311 files changed, 4047 insertions, 1885 deletions

diff --git a/.mailmap b/.mailmap
index 2a91c14c80bf..b18912c5121e 100644
--- a/.mailmap
+++ b/.mailmap
@@ -88,6 +88,7 @@ Kay Sievers <kay.sievers@vrfy.org>
 Kenneth W Chen <kenneth.w.chen@intel.com>
 Konstantin Khlebnikov <koct9i@gmail.com> <k.khlebnikov@samsung.com>
 Koushik <raghavendra.koushik@neterion.com>
+Krzysztof Kozlowski <krzk@kernel.org> <k.kozlowski@samsung.com>
 Krzysztof Kozlowski <krzk@kernel.org> <k.kozlowski.k@gmail.com>
 Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
 Leonid I Ananiev <leonid.i.ananiev@intel.com>
diff --git a/Documentation/conf.py b/Documentation/conf.py
index 96b7aa66c89c..106ae9c740b9 100644
--- a/Documentation/conf.py
+++ b/Documentation/conf.py
@@ -131,7 +131,7 @@ pygments_style = 'sphinx'
 todo_include_todos = False
 
 primary_domain = 'C'
-highlight_language = 'C'
+highlight_language = 'guess'
 
 # -- Options for HTML output ----------------------------------------------
 
diff --git a/Documentation/hwmon/ftsteutates b/Documentation/hwmon/ftsteutates
index 2a1bf69c6a26..8c10a916de20 100644
--- a/Documentation/hwmon/ftsteutates
+++ b/Documentation/hwmon/ftsteutates
@@ -19,5 +19,5 @@ enhancements. It can monitor up to 4 voltages, 16 temperatures and
 implemented in this driver.
 
 Specification of the chip can be found here:
-ftp:///pub/Mainboard-OEM-Sales/Services/Software&Tools/Linux_SystemMonitoring&Watchdog&GPIO/BMC-Teutates_Specification_V1.21.pdf
-ftp:///pub/Mainboard-OEM-Sales/Services/Software&Tools/Linux_SystemMonitoring&Watchdog&GPIO/Fujitsu_mainboards-1-Sensors_HowTo-en-US.pdf
+ftp://ftp.ts.fujitsu.com/pub/Mainboard-OEM-Sales/Services/Software&Tools/Linux_SystemMonitoring&Watchdog&GPIO/BMC-Teutates_Specification_V1.21.pdf
+ftp://ftp.ts.fujitsu.com/pub/Mainboard-OEM-Sales/Services/Software&Tools/Linux_SystemMonitoring&Watchdog&GPIO/Fujitsu_mainboards-1-Sensors_HowTo-en-US.pdf
diff --git a/Documentation/kernel-documentation.rst b/Documentation/kernel-documentation.rst
index c4eb5049da39..391decc66a18 100644
--- a/Documentation/kernel-documentation.rst
+++ b/Documentation/kernel-documentation.rst
@@ -366,8 +366,6 @@ Domain`_ references.
 Cross-referencing from reStructuredText
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-.. highlight:: none
-
 To cross-reference the functions and types defined in the kernel-doc comments
 from reStructuredText documents, please use the `Sphinx C Domain`_
 references. For example::
@@ -390,8 +388,6 @@ For further details, please refer to the `Sphinx C Domain`_ documentation.
 Function documentation
 ----------------------
 
-.. highlight:: c
-
 The general format of a function and function-like macro kernel-doc comment is::
 
   /**
@@ -572,8 +568,6 @@ DocBook XML [DEPRECATED]
 Converting DocBook to Sphinx
 ----------------------------
 
-.. highlight:: none
-
 Over time, we expect all of the documents under ``Documentation/DocBook`` to be
 converted to Sphinx and reStructuredText. For most DocBook XML documents, a good
 enough solution is to use the simple ``Documentation/sphinx/tmplcvt`` script,
diff --git a/Documentation/networking/rxrpc.txt b/Documentation/networking/rxrpc.txt
index 16a924c486bf..70c926ae212d 100644
--- a/Documentation/networking/rxrpc.txt
+++ b/Documentation/networking/rxrpc.txt
@@ -790,13 +790,12 @@ The kernel interface functions are as follows:
      Data messages can have their contents extracted with the usual bunch of
      socket buffer manipulation functions.  A data message can be determined to
      be the last one in a sequence with rxrpc_kernel_is_data_last().  When a
-     data message has been used up, rxrpc_kernel_data_delivered() should be
-     called on it..
+     data message has been used up, rxrpc_kernel_data_consumed() should be
+     called on it.
 
-     Non-data messages should be handled to rxrpc_kernel_free_skb() to dispose
-     of.  It is possible to get extra refs on all types of message for later
-     freeing, but this may pin the state of a call until the message is finally
-     freed.
+     Messages should be handled to rxrpc_kernel_free_skb() to dispose of.  It
+     is possible to get extra refs on all types of message for later freeing,
+     but this may pin the state of a call until the message is finally freed.
 
  (*) Accept an incoming call.
 
@@ -821,12 +820,14 @@ The kernel interface functions are as follows:
      Other errors may be returned if the call had been aborted (-ECONNABORTED)
      or had timed out (-ETIME).
 
- (*) Record the delivery of a data message and free it.
+ (*) Record the delivery of a data message.
 
-        void rxrpc_kernel_data_delivered(struct sk_buff *skb);
+        void rxrpc_kernel_data_consumed(struct rxrpc_call *call,
+                                        struct sk_buff *skb);
 
-     This is used to record a data message as having been delivered and to
-     update the ACK state for the call.  The socket buffer will be freed.
+     This is used to record a data message as having been consumed and to
+     update the ACK state for the call.  The message must still be passed to
+     rxrpc_kernel_free_skb() for disposal by the caller.
 
  (*) Free a message.
 
diff --git a/Documentation/power/basic-pm-debugging.txt b/Documentation/power/basic-pm-debugging.txt
index b96098ccfe69..708f87f78a75 100644
--- a/Documentation/power/basic-pm-debugging.txt
+++ b/Documentation/power/basic-pm-debugging.txt
@@ -164,7 +164,32 @@ load n/2 modules more and try again.
 Again, if you find the offending module(s), it(they) must be unloaded every time
 before hibernation, and please report the problem with it(them).
 
-c) Advanced debugging
+c) Using the "test_resume" hibernation option
+
+/sys/power/disk generally tells the kernel what to do after creating a
+hibernation image.  One of the available options is "test_resume" which
+causes the just created image to be used for immediate restoration.  Namely,
+after doing:
+
+# echo test_resume > /sys/power/disk
+# echo disk > /sys/power/state
+
+a hibernation image will be created and a resume from it will be triggered
+immediately without involving the platform firmware in any way.
+
+That test can be used to check if failures to resume from hibernation are
+related to bad interactions with the platform firmware.  That is, if the above
+works every time, but resume from actual hibernation does not work or is
+unreliable, the platform firmware may be responsible for the failures.
+
+On architectures and platforms that support using different kernels to restore
+hibernation images (that is, the kernel used to read the image from storage and
+load it into memory is different from the one included in the image) or support
+kernel address space randomization, it also can be used to check if failures
+to resume may be related to the differences between the restore and image
+kernels.
+
+d) Advanced debugging
 
 In case that hibernation does not work on your system even in the minimal
 configuration and compiling more drivers as modules is not practical or some
diff --git a/Documentation/power/interface.txt b/Documentation/power/interface.txt
index f1f0f59a7c47..974916ff6608 100644
--- a/Documentation/power/interface.txt
+++ b/Documentation/power/interface.txt
@@ -1,75 +1,76 @@
-Power Management Interface
-
-
-The power management subsystem provides a unified sysfs interface to 
-userspace, regardless of what architecture or platform one is
-running. The interface exists in /sys/power/ directory (assuming sysfs
-is mounted at /sys). 
-
-/sys/power/state controls system power state. Reading from this file
-returns what states are supported, which is hard-coded to 'freeze',
-'standby' (Power-On Suspend), 'mem' (Suspend-to-RAM), and 'disk'
-(Suspend-to-Disk). 
-
-Writing to this file one of those strings causes the system to
-transition into that state. Please see the file
-Documentation/power/states.txt for a description of each of those
-states.
-
-
-/sys/power/disk controls the operating mode of the suspend-to-disk
-mechanism. Suspend-to-disk can be handled in several ways. We have a
-few options for putting the system to sleep - using the platform driver
-(e.g. ACPI or other suspend_ops), powering off the system or rebooting the
-system (for testing).
-
-Additionally, /sys/power/disk can be used to turn on one of the two testing
-modes of the suspend-to-disk mechanism: 'testproc' or 'test'.  If the
-suspend-to-disk mechanism is in the 'testproc' mode, writing 'disk' to
-/sys/power/state will cause the kernel to disable nonboot CPUs and freeze
-tasks, wait for 5 seconds, unfreeze tasks and enable nonboot CPUs.  If it is
-in the 'test' mode, writing 'disk' to /sys/power/state will cause the kernel
-to disable nonboot CPUs and freeze tasks, shrink memory, suspend devices, wait
-for 5 seconds, resume devices, unfreeze tasks and enable nonboot CPUs.  Then,
-we are able to look in the log messages and work out, for example, which code
-is being slow and which device drivers are misbehaving.
-
-Reading from this file will display all supported modes and the currently
-selected one in brackets, for example
-
-        [shutdown] reboot test testproc
-
-Writing to this file will accept one of
-
-       'platform' (only if the platform supports it)
-       'shutdown'
-       'reboot'
-       'testproc'
-       'test'
-
-/sys/power/image_size controls the size of the image created by
-the suspend-to-disk mechanism.  It can be written a string
-representing a non-negative integer that will be used as an upper
-limit of the image size, in bytes.  The suspend-to-disk mechanism will
-do its best to ensure the image size will not exceed that number.  However,
-if this turns out to be impossible, it will try to suspend anyway using the
-smallest image possible.  In particular, if "0" is written to this file, the
-suspend image will be as small as possible.
-
-Reading from this file will display the current image size limit, which
-is set to 2/5 of available RAM by default.
-
-/sys/power/pm_trace controls the code which saves the last PM event point in
-the RTC across reboots, so that you can debug a machine that just hangs
-during suspend (or more commonly, during resume).  Namely, the RTC is only
-used to save the last PM event point if this file contains '1'.  Initially it
-contains '0' which may be changed to '1' by writing a string representing a
-nonzero integer into it.
-
-To use this debugging feature you should attempt to suspend the machine, then
-reboot it and run
-
-        dmesg -s 1000000 | grep 'hash matches'
-
-CAUTION: Using it will cause your machine's real-time (CMOS) clock to be
-set to a random invalid time after a resume.
+Power Management Interface for System Sleep
+
+Copyright (c) 2016 Intel Corp., Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+The power management subsystem provides userspace with a unified sysfs interface
+for system sleep regardless of the underlying system architecture or platform.
+The interface is located in the /sys/power/ directory (assuming that sysfs is
+mounted at /sys).
+
+/sys/power/state is the system sleep state control file.
+
+Reading from it returns a list of supported sleep states, encoded as:
+
+'freeze' (Suspend-to-Idle)
+'standby' (Power-On Suspend)
+'mem' (Suspend-to-RAM)
+'disk' (Suspend-to-Disk)
+
+Suspend-to-Idle is always supported.  Suspend-to-Disk is always supported
+too as long the kernel has been configured to support hibernation at all
+(ie. CONFIG_HIBERNATION is set in the kernel configuration file).  Support
+for Suspend-to-RAM and Power-On Suspend depends on the capabilities of the
+platform.
+
+If one of the strings listed in /sys/power/state is written to it, the system
+will attempt to transition into the corresponding sleep state.  Refer to
+Documentation/power/states.txt for a description of each of those states.
+
+/sys/power/disk controls the operating mode of hibernation (Suspend-to-Disk).
+Specifically, it tells the kernel what to do after creating a hibernation image.
+
+Reading from it returns a list of supported options encoded as:
+
+'platform' (put the system into sleep using a platform-provided method)
+'shutdown' (shut the system down)
+'reboot' (reboot the system)
+'suspend' (trigger a Suspend-to-RAM transition)
+'test_resume' (resume-after-hibernation test mode)
+
+The currently selected option is printed in square brackets.
+
+The 'platform' option is only available if the platform provides a special
+mechanism to put the system to sleep after creating a hibernation image (ACPI
+does that, for example).  The 'suspend' option is available if Suspend-to-RAM
+is supported.  Refer to Documentation/power/basic_pm_debugging.txt for the
+description of the 'test_resume' option.
+
+To select an option, write the string representing it to /sys/power/disk.
+
+/sys/power/image_size controls the size of hibernation images.
+
+It can be written a string representing a non-negative integer that will be
+used as a best-effort upper limit of the image size, in bytes.  The hibernation
+core will do its best to ensure that the image size will not exceed that number.
+However, if that turns out to be impossible to achieve, a hibernation image will
+still be created and its size will be as small as possible.  In particular,
+writing '0' to this file will enforce hibernation images to be as small as
+possible.
+
+Reading from this file returns the current image size limit, which is set to
+around 2/5 of available RAM by default.
+
+/sys/power/pm_trace controls the PM trace mechanism saving the last suspend
+or resume event point in the RTC across reboots.
+
+It helps to debug hard lockups or reboots due to device driver failures that
+occur during system suspend or resume (which is more common) more effectively.
+
+If /sys/power/pm_trace contains '1', the fingerprint of each suspend/resume
+event point in turn will be stored in the RTC memory (overwriting the actual
+RTC information), so it will survive a system crash if one occurs right after
+storing it and it can be used later to identify the driver that caused the crash
+to happen (see Documentation/power/s2ram.txt for more information).
+
+Initially it contains '0' which may be changed to '1' by writing a string
+representing a nonzero integer into it.
diff --git a/Documentation/sphinx-static/theme_overrides.css b/Documentation/sphinx-static/theme_overrides.css
index 3a2ac4bcfd78..e88461c4c1e6 100644
--- a/Documentation/sphinx-static/theme_overrides.css
+++ b/Documentation/sphinx-static/theme_overrides.css
@@ -42,11 +42,12 @@
     caption a.headerlink { opacity: 0; }
     caption a.headerlink:hover { opacity: 1; }
 
-    /* inline literal: drop the borderbox and red color */
+    /* inline literal: drop the borderbox, padding and red color */
 
     code, .rst-content tt, .rst-content code {
         color: inherit;
         border: none;
+        padding: unset;
         background: inherit;
         font-size: 85%;
     }
diff --git a/MAINTAINERS b/MAINTAINERS
index a306795a7450..ecf066a399e3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1614,7 +1614,7 @@ N:	rockchip
 
 ARM/SAMSUNG EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene@kernel.org>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 S:      Maintained
@@ -1822,6 +1822,7 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-stericsson.git
 ARM/UNIPHIER ARCHITECTURE
 M:      Masahiro Yamada <yamada.masahiro@socionext.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-uniphier.git
 S:      Maintained
 F:      arch/arm/boot/dts/uniphier*
 F:      arch/arm/include/asm/hardware/cache-uniphier.h
@@ -4525,6 +4526,12 @@ L:	linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/sb_edac.c
 
+EDAC-SKYLAKE
+M:      Tony Luck <tony.luck@intel.com>
+L:      linux-edac@vger.kernel.org
+S:      Maintained
+F:      drivers/edac/skx_edac.c
+
 EDAC-XGENE
 APPLIED MICRO (APM) X-GENE SOC EDAC
 M:     Loc Ho <lho@apm.com>
@@ -7449,7 +7456,8 @@ F:	Documentation/devicetree/bindings/sound/max9860.txt
 F:      sound/soc/codecs/max9860.*
 
 MAXIM MUIC CHARGER DRIVERS FOR EXYNOS BASED BOARDS
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
 L:      linux-pm@vger.kernel.org
 S:      Supported
 F:      drivers/power/max14577_charger.c
@@ -7465,7 +7473,8 @@ F:	include/dt-bindings/*/*max77802.h
 
 MAXIM PMIC AND MUIC DRIVERS FOR EXYNOS BASED BOARDS
 M:      Chanwoo Choi <cw00.choi@samsung.com>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
 L:      linux-kernel@vger.kernel.org
 S:      Supported
 F:      drivers/*/max14577*.c
@@ -9231,7 +9240,7 @@ F:	drivers/pinctrl/sh-pfc/
 
 PIN CONTROLLER - SAMSUNG
 M:      Tomasz Figa <tomasz.figa@gmail.com>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
 M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
@@ -10164,7 +10173,7 @@ S:	Maintained
 F:      drivers/platform/x86/samsung-laptop.c
 
 SAMSUNG AUDIO (ASoC) DRIVERS
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
 M:      Sangbeom Kim <sbkim73@samsung.com>
 M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
@@ -10179,7 +10188,8 @@ F:	drivers/video/fbdev/s3c-fb.c
 
 SAMSUNG MULTIFUNCTION PMIC DEVICE DRIVERS
 M:      Sangbeom Kim <sbkim73@samsung.com>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
 L:      linux-kernel@vger.kernel.org
 L:      linux-samsung-soc@vger.kernel.org
 S:      Supported
diff --git a/Makefile b/Makefile
index 5c18baad7218..3537aa23905f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 8
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Psychotic Stoned Sheep
 
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/am335x-baltos.dtsi b/arch/arm/boot/dts/am335x-baltos.dtsi
index c8609d8d2c55..b689172632ef 100644
--- a/arch/arm/boot/dts/am335x-baltos.dtsi
+++ b/arch/arm/boot/dts/am335x-baltos.dtsi
@@ -226,7 +226,7 @@
 
                 #address-cells = <1>;
                 #size-cells = <1>;
-                elm_id = <&elm>;
+                ti,elm-id = <&elm>;
         };
 };
 
diff --git a/arch/arm/boot/dts/am335x-igep0033.dtsi b/arch/arm/boot/dts/am335x-igep0033.dtsi
index df63484ef9b3..e7d9ca1305fa 100644
--- a/arch/arm/boot/dts/am335x-igep0033.dtsi
+++ b/arch/arm/boot/dts/am335x-igep0033.dtsi
@@ -161,7 +161,7 @@
 
                 #address-cells = <1>;
                 #size-cells = <1>;
-                elm_id = <&elm>;
+                ti,elm-id = <&elm>;
 
                 /* MTD partition table */
                 partition@0 {
diff --git a/arch/arm/boot/dts/am335x-phycore-som.dtsi b/arch/arm/boot/dts/am335x-phycore-som.dtsi
index 86f773165d5c..1263c9d4cba3 100644
--- a/arch/arm/boot/dts/am335x-phycore-som.dtsi
+++ b/arch/arm/boot/dts/am335x-phycore-som.dtsi
@@ -197,7 +197,7 @@
                 gpmc,wr-access-ns = <30>;
                 gpmc,wr-data-mux-bus-ns = <0>;
 
-                elm_id = <&elm>;
+                ti,elm-id = <&elm>;
 
                 #address-cells = <1>;
                 #size-cells = <1>;
diff --git a/arch/arm/boot/dts/armada-388-clearfog.dts b/arch/arm/boot/dts/armada-388-clearfog.dts
index 2e0556af6e5e..d3e6bd805006 100644
--- a/arch/arm/boot/dts/armada-388-clearfog.dts
+++ b/arch/arm/boot/dts/armada-388-clearfog.dts
@@ -390,12 +390,12 @@
 
                         port@0 {
                                 reg = <0>;
-                                label = "lan1";
+                                label = "lan5";
                         };
 
                         port@1 {
                                 reg = <1>;
-                                label = "lan2";
+                                label = "lan4";
                         };
 
                         port@2 {
@@ -405,12 +405,12 @@
 
                         port@3 {
                                 reg = <3>;
-                                label = "lan4";
+                                label = "lan2";
                         };
 
                         port@4 {
                                 reg = <4>;
-                                label = "lan5";
+                                label = "lan1";
                         };
 
