x\n", __func__, ent->t263.queue_type);
@@ -676,6 +688,18 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
                                 count++;
                         }
                 }
+        } else if (QLA_TGT_MODE_ENABLED() &&
+            ent->t274.queue_type == T274_QUEUE_TYPE_ATIO_SHAD) {
+                struct qla_hw_data *ha = vha->hw;
+                struct atio *atr = ha->tgt.atio_ring_ptr;
+
+                if (atr || !buf) {
+                        qla27xx_insert16(0, buf, len);
+                        qla27xx_insert16(1, buf, len);
+                        qla27xx_insert32(ha->tgt.atio_q_in ?
+                            readl(ha->tgt.atio_q_in) : 0, buf, len);
+                        count++;
+                }
         } else {
                 ql_dbg(ql_dbg_misc, vha, 0xd02f,
                     "%s: unknown queue %x\n", __func__, ent->t274.queue_type);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 6643f6fc7795..d925910be761 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -1800,7 +1800,7 @@ static ssize_t tcm_qla2xxx_wwn_version_show(struct config_item *item,
 {
         return sprintf(page,
             "TCM QLOGIC QLA2XXX NPIV capable fabric module %s on %s/%s on "
-            UTS_RELEASE"\n", TCM_QLA2XXX_VERSION, utsname()->sysname,
+            UTS_RELEASE"\n", QLA2XXX_VERSION, utsname()->sysname,
             utsname()->machine);
 }
 
@@ -1906,7 +1906,7 @@ static int tcm_qla2xxx_register_configfs(void)
         int ret;
 
         pr_debug("TCM QLOGIC QLA2XXX fabric module %s on %s/%s on "
-            UTS_RELEASE"\n", TCM_QLA2XXX_VERSION, utsname()->sysname,
+            UTS_RELEASE"\n", QLA2XXX_VERSION, utsname()->sysname,
             utsname()->machine);
 
         ret = target_register_template(&tcm_qla2xxx_ops);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
index 37e026a4823d..cf8430be183b 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
@@ -1,7 +1,6 @@
 #include <target/target_core_base.h>
 #include <linux/btree.h>
 
-#define TCM_QLA2XXX_VERSION     "v0.1"
 /* length of ASCII WWPNs including pad */
 #define TCM_QLA2XXX_NAMELEN     32
 /*
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 1fbb1ecf49f2..0b09638fa39b 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2585,7 +2585,8 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
                 if (sdp->broken_fua) {
                         sd_first_printk(KERN_NOTICE, sdkp, "Disabling FUA\n");
                         sdkp->DPOFUA = 0;
-                } else if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) {
+                } else if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw &&
+                           !sdkp->device->use_16_for_rw) {
                         sd_first_printk(KERN_NOTICE, sdkp,
                                   "Uses READ/WRITE(6), disabling FUA\n");
                         sdkp->DPOFUA = 0;
@@ -2768,13 +2769,21 @@ static void sd_read_block_characteristics(struct scsi_disk *sdkp)
                 queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, q);
         }
 
-        sdkp->zoned = (buffer[8] >> 4) & 3;
-        if (sdkp->zoned == 1)
-                q->limits.zoned = BLK_ZONED_HA;
-        else if (sdkp->device->type == TYPE_ZBC)
+        if (sdkp->device->type == TYPE_ZBC) {
+                /* Host-managed */
                 q->limits.zoned = BLK_ZONED_HM;
-        else
-                q->limits.zoned = BLK_ZONED_NONE;
+        } else {
+                sdkp->zoned = (buffer[8] >> 4) & 3;
+                if (sdkp->zoned == 1)
+                        /* Host-aware */
+                        q->limits.zoned = BLK_ZONED_HA;
+                else
+                        /*
+                         * Treat drive-managed devices as
+                         * regular block devices.
+                         */
+                        q->limits.zoned = BLK_ZONED_NONE;
+        }
         if (blk_queue_is_zoned(q) && sdkp->first_scan)
                 sd_printk(KERN_NOTICE, sdkp, "Host-%s zoned block device\n",
                       q->limits.zoned == BLK_ZONED_HM ? "managed" : "aware");
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 8c9a35c91705..50adabbb5808 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -587,7 +587,7 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,
 
         ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0);
 
-        if (scsi_is_sas_rphy(&sdev->sdev_gendev))
+        if (scsi_is_sas_rphy(sdev->sdev_target->dev.parent))
                 efd.addr = sas_get_address(sdev);
 
         if (efd.addr) {
diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c
index 8823cc81ae45..5bb376009d98 100644
--- a/drivers/soc/ti/wkup_m3_ipc.c
+++ b/drivers/soc/ti/wkup_m3_ipc.c
@@ -459,6 +459,7 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev)
 
         if (IS_ERR(task)) {
                 dev_err(dev, "can't create rproc_boot thread\n");
+                ret = PTR_ERR(task);
                 goto err_put_rproc;
         }
 
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index ec4aa252d6e8..2922a9908302 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -378,6 +378,7 @@ config SPI_FSL_SPI
 config SPI_FSL_DSPI
         tristate "Freescale DSPI controller"
         select REGMAP_MMIO
+        depends on HAS_DMA
         depends on SOC_VF610 || SOC_LS1021A || ARCH_LAYERSCAPE || COMPILE_TEST
         help
           This enables support for the Freescale DSPI controller in master
diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c
index e89da0af45d2..0314c6b9e044 100644
--- a/drivers/spi/spi-armada-3700.c
+++ b/drivers/spi/spi-armada-3700.c
@@ -800,7 +800,7 @@ static int a3700_spi_probe(struct platform_device *pdev)
         struct spi_master *master;
         struct a3700_spi *spi;
         u32 num_cs = 0;
-        int ret = 0;
+        int irq, ret = 0;
 
         master = spi_alloc_master(dev, sizeof(*spi));
         if (!master) {
@@ -825,7 +825,7 @@ static int a3700_spi_probe(struct platform_device *pdev)
         master->unprepare_message = a3700_spi_unprepare_message;
         master->set_cs = a3700_spi_set_cs;
         master->flags = SPI_MASTER_HALF_DUPLEX;
-        master->mode_bits |= (SPI_RX_DUAL | SPI_RX_DUAL |
+        master->mode_bits |= (SPI_RX_DUAL | SPI_TX_DUAL |
                               SPI_RX_QUAD | SPI_TX_QUAD);
 
         platform_set_drvdata(pdev, master);
@@ -846,12 +846,13 @@ static int a3700_spi_probe(struct platform_device *pdev)
                 goto error;
         }
 
-        spi->irq = platform_get_irq(pdev, 0);
-        if (spi->irq < 0) {
-                dev_err(dev, "could not get irq: %d\n", spi->irq);
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(dev, "could not get irq: %d\n", irq);
                 ret = -ENXIO;
                 goto error;
         }
+        spi->irq = irq;
 
         init_completion(&spi->done);
 
diff --git a/drivers/spi/spi-axi-spi-engine.c b/drivers/spi/spi-axi-spi-engine.c
index 319225d7e761..6ab4c7700228 100644
--- a/drivers/spi/spi-axi-spi-engine.c
+++ b/drivers/spi/spi-axi-spi-engine.c
@@ -494,7 +494,8 @@ static int spi_engine_probe(struct platform_device *pdev)
                         SPI_ENGINE_VERSION_MAJOR(version),
                         SPI_ENGINE_VERSION_MINOR(version),
                         SPI_ENGINE_VERSION_PATCH(version));
-                return -ENODEV;
+                ret = -ENODEV;
+                goto err_put_master;
         }
 
         spi_engine->clk = devm_clk_get(&pdev->dev, "s_axi_aclk");
diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index d36c11b73a35..02fb96797ac8 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -646,7 +646,7 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
                         buf = t->rx_buf;
                 t->rx_dma = dma_map_single(&spi->dev, buf,
                                 t->len, DMA_FROM_DEVICE);
-                if (!t->rx_dma) {
+                if (dma_mapping_error(&spi->dev, !t->rx_dma)) {
                         ret = -EFAULT;
                         goto err_rx_map;
                 }
@@ -660,7 +660,7 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
                         buf = (void *)t->tx_buf;
                 t->tx_dma = dma_map_single(&spi->dev, buf,
                                 t->len, DMA_TO_DEVICE);
-                if (!t->tx_dma) {
+                if (dma_mapping_error(&spi->dev, t->tx_dma)) {
                         ret = -EFAULT;
                         goto err_tx_map;
                 }
diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
index e31971f91475..837cb8d0bac6 100644
--- a/drivers/spi/spi-dw-mid.c
+++ b/drivers/spi/spi-dw-mid.c
@@ -274,11 +274,11 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, struct spi_transfer *xfer)
 static void mid_spi_dma_stop(struct dw_spi *dws)
 {
         if (test_bit(TX_BUSY, &dws->dma_chan_busy)) {
-                dmaengine_terminate_all(dws->txchan);
+                dmaengine_terminate_sync(dws->txchan);
                 clear_bit(TX_BUSY, &dws->dma_chan_busy);
         }
         if (test_bit(RX_BUSY, &dws->dma_chan_busy)) {
-                dmaengine_terminate_all(dws->rxchan);
+                dmaengine_terminate_sync(dws->rxchan);
                 clear_bit(RX_BUSY, &dws->dma_chan_busy);
         }
 }
diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
index b715a26a9148..054012f87567 100644
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -107,7 +107,10 @@ static const struct file_operations dw_spi_regs_ops = {
 
 static int dw_spi_debugfs_init(struct dw_spi *dws)
 {
-        dws->debugfs = debugfs_create_dir("dw_spi", NULL);
+        char name[128];
+
+        snprintf(name, 128, "dw_spi-%s", dev_name(&dws->master->dev));
+        dws->debugfs = debugfs_create_dir(name, NULL);
         if (!dws->debugfs)
                 return -ENOMEM;
 
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index dd7b5b47291d..d6239fa718be 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1690,6 +1690,7 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
                 pxa2xx_spi_write(drv_data, SSCR1, tmp);
                 tmp = SSCR0_SCR(2) | SSCR0_Motorola | SSCR0_DataSize(8);
                 pxa2xx_spi_write(drv_data, SSCR0, tmp);
+                break;
         default:
                 tmp = SSCR1_RxTresh(RX_THRESH_DFLT) |
                       SSCR1_TxTresh(TX_THRESH_DFLT);
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index 0012ad02e569..1f00eeb0b5a3 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -973,14 +973,16 @@ static const struct sh_msiof_chipdata r8a779x_data = {
 };
 
 static const struct of_device_id sh_msiof_match[] = {
-        { .compatible = "renesas,sh-msiof",        .data = &sh_data },
         { .compatible = "renesas,sh-mobile-msiof", .data = &sh_data },
         { .compatible = "renesas,msiof-r8a7790",   .data = &r8a779x_data },
         { .compatible = "renesas,msiof-r8a7791",   .data = &r8a779x_data },
         { .compatible = "renesas,msiof-r8a7792",   .data = &r8a779x_data },
         { .compatible = "renesas,msiof-r8a7793",   .data = &r8a779x_data },
         { .compatible = "renesas,msiof-r8a7794",   .data = &r8a779x_data },
+        { .compatible = "renesas,rcar-gen2-msiof", .data = &r8a779x_data },
         { .compatible = "renesas,msiof-r8a7796",   .data = &r8a779x_data },
+        { .compatible = "renesas,rcar-gen3-msiof", .data = &r8a779x_data },
+        { .compatible = "renesas,sh-msiof",        .data = &sh_data }, /* Deprecated */
         {},
 };
 MODULE_DEVICE_TABLE(of, sh_msiof_match);
diff --git a/drivers/thermal/rockchip_thermal.c b/drivers/thermal/rockchip_thermal.c
index b811b0fb61b1..4c7796512453 100644
--- a/drivers/thermal/rockchip_thermal.c
+++ b/drivers/thermal/rockchip_thermal.c
@@ -118,12 +118,12 @@ struct rockchip_tsadc_chip {
         void (*control)(void __iomem *reg, bool on);
 
         /* Per-sensor methods */
-        int (*get_temp)(struct chip_tsadc_table table,
+        int (*get_temp)(const struct chip_tsadc_table *table,
                         int chn, void __iomem *reg, int *temp);
-        void (*set_alarm_temp)(struct chip_tsadc_table table,
-                               int chn, void __iomem *reg, int temp);
-        void (*set_tshut_temp)(struct chip_tsadc_table table,
-                               int chn, void __iomem *reg, int temp);
+        int (*set_alarm_temp)(const struct chip_tsadc_table *table,
+                              int chn, void __iomem *reg, int temp);
+        int (*set_tshut_temp)(const struct chip_tsadc_table *table,
+                              int chn, void __iomem *reg, int temp);
         void (*set_tshut_mode)(int chn, void __iomem *reg, enum tshut_mode m);
 
         /* Per-table methods */
@@ -317,6 +317,7 @@ static const struct tsadc_table rk3288_code_table[] = {
         {3452, 115000},
         {3437, 120000},
         {3421, 125000},
+        {0, 125000},
 };
 
 static const struct tsadc_table rk3368_code_table[] = {
@@ -397,59 +398,80 @@ static const struct tsadc_table rk3399_code_table[] = {
         {TSADCV3_DATA_MASK, 125000},
 };
 
-static u32 rk_tsadcv2_temp_to_code(struct chip_tsadc_table table,
+static u32 rk_tsadcv2_temp_to_code(const struct chip_tsadc_table *table,
                                    int temp)
 {
         int high, low, mid;
-        u32 error = 0;
+        unsigned long num;
+        unsigned int denom;
+        u32 error = table->data_mask;
 
         low = 0;
-        high = table.length - 1;
+        high = (table->length - 1) - 1; /* ignore the last check for table */
         mid = (high + low) / 2;
 
         /* Return mask code data when the temp is over table range */
-        if (temp < table.id[low].temp || temp > table.id[high].temp) {
-                error = table.data_mask;
+        if (temp < table->id[low].temp || temp > table->id[high].temp)
                 goto exit;
-        }
 
         while (low <= high) {
-                if (temp == table.id[mid].temp)
-                        return table.id[mid].code;
-                else if (temp < table.id[mid].temp)
+                if (temp == table->id[mid].temp)
+                        return table->id[mid].code;
+                else if (temp < table->id[mid].temp)
                         high = mid - 1;
                 else
                         low = mid + 1;
                 mid = (low + high) / 2;
         }
 
+        /*
+         * The conversion code granularity provided by the table. Let's
+         * assume that the relationship between temperature and
+         * analog value between 2 table entries is linear and interpolate
+         * to produce less granular result.
+         */
+        num = abs(table->id[mid + 1].code - table->id[mid].code);
+        num *= temp - table->id[mid].temp;
+        denom = table->id[mid + 1].temp - table->id[mid].temp;
+
+        switch (table->mode) {
+        case ADC_DECREMENT:
+                return table->id[mid].code - (num / denom);
+        case ADC_INCREMENT:
+                return table->id[mid].code + (num / denom);
+        default:
+                pr_err("%s: unknown table mode: %d\n", __func__, table->mode);
+                return error;
+        }
+
 exit:
-        pr_err("Invalid the conversion, error=%d\n", error);
+        pr_err("%s: invalid temperature, temp=%d error=%d\n",
+               __func__, temp, error);
         return error;
 }
 
-static int rk_tsadcv2_code_to_temp(struct chip_tsadc_table table, u32 code,
-                                   int *temp)
+static int rk_tsadcv2_code_to_temp(const struct chip_tsadc_table *table,
+                                   u32 code, int *temp)
 {
         unsigned int low = 1;
-        unsigned int high = table.length - 1;
+        unsigned int high = table->length - 1;
         unsigned int mid = (low + high) / 2;
         unsigned int num;
         unsigned long denom;
 
-        WARN_ON(table.length < 2);
+        WARN_ON(table->length < 2);
 
-        switch (table.mode) {
+        switch (table->mode) {
         case ADC_DECREMENT:
-                code &= table.data_mask;
-                if (code < table.id[high].code)
+                code &= table->data_mask;
+                if (code <= table->id[high].code)
                         return -EAGAIN;         /* Incorrect reading */
 
                 while (low <= high) {
-                        if (code >= table.id[mid].code &&
-                            code < table.id[mid - 1].code)
+                        if (code >= table->id[mid].code &&
+                            code < table->id[mid - 1].code)
                                 break;
-                        else if (code < table.id[mid].code)
+                        else if (code < table->id[mid].code)
                                 low = mid + 1;
                         else
                                 high = mid - 1;
@@ -458,15 +480,15 @@ static int rk_tsadcv2_code_to_temp(struct chip_tsadc_table table, u32 code,
                 }
                 break;
         case ADC_INCREMENT:
-                code &= table.data_mask;
-                if (code < table.id[low].code)
+                code &= table->data_mask;
+                if (code < table->id[low].code)
                         return -EAGAIN;         /* Incorrect reading */
 
                 while (low <= high) {
-                        if (code <= table.id[mid].code &&
-                            code > table.id[mid - 1].code)
+                        if (code <= table->id[mid].code &&
+                            code > table->id[mid - 1].code)
                                 break;
-                        else if (code > table.id[mid].code)
+                        else if (code > table->id[mid].code)
                                 low = mid + 1;
                         else
                                 high = mid - 1;
@@ -475,7 +497,8 @@ static int rk_tsadcv2_code_to_temp(struct chip_tsadc_table table, u32 code,
                 }
                 break;
         default:
-                pr_err("Invalid the conversion table\n");
+                pr_err("%s: unknown table mode: %d\n", __func__, table->mode);
+                return -EINVAL;
         }
 
         /*
@@ -484,10 +507,10 @@ static int rk_tsadcv2_code_to_temp(struct chip_tsadc_table table, u32 code,
          * temperature between 2 table entries is linear and interpolate
          * to produce less granular result.
          */
-        num = table.id[mid].temp - table.id[mid - 1].temp;
-        num *= abs(table.id[mid - 1].code - code);
-        denom = abs(table.id[mid - 1].code - table.id[mid].code);
-        *temp = table.id[mid - 1].temp + (num / denom);
+        num = table->id[mid].temp - table->id[mid - 1].temp;
+        num *= abs(table->id[mid - 1].code - code);
+        denom = abs(table->id[mid - 1].code - table->id[mid].code);
+        *temp = table->id[mid - 1].temp + (num / denom);
 
         return 0;
 }
@@ -638,7 +661,7 @@ static void rk_tsadcv3_control(void __iomem *regs, bool enable)
         writel_relaxed(val, regs + TSADCV2_AUTO_CON);
 }
 
-static int rk_tsadcv2_get_temp(struct chip_tsadc_table table,
+static int rk_tsadcv2_get_temp(const struct chip_tsadc_table *table,
                                int chn, void __iomem *regs, int *temp)
 {
         u32 val;
@@ -648,39 +671,57 @@ static int rk_tsadcv2_get_temp(struct chip_tsadc_table table,
         return rk_tsadcv2_code_to_temp(table, val, temp);
 }
 
-static void rk_tsadcv2_alarm_temp(struct chip_tsadc_table table,
-                                  int chn, void __iomem *regs, int temp)
+static int rk_tsadcv2_alarm_temp(const struct chip_tsadc_table *table,
+                                 int chn, void __iomem *regs, int temp)
 {
-        u32 alarm_value, int_en;
+        u32 alarm_value;
+        u32 int_en, int_clr;
+
+        /*
+         * In some cases, some sensors didn't need the trip points, the
+         * set_trips will pass {-INT_MAX, INT_MAX} to trigger tsadc alarm
+         * in the end, ignore this case and disable the high temperature
+         * interrupt.
+         */
+        if (temp == INT_MAX) {
+                int_clr = readl_relaxed(regs + TSADCV2_INT_EN);
+                int_clr &= ~TSADCV2_INT_SRC_EN(chn);
+                writel_relaxed(int_clr, regs + TSADCV2_INT_EN);
+                return 0;
+        }
 
         /* Make sure the value is valid */
         alarm_value = rk_tsadcv2_temp_to_code(table, temp);
-        if (alarm_value == table.data_mask)
-                return;
+        if (alarm_value == table->data_mask)
+                return -ERANGE;
 
-        writel_relaxed(alarm_value & table.data_mask,
+        writel_relaxed(alarm_value & table->data_mask,
                        regs + TSADCV2_COMP_INT(chn));
 
         int_en = readl_relaxed(regs + TSADCV2_INT_EN);
         int_en |= TSADCV2_INT_SRC_EN(chn);
         writel_relaxed(int_en, regs + TSADCV2_INT_EN);
+
+        return 0;
 }
 
-static void rk_tsadcv2_tshut_temp(struct chip_tsadc_table table,
-                                  int chn, void __iomem *regs, int temp)
+static int rk_tsadcv2_tshut_temp(const struct chip_tsadc_table *table,
+                                 int chn, void __iomem *regs, int temp)
 {
         u32 tshut_value, val;
 
         /* Make sure the value is valid */
         tshut_value = rk_tsadcv2_temp_to_code(table, temp);
-        if (tshut_value == table.data_mask)
-                return;
+        if (tshut_value == table->data_mask)
+                return -ERANGE;
 
         writel_relaxed(tshut_value, regs + TSADCV2_COMP_SHUT(chn));
 
         /* TSHUT will be valid */
         val = readl_relaxed(regs + TSADCV2_AUTO_CON);
         writel_relaxed(val | TSADCV2_AUTO_SRC_EN(chn), regs + TSADCV2_AUTO_CON);
+
+        return 0;
 }
 
 static void rk_tsadcv2_tshut_mode(int chn, void __iomem *regs,
@@ -883,10 +924,8 @@ static int rockchip_thermal_set_trips(void *_sensor, int low, int high)
         dev_dbg(&thermal->pdev->dev, "%s: sensor %d: low: %d, high %d\n",
                 __func__, sensor->id, low, high);
 
-        tsadc->set_alarm_temp(tsadc->table,
-                              sensor->id, thermal->regs, high);
-
-        return 0;
+        return tsadc->set_alarm_temp(&tsadc->table,
+                                     sensor->id, thermal->regs, high);
 }
 
 static int rockchip_thermal_get_temp(void *_sensor, int *out_temp)
@@ -896,7 +935,7 @@ static int rockchip_thermal_get_temp(void *_sensor, int *out_temp)
         const struct rockchip_tsadc_chip *tsadc = sensor->thermal->chip;
         int retval;
 
-        retval = tsadc->get_temp(tsadc->table,
+        retval = tsadc->get_temp(&tsadc->table,
                                  sensor->id, thermal->regs, out_temp);
         dev_dbg(&thermal->pdev->dev, "sensor %d - temp: %d, retval: %d\n",
                 sensor->id, *out_temp, retval);
@@ -982,8 +1021,12 @@ rockchip_thermal_register_sensor(struct platform_device *pdev,
         int error;
 
         tsadc->set_tshut_mode(id, thermal->regs, thermal->tshut_mode);
-        tsadc->set_tshut_temp(tsadc->table, id, thermal->regs,
+
+        error = tsadc->set_tshut_temp(&tsadc->table, id, thermal->regs,
                               thermal->tshut_temp);
+        if (error)
+                dev_err(&pdev->dev, "%s: invalid tshut=%d, error=%d\n",
+                        __func__, thermal->tshut_temp, error);
 
         sensor->thermal = thermal;
         sensor->id = id;
@@ -1196,9 +1239,13 @@ static int __maybe_unused rockchip_thermal_resume(struct device *dev)
 
                 thermal->chip->set_tshut_mode(id, thermal->regs,
                                               thermal->tshut_mode);
-                thermal->chip->set_tshut_temp(thermal->chip->table,
+
+                error = thermal->chip->set_tshut_temp(&thermal->chip->table,
                                               id, thermal->regs,
                                               thermal->tshut_temp);
+                if (error)
+                        dev_err(&pdev->dev, "%s: invalid tshut=%d, error=%d\n",
+                                __func__, thermal->tshut_temp, error);
         }
 
         thermal->chip->control(thermal->regs, true);
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 641faab6e24b..655591316a88 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -799,6 +799,11 @@ static void thermal_release(struct device *dev)
         if (!strncmp(dev_name(dev), "thermal_zone",
                      sizeof("thermal_zone") - 1)) {
                 tz = to_thermal_zone(dev);
+                kfree(tz->trip_type_attrs);
+                kfree(tz->trip_temp_attrs);
+                kfree(tz->trip_hyst_attrs);
+                kfree(tz->trips_attribute_group.attrs);
+                kfree(tz->device.groups);
                 kfree(tz);
         } else if (!strncmp(dev_name(dev), "cooling_device",
                             sizeof("cooling_device") - 1)) {
@@ -1305,10 +1310,6 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)
 
         thermal_zone_device_set_polling(tz, 0);
 
-        kfree(tz->trip_type_attrs);
-        kfree(tz->trip_temp_attrs);
-        kfree(tz->trip_hyst_attrs);
-        kfree(tz->trips_attribute_group.attrs);
         thermal_set_governor(tz, NULL);
 
         thermal_remove_hwmon_sysfs(tz);
@@ -1316,7 +1317,6 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)
         idr_destroy(&tz->idr);
         mutex_destroy(&tz->lock);
         device_unregister(&tz->device);
-        kfree(tz->device.groups);
 }
 EXPORT_SYMBOL_GPL(thermal_zone_device_unregister);
 
diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
index 541af5946203..c4a508a124dc 100644
--- a/drivers/thermal/thermal_hwmon.c
+++ b/drivers/thermal/thermal_hwmon.c
@@ -59,14 +59,6 @@ static LIST_HEAD(thermal_hwmon_list);
 static DEFINE_MUTEX(thermal_hwmon_list_lock);
 
 static ssize_t
-name_show(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct thermal_hwmon_device *hwmon = dev_get_drvdata(dev);
-        return sprintf(buf, "%s\n", hwmon->type);
-}
-static DEVICE_ATTR_RO(name);
-
-static ssize_t
 temp_input_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
         int temperature;
@@ -165,15 +157,12 @@ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
 
         INIT_LIST_HEAD(&hwmon->tz_list);
         strlcpy(hwmon->type, tz->type, THERMAL_NAME_LENGTH);
-        hwmon->device = hwmon_device_register(NULL);
+        hwmon->device = hwmon_device_register_with_info(NULL, hwmon->type,
+                                                        hwmon, NULL, NULL);
         if (IS_ERR(hwmon->device)) {
                 result = PTR_ERR(hwmon->device);
                 goto free_mem;
         }
-        dev_set_drvdata(hwmon->device, hwmon);
-        result = device_create_file(hwmon->device, &dev_attr_name);
-        if (result)
-                goto free_mem;
 
  register_sys_interface:
         temp = kzalloc(sizeof(*temp), GFP_KERNEL);
@@ -222,10 +211,8 @@ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
  free_temp_mem:
         kfree(temp);
  unregister_name:
-        if (new_hwmon_device) {
-                device_remove_file(hwmon->device, &dev_attr_name);
+        if (new_hwmon_device)
                 hwmon_device_unregister(hwmon->device);
-        }
  free_mem:
         if (new_hwmon_device)
                 kfree(hwmon);
@@ -267,7 +254,6 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
         list_del(&hwmon->node);
         mutex_unlock(&thermal_hwmon_list_lock);
 
-        device_remove_file(hwmon->device, &dev_attr_name);
         hwmon_device_unregister(hwmon->device);
         kfree(hwmon);
 }
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index 9548d3e03453..302b8f5f7d27 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -513,8 +513,8 @@ struct dwc2_core_params {
         /* Gadget parameters */
         bool g_dma;
         bool g_dma_desc;
-        u16 g_rx_fifo_size;
-        u16 g_np_tx_fifo_size;
+        u32 g_rx_fifo_size;
+        u32 g_np_tx_fifo_size;
         u32 g_tx_fifo_size[MAX_EPS_CHANNELS];
 };
 
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index c55db4aa54d6..77c5fcf3a5bf 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3169,7 +3169,7 @@ void dwc2_hsotg_core_init_disconnected(struct dwc2_hsotg *hsotg,
         /* keep other bits untouched (so e.g. forced modes are not lost) */
         usbcfg = dwc2_readl(hsotg->regs + GUSBCFG);
         usbcfg &= ~(GUSBCFG_TOUTCAL_MASK | GUSBCFG_PHYIF16 | GUSBCFG_SRPCAP |
-                GUSBCFG_HNPCAP);
+                GUSBCFG_HNPCAP | GUSBCFG_USBTRDTIM_MASK);
 
         if (hsotg->params.phy_type == DWC2_PHY_TYPE_PARAM_FS &&
             (hsotg->params.speed == DWC2_SPEED_PARAM_FULL ||
@@ -3749,8 +3749,8 @@ static int dwc2_hsotg_ep_enable(struct usb_ep *ep,
                 __func__, epctrl, epctrl_reg);
 
         /* Allocate DMA descriptor chain for non-ctrl endpoints */
-        if (using_desc_dma(hsotg)) {
-                hs_ep->desc_list = dma_alloc_coherent(hsotg->dev,
+        if (using_desc_dma(hsotg) && !hs_ep->desc_list) {
+                hs_ep->desc_list = dmam_alloc_coherent(hsotg->dev,
                         MAX_DMA_DESC_NUM_GENERIC *
                         sizeof(struct dwc2_dma_desc),
                         &hs_ep->desc_list_dma, GFP_ATOMIC);
@@ -3872,7 +3872,7 @@ error1:
 
 error2:
         if (ret && using_desc_dma(hsotg) && hs_ep->desc_list) {
-                dma_free_coherent(hsotg->dev, MAX_DMA_DESC_NUM_GENERIC *
+                dmam_free_coherent(hsotg->dev, MAX_DMA_DESC_NUM_GENERIC *
                         sizeof(struct dwc2_dma_desc),
                         hs_ep->desc_list, hs_ep->desc_list_dma);
                 hs_ep->desc_list = NULL;
@@ -3902,14 +3902,6 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
                 return -EINVAL;
         }
 
-        /* Remove DMA memory allocated for non-control Endpoints */
-        if (using_desc_dma(hsotg)) {
-                dma_free_coherent(hsotg->dev, MAX_DMA_DESC_NUM_GENERIC *
-                                  sizeof(struct dwc2_dma_desc),
-                                  hs_ep->desc_list, hs_ep->desc_list_dma);
-                hs_ep->desc_list = NULL;
-        }
-
         epctrl_reg = dir_in ? DIEPCTL(index) : DOEPCTL(index);
 
         spin_lock_irqsave(&hsotg->lock, flags);
@@ -4131,7 +4123,7 @@ static void dwc2_hsotg_init(struct dwc2_hsotg *hsotg)
         /* keep other bits untouched (so e.g. forced modes are not lost) */
         usbcfg = dwc2_readl(hsotg->regs + GUSBCFG);
         usbcfg &= ~(GUSBCFG_TOUTCAL_MASK | GUSBCFG_PHYIF16 | GUSBCFG_SRPCAP |
-                GUSBCFG_HNPCAP);
+                GUSBCFG_HNPCAP | GUSBCFG_USBTRDTIM_MASK);
 
         /* set the PLL on, remove the HNP/SRP and set the PHY */
         trdtim = (hsotg->phyif == GUSBCFG_PHYIF8) ? 9 : 5;
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index 911c3b36ac06..46d0ad5105e4 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -4367,6 +4367,9 @@ static int _dwc2_hcd_suspend(struct usb_hcd *hcd)
         if (!HCD_HW_ACCESSIBLE(hcd))
                 goto unlock;
 
+        if (hsotg->op_state == OTG_STATE_B_PERIPHERAL)
+                goto unlock;
+
         if (!hsotg->params.hibernation)
                 goto skip_power_saving;
 
@@ -4489,8 +4492,8 @@ static void dwc2_dump_urb_info(struct usb_hcd *hcd, struct urb *urb,
 {
 #ifdef VERBOSE_DEBUG
         struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd);
-        char *pipetype;
-        char *speed;
+        char *pipetype = NULL;
+        char *speed = NULL;
 
         dev_vdbg(hsotg->dev, "%s, urb %p\n", fn_name, urb);
         dev_vdbg(hsotg->dev, "  Device address: %d\n",
diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
index 11fe68a4627b..bcd1e19b4076 100644
--- a/drivers/usb/dwc2/params.c
+++ b/drivers/usb/dwc2/params.c
@@ -385,16 +385,16 @@ static void dwc2_set_param(struct dwc2_hsotg *hsotg, void *param,
 }
 
 /**
- * dwc2_set_param_u16() - Set a u16 parameter
+ * dwc2_set_param_u32() - Set a u32 parameter
  *
  * See dwc2_set_param().
  */
-static void dwc2_set_param_u16(struct dwc2_hsotg *hsotg, u16 *param,
+static void dwc2_set_param_u32(struct dwc2_hsotg *hsotg, u32 *param,
                                bool lookup, char *property, u16 legacy,
                                u16 def, u16 min, u16 max)
 {
         dwc2_set_param(hsotg, param, lookup, property,
-                       legacy, def, min, max, 2);
+                       legacy, def, min, max, 4);
 }
 
 /**
@@ -1178,12 +1178,12 @@ static void dwc2_set_parameters(struct dwc2_hsotg *hsotg,
                  * auto-detect if the hardware does not support the
                  * default.
                  */
-                dwc2_set_param_u16(hsotg, &p->g_rx_fifo_size,
+                dwc2_set_param_u32(hsotg, &p->g_rx_fifo_size,
                                    true, "g-rx-fifo-size", 2048,
                                    hw->rx_fifo_size,
                                    16, hw->rx_fifo_size);
 
-                dwc2_set_param_u16(hsotg, &p->g_np_tx_fifo_size,
+                dwc2_set_param_u32(hsotg, &p->g_np_tx_fifo_size,
                                    true, "g-np-tx-fifo-size", 1024,
                                    hw->dev_nperio_tx_fifo_size,
                                    16, hw->dev_nperio_tx_fifo_size);
diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c
index e27899bb5706..e956306d9b0f 100644
--- a/drivers/usb/dwc3/dwc3-exynos.c
+++ b/drivers/usb/dwc3/dwc3-exynos.c
@@ -138,7 +138,8 @@ static int dwc3_exynos_probe(struct platform_device *pdev)
                 exynos->axius_clk = devm_clk_get(dev, "usbdrd30_axius_clk");
                 if (IS_ERR(exynos->axius_clk)) {
                         dev_err(dev, "no AXI UpScaler clk specified\n");
-                        return -ENODEV;
+                        ret = -ENODEV;
+                        goto axius_clk_err;
                 }
                 clk_prepare_enable(exynos->axius_clk);
         } else {
@@ -196,6 +197,7 @@ err3:
         regulator_disable(exynos->vdd33);
 err2:
         clk_disable_unprepare(exynos->axius_clk);
+axius_clk_err:
         clk_disable_unprepare(exynos->susp_clk);
         clk_disable_unprepare(exynos->clk);
         return ret;
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 002822d98fda..49d685ad0da9 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -2147,7 +2147,7 @@ int composite_os_desc_req_prepare(struct usb_composite_dev *cdev,
         cdev->os_desc_req->buf = kmalloc(4096, GFP_KERNEL);
         if (!cdev->os_desc_req->buf) {
                 ret = -ENOMEM;
-                kfree(cdev->os_desc_req);
+                usb_ep_free_request(ep0, cdev->os_desc_req);
                 goto end;
         }
         cdev->os_desc_req->context = cdev;
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 5e746adc8a2d..5490fc51638e 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1806,7 +1806,7 @@ static void ffs_func_eps_disable(struct ffs_function *func)
         unsigned long flags;
 
         spin_lock_irqsave(&func->ffs->eps_lock, flags);
-        do {
+        while (count--) {
                 /* pending requests get nuked */
                 if (likely(ep->ep))
                         usb_ep_disable(ep->ep);
@@ -1817,7 +1817,7 @@ static void ffs_func_eps_disable(struct ffs_function *func)
                         __ffs_epfile_read_buffer_free(epfile);
                         ++epfile;
                 }
-        } while (--count);
+        }
         spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
 }
 
@@ -1831,7 +1831,7 @@ static int ffs_func_eps_enable(struct ffs_function *func)
         int ret = 0;
 
         spin_lock_irqsave(&func->ffs->eps_lock, flags);
-        do {
+        while(count--) {
                 struct usb_endpoint_descriptor *ds;
                 int desc_idx;
 
@@ -1867,7 +1867,7 @@ static int ffs_func_eps_enable(struct ffs_function *func)
 
                 ++ep;
                 ++epfile;
-        } while (--count);
+        }
         spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
 
         return ret;
@@ -3448,12 +3448,12 @@ static void ffs_func_unbind(struct usb_configuration *c,
 
         /* cleanup after autoconfig */
         spin_lock_irqsave(&func->ffs->eps_lock, flags);
-        do {
+        while (count--) {
                 if (ep->ep && ep->req)
                         usb_ep_free_request(ep->ep, ep->req);
                 ep->req = NULL;
                 ++ep;
-        } while (--count);
+        }
         spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
         kfree(func->eps);
         func->eps = NULL;
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index f3212db9bc37..12c7687216e6 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -1978,7 +1978,8 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev,
                         dev_err(&pdev->dev, "of_probe: name error(%d)\n", ret);
                         goto err;
                 }
-                ep->ep.name = kasprintf(GFP_KERNEL, "ep%d", ep->index);
+                sprintf(ep->name, "ep%d", ep->index);
+                ep->ep.name = ep->name;
 
                 ep->ep_regs = udc->regs + USBA_EPT_BASE(i);
                 ep->dma_regs = udc->regs + USBA_DMA_BASE(i);
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.h b/drivers/usb/gadget/udc/atmel_usba_udc.h
index 3e1c9d589dfa..b03b2ebfc53a 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.h
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.h
@@ -280,6 +280,7 @@ struct usba_ep {
         void __iomem                            *ep_regs;
         void __iomem                            *dma_regs;
         void __iomem                            *fifo;
+        char                                    name[8];
         struct usb_ep                           ep;
         struct usba_udc                         *udc;
 
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index ddfab301e366..e5834dd9bcde 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -165,7 +165,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
                 return -ENODEV;
 
         /* Try to set 64-bit DMA first */
-        if (WARN_ON(!pdev->dev.dma_mask))
+        if (!pdev->dev.dma_mask)
                 /* Platform did not initialize dma_mask */
                 ret = dma_coerce_mask_and_coherent(&pdev->dev,
                                                    DMA_BIT_MASK(64));
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 253310cdaaca..fd6c8b66f06f 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -843,7 +843,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
         struct iov_iter out_iter, in_iter, prot_iter, data_iter;
         u64 tag;
         u32 exp_data_len, data_direction;
-        unsigned out, in;
+        unsigned int out = 0, in = 0;
         int head, ret, prot_bytes;
         size_t req_size, rsp_size = sizeof(struct virtio_scsi_cmd_resp);
         size_t out_size, in_size;
@@ -2087,7 +2087,7 @@ static struct configfs_attribute *vhost_scsi_wwn_attrs[] = {
         NULL,
 };
 