                         port@5 {
diff --git a/arch/arm/boot/dts/exynos5410-odroidxu.dts b/arch/arm/boot/dts/exynos5410-odroidxu.dts
index d9499310a301..f6d135245a4b 100644
--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
+++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
@@ -447,14 +447,11 @@
         samsung,dw-mshc-ciu-div = <3>;
         samsung,dw-mshc-sdr-timing = <0 4>;
         samsung,dw-mshc-ddr-timing = <0 2>;
-        samsung,dw-mshc-hs400-timing = <0 2>;
-        samsung,read-strobe-delay = <90>;
         pinctrl-names = "default";
         pinctrl-0 = <&sd0_clk &sd0_cmd &sd0_bus1 &sd0_bus4 &sd0_bus8 &sd0_cd>;
         bus-width = <8>;
         cap-mmc-highspeed;
         mmc-hs200-1_8v;
-        mmc-hs400-1_8v;
         vmmc-supply = <&ldo20_reg>;
         vqmmc-supply = <&ldo11_reg>;
 };
diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
index 96ea936eeeb0..240a2864d044 100644
--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
+++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
@@ -64,7 +64,7 @@
         cd-gpios = <&gpio7 11 GPIO_ACTIVE_LOW>;
         no-1-8-v;
         keep-power-in-suspend;
-        enable-sdio-wakup;
+        wakeup-source;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/kirkwood-ib62x0.dts b/arch/arm/boot/dts/kirkwood-ib62x0.dts
index ef84d8699a76..5bf62897014c 100644
--- a/arch/arm/boot/dts/kirkwood-ib62x0.dts
+++ b/arch/arm/boot/dts/kirkwood-ib62x0.dts
@@ -113,7 +113,7 @@
 
         partition@e0000 {
                 label = "u-boot environment";
-                reg = <0xe0000 0x100000>;
+                reg = <0xe0000 0x20000>;
         };
 
         partition@100000 {
diff --git a/arch/arm/boot/dts/kirkwood-openrd.dtsi b/arch/arm/boot/dts/kirkwood-openrd.dtsi
index e4ecab112601..7175511a92da 100644
--- a/arch/arm/boot/dts/kirkwood-openrd.dtsi
+++ b/arch/arm/boot/dts/kirkwood-openrd.dtsi
@@ -116,6 +116,10 @@
         };
 };
 
+&pciec {
+        status = "okay";
+};
+
 &pcie0 {
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
index 365f39ff58bb..0ff1c2de95bf 100644
--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
+++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
@@ -35,10 +35,15 @@
         ranges = <0 0 0x00000000 0x1000000>;    /* CS0: 16MB for NAND */
 
         nand@0,0 {
-                linux,mtd-name = "micron,mt29f4g16abbda3w";
+                compatible = "ti,omap2-nand";
                 reg = <0 0 4>; /* CS0, offset 0, IO size 4 */
+                interrupt-parent = <&gpmc>;
+                interrupts = <0 IRQ_TYPE_NONE>, /* fifoevent */
+                             <1 IRQ_TYPE_NONE>; /* termcount */
+                linux,mtd-name = "micron,mt29f4g16abbda3w";
                 nand-bus-width = <16>;
                 ti,nand-ecc-opt = "bch8";
+                rb-gpios = <&gpmc 0 GPIO_ACTIVE_HIGH>; /* gpmc_wait0 */
                 gpmc,sync-clk-ps = <0>;
                 gpmc,cs-on-ns = <0>;
                 gpmc,cs-rd-off-ns = <44>;
@@ -54,10 +59,6 @@
                 gpmc,wr-access-ns = <40>;
                 gpmc,wr-data-mux-bus-ns = <0>;
                 gpmc,device-width = <2>;
-
-                gpmc,page-burst-access-ns = <5>;
-                gpmc,cycle2cycle-delay-ns = <50>;
-
                 #address-cells = <1>;
                 #size-cells = <1>;
 
diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
index 5e9a13c0eaf7..1c2c74655416 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
@@ -46,6 +46,7 @@
                 linux,mtd-name = "micron,mt29f4g16abbda3w";
                 nand-bus-width = <16>;
                 ti,nand-ecc-opt = "bch8";
+                rb-gpios = <&gpmc 0 GPIO_ACTIVE_HIGH>; /* gpmc_wait0 */
                 gpmc,sync-clk-ps = <0>;
                 gpmc,cs-on-ns = <0>;
                 gpmc,cs-rd-off-ns = <44>;
diff --git a/arch/arm/boot/dts/omap3-overo-base.dtsi b/arch/arm/boot/dts/omap3-overo-base.dtsi
index de256fa8da48..3e946cac55f3 100644
--- a/arch/arm/boot/dts/omap3-overo-base.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-base.dtsi
@@ -223,7 +223,9 @@
 };
 
 &gpmc {
-        ranges = <0 0 0x00000000 0x20000000>;
+        ranges = <0 0 0x30000000 0x1000000>,    /* CS0 */
+                 <4 0 0x2b000000 0x1000000>,    /* CS4 */
+                 <5 0 0x2c000000 0x1000000>;    /* CS5 */
 
         nand@0,0 {
                 compatible = "ti,omap2-nand";
diff --git a/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi b/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
index 7df27926ead2..4f4c6efbd518 100644
--- a/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
@@ -55,8 +55,6 @@
 #include "omap-gpmc-smsc9221.dtsi"
 
 &gpmc {
-        ranges = <5 0 0x2c000000 0x1000000>;    /* CS5 */
-
         ethernet@gpmc {
                 reg = <5 0 0xff>;
                 interrupt-parent = <&gpio6>;
diff --git a/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
index 9e24b6a1d07b..1b304e2f1bd2 100644
--- a/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
@@ -27,8 +27,6 @@
 #include "omap-gpmc-smsc9221.dtsi"
 
 &gpmc {
-        ranges = <5 0 0x2c000000 0x1000000>;    /* CS5 */
-
         ethernet@gpmc {
                 reg = <5 0 0xff>;
                 interrupt-parent = <&gpio6>;
diff --git a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
index 334109e14613..82e98ee3023a 100644
--- a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
@@ -15,9 +15,6 @@
 #include "omap-gpmc-smsc9221.dtsi"
 
 &gpmc {
-        ranges = <4 0 0x2b000000 0x1000000>,    /* CS4 */
-                 <5 0 0x2c000000 0x1000000>;    /* CS5 */
-
         smsc1: ethernet@gpmc {
                 reg = <5 0 0xff>;
                 interrupt-parent = <&gpio6>;
diff --git a/arch/arm/boot/dts/tegra114-dalmore.dts b/arch/arm/boot/dts/tegra114-dalmore.dts
index 1dfc492cc004..1444fbd543e7 100644
--- a/arch/arm/boot/dts/tegra114-dalmore.dts
+++ b/arch/arm/boot/dts/tegra114-dalmore.dts
@@ -897,7 +897,7 @@
                 palmas: tps65913@58 {
                         compatible = "ti,palmas";
                         reg = <0x58>;
-                        interrupts = <0 86 IRQ_TYPE_LEVEL_LOW>;
+                        interrupts = <0 86 IRQ_TYPE_LEVEL_HIGH>;
 
                         #interrupt-cells = <2>;
                         interrupt-controller;
diff --git a/arch/arm/boot/dts/tegra114-roth.dts b/arch/arm/boot/dts/tegra114-roth.dts
index 70cf40996c3f..966a7fc044af 100644
--- a/arch/arm/boot/dts/tegra114-roth.dts
+++ b/arch/arm/boot/dts/tegra114-roth.dts
@@ -802,7 +802,7 @@
                 palmas: pmic@58 {
                         compatible = "ti,palmas";
                         reg = <0x58>;
-                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_LOW>;
+                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
 
                         #interrupt-cells = <2>;
                         interrupt-controller;
diff --git a/arch/arm/boot/dts/tegra114-tn7.dts b/arch/arm/boot/dts/tegra114-tn7.dts
index 17dd14545862..a161fa1dfb61 100644
--- a/arch/arm/boot/dts/tegra114-tn7.dts
+++ b/arch/arm/boot/dts/tegra114-tn7.dts
@@ -63,7 +63,7 @@
                 palmas: pmic@58 {
                         compatible = "ti,palmas";
                         reg = <0x58>;
-                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_LOW>;
+                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
 
                         #interrupt-cells = <2>;
                         interrupt-controller;
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index bc5f50799d75..9f157e7c51e7 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -295,6 +295,7 @@ __und_svc_fault:
         bl      __und_fault
 
 __und_svc_finish:
+        get_thread_info tsk
         ldr     r5, [sp, #S_PSR]                @ Get SVC cpsr
         svc_exit r5                             @ return from exception
  UNWIND(.fnend          )
diff --git a/arch/arm/mach-imx/gpc.c b/arch/arm/mach-imx/gpc.c
index fd8720532471..0df062d8b2c9 100644
--- a/arch/arm/mach-imx/gpc.c
+++ b/arch/arm/mach-imx/gpc.c
@@ -271,6 +271,12 @@ static int __init imx_gpc_init(struct device_node *node,
         for (i = 0; i < IMR_NUM; i++)
                 writel_relaxed(~0, gpc_base + GPC_IMR1 + i * 4);
 
+        /*
+         * Clear the OF_POPULATED flag set in of_irq_init so that
+         * later the GPC power domain driver will not be skipped.
+         */
+        of_node_clear_flag(node, OF_POPULATED);
+
         return 0;
 }
 IRQCHIP_DECLARE(imx_gpc, "fsl,imx6q-gpc", imx_gpc_init);
diff --git a/arch/arm/mach-imx/mach-imx6ul.c b/arch/arm/mach-imx/mach-imx6ul.c
index 5d9bfab279dd..6bb7d9cf1e38 100644
--- a/arch/arm/mach-imx/mach-imx6ul.c
+++ b/arch/arm/mach-imx/mach-imx6ul.c
@@ -64,6 +64,7 @@ static void __init imx6ul_init_machine(void)
         if (parent == NULL)
                 pr_warn("failed to initialize soc device\n");
 
+        of_platform_default_populate(NULL, NULL, parent);
         imx6ul_enet_init();
         imx_anatop_init();
         imx6ul_pm_init();
diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
index 58924b3844df..67bab74fcbc5 100644
--- a/arch/arm/mach-imx/pm-imx6.c
+++ b/arch/arm/mach-imx/pm-imx6.c
@@ -295,7 +295,7 @@ int imx6_set_lpm(enum mxc_cpu_pwr_mode mode)
                 val &= ~BM_CLPCR_SBYOS;
                 if (cpu_is_imx6sl())
                         val |= BM_CLPCR_BYPASS_PMIC_READY;
-                if (cpu_is_imx6sl() || cpu_is_imx6sx())
+                if (cpu_is_imx6sl() || cpu_is_imx6sx() || cpu_is_imx6ul())
                         val |= BM_CLPCR_BYP_MMDC_CH0_LPM_HS;
                 else
                         val |= BM_CLPCR_BYP_MMDC_CH1_LPM_HS;
diff --git a/arch/arm/mach-omap2/cm33xx.c b/arch/arm/mach-omap2/cm33xx.c
index c073fb57dd13..6f2d0aec0513 100644
--- a/arch/arm/mach-omap2/cm33xx.c
+++ b/arch/arm/mach-omap2/cm33xx.c
@@ -220,9 +220,6 @@ static int am33xx_cm_wait_module_ready(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout(_is_module_ready(inst, clkctrl_offs),
                           MAX_MODULE_READY_TIME, i);
 
@@ -246,9 +243,6 @@ static int am33xx_cm_wait_module_idle(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout((_clkctrl_idlest(inst, clkctrl_offs) ==
                                 CLKCTRL_IDLEST_DISABLED),
                                 MAX_MODULE_READY_TIME, i);
diff --git a/arch/arm/mach-omap2/cminst44xx.c b/arch/arm/mach-omap2/cminst44xx.c
index 2c0e07ed6b99..2ab27ade136a 100644
--- a/arch/arm/mach-omap2/cminst44xx.c
+++ b/arch/arm/mach-omap2/cminst44xx.c
@@ -278,9 +278,6 @@ static int omap4_cminst_wait_module_ready(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout(_is_module_ready(part, inst, clkctrl_offs),
                           MAX_MODULE_READY_TIME, i);
 
@@ -304,9 +301,6 @@ static int omap4_cminst_wait_module_idle(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout((_clkctrl_idlest(part, inst, clkctrl_offs) ==
                            CLKCTRL_IDLEST_DISABLED),
                           MAX_MODULE_DISABLE_TIME, i);
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 5b709383381c..1052b29697b8 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1053,6 +1053,10 @@ static int _omap4_wait_target_disable(struct omap_hwmod *oh)
         if (oh->flags & HWMOD_NO_IDLEST)
                 return 0;
 
+        if (!oh->prcm.omap4.clkctrl_offs &&
+            !(oh->prcm.omap4.flags & HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET))
+                return 0;
+
         return omap_cm_wait_module_idle(oh->clkdm->prcm_partition,
                                         oh->clkdm->cm_inst,
                                         oh->prcm.omap4.clkctrl_offs, 0);
@@ -2971,6 +2975,10 @@ static int _omap4_wait_target_ready(struct omap_hwmod *oh)
         if (!_find_mpu_rt_port(oh))
                 return 0;
 
+        if (!oh->prcm.omap4.clkctrl_offs &&
+            !(oh->prcm.omap4.flags & HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET))
+                return 0;
+
         /* XXX check module SIDLEMODE, hardreset status */
 
         return omap_cm_wait_module_ready(oh->clkdm->prcm_partition,
diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h
index 4041bad79a9a..78904017f18c 100644
--- a/arch/arm/mach-omap2/omap_hwmod.h
+++ b/arch/arm/mach-omap2/omap_hwmod.h
@@ -443,8 +443,12 @@ struct omap_hwmod_omap2_prcm {
  * HWMOD_OMAP4_NO_CONTEXT_LOSS_BIT: Some IP blocks don't have a PRCM
  *     module-level context loss register associated with them; this
  *     flag bit should be set in those cases
+ * HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET: Some IP blocks have a valid CLKCTRL
+ *      offset of zero; this flag bit should be set in those cases to
+ *      distinguish from hwmods that have no clkctrl offset.
  */
 #define HWMOD_OMAP4_NO_CONTEXT_LOSS_BIT         (1 << 0)
+#define HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET         (1 << 1)
 
 /**
  * struct omap_hwmod_omap4_prcm - OMAP4-specific PRCM data
diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
index 55c5878577f4..e2d84aa7f595 100644
--- a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
@@ -29,6 +29,7 @@
 #define CLKCTRL(oh, clkctrl) ((oh).prcm.omap4.clkctrl_offs = (clkctrl))
 #define RSTCTRL(oh, rstctrl) ((oh).prcm.omap4.rstctrl_offs = (rstctrl))
 #define RSTST(oh, rstst) ((oh).prcm.omap4.rstst_offs = (rstst))
+#define PRCM_FLAGS(oh, flag) ((oh).prcm.omap4.flags = (flag))
 
 /*
  * 'l3' class
@@ -1296,6 +1297,7 @@ static void omap_hwmod_am33xx_clkctrl(void)
         CLKCTRL(am33xx_i2c1_hwmod, AM33XX_CM_WKUP_I2C0_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_wd_timer1_hwmod, AM33XX_CM_WKUP_WDT1_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_rtc_hwmod, AM33XX_CM_RTC_RTC_CLKCTRL_OFFSET);
+        PRCM_FLAGS(am33xx_rtc_hwmod, HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_mmc2_hwmod, AM33XX_CM_PER_MMC2_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_gpmc_hwmod, AM33XX_CM_PER_GPMC_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_l4_ls_hwmod, AM33XX_CM_PER_L4LS_CLKCTRL_OFFSET);
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index d72ee6185d5e..1cc4a6f3954e 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -722,8 +722,20 @@ static struct omap_hwmod omap3xxx_dss_dispc_hwmod = {
  * display serial interface controller
  */
 
+static struct omap_hwmod_class_sysconfig omap3xxx_dsi_sysc = {
+        .rev_offs       = 0x0000,
+        .sysc_offs      = 0x0010,
+        .syss_offs      = 0x0014,
+        .sysc_flags     = (SYSC_HAS_AUTOIDLE | SYSC_HAS_CLOCKACTIVITY |
+                           SYSC_HAS_ENAWAKEUP | SYSC_HAS_SIDLEMODE |
+                           SYSC_HAS_SOFTRESET | SYSS_HAS_RESET_STATUS),
+        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
+        .sysc_fields    = &omap_hwmod_sysc_type1,
+};
+
 static struct omap_hwmod_class omap3xxx_dsi_hwmod_class = {
         .name = "dsi",
+        .sysc   = &omap3xxx_dsi_sysc,
 };
 
 static struct omap_hwmod_irq_info omap3xxx_dsi1_irqs[] = {
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 62f4d01941f7..6344913f0804 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -728,7 +728,8 @@ static void *__init late_alloc(unsigned long sz)
 {
         void *ptr = (void *)__get_free_pages(PGALLOC_GFP, get_order(sz));
 
-        BUG_ON(!ptr);
+        if (!ptr || !pgtable_page_ctor(virt_to_page(ptr)))
+                BUG();
         return ptr;
 }
 
@@ -1155,10 +1156,19 @@ void __init sanity_check_meminfo(void)
 {
         phys_addr_t memblock_limit = 0;
         int highmem = 0;
-        phys_addr_t vmalloc_limit = __pa(vmalloc_min - 1) + 1;
+        u64 vmalloc_limit;
         struct memblock_region *reg;
         bool should_use_highmem = false;
 
+        /*
+         * Let's use our own (unoptimized) equivalent of __pa() that is
+         * not affected by wrap-arounds when sizeof(phys_addr_t) == 4.
+         * The result is used as the upper bound on physical memory address
+         * and may itself be outside the valid range for which phys_addr_t
+         * and therefore __pa() is defined.
+         */
+        vmalloc_limit = (u64)(uintptr_t)vmalloc_min - PAGE_OFFSET + PHYS_OFFSET;
+
         for_each_memblock(memory, reg) {
                 phys_addr_t block_start = reg->base;
                 phys_addr_t block_end = reg->base + reg->size;
@@ -1183,10 +1193,11 @@ void __init sanity_check_meminfo(void)
                         if (reg->size > size_limit) {
                                 phys_addr_t overlap_size = reg->size - size_limit;
 
-                                pr_notice("Truncating RAM at %pa-%pa to -%pa",
-                                          &block_start, &block_end, &vmalloc_limit);
-                                memblock_remove(vmalloc_limit, overlap_size);
+                                pr_notice("Truncating RAM at %pa-%pa",
+                                          &block_start, &block_end);
                                 block_end = vmalloc_limit;
+                                pr_cont(" to -%pa", &block_end);
+                                memblock_remove(vmalloc_limit, overlap_size);
                                 should_use_highmem = true;
                         }
                 }
diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S
index 9a3aec97ac09..ccf79d849e0a 100644
--- a/arch/arm64/kernel/sleep.S
+++ b/arch/arm64/kernel/sleep.S
@@ -101,12 +101,20 @@ ENTRY(cpu_resume)
         bl      el2_setup               // if in EL2 drop to EL1 cleanly
         /* enable the MMU early - so we can access sleep_save_stash by va */
         adr_l   lr, __enable_mmu        /* __cpu_setup will return here */
-        ldr     x27, =_cpu_resume       /* __enable_mmu will branch here */
+        adr_l   x27, _resume_switched   /* __enable_mmu will branch here */
         adrp    x25, idmap_pg_dir
         adrp    x26, swapper_pg_dir
         b       __cpu_setup
 ENDPROC(cpu_resume)
 
+        .pushsection    ".idmap.text", "ax"
+_resume_switched:
+        ldr     x8, =_cpu_resume
+        br      x8
+ENDPROC(_resume_switched)
+        .ltorg
+        .popsection
+
 ENTRY(_cpu_resume)
         mrs     x1, mpidr_el1
         adrp    x8, mpidr_hash
diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
index f94b80eb295d..9c3e75df2180 100644
--- a/arch/arm64/mm/dump.c
+++ b/arch/arm64/mm/dump.c
@@ -242,7 +242,7 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level,
 
 static void walk_pte(struct pg_state *st, pmd_t *pmd, unsigned long start)
 {
-        pte_t *pte = pte_offset_kernel(pmd, 0);
+        pte_t *pte = pte_offset_kernel(pmd, 0UL);
         unsigned long addr;
         unsigned i;
 
@@ -254,7 +254,7 @@ static void walk_pte(struct pg_state *st, pmd_t *pmd, unsigned long start)
 
 static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
 {
-        pmd_t *pmd = pmd_offset(pud, 0);
+        pmd_t *pmd = pmd_offset(pud, 0UL);
         unsigned long addr;
         unsigned i;
 
@@ -271,7 +271,7 @@ static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
 
 static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
 {
-        pud_t *pud = pud_offset(pgd, 0);
+        pud_t *pud = pud_offset(pgd, 0UL);
         unsigned long addr;
         unsigned i;
 
diff --git a/arch/arm64/mm/numa.c b/arch/arm64/mm/numa.c
index c7fe3ec70774..5bb15eab6f00 100644
--- a/arch/arm64/mm/numa.c
+++ b/arch/arm64/mm/numa.c
@@ -23,6 +23,8 @@
 #include <linux/module.h>
 #include <linux/of.h>
 