-static struct target_core_fabric_ops vhost_scsi_ops = {
+static const struct target_core_fabric_ops vhost_scsi_ops = {
         .module                         = THIS_MODULE,
         .name                           = "vhost",
         .get_fabric_name                = vhost_scsi_get_fabric_name,
diff --git a/drivers/xen/platform-pci.c b/drivers/xen/platform-pci.c
index 112ce422dc22..2a165cc8a43c 100644
--- a/drivers/xen/platform-pci.c
+++ b/drivers/xen/platform-pci.c
@@ -42,6 +42,7 @@
 static unsigned long platform_mmio;
 static unsigned long platform_mmio_alloc;
 static unsigned long platform_mmiolen;
+static uint64_t callback_via;
 
 static unsigned long alloc_xen_mmio(unsigned long len)
 {
@@ -54,6 +55,51 @@ static unsigned long alloc_xen_mmio(unsigned long len)
         return addr;
 }
 
+static uint64_t get_callback_via(struct pci_dev *pdev)
+{
+        u8 pin;
+        int irq;
+
+        irq = pdev->irq;
+        if (irq < 16)
+                return irq; /* ISA IRQ */
+
+        pin = pdev->pin;
+
+        /* We don't know the GSI. Specify the PCI INTx line instead. */
+        return ((uint64_t)0x01 << HVM_CALLBACK_VIA_TYPE_SHIFT) | /* PCI INTx identifier */
+                ((uint64_t)pci_domain_nr(pdev->bus) << 32) |
+                ((uint64_t)pdev->bus->number << 16) |
+                ((uint64_t)(pdev->devfn & 0xff) << 8) |
+                ((uint64_t)(pin - 1) & 3);
+}
+
+static irqreturn_t do_hvm_evtchn_intr(int irq, void *dev_id)
+{
+        xen_hvm_evtchn_do_upcall();
+        return IRQ_HANDLED;
+}
+
+static int xen_allocate_irq(struct pci_dev *pdev)
+{
+        return request_irq(pdev->irq, do_hvm_evtchn_intr,
+                        IRQF_NOBALANCING | IRQF_TRIGGER_RISING,
+                        "xen-platform-pci", pdev);
+}
+
+static int platform_pci_resume(struct pci_dev *pdev)
+{
+        int err;
+        if (!xen_pv_domain())
+                return 0;
+        err = xen_set_callback_via(callback_via);
+        if (err) {
+                dev_err(&pdev->dev, "platform_pci_resume failure!\n");
+                return err;
+        }
+        return 0;
+}
+
 static int platform_pci_probe(struct pci_dev *pdev,
                               const struct pci_device_id *ent)
 {
@@ -92,6 +138,28 @@ static int platform_pci_probe(struct pci_dev *pdev,
         platform_mmio = mmio_addr;
         platform_mmiolen = mmio_len;
 
+        /* 
+         * Xen HVM guests always use the vector callback mechanism.
+         * L1 Dom0 in a nested Xen environment is a PV guest inside in an
+         * HVM environment. It needs the platform-pci driver to get
+         * notifications from L0 Xen, but it cannot use the vector callback
+         * as it is not exported by L1 Xen.
+         */
+        if (xen_pv_domain()) {
+                ret = xen_allocate_irq(pdev);
+                if (ret) {
+                        dev_warn(&pdev->dev, "request_irq failed err=%d\n", ret);
+                        goto out;
+                }
+                callback_via = get_callback_via(pdev);
+                ret = xen_set_callback_via(callback_via);
+                if (ret) {
+                        dev_warn(&pdev->dev, "Unable to set the evtchn callback "
+                                         "err=%d\n", ret);
+                        goto out;
+                }
+        }
+
         max_nr_gframes = gnttab_max_grant_frames();
         grant_frames = alloc_xen_mmio(PAGE_SIZE * max_nr_gframes);
         ret = gnttab_setup_auto_xlat_frames(grant_frames);
@@ -123,6 +191,9 @@ static struct pci_driver platform_driver = {
         .name =           DRV_NAME,
         .probe =          platform_pci_probe,
         .id_table =       platform_pci_tbl,
+#ifdef CONFIG_PM
+        .resume_early =   platform_pci_resume,
+#endif
 };
 
 builtin_pci_driver(platform_driver);
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index baea866a6751..94fd76d04683 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -2591,8 +2591,13 @@ int ceph_get_caps(struct ceph_inode_info *ci, int need, int want,
                         add_wait_queue(&ci->i_cap_wq, &wait);
 
                         while (!try_get_cap_refs(ci, need, want, endoff,
-                                                 true, &_got, &err))
+                                                 true, &_got, &err)) {
+                                if (signal_pending(current)) {
+                                        ret = -ERESTARTSYS;
+                                        break;
+                                }
                                 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
+                        }
 
                         remove_wait_queue(&ci->i_cap_wq, &wait);
 
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index d7a93696663b..8ab1fdf0bd49 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -1230,7 +1230,8 @@ static int ceph_d_revalidate(struct dentry *dentry, unsigned int flags)
                 struct ceph_mds_client *mdsc =
                         ceph_sb_to_client(dir->i_sb)->mdsc;
                 struct ceph_mds_request *req;
-                int op, mask, err;
+                int op, err;
+                u32 mask;
 
                 if (flags & LOOKUP_RCU)
                         return -ECHILD;
@@ -1245,7 +1246,7 @@ static int ceph_d_revalidate(struct dentry *dentry, unsigned int flags)
                         mask = CEPH_STAT_CAP_INODE | CEPH_CAP_AUTH_SHARED;
                         if (ceph_security_xattr_wanted(dir))
                                 mask |= CEPH_CAP_XATTR_SHARED;
-                        req->r_args.getattr.mask = mask;
+                        req->r_args.getattr.mask = cpu_to_le32(mask);
 
                         err = ceph_mdsc_do_request(mdsc, NULL, req);
                         switch (err) {
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 398e5328b309..5e659d054b40 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -305,7 +305,8 @@ static int frag_tree_split_cmp(const void *l, const void *r)
 {
         struct ceph_frag_tree_split *ls = (struct ceph_frag_tree_split*)l;
         struct ceph_frag_tree_split *rs = (struct ceph_frag_tree_split*)r;
-        return ceph_frag_compare(ls->frag, rs->frag);
+        return ceph_frag_compare(le32_to_cpu(ls->frag),
+                                 le32_to_cpu(rs->frag));
 }
 
 static bool is_frag_child(u32 f, struct ceph_inode_frag *frag)
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index ec6b35e9f966..c9d2e553a6c4 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -288,12 +288,13 @@ static int parse_reply_info_extra(void **p, void *end,
                                   struct ceph_mds_reply_info_parsed *info,
                                   u64 features)
 {
-        if (info->head->op == CEPH_MDS_OP_GETFILELOCK)
+        u32 op = le32_to_cpu(info->head->op);
+
+        if (op == CEPH_MDS_OP_GETFILELOCK)
                 return parse_reply_info_filelock(p, end, info, features);
-        else if (info->head->op == CEPH_MDS_OP_READDIR ||
-                 info->head->op == CEPH_MDS_OP_LSSNAP)
+        else if (op == CEPH_MDS_OP_READDIR || op == CEPH_MDS_OP_LSSNAP)
                 return parse_reply_info_dir(p, end, info, features);
-        else if (info->head->op == CEPH_MDS_OP_CREATE)
+        else if (op == CEPH_MDS_OP_CREATE)
                 return parse_reply_info_create(p, end, info, features);
         else
                 return -EIO;
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 70ea57c7b6bb..4e06a27ed7f8 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -2025,7 +2025,6 @@ static void end_requests(struct fuse_conn *fc, struct list_head *head)
                 struct fuse_req *req;
                 req = list_entry(head->next, struct fuse_req, list);
                 req->out.h.error = -ECONNABORTED;
-                clear_bit(FR_PENDING, &req->flags);
                 clear_bit(FR_SENT, &req->flags);
                 list_del_init(&req->list);
                 request_end(fc, req);
@@ -2103,6 +2102,8 @@ void fuse_abort_conn(struct fuse_conn *fc)
                 spin_lock(&fiq->waitq.lock);
                 fiq->connected = 0;
                 list_splice_init(&fiq->pending, &to_end2);
+                list_for_each_entry(req, &to_end2, list)
+                        clear_bit(FR_PENDING, &req->flags);
                 while (forget_pending(fiq))
                         kfree(dequeue_forget(fiq, 1, NULL));
                 wake_up_all_locked(&fiq->waitq);
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 1f7c732f32b0..811fd8929a18 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -68,7 +68,7 @@ static u64 time_to_jiffies(u64 sec, u32 nsec)
         if (sec || nsec) {
                 struct timespec64 ts = {
                         sec,
-                        max_t(u32, nsec, NSEC_PER_SEC - 1)
+                        min_t(u32, nsec, NSEC_PER_SEC - 1)
                 };
 
                 return get_jiffies_64() + timespec64_to_jiffies(&ts);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 6dcbc5defb7a..ecc151697fd4 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -38,7 +38,6 @@
 #include <linux/mm.h>
 #include <linux/delay.h>
 #include <linux/errno.h>
-#include <linux/file.h>
 #include <linux/string.h>
 #include <linux/ratelimit.h>
 #include <linux/printk.h>
@@ -1083,7 +1082,8 @@ int nfs4_call_sync(struct rpc_clnt *clnt,
         return nfs4_call_sync_sequence(clnt, server, msg, args, res);
 }
 
-static void update_changeattr(struct inode *dir, struct nfs4_change_info *cinfo)
+static void update_changeattr(struct inode *dir, struct nfs4_change_info *cinfo,
+                unsigned long timestamp)
 {
         struct nfs_inode *nfsi = NFS_I(dir);
 
@@ -1099,6 +1099,7 @@ static void update_changeattr(struct inode *dir, struct nfs4_change_info *cinfo)
                                 NFS_INO_INVALID_ACL;
         }
         dir->i_version = cinfo->after;
+        nfsi->read_cache_jiffies = timestamp;
         nfsi->attr_gencount = nfs_inc_attr_generation_counter();
         nfs_fscache_invalidate(dir);
         spin_unlock(&dir->i_lock);
@@ -2391,11 +2392,13 @@ static int _nfs4_proc_open(struct nfs4_opendata *data)
         nfs_fattr_map_and_free_names(server, &data->f_attr);
 
         if (o_arg->open_flags & O_CREAT) {
-                update_changeattr(dir, &o_res->cinfo);
                 if (o_arg->open_flags & O_EXCL)
                         data->file_created = 1;
                 else if (o_res->cinfo.before != o_res->cinfo.after)
                         data->file_created = 1;
+                if (data->file_created || dir->i_version != o_res->cinfo.after)
+                        update_changeattr(dir, &o_res->cinfo,
+                                        o_res->f_attr->time_start);
         }
         if ((o_res->rflags & NFS4_OPEN_RESULT_LOCKTYPE_POSIX) == 0)
                 server->caps &= ~NFS_CAP_POSIX_LOCK;
@@ -4073,11 +4076,12 @@ static int _nfs4_proc_remove(struct inode *dir, const struct qstr *name)
                 .rpc_argp = &args,
                 .rpc_resp = &res,
         };
+        unsigned long timestamp = jiffies;
         int status;
 
         status = nfs4_call_sync(server->client, server, &msg, &args.seq_args, &res.seq_res, 1);
         if (status == 0)
-                update_changeattr(dir, &res.cinfo);
+                update_changeattr(dir, &res.cinfo, timestamp);
         return status;
 }
 
@@ -4125,7 +4129,8 @@ static int nfs4_proc_unlink_done(struct rpc_task *task, struct inode *dir)
         if (nfs4_async_handle_error(task, res->server, NULL,
                                     &data->timeout) == -EAGAIN)
                 return 0;
-        update_changeattr(dir, &res->cinfo);
+        if (task->tk_status == 0)
+                update_changeattr(dir, &res->cinfo, res->dir_attr->time_start);
         return 1;
 }
 
@@ -4159,8 +4164,11 @@ static int nfs4_proc_rename_done(struct rpc_task *task, struct inode *old_dir,
         if (nfs4_async_handle_error(task, res->server, NULL, &data->timeout) == -EAGAIN)
                 return 0;
 
-        update_changeattr(old_dir, &res->old_cinfo);
-        update_changeattr(new_dir, &res->new_cinfo);
+        if (task->tk_status == 0) {
+                update_changeattr(old_dir, &res->old_cinfo, res->old_fattr->time_start);
+                if (new_dir != old_dir)
+                        update_changeattr(new_dir, &res->new_cinfo, res->new_fattr->time_start);
+        }
         return 1;
 }
 
@@ -4197,7 +4205,7 @@ static int _nfs4_proc_link(struct inode *inode, struct inode *dir, const struct
 
         status = nfs4_call_sync(server->client, server, &msg, &arg.seq_args, &res.seq_res, 1);
         if (!status) {
-                update_changeattr(dir, &res.cinfo);
+                update_changeattr(dir, &res.cinfo, res.fattr->time_start);
                 status = nfs_post_op_update_inode(inode, res.fattr);
                 if (!status)
                         nfs_setsecurity(inode, res.fattr, res.label);
@@ -4272,7 +4280,8 @@ static int nfs4_do_create(struct inode *dir, struct dentry *dentry, struct nfs4_
         int status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &data->msg,
                                     &data->arg.seq_args, &data->res.seq_res, 1);
         if (status == 0) {
-                update_changeattr(dir, &data->res.dir_cinfo);
+                update_changeattr(dir, &data->res.dir_cinfo,
+                                data->res.fattr->time_start);
                 status = nfs_instantiate(dentry, data->res.fh, data->res.fattr, data->res.label);
         }
         return status;
@@ -6127,7 +6136,6 @@ static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl,
         p->server = server;
         atomic_inc(&lsp->ls_count);
         p->ctx = get_nfs_open_context(ctx);
-        get_file(fl->fl_file);
         memcpy(&p->fl, fl, sizeof(p->fl));
         return p;
 out_free_seqid:
@@ -6240,7 +6248,6 @@ static void nfs4_lock_release(void *calldata)
                 nfs_free_seqid(data->arg.lock_seqid);
         nfs4_put_lock_state(data->lsp);
         put_nfs_open_context(data->ctx);
-        fput(data->fl.fl_file);
         kfree(data);
         dprintk("%s: done!\n", __func__);
 }
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 1d152f4470cd..90e6193ce6be 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1729,7 +1729,6 @@ static int nfs4_recovery_handle_error(struct nfs_client *clp, int error)
                         break;
                 case -NFS4ERR_STALE_CLIENTID:
                         set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
-                        nfs4_state_clear_reclaim_reboot(clp);
                         nfs4_state_start_reclaim_reboot(clp);
                         break;
                 case -NFS4ERR_EXPIRED:
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 7ecf16be4a44..8fae53ce21d1 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2440,7 +2440,9 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
         p++;                /* to be backfilled later */
 
         if (bmval0 & FATTR4_WORD0_SUPPORTED_ATTRS) {
-                u32 *supp = nfsd_suppattrs[minorversion];
+                u32 supp[3];
+
+                memcpy(supp, nfsd_suppattrs[minorversion], sizeof(supp));
 
                 if (!IS_POSIXACL(dentry->d_inode))
                         supp[0] &= ~FATTR4_WORD0_ACL;
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index 9ad48d9202a9..023bb0b03352 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -154,29 +154,38 @@ out_err:
 static int ovl_lookup_layer(struct dentry *base, struct ovl_lookup_data *d,
                             struct dentry **ret)
 {
-        const char *s = d->name.name;
+        /* Counting down from the end, since the prefix can change */
+        size_t rem = d->name.len - 1;
         struct dentry *dentry = NULL;
         int err;
 
-        if (*s != '/')
+        if (d->name.name[0] != '/')
                 return ovl_lookup_single(base, d, d->name.name, d->name.len,
                                          0, "", ret);
 
-        while (*s++ == '/' && !IS_ERR_OR_NULL(base) && d_can_lookup(base)) {
+        while (!IS_ERR_OR_NULL(base) && d_can_lookup(base)) {
+                const char *s = d->name.name + d->name.len - rem;
                 const char *next = strchrnul(s, '/');
-                size_t slen = strlen(s);
+                size_t thislen = next - s;
+                bool end = !next[0];
 
-                if (WARN_ON(slen > d->name.len) ||
-                    WARN_ON(strcmp(d->name.name + d->name.len - slen, s)))
+                /* Verify we did not go off the rails */
+                if (WARN_ON(s[-1] != '/'))
                         return -EIO;
 
-                err = ovl_lookup_single(base, d, s, next - s,
-                                        d->name.len - slen, next, &base);
+                err = ovl_lookup_single(base, d, s, thislen,
+                                        d->name.len - rem, next, &base);
                 dput(dentry);
                 if (err)
                         return err;
                 dentry = base;
-                s = next;
+                if (end)
+                        break;
+
+                rem -= thislen + 1;
+
+                if (WARN_ON(rem >= d->name.len))
+                        return -EIO;
         }
         *ret = dentry;
         return 0;
diff --git a/fs/ubifs/Kconfig b/fs/ubifs/Kconfig
index 0a908ae7af13..b0d0623c83ed 100644
--- a/fs/ubifs/Kconfig
+++ b/fs/ubifs/Kconfig
@@ -53,7 +53,7 @@ config UBIFS_ATIME_SUPPORT
 
 config UBIFS_FS_ENCRYPTION
         bool "UBIFS Encryption"
-        depends on UBIFS_FS
+        depends on UBIFS_FS && BLOCK
         select FS_ENCRYPTION
         default n
         help
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index 1c5331ac9614..528369f3e472 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -390,16 +390,6 @@ static int do_tmpfile(struct inode *dir, struct dentry *dentry,
         dbg_gen("dent '%pd', mode %#hx in dir ino %lu",
                 dentry, mode, dir->i_ino);
 
-        if (ubifs_crypt_is_encrypted(dir)) {
-                err = fscrypt_get_encryption_info(dir);
-                if (err)
-                        return err;
-
-                if (!fscrypt_has_encryption_key(dir)) {
-                        return -EPERM;
-                }
-        }
-
         err = fscrypt_setup_filename(dir, &dentry->d_name, 0, &nm);
         if (err)
                 return err;
@@ -741,17 +731,9 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
         ubifs_assert(inode_is_locked(dir));
         ubifs_assert(inode_is_locked(inode));
 
-        if (ubifs_crypt_is_encrypted(dir)) {
-                if (!fscrypt_has_permitted_context(dir, inode))
-                        return -EPERM;
-
-                err = fscrypt_get_encryption_info(inode);
-                if (err)
-                        return err;
-
-                if (!fscrypt_has_encryption_key(inode))
-                        return -EPERM;
-        }
+        if (ubifs_crypt_is_encrypted(dir) &&
+            !fscrypt_has_permitted_context(dir, inode))
+                return -EPERM;
 
         err = fscrypt_setup_filename(dir, &dentry->d_name, 0, &nm);
         if (err)
@@ -1000,17 +982,6 @@ static int ubifs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
         if (err)
                 return err;
 
-        if (ubifs_crypt_is_encrypted(dir)) {
-                err = fscrypt_get_encryption_info(dir);
-                if (err)
-                        goto out_budg;
-
-                if (!fscrypt_has_encryption_key(dir)) {
-                        err = -EPERM;
-                        goto out_budg;
-                }
-        }
-
         err = fscrypt_setup_filename(dir, &dentry->d_name, 0, &nm);
         if (err)
                 goto out_budg;
@@ -1096,17 +1067,6 @@ static int ubifs_mknod(struct inode *dir, struct dentry *dentry,
                 return err;
         }
 
-        if (ubifs_crypt_is_encrypted(dir)) {
-                err = fscrypt_get_encryption_info(dir);
-                if (err)
-                        goto out_budg;
-
-                if (!fscrypt_has_encryption_key(dir)) {
-                        err = -EPERM;
-                        goto out_budg;
-                }
-        }
-
         err = fscrypt_setup_filename(dir, &dentry->d_name, 0, &nm);
         if (err)
                 goto out_budg;
@@ -1231,18 +1191,6 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry,
                         goto out_inode;
                 }
 
-                err = fscrypt_get_encryption_info(inode);
-                if (err) {
-                        kfree(sd);
-                        goto out_inode;
-                }
-
-                if (!fscrypt_has_encryption_key(inode)) {
-                        kfree(sd);
-                        err = -EPERM;
-                        goto out_inode;
-                }
-
                 ostr.name = sd->encrypted_path;
                 ostr.len = disk_link.len;
 
diff --git a/fs/ubifs/ioctl.c b/fs/ubifs/ioctl.c
index 78d713644df3..da519ba205f6 100644
--- a/fs/ubifs/ioctl.c
+++ b/fs/ubifs/ioctl.c
@@ -217,6 +217,9 @@ long ubifs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         case FS_IOC32_SETFLAGS:
                 cmd = FS_IOC_SETFLAGS;
                 break;
+        case FS_IOC_SET_ENCRYPTION_POLICY:
+        case FS_IOC_GET_ENCRYPTION_POLICY:
+                break;
         default:
                 return -ENOIOCTLCMD;
         }
diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index a459211a1c21..294519b98874 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -744,6 +744,7 @@ int ubifs_jnl_write_data(struct ubifs_info *c, const struct inode *inode,
 
         } else {
                 data->compr_size = 0;
+                out_len = compr_len;
         }
 
         dlen = UBIFS_DATA_NODE_SZ + out_len;
@@ -1319,6 +1320,7 @@ static int truncate_data_node(const struct ubifs_info *c, const struct inode *in
         dn->compr_type = cpu_to_le16(compr_type);
         dn->size = cpu_to_le32(*new_len);
         *new_len = UBIFS_DATA_NODE_SZ + out_len;
+        err = 0;
 out:
         kfree(buf);
         return err;
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index 74ae2de949df..709aa098dd46 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -34,6 +34,11 @@
 #include <linux/slab.h>
 #include "ubifs.h"
 
+static int try_read_node(const struct ubifs_info *c, void *buf, int type,
+                         int len, int lnum, int offs);
+static int fallible_read_node(struct ubifs_info *c, const union ubifs_key *key,
+                              struct ubifs_zbranch *zbr, void *node);
+
 /*
  * Returned codes of 'matches_name()' and 'fallible_matches_name()' functions.
  * @NAME_LESS: name corresponding to the first argument is less than second
@@ -402,7 +407,19 @@ static int tnc_read_hashed_node(struct ubifs_info *c, struct ubifs_zbranch *zbr,
                 return 0;
         }
 
-        err = ubifs_tnc_read_node(c, zbr, node);
+        if (c->replaying) {
+                err = fallible_read_node(c, &zbr->key, zbr, node);
+                /*
+                 * When the node was not found, return -ENOENT, 0 otherwise.
+                 * Negative return codes stay as-is.
+                 */
+                if (err == 0)
+                        err = -ENOENT;
+                else if (err == 1)
+                        err = 0;
+        } else {
+                err = ubifs_tnc_read_node(c, zbr, node);
+        }
         if (err)
                 return err;
 
@@ -2857,7 +2874,11 @@ struct ubifs_dent_node *ubifs_tnc_next_ent(struct ubifs_info *c,
         if (fname_len(nm) > 0) {
                 if (err) {
                         /* Handle collisions */
-                        err = resolve_collision(c, key, &znode, &n, nm);
+                        if (c->replaying)
+                                err = fallible_resolve_collision(c, key, &znode, &n,
+                                                         nm, 0);
+                        else
+                                err = resolve_collision(c, key, &znode, &n, nm);
                         dbg_tnc("rc returned %d, znode %p, n %d",
                                 err, znode, n);
                         if (unlikely(err < 0))
diff --git a/fs/xfs/libxfs/xfs_dir2.c b/fs/xfs/libxfs/xfs_dir2.c
index c58d72c220f5..2f389d366e93 100644
--- a/fs/xfs/libxfs/xfs_dir2.c
+++ b/fs/xfs/libxfs/xfs_dir2.c
@@ -36,21 +36,29 @@
 struct xfs_name xfs_name_dotdot = { (unsigned char *)"..", 2, XFS_DIR3_FT_DIR };
 
 /*
- * @mode, if set, indicates that the type field needs to be set up.
- * This uses the transformation from file mode to DT_* as defined in linux/fs.h
- * for file type specification. This will be propagated into the directory
- * structure if appropriate for the given operation and filesystem config.
+ * Convert inode mode to directory entry filetype
  */
-const unsigned char xfs_mode_to_ftype[S_IFMT >> S_SHIFT] = {
-        [0]                     = XFS_DIR3_FT_UNKNOWN,
-        [S_IFREG >> S_SHIFT]    = XFS_DIR3_FT_REG_FILE,
-        [S_IFDIR >> S_SHIFT]    = XFS_DIR3_FT_DIR,
-        [S_IFCHR >> S_SHIFT]    = XFS_DIR3_FT_CHRDEV,
-        [S_IFBLK >> S_SHIFT]    = XFS_DIR3_FT_BLKDEV,
-        [S_IFIFO >> S_SHIFT]    = XFS_DIR3_FT_FIFO,
-        [S_IFSOCK >> S_SHIFT]   = XFS_DIR3_FT_SOCK,
-        [S_IFLNK >> S_SHIFT]    = XFS_DIR3_FT_SYMLINK,
-};
+unsigned char xfs_mode_to_ftype(int mode)
+{
+        switch (mode & S_IFMT) {
+        case S_IFREG:
+                return XFS_DIR3_FT_REG_FILE;
+        case S_IFDIR:
+                return XFS_DIR3_FT_DIR;
+        case S_IFCHR:
+                return XFS_DIR3_FT_CHRDEV;
+        case S_IFBLK:
+                return XFS_DIR3_FT_BLKDEV;
+        case S_IFIFO:
+                return XFS_DIR3_FT_FIFO;
+        case S_IFSOCK:
+                return XFS_DIR3_FT_SOCK;
+        case S_IFLNK:
+                return XFS_DIR3_FT_SYMLINK;
+        default:
+                return XFS_DIR3_FT_UNKNOWN;
+        }
+}
 
 /*
  * ASCII case-insensitive (ie. A-Z) support for directories that was
@@ -631,7 +639,8 @@ xfs_dir2_isblock(
         if ((rval = xfs_bmap_last_offset(args->dp, &last, XFS_DATA_FORK)))
                 return rval;
         rval = XFS_FSB_TO_B(args->dp->i_mount, last) == args->geo->blksize;
-        ASSERT(rval == 0 || args->dp->i_d.di_size == args->geo->blksize);
+        if (rval != 0 && args->dp->i_d.di_size != args->geo->blksize)
+                return -EFSCORRUPTED;
         *vp = rval;
         return 0;
 }
diff --git a/fs/xfs/libxfs/xfs_dir2.h b/fs/xfs/libxfs/xfs_dir2.h
index 0197590fa7d7..d6e6d9d16f6c 100644
--- a/fs/xfs/libxfs/xfs_dir2.h
+++ b/fs/xfs/libxfs/xfs_dir2.h
@@ -18,6 +18,9 @@
 #ifndef __XFS_DIR2_H__
 #define __XFS_DIR2_H__
 
+#include "xfs_da_format.h"
+#include "xfs_da_btree.h"
+
 struct xfs_defer_ops;
 struct xfs_da_args;
 struct xfs_inode;
@@ -32,10 +35,9 @@ struct xfs_dir2_data_unused;
 extern struct xfs_name  xfs_name_dotdot;
 
 /*
- * directory filetype conversion tables.
+ * Convert inode mode to directory entry filetype
  */
-#define S_SHIFT 12
-extern const unsigned char xfs_mode_to_ftype[];
+extern unsigned char xfs_mode_to_ftype(int mode);
 
 /*
  * directory operations vector for encode/decode routines
diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
index dd483e2767f7..d93f9d918cfc 100644
--- a/fs/xfs/libxfs/xfs_inode_buf.c
+++ b/fs/xfs/libxfs/xfs_inode_buf.c
@@ -29,6 +29,7 @@
 #include "xfs_icache.h"
 #include "xfs_trans.h"
 #include "xfs_ialloc.h"
+#include "xfs_dir2.h"
 
 /*
  * Check that none of the inode's in the buffer have a next
@@ -386,6 +387,7 @@ xfs_dinode_verify(
         xfs_ino_t               ino,
         struct xfs_dinode       *dip)
 {
+        uint16_t                mode;
         uint16_t                flags;
         uint64_t                flags2;
 
@@ -396,8 +398,12 @@ xfs_dinode_verify(
         if (be64_to_cpu(dip->di_size) & (1ULL << 63))
                 return false;
 
-        /* No zero-length symlinks. */
-        if (S_ISLNK(be16_to_cpu(dip->di_mode)) && dip->di_size == 0)
+        mode = be16_to_cpu(dip->di_mode);
+        if (mode && xfs_mode_to_ftype(mode) == XFS_DIR3_FT_UNKNOWN)
+                return false;
+
+        /* No zero-length symlinks/dirs. */
+        if ((S_ISLNK(mode) || S_ISDIR(mode)) && dip->di_size == 0)
                 return false;
 
         /* only version 3 or greater inodes are extensively verified here */
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index 7a30b8f11db7..9d06cc30e875 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -710,6 +710,10 @@ xfs_dq_get_next_id(
         /* Simple advance */
         next_id = *id + 1;
 
+        /* If we'd wrap past the max ID, stop */
+        if (next_id < *id)
+                return -ENOENT;
+
         /* If new ID is within the current chunk, advancing it sufficed */
         if (next_id % mp->m_quotainfo->qi_dqperchunk) {
                 *id = next_id;
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 308bebb6dfd2..22c16155f1b4 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -98,12 +98,27 @@ xfs_init_security(
 static void
 xfs_dentry_to_name(
         struct xfs_name *namep,
+        struct dentry   *dentry)
+{
+        namep->name = dentry->d_name.name;
+        namep->len = dentry->d_name.len;
+        namep->type = XFS_DIR3_FT_UNKNOWN;
+}
+
+static int
+xfs_dentry_mode_to_name(
+        struct xfs_name *namep,
         struct dentry   *dentry,
         int             mode)
 {
         namep->name = dentry->d_name.name;
         namep->len = dentry->d_name.len;
-        namep->type = xfs_mode_to_ftype[(mode & S_IFMT) >> S_SHIFT];
+        namep->type = xfs_mode_to_ftype(mode);
+
+        if (unlikely(namep->type == XFS_DIR3_FT_UNKNOWN))
+                return -EFSCORRUPTED;
+
+        return 0;
 }
 
 STATIC void
@@ -119,7 +134,7 @@ xfs_cleanup_inode(
          * xfs_init_security we must back out.
          * ENOSPC can hit here, among other things.
          */
-        xfs_dentry_to_name(&teardown, dentry, 0);
+        xfs_dentry_to_name(&teardown, dentry);
 
         xfs_remove(XFS_I(dir), &teardown, XFS_I(inode));
 }
@@ -154,8 +169,12 @@ xfs_generic_create(
         if (error)
                 return error;
 
+        /* Verify mode is valid also for tmpfile case */
+        error = xfs_dentry_mode_to_name(&name, dentry, mode);
+        if (unlikely(error))
+                goto out_free_acl;
+
         if (!tmpfile) {
-                xfs_dentry_to_name(&name, dentry, mode);
                 error = xfs_create(XFS_I(dir), &name, mode, rdev, &ip);
         } else {
                 error = xfs_create_tmpfile(XFS_I(dir), dentry, mode, &ip);
@@ -248,7 +267,7 @@ xfs_vn_lookup(
         if (dentry->d_name.len >= MAXNAMELEN)
                 return ERR_PTR(-ENAMETOOLONG);
 
-        xfs_dentry_to_name(&name, dentry, 0);
+        xfs_dentry_to_name(&name, dentry);
         error = xfs_lookup(XFS_I(dir), &name, &cip, NULL);
         if (unlikely(error)) {
                 if (unlikely(error != -ENOENT))
@@ -275,7 +294,7 @@ xfs_vn_ci_lookup(
         if (dentry->d_name.len >= MAXNAMELEN)
                 return ERR_PTR(-ENAMETOOLONG);
 
-        xfs_dentry_to_name(&xname, dentry, 0);
+        xfs_dentry_to_name(&xname, dentry);
         error = xfs_lookup(XFS_I(dir), &xname, &ip, &ci_name);
         if (unlikely(error)) {
                 if (unlikely(error != -ENOENT))
@@ -310,7 +329,9 @@ xfs_vn_link(
         struct xfs_name name;
         int             error;
 
-        xfs_dentry_to_name(&name, dentry, inode->i_mode);
+        error = xfs_dentry_mode_to_name(&name, dentry, inode->i_mode);
+        if (unlikely(error))
+                return error;
 
         error = xfs_link(XFS_I(dir), XFS_I(inode), &name);
         if (unlikely(error))
@@ -329,7 +350,7 @@ xfs_vn_unlink(
         struct xfs_name name;
         int             error;
 
-        xfs_dentry_to_name(&name, dentry, 0);
+        xfs_dentry_to_name(&name, dentry);
 
         error = xfs_remove(XFS_I(dir), &name, XFS_I(d_inode(dentry)));
         if (error)
@@ -359,7 +380,9 @@ xfs_vn_symlink(
 
         mode = S_IFLNK |
                 (irix_symlink_mode ? 0777 & ~current_umask() : S_IRWXUGO);
-        xfs_dentry_to_name(&name, dentry, mode);
+        error = xfs_dentry_mode_to_name(&name, dentry, mode);
+        if (unlikely(error))
+                goto out;
 
         error = xfs_symlink(XFS_I(dir), &name, symname, mode, &cip);
         if (unlikely(error))
@@ -395,6 +418,7 @@ xfs_vn_rename(
 {
         struct inode    *new_inode = d_inode(ndentry);
         int             omode = 0;
+        int             error;
         struct xfs_name oname;
         struct xfs_name nname;
 
@@ -405,8 +429,14 @@ xfs_vn_rename(
         if (flags & RENAME_EXCHANGE)
                 omode = d_inode(ndentry)->i_mode;
 
-        xfs_dentry_to_name(&oname, odentry, omode);
-        xfs_dentry_to_name(&nname, ndentry, d_inode(odentry)->i_mode);
+        error = xfs_dentry_mode_to_name(&oname, odentry, omode);
+        if (omode && unlikely(error))
+                return error;
+
+        error = xfs_dentry_mode_to_name(&nname, ndentry,
+                                        d_inode(odentry)->i_mode);
+        if (unlikely(error))
+                return error;
 
         return xfs_rename(XFS_I(odir), &oname, XFS_I(d_inode(odentry)),
                           XFS_I(ndir), &nname,
diff --git a/fs/xfs/xfs_linux.h b/fs/xfs/xfs_linux.h
index e467218c0098..7a989de224f4 100644
--- a/fs/xfs/xfs_linux.h
+++ b/fs/xfs/xfs_linux.h
@@ -331,11 +331,11 @@ static inline __uint64_t howmany_64(__uint64_t x, __uint32_t y)
 }
 
 #define ASSERT_ALWAYS(expr)     \
-        (unlikely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
+        (likely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
 
 #ifdef DEBUG
 #define ASSERT(expr)    \
-        (unlikely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
+        (likely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
 
 #ifndef STATIC
 # define STATIC noinline
@@ -346,7 +346,7 @@ static inline __uint64_t howmany_64(__uint64_t x, __uint32_t y)
 #ifdef XFS_WARN
 
 #define ASSERT(expr)    \
-        (unlikely(expr) ? (void)0 : asswarn(#expr, __FILE__, __LINE__))
+        (likely(expr) ? (void)0 : asswarn(#expr, __FILE__, __LINE__))
 
 #ifndef STATIC
 # define STATIC static noinline
diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
index 982c299e435a..d026f5017c33 100644
--- a/include/drm/drm_crtc_helper.h
+++ b/include/drm/drm_crtc_helper.h
@@ -73,6 +73,5 @@ extern void drm_kms_helper_hotplug_event(struct drm_device *dev);
 
 extern void drm_kms_helper_poll_disable(struct drm_device *dev);
 extern void drm_kms_helper_poll_enable(struct drm_device *dev);
-extern void drm_kms_helper_poll_enable_locked(struct drm_device *dev);
 
 #endif
diff --git a/include/kvm/arm_arch_timer.h b/include/kvm/arm_arch_timer.h
index b717ed9d2b75..5c970ce67949 100644
--- a/include/kvm/arm_arch_timer.h
+++ b/include/kvm/arm_arch_timer.h
@@ -76,4 +76,5 @@ void kvm_timer_unschedule(struct kvm_vcpu *vcpu);
 
 void kvm_timer_vcpu_put(struct kvm_vcpu *vcpu);
 
+void kvm_timer_init_vhe(void);
 #endif
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index f74ae68086dc..05cf951df3fe 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -216,7 +216,7 @@ u64 bpf_tail_call(u64 ctx, u64 r2, u64 index, u64 r4, u64 r5);
 u64 bpf_get_stackid(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
 
 bool bpf_prog_array_compatible(struct bpf_array *array, const struct bpf_prog *fp);
-int bpf_prog_calc_digest(struct bpf_prog *fp);
+int bpf_prog_calc_tag(struct bpf_prog *fp);
 
 const struct bpf_func_proto *bpf_get_trace_printk_proto(void);
 
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index 20bfefbe7594..d936a0021839 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -74,6 +74,8 @@ enum cpuhp_state {
         CPUHP_ZCOMP_PREPARE,
         CPUHP_TIMERS_DEAD,
         CPUHP_MIPS_SOC_PREPARE,
+        CPUHP_BP_PREPARE_DYN,
+        CPUHP_BP_PREPARE_DYN_END                = CPUHP_BP_PREPARE_DYN + 20,
         CPUHP_BRINGUP_CPU,
         CPUHP_AP_IDLE_DEAD,
         CPUHP_AP_OFFLINE,
diff --git a/include/linux/filter.h b/include/linux/filter.h
index a0934e6c9bab..e4eb2546339a 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -57,6 +57,8 @@ struct bpf_prog_aux;
 /* BPF program can access up to 512 bytes of stack space. */
 #define MAX_BPF_STACK   512
 
+#define BPF_TAG_SIZE    8
+
 /* Helper macros for filter block array initializers. */
 