+#include <asm/acpi.h>
+
 struct pglist_data *node_data[MAX_NUMNODES] __read_mostly;
 EXPORT_SYMBOL(node_data);
 nodemask_t numa_nodes_parsed __initdata;
diff --git a/arch/parisc/include/uapi/asm/errno.h b/arch/parisc/include/uapi/asm/errno.h
index c0ae62520d15..274d5bc6ecce 100644
--- a/arch/parisc/include/uapi/asm/errno.h
+++ b/arch/parisc/include/uapi/asm/errno.h
@@ -97,10 +97,10 @@
 #define ENOTCONN        235     /* Transport endpoint is not connected */
 #define ESHUTDOWN       236     /* Cannot send after transport endpoint shutdown */
 #define ETOOMANYREFS    237     /* Too many references: cannot splice */
-#define EREFUSED        ECONNREFUSED    /* for HP's NFS apparently */
 #define ETIMEDOUT       238     /* Connection timed out */
 #define ECONNREFUSED    239     /* Connection refused */
-#define EREMOTERELEASE  240     /* Remote peer released connection */
+#define EREFUSED        ECONNREFUSED    /* for HP's NFS apparently */
+#define EREMOTERELEASE  240     /* Remote peer released connection */
 #define EHOSTDOWN       241     /* Host is down */
 #define EHOSTUNREACH    242     /* No route to host */
 
diff --git a/arch/parisc/kernel/processor.c b/arch/parisc/kernel/processor.c
index 5adc339eb7c8..0c2a94a0f751 100644
--- a/arch/parisc/kernel/processor.c
+++ b/arch/parisc/kernel/processor.c
@@ -51,8 +51,6 @@ EXPORT_SYMBOL(_parisc_requires_coherency);
 
 DEFINE_PER_CPU(struct cpuinfo_parisc, cpu_data);
 
-extern int update_cr16_clocksource(void);       /* from time.c */
-
 /*
 **      PARISC CPU driver - claim "device" and initialize CPU data structures.
 **
@@ -228,12 +226,6 @@ static int processor_probe(struct parisc_device *dev)
         }
 #endif
 
-        /* If we've registered more than one cpu,
-         * we'll use the jiffies clocksource since cr16
-         * is not synchronized between CPUs.
-         */
-        update_cr16_clocksource();
-
         return 0;
 }
 
diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
index 505cf1ac5af2..4b0b963d52a7 100644
--- a/arch/parisc/kernel/time.c
+++ b/arch/parisc/kernel/time.c
@@ -221,18 +221,6 @@ static struct clocksource clocksource_cr16 = {
         .flags                  = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
-int update_cr16_clocksource(void)
-{
-        /* since the cr16 cycle counters are not synchronized across CPUs,
-           we'll check if we should switch to a safe clocksource: */
-        if (clocksource_cr16.rating != 0 && num_online_cpus() > 1) {
-                clocksource_change_rating(&clocksource_cr16, 0);
-                return 1;
-        }
-
-        return 0;
-}
-
 void __init start_cpu_itimer(void)
 {
         unsigned int cpu = smp_processor_id();
diff --git a/arch/s390/boot/compressed/head.S b/arch/s390/boot/compressed/head.S
index f86a4eef28a9..28c4f96a2d9c 100644
--- a/arch/s390/boot/compressed/head.S
+++ b/arch/s390/boot/compressed/head.S
@@ -21,16 +21,21 @@ ENTRY(startup_continue)
         lg      %r15,.Lstack-.LPG1(%r13)
         aghi    %r15,-160
         brasl   %r14,decompress_kernel
-        # setup registers for memory mover & branch to target
+        # Set up registers for memory mover. We move the decompressed image to
+        # 0x11000, starting at offset 0x11000 in the decompressed image so
+        # that code living at 0x11000 in the image will end up at 0x11000 in
+        # memory.
         lgr     %r4,%r2
         lg      %r2,.Loffset-.LPG1(%r13)
         la      %r4,0(%r2,%r4)
         lg      %r3,.Lmvsize-.LPG1(%r13)
         lgr     %r5,%r3
-        # move the memory mover someplace safe
+        # Move the memory mover someplace safe so it doesn't overwrite itself.
         la      %r1,0x200
         mvc     0(mover_end-mover,%r1),mover-.LPG1(%r13)
-        # decompress image is started at 0x11000
+        # When the memory mover is done we pass control to
+        # arch/s390/kernel/head64.S:startup_continue which lives at 0x11000 in
+        # the decompressed image.
         lgr     %r6,%r2
         br      %r1
 mover:
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index 889ea3450210..26e0c7f08814 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -678,7 +678,7 @@ CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
-CONFIG_CRYPTO_CRC32_S390=m
+CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index 1bcfd764910a..24879dab47bc 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -616,7 +616,7 @@ CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
-CONFIG_CRYPTO_CRC32_S390=m
+CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index 13ff090139c8..a5c1e5f2a0ca 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -615,7 +615,7 @@ CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
-CONFIG_CRYPTO_CRC32_S390=m
+CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
diff --git a/arch/s390/crypto/crc32-vx.c b/arch/s390/crypto/crc32-vx.c
index 577ae1d4ae89..2bad9d837029 100644
--- a/arch/s390/crypto/crc32-vx.c
+++ b/arch/s390/crypto/crc32-vx.c
@@ -51,6 +51,9 @@ u32 crc32c_le_vgfm_16(u32 crc, unsigned char const *buf, size_t size);
                 struct kernel_fpu vxstate;                                  \
                 unsigned long prealign, aligned, remaining;                 \
                                                                             \
+                if (datalen < VX_MIN_LEN + VX_ALIGN_MASK)                   \
+                        return ___crc32_sw(crc, data, datalen);             \
+                                                                            \
                 if ((unsigned long)data & VX_ALIGN_MASK) {                  \
                         prealign = VX_ALIGNMENT -                           \
                                   ((unsigned long)data & VX_ALIGN_MASK);    \
@@ -59,9 +62,6 @@ u32 crc32c_le_vgfm_16(u32 crc, unsigned char const *buf, size_t size);
                         data = (void *)((unsigned long)data + prealign);    \
                 }                                                           \
                                                                             \
-                if (datalen < VX_MIN_LEN)                                   \
-                        return ___crc32_sw(crc, data, datalen);             \
-                                                                            \
                 aligned = datalen & ~VX_ALIGN_MASK;                         \
                 remaining = datalen & VX_ALIGN_MASK;                        \
                                                                             \
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index ccccebeeaaf6..73610f2e3b4f 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -234,7 +234,7 @@ CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
-CONFIG_CRYPTO_CRC32_S390=m
+CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_CRC7=m
 # CONFIG_XZ_DEC_X86 is not set
 # CONFIG_XZ_DEC_POWERPC is not set
diff --git a/arch/s390/kernel/head.S b/arch/s390/kernel/head.S
index 56e4d8234ef2..4431905f8cfa 100644
--- a/arch/s390/kernel/head.S
+++ b/arch/s390/kernel/head.S
@@ -309,7 +309,9 @@ ENTRY(startup_kdump)
         l       %r15,.Lstack-.LPG0(%r13)
         ahi     %r15,-STACK_FRAME_OVERHEAD
         brasl   %r14,verify_facilities
-        /* Continue with startup code in head64.S */
+# For uncompressed images, continue in
+# arch/s390/kernel/head64.S. For compressed images, continue in
+# arch/s390/boot/compressed/head.S.
         jg      startup_continue
 
 .Lstack:
diff --git a/arch/s390/lib/string.c b/arch/s390/lib/string.c
index e390bbb16443..48352bffbc92 100644
--- a/arch/s390/lib/string.c
+++ b/arch/s390/lib/string.c
@@ -237,11 +237,10 @@ char * strrchr(const char * s, int c)
 EXPORT_SYMBOL(strrchr);
 
 static inline int clcle(const char *s1, unsigned long l1,
-                        const char *s2, unsigned long l2,
-                        int *diff)
+                        const char *s2, unsigned long l2)
 {
         register unsigned long r2 asm("2") = (unsigned long) s1;
-        register unsigned long r3 asm("3") = (unsigned long) l2;
+        register unsigned long r3 asm("3") = (unsigned long) l1;
         register unsigned long r4 asm("4") = (unsigned long) s2;
         register unsigned long r5 asm("5") = (unsigned long) l2;
         int cc;
@@ -252,7 +251,6 @@ static inline int clcle(const char *s1, unsigned long l1,
                       "   srl   %0,28"
                       : "=&d" (cc), "+a" (r2), "+a" (r3),
                         "+a" (r4), "+a" (r5) : : "cc");
-        *diff = *(char *)r2 - *(char *)r4;
         return cc;
 }
 
@@ -270,9 +268,9 @@ char * strstr(const char * s1,const char * s2)
                 return (char *) s1;
         l1 = __strend(s1) - s1;
         while (l1-- >= l2) {
-                int cc, dummy;
+                int cc;
 
-                cc = clcle(s1, l1, s2, l2, &dummy);
+                cc = clcle(s1, l2, s2, l2);
                 if (!cc)
                         return (char *) s1;
                 s1++;
@@ -313,11 +311,11 @@ EXPORT_SYMBOL(memchr);
  */
 int memcmp(const void *cs, const void *ct, size_t n)
 {
-        int ret, diff;
+        int ret;
 
-        ret = clcle(cs, n, ct, n, &diff);
+        ret = clcle(cs, n, ct, n);
         if (ret)
-                ret = diff;
+                ret = ret == 1 ? -1 : 1;
         return ret;
 }
 EXPORT_SYMBOL(memcmp);
diff --git a/arch/s390/mm/pageattr.c b/arch/s390/mm/pageattr.c
index 7104ffb5a67f..af7cf28cf97e 100644
--- a/arch/s390/mm/pageattr.c
+++ b/arch/s390/mm/pageattr.c
@@ -252,6 +252,8 @@ static int change_page_attr(unsigned long addr, unsigned long end,
         int rc = -EINVAL;
         pgd_t *pgdp;
 
+        if (addr == end)
+                return 0;
         if (end >= MODULES_END)
                 return -EINVAL;
         mutex_lock(&cpa_mutex);
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 27a0228c9cae..b816971f5da4 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -355,6 +355,7 @@ void load_ucode_amd_ap(void)
         unsigned int cpu = smp_processor_id();
         struct equiv_cpu_entry *eq;
         struct microcode_amd *mc;
+        u8 *cont = container;
         u32 rev, eax;
         u16 eq_id;
 
@@ -371,8 +372,11 @@ void load_ucode_amd_ap(void)
         if (check_current_patch_level(&rev, false))
                 return;
 
+        /* Add CONFIG_RANDOMIZE_MEMORY offset. */
+        cont += PAGE_OFFSET - __PAGE_OFFSET_BASE;
+
         eax = cpuid_eax(0x00000001);
-        eq  = (struct equiv_cpu_entry *)(container + CONTAINER_HDR_SZ);
+        eq  = (struct equiv_cpu_entry *)(cont + CONTAINER_HDR_SZ);
 
         eq_id = find_equiv_id(eq, eax);
         if (!eq_id)
@@ -434,6 +438,9 @@ int __init save_microcode_in_initrd_amd(void)
         else
                 container = cont_va;
 
+        /* Add CONFIG_RANDOMIZE_MEMORY offset. */
+        container += PAGE_OFFSET - __PAGE_OFFSET_BASE;
+
         eax   = cpuid_eax(0x00000001);
         eax   = ((eax >> 8) & 0xf) + ((eax >> 20) & 0xff);
 
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 2a6e84a30a54..4296beb8fdd3 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -100,10 +100,11 @@ EXPORT_PER_CPU_SYMBOL(cpu_info);
 /* Logical package management. We might want to allocate that dynamically */
 static int *physical_to_logical_pkg __read_mostly;
 static unsigned long *physical_package_map __read_mostly;;
-static unsigned long *logical_package_map  __read_mostly;
 static unsigned int max_physical_pkg_id __read_mostly;
 unsigned int __max_logical_packages __read_mostly;
 EXPORT_SYMBOL(__max_logical_packages);
+static unsigned int logical_packages __read_mostly;
+static bool logical_packages_frozen __read_mostly;
 
 /* Maximum number of SMT threads on any online core */
 int __max_smt_threads __read_mostly;
@@ -277,14 +278,14 @@ int topology_update_package_map(unsigned int apicid, unsigned int cpu)
         if (test_and_set_bit(pkg, physical_package_map))
                 goto found;
 
-        new = find_first_zero_bit(logical_package_map, __max_logical_packages);
-        if (new >= __max_logical_packages) {
+        if (logical_packages_frozen) {
                 physical_to_logical_pkg[pkg] = -1;
-                pr_warn("APIC(%x) Package %u exceeds logical package map\n",
+                pr_warn("APIC(%x) Package %u exceeds logical package max\n",
                         apicid, pkg);
                 return -ENOSPC;
         }
-        set_bit(new, logical_package_map);
+
+        new = logical_packages++;
         pr_info("APIC(%x) Converting physical %u to logical package %u\n",
                 apicid, pkg, new);
         physical_to_logical_pkg[pkg] = new;
@@ -341,6 +342,7 @@ static void __init smp_init_package_map(void)
         }
 
         __max_logical_packages = DIV_ROUND_UP(total_cpus, ncpus);
+        logical_packages = 0;
 
         /*
          * Possibly larger than what we need as the number of apic ids per
@@ -352,10 +354,6 @@ static void __init smp_init_package_map(void)
         memset(physical_to_logical_pkg, 0xff, size);
         size = BITS_TO_LONGS(max_physical_pkg_id) * sizeof(unsigned long);
         physical_package_map = kzalloc(size, GFP_KERNEL);
-        size = BITS_TO_LONGS(__max_logical_packages) * sizeof(unsigned long);
-        logical_package_map = kzalloc(size, GFP_KERNEL);
-
-        pr_info("Max logical packages: %u\n", __max_logical_packages);
 
         for_each_present_cpu(cpu) {
                 unsigned int apicid = apic->cpu_present_to_apicid(cpu);
@@ -369,6 +367,15 @@ static void __init smp_init_package_map(void)
                 set_cpu_possible(cpu, false);
                 set_cpu_present(cpu, false);
         }
+
+        if (logical_packages > __max_logical_packages) {
+                pr_warn("Detected more packages (%u), then computed by BIOS data (%u).\n",
+                        logical_packages, __max_logical_packages);
+                logical_packages_frozen = true;
+                __max_logical_packages  = logical_packages;
+        }
+
+        pr_info("Max logical packages: %u\n", __max_logical_packages);
 }
 
 void __init smp_store_boot_cpu_info(void)
diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
index a3e3ccc87138..9634557a5444 100644
--- a/arch/x86/power/hibernate_64.c
+++ b/arch/x86/power/hibernate_64.c
@@ -113,7 +113,7 @@ static int set_up_temporary_mappings(void)
                         return result;
         }
 
-        temp_level4_pgt = (unsigned long)pgd - __PAGE_OFFSET;
+        temp_level4_pgt = __pa(pgd);
         return 0;
 }
 
diff --git a/crypto/Kconfig b/crypto/Kconfig
index a9377bef25e3..84d71482bf08 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -439,7 +439,7 @@ config CRYPTO_CRC32C_INTEL
 
 config CRYPT_CRC32C_VPMSUM
         tristate "CRC32c CRC algorithm (powerpc64)"
-        depends on PPC64
+        depends on PPC64 && ALTIVEC
         select CRYPTO_HASH
         select CRC32
         help
diff --git a/crypto/sha3_generic.c b/crypto/sha3_generic.c
index 62264397a2d2..7e8ed96236ce 100644
--- a/crypto/sha3_generic.c
+++ b/crypto/sha3_generic.c
@@ -24,14 +24,14 @@
 #define ROTL64(x, y) (((x) << (y)) | ((x) >> (64 - (y))))
 
 static const u64 keccakf_rndc[24] = {
-        0x0000000000000001, 0x0000000000008082, 0x800000000000808a,
-        0x8000000080008000, 0x000000000000808b, 0x0000000080000001,
-        0x8000000080008081, 0x8000000000008009, 0x000000000000008a,
-        0x0000000000000088, 0x0000000080008009, 0x000000008000000a,
-        0x000000008000808b, 0x800000000000008b, 0x8000000000008089,
-        0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
-        0x000000000000800a, 0x800000008000000a, 0x8000000080008081,
-        0x8000000000008080, 0x0000000080000001, 0x8000000080008008
+        0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL,
+        0x8000000080008000ULL, 0x000000000000808bULL, 0x0000000080000001ULL,
+        0x8000000080008081ULL, 0x8000000000008009ULL, 0x000000000000008aULL,
+        0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,
+        0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL,
+        0x8000000000008003ULL, 0x8000000000008002ULL, 0x8000000000000080ULL,
+        0x000000000000800aULL, 0x800000008000000aULL, 0x8000000080008081ULL,
+        0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL
 };
 
 static const int keccakf_rotc[24] = {
diff --git a/drivers/bus/vexpress-config.c b/drivers/bus/vexpress-config.c
index c3cb76b363c6..9efdf1de4035 100644
--- a/drivers/bus/vexpress-config.c
+++ b/drivers/bus/vexpress-config.c
@@ -178,6 +178,7 @@ static int vexpress_config_populate(struct device_node *node)
 
         parent = class_find_device(vexpress_config_class, NULL, bridge,
                         vexpress_config_node_match);
+        of_node_put(bridge);
         if (WARN_ON(!parent))
                 return -ENODEV;
 
diff --git a/drivers/clocksource/bcm_kona_timer.c b/drivers/clocksource/bcm_kona_timer.c
index 7e3fd375a627..92f6e4deee74 100644
--- a/drivers/clocksource/bcm_kona_timer.c
+++ b/drivers/clocksource/bcm_kona_timer.c
@@ -66,10 +66,10 @@ static void kona_timer_disable_and_clear(void __iomem *base)
 
 }
 
-static void
+static int
 kona_timer_get_counter(void __iomem *timer_base, uint32_t *msw, uint32_t *lsw)
 {
-        int loop_limit = 4;
+        int loop_limit = 3;
 
         /*
          * Read 64-bit free running counter
@@ -83,18 +83,19 @@ kona_timer_get_counter(void __iomem *timer_base, uint32_t *msw, uint32_t *lsw)
          *      if new hi-word is equal to previously read hi-word then stop.
          */
 
-        while (--loop_limit) {
+        do {
                 *msw = readl(timer_base + KONA_GPTIMER_STCHI_OFFSET);
                 *lsw = readl(timer_base + KONA_GPTIMER_STCLO_OFFSET);
                 if (*msw == readl(timer_base + KONA_GPTIMER_STCHI_OFFSET))
                         break;
-        }
+        } while (--loop_limit);
         if (!loop_limit) {
                 pr_err("bcm_kona_timer: getting counter failed.\n");
                 pr_err(" Timer will be impacted\n");
+                return -ETIMEDOUT;
         }
 
-        return;
+        return 0;
 }
 
 static int kona_timer_set_next_event(unsigned long clc,
@@ -112,8 +113,11 @@ static int kona_timer_set_next_event(unsigned long clc,
 
         uint32_t lsw, msw;
         uint32_t reg;
+        int ret;
 
-        kona_timer_get_counter(timers.tmr_regs, &msw, &lsw);
+        ret = kona_timer_get_counter(timers.tmr_regs, &msw, &lsw);
+        if (ret)
+                return ret;
 
         /* Load the "next" event tick value */
         writel(lsw + clc, timers.tmr_regs + KONA_GPTIMER_STCM0_OFFSET);
diff --git a/drivers/clocksource/mips-gic-timer.c b/drivers/clocksource/mips-gic-timer.c
index d91e8725917c..b4b3ab5a11ad 100644
--- a/drivers/clocksource/mips-gic-timer.c
+++ b/drivers/clocksource/mips-gic-timer.c
@@ -164,7 +164,7 @@ void __init gic_clocksource_init(unsigned int frequency)
         gic_start_count();
 }
 
-static void __init gic_clocksource_of_init(struct device_node *node)
+static int __init gic_clocksource_of_init(struct device_node *node)
 {
         struct clk *clk;
         int ret;
diff --git a/drivers/clocksource/time-armada-370-xp.c b/drivers/clocksource/time-armada-370-xp.c
index 719b478d136e..3c39e6f45971 100644
--- a/drivers/clocksource/time-armada-370-xp.c
+++ b/drivers/clocksource/time-armada-370-xp.c
@@ -338,7 +338,6 @@ static int __init armada_xp_timer_init(struct device_node *np)
         struct clk *clk = of_clk_get_by_name(np, "fixed");
         int ret;
 
-        clk = of_clk_get(np, 0);
         if (IS_ERR(clk)) {
                 pr_err("Failed to get clock");
                 return PTR_ERR(clk);
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index ea8189f4b021..6dc597126b79 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -441,6 +441,9 @@ static int aead_set_sh_desc(struct crypto_aead *aead)
                                OP_ALG_AAI_CTR_MOD128);
         const bool is_rfc3686 = alg->caam.rfc3686;
 
+        if (!ctx->authsize)
+                return 0;
+
         /* NULL encryption / decryption */
         if (!ctx->enckeylen)
                 return aead_null_set_sh_desc(aead);
@@ -614,7 +617,7 @@ skip_enc:
                 keys_fit_inline = true;
 
         /* aead_givencrypt shared descriptor */
-        desc = ctx->sh_desc_givenc;
+        desc = ctx->sh_desc_enc;
 
         /* Note: Context registers are saved. */
         init_sh_desc_key_aead(desc, ctx, keys_fit_inline, is_rfc3686);
@@ -645,13 +648,13 @@ copy_iv:
         append_operation(desc, ctx->class2_alg_type |
                          OP_ALG_AS_INITFINAL | OP_ALG_ENCRYPT);
 
-        /* ivsize + cryptlen = seqoutlen - authsize */
-        append_math_sub_imm_u32(desc, REG3, SEQOUTLEN, IMM, ctx->authsize);
-
         /* Read and write assoclen bytes */
         append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ);
         append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
 
+        /* ivsize + cryptlen = seqoutlen - authsize */
+        append_math_sub_imm_u32(desc, REG3, SEQOUTLEN, IMM, ctx->authsize);
+
         /* Skip assoc data */
         append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
 
@@ -697,7 +700,7 @@ copy_iv:
         ctx->sh_desc_enc_dma = dma_map_single(jrdev, desc,
                                               desc_bytes(desc),
                                               DMA_TO_DEVICE);
-        if (dma_mapping_error(jrdev, ctx->sh_desc_givenc_dma)) {
+        if (dma_mapping_error(jrdev, ctx->sh_desc_enc_dma)) {
                 dev_err(jrdev, "unable to map shared descriptor\n");
                 return -ENOMEM;
         }
diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
index f1ecc8df8d41..36365b3efdfd 100644
--- a/drivers/crypto/caam/caamhash.c
+++ b/drivers/crypto/caam/caamhash.c
@@ -1898,6 +1898,7 @@ caam_hash_alloc(struct caam_hash_template *template,
                          template->name);
                 snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s",
                          template->driver_name);
+                t_alg->ahash_alg.setkey = NULL;
         }
         alg->cra_module = THIS_MODULE;
         alg->cra_init = caam_hash_cra_init;
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index d0c1dab9b435..dff1a4a6dc1b 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -251,6 +251,14 @@ config EDAC_SBRIDGE
           Support for error detection and correction the Intel
           Sandy Bridge, Ivy Bridge and Haswell Integrated Memory Controllers.
 
+config EDAC_SKX
+        tristate "Intel Skylake server Integrated MC"
+        depends on EDAC_MM_EDAC && PCI && X86_64 && X86_MCE_INTEL
+        depends on PCI_MMCONFIG
+        help
+          Support for error detection and correction the Intel
+          Skylake server Integrated Memory Controllers.
+
 config EDAC_MPC85XX
         tristate "Freescale MPC83xx / MPC85xx"
         depends on EDAC_MM_EDAC && FSL_SOC
diff --git a/drivers/edac/Makefile b/drivers/edac/Makefile
index f9e4a3e0e6e9..986049925b08 100644
--- a/drivers/edac/Makefile
+++ b/drivers/edac/Makefile
@@ -31,6 +31,7 @@ obj-$(CONFIG_EDAC_I5400)		+= i5400_edac.o
 obj-$(CONFIG_EDAC_I7300)                += i7300_edac.o
 obj-$(CONFIG_EDAC_I7CORE)               += i7core_edac.o
 obj-$(CONFIG_EDAC_SBRIDGE)              += sb_edac.o
+obj-$(CONFIG_EDAC_SKX)                  += skx_edac.o
 obj-$(CONFIG_EDAC_E7XXX)                += e7xxx_edac.o
 obj-$(CONFIG_EDAC_E752X)                += e752x_edac.o
 obj-$(CONFIG_EDAC_I82443BXGX)           += i82443bxgx_edac.o
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index 4fb2eb7c800d..ce0067b7a2f6 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -552,9 +552,9 @@ static const struct pci_id_table pci_dev_descr_haswell_table[] = {
 /* Knight's Landing Support */
 /*
  * KNL's memory channels are swizzled between memory controllers.
- * MC0 is mapped to CH3,5,6 and MC1 is mapped to CH0,1,2
+ * MC0 is mapped to CH3,4,5 and MC1 is mapped to CH0,1,2
  */
-#define knl_channel_remap(channel) ((channel + 3) % 6)
+#define knl_channel_remap(mc, chan) ((mc) ? (chan) : (chan) + 3)
 
 /* Memory controller, TAD tables, error injection - 2-8-0, 2-9-0 (2 of these) */
 #define PCI_DEVICE_ID_INTEL_KNL_IMC_MC       0x7840
@@ -1286,7 +1286,7 @@ static u32 knl_get_mc_route(int entry, u32 reg)
         mc = GET_BITFIELD(reg, entry*3, (entry*3)+2);
         chan = GET_BITFIELD(reg, (entry*2) + 18, (entry*2) + 18 + 1);
 
-        return knl_channel_remap(mc*3 + chan);
+        return knl_channel_remap(mc, chan);
 }
 
 /*
@@ -2997,8 +2997,15 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci,
                 } else {
                         char A = *("A");
 