 /* ALU ops on registers, bpf_add|sub|...: dst_reg += src_reg */
@@ -408,7 +410,7 @@ struct bpf_prog {
         kmemcheck_bitfield_end(meta);
         enum bpf_prog_type      type;           /* Type of BPF program */
         u32                     len;            /* Number of filter blocks */
-        u32                     digest[SHA_DIGEST_WORDS]; /* Program digest */
+        u8                      tag[BPF_TAG_SIZE];
         struct bpf_prog_aux     *aux;           /* Auxiliary fields */
         struct sock_fprog_kern  *orig_prog;     /* Original BPF program */
         unsigned int            (*bpf_func)(const void *ctx,
@@ -519,7 +521,7 @@ static inline u32 bpf_prog_insn_size(const struct bpf_prog *prog)
         return prog->len * sizeof(struct bpf_insn);
 }
 
-static inline u32 bpf_prog_digest_scratch_size(const struct bpf_prog *prog)
+static inline u32 bpf_prog_tag_scratch_size(const struct bpf_prog *prog)
 {
         return round_up(bpf_prog_insn_size(prog) +
                         sizeof(__be64) + 1, SHA_MESSAGE_BYTES);
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 56aec84237ad..cb09238f6d32 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -514,8 +514,8 @@ extern enum system_states {
 #define TAINT_FLAGS_COUNT               16
 
 struct taint_flag {
-        char true;      /* character printed when tainted */
-        char false;     /* character printed when not tainted */
+        char c_true;    /* character printed when tainted */
+        char c_false;   /* character printed when not tainted */
         bool module;    /* also show as a per-module taint flag */
 };
 
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 321f9ed552a9..01f71e1d2e94 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -444,6 +444,10 @@ bool __rcu_is_watching(void);
 #error "Unknown RCU implementation specified to kernel configuration"
 #endif
 
+#define RCU_SCHEDULER_INACTIVE  0
+#define RCU_SCHEDULER_INIT      1
+#define RCU_SCHEDULER_RUNNING   2
+
 /*
  * init_rcu_head_on_stack()/destroy_rcu_head_on_stack() are needed for dynamic
  * initialization and destruction of rcu_head on the stack. rcu_head structures
diff --git a/include/linux/sunrpc/svc_xprt.h b/include/linux/sunrpc/svc_xprt.h
index e5d193440374..7440290f64ac 100644
--- a/include/linux/sunrpc/svc_xprt.h
+++ b/include/linux/sunrpc/svc_xprt.h
@@ -66,6 +66,7 @@ struct svc_xprt {
 #define XPT_LISTENER    10              /* listening endpoint */
 #define XPT_CACHE_AUTH  11              /* cache auth info */
 #define XPT_LOCAL       12              /* connection from loopback interface */
+#define XPT_KILL_TEMP   13              /* call xpo_kill_temp_xprt before closing */
 
         struct svc_serv         *xpt_server;    /* service for transport */
         atomic_t                xpt_reserved;   /* space on outq that is rsvd */
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index fc5848dad7a4..c93f4b3a59cb 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -62,8 +62,13 @@ static inline unsigned int tcp_optlen(const struct sk_buff *skb)
 
 /* TCP Fast Open Cookie as stored in memory */
 struct tcp_fastopen_cookie {
+        union {
+                u8      val[TCP_FASTOPEN_COOKIE_MAX];
+#if IS_ENABLED(CONFIG_IPV6)
+                struct in6_addr addr;
+#endif
+        };
         s8      len;
-        u8      val[TCP_FASTOPEN_COOKIE_MAX];
         bool    exp;    /* In RFC6994 experimental option format */
 };
 
diff --git a/include/scsi/libfc.h b/include/scsi/libfc.h
index 96dd0b3f70d7..da5033dd8cbc 100644
--- a/include/scsi/libfc.h
+++ b/include/scsi/libfc.h
@@ -809,11 +809,11 @@ static inline void fc_set_wwnn(struct fc_lport *lport, u64 wwnn)
 /**
  * fc_set_wwpn() - Set the World Wide Port Name of a local port
  * @lport: The local port whose WWPN is to be set
- * @wwnn:  The new WWPN
+ * @wwpn:  The new WWPN
  */
-static inline void fc_set_wwpn(struct fc_lport *lport, u64 wwnn)
+static inline void fc_set_wwpn(struct fc_lport *lport, u64 wwpn)
 {
-        lport->wwpn = wwnn;
+        lport->wwpn = wwpn;
 }
 
 /**
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 6b76e3b0c18e..bea982af9cfb 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -1772,7 +1772,9 @@ enum nl80211_commands {
  *
  * @NL80211_ATTR_OPMODE_NOTIF: Operating mode field from Operating Mode
  *      Notification Element based on association request when used with
- *      %NL80211_CMD_NEW_STATION; u8 attribute.
+ *      %NL80211_CMD_NEW_STATION or %NL80211_CMD_SET_STATION (only when
+ *      %NL80211_FEATURE_FULL_AP_CLIENT_STATE is supported, or with TDLS);
+ *      u8 attribute.
  *
  * @NL80211_ATTR_VENDOR_ID: The vendor ID, either a 24-bit OUI or, if
  *      %NL80211_VENDOR_ID_IS_LINUX is set, a special Linux ID (not used yet)
diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index cb4bcdc58543..a4dcd88ec271 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -397,7 +397,7 @@ enum {
         TCA_BPF_NAME,
         TCA_BPF_FLAGS,
         TCA_BPF_FLAGS_GEN,
-        TCA_BPF_DIGEST,
+        TCA_BPF_TAG,
         __TCA_BPF_MAX,
 };
 
diff --git a/include/uapi/linux/tc_act/tc_bpf.h b/include/uapi/linux/tc_act/tc_bpf.h
index a6b88a6f7f71..975b50dc8d1d 100644
--- a/include/uapi/linux/tc_act/tc_bpf.h
+++ b/include/uapi/linux/tc_act/tc_bpf.h
@@ -27,7 +27,7 @@ enum {
         TCA_ACT_BPF_FD,
         TCA_ACT_BPF_NAME,
         TCA_ACT_BPF_PAD,
-        TCA_ACT_BPF_DIGEST,
+        TCA_ACT_BPF_TAG,
         __TCA_ACT_BPF_MAX,
 };
 #define TCA_ACT_BPF_MAX (__TCA_ACT_BPF_MAX - 1)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 1eb4f1303756..503d4211988a 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -146,10 +146,11 @@ void __bpf_prog_free(struct bpf_prog *fp)
         vfree(fp);
 }
 
-int bpf_prog_calc_digest(struct bpf_prog *fp)
+int bpf_prog_calc_tag(struct bpf_prog *fp)
 {
         const u32 bits_offset = SHA_MESSAGE_BYTES - sizeof(__be64);
-        u32 raw_size = bpf_prog_digest_scratch_size(fp);
+        u32 raw_size = bpf_prog_tag_scratch_size(fp);
+        u32 digest[SHA_DIGEST_WORDS];
         u32 ws[SHA_WORKSPACE_WORDS];
         u32 i, bsize, psize, blocks;
         struct bpf_insn *dst;
@@ -162,7 +163,7 @@ int bpf_prog_calc_digest(struct bpf_prog *fp)
         if (!raw)
                 return -ENOMEM;
 
-        sha_init(fp->digest);
+        sha_init(digest);
         memset(ws, 0, sizeof(ws));
 
         /* We need to take out the map fd for the digest calculation
@@ -204,13 +205,14 @@ int bpf_prog_calc_digest(struct bpf_prog *fp)
         *bits = cpu_to_be64((psize - 1) << 3);
 
         while (blocks--) {
-                sha_transform(fp->digest, todo, ws);
+                sha_transform(digest, todo, ws);
                 todo += SHA_MESSAGE_BYTES;
         }
 
-        result = (__force __be32 *)fp->digest;
+        result = (__force __be32 *)digest;
         for (i = 0; i < SHA_DIGEST_WORDS; i++)
-                result[i] = cpu_to_be32(fp->digest[i]);
+                result[i] = cpu_to_be32(digest[i]);
+        memcpy(fp->tag, result, sizeof(fp->tag));
 
         vfree(raw);
         return 0;
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index e89acea22ecf..1d6b29e4e2c3 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -688,17 +688,17 @@ static int bpf_prog_release(struct inode *inode, struct file *filp)
 static void bpf_prog_show_fdinfo(struct seq_file *m, struct file *filp)
 {
         const struct bpf_prog *prog = filp->private_data;
-        char prog_digest[sizeof(prog->digest) * 2 + 1] = { };
+        char prog_tag[sizeof(prog->tag) * 2 + 1] = { };
 
-        bin2hex(prog_digest, prog->digest, sizeof(prog->digest));
+        bin2hex(prog_tag, prog->tag, sizeof(prog->tag));
         seq_printf(m,
                    "prog_type:\t%u\n"
                    "prog_jited:\t%u\n"
-                   "prog_digest:\t%s\n"
+                   "prog_tag:\t%s\n"
                    "memlock:\t%llu\n",
                    prog->type,
                    prog->jited,
-                   prog_digest,
+                   prog_tag,
                    prog->pages * 1ULL << PAGE_SHIFT);
 }
 #endif
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 83ed2f8f6f22..cdc43b899f28 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2936,7 +2936,7 @@ static int replace_map_fd_with_map_ptr(struct bpf_verifier_env *env)
         int insn_cnt = env->prog->len;
         int i, j, err;
 
-        err = bpf_prog_calc_digest(env->prog);
+        err = bpf_prog_calc_tag(env->prog);
         if (err)
                 return err;
 
diff --git a/kernel/cpu.c b/kernel/cpu.c
index f75c4d031eeb..0a5f630f5c54 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -764,7 +764,6 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen,
 {
         struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, cpu);
         int prev_state, ret = 0;
-        bool hasdied = false;
 
         if (num_online_cpus() == 1)
                 return -EBUSY;
@@ -809,7 +808,6 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen,
                 cpuhp_kick_ap_work(cpu);
         }
 
-        hasdied = prev_state != st->state && st->state == CPUHP_OFFLINE;
 out:
         cpu_hotplug_done();
         return ret;
@@ -1302,10 +1300,24 @@ static int cpuhp_cb_check(enum cpuhp_state state)
  */
 static int cpuhp_reserve_state(enum cpuhp_state state)
 {
-        enum cpuhp_state i;
+        enum cpuhp_state i, end;
+        struct cpuhp_step *step;
 
-        for (i = CPUHP_AP_ONLINE_DYN; i <= CPUHP_AP_ONLINE_DYN_END; i++) {
-                if (!cpuhp_ap_states[i].name)
+        switch (state) {
+        case CPUHP_AP_ONLINE_DYN:
+                step = cpuhp_ap_states + CPUHP_AP_ONLINE_DYN;
+                end = CPUHP_AP_ONLINE_DYN_END;
+                break;
+        case CPUHP_BP_PREPARE_DYN:
+                step = cpuhp_bp_states + CPUHP_BP_PREPARE_DYN;
+                end = CPUHP_BP_PREPARE_DYN_END;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        for (i = state; i <= end; i++, step++) {
+                if (!step->name)
                         return i;
         }
         WARN(1, "No more dynamic states available for CPU hotplug\n");
@@ -1323,7 +1335,7 @@ static int cpuhp_store_callbacks(enum cpuhp_state state, const char *name,
 
         mutex_lock(&cpuhp_state_mutex);
 
-        if (state == CPUHP_AP_ONLINE_DYN) {
+        if (state == CPUHP_AP_ONLINE_DYN || state == CPUHP_BP_PREPARE_DYN) {
                 ret = cpuhp_reserve_state(state);
                 if (ret < 0)
                         goto out;
diff --git a/kernel/module.c b/kernel/module.c
index 5088784c0cf9..38d4270925d4 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1145,7 +1145,7 @@ static size_t module_flags_taint(struct module *mod, char *buf)
 
         for (i = 0; i < TAINT_FLAGS_COUNT; i++) {
                 if (taint_flags[i].module && test_bit(i, &mod->taints))
-                        buf[l++] = taint_flags[i].true;
+                        buf[l++] = taint_flags[i].c_true;
         }
 
         return l;
diff --git a/kernel/panic.c b/kernel/panic.c
index c51edaa04fce..901c4fb46002 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -355,7 +355,7 @@ const char *print_tainted(void)
                 for (i = 0; i < TAINT_FLAGS_COUNT; i++) {
                         const struct taint_flag *t = &taint_flags[i];
                         *s++ = test_bit(i, &tainted_mask) ?
-                                        t->true : t->false;
+                                        t->c_true : t->c_false;
                 }
                 *s = 0;
         } else
diff --git a/kernel/rcu/rcu.h b/kernel/rcu/rcu.h
index 80adef7d4c3d..0d6ff3e471be 100644
--- a/kernel/rcu/rcu.h
+++ b/kernel/rcu/rcu.h
@@ -136,6 +136,7 @@ int rcu_jiffies_till_stall_check(void);
 #define TPS(x)  tracepoint_string(x)
 
 void rcu_early_boot_tests(void);
+void rcu_test_sync_prims(void);
 
 /*
  * This function really isn't for public consumption, but RCU is special in
diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
index 1898559e6b60..b23a4d076f3d 100644
--- a/kernel/rcu/tiny.c
+++ b/kernel/rcu/tiny.c
@@ -185,9 +185,6 @@ static __latent_entropy void rcu_process_callbacks(struct softirq_action *unused
  * benefits of doing might_sleep() to reduce latency.)
  *
  * Cool, huh?  (Due to Josh Triplett.)
- *
- * But we want to make this a static inline later.  The cond_resched()
- * currently makes this problematic.
  */
 void synchronize_sched(void)
 {
@@ -195,7 +192,6 @@ void synchronize_sched(void)
                          lock_is_held(&rcu_lock_map) ||
                          lock_is_held(&rcu_sched_lock_map),
                          "Illegal synchronize_sched() in RCU read-side critical section");
-        cond_resched();
 }
 EXPORT_SYMBOL_GPL(synchronize_sched);
 
diff --git a/kernel/rcu/tiny_plugin.h b/kernel/rcu/tiny_plugin.h
index 196f0302e2f4..c64b827ecbca 100644
--- a/kernel/rcu/tiny_plugin.h
+++ b/kernel/rcu/tiny_plugin.h
@@ -60,12 +60,17 @@ EXPORT_SYMBOL_GPL(rcu_scheduler_active);
 
 /*
  * During boot, we forgive RCU lockdep issues.  After this function is
- * invoked, we start taking RCU lockdep issues seriously.
+ * invoked, we start taking RCU lockdep issues seriously.  Note that unlike
+ * Tree RCU, Tiny RCU transitions directly from RCU_SCHEDULER_INACTIVE
+ * to RCU_SCHEDULER_RUNNING, skipping the RCU_SCHEDULER_INIT stage.
+ * The reason for this is that Tiny RCU does not need kthreads, so does
+ * not have to care about the fact that the scheduler is half-initialized
+ * at a certain phase of the boot process.
  */
 void __init rcu_scheduler_starting(void)
 {
         WARN_ON(nr_context_switches() > 0);
-        rcu_scheduler_active = 1;
+        rcu_scheduler_active = RCU_SCHEDULER_RUNNING;
 }
 
 #endif /* #ifdef CONFIG_DEBUG_LOCK_ALLOC */
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 96c52e43f7ca..cb4e2056ccf3 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -127,13 +127,16 @@ int rcu_num_nodes __read_mostly = NUM_RCU_NODES; /* Total # rcu_nodes in use. */
 int sysctl_panic_on_rcu_stall __read_mostly;
 
 /*
- * The rcu_scheduler_active variable transitions from zero to one just
- * before the first task is spawned.  So when this variable is zero, RCU
- * can assume that there is but one task, allowing RCU to (for example)
+ * The rcu_scheduler_active variable is initialized to the value
+ * RCU_SCHEDULER_INACTIVE and transitions RCU_SCHEDULER_INIT just before the
+ * first task is spawned.  So when this variable is RCU_SCHEDULER_INACTIVE,
+ * RCU can assume that there is but one task, allowing RCU to (for example)
  * optimize synchronize_rcu() to a simple barrier().  When this variable
- * is one, RCU must actually do all the hard work required to detect real
- * grace periods.  This variable is also used to suppress boot-time false
- * positives from lockdep-RCU error checking.
+ * is RCU_SCHEDULER_INIT, RCU must actually do all the hard work required
+ * to detect real grace periods.  This variable is also used to suppress
+ * boot-time false positives from lockdep-RCU error checking.  Finally, it
+ * transitions from RCU_SCHEDULER_INIT to RCU_SCHEDULER_RUNNING after RCU
+ * is fully initialized, including all of its kthreads having been spawned.
  */
 int rcu_scheduler_active __read_mostly;
 EXPORT_SYMBOL_GPL(rcu_scheduler_active);
@@ -3980,18 +3983,22 @@ static int __init rcu_spawn_gp_kthread(void)
 early_initcall(rcu_spawn_gp_kthread);
 
 /*
- * This function is invoked towards the end of the scheduler's initialization
- * process.  Before this is called, the idle task might contain
- * RCU read-side critical sections (during which time, this idle
- * task is booting the system).  After this function is called, the
- * idle tasks are prohibited from containing RCU read-side critical
- * sections.  This function also enables RCU lockdep checking.
+ * This function is invoked towards the end of the scheduler's
+ * initialization process.  Before this is called, the idle task might
+ * contain synchronous grace-period primitives (during which time, this idle
+ * task is booting the system, and such primitives are no-ops).  After this
+ * function is called, any synchronous grace-period primitives are run as
+ * expedited, with the requesting task driving the grace period forward.
+ * A later core_initcall() rcu_exp_runtime_mode() will switch to full
+ * runtime RCU functionality.
  */
 void rcu_scheduler_starting(void)
 {
         WARN_ON(num_online_cpus() != 1);
         WARN_ON(nr_context_switches() > 0);
-        rcu_scheduler_active = 1;
+        rcu_test_sync_prims();
+        rcu_scheduler_active = RCU_SCHEDULER_INIT;
+        rcu_test_sync_prims();
 }
 
 /*
diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
index d3053e99fdb6..e59e1849b89a 100644
--- a/kernel/rcu/tree_exp.h
+++ b/kernel/rcu/tree_exp.h
@@ -532,18 +532,28 @@ struct rcu_exp_work {
 };
 
 /*
+ * Common code to drive an expedited grace period forward, used by
+ * workqueues and mid-boot-time tasks.
+ */
+static void rcu_exp_sel_wait_wake(struct rcu_state *rsp,
+                                  smp_call_func_t func, unsigned long s)
+{
+        /* Initialize the rcu_node tree in preparation for the wait. */
+        sync_rcu_exp_select_cpus(rsp, func);
+
+        /* Wait and clean up, including waking everyone. */
+        rcu_exp_wait_wake(rsp, s);
+}
+
+/*
  * Work-queue handler to drive an expedited grace period forward.
  */
 static void wait_rcu_exp_gp(struct work_struct *wp)
 {
         struct rcu_exp_work *rewp;
 
-        /* Initialize the rcu_node tree in preparation for the wait. */
         rewp = container_of(wp, struct rcu_exp_work, rew_work);
-        sync_rcu_exp_select_cpus(rewp->rew_rsp, rewp->rew_func);
-
-        /* Wait and clean up, including waking everyone. */
-        rcu_exp_wait_wake(rewp->rew_rsp, rewp->rew_s);
+        rcu_exp_sel_wait_wake(rewp->rew_rsp, rewp->rew_func, rewp->rew_s);
 }
 
 /*
@@ -569,12 +579,18 @@ static void _synchronize_rcu_expedited(struct rcu_state *rsp,
         if (exp_funnel_lock(rsp, s))
                 return;  /* Someone else did our work for us. */
 
-        /* Marshall arguments and schedule the expedited grace period. */
-        rew.rew_func = func;
-        rew.rew_rsp = rsp;
-        rew.rew_s = s;
-        INIT_WORK_ONSTACK(&rew.rew_work, wait_rcu_exp_gp);
-        schedule_work(&rew.rew_work);
+        /* Ensure that load happens before action based on it. */
+        if (unlikely(rcu_scheduler_active == RCU_SCHEDULER_INIT)) {
+                /* Direct call during scheduler init and early_initcalls(). */
+                rcu_exp_sel_wait_wake(rsp, func, s);
+        } else {
+                /* Marshall arguments & schedule the expedited grace period. */
+                rew.rew_func = func;
+                rew.rew_rsp = rsp;
+                rew.rew_s = s;
+                INIT_WORK_ONSTACK(&rew.rew_work, wait_rcu_exp_gp);
+                schedule_work(&rew.rew_work);
+        }
 
         /* Wait for expedited grace period to complete. */
         rdp = per_cpu_ptr(rsp->rda, raw_smp_processor_id());
@@ -676,6 +692,8 @@ void synchronize_rcu_expedited(void)
 {
         struct rcu_state *rsp = rcu_state_p;
 
+        if (rcu_scheduler_active == RCU_SCHEDULER_INACTIVE)
+                return;
         _synchronize_rcu_expedited(rsp, sync_rcu_exp_handler);
 }
 EXPORT_SYMBOL_GPL(synchronize_rcu_expedited);
@@ -693,3 +711,15 @@ void synchronize_rcu_expedited(void)
 EXPORT_SYMBOL_GPL(synchronize_rcu_expedited);
 
 #endif /* #else #ifdef CONFIG_PREEMPT_RCU */
+
+/*
+ * Switch to run-time mode once Tree RCU has fully initialized.
+ */
+static int __init rcu_exp_runtime_mode(void)
+{
+        rcu_test_sync_prims();
+        rcu_scheduler_active = RCU_SCHEDULER_RUNNING;
+        rcu_test_sync_prims();
+        return 0;
+}
+core_initcall(rcu_exp_runtime_mode);
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index 85c5a883c6e3..56583e764ebf 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -670,7 +670,7 @@ void synchronize_rcu(void)
                          lock_is_held(&rcu_lock_map) ||
                          lock_is_held(&rcu_sched_lock_map),
                          "Illegal synchronize_rcu() in RCU read-side critical section");
-        if (!rcu_scheduler_active)
+        if (rcu_scheduler_active == RCU_SCHEDULER_INACTIVE)
                 return;
         if (rcu_gp_is_expedited())
                 synchronize_rcu_expedited();
diff --git a/kernel/rcu/update.c b/kernel/rcu/update.c
index f19271dce0a9..4f6db7e6a117 100644
--- a/kernel/rcu/update.c
+++ b/kernel/rcu/update.c
@@ -121,11 +121,14 @@ EXPORT_SYMBOL(rcu_read_lock_sched_held);
  * Should expedited grace-period primitives always fall back to their
  * non-expedited counterparts?  Intended for use within RCU.  Note
  * that if the user specifies both rcu_expedited and rcu_normal, then
- * rcu_normal wins.
+ * rcu_normal wins.  (Except during the time period during boot from
+ * when the first task is spawned until the rcu_exp_runtime_mode()
+ * core_initcall() is invoked, at which point everything is expedited.)
  */
 bool rcu_gp_is_normal(void)
 {
-        return READ_ONCE(rcu_normal);
+        return READ_ONCE(rcu_normal) &&
+               rcu_scheduler_active != RCU_SCHEDULER_INIT;
 }
 EXPORT_SYMBOL_GPL(rcu_gp_is_normal);
 
@@ -135,13 +138,14 @@ static atomic_t rcu_expedited_nesting =
 /*
  * Should normal grace-period primitives be expedited?  Intended for
  * use within RCU.  Note that this function takes the rcu_expedited
- * sysfs/boot variable into account as well as the rcu_expedite_gp()
- * nesting.  So looping on rcu_unexpedite_gp() until rcu_gp_is_expedited()
- * returns false is a -really- bad idea.
+ * sysfs/boot variable and rcu_scheduler_active into account as well
+ * as the rcu_expedite_gp() nesting.  So looping on rcu_unexpedite_gp()
+ * until rcu_gp_is_expedited() returns false is a -really- bad idea.
  */
 bool rcu_gp_is_expedited(void)
 {
-        return rcu_expedited || atomic_read(&rcu_expedited_nesting);
+        return rcu_expedited || atomic_read(&rcu_expedited_nesting) ||
+               rcu_scheduler_active == RCU_SCHEDULER_INIT;
 }
 EXPORT_SYMBOL_GPL(rcu_gp_is_expedited);
 
@@ -257,7 +261,7 @@ EXPORT_SYMBOL_GPL(rcu_callback_map);
 
 int notrace debug_lockdep_rcu_enabled(void)
 {
-        return rcu_scheduler_active && debug_locks &&
+        return rcu_scheduler_active != RCU_SCHEDULER_INACTIVE && debug_locks &&
                current->lockdep_recursion == 0;
 }
 EXPORT_SYMBOL_GPL(debug_lockdep_rcu_enabled);
@@ -591,7 +595,7 @@ EXPORT_SYMBOL_GPL(call_rcu_tasks);
 void synchronize_rcu_tasks(void)
 {
         /* Complain if the scheduler has not started.  */
-        RCU_LOCKDEP_WARN(!rcu_scheduler_active,
+        RCU_LOCKDEP_WARN(rcu_scheduler_active == RCU_SCHEDULER_INACTIVE,
                          "synchronize_rcu_tasks called too soon");
 
         /* Wait for the grace period. */
@@ -813,6 +817,23 @@ static void rcu_spawn_tasks_kthread(void)
 
 #endif /* #ifdef CONFIG_TASKS_RCU */
 
+/*
+ * Test each non-SRCU synchronous grace-period wait API.  This is
+ * useful just after a change in mode for these primitives, and
+ * during early boot.
+ */
+void rcu_test_sync_prims(void)
+{
+        if (!IS_ENABLED(CONFIG_PROVE_RCU))
+                return;
+        synchronize_rcu();
+        synchronize_rcu_bh();
+        synchronize_sched();
+        synchronize_rcu_expedited();
+        synchronize_rcu_bh_expedited();
+        synchronize_sched_expedited();
+}
+
 #ifdef CONFIG_PROVE_RCU
 
 /*
@@ -865,6 +886,7 @@ void rcu_early_boot_tests(void)
                 early_boot_test_call_rcu_bh();
         if (rcu_self_test_sched)
                 early_boot_test_call_rcu_sched();
+        rcu_test_sync_prims();
 }
 
 static int rcu_verify_early_boot_tests(void)
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 975b8fc4f1e1..a8d74a733a38 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -483,11 +483,11 @@ phys_addr_t swiotlb_tbl_map_single(struct device *hwdev,
                     : 1UL << (BITS_PER_LONG - IO_TLB_SHIFT);
 
         /*
-         * For mappings greater than a page, we limit the stride (and
-         * hence alignment) to a page size.
+         * For mappings greater than or equal to a page, we limit the stride
+         * (and hence alignment) to a page size.
          */
         nslots = ALIGN(size, 1 << IO_TLB_SHIFT) >> IO_TLB_SHIFT;
-        if (size > PAGE_SIZE)
+        if (size >= PAGE_SIZE)
                 stride = (1 << (PAGE_SHIFT - IO_TLB_SHIFT));
         else
                 stride = 1;
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index 4855d18a8511..038b109b2be7 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -264,7 +264,7 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
 {
         ax25_clear_queues(ax25);
 
-        if (!sock_flag(ax25->sk, SOCK_DESTROY))
+        if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY))
                 ax25_stop_heartbeat(ax25);
         ax25_stop_t1timer(ax25);
         ax25_stop_t2timer(ax25);
diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
index 3949ce70be07..292e33bd916e 100644
--- a/net/ceph/crypto.c
+++ b/net/ceph/crypto.c
@@ -214,7 +214,7 @@ static int ceph_aes_crypt(const struct ceph_crypto_key *key, bool encrypt,
         SKCIPHER_REQUEST_ON_STACK(req, key->tfm);
         struct sg_table sgt;
         struct scatterlist prealloc_sg;
-        char iv[AES_BLOCK_SIZE];
+        char iv[AES_BLOCK_SIZE] __aligned(8);
         int pad_byte = AES_BLOCK_SIZE - (in_len & (AES_BLOCK_SIZE - 1));
         int crypt_len = encrypt ? in_len + pad_byte : in_len;
         int ret;
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index eba1546b5031..9a375b908d01 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1279,8 +1279,9 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
                     nla_put_u32(skb, RTA_FLOW, fi->fib_nh[0].nh_tclassid))
                         goto nla_put_failure;
 #endif
-                if (fi->fib_nh->nh_lwtstate)
-                        lwtunnel_fill_encap(skb, fi->fib_nh->nh_lwtstate);
+                if (fi->fib_nh->nh_lwtstate &&
+                    lwtunnel_fill_encap(skb, fi->fib_nh->nh_lwtstate) < 0)
+                        goto nla_put_failure;
         }
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
         if (fi->fib_nhs > 1) {
@@ -1316,8 +1317,10 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
                             nla_put_u32(skb, RTA_FLOW, nh->nh_tclassid))
                                 goto nla_put_failure;
 #endif
-                        if (nh->nh_lwtstate)
-                                lwtunnel_fill_encap(skb, nh->nh_lwtstate);
+                        if (nh->nh_lwtstate &&
+                            lwtunnel_fill_encap(skb, nh->nh_lwtstate) < 0)
+                                goto nla_put_failure;
+
                         /* length of rtnetlink header + attributes */
                         rtnh->rtnh_len = nlmsg_get_pos(skb) - (void *) rtnh;
                 } endfor_nexthops(fi);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 0fcac8e7a2b2..709ffe67d1de 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2472,7 +2472,7 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src, u32 table_id,
         r->rtm_dst_len  = 32;
         r->rtm_src_len  = 0;
         r->rtm_tos      = fl4->flowi4_tos;
-        r->rtm_table    = table_id;
+        r->rtm_table    = table_id < 256 ? table_id : RT_TABLE_COMPAT;
         if (nla_put_u32(skb, RTA_TABLE, table_id))
                 goto nla_put_failure;
         r->rtm_type     = rt->rt_type;
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 4e777a3243f9..f51919535ca7 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -113,7 +113,7 @@ static bool tcp_fastopen_cookie_gen(struct request_sock *req,
                 struct tcp_fastopen_cookie tmp;
 
                 if (__tcp_fastopen_cookie_gen(&ip6h->saddr, &tmp)) {
-                        struct in6_addr *buf = (struct in6_addr *) tmp.val;
+                        struct in6_addr *buf = &tmp.addr;
                         int i;
 
                         for (i = 0; i < 4; i++)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 36d292180942..753d6d0860fb 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1108,7 +1108,7 @@ route_lookup:
                                      t->parms.name);
                 goto tx_err_dst_release;
         }
-        mtu = dst_mtu(dst) - psh_hlen;
+        mtu = dst_mtu(dst) - psh_hlen - t->tun_hlen;
         if (encap_limit >= 0) {
                 max_headroom += 8;
                 mtu -= 8;
@@ -1117,7 +1117,7 @@ route_lookup:
                 mtu = IPV6_MIN_MTU;
         if (skb_dst(skb) && !t->parms.collect_md)
                 skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
-        if (skb->len > mtu && !skb_is_gso(skb)) {
+        if (skb->len - t->tun_hlen > mtu && !skb_is_gso(skb)) {
                 *pmtu = mtu;
                 err = -EMSGSIZE;
                 goto tx_err_dst_release;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 14a3903f1c82..7139fffd61b6 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -81,7 +81,7 @@ static void mld_gq_timer_expire(unsigned long data);
 static void mld_ifc_timer_expire(unsigned long data);
 static void mld_ifc_event(struct inet6_dev *idev);
 static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
-static void mld_del_delrec(struct inet6_dev *idev, const struct in6_addr *addr);
+static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
 static void mld_clear_delrec(struct inet6_dev *idev);
 static bool mld_in_v1_mode(const struct inet6_dev *idev);
 static int sf_setstate(struct ifmcaddr6 *pmc);
@@ -692,9 +692,9 @@ static void igmp6_group_dropped(struct ifmcaddr6 *mc)
                         dev_mc_del(dev, buf);
         }
 
-        if (mc->mca_flags & MAF_NOREPORT)
-                goto done;
         spin_unlock_bh(&mc->mca_lock);
+        if (mc->mca_flags & MAF_NOREPORT)
+                return;
 
         if (!mc->idev->dead)
                 igmp6_leave_group(mc);
@@ -702,8 +702,6 @@ static void igmp6_group_dropped(struct ifmcaddr6 *mc)
         spin_lock_bh(&mc->mca_lock);
         if (del_timer(&mc->mca_timer))
                 atomic_dec(&mc->mca_refcnt);
-done:
-        ip6_mc_clear_src(mc);
         spin_unlock_bh(&mc->mca_lock);
 }
 
@@ -748,10 +746,11 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
         spin_unlock_bh(&idev->mc_lock);
 }
 
-static void mld_del_delrec(struct inet6_dev *idev, const struct in6_addr *pmca)
+static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
 {
         struct ifmcaddr6 *pmc, *pmc_prev;
-        struct ip6_sf_list *psf, *psf_next;
+        struct ip6_sf_list *psf;
+        struct in6_addr *pmca = &im->mca_addr;
 
         spin_lock_bh(&idev->mc_lock);
         pmc_prev = NULL;
@@ -768,14 +767,20 @@ static void mld_del_delrec(struct inet6_dev *idev, const struct in6_addr *pmca)
         }
         spin_unlock_bh(&idev->mc_lock);
 
+        spin_lock_bh(&im->mca_lock);
         if (pmc) {
-                for (psf = pmc->mca_tomb; psf; psf = psf_next) {
-                        psf_next = psf->sf_next;
-                        kfree(psf);
+                im->idev = pmc->idev;
+                im->mca_crcount = idev->mc_qrv;
+                im->mca_sfmode = pmc->mca_sfmode;
+                if (pmc->mca_sfmode == MCAST_INCLUDE) {
+                        im->mca_tomb = pmc->mca_tomb;
+                        im->mca_sources = pmc->mca_sources;
+                        for (psf = im->mca_sources; psf; psf = psf->sf_next)
+                                psf->sf_crcount = im->mca_crcount;
                 }
                 in6_dev_put(pmc->idev);
-                kfree(pmc);
         }
+        spin_unlock_bh(&im->mca_lock);
 }
 
 static void mld_clear_delrec(struct inet6_dev *idev)
@@ -904,7 +909,7 @@ int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
         mca_get(mc);
         write_unlock_bh(&idev->lock);
 
-        mld_del_delrec(idev, &mc->mca_addr);
+        mld_del_delrec(idev, mc);
         igmp6_group_added(mc);
         ma_put(mc);
         return 0;
@@ -927,6 +932,7 @@ int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr)
                                 write_unlock_bh(&idev->lock);
 
                                 igmp6_group_dropped(ma);
+                                ip6_mc_clear_src(ma);
 
                                 ma_put(ma);
                                 return 0;
@@ -2501,15 +2507,17 @@ void ipv6_mc_down(struct inet6_dev *idev)
         /* Withdraw multicast list */
 
         read_lock_bh(&idev->lock);
-        mld_ifc_stop_timer(idev);
-        mld_gq_stop_timer(idev);
-        mld_dad_stop_timer(idev);
 
         for (i = idev->mc_list; i; i = i->next)
                 igmp6_group_dropped(i);
-        read_unlock_bh(&idev->lock);
 
-        mld_clear_delrec(idev);
+        /* Should stop timer after group drop. or we will
+         * start timer again in mld_ifc_event()
+         */
+        mld_ifc_stop_timer(idev);
+        mld_gq_stop_timer(idev);
+        mld_dad_stop_timer(idev);
+        read_unlock_bh(&idev->lock);
 }
 
 static void ipv6_mc_reset(struct inet6_dev *idev)
@@ -2531,8 +2539,10 @@ void ipv6_mc_up(struct inet6_dev *idev)
 
         read_lock_bh(&idev->lock);
         ipv6_mc_reset(idev);
-        for (i = idev->mc_list; i; i = i->next)
+        for (i = idev->mc_list; i; i = i->next) {
+                mld_del_delrec(idev, i);
                 igmp6_group_added(i);
+        }
         read_unlock_bh(&idev->lock);
 }
 
@@ -2565,6 +2575,7 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev)
 
         /* Deactivate timers */
         ipv6_mc_down(idev);
+        mld_clear_delrec(idev);
 
         /* Delete all-nodes address. */
         /* We cannot call ipv6_dev_mc_dec() directly, our caller in
@@ -2579,11 +2590,9 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev)
         write_lock_bh(&idev->lock);
         while ((i = idev->mc_list) != NULL) {
                 idev->mc_list = i->next;
-                write_unlock_bh(&idev->lock);
 
-                igmp6_group_dropped(i);
+                write_unlock_bh(&idev->lock);
                 ma_put(i);
-
                 write_lock_bh(&idev->lock);
         }
         write_unlock_bh(&idev->lock);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index ce5aaf448c54..4f6b067c8753 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3317,7 +3317,8 @@ static int rt6_fill_node(struct net *net,
         if (nla_put_u8(skb, RTA_PREF, IPV6_EXTRACT_PREF(rt->rt6i_flags)))
                 goto nla_put_failure;
 
-        lwtunnel_fill_encap(skb, rt->dst.lwtstate);
+        if (lwtunnel_fill_encap(skb, rt->dst.lwtstate) < 0)
+                goto nla_put_failure;
 
         nlmsg_end(skb, nlh);
         return 0;
diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c
index ef1c8a46e7ac..03a064803626 100644
--- a/net/ipv6/seg6_hmac.c
+++ b/net/ipv6/seg6_hmac.c
@@ -400,7 +400,7 @@ static int seg6_hmac_init_algo(void)
                         *p_tfm = tfm;
                 }
 
-                p_tfm = this_cpu_ptr(algo->tfms);
+                p_tfm = raw_cpu_ptr(algo->tfms);
                 tfm = *p_tfm;
 
                 shsize = sizeof(*shash) + crypto_shash_descsize(tfm);
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index bbfca22c34ae..1d60cb132835 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -265,7 +265,9 @@ int seg6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
         slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate);
 
 #ifdef CONFIG_DST_CACHE
+        preempt_disable();
         dst = dst_cache_get(&slwt->cache);
+        preempt_enable();
 #endif
 
         if (unlikely(!dst)) {
@@ -286,7 +288,9 @@ int seg6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
                 }
 
 #ifdef CONFIG_DST_CACHE
+                preempt_disable();
                 dst_cache_set_ip6(&slwt->cache, dst, &fl6.saddr);
+                preempt_enable();
 #endif
         }
 
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index e75cbf6ecc26..a0d901d8992e 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -231,9 +231,6 @@ ieee80211_get_max_required_bw(struct ieee80211_sub_if_data *sdata)
                     !(sta->sdata->bss && sta->sdata->bss == sdata->bss))
                         continue;
 