-                        channel = knl_channel_remap(channel);
+                        /*
+                         * Reported channel is in range 0-2, so we can't map it
+                         * back to mc. To figure out mc we check machine check
+                         * bank register that reported this error.
+                         * bank15 means mc0 and bank16 means mc1.
+                         */
+                        channel = knl_channel_remap(m->bank == 16, channel);
                         channel_mask = 1 << channel;
+
                         snprintf(msg, sizeof(msg),
                                 "%s%s err_code:%04x:%04x channel:%d (DIMM_%c)",
                                 overflow ? " OVERFLOW" : "",
diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c
new file mode 100644
index 000000000000..0ff4878c2aa1
--- /dev/null
+++ b/drivers/edac/skx_edac.c
@@ -0,0 +1,1121 @@
+/*
+ * EDAC driver for Intel(R) Xeon(R) Skylake processors
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/pci_ids.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/edac.h>
+#include <linux/mmzone.h>
+#include <linux/smp.h>
+#include <linux/bitmap.h>
+#include <linux/math64.h>
+#include <linux/mod_devicetable.h>
+#include <asm/cpu_device_id.h>
+#include <asm/processor.h>
+#include <asm/mce.h>
+
+#include "edac_core.h"
+
+#define SKX_REVISION    " Ver: 1.0 "
+
+/*
+ * Debug macros
+ */
+#define skx_printk(level, fmt, arg...)                  \
+        edac_printk(level, "skx", fmt, ##arg)
+
+#define skx_mc_printk(mci, level, fmt, arg...)          \
+        edac_mc_chipset_printk(mci, level, "skx", fmt, ##arg)
+
+/*
+ * Get a bit field at register value <v>, from bit <lo> to bit <hi>
+ */
+#define GET_BITFIELD(v, lo, hi) \
+        (((v) & GENMASK_ULL((hi), (lo))) >> (lo))
+
+static LIST_HEAD(skx_edac_list);
+
+static u64 skx_tolm, skx_tohm;
+
+#define NUM_IMC                 2       /* memory controllers per socket */
+#define NUM_CHANNELS            3       /* channels per memory controller */
+#define NUM_DIMMS               2       /* Max DIMMS per channel */
+
+#define MASK26  0x3FFFFFF               /* Mask for 2^26 */
+#define MASK29  0x1FFFFFFF              /* Mask for 2^29 */
+
+/*
+ * Each cpu socket contains some pci devices that provide global
+ * information, and also some that are local to each of the two
+ * memory controllers on the die.
+ */
+struct skx_dev {
+        struct list_head        list;
+        u8                      bus[4];
+        struct pci_dev  *sad_all;
+        struct pci_dev  *util_all;
+        u32     mcroute;
+        struct skx_imc {
+                struct mem_ctl_info *mci;
+                u8      mc;     /* system wide mc# */
+                u8      lmc;    /* socket relative mc# */
+                u8      src_id, node_id;
+                struct skx_channel {
+                        struct pci_dev *cdev;
+                        struct skx_dimm {
+                                u8      close_pg;
+                                u8      bank_xor_enable;
+                                u8      fine_grain_bank;
+                                u8      rowbits;
+                                u8      colbits;
+                        } dimms[NUM_DIMMS];
+                } chan[NUM_CHANNELS];
+        } imc[NUM_IMC];
+};
+static int skx_num_sockets;
+
+struct skx_pvt {
+        struct skx_imc  *imc;
+};
+
+struct decoded_addr {
+        struct skx_dev *dev;
+        u64     addr;
+        int     socket;
+        int     imc;
+        int     channel;
+        u64     chan_addr;
+        int     sktways;
+        int     chanways;
+        int     dimm;
+        int     rank;
+        int     channel_rank;
+        u64     rank_address;
+        int     row;
+        int     column;
+        int     bank_address;
+        int     bank_group;
+};
+
+static struct skx_dev *get_skx_dev(u8 bus, u8 idx)
+{
+        struct skx_dev *d;
+
+        list_for_each_entry(d, &skx_edac_list, list) {
+                if (d->bus[idx] == bus)
+                        return d;
+        }
+
+        return NULL;
+}
+
+enum munittype {
+        CHAN0, CHAN1, CHAN2, SAD_ALL, UTIL_ALL, SAD
+};
+
+struct munit {
+        u16     did;
+        u16     devfn[NUM_IMC];
+        u8      busidx;
+        u8      per_socket;
+        enum munittype mtype;
+};
+
+/*
+ * List of PCI device ids that we need together with some device
+ * number and function numbers to tell which memory controller the
+ * device belongs to.
+ */
+static const struct munit skx_all_munits[] = {
+        { 0x2054, { }, 1, 1, SAD_ALL },
+        { 0x2055, { }, 1, 1, UTIL_ALL },
+        { 0x2040, { PCI_DEVFN(10, 0), PCI_DEVFN(12, 0) }, 2, 2, CHAN0 },
+        { 0x2044, { PCI_DEVFN(10, 4), PCI_DEVFN(12, 4) }, 2, 2, CHAN1 },
+        { 0x2048, { PCI_DEVFN(11, 0), PCI_DEVFN(13, 0) }, 2, 2, CHAN2 },
+        { 0x208e, { }, 1, 0, SAD },
+        { }
+};
+
+/*
+ * We use the per-socket device 0x2016 to count how many sockets are present,
+ * and to detemine which PCI buses are associated with each socket. Allocate
+ * and build the full list of all the skx_dev structures that we need here.
+ */
+static int get_all_bus_mappings(void)
+{
+        struct pci_dev *pdev, *prev;
+        struct skx_dev *d;
+        u32 reg;
+        int ndev = 0;
+
+        prev = NULL;
+        for (;;) {
+                pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x2016, prev);
+                if (!pdev)
+                        break;
+                ndev++;
+                d = kzalloc(sizeof(*d), GFP_KERNEL);
+                if (!d) {
+                        pci_dev_put(pdev);
+                        return -ENOMEM;
+                }
+                pci_read_config_dword(pdev, 0xCC, &reg);
+                d->bus[0] =  GET_BITFIELD(reg, 0, 7);
+                d->bus[1] =  GET_BITFIELD(reg, 8, 15);
+                d->bus[2] =  GET_BITFIELD(reg, 16, 23);
+                d->bus[3] =  GET_BITFIELD(reg, 24, 31);
+                edac_dbg(2, "busses: %x, %x, %x, %x\n",
+                         d->bus[0], d->bus[1], d->bus[2], d->bus[3]);
+                list_add_tail(&d->list, &skx_edac_list);
+                skx_num_sockets++;
+                prev = pdev;
+        }
+
+        return ndev;
+}
+
+static int get_all_munits(const struct munit *m)
+{
+        struct pci_dev *pdev, *prev;
+        struct skx_dev *d;
+        u32 reg;
+        int i = 0, ndev = 0;
+
+        prev = NULL;
+        for (;;) {
+                pdev = pci_get_device(PCI_VENDOR_ID_INTEL, m->did, prev);
+                if (!pdev)
+                        break;
+                ndev++;
+                if (m->per_socket == NUM_IMC) {
+                        for (i = 0; i < NUM_IMC; i++)
+                                if (m->devfn[i] == pdev->devfn)
+                                        break;
+                        if (i == NUM_IMC)
+                                goto fail;
+                }
+                d = get_skx_dev(pdev->bus->number, m->busidx);
+                if (!d)
+                        goto fail;
+
+                /* Be sure that the device is enabled */
+                if (unlikely(pci_enable_device(pdev) < 0)) {
+                        skx_printk(KERN_ERR,
+                                "Couldn't enable %04x:%04x\n", PCI_VENDOR_ID_INTEL, m->did);
+                        goto fail;
+                }
+
+                switch (m->mtype) {
+                case CHAN0: case CHAN1: case CHAN2:
+                        pci_dev_get(pdev);
+                        d->imc[i].chan[m->mtype].cdev = pdev;
+                        break;
+                case SAD_ALL:
+                        pci_dev_get(pdev);
+                        d->sad_all = pdev;
+                        break;
+                case UTIL_ALL:
+                        pci_dev_get(pdev);
+                        d->util_all = pdev;
+                        break;
+                case SAD:
+                        /*
+                         * one of these devices per core, including cores
+                         * that don't exist on this SKU. Ignore any that
+                         * read a route table of zero, make sure all the
+                         * non-zero values match.
+                         */
+                        pci_read_config_dword(pdev, 0xB4, &reg);
+                        if (reg != 0) {
+                                if (d->mcroute == 0)
+                                        d->mcroute = reg;
+                                else if (d->mcroute != reg) {
+                                        skx_printk(KERN_ERR,
+                                                "mcroute mismatch\n");
+                                        goto fail;
+                                }
+                        }
+                        ndev--;
+                        break;
+                }
+
+                prev = pdev;
+        }
+
+        return ndev;
+fail:
+        pci_dev_put(pdev);
+        return -ENODEV;
+}
+
+const struct x86_cpu_id skx_cpuids[] = {
+        { X86_VENDOR_INTEL, 6, 0x55, 0, 0 },    /* Skylake */
+        { }
+};
+MODULE_DEVICE_TABLE(x86cpu, skx_cpuids);
+
+static u8 get_src_id(struct skx_dev *d)
+{
+        u32 reg;
+
+        pci_read_config_dword(d->util_all, 0xF0, &reg);
+
+        return GET_BITFIELD(reg, 12, 14);
+}
+
+static u8 skx_get_node_id(struct skx_dev *d)
+{
+        u32 reg;
+
+        pci_read_config_dword(d->util_all, 0xF4, &reg);
+
+        return GET_BITFIELD(reg, 0, 2);
+}
+
+static int get_dimm_attr(u32 reg, int lobit, int hibit, int add, int minval,
+                         int maxval, char *name)
+{
+        u32 val = GET_BITFIELD(reg, lobit, hibit);
+
+        if (val < minval || val > maxval) {
+                edac_dbg(2, "bad %s = %d (raw=%x)\n", name, val, reg);
+                return -EINVAL;
+        }
+        return val + add;
+}
+
+#define IS_DIMM_PRESENT(mtr)            GET_BITFIELD((mtr), 15, 15)
+
+#define numrank(reg) get_dimm_attr((reg), 12, 13, 0, 1, 2, "ranks")
+#define numrow(reg) get_dimm_attr((reg), 2, 4, 12, 1, 6, "rows")
+#define numcol(reg) get_dimm_attr((reg), 0, 1, 10, 0, 2, "cols")
+
+static int get_width(u32 mtr)
+{
+        switch (GET_BITFIELD(mtr, 8, 9)) {
+        case 0:
+                return DEV_X4;
+        case 1:
+                return DEV_X8;
+        case 2:
+                return DEV_X16;
+        }
+        return DEV_UNKNOWN;
+}
+
+static int skx_get_hi_lo(void)
+{
+        struct pci_dev *pdev;
+        u32 reg;
+
+        pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x2034, NULL);
+        if (!pdev) {
+                edac_dbg(0, "Can't get tolm/tohm\n");
+                return -ENODEV;
+        }
+
+        pci_read_config_dword(pdev, 0xD0, &reg);
+        skx_tolm = reg;
+        pci_read_config_dword(pdev, 0xD4, &reg);
+        skx_tohm = reg;
+        pci_read_config_dword(pdev, 0xD8, &reg);
+        skx_tohm |= (u64)reg << 32;
+
+        pci_dev_put(pdev);
+        edac_dbg(2, "tolm=%llx tohm=%llx\n", skx_tolm, skx_tohm);
+
+        return 0;
+}
+
+static int get_dimm_info(u32 mtr, u32 amap, struct dimm_info *dimm,
+                         struct skx_imc *imc, int chan, int dimmno)
+{
+        int  banks = 16, ranks, rows, cols, npages;
+        u64 size;
+
+        if (!IS_DIMM_PRESENT(mtr))
+                return 0;
+        ranks = numrank(mtr);
+        rows = numrow(mtr);
+        cols = numcol(mtr);
+
+        /*
+         * Compute size in 8-byte (2^3) words, then shift to MiB (2^20)
+         */
+        size = ((1ull << (rows + cols + ranks)) * banks) >> (20 - 3);
+        npages = MiB_TO_PAGES(size);
+
+        edac_dbg(0, "mc#%d: channel %d, dimm %d, %lld Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
+                 imc->mc, chan, dimmno, size, npages,
+                 banks, ranks, rows, cols);
+
+        imc->chan[chan].dimms[dimmno].close_pg = GET_BITFIELD(mtr, 0, 0);
+        imc->chan[chan].dimms[dimmno].bank_xor_enable = GET_BITFIELD(mtr, 9, 9);
+        imc->chan[chan].dimms[dimmno].fine_grain_bank = GET_BITFIELD(amap, 0, 0);
+        imc->chan[chan].dimms[dimmno].rowbits = rows;
+        imc->chan[chan].dimms[dimmno].colbits = cols;
+
+        dimm->nr_pages = npages;
+        dimm->grain = 32;
+        dimm->dtype = get_width(mtr);
+        dimm->mtype = MEM_DDR4;
+        dimm->edac_mode = EDAC_SECDED; /* likely better than this */
+        snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u",
+                 imc->src_id, imc->lmc, chan, dimmno);
+
+        return 1;
+}
+
+#define SKX_GET_MTMTR(dev, reg) \
+        pci_read_config_dword((dev), 0x87c, &reg)
+
+static bool skx_check_ecc(struct pci_dev *pdev)
+{
+        u32 mtmtr;
+
+        SKX_GET_MTMTR(pdev, mtmtr);
+
+        return !!GET_BITFIELD(mtmtr, 2, 2);
+}
+
+static int skx_get_dimm_config(struct mem_ctl_info *mci)
+{
+        struct skx_pvt *pvt = mci->pvt_info;
+        struct skx_imc *imc = pvt->imc;
+        struct dimm_info *dimm;
+        int i, j;
+        u32 mtr, amap;
+        int ndimms;
+
+        for (i = 0; i < NUM_CHANNELS; i++) {
+                ndimms = 0;
+                pci_read_config_dword(imc->chan[i].cdev, 0x8C, &amap);
+                for (j = 0; j < NUM_DIMMS; j++) {
+                        dimm = EDAC_DIMM_PTR(mci->layers, mci->dimms,
+                                             mci->n_layers, i, j, 0);
+                        pci_read_config_dword(imc->chan[i].cdev,
+                                        0x80 + 4*j, &mtr);
+                        ndimms += get_dimm_info(mtr, amap, dimm, imc, i, j);
+                }
+                if (ndimms && !skx_check_ecc(imc->chan[0].cdev)) {
+                        skx_printk(KERN_ERR, "ECC is disabled on imc %d\n", imc->mc);
+                        return -ENODEV;
+                }
+        }
+
+        return 0;
+}
+
+static void skx_unregister_mci(struct skx_imc *imc)
+{
+        struct mem_ctl_info *mci = imc->mci;
+
+        if (!mci)
+                return;
+
+        edac_dbg(0, "MC%d: mci = %p\n", imc->mc, mci);
+
+        /* Remove MC sysfs nodes */
+        edac_mc_del_mc(mci->pdev);
+
+        edac_dbg(1, "%s: free mci struct\n", mci->ctl_name);
+        kfree(mci->ctl_name);
+        edac_mc_free(mci);
+}
+
+static int skx_register_mci(struct skx_imc *imc)
+{
+        struct mem_ctl_info *mci;
+        struct edac_mc_layer layers[2];
+        struct pci_dev *pdev = imc->chan[0].cdev;
+        struct skx_pvt *pvt;
+        int rc;
+
+        /* allocate a new MC control structure */
+        layers[0].type = EDAC_MC_LAYER_CHANNEL;
+        layers[0].size = NUM_CHANNELS;
+        layers[0].is_virt_csrow = false;
+        layers[1].type = EDAC_MC_LAYER_SLOT;
+        layers[1].size = NUM_DIMMS;
+        layers[1].is_virt_csrow = true;
+        mci = edac_mc_alloc(imc->mc, ARRAY_SIZE(layers), layers,
+                            sizeof(struct skx_pvt));
+
+        if (unlikely(!mci))
+                return -ENOMEM;
+
+        edac_dbg(0, "MC#%d: mci = %p\n", imc->mc, mci);
+
+        /* Associate skx_dev and mci for future usage */
+        imc->mci = mci;
+        pvt = mci->pvt_info;
+        pvt->imc = imc;
+
+        mci->ctl_name = kasprintf(GFP_KERNEL, "Skylake Socket#%d IMC#%d",
+                                  imc->node_id, imc->lmc);
+        mci->mtype_cap = MEM_FLAG_DDR4;
+        mci->edac_ctl_cap = EDAC_FLAG_NONE;
+        mci->edac_cap = EDAC_FLAG_NONE;
+        mci->mod_name = "skx_edac.c";
+        mci->dev_name = pci_name(imc->chan[0].cdev);
+        mci->mod_ver = SKX_REVISION;
+        mci->ctl_page_to_phys = NULL;
+
+        rc = skx_get_dimm_config(mci);
+        if (rc < 0)
+                goto fail;
+
+        /* record ptr to the generic device */
+        mci->pdev = &pdev->dev;
+
+        /* add this new MC control structure to EDAC's list of MCs */
+        if (unlikely(edac_mc_add_mc(mci))) {
+                edac_dbg(0, "MC: failed edac_mc_add_mc()\n");
+                rc = -EINVAL;
+                goto fail;
+        }
+
+        return 0;
+
+fail:
+        kfree(mci->ctl_name);
+        edac_mc_free(mci);
+        imc->mci = NULL;
+        return rc;
+}
+
+#define SKX_MAX_SAD 24
+
+#define SKX_GET_SAD(d, i, reg)  \
+        pci_read_config_dword((d)->sad_all, 0x60 + 8 * (i), &reg)
+#define SKX_GET_ILV(d, i, reg)  \
+        pci_read_config_dword((d)->sad_all, 0x64 + 8 * (i), &reg)
+
+#define SKX_SAD_MOD3MODE(sad)   GET_BITFIELD((sad), 30, 31)
+#define SKX_SAD_MOD3(sad)       GET_BITFIELD((sad), 27, 27)
+#define SKX_SAD_LIMIT(sad)      (((u64)GET_BITFIELD((sad), 7, 26) << 26) | MASK26)
+#define SKX_SAD_MOD3ASMOD2(sad) GET_BITFIELD((sad), 5, 6)
+#define SKX_SAD_ATTR(sad)       GET_BITFIELD((sad), 3, 4)
+#define SKX_SAD_INTERLEAVE(sad) GET_BITFIELD((sad), 1, 2)
+#define SKX_SAD_ENABLE(sad)     GET_BITFIELD((sad), 0, 0)
+
+#define SKX_ILV_REMOTE(tgt)     (((tgt) & 8) == 0)
+#define SKX_ILV_TARGET(tgt)     ((tgt) & 7)
+
+static bool skx_sad_decode(struct decoded_addr *res)
+{
+        struct skx_dev *d = list_first_entry(&skx_edac_list, typeof(*d), list);
+        u64 addr = res->addr;
+        int i, idx, tgt, lchan, shift;
+        u32 sad, ilv;
+        u64 limit, prev_limit;
+        int remote = 0;
+
+        /* Simple sanity check for I/O space or out of range */
+        if (addr >= skx_tohm || (addr >= skx_tolm && addr < BIT_ULL(32))) {
+                edac_dbg(0, "Address %llx out of range\n", addr);
+                return false;
+        }
+
+restart:
+        prev_limit = 0;
+        for (i = 0; i < SKX_MAX_SAD; i++) {
+                SKX_GET_SAD(d, i, sad);
+                limit = SKX_SAD_LIMIT(sad);
+                if (SKX_SAD_ENABLE(sad)) {
+                        if (addr >= prev_limit && addr <= limit)
+                                goto sad_found;
+                }
+                prev_limit = limit + 1;
+        }
+        edac_dbg(0, "No SAD entry for %llx\n", addr);
+        return false;
+
+sad_found:
+        SKX_GET_ILV(d, i, ilv);
+
+        switch (SKX_SAD_INTERLEAVE(sad)) {
+        case 0:
+                idx = GET_BITFIELD(addr, 6, 8);
+                break;
+        case 1:
+                idx = GET_BITFIELD(addr, 8, 10);
+                break;
+        case 2:
+                idx = GET_BITFIELD(addr, 12, 14);
+                break;
+        case 3:
+                idx = GET_BITFIELD(addr, 30, 32);
+                break;
+        }
+
+        tgt = GET_BITFIELD(ilv, 4 * idx, 4 * idx + 3);
+
+        /* If point to another node, find it and start over */
+        if (SKX_ILV_REMOTE(tgt)) {
+                if (remote) {
+                        edac_dbg(0, "Double remote!\n");
+                        return false;
+                }
+                remote = 1;
+                list_for_each_entry(d, &skx_edac_list, list) {
+                        if (d->imc[0].src_id == SKX_ILV_TARGET(tgt))
+                                goto restart;
+                }
+                edac_dbg(0, "Can't find node %d\n", SKX_ILV_TARGET(tgt));
+                return false;
+        }
+
+        if (SKX_SAD_MOD3(sad) == 0)
+                lchan = SKX_ILV_TARGET(tgt);
+        else {
+                switch (SKX_SAD_MOD3MODE(sad)) {
+                case 0:
+                        shift = 6;
+                        break;
+                case 1:
+                        shift = 8;
+                        break;
+                case 2:
+                        shift = 12;
+                        break;
+                default:
+                        edac_dbg(0, "illegal mod3mode\n");
+                        return false;
+                }
+                switch (SKX_SAD_MOD3ASMOD2(sad)) {
+                case 0:
+                        lchan = (addr >> shift) % 3;
+                        break;
+                case 1:
+                        lchan = (addr >> shift) % 2;
+                        break;
+                case 2:
+                        lchan = (addr >> shift) % 2;
+                        lchan = (lchan << 1) | ~lchan;
+                        break;
+                case 3:
+                        lchan = ((addr >> shift) % 2) << 1;
+                        break;
+                }
+                lchan = (lchan << 1) | (SKX_ILV_TARGET(tgt) & 1);
+        }
+
+        res->dev = d;
+        res->socket = d->imc[0].src_id;
+        res->imc = GET_BITFIELD(d->mcroute, lchan * 3, lchan * 3 + 2);
+        res->channel = GET_BITFIELD(d->mcroute, lchan * 2 + 18, lchan * 2 + 19);
+
+        edac_dbg(2, "%llx: socket=%d imc=%d channel=%d\n",
+                 res->addr, res->socket, res->imc, res->channel);
+        return true;
+}
+
+#define SKX_MAX_TAD 8
+
+#define SKX_GET_TADBASE(d, mc, i, reg)                  \
+        pci_read_config_dword((d)->imc[mc].chan[0].cdev, 0x850 + 4 * (i), &reg)
+#define SKX_GET_TADWAYNESS(d, mc, i, reg)               \
+        pci_read_config_dword((d)->imc[mc].chan[0].cdev, 0x880 + 4 * (i), &reg)
+#define SKX_GET_TADCHNILVOFFSET(d, mc, ch, i, reg)      \
+        pci_read_config_dword((d)->imc[mc].chan[ch].cdev, 0x90 + 4 * (i), &reg)
+
+#define SKX_TAD_BASE(b)         ((u64)GET_BITFIELD((b), 12, 31) << 26)
+#define SKX_TAD_SKT_GRAN(b)     GET_BITFIELD((b), 4, 5)
+#define SKX_TAD_CHN_GRAN(b)     GET_BITFIELD((b), 6, 7)
+#define SKX_TAD_LIMIT(b)        (((u64)GET_BITFIELD((b), 12, 31) << 26) | MASK26)
+#define SKX_TAD_OFFSET(b)       ((u64)GET_BITFIELD((b), 4, 23) << 26)
+#define SKX_TAD_SKTWAYS(b)      (1 << GET_BITFIELD((b), 10, 11))
+#define SKX_TAD_CHNWAYS(b)      (GET_BITFIELD((b), 8, 9) + 1)
+
+/* which bit used for both socket and channel interleave */
+static int skx_granularity[] = { 6, 8, 12, 30 };
+
+static u64 skx_do_interleave(u64 addr, int shift, int ways, u64 lowbits)
+{
+        addr >>= shift;
+        addr /= ways;
+        addr <<= shift;
+
+        return addr | (lowbits & ((1ull << shift) - 1));
+}
+
+static bool skx_tad_decode(struct decoded_addr *res)
+{
+        int i;
+        u32 base, wayness, chnilvoffset;
+        int skt_interleave_bit, chn_interleave_bit;
+        u64 channel_addr;
+
+        for (i = 0; i < SKX_MAX_TAD; i++) {
+                SKX_GET_TADBASE(res->dev, res->imc, i, base);
+                SKX_GET_TADWAYNESS(res->dev, res->imc, i, wayness);
+                if (SKX_TAD_BASE(base) <= res->addr && res->addr <= SKX_TAD_LIMIT(wayness))
+                        goto tad_found;
+        }
+        edac_dbg(0, "No TAD entry for %llx\n", res->addr);
+        return false;
+
+tad_found:
+        res->sktways = SKX_TAD_SKTWAYS(wayness);
+        res->chanways = SKX_TAD_CHNWAYS(wayness);
+        skt_interleave_bit = skx_granularity[SKX_TAD_SKT_GRAN(base)];
+        chn_interleave_bit = skx_granularity[SKX_TAD_CHN_GRAN(base)];
+
+        SKX_GET_TADCHNILVOFFSET(res->dev, res->imc, res->channel, i, chnilvoffset);
+        channel_addr = res->addr - SKX_TAD_OFFSET(chnilvoffset);
+
+        if (res->chanways == 3 && skt_interleave_bit > chn_interleave_bit) {
+                /* Must handle channel first, then socket */
+                channel_addr = skx_do_interleave(channel_addr, chn_interleave_bit,
+                                                 res->chanways, channel_addr);
+                channel_addr = skx_do_interleave(channel_addr, skt_interleave_bit,
+                                                 res->sktways, channel_addr);
+        } else {
+                /* Handle socket then channel. Preserve low bits from original address */
+                channel_addr = skx_do_interleave(channel_addr, skt_interleave_bit,
+                                                 res->sktways, res->addr);
+                channel_addr = skx_do_interleave(channel_addr, chn_interleave_bit,
+                                                 res->chanways, res->addr);
+        }
+
+        res->chan_addr = channel_addr;
+
+        edac_dbg(2, "%llx: chan_addr=%llx sktways=%d chanways=%d\n",
+                 res->addr, res->chan_addr, res->sktways, res->chanways);
+        return true;
+}
+
+#define SKX_MAX_RIR 4
+
+#define SKX_GET_RIRWAYNESS(d, mc, ch, i, reg)           \
+        pci_read_config_dword((d)->imc[mc].chan[ch].cdev,       \
+                              0x108 + 4 * (i), &reg)
+#define SKX_GET_RIRILV(d, mc, ch, idx, i, reg)          \
+        pci_read_config_dword((d)->imc[mc].chan[ch].cdev,       \
+                              0x120 + 16 * idx + 4 * (i), &reg)
+
+#define SKX_RIR_VALID(b) GET_BITFIELD((b), 31, 31)
+#define SKX_RIR_LIMIT(b) (((u64)GET_BITFIELD((b), 1, 11) << 29) | MASK29)
+#define SKX_RIR_WAYS(b) (1 << GET_BITFIELD((b), 28, 29))
+#define SKX_RIR_CHAN_RANK(b) GET_BITFIELD((b), 16, 19)
+#define SKX_RIR_OFFSET(b) ((u64)(GET_BITFIELD((b), 2, 15) << 26))
+
+static bool skx_rir_decode(struct decoded_addr *res)
+{
+        int i, idx, chan_rank;
+        int shift;
+        u32 rirway, rirlv;
+        u64 rank_addr, prev_limit = 0, limit;
+
+        if (res->dev->imc[res->imc].chan[res->channel].dimms[0].close_pg)
+                shift = 6;
+        else
+                shift = 13;
+
+        for (i = 0; i < SKX_MAX_RIR; i++) {
+                SKX_GET_RIRWAYNESS(res->dev, res->imc, res->channel, i, rirway);
+                limit = SKX_RIR_LIMIT(rirway);
+                if (SKX_RIR_VALID(rirway)) {
+                        if (prev_limit <= res->chan_addr &&
+                            res->chan_addr <= limit)
+                                goto rir_found;
+                }
+                prev_limit = limit;
+        }
+        edac_dbg(0, "No RIR entry for %llx\n", res->addr);
+        return false;
+
+rir_found:
+        rank_addr = res->chan_addr >> shift;
+        rank_addr /= SKX_RIR_WAYS(rirway);
+        rank_addr <<= shift;
+        rank_addr |= res->chan_addr & GENMASK_ULL(shift - 1, 0);
+
+        res->rank_address = rank_addr;
+        idx = (res->chan_addr >> shift) % SKX_RIR_WAYS(rirway);
+
+        SKX_GET_RIRILV(res->dev, res->imc, res->channel, idx, i, rirlv);
+        res->rank_address = rank_addr - SKX_RIR_OFFSET(rirlv);
+        chan_rank = SKX_RIR_CHAN_RANK(rirlv);
+        res->channel_rank = chan_rank;
+        res->dimm = chan_rank / 4;
+        res->rank = chan_rank % 4;
+
+        edac_dbg(2, "%llx: dimm=%d rank=%d chan_rank=%d rank_addr=%llx\n",
+                 res->addr, res->dimm, res->rank,
+                 res->channel_rank, res->rank_address);
+        return true;
+}
+
+static u8 skx_close_row[] = {
+        15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33
+};
+static u8 skx_close_column[] = {
+        3, 4, 5, 14, 19, 23, 24, 25, 26, 27
+};
+static u8 skx_open_row[] = {
+        14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33
+};
+static u8 skx_open_column[] = {
+        3, 4, 5, 6, 7, 8, 9, 10, 11, 12
+};
+static u8 skx_open_fine_column[] = {
+        3, 4, 5, 7, 8, 9, 10, 11, 12, 13
+};
+
+static int skx_bits(u64 addr, int nbits, u8 *bits)
+{
+        int i, res = 0;
+
+        for (i = 0; i < nbits; i++)
+                res |= ((addr >> bits[i]) & 1) << i;
+        return res;
+}
+
+static int skx_bank_bits(u64 addr, int b0, int b1, int do_xor, int x0, int x1)
+{
+        int ret = GET_BITFIELD(addr, b0, b0) | (GET_BITFIELD(addr, b1, b1) << 1);
+
+        if (do_xor)
+                ret ^= GET_BITFIELD(addr, x0, x0) | (GET_BITFIELD(addr, x1, x1) << 1);
+
+        return ret;
+}
+
+static bool skx_mad_decode(struct decoded_addr *r)
+{
+        struct skx_dimm *dimm = &r->dev->imc[r->imc].chan[r->channel].dimms[r->dimm];
+        int bg0 = dimm->fine_grain_bank ? 6 : 13;
+
+        if (dimm->close_pg) {
+                r->row = skx_bits(r->rank_address, dimm->rowbits, skx_close_row);
+                r->column = skx_bits(r->rank_address, dimm->colbits, skx_close_column);
+                r->column |= 0x400; /* C10 is autoprecharge, always set */
+                r->bank_address = skx_bank_bits(r->rank_address, 8, 9, dimm->bank_xor_enable, 22, 28);
+                r->bank_group = skx_bank_bits(r->rank_address, 6, 7, dimm->bank_xor_enable, 20, 21);
+        } else {
+                r->row = skx_bits(r->rank_address, dimm->rowbits, skx_open_row);
+                if (dimm->fine_grain_bank)
+                        r->column = skx_bits(r->rank_address, dimm->colbits, skx_open_fine_column);
+                else
+                        r->column = skx_bits(r->rank_address, dimm->colbits, skx_open_column);
+                r->bank_address = skx_bank_bits(r->rank_address, 18, 19, dimm->bank_xor_enable, 22, 23);
+                r->bank_group = skx_bank_bits(r->rank_address, bg0, 17, dimm->bank_xor_enable, 20, 21);
+        }
+        r->row &= (1u << dimm->rowbits) - 1;
+
+        edac_dbg(2, "%llx: row=%x col=%x bank_addr=%d bank_group=%d\n",
+                 r->addr, r->row, r->column, r->bank_address,
+                 r->bank_group);
+        return true;
+}
+
+static bool skx_decode(struct decoded_addr *res)
+{
+
+        return skx_sad_decode(res) && skx_tad_decode(res) &&
+                skx_rir_decode(res) && skx_mad_decode(res);
+}
+
+#ifdef CONFIG_EDAC_DEBUG
+/*
+ * Debug feature. Make /sys/kernel/debug/skx_edac_test/addr.
+ * Write an address to this file to exercise the address decode
+ * logic in this driver.
+ */
+static struct dentry *skx_test;
+static u64 skx_fake_addr;
+
+static int debugfs_u64_set(void *data, u64 val)
+{
+        struct decoded_addr res;
+
+        res.addr = val;
+        skx_decode(&res);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(fops_u64_wo, NULL, debugfs_u64_set, "%llu\n");
+
+static struct dentry *mydebugfs_create(const char *name, umode_t mode,
+                                       struct dentry *parent, u64 *value)
+{
+        return debugfs_create_file(name, mode, parent, value, &fops_u64_wo);
+}
+
+static void setup_skx_debug(void)
+{
+        skx_test = debugfs_create_dir("skx_edac_test", NULL);
+        mydebugfs_create("addr", S_IWUSR, skx_test, &skx_fake_addr);
+}
+
+static void teardown_skx_debug(void)
+{
+        debugfs_remove_recursive(skx_test);
+}
+#else
+static void setup_skx_debug(void)
+{
+}
+
+static void teardown_skx_debug(void)
+{
+}
+#endif /*CONFIG_EDAC_DEBUG*/
+
+static void skx_mce_output_error(struct mem_ctl_info *mci,
+                                 const struct mce *m,
+                                 struct decoded_addr *res)
+{
+        enum hw_event_mc_err_type tp_event;
+        char *type, *optype, msg[256];
+        bool ripv = GET_BITFIELD(m->mcgstatus, 0, 0);
+        bool overflow = GET_BITFIELD(m->status, 62, 62);
+        bool uncorrected_error = GET_BITFIELD(m->status, 61, 61);
+        bool recoverable;
+        u32 core_err_cnt = GET_BITFIELD(m->status, 38, 52);
+        u32 mscod = GET_BITFIELD(m->status, 16, 31);
+        u32 errcode = GET_BITFIELD(m->status, 0, 15);
+        u32 optypenum = GET_BITFIELD(m->status, 4, 6);
+
+        recoverable = GET_BITFIELD(m->status, 56, 56);
+
+        if (uncorrected_error) {
+                if (ripv) {
+                        type = "FATAL";
+                        tp_event = HW_EVENT_ERR_FATAL;
+                } else {
+                        type = "NON_FATAL";
+                        tp_event = HW_EVENT_ERR_UNCORRECTED;
+                }
+        } else {
+                type = "CORRECTED";
+                tp_event = HW_EVENT_ERR_CORRECTED;
+        }
+
+        /*
+         * According with Table 15-9 of the Intel Architecture spec vol 3A,
+         * memory errors should fit in this mask:
+         *      000f 0000 1mmm cccc (binary)
+         * where:
+         *      f = Correction Report Filtering Bit. If 1, subsequent errors
+         *          won't be shown
+         *      mmm = error type
+         *      cccc = channel
+         * If the mask doesn't match, report an error to the parsing logic
+         */
+        if (!((errcode & 0xef80) == 0x80)) {
+                optype = "Can't parse: it is not a mem";
+        } else {
+                switch (optypenum) {
+                case 0:
+                        optype = "generic undef request error";
+                        break;
+                case 1:
+                        optype = "memory read error";
+                        break;
+                case 2:
+                        optype = "memory write error";
+                        break;
+                case 3:
+                        optype = "addr/cmd error";
+                        break;
+                case 4:
+                        optype = "memory scrubbing error";
+                        break;
+                default:
+                        optype = "reserved";
+                        break;
+                }
+        }
+
+        snprintf(msg, sizeof(msg),
+                 "%s%s err_code:%04x:%04x socket:%d imc:%d rank:%d bg:%d ba:%d row:%x col:%x",
+                 overflow ? " OVERFLOW" : "",
+                 (uncorrected_error && recoverable) ? " recoverable" : "",
+                 mscod, errcode,
+                 res->socket, res->imc, res->rank,
+                 res->bank_group, res->bank_address, res->row, res->column);
+
+        edac_dbg(0, "%s\n", msg);
+
+        /* Call the helper to output message */
+        edac_mc_handle_error(tp_event, mci, core_err_cnt,
+                             m->addr >> PAGE_SHIFT, m->addr & ~PAGE_MASK, 0,
+                             res->channel, res->dimm, -1,
+                             optype, msg);
+}
+
+static int skx_mce_check_error(struct notifier_block *nb, unsigned long val,
+                               void *data)
+{
+        struct mce *mce = (struct mce *)data;
+        struct decoded_addr res;
+        struct mem_ctl_info *mci;
+        char *type;
+
+        if (get_edac_report_status() == EDAC_REPORTING_DISABLED)
+                return NOTIFY_DONE;
+
+        /* ignore unless this is memory related with an address */
+        if ((mce->status & 0xefff) >> 7 != 1 || !(mce->status & MCI_STATUS_ADDRV))
+                return NOTIFY_DONE;
+
+        res.addr = mce->addr;
+        if (!skx_decode(&res))
+                return NOTIFY_DONE;
+        mci = res.dev->imc[res.imc].mci;
+
+        if (mce->mcgstatus & MCG_STATUS_MCIP)
+                type = "Exception";
+        else
+                type = "Event";
+
+        skx_mc_printk(mci, KERN_DEBUG, "HANDLING MCE MEMORY ERROR\n");
+
+        skx_mc_printk(mci, KERN_DEBUG, "CPU %d: Machine Check %s: %Lx "
+                          "Bank %d: %016Lx\n", mce->extcpu, type,
+                          mce->mcgstatus, mce->bank, mce->status);
+        skx_mc_printk(mci, KERN_DEBUG, "TSC %llx ", mce->tsc);
+        skx_mc_printk(mci, KERN_DEBUG, "ADDR %llx ", mce->addr);
+        skx_mc_printk(mci, KERN_DEBUG, "MISC %llx ", mce->misc);
+
+        skx_mc_printk(mci, KERN_DEBUG, "PROCESSOR %u:%x TIME %llu SOCKET "
+                          "%u APIC %x\n", mce->cpuvendor, mce->cpuid,
+                          mce->time, mce->socketid, mce->apicid);
+
+        skx_mce_output_error(mci, mce, &res);
+
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block skx_mce_dec = {
+        .notifier_call = skx_mce_check_error,
+};
+
+static void skx_remove(void)
+{
+        int i, j;
+        struct skx_dev *d, *tmp;
+
+        edac_dbg(0, "\n");
+
+        list_for_each_entry_safe(d, tmp, &skx_edac_list, list) {
+                list_del(&d->list);
+                for (i = 0; i < NUM_IMC; i++) {
+                        skx_unregister_mci(&d->imc[i]);
+                        for (j = 0; j < NUM_CHANNELS; j++)
+                                pci_dev_put(d->imc[i].chan[j].cdev);
+                }
+                pci_dev_put(d->util_all);
+                pci_dev_put(d->sad_all);
+
+                kfree(d);
+        }
+}
+
+/*
+ * skx_init:
+ *      make sure we are running on the correct cpu model
+ *      search for all the devices we need
+ *      check which DIMMs are present.
+ */
+int __init skx_init(void)
+{
+        const struct x86_cpu_id *id;
+        const struct munit *m;
+        int rc = 0, i;
+        u8 mc = 0, src_id, node_id;
+        struct skx_dev *d;
+
+        edac_dbg(2, "\n");
+
+        id = x86_match_cpu(skx_cpuids);
+        if (!id)
+                return -ENODEV;
+
+        rc = skx_get_hi_lo();
+        if (rc)
+                return rc;
+
+        rc = get_all_bus_mappings();
+        if (rc < 0)
+                goto fail;
+        if (rc == 0) {
+                edac_dbg(2, "No memory controllers found\n");
+                return -ENODEV;
+        }
+
+        for (m = skx_all_munits; m->did; m++) {
+                rc = get_all_munits(m);
+                if (rc < 0)
+                        goto fail;
+                if (rc != m->per_socket * skx_num_sockets) {
+                        edac_dbg(2, "Expected %d, got %d of %x\n",
+                                 m->per_socket * skx_num_sockets, rc, m->did);
+                        rc = -ENODEV;
+                        goto fail;
+                }
+        }
+
+        list_for_each_entry(d, &skx_edac_list, list) {
+                src_id = get_src_id(d);
+                node_id = skx_get_node_id(d);
+                edac_dbg(2, "src_id=%d node_id=%d\n", src_id, node_id);
+                for (i = 0; i < NUM_IMC; i++) {
+                        d->imc[i].mc = mc++;
+                        d->imc[i].lmc = i;
+                        d->imc[i].src_id = src_id;
+                        d->imc[i].node_id = node_id;
+                        rc = skx_register_mci(&d->imc[i]);
+                        if (rc < 0)
+                                goto fail;
+                }
+        }
+
+        /* Ensure that the OPSTATE is set correctly for POLL or NMI */
+        opstate_init();
+
+        setup_skx_debug();
+
+        mce_register_decode_chain(&skx_mce_dec);
+
+        return 0;
+fail:
+        skx_remove();
+        return rc;
+}
+
+static void __exit skx_exit(void)
+{
+        edac_dbg(2, "\n");
+        mce_unregister_decode_chain(&skx_mce_dec);
+        skx_remove();
+        teardown_skx_debug();
+}
+
+module_init(skx_init);
+module_exit(skx_exit);
+
+module_param(edac_op_state, int, 0444);
+MODULE_PARM_DESC(edac_op_state, "EDAC Error Reporting state: 0=Poll,1=NMI");
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Tony Luck");
+MODULE_DESCRIPTION("MC Driver for Intel Skylake server processors");
diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c
index 438893762076..ce2bc2a38101 100644
--- a/drivers/firmware/arm_scpi.c
+++ b/drivers/firmware/arm_scpi.c
@@ -709,9 +709,10 @@ static int scpi_probe(struct platform_device *pdev)
                 struct mbox_client *cl = &pchan->cl;
                 struct device_node *shmem = of_parse_phandle(np, "shmem", idx);
 
-                if (of_address_to_resource(shmem, 0, &res)) {
+                ret = of_address_to_resource(shmem, 0, &res);
+                of_node_put(shmem);
+                if (ret) {
                         dev_err(dev, "failed to get SCPI payload mem resource\n");
-                        ret = -EINVAL;
                         goto err;
                 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 8ebc5f1eb4c0..8c704c86597b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -646,9 +646,9 @@ int amdgpu_gart_table_vram_pin(struct amdgpu_device *adev);
 void amdgpu_gart_table_vram_unpin(struct amdgpu_device *adev);
 int amdgpu_gart_init(struct amdgpu_device *adev);
 void amdgpu_gart_fini(struct amdgpu_device *adev);
-void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
+void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
                         int pages);
-int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset,
+int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset,
                      int pages, struct page **pagelist,
                      dma_addr_t *dma_addr, uint32_t flags);
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index 49de92600074..10b5ddf2c588 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -200,16 +200,7 @@ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx)
         atpx->is_hybrid = false;
         if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
                 printk("ATPX Hybrid Graphics\n");
-#if 1
-                /* This is a temporary hack until the D3 cold support
-                 * makes it upstream.  The ATPX power_control method seems
-                 * to still work on even if the system should be using
-                 * the new standardized hybrid D3 cold ACPI interface.
-                 */
-                atpx->functions.power_cntl = true;
-#else
                 atpx->functions.power_cntl = false;
-#endif
                 atpx->is_hybrid = true;
         }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
index 921bce2df0b0..0feea347f680 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
@@ -221,7 +221,7 @@ void amdgpu_gart_table_vram_free(struct amdgpu_device *adev)
  * Unbinds the requested pages from the gart page table and
  * replaces them with the dummy page (all asics).
  */
-void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
+void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
                         int pages)
 {
         unsigned t;
@@ -268,7 +268,7 @@ void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
  * (all asics).
  * Returns 0 for success, -EINVAL for failure.
  */
-int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset,
+int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset,
                      int pages, struct page **pagelist, dma_addr_t *dma_addr,
                      uint32_t flags)
 {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index b11f4e8868d7..4aa993d19018 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -1187,7 +1187,8 @@ int amdgpu_uvd_ring_test_ib(struct amdgpu_ring *ring, long timeout)
                 r = 0;
         }
 
-error:
         fence_put(fence);
+
+error:
         return r;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 8e642fc48df4..80120fa4092c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -1535,7 +1535,7 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
         r = amd_sched_entity_init(&ring->sched, &vm->entity,
                                   rq, amdgpu_sched_jobs);
         if (r)
-                return r;
+                goto err;
 
         vm->page_directory_fence = NULL;
 
@@ -1565,6 +1565,9 @@ error_free_page_directory:
 error_free_sched_entity:
         amd_sched_entity_fini(&ring->sched, &vm->entity);
 
+err:
+        drm_free_large(vm->page_tables);
+
         return r;
 }
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
index e621eba63126..a7d3cb3fead0 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
@@ -184,7 +184,7 @@ u32 __iomem *kfd_get_kernel_doorbell(struct kfd_dev *kfd,
                                                         sizeof(u32)) + inx;
 
         pr_debug("kfd: get kernel queue doorbell\n"
-                         "     doorbell offset   == 0x%08d\n"
+                         "     doorbell offset   == 0x%08X\n"
                          "     kernel address    == 0x%08lX\n",
                 *doorbell_off, (uintptr_t)(kfd->doorbell_kernel_ptr + inx));
 
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index ce54e985d91b..0a06f9120b5a 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -464,7 +464,7 @@ static bool drm_fb_helper_is_bound(struct drm_fb_helper *fb_helper)
 
         /* Sometimes user space wants everything disabled, so don't steal the
          * display if there's a master. */
-        if (lockless_dereference(dev->master))
+        if (READ_ONCE(dev->master))
                 return false;
 
         drm_for_each_crtc(crtc, dev) {
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 87ef34150d46..b382cf505262 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -1333,8 +1333,6 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
         if (ret < 0)
                 return ret;
 
-        mutex_lock(&gpu->lock);
-
         /*
          * TODO
          *
@@ -1348,16 +1346,18 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
         if (unlikely(event == ~0U)) {
                 DRM_ERROR("no free event\n");
                 ret = -EBUSY;
-                goto out_unlock;
+                goto out_pm_put;
         }
 
         fence = etnaviv_gpu_fence_alloc(gpu);
         if (!fence) {
                 event_free(gpu, event);
                 ret = -ENOMEM;
-                goto out_unlock;
+                goto out_pm_put;
         }
 
+        mutex_lock(&gpu->lock);
+
         gpu->event[event].fence = fence;
         submit->fence = fence->seqno;
         gpu->active_fence = submit->fence;
@@ -1395,9 +1395,9 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
         hangcheck_timer_reset(gpu);
         ret = 0;
 
-out_unlock:
         mutex_unlock(&gpu->lock);
 
+out_pm_put:
         etnaviv_gpu_pm_put(gpu);
 
         return ret;
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 21f939074abc..20fe9d52e256 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1854,6 +1854,7 @@ struct drm_i915_private {
         enum modeset_restore modeset_restore;
         struct mutex modeset_restore_lock;
         struct drm_atomic_state *modeset_restore_state;
+        struct drm_modeset_acquire_ctx reset_ctx;
 
         struct list_head vm_list; /* Global list of all address spaces */
         struct i915_ggtt ggtt; /* VM representing the global address space */
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 11681501d7b1..a77ce9983f69 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -879,9 +879,12 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
         ret = i915_gem_shmem_pread(dev, obj, args, file);
 
         /* pread for non shmem backed objects */
-        if (ret == -EFAULT || ret == -ENODEV)
+        if (ret == -EFAULT || ret == -ENODEV) {
+                intel_runtime_pm_get(to_i915(dev));
                 ret = i915_gem_gtt_pread(dev, obj, args->size,
                                         args->offset, args->data_ptr);
+                intel_runtime_pm_put(to_i915(dev));
+        }
 
 out:
         drm_gem_object_unreference(&obj->base);
@@ -1306,7 +1309,7 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                  * textures). Fallback to the shmem path in that case. */
         }
 
-        if (ret == -EFAULT) {
+        if (ret == -EFAULT || ret == -ENOSPC) {
                 if (obj->phys_handle)
                         ret = i915_gem_phys_pwrite(obj, args, file);
                 else if (i915_gem_object_has_struct_page(obj))
@@ -3169,6 +3172,8 @@ static void i915_gem_reset_engine_cleanup(struct intel_engine_cs *engine)
         }
 
         intel_ring_init_seqno(engine, engine->last_submitted_seqno);
+
+        engine->i915->gt.active_engines &= ~intel_engine_flag(engine);
 }
 
 void i915_gem_reset(struct drm_device *dev)
@@ -3186,6 +3191,7 @@ void i915_gem_reset(struct drm_device *dev)
 
         for_each_engine(engine, dev_priv)
                 i915_gem_reset_engine_cleanup(engine);
+        mod_delayed_work(dev_priv->wq, &dev_priv->gt.idle_work, 0);
 
         i915_gem_context_reset(dev);
 
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 10f1e32767e6..7a30af79d799 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -2873,6 +2873,7 @@ void i915_ggtt_cleanup_hw(struct drm_device *dev)
                 struct i915_hw_ppgtt *ppgtt = dev_priv->mm.aliasing_ppgtt;
 
                 ppgtt->base.cleanup(&ppgtt->base);
+                kfree(ppgtt);
         }
 
         i915_gem_cleanup_stolen(dev);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index ce14fe09d962..5c06413ae0e6 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -1536,6 +1536,7 @@ enum skl_disp_power_wells {
 #define BALANCE_LEG_MASK(port)          (7<<(8+3*(port)))
 /* Balance leg disable bits */
 #define BALANCE_LEG_DISABLE_SHIFT       23
+#define BALANCE_LEG_DISABLE(port)       (1 << (23 + (port)))
 
 /*
  * Fence registers
diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
index 6700a7be7f78..d32f586f9c05 100644
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -600,6 +600,8 @@ static void i915_audio_component_codec_wake_override(struct device *dev,
         if (!IS_SKYLAKE(dev_priv) && !IS_KABYLAKE(dev_priv))
                 return;
 
+        i915_audio_component_get_power(dev);
+
         /*
          * Enable/disable generating the codec wake signal, overriding the
          * internal logic to generate the codec wake to controller.
@@ -615,6 +617,8 @@ static void i915_audio_component_codec_wake_override(struct device *dev,
                 I915_WRITE(HSW_AUD_CHICKENBIT, tmp);
                 usleep_range(1000, 1500);
         }
+
+        i915_audio_component_put_power(dev);
 }
 
 /* Get CDCLK in kHz  */
@@ -648,6 +652,7 @@ static int i915_audio_component_sync_audio_rate(struct device *dev,
             !IS_HASWELL(dev_priv))
                 return 0;
 
+        i915_audio_component_get_power(dev);
         mutex_lock(&dev_priv->av_mutex);
         /* 1. get the pipe */
         intel_encoder = dev_priv->dig_port_map[port];
@@ -698,6 +703,7 @@ static int i915_audio_component_sync_audio_rate(struct device *dev,
 
  unlock:
         mutex_unlock(&dev_priv->av_mutex);
+        i915_audio_component_put_power(dev);
         return err;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index dd1d6fe12297..1a7efac65fd5 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -145,7 +145,7 @@ static const struct ddi_buf_trans skl_ddi_translations_dp[] = {
 static const struct ddi_buf_trans skl_u_ddi_translations_dp[] = {
         { 0x0000201B, 0x000000A2, 0x0 },
         { 0x00005012, 0x00000088, 0x0 },
-        { 0x80007011, 0x000000CD, 0x0 },
+        { 0x80007011, 0x000000CD, 0x1 },
         { 0x80009010, 0x000000C0, 0x1 },
         { 0x0000201B, 0x0000009D, 0x0 },
         { 0x80005012, 0x000000C0, 0x1 },
@@ -158,7 +158,7 @@ static const struct ddi_buf_trans skl_u_ddi_translations_dp[] = {
 static const struct ddi_buf_trans skl_y_ddi_translations_dp[] = {
         { 0x00000018, 0x000000A2, 0x0 },
         { 0x00005012, 0x00000088, 0x0 },
-        { 0x80007011, 0x000000CD, 0x0 },
+        { 0x80007011, 0x000000CD, 0x3 },
         { 0x80009010, 0x000000C0, 0x3 },
         { 0x00000018, 0x0000009D, 0x0 },
         { 0x80005012, 0x000000C0, 0x3 },
@@ -388,6 +388,40 @@ skl_get_buf_trans_hdmi(struct drm_i915_private *dev_priv, int *n_entries)
         }
 }
 
+static int intel_ddi_hdmi_level(struct drm_i915_private *dev_priv, enum port port)
+{
+        int n_hdmi_entries;
+        int hdmi_level;
+        int hdmi_default_entry;
+
+        hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift;
+
+        if (IS_BROXTON(dev_priv))
+                return hdmi_level;
+
+        if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) {
+                skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries);
+                hdmi_default_entry = 8;
+        } else if (IS_BROADWELL(dev_priv)) {
+                n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
+                hdmi_default_entry = 7;
+        } else if (IS_HASWELL(dev_priv)) {
+                n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi);
+                hdmi_default_entry = 6;
+        } else {
+                WARN(1, "ddi translation table missing\n");
+                n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
+                hdmi_default_entry = 7;
+        }
+
+        /* Choose a good default if VBT is badly populated */
+        if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN ||
+            hdmi_level >= n_hdmi_entries)
+                hdmi_level = hdmi_default_entry;
+
+        return hdmi_level;
+}
+
 /*
  * Starting with Haswell, DDI port buffers must be programmed with correct
  * values in advance. The buffer values are different for FDI and DP modes,
@@ -399,7 +433,7 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
 {
         struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
         u32 iboost_bit = 0;
-        int i, n_hdmi_entries, n_dp_entries, n_edp_entries, hdmi_default_entry,
+        int i, n_hdmi_entries, n_dp_entries, n_edp_entries,
             size;
         int hdmi_level;
         enum port port;
@@ -410,7 +444,7 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
         const struct ddi_buf_trans *ddi_translations;
 
         port = intel_ddi_get_encoder_port(encoder);
-        hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift;
+        hdmi_level = intel_ddi_hdmi_level(dev_priv, port);
 
         if (IS_BROXTON(dev_priv)) {
                 if (encoder->type != INTEL_OUTPUT_HDMI)
@@ -430,7 +464,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
                                 skl_get_buf_trans_edp(dev_priv, &n_edp_entries);
                 ddi_translations_hdmi =
                                 skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries);
-                hdmi_default_entry = 8;
                 /* If we're boosting the current, set bit 31 of trans1 */
                 if (dev_priv->vbt.ddi_port_info[port].hdmi_boost_level ||
                     dev_priv->vbt.ddi_port_info[port].dp_boost_level)
@@ -456,7 +489,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
 
                 n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp);
                 n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
-                hdmi_default_entry = 7;
         } else if (IS_HASWELL(dev_priv)) {
                 ddi_translations_fdi = hsw_ddi_translations_fdi;
                 ddi_translations_dp = hsw_ddi_translations_dp;
@@ -464,7 +496,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
                 ddi_translations_hdmi = hsw_ddi_translations_hdmi;
                 n_dp_entries = n_edp_entries = ARRAY_SIZE(hsw_ddi_translations_dp);
                 n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi);
-                hdmi_default_entry = 6;
         } else {
                 WARN(1, "ddi translation table missing\n");
                 ddi_translations_edp = bdw_ddi_translations_dp;
@@ -474,7 +505,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
                 n_edp_entries = ARRAY_SIZE(bdw_ddi_translations_edp);
                 n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp);
                 n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
-                hdmi_default_entry = 7;
         }
 
         switch (encoder->type) {
@@ -505,11 +535,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
         if (encoder->type != INTEL_OUTPUT_HDMI)
                 return;
 