-                if (!sta->uploaded || !test_sta_flag(sta, WLAN_STA_ASSOC))
-                        continue;
-
                 max_bw = max(max_bw, ieee80211_get_sta_bw(&sta->sta));
         }
         rcu_read_unlock();
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 41497b670e2b..d37ae7dc114b 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -6,6 +6,7 @@
  * Copyright (c) 2006 Jiri Benc <jbenc@suse.cz>
  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2013-2014  Intel Mobile Communications GmbH
+ * Copyright (c) 2016        Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -1295,6 +1296,26 @@ static void ieee80211_iface_work(struct work_struct *work)
                 } else if (ieee80211_is_action(mgmt->frame_control) &&
                            mgmt->u.action.category == WLAN_CATEGORY_VHT) {
                         switch (mgmt->u.action.u.vht_group_notif.action_code) {
+                        case WLAN_VHT_ACTION_OPMODE_NOTIF: {
+                                struct ieee80211_rx_status *status;
+                                enum nl80211_band band;
+                                u8 opmode;
+
+                                status = IEEE80211_SKB_RXCB(skb);
+                                band = status->band;
+                                opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
+
+                                mutex_lock(&local->sta_mtx);
+                                sta = sta_info_get_bss(sdata, mgmt->sa);
+
+                                if (sta)
+                                        ieee80211_vht_handle_opmode(sdata, sta,
+                                                                    opmode,
+                                                                    band);
+
+                                mutex_unlock(&local->sta_mtx);
+                                break;
+                        }
                         case WLAN_VHT_ACTION_GROUPID_MGMT:
                                 ieee80211_process_mu_groups(sdata, mgmt);
                                 break;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 1822c77f2b1c..56fb47953b72 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -913,12 +913,17 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 supp_ht = supp_ht || sband->ht_cap.ht_supported;
                 supp_vht = supp_vht || sband->vht_cap.vht_supported;
 
-                if (sband->ht_cap.ht_supported)
-                        local->rx_chains =
-                                max(ieee80211_mcs_to_chains(&sband->ht_cap.mcs),
-                                    local->rx_chains);
+                if (!sband->ht_cap.ht_supported)
+                        continue;
 
                 /* TODO: consider VHT for RX chains, hopefully it's the same */
+                local->rx_chains =
+                        max(ieee80211_mcs_to_chains(&sband->ht_cap.mcs),
+                            local->rx_chains);
+
+                /* no need to mask, SM_PS_DISABLED has all bits set */
+                sband->ht_cap.cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
+                                     IEEE80211_HT_CAP_SM_PS_SHIFT;
         }
 
         /* if low-level driver supports AP, we also support VLAN */
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 206698bc93f4..9e2641d45587 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -40,6 +40,8 @@ void rate_control_rate_init(struct sta_info *sta)
 
         ieee80211_sta_set_rx_nss(sta);
 
+        ieee80211_recalc_min_chandef(sta->sdata);
+
         if (!ref)
                 return;
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 3e289a64ed43..3090dd4342f6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2472,7 +2472,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         if (!ifmsh->mshcfg.dot11MeshForwarding)
                 goto out;
 
-        fwd_skb = skb_copy_expand(skb, local->tx_headroom, 0, GFP_ATOMIC);
+        fwd_skb = skb_copy_expand(skb, local->tx_headroom +
+                                       sdata->encrypt_headroom, 0, GFP_ATOMIC);
         if (!fwd_skb) {
                 net_info_ratelimited("%s: failed to clone mesh frame\n",
                                     sdata->name);
@@ -2880,17 +2881,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 
                 switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
                 case WLAN_VHT_ACTION_OPMODE_NOTIF: {
-                        u8 opmode;
-
                         /* verify opmode is present */
                         if (len < IEEE80211_MIN_ACTION_SIZE + 2)
                                 goto invalid;
-
-                        opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
-
-                        ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
-                                                    opmode, status->band);
-                        goto handled;
+                        goto queue;
                 }
                 case WLAN_VHT_ACTION_GROUPID_MGMT: {
                         if (len < IEEE80211_MIN_ACTION_SIZE + 25)
@@ -3942,21 +3936,31 @@ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
         u64_stats_update_end(&stats->syncp);
 
         if (fast_rx->internal_forward) {
-                struct sta_info *dsta = sta_info_get(rx->sdata, skb->data);
+                struct sk_buff *xmit_skb = NULL;
+                bool multicast = is_multicast_ether_addr(skb->data);
+
+                if (multicast) {
+                        xmit_skb = skb_copy(skb, GFP_ATOMIC);
+                } else if (sta_info_get(rx->sdata, skb->data)) {
+                        xmit_skb = skb;
+                        skb = NULL;
+                }
 
-                if (dsta) {
+                if (xmit_skb) {
                         /*
                          * Send to wireless media and increase priority by 256
                          * to keep the received priority instead of
                          * reclassifying the frame (see cfg80211_classify8021d).
                          */
-                        skb->priority += 256;
-                        skb->protocol = htons(ETH_P_802_3);
-                        skb_reset_network_header(skb);
-                        skb_reset_mac_header(skb);
-                        dev_queue_xmit(skb);
-                        return true;
+                        xmit_skb->priority += 256;
+                        xmit_skb->protocol = htons(ETH_P_802_3);
+                        skb_reset_network_header(xmit_skb);
+                        skb_reset_mac_header(xmit_skb);
+                        dev_queue_xmit(xmit_skb);
                 }
+
+                if (!skb)
+                        return true;
         }
 
         /* deliver to local stack */
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index b6cfcf038c11..50c309094c37 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1501,8 +1501,8 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
 
                 /* This will evaluate to 1, 3, 5 or 7. */
                 for (ac = IEEE80211_AC_VO; ac < IEEE80211_NUM_ACS; ac++)
-                        if (ignored_acs & BIT(ac))
-                                continue;
+                        if (!(ignored_acs & ieee80211_ac_to_qos_mask[ac]))
+                                break;
                 tid = 7 - 2 * ac;
 
                 ieee80211_send_null_response(sta, tid, reason, true, false);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 0d8b716e509e..797e847cbc49 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1243,7 +1243,7 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
 
 static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local,
                                           struct ieee80211_vif *vif,
-                                          struct ieee80211_sta *pubsta,
+                                          struct sta_info *sta,
                                           struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
@@ -1257,10 +1257,13 @@ static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local,
         if (!ieee80211_is_data(hdr->frame_control))
                 return NULL;
 
-        if (pubsta) {
+        if (sta) {
                 u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
 
-                txq = pubsta->txq[tid];
+                if (!sta->uploaded)
+                        return NULL;
+
+                txq = sta->sta.txq[tid];
         } else if (vif) {
                 txq = vif->txq;
         }
@@ -1503,23 +1506,17 @@ static bool ieee80211_queue_skb(struct ieee80211_local *local,
         struct fq *fq = &local->fq;
         struct ieee80211_vif *vif;
         struct txq_info *txqi;
-        struct ieee80211_sta *pubsta;
 
         if (!local->ops->wake_tx_queue ||
             sdata->vif.type == NL80211_IFTYPE_MONITOR)
                 return false;
 
-        if (sta && sta->uploaded)
-                pubsta = &sta->sta;
-        else
-                pubsta = NULL;
-
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 sdata = container_of(sdata->bss,
                                      struct ieee80211_sub_if_data, u.ap);
 
         vif = &sdata->vif;
-        txqi = ieee80211_get_txq(local, vif, pubsta, skb);
+        txqi = ieee80211_get_txq(local, vif, sta, skb);
 
         if (!txqi)
                 return false;
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index 6832bf6ab69f..43e45bb660bc 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -527,8 +527,10 @@ void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
 
         u32 changed = __ieee80211_vht_handle_opmode(sdata, sta, opmode, band);
 
-        if (changed > 0)
+        if (changed > 0) {
+                ieee80211_recalc_min_chandef(sdata);
                 rate_control_rate_update(local, sband, sta, changed);
+        }
 }
 
 void ieee80211_get_vht_mask_from_cap(__le16 vht_cap,
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 6b78bab27755..54253ea5976e 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -514,7 +514,7 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
         int hooknum, nh_off, err = NF_ACCEPT;
 
         nh_off = skb_network_offset(skb);
-        skb_pull(skb, nh_off);
+        skb_pull_rcsum(skb, nh_off);
 
         /* See HOOK2MANIP(). */
         if (maniptype == NF_NAT_MANIP_SRC)
@@ -579,6 +579,7 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
         err = nf_nat_packet(ct, ctinfo, hooknum, skb);
 push:
         skb_push(skb, nh_off);
+        skb_postpush_rcsum(skb, skb->data, nh_off);
 
         return err;
 }
@@ -886,7 +887,7 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
 
         /* The conntrack module expects to be working at L3. */
         nh_ofs = skb_network_offset(skb);
-        skb_pull(skb, nh_ofs);
+        skb_pull_rcsum(skb, nh_ofs);
 
         if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
                 err = handle_fragments(net, key, info->zone.id, skb);
@@ -900,6 +901,7 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
                 err = ovs_ct_lookup(net, key, info, skb);
 
         skb_push(skb, nh_ofs);
+        skb_postpush_rcsum(skb, skb->data, nh_ofs);
         if (err)
                 kfree_skb(skb);
         return err;
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 2095c83ce773..e10456ef6f7a 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -900,8 +900,6 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
                         goto err;
                 }
                 act->order = i;
-                if (event == RTM_GETACTION)
-                        act->tcfa_refcnt++;
                 list_add_tail(&act->list, &actions);
         }
 
@@ -914,7 +912,8 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
                 return ret;
         }
 err:
-        tcf_action_destroy(&actions, 0);
+        if (event != RTM_GETACTION)
+                tcf_action_destroy(&actions, 0);
         return ret;
 }
 
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index 1c60317f0121..520baa41cba3 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -123,12 +123,11 @@ static int tcf_bpf_dump_ebpf_info(const struct tcf_bpf *prog,
             nla_put_string(skb, TCA_ACT_BPF_NAME, prog->bpf_name))
                 return -EMSGSIZE;
 
-        nla = nla_reserve(skb, TCA_ACT_BPF_DIGEST,
-                          sizeof(prog->filter->digest));
+        nla = nla_reserve(skb, TCA_ACT_BPF_TAG, sizeof(prog->filter->tag));
         if (nla == NULL)
                 return -EMSGSIZE;
 
-        memcpy(nla_data(nla), prog->filter->digest, nla_len(nla));
+        memcpy(nla_data(nla), prog->filter->tag, nla_len(nla));
 
         return 0;
 }
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index adc776048d1a..d9c97018317d 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -555,11 +555,11 @@ static int cls_bpf_dump_ebpf_info(const struct cls_bpf_prog *prog,
             nla_put_string(skb, TCA_BPF_NAME, prog->bpf_name))
                 return -EMSGSIZE;
 
-        nla = nla_reserve(skb, TCA_BPF_DIGEST, sizeof(prog->filter->digest));
+        nla = nla_reserve(skb, TCA_BPF_TAG, sizeof(prog->filter->tag));
         if (nla == NULL)
                 return -EMSGSIZE;
 
-        memcpy(nla_data(nla), prog->filter->digest, nla_len(nla));
+        memcpy(nla_data(nla), prog->filter->tag, nla_len(nla));
 
         return 0;
 }
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 886e9d381771..153082598522 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1489,7 +1489,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
         case RPC_GSS_PROC_DESTROY:
                 if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
                         goto auth_err;
-                rsci->h.expiry_time = get_seconds();
+                rsci->h.expiry_time = seconds_since_boot();
                 set_bit(CACHE_NEGATIVE, &rsci->h.flags);
                 if (resv->iov_len + 4 > PAGE_SIZE)
                         goto drop;
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 3bc1d61694cb..9c9db55a0c1e 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -799,6 +799,8 @@ static int svc_handle_xprt(struct svc_rqst *rqstp, struct svc_xprt *xprt)
 
         if (test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
                 dprintk("svc_recv: found XPT_CLOSE\n");
+                if (test_and_clear_bit(XPT_KILL_TEMP, &xprt->xpt_flags))
+                        xprt->xpt_ops->xpo_kill_temp_xprt(xprt);
                 svc_delete_xprt(xprt);
                 /* Leave XPT_BUSY set on the dead xprt: */
                 goto out;
@@ -1020,9 +1022,11 @@ void svc_age_temp_xprts_now(struct svc_serv *serv, struct sockaddr *server_addr)
                 le = to_be_closed.next;
                 list_del_init(le);
                 xprt = list_entry(le, struct svc_xprt, xpt_list);
-                dprintk("svc_age_temp_xprts_now: closing %p\n", xprt);
-                xprt->xpt_ops->xpo_kill_temp_xprt(xprt);
-                svc_close_xprt(xprt);
+                set_bit(XPT_CLOSE, &xprt->xpt_flags);
+                set_bit(XPT_KILL_TEMP, &xprt->xpt_flags);
+                dprintk("svc_age_temp_xprts_now: queuing xprt %p for closing\n",
+                                xprt);
+                svc_xprt_enqueue(xprt);
         }
 }
 EXPORT_SYMBOL_GPL(svc_age_temp_xprts_now);
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 57d35fbb1c28..172b537f8cfc 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -347,8 +347,6 @@ int rdma_read_chunk_frmr(struct svcxprt_rdma *xprt,
         atomic_inc(&rdma_stat_read);
         return ret;
  err:
-        ib_dma_unmap_sg(xprt->sc_cm_id->device,
-                        frmr->sg, frmr->sg_nents, frmr->direction);
         svc_rdma_put_context(ctxt, 0);
         svc_rdma_put_frmr(xprt, frmr);
         return ret;
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index 6b109a808d4c..02462d67d191 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -169,7 +169,7 @@ void tipc_disc_rcv(struct net *net, struct sk_buff *skb,
 
         /* Send response, if necessary */
         if (respond && (mtyp == DSC_REQ_MSG)) {
-                rskb = tipc_buf_acquire(MAX_H_SIZE);
+                rskb = tipc_buf_acquire(MAX_H_SIZE, GFP_ATOMIC);
                 if (!rskb)
                         return;
                 tipc_disc_init_msg(net, rskb, DSC_RESP_MSG, bearer);
@@ -278,7 +278,7 @@ int tipc_disc_create(struct net *net, struct tipc_bearer *b,
         req = kmalloc(sizeof(*req), GFP_ATOMIC);
         if (!req)
                 return -ENOMEM;
-        req->buf = tipc_buf_acquire(MAX_H_SIZE);
+        req->buf = tipc_buf_acquire(MAX_H_SIZE, GFP_ATOMIC);
         if (!req->buf) {
                 kfree(req);
                 return -ENOMEM;
diff --git a/net/tipc/link.c b/net/tipc/link.c
index bda89bf9f4ff..4e8647aef01c 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1395,7 +1395,7 @@ tnl:
                         msg_set_seqno(hdr, seqno++);
                 pktlen = msg_size(hdr);
                 msg_set_size(&tnlhdr, pktlen + INT_H_SIZE);
-                tnlskb = tipc_buf_acquire(pktlen + INT_H_SIZE);
+                tnlskb = tipc_buf_acquire(pktlen + INT_H_SIZE, GFP_ATOMIC);
                 if (!tnlskb) {
                         pr_warn("%sunable to send packet\n", link_co_err);
                         return;
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index a22be502f1bd..ab02d0742476 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -58,12 +58,12 @@ static unsigned int align(unsigned int i)
  * NOTE: Headroom is reserved to allow prepending of a data link header.
  *       There may also be unrequested tailroom present at the buffer's end.
  */
-struct sk_buff *tipc_buf_acquire(u32 size)
+struct sk_buff *tipc_buf_acquire(u32 size, gfp_t gfp)
 {
         struct sk_buff *skb;
         unsigned int buf_size = (BUF_HEADROOM + size + 3) & ~3u;
 
-        skb = alloc_skb_fclone(buf_size, GFP_ATOMIC);
+        skb = alloc_skb_fclone(buf_size, gfp);
         if (skb) {
                 skb_reserve(skb, BUF_HEADROOM);
                 skb_put(skb, size);
@@ -95,7 +95,7 @@ struct sk_buff *tipc_msg_create(uint user, uint type,
         struct tipc_msg *msg;
         struct sk_buff *buf;
 
-        buf = tipc_buf_acquire(hdr_sz + data_sz);
+        buf = tipc_buf_acquire(hdr_sz + data_sz, GFP_ATOMIC);
         if (unlikely(!buf))
                 return NULL;
 
@@ -261,7 +261,7 @@ int tipc_msg_build(struct tipc_msg *mhdr, struct msghdr *m,
 
         /* No fragmentation needed? */
         if (likely(msz <= pktmax)) {
-                skb = tipc_buf_acquire(msz);
+                skb = tipc_buf_acquire(msz, GFP_KERNEL);
                 if (unlikely(!skb))
                         return -ENOMEM;
                 skb_orphan(skb);
@@ -282,7 +282,7 @@ int tipc_msg_build(struct tipc_msg *mhdr, struct msghdr *m,
         msg_set_importance(&pkthdr, msg_importance(mhdr));
 
         /* Prepare first fragment */
-        skb = tipc_buf_acquire(pktmax);
+        skb = tipc_buf_acquire(pktmax, GFP_KERNEL);
         if (!skb)
                 return -ENOMEM;
         skb_orphan(skb);
@@ -313,7 +313,7 @@ int tipc_msg_build(struct tipc_msg *mhdr, struct msghdr *m,
                         pktsz = drem + INT_H_SIZE;
                 else
                         pktsz = pktmax;
-                skb = tipc_buf_acquire(pktsz);
+                skb = tipc_buf_acquire(pktsz, GFP_KERNEL);
                 if (!skb) {
                         rc = -ENOMEM;
                         goto error;
@@ -448,7 +448,7 @@ bool tipc_msg_make_bundle(struct sk_buff **skb,  struct tipc_msg *msg,
         if (msz > (max / 2))
                 return false;
 
-        _skb = tipc_buf_acquire(max);
+        _skb = tipc_buf_acquire(max, GFP_ATOMIC);
         if (!_skb)
                 return false;
 
@@ -496,7 +496,7 @@ bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
 
         /* Never return SHORT header; expand by replacing buffer if necessary */
         if (msg_short(hdr)) {
-                *skb = tipc_buf_acquire(BASIC_H_SIZE + dlen);
+                *skb = tipc_buf_acquire(BASIC_H_SIZE + dlen, GFP_ATOMIC);
                 if (!*skb)
                         goto exit;
                 memcpy((*skb)->data + BASIC_H_SIZE, msg_data(hdr), dlen);
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index 8d408612ffa4..2c3dc38abf9c 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -820,7 +820,7 @@ static inline bool msg_is_reset(struct tipc_msg *hdr)
         return (msg_user(hdr) == LINK_PROTOCOL) && (msg_type(hdr) == RESET_MSG);
 }
 
-struct sk_buff *tipc_buf_acquire(u32 size);
+struct sk_buff *tipc_buf_acquire(u32 size, gfp_t gfp);
 bool tipc_msg_validate(struct sk_buff *skb);
 bool tipc_msg_reverse(u32 own_addr, struct sk_buff **skb, int err);
 void tipc_msg_init(u32 own_addr, struct tipc_msg *m, u32 user, u32 type,
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index c1cfd92de17a..23f8899e0f8c 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -69,7 +69,7 @@ static struct sk_buff *named_prepare_buf(struct net *net, u32 type, u32 size,
                                          u32 dest)
 {
         struct tipc_net *tn = net_generic(net, tipc_net_id);
-        struct sk_buff *buf = tipc_buf_acquire(INT_H_SIZE + size);
+        struct sk_buff *buf = tipc_buf_acquire(INT_H_SIZE + size, GFP_ATOMIC);
         struct tipc_msg *msg;
 
         if (buf != NULL) {
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index ef5eff93a8b8..5c1b267e22be 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4615,6 +4615,15 @@ int cfg80211_check_station_change(struct wiphy *wiphy,
                 break;
         }
 