-        /* Choose a good default if VBT is badly populated */
-        if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN ||
-            hdmi_level >= n_hdmi_entries)
-                hdmi_level = hdmi_default_entry;
-
         /* Entry 9 is for HDMI: */
         I915_WRITE(DDI_BUF_TRANS_LO(port, i),
                    ddi_translations_hdmi[hdmi_level].trans1 | iboost_bit);
@@ -1379,14 +1404,30 @@ void intel_ddi_disable_pipe_clock(struct intel_crtc *intel_crtc)
                            TRANS_CLK_SEL_DISABLED);
 }
 
-static void skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
-                               u32 level, enum port port, int type)
+static void _skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
+                                enum port port, uint8_t iboost)
 {
+        u32 tmp;
+
+        tmp = I915_READ(DISPIO_CR_TX_BMU_CR0);
+        tmp &= ~(BALANCE_LEG_MASK(port) | BALANCE_LEG_DISABLE(port));
+        if (iboost)
+                tmp |= iboost << BALANCE_LEG_SHIFT(port);
+        else
+                tmp |= BALANCE_LEG_DISABLE(port);
+        I915_WRITE(DISPIO_CR_TX_BMU_CR0, tmp);
+}
+
+static void skl_ddi_set_iboost(struct intel_encoder *encoder, u32 level)
+{
+        struct intel_digital_port *intel_dig_port = enc_to_dig_port(&encoder->base);
+        struct drm_i915_private *dev_priv = to_i915(intel_dig_port->base.base.dev);
+        enum port port = intel_dig_port->port;
+        int type = encoder->type;
         const struct ddi_buf_trans *ddi_translations;
         uint8_t iboost;
         uint8_t dp_iboost, hdmi_iboost;
         int n_entries;
-        u32 reg;
 
         /* VBT may override standard boost values */
         dp_iboost = dev_priv->vbt.ddi_port_info[port].dp_boost_level;
@@ -1428,16 +1469,10 @@ static void skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
                 return;
         }
 
-        reg = I915_READ(DISPIO_CR_TX_BMU_CR0);
-        reg &= ~BALANCE_LEG_MASK(port);
-        reg &= ~(1 << (BALANCE_LEG_DISABLE_SHIFT + port));
-
-        if (iboost)
-                reg |= iboost << BALANCE_LEG_SHIFT(port);
-        else
-                reg |= 1 << (BALANCE_LEG_DISABLE_SHIFT + port);
+        _skl_ddi_set_iboost(dev_priv, port, iboost);
 
-        I915_WRITE(DISPIO_CR_TX_BMU_CR0, reg);
+        if (port == PORT_A && intel_dig_port->max_lanes == 4)
+                _skl_ddi_set_iboost(dev_priv, PORT_E, iboost);
 }
 
 static void bxt_ddi_vswing_sequence(struct drm_i915_private *dev_priv,
@@ -1568,7 +1603,7 @@ uint32_t ddi_signal_levels(struct intel_dp *intel_dp)
         level = translate_signal_level(signal_levels);
 
         if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv))
-                skl_ddi_set_iboost(dev_priv, level, port, encoder->type);
+                skl_ddi_set_iboost(encoder, level);
         else if (IS_BROXTON(dev_priv))
                 bxt_ddi_vswing_sequence(dev_priv, level, port, encoder->type);
 
@@ -1637,6 +1672,10 @@ static void intel_ddi_pre_enable(struct intel_encoder *intel_encoder)
                         intel_dp_stop_link_train(intel_dp);
         } else if (type == INTEL_OUTPUT_HDMI) {
                 struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder);
+                int level = intel_ddi_hdmi_level(dev_priv, port);
+
+                if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv))
+                        skl_ddi_set_iboost(intel_encoder, level);
 
                 intel_hdmi->set_infoframes(encoder,
                                            crtc->config->has_hdmi_sink,
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index dcf93b3d4fb6..2a751b6e0253 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3093,40 +3093,110 @@ static void intel_update_primary_planes(struct drm_device *dev)
 
         for_each_crtc(dev, crtc) {
                 struct intel_plane *plane = to_intel_plane(crtc->primary);
-                struct intel_plane_state *plane_state;
-
-                drm_modeset_lock_crtc(crtc, &plane->base);
-                plane_state = to_intel_plane_state(plane->base.state);
+                struct intel_plane_state *plane_state =
+                        to_intel_plane_state(plane->base.state);
 
                 if (plane_state->visible)
                         plane->update_plane(&plane->base,
                                             to_intel_crtc_state(crtc->state),
                                             plane_state);
+        }
+}
+
+static int
+__intel_display_resume(struct drm_device *dev,
+                       struct drm_atomic_state *state)
+{
+        struct drm_crtc_state *crtc_state;
+        struct drm_crtc *crtc;
+        int i, ret;
+
+        intel_modeset_setup_hw_state(dev);
+        i915_redisable_vga(dev);
 
-                drm_modeset_unlock_crtc(crtc);
+        if (!state)
+                return 0;
+
+        for_each_crtc_in_state(state, crtc, crtc_state, i) {
+                /*
+                 * Force recalculation even if we restore
+                 * current state. With fast modeset this may not result
+                 * in a modeset when the state is compatible.
+                 */
+                crtc_state->mode_changed = true;
         }
+
+        /* ignore any reset values/BIOS leftovers in the WM registers */
+        to_intel_atomic_state(state)->skip_intermediate_wm = true;
+
+        ret = drm_atomic_commit(state);
+
+        WARN_ON(ret == -EDEADLK);
+        return ret;
 }
 
 void intel_prepare_reset(struct drm_i915_private *dev_priv)
 {
+        struct drm_device *dev = &dev_priv->drm;
+        struct drm_modeset_acquire_ctx *ctx = &dev_priv->reset_ctx;
+        struct drm_atomic_state *state;
+        int ret;
+
         /* no reset support for gen2 */
         if (IS_GEN2(dev_priv))
                 return;
 
-        /* reset doesn't touch the display */
+        /*
+         * Need mode_config.mutex so that we don't
+         * trample ongoing ->detect() and whatnot.
+         */
+        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_acquire_init(ctx, 0);
+        while (1) {
+                ret = drm_modeset_lock_all_ctx(dev, ctx);
+                if (ret != -EDEADLK)
+                        break;
+
+                drm_modeset_backoff(ctx);
+        }
+
+        /* reset doesn't touch the display, but flips might get nuked anyway, */
         if (INTEL_GEN(dev_priv) >= 5 || IS_G4X(dev_priv))
                 return;
 
-        drm_modeset_lock_all(&dev_priv->drm);
         /*
          * Disabling the crtcs gracefully seems nicer. Also the
          * g33 docs say we should at least disable all the planes.
          */
-        intel_display_suspend(&dev_priv->drm);
+        state = drm_atomic_helper_duplicate_state(dev, ctx);
+        if (IS_ERR(state)) {
+                ret = PTR_ERR(state);
+                state = NULL;
+                DRM_ERROR("Duplicating state failed with %i\n", ret);
+                goto err;
+        }
+
+        ret = drm_atomic_helper_disable_all(dev, ctx);
+        if (ret) {
+                DRM_ERROR("Suspending crtc's failed with %i\n", ret);
+                goto err;
+        }
+
+        dev_priv->modeset_restore_state = state;
+        state->acquire_ctx = ctx;
+        return;
+
+err:
+        drm_atomic_state_free(state);
 }
 
 void intel_finish_reset(struct drm_i915_private *dev_priv)
 {
+        struct drm_device *dev = &dev_priv->drm;
+        struct drm_modeset_acquire_ctx *ctx = &dev_priv->reset_ctx;
+        struct drm_atomic_state *state = dev_priv->modeset_restore_state;
+        int ret;
+
         /*
          * Flips in the rings will be nuked by the reset,
          * so complete all pending flips so that user space
@@ -3138,6 +3208,8 @@ void intel_finish_reset(struct drm_i915_private *dev_priv)
         if (IS_GEN2(dev_priv))
                 return;
 
+        dev_priv->modeset_restore_state = NULL;
+
         /* reset doesn't touch the display */
         if (INTEL_GEN(dev_priv) >= 5 || IS_G4X(dev_priv)) {
                 /*
@@ -3149,29 +3221,32 @@ void intel_finish_reset(struct drm_i915_private *dev_priv)
                  * FIXME: Atomic will make this obsolete since we won't schedule
                  * CS-based flips (which might get lost in gpu resets) any more.
                  */
-                intel_update_primary_planes(&dev_priv->drm);
-                return;
-        }
-
-        /*
-         * The display has been reset as well,
-         * so need a full re-initialization.
-         */
-        intel_runtime_pm_disable_interrupts(dev_priv);
-        intel_runtime_pm_enable_interrupts(dev_priv);
+                intel_update_primary_planes(dev);
+        } else {
+                /*
+                 * The display has been reset as well,
+                 * so need a full re-initialization.
+                 */
+                intel_runtime_pm_disable_interrupts(dev_priv);
+                intel_runtime_pm_enable_interrupts(dev_priv);
 
-        intel_modeset_init_hw(&dev_priv->drm);
+                intel_modeset_init_hw(dev);
 
-        spin_lock_irq(&dev_priv->irq_lock);
-        if (dev_priv->display.hpd_irq_setup)
-                dev_priv->display.hpd_irq_setup(dev_priv);
-        spin_unlock_irq(&dev_priv->irq_lock);
+                spin_lock_irq(&dev_priv->irq_lock);
+                if (dev_priv->display.hpd_irq_setup)
+                        dev_priv->display.hpd_irq_setup(dev_priv);
+                spin_unlock_irq(&dev_priv->irq_lock);
 
-        intel_display_resume(&dev_priv->drm);
+                ret = __intel_display_resume(dev, state);
+                if (ret)
+                        DRM_ERROR("Restoring old state failed with %i\n", ret);
 
-        intel_hpd_init(dev_priv);
+                intel_hpd_init(dev_priv);
+        }
 
-        drm_modeset_unlock_all(&dev_priv->drm);
+        drm_modeset_drop_locks(ctx);
+        drm_modeset_acquire_fini(ctx);
+        mutex_unlock(&dev->mode_config.mutex);
 }
 
 static bool intel_crtc_has_pending_flip(struct drm_crtc *crtc)
@@ -16156,9 +16231,10 @@ void intel_display_resume(struct drm_device *dev)
         struct drm_atomic_state *state = dev_priv->modeset_restore_state;
         struct drm_modeset_acquire_ctx ctx;
         int ret;
-        bool setup = false;
 
         dev_priv->modeset_restore_state = NULL;
+        if (state)
+                state->acquire_ctx = &ctx;
 
         /*
          * This is a cludge because with real atomic modeset mode_config.mutex
@@ -16169,43 +16245,17 @@ void intel_display_resume(struct drm_device *dev)
         mutex_lock(&dev->mode_config.mutex);
         drm_modeset_acquire_init(&ctx, 0);
 
-retry:
-        ret = drm_modeset_lock_all_ctx(dev, &ctx);
-
-        if (ret == 0 && !setup) {
-                setup = true;
-
-                intel_modeset_setup_hw_state(dev);
-                i915_redisable_vga(dev);
-        }
-
-        if (ret == 0 && state) {
-                struct drm_crtc_state *crtc_state;
-                struct drm_crtc *crtc;
-                int i;
-
-                state->acquire_ctx = &ctx;
-
-                /* ignore any reset values/BIOS leftovers in the WM registers */
-                to_intel_atomic_state(state)->skip_intermediate_wm = true;
-
-                for_each_crtc_in_state(state, crtc, crtc_state, i) {
-                        /*
-                         * Force recalculation even if we restore
-                         * current state. With fast modeset this may not result
-                         * in a modeset when the state is compatible.
-                         */
-                        crtc_state->mode_changed = true;
-                }
-
-                ret = drm_atomic_commit(state);
-        }
+        while (1) {
+                ret = drm_modeset_lock_all_ctx(dev, &ctx);
+                if (ret != -EDEADLK)
+                        break;
 
-        if (ret == -EDEADLK) {
                 drm_modeset_backoff(&ctx);
-                goto retry;
         }
 
+        if (!ret)
+                ret = __intel_display_resume(dev, state);
+
         drm_modeset_drop_locks(&ctx);
         drm_modeset_acquire_fini(&ctx);
         mutex_unlock(&dev->mode_config.mutex);
diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
index 6a7ad3ed1463..3836a1c79714 100644
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -1230,12 +1230,29 @@ static int intel_sanitize_fbc_option(struct drm_i915_private *dev_priv)
         if (i915.enable_fbc >= 0)
                 return !!i915.enable_fbc;
 
+        if (!HAS_FBC(dev_priv))
+                return 0;
+
         if (IS_BROADWELL(dev_priv))
                 return 1;
 
         return 0;
 }
 
+static bool need_fbc_vtd_wa(struct drm_i915_private *dev_priv)
+{
+#ifdef CONFIG_INTEL_IOMMU
+        /* WaFbcTurnOffFbcWhenHyperVisorIsUsed:skl,bxt */
+        if (intel_iommu_gfx_mapped &&
+            (IS_SKYLAKE(dev_priv) || IS_BROXTON(dev_priv))) {
+                DRM_INFO("Disabling framebuffer compression (FBC) to prevent screen flicker with VT-d enabled\n");
+                return true;
+        }
+#endif
+
+        return false;
+}
+
 /**
  * intel_fbc_init - Initialize FBC
  * @dev_priv: the i915 device
@@ -1253,6 +1270,9 @@ void intel_fbc_init(struct drm_i915_private *dev_priv)
         fbc->active = false;
         fbc->work.scheduled = false;
 
+        if (need_fbc_vtd_wa(dev_priv))
+                mkwrite_device_info(dev_priv)->has_fbc = false;
+
         i915.enable_fbc = intel_sanitize_fbc_option(dev_priv);
         DRM_DEBUG_KMS("Sanitized enable_fbc value: %d\n", i915.enable_fbc);
 
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 97ba6c8cf907..d5deb58a2128 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3344,6 +3344,8 @@ static uint32_t skl_wm_method2(uint32_t pixel_rate, uint32_t pipe_htotal,
                 plane_bytes_per_line *= 4;
                 plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512);
                 plane_blocks_per_line /= 4;
+        } else if (tiling == DRM_FORMAT_MOD_NONE) {
+                plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512) + 1;
         } else {
                 plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512);
         }
@@ -6574,9 +6576,7 @@ void intel_init_gt_powersave(struct drm_i915_private *dev_priv)
 
 void intel_cleanup_gt_powersave(struct drm_i915_private *dev_priv)
 {
-        if (IS_CHERRYVIEW(dev_priv))
-                return;
-        else if (IS_VALLEYVIEW(dev_priv))
+        if (IS_VALLEYVIEW(dev_priv))
                 valleyview_cleanup_gt_powersave(dev_priv);
 
         if (!i915.enable_rc6)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index cca7792f26d5..1d3161bbea24 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -1178,8 +1178,8 @@ static int bxt_init_workarounds(struct intel_engine_cs *engine)
                 I915_WRITE(GEN8_L3SQCREG1, L3_GENERAL_PRIO_CREDITS(62) |
                                            L3_HIGH_PRIO_CREDITS(2));
 
-        /* WaInsertDummyPushConstPs:bxt */
-        if (IS_BXT_REVID(dev_priv, 0, BXT_REVID_B0))
+        /* WaToEnableHwFixForPushConstHWBug:bxt */
+        if (IS_BXT_REVID(dev_priv, BXT_REVID_C0, REVID_FOREVER))
                 WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2,
                                   GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION);
 
@@ -1222,8 +1222,8 @@ static int kbl_init_workarounds(struct intel_engine_cs *engine)
                 I915_WRITE(GEN8_L3SQCREG4, I915_READ(GEN8_L3SQCREG4) |
                            GEN8_LQSC_RO_PERF_DIS);
 
-        /* WaInsertDummyPushConstPs:kbl */
-        if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_B0))
+        /* WaToEnableHwFixForPushConstHWBug:kbl */
+        if (IS_KBL_REVID(dev_priv, KBL_REVID_C0, REVID_FOREVER))
                 WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2,
                                   GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION);
 
diff --git a/drivers/gpu/drm/mediatek/Kconfig b/drivers/gpu/drm/mediatek/Kconfig
index 23ac8041c562..294de4549922 100644
--- a/drivers/gpu/drm/mediatek/Kconfig
+++ b/drivers/gpu/drm/mediatek/Kconfig
@@ -2,6 +2,9 @@ config DRM_MEDIATEK
         tristate "DRM Support for Mediatek SoCs"
         depends on DRM
         depends on ARCH_MEDIATEK || (ARM && COMPILE_TEST)
+        depends on COMMON_CLK
+        depends on HAVE_ARM_SMCCC
+        depends on OF
         select DRM_GEM_CMA_HELPER
         select DRM_KMS_HELPER
         select DRM_MIPI_DSI
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 6de342861202..ddef0d494084 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -198,16 +198,7 @@ static int radeon_atpx_validate(struct radeon_atpx *atpx)
         atpx->is_hybrid = false;
         if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
                 printk("ATPX Hybrid Graphics\n");
-#if 1
-                /* This is a temporary hack until the D3 cold support
-                 * makes it upstream.  The ATPX power_control method seems
-                 * to still work on even if the system should be using
-                 * the new standardized hybrid D3 cold ACPI interface.
-                 */
-                atpx->functions.power_cntl = true;
-#else
                 atpx->functions.power_cntl = false;
-#endif
                 atpx->is_hybrid = true;
         }
 
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index 730d84028260..d0203a115eff 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -491,7 +491,7 @@ struct it87_sio_data {
 struct it87_data {
         const struct attribute_group *groups[7];
         enum chips type;
-        u16 features;
+        u32 features;
         u8 peci_mask;
         u8 old_peci_mask;
 
diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
index f23372669f77..1bb97f658b47 100644
--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -38,6 +38,7 @@
 #define AT91_I2C_TIMEOUT        msecs_to_jiffies(100)   /* transfer timeout */
 #define AT91_I2C_DMA_THRESHOLD  8                       /* enable DMA if transfer size is bigger than this threshold */
 #define AUTOSUSPEND_TIMEOUT             2000
+#define AT91_I2C_MAX_ALT_CMD_DATA_SIZE  256
 
 /* AT91 TWI register definitions */
 #define AT91_TWI_CR             0x0000  /* Control Register */
@@ -141,6 +142,7 @@ struct at91_twi_dev {
         unsigned twi_cwgr_reg;
         struct at91_twi_pdata *pdata;
         bool use_dma;
+        bool use_alt_cmd;
         bool recv_len_abort;
         u32 fifo_size;
         struct at91_twi_dma dma;
@@ -269,7 +271,7 @@ static void at91_twi_write_next_byte(struct at91_twi_dev *dev)
 
         /* send stop when last byte has been written */
         if (--dev->buf_len == 0)
-                if (!dev->pdata->has_alt_cmd)
+                if (!dev->use_alt_cmd)
                         at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
 
         dev_dbg(dev->dev, "wrote 0x%x, to go %d\n", *dev->buf, dev->buf_len);
@@ -292,7 +294,7 @@ static void at91_twi_write_data_dma_callback(void *data)
          * we just have to enable TXCOMP one.
          */
         at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
-        if (!dev->pdata->has_alt_cmd)
+        if (!dev->use_alt_cmd)
                 at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
 }
 
@@ -410,7 +412,7 @@ static void at91_twi_read_next_byte(struct at91_twi_dev *dev)
         }
 
         /* send stop if second but last byte has been read */
-        if (!dev->pdata->has_alt_cmd && dev->buf_len == 1)
+        if (!dev->use_alt_cmd && dev->buf_len == 1)
                 at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
 
         dev_dbg(dev->dev, "read 0x%x, to go %d\n", *dev->buf, dev->buf_len);
@@ -426,7 +428,7 @@ static void at91_twi_read_data_dma_callback(void *data)
         dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg[0]),
                          dev->buf_len, DMA_FROM_DEVICE);
 
-        if (!dev->pdata->has_alt_cmd) {
+        if (!dev->use_alt_cmd) {
                 /* The last two bytes have to be read without using dma */
                 dev->buf += dev->buf_len - 2;
                 dev->buf_len = 2;
@@ -443,7 +445,7 @@ static void at91_twi_read_data_dma(struct at91_twi_dev *dev)
         struct dma_chan *chan_rx = dma->chan_rx;
         size_t buf_len;
 
-        buf_len = (dev->pdata->has_alt_cmd) ? dev->buf_len : dev->buf_len - 2;
+        buf_len = (dev->use_alt_cmd) ? dev->buf_len : dev->buf_len - 2;
         dma->direction = DMA_FROM_DEVICE;
 
         /* Keep in mind that we won't use dma to read the last two bytes */
@@ -651,7 +653,7 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
                 unsigned start_flags = AT91_TWI_START;
 
                 /* if only one byte is to be read, immediately stop transfer */
-                if (!has_alt_cmd && dev->buf_len <= 1 &&
+                if (!dev->use_alt_cmd && dev->buf_len <= 1 &&
                     !(dev->msg->flags & I2C_M_RECV_LEN))
                         start_flags |= AT91_TWI_STOP;
                 at91_twi_write(dev, AT91_TWI_CR, start_flags);
@@ -745,7 +747,7 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
         int ret;
         unsigned int_addr_flag = 0;
         struct i2c_msg *m_start = msg;
-        bool is_read, use_alt_cmd = false;
+        bool is_read;
 
         dev_dbg(&adap->dev, "at91_xfer: processing %d messages:\n", num);
 
@@ -768,14 +770,16 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
                 at91_twi_write(dev, AT91_TWI_IADR, internal_address);
         }
 
+        dev->use_alt_cmd = false;
         is_read = (m_start->flags & I2C_M_RD);
         if (dev->pdata->has_alt_cmd) {
-                if (m_start->len > 0) {
+                if (m_start->len > 0 &&
+                    m_start->len < AT91_I2C_MAX_ALT_CMD_DATA_SIZE) {
                         at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_ACMEN);
                         at91_twi_write(dev, AT91_TWI_ACR,
                                        AT91_TWI_ACR_DATAL(m_start->len) |
                                        ((is_read) ? AT91_TWI_ACR_DIR : 0));
-                        use_alt_cmd = true;
+                        dev->use_alt_cmd = true;
                 } else {
                         at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_ACMDIS);
                 }
@@ -784,7 +788,7 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
         at91_twi_write(dev, AT91_TWI_MMR,
                        (m_start->addr << 16) |
                        int_addr_flag |
-                       ((!use_alt_cmd && is_read) ? AT91_TWI_MREAD : 0));
+                       ((!dev->use_alt_cmd && is_read) ? AT91_TWI_MREAD : 0));
 
         dev->buf_len = m_start->len;
         dev->buf = m_start->buf;
diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
index 19c843828fe2..95f7cac76f89 100644
--- a/drivers/i2c/busses/i2c-bcm-iproc.c
+++ b/drivers/i2c/busses/i2c-bcm-iproc.c
@@ -158,7 +158,7 @@ static irqreturn_t bcm_iproc_i2c_isr(int irq, void *data)
 
         if (status & BIT(IS_M_START_BUSY_SHIFT)) {
                 iproc_i2c->xfer_is_done = 1;
-                complete_all(&iproc_i2c->done);
+                complete(&iproc_i2c->done);
         }
 
         writel(status, iproc_i2c->base + IS_OFFSET);
diff --git a/drivers/i2c/busses/i2c-bcm-kona.c b/drivers/i2c/busses/i2c-bcm-kona.c
index ac9f47679c3a..f98743277e3c 100644
--- a/drivers/i2c/busses/i2c-bcm-kona.c
+++ b/drivers/i2c/busses/i2c-bcm-kona.c
@@ -229,7 +229,7 @@ static irqreturn_t bcm_kona_i2c_isr(int irq, void *devid)
                        dev->base + TXFCR_OFFSET);
 
         writel(status & ~ISR_RESERVED_MASK, dev->base + ISR_OFFSET);
-        complete_all(&dev->done);
+        complete(&dev->done);
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
index 3f5a4d71d3bf..385b57bfcb38 100644
--- a/drivers/i2c/busses/i2c-brcmstb.c
+++ b/drivers/i2c/busses/i2c-brcmstb.c
@@ -228,7 +228,7 @@ static irqreturn_t brcmstb_i2c_isr(int irq, void *devid)
                 return IRQ_NONE;
 
         brcmstb_i2c_enable_disable_irq(dev, INT_DISABLE);
-        complete_all(&dev->done);
+        complete(&dev->done);
 
         dev_dbg(dev->device, "isr handled");
         return IRQ_HANDLED;
diff --git a/drivers/i2c/busses/i2c-cros-ec-tunnel.c b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
index a0d95ff682ae..2d5ff86398d0 100644
--- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c
+++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
@@ -215,7 +215,7 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[],
         msg->outsize = request_len;
         msg->insize = response_len;
 
-        result = cros_ec_cmd_xfer(bus->ec, msg);
+        result = cros_ec_cmd_xfer_status(bus->ec, msg);
         if (result < 0) {
                 dev_err(dev, "Error transferring EC i2c message %d\n", result);
                 goto exit;
diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c
index 71d3929adf54..76e28980904f 100644
--- a/drivers/i2c/busses/i2c-meson.c
+++ b/drivers/i2c/busses/i2c-meson.c
@@ -211,7 +211,7 @@ static void meson_i2c_stop(struct meson_i2c *i2c)
                 meson_i2c_add_token(i2c, TOKEN_STOP);
         } else {
                 i2c->state = STATE_IDLE;
-                complete_all(&i2c->done);
+                complete(&i2c->done);
         }
 }
 
@@ -238,7 +238,7 @@ static irqreturn_t meson_i2c_irq(int irqno, void *dev_id)
                 dev_dbg(i2c->dev, "error bit set\n");
                 i2c->error = -ENXIO;
                 i2c->state = STATE_IDLE;
-                complete_all(&i2c->done);
+                complete(&i2c->done);
                 goto out;
         }
 
@@ -269,7 +269,7 @@ static irqreturn_t meson_i2c_irq(int irqno, void *dev_id)
                 break;
         case STATE_STOP:
                 i2c->state = STATE_IDLE;
-                complete_all(&i2c->done);
+                complete(&i2c->done);
                 break;
         case STATE_IDLE:
                 break;
diff --git a/drivers/i2c/busses/i2c-ocores.c b/drivers/i2c/busses/i2c-ocores.c
index dfa7a4b4a91d..ac88a524143e 100644
--- a/drivers/i2c/busses/i2c-ocores.c
+++ b/drivers/i2c/busses/i2c-ocores.c
@@ -379,6 +379,7 @@ static int ocores_i2c_of_probe(struct platform_device *pdev,
                         if (!clock_frequency_present) {
                                 dev_err(&pdev->dev,
                                         "Missing required parameter 'opencores,ip-clock-frequency'\n");
+                                clk_disable_unprepare(i2c->clk);
                                 return -ENODEV;
                         }
                         i2c->ip_clock_khz = clock_frequency / 1000;
@@ -467,20 +468,21 @@ static int ocores_i2c_probe(struct platform_device *pdev)
                 default:
                         dev_err(&pdev->dev, "Unsupported I/O width (%d)\n",
                                 i2c->reg_io_width);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto err_clk;
                 }
         }
 
         ret = ocores_init(&pdev->dev, i2c);
         if (ret)
-                return ret;
+                goto err_clk;
 
         init_waitqueue_head(&i2c->wait);
         ret = devm_request_irq(&pdev->dev, irq, ocores_isr, 0,
                                pdev->name, i2c);
         if (ret) {
                 dev_err(&pdev->dev, "Cannot claim IRQ\n");
-                return ret;
+                goto err_clk;
         }
 
         /* hook up driver to tree */
@@ -494,7 +496,7 @@ static int ocores_i2c_probe(struct platform_device *pdev)
         ret = i2c_add_adapter(&i2c->adap);
         if (ret) {
                 dev_err(&pdev->dev, "Failed to add adapter\n");
-                return ret;
+                goto err_clk;
         }
 
         /* add in known devices to the bus */
@@ -504,6 +506,10 @@ static int ocores_i2c_probe(struct platform_device *pdev)
         }
 
         return 0;
+
+err_clk:
+        clk_disable_unprepare(i2c->clk);
+        return ret;
 }
 
 static int ocores_i2c_remove(struct platform_device *pdev)
diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
index 8de073aed001..215ac87f606d 100644
--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
@@ -68,7 +68,7 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
         adap = of_find_i2c_adapter_by_node(priv->chan[new_chan].parent_np);
         if (!adap) {
                 ret = -ENODEV;
-                goto err;
+                goto err_with_revert;
         }
 
         p = devm_pinctrl_get_select(adap->dev.parent, priv->bus_name);
@@ -103,6 +103,8 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
 
  err_with_put:
         i2c_put_adapter(adap);
+ err_with_revert:
+        of_changeset_revert(&priv->chan[new_chan].chgset);
  err:
         dev_err(priv->dev, "failed to setup demux-adapter %d (%d)\n", new_chan, ret);
         return ret;
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 08a1e2f3690f..00c8a08d56e7 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -68,7 +68,8 @@ void iommu_put_dma_cookie(struct iommu_domain *domain)
         if (!iovad)
                 return;
 
-        put_iova_domain(iovad);
+        if (iovad->granule)
+                put_iova_domain(iovad);
         kfree(iovad);
         domain->iova_cookie = NULL;
 }
@@ -151,12 +152,15 @@ int dma_direction_to_prot(enum dma_data_direction dir, bool coherent)
         }
 }
 
-static struct iova *__alloc_iova(struct iova_domain *iovad, size_t size,
+static struct iova *__alloc_iova(struct iommu_domain *domain, size_t size,
                 dma_addr_t dma_limit)
 {
+        struct iova_domain *iovad = domain->iova_cookie;
         unsigned long shift = iova_shift(iovad);
         unsigned long length = iova_align(iovad, size) >> shift;
 
+        if (domain->geometry.force_aperture)
+                dma_limit = min(dma_limit, domain->geometry.aperture_end);
         /*
          * Enforce size-alignment to be safe - there could perhaps be an
          * attribute to control this per-device, or at least per-domain...
@@ -314,7 +318,7 @@ struct page **iommu_dma_alloc(struct device *dev, size_t size, gfp_t gfp,
         if (!pages)
                 return NULL;
 
-        iova = __alloc_iova(iovad, size, dev->coherent_dma_mask);
+        iova = __alloc_iova(domain, size, dev->coherent_dma_mask);
         if (!iova)
                 goto out_free_pages;
 
@@ -386,7 +390,7 @@ dma_addr_t iommu_dma_map_page(struct device *dev, struct page *page,
         phys_addr_t phys = page_to_phys(page) + offset;
         size_t iova_off = iova_offset(iovad, phys);
         size_t len = iova_align(iovad, size + iova_off);
-        struct iova *iova = __alloc_iova(iovad, len, dma_get_mask(dev));
+        struct iova *iova = __alloc_iova(domain, len, dma_get_mask(dev));
 
         if (!iova)
                 return DMA_ERROR_CODE;
@@ -538,7 +542,7 @@ int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg,
                 prev = s;
         }
 
-        iova = __alloc_iova(iovad, iova_len, dma_get_mask(dev));
+        iova = __alloc_iova(domain, iova_len, dma_get_mask(dev));
         if (!iova)
                 goto out_restore_sg;
 
diff --git a/drivers/iommu/mtk_iommu.h b/drivers/iommu/mtk_iommu.h
index 9ed0a8462ccf..3dab13b4a211 100644
--- a/drivers/iommu/mtk_iommu.h
+++ b/drivers/iommu/mtk_iommu.h
@@ -55,19 +55,19 @@ struct mtk_iommu_data {
         bool                            enable_4GB;
 };
 
-static int compare_of(struct device *dev, void *data)
+static inline int compare_of(struct device *dev, void *data)
 {
         return dev->of_node == data;
 }
 
-static int mtk_iommu_bind(struct device *dev)
+static inline int mtk_iommu_bind(struct device *dev)
 {
         struct mtk_iommu_data *data = dev_get_drvdata(dev);
 
         return component_bind_all(dev, &data->smi_imu);
 }
 
-static void mtk_iommu_unbind(struct device *dev)
+static inline void mtk_iommu_unbind(struct device *dev)
 {
         struct mtk_iommu_data *data = dev_get_drvdata(dev);
 
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 4e9784b4e0ac..eedba67b0e3e 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -181,7 +181,7 @@ struct crypt_config {
         u8 key[0];
 };
 
-#define MIN_IOS        16
+#define MIN_IOS        64
 
 static void clone_init(struct dm_crypt_io *, struct bio *);
 static void kcryptd_queue_crypt(struct dm_crypt_io *io);
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 1b9795d75ef8..8abde6b8cedc 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -191,7 +191,6 @@ struct raid_dev {
 #define RT_FLAG_RS_BITMAP_LOADED        2
 #define RT_FLAG_UPDATE_SBS              3
 #define RT_FLAG_RESHAPE_RS              4
-#define RT_FLAG_KEEP_RS_FROZEN          5
 
 /* Array elements of 64 bit needed for rebuild/failed disk bits */
 #define DISKS_ARRAY_ELEMS ((MAX_RAID_DEVICES + (sizeof(uint64_t) * 8 - 1)) / sizeof(uint64_t) / 8)
@@ -861,6 +860,9 @@ static int validate_region_size(struct raid_set *rs, unsigned long region_size)
 {
         unsigned long min_region_size = rs->ti->len / (1 << 21);
 
+        if (rs_is_raid0(rs))
+                return 0;
+
         if (!region_size) {
                 /*
                  * Choose a reasonable default.  All figures in sectors.
@@ -930,6 +932,8 @@ static int validate_raid_redundancy(struct raid_set *rs)
                         rebuild_cnt++;
 
         switch (rs->raid_type->level) {
+        case 0:
+                break;
         case 1:
                 if (rebuild_cnt >= rs->md.raid_disks)
                         goto too_many;
@@ -2335,6 +2339,13 @@ static int analyse_superblocks(struct dm_target *ti, struct raid_set *rs)
                 case 0:
                         break;
                 default:
+                        /*
+                         * We have to keep any raid0 data/metadata device pairs or
+                         * the MD raid0 personality will fail to start the array.
+                         */
+                        if (rs_is_raid0(rs))
+                                continue;
+
                         dev = container_of(rdev, struct raid_dev, rdev);
                         if (dev->meta_dev)
                                 dm_put_device(ti, dev->meta_dev);
@@ -2579,7 +2590,6 @@ static int rs_prepare_reshape(struct raid_set *rs)
                 } else {
                         /* Process raid1 without delta_disks */
                         mddev->raid_disks = rs->raid_disks;
-                        set_bit(RT_FLAG_KEEP_RS_FROZEN, &rs->runtime_flags);
                         reshape = false;
                 }
         } else {
@@ -2590,7 +2600,6 @@ static int rs_prepare_reshape(struct raid_set *rs)
         if (reshape) {
                 set_bit(RT_FLAG_RESHAPE_RS, &rs->runtime_flags);
                 set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
-                set_bit(RT_FLAG_KEEP_RS_FROZEN, &rs->runtime_flags);
         } else if (mddev->raid_disks < rs->raid_disks)
                 /* Create new superblocks and bitmaps, if any new disks */
                 set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
@@ -2902,7 +2911,6 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                         goto bad;
 
                 set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
-                set_bit(RT_FLAG_KEEP_RS_FROZEN, &rs->runtime_flags);
                 /* Takeover ain't recovery, so disable recovery */
                 rs_setup_recovery(rs, MaxSector);
                 rs_set_new(rs);
@@ -3386,21 +3394,28 @@ static void raid_postsuspend(struct dm_target *ti)
 {
         struct raid_set *rs = ti->private;
 
-        if (test_and_clear_bit(RT_FLAG_RS_RESUMED, &rs->runtime_flags)) {
-                if (!rs->md.suspended)
-                        mddev_suspend(&rs->md);
-                rs->md.ro = 1;
-        }
+        if (!rs->md.suspended)
+                mddev_suspend(&rs->md);
+
+        rs->md.ro = 1;
 }
 
 static void attempt_restore_of_faulty_devices(struct raid_set *rs)
 {
         int i;
-        uint64_t failed_devices, cleared_failed_devices = 0;
+        uint64_t cleared_failed_devices[DISKS_ARRAY_ELEMS];
         unsigned long flags;
+        bool cleared = false;
         struct dm_raid_superblock *sb;
+        struct mddev *mddev = &rs->md;
         struct md_rdev *r;
 
+        /* RAID personalities have to provide hot add/remove methods or we need to bail out. */
+        if (!mddev->pers || !mddev->pers->hot_add_disk || !mddev->pers->hot_remove_disk)
+                return;
+
+        memset(cleared_failed_devices, 0, sizeof(cleared_failed_devices));
+
         for (i = 0; i < rs->md.raid_disks; i++) {
                 r = &rs->dev[i].rdev;
                 if (test_bit(Faulty, &r->flags) && r->sb_page &&
@@ -3420,7 +3435,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs)
                          * ourselves.
                          */
                         if ((r->raid_disk >= 0) &&
-                            (r->mddev->pers->hot_remove_disk(r->mddev, r) != 0))
+                            (mddev->pers->hot_remove_disk(mddev, r) != 0))
                                 /* Failed to revive this device, try next */
                                 continue;
 
@@ -3430,22 +3445,30 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs)
                         clear_bit(Faulty, &r->flags);
                         clear_bit(WriteErrorSeen, &r->flags);
                         clear_bit(In_sync, &r->flags);
-                        if (r->mddev->pers->hot_add_disk(r->mddev, r)) {
+                        if (mddev->pers->hot_add_disk(mddev, r)) {
                                 r->raid_disk = -1;
                                 r->saved_raid_disk = -1;
                                 r->flags = flags;
                         } else {
                                 r->recovery_offset = 0;
-                                cleared_failed_devices |= 1 << i;
+                                set_bit(i, (void *) cleared_failed_devices);
+                                cleared = true;
                         }
                 }
         }
-        if (cleared_failed_devices) {
+
+        /* If any failed devices could be cleared, update all sbs failed_devices bits */
+        if (cleared) {
+                uint64_t failed_devices[DISKS_ARRAY_ELEMS];
+
                 rdev_for_each(r, &rs->md) {
                         sb = page_address(r->sb_page);
-                        failed_devices = le64_to_cpu(sb->failed_devices);
-                        failed_devices &= ~cleared_failed_devices;
-                        sb->failed_devices = cpu_to_le64(failed_devices);
+                        sb_retrieve_failed_devices(sb, failed_devices);
+
+                        for (i = 0; i < DISKS_ARRAY_ELEMS; i++)
+                                failed_devices[i] &= ~cleared_failed_devices[i];
+
+                        sb_update_failed_devices(sb, failed_devices);
                 }
         }
 }
@@ -3610,26 +3633,15 @@ static void raid_resume(struct dm_target *ti)
                  * devices are reachable again.
                  */
                 attempt_restore_of_faulty_devices(rs);
-        } else {
-                mddev->ro = 0;
-                mddev->in_sync = 0;
+        }
 
-                /*
-                 * When passing in flags to the ctr, we expect userspace
-                 * to reset them because they made it to the superblocks
-                 * and reload the mapping anyway.
-                 *
-                 * -> only unfreeze recovery in case of a table reload or
-                 *    we'll have a bogus recovery/reshape position
-                 *    retrieved from the superblock by the ctr because
-                 *    the ongoing recovery/reshape will change it after read.
-                 */
-                if (!test_bit(RT_FLAG_KEEP_RS_FROZEN, &rs->runtime_flags))
-                        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+        mddev->ro = 0;
+        mddev->in_sync = 0;
 
-                if (mddev->suspended)
-                        mddev_resume(mddev);
-        }
+        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+
+        if (mddev->suspended)
+                mddev_resume(mddev);
 }
 
 static struct target_type raid_target = {
diff --git a/drivers/md/dm-round-robin.c b/drivers/md/dm-round-robin.c
index 4ace1da17db8..6c25213ab38c 100644
--- a/drivers/md/dm-round-robin.c
+++ b/drivers/md/dm-round-robin.c
@@ -210,14 +210,17 @@ static struct dm_path *rr_select_path(struct path_selector *ps, size_t nr_bytes)
         struct path_info *pi = NULL;
         struct dm_path *current_path = NULL;
 
+        local_irq_save(flags);
         current_path = *this_cpu_ptr(s->current_path);
         if (current_path) {
                 percpu_counter_dec(&s->repeat_count);
-                if (percpu_counter_read_positive(&s->repeat_count) > 0)
+                if (percpu_counter_read_positive(&s->repeat_count) > 0) {
+                        local_irq_restore(flags);
                         return current_path;
+                }
         }
 
-        spin_lock_irqsave(&s->lock