+        /*
+         * Older kernel versions ignored this attribute entirely, so don't
+         * reject attempts to update it but mark it as unused instead so the
+         * driver won't look at the data.
+         */
+        if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
+            statype != CFG80211_STA_TDLS_PEER_SETUP)
+                params->opmode_notif_used = false;
+
         return 0;
 }
 EXPORT_SYMBOL(cfg80211_check_station_change);
@@ -4854,6 +4863,12 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 params.local_pm = pm;
         }
 
+        if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
+                params.opmode_notif_used = true;
+                params.opmode_notif =
+                        nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
+        }
+
         /* Include parameters for TDLS peer (will check later) */
         err = nl80211_set_station_tdls(info, &params);
         if (err)
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 4a57c8a60bd9..6a6f44dd594b 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -610,6 +610,33 @@ error:
         return ret ? : -ENOENT;
 }
 
+/* Adjust symbol name and address */
+static int post_process_probe_trace_point(struct probe_trace_point *tp,
+                                           struct map *map, unsigned long offs)
+{
+        struct symbol *sym;
+        u64 addr = tp->address + tp->offset - offs;
+
+        sym = map__find_symbol(map, addr);
+        if (!sym)
+                return -ENOENT;
+
+        if (strcmp(sym->name, tp->symbol)) {
+                /* If we have no realname, use symbol for it */
+                if (!tp->realname)
+                        tp->realname = tp->symbol;
+                else
+                        free(tp->symbol);
+                tp->symbol = strdup(sym->name);
+                if (!tp->symbol)
+                        return -ENOMEM;
+        }
+        tp->offset = addr - sym->start;
+        tp->address -= offs;
+
+        return 0;
+}
+
 /*
  * Rename DWARF symbols to ELF symbols -- gcc sometimes optimizes functions
  * and generate new symbols with suffixes such as .constprop.N or .isra.N
@@ -622,11 +649,9 @@ static int
 post_process_offline_probe_trace_events(struct probe_trace_event *tevs,
                                         int ntevs, const char *pathname)
 {
-        struct symbol *sym;
         struct map *map;
         unsigned long stext = 0;
-        u64 addr;
-        int i;
+        int i, ret = 0;
 
         /* Prepare a map for offline binary */
         map = dso__new_map(pathname);
@@ -636,23 +661,14 @@ post_process_offline_probe_trace_events(struct probe_trace_event *tevs,
         }
 
         for (i = 0; i < ntevs; i++) {
-                addr = tevs[i].point.address + tevs[i].point.offset - stext;
-                sym = map__find_symbol(map, addr);
-                if (!sym)
-                        continue;
-                if (!strcmp(sym->name, tevs[i].point.symbol))
-                        continue;
-                /* If we have no realname, use symbol for it */
-                if (!tevs[i].point.realname)
-                        tevs[i].point.realname = tevs[i].point.symbol;
-                else
-                        free(tevs[i].point.symbol);
-                tevs[i].point.symbol = strdup(sym->name);
-                tevs[i].point.offset = addr - sym->start;
+                ret = post_process_probe_trace_point(&tevs[i].point,
+                                                     map, stext);
+                if (ret < 0)
+                        break;
         }
         map__put(map);
 
-        return 0;
+        return ret;
 }
 
 static int add_exec_to_probe_trace_events(struct probe_trace_event *tevs,
@@ -682,18 +698,31 @@ static int add_exec_to_probe_trace_events(struct probe_trace_event *tevs,
         return ret;
 }
 
-static int add_module_to_probe_trace_events(struct probe_trace_event *tevs,
-                                            int ntevs, const char *module)
+static int
+post_process_module_probe_trace_events(struct probe_trace_event *tevs,
+                                       int ntevs, const char *module,
+                                       struct debuginfo *dinfo)
 {
+        Dwarf_Addr text_offs = 0;
         int i, ret = 0;
         char *mod_name = NULL;
+        struct map *map;
 
         if (!module)
                 return 0;
 
-        mod_name = find_module_name(module);
+        map = get_target_map(module, false);
+        if (!map || debuginfo__get_text_offset(dinfo, &text_offs, true) < 0) {
+                pr_warning("Failed to get ELF symbols for %s\n", module);
+                return -EINVAL;
+        }
 
+        mod_name = find_module_name(module);
         for (i = 0; i < ntevs; i++) {
+                ret = post_process_probe_trace_point(&tevs[i].point,
+                                                map, (unsigned long)text_offs);
+                if (ret < 0)
+                        break;
                 tevs[i].point.module =
                         strdup(mod_name ? mod_name : module);
                 if (!tevs[i].point.module) {
@@ -703,6 +732,8 @@ static int add_module_to_probe_trace_events(struct probe_trace_event *tevs,
         }
 
         free(mod_name);
+        map__put(map);
+
         return ret;
 }
 
@@ -760,7 +791,7 @@ arch__post_process_probe_trace_events(struct perf_probe_event *pev __maybe_unuse
 static int post_process_probe_trace_events(struct perf_probe_event *pev,
                                            struct probe_trace_event *tevs,
                                            int ntevs, const char *module,
-                                           bool uprobe)
+                                           bool uprobe, struct debuginfo *dinfo)
 {
         int ret;
 
@@ -768,7 +799,8 @@ static int post_process_probe_trace_events(struct perf_probe_event *pev,
                 ret = add_exec_to_probe_trace_events(tevs, ntevs, module);
         else if (module)
                 /* Currently ref_reloc_sym based probe is not for drivers */
-                ret = add_module_to_probe_trace_events(tevs, ntevs, module);
+                ret = post_process_module_probe_trace_events(tevs, ntevs,
+                                                             module, dinfo);
         else
                 ret = post_process_kernel_probe_trace_events(tevs, ntevs);
 
@@ -812,30 +844,27 @@ static int try_to_find_probe_trace_events(struct perf_probe_event *pev,
                 }
         }
 
-        debuginfo__delete(dinfo);
-
         if (ntevs > 0) {        /* Succeeded to find trace events */
                 pr_debug("Found %d probe_trace_events.\n", ntevs);
                 ret = post_process_probe_trace_events(pev, *tevs, ntevs,
-                                                pev->target, pev->uprobes);
+                                        pev->target, pev->uprobes, dinfo);
                 if (ret < 0 || ret == ntevs) {
+                        pr_debug("Post processing failed or all events are skipped. (%d)\n", ret);
                         clear_probe_trace_events(*tevs, ntevs);
                         zfree(tevs);
+                        ntevs = 0;
                 }
-                if (ret != ntevs)
-                        return ret < 0 ? ret : ntevs;
-                ntevs = 0;
-                /* Fall through */
         }
 
+        debuginfo__delete(dinfo);
+
         if (ntevs == 0) {       /* No error but failed to find probe point. */
                 pr_warning("Probe point '%s' not found.\n",
                            synthesize_perf_probe_point(&pev->point));
                 return -ENOENT;
-        }
-        /* Error path : ntevs < 0 */
-        pr_debug("An error occurred in debuginfo analysis (%d).\n", ntevs);
-        if (ntevs < 0) {
+        } else if (ntevs < 0) {
+                /* Error path : ntevs < 0 */
+                pr_debug("An error occurred in debuginfo analysis (%d).\n", ntevs);
                 if (ntevs == -EBADF)
                         pr_warning("Warning: No dwarf info found in the vmlinux - "
                                 "please rebuild kernel with CONFIG_DEBUG_INFO=y.\n");
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index df4debe564da..0d9d6e0803b8 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -1501,7 +1501,8 @@ int debuginfo__find_available_vars_at(struct debuginfo *dbg,
 }
 
 /* For the kernel module, we need a special code to get a DIE */
-static int debuginfo__get_text_offset(struct debuginfo *dbg, Dwarf_Addr *offs)
+int debuginfo__get_text_offset(struct debuginfo *dbg, Dwarf_Addr *offs,
+                                bool adjust_offset)
 {
         int n, i;
         Elf32_Word shndx;
@@ -1530,6 +1531,8 @@ static int debuginfo__get_text_offset(struct debuginfo *dbg, Dwarf_Addr *offs)
                         if (!shdr)
                                 return -ENOENT;
                         *offs = shdr->sh_addr;
+                        if (adjust_offset)
+                                *offs -= shdr->sh_offset;
                 }
         }
         return 0;
@@ -1543,16 +1546,12 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr,
         Dwarf_Addr _addr = 0, baseaddr = 0;
         const char *fname = NULL, *func = NULL, *basefunc = NULL, *tmp;
         int baseline = 0, lineno = 0, ret = 0;
-        bool reloc = false;
 
-retry:
+        /* We always need to relocate the address for aranges */
+        if (debuginfo__get_text_offset(dbg, &baseaddr, false) == 0)
+                addr += baseaddr;
         /* Find cu die */
         if (!dwarf_addrdie(dbg->dbg, (Dwarf_Addr)addr, &cudie)) {
-                if (!reloc && debuginfo__get_text_offset(dbg, &baseaddr) == 0) {
-                        addr += baseaddr;
-                        reloc = true;
-                        goto retry;
-                }
                 pr_warning("Failed to find debug information for address %lx\n",
                            addr);
                 ret = -EINVAL;
diff --git a/tools/perf/util/probe-finder.h b/tools/perf/util/probe-finder.h
index f1d8558f498e..2956c5198652 100644
--- a/tools/perf/util/probe-finder.h
+++ b/tools/perf/util/probe-finder.h
@@ -46,6 +46,9 @@ int debuginfo__find_trace_events(struct debuginfo *dbg,
 int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr,
                                 struct perf_probe_point *ppt);
 
+int debuginfo__get_text_offset(struct debuginfo *dbg, Dwarf_Addr *offs,
+                               bool adjust_offset);
+
 /* Find a line range */
 int debuginfo__find_line_range(struct debuginfo *dbg, struct line_range *lr);
 
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
index c22860ab9733..30e1ac62e8cb 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
@@ -66,7 +66,7 @@ int pmc56_overflow(void)
 
         FAIL_IF(ebb_event_enable(&event));
 
-        mtspr(SPRN_PMC1, pmc_sample_period(sample_period));
+        mtspr(SPRN_PMC2, pmc_sample_period(sample_period));
         mtspr(SPRN_PMC5, 0);
         mtspr(SPRN_PMC6, 0);
 
diff --git a/tools/virtio/ringtest/main.h b/tools/virtio/ringtest/main.h
index 34e63cc4c572..14142faf040b 100644
--- a/tools/virtio/ringtest/main.h
+++ b/tools/virtio/ringtest/main.h
@@ -26,6 +26,16 @@ static inline void wait_cycles(unsigned long long cycles)
 #define VMEXIT_CYCLES 500
 #define VMENTRY_CYCLES 500
 
+#elif defined(__s390x__)
+static inline void wait_cycles(unsigned long long cycles)
+{
+        asm volatile("0: brctg %0,0b" : : "d" (cycles));
+}
+
+/* tweak me */
+#define VMEXIT_CYCLES 200
+#define VMENTRY_CYCLES 200
+
 #else
 static inline void wait_cycles(unsigned long long cycles)
 {
@@ -81,6 +91,8 @@ extern unsigned ring_size;
 /* Is there a portable way to do this? */
 #if defined(__x86_64__) || defined(__i386__)
 #define cpu_relax() asm ("rep; nop" ::: "memory")
+#elif defined(__s390x__)
+#define cpu_relax() barrier()
 #else
 #define cpu_relax() assert(0)
 #endif
diff --git a/tools/virtio/ringtest/run-on-all.sh b/tools/virtio/ringtest/run-on-all.sh
index 2e69ca812b4c..29b0d3920bfc 100755
--- a/tools/virtio/ringtest/run-on-all.sh
+++ b/tools/virtio/ringtest/run-on-all.sh
@@ -1,12 +1,13 @@
 #!/bin/sh
 
+CPUS_ONLINE=$(lscpu --online -p=cpu|grep -v -e '#')
 #use last CPU for host. Why not the first?
 #many devices tend to use cpu0 by default so
 #it tends to be busier
-HOST_AFFINITY=$(lscpu -p=cpu | tail -1)
+HOST_AFFINITY=$(echo "${CPUS_ONLINE}"|tail -n 1)
 
 #run command on all cpus
-for cpu in $(seq 0 $HOST_AFFINITY)
+for cpu in $CPUS_ONLINE
 do
         #Don't run guest and host on same CPU
         #It actually works ok if using signalling
diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
index a2dbbccbb6a3..6a084cd57b88 100644
--- a/virt/kvm/arm/arch_timer.c
+++ b/virt/kvm/arm/arch_timer.c
@@ -24,6 +24,7 @@
 
 #include <clocksource/arm_arch_timer.h>
 #include <asm/arch_timer.h>
+#include <asm/kvm_hyp.h>
 
 #include <kvm/arm_vgic.h>
 #include <kvm/arm_arch_timer.h>
@@ -89,9 +90,6 @@ static void kvm_timer_inject_irq_work(struct work_struct *work)
         struct kvm_vcpu *vcpu;
 
         vcpu = container_of(work, struct kvm_vcpu, arch.timer_cpu.expired);
-        vcpu->arch.timer_cpu.armed = false;
-
-        WARN_ON(!kvm_timer_should_fire(vcpu));
 
         /*
          * If the vcpu is blocked we want to wake it up so that it will see
@@ -512,3 +510,25 @@ void kvm_timer_init(struct kvm *kvm)
 {
         kvm->arch.timer.cntvoff = kvm_phys_timer_read();
 }
+
+/*
+ * On VHE system, we only need to configure trap on physical timer and counter
+ * accesses in EL0 and EL1 once, not for every world switch.
+ * The host kernel runs at EL2 with HCR_EL2.TGE == 1,
+ * and this makes those bits have no effect for the host kernel execution.
+ */
+void kvm_timer_init_vhe(void)
+{
+        /* When HCR_EL2.E2H ==1, EL1PCEN and EL1PCTEN are shifted by 10 */
+        u32 cnthctl_shift = 10;
+        u64 val;
+
+        /*
+         * Disallow physical timer access for the guest.
+         * Physical counter access is allowed.
+         */
+        val = read_sysreg(cnthctl_el2);
+        val &= ~(CNTHCTL_EL1PCEN << cnthctl_shift);
+        val |= (CNTHCTL_EL1PCTEN << cnthctl_shift);
+        write_sysreg(val, cnthctl_el2);
+}
diff --git a/virt/kvm/arm/hyp/timer-sr.c b/virt/kvm/arm/hyp/timer-sr.c
index 798866a8d875..63e28dd18bb0 100644
--- a/virt/kvm/arm/hyp/timer-sr.c
+++ b/virt/kvm/arm/hyp/timer-sr.c
@@ -35,10 +35,16 @@ void __hyp_text __timer_save_state(struct kvm_vcpu *vcpu)
         /* Disable the virtual timer */
         write_sysreg_el0(0, cntv_ctl);
 
-        /* Allow physical timer/counter access for the host */
-        val = read_sysreg(cnthctl_el2);
-        val |= CNTHCTL_EL1PCTEN | CNTHCTL_EL1PCEN;
-        write_sysreg(val, cnthctl_el2);
+        /*
+         * We don't need to do this for VHE since the host kernel runs in EL2
+         * with HCR_EL2.TGE ==1, which makes those bits have no impact.
+         */
+        if (!has_vhe()) {
+                /* Allow physical timer/counter access for the host */
+                val = read_sysreg(cnthctl_el2);
+                val |= CNTHCTL_EL1PCTEN | CNTHCTL_EL1PCEN;
+                write_sysreg(val, cnthctl_el2);
+        }
 
         /* Clear cntvoff for the host */
         write_sysreg(0, cntvoff_el2);
@@ -50,14 +56,17 @@ void __hyp_text __timer_restore_state(struct kvm_vcpu *vcpu)
         struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
         u64 val;
 
-        /*
-         * Disallow physical timer access for the guest
-         * Physical counter access is allowed
-         */
-        val = read_sysreg(cnthctl_el2);
-        val &= ~CNTHCTL_EL1PCEN;
-        val |= CNTHCTL_EL1PCTEN;
-        write_sysreg(val, cnthctl_el2);
+        /* Those bits are already configured at boot on VHE-system */
+        if (!has_vhe()) {
+                /*
+                 * Disallow physical timer access for the guest
+                 * Physical counter access is allowed
+                 */
+                val = read_sysreg(cnthctl_el2);
+                val &= ~CNTHCTL_EL1PCEN;
+                val |= CNTHCTL_EL1PCTEN;
+                write_sysreg(val, cnthctl_el2);
+        }
 
         if (timer->enabled) {
                 write_sysreg(kvm->arch.timer.cntvoff, cntvoff_el2);
diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
index 5114391b7e5a..c737ea0a310a 100644
--- a/virt/kvm/arm/vgic/vgic-init.c
+++ b/virt/kvm/arm/vgic/vgic-init.c
@@ -268,15 +268,11 @@ static void kvm_vgic_dist_destroy(struct kvm *kvm)
 {
         struct vgic_dist *dist = &kvm->arch.vgic;
 
-        mutex_lock(&kvm->lock);
-
         dist->ready = false;
         dist->initialized = false;
 
         kfree(dist->spis);
         dist->nr_spis = 0;
-
-        mutex_unlock(&kvm->lock);
 }
 
 void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
@@ -286,7 +282,8 @@ void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
         INIT_LIST_HEAD(&vgic_cpu->ap_list_head);
 }
 
-void kvm_vgic_destroy(struct kvm *kvm)
+/* To be called with kvm->lock held */
+static void __kvm_vgic_destroy(struct kvm *kvm)
 {
         struct kvm_vcpu *vcpu;
         int i;
@@ -297,6 +294,13 @@ void kvm_vgic_destroy(struct kvm *kvm)
                 kvm_vgic_vcpu_destroy(vcpu);
 }
 
+void kvm_vgic_destroy(struct kvm *kvm)
+{
+        mutex_lock(&kvm->lock);
+        __kvm_vgic_destroy(kvm);
+        mutex_unlock(&kvm->lock);
+}
+
 /**
  * vgic_lazy_init: Lazy init is only allowed if the GIC exposed to the guest
  * is a GICv2. A GICv3 must be explicitly initialized by the guest using the
@@ -348,6 +352,10 @@ int kvm_vgic_map_resources(struct kvm *kvm)
                 ret = vgic_v2_map_resources(kvm);
         else
                 ret = vgic_v3_map_resources(kvm);
+
+        if (ret)
+                __kvm_vgic_destroy(kvm);
+
 out:
         mutex_unlock(&kvm->lock);
         return ret;
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index 9bab86757fa4..834137e7b83f 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -293,8 +293,6 @@ int vgic_v2_map_resources(struct kvm *kvm)
         dist->ready = true;
 
 out:
-        if (ret)
-                kvm_vgic_destroy(kvm);
         return ret;
 }
 
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 5c9f9745e6ca..e6b03fd8c374 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -302,8 +302,6 @@ int vgic_v3_map_resources(struct kvm *kvm)
         dist->ready = true;
 
 out:
-        if (ret)
-                kvm_vgic_destroy(kvm);
         return ret;
 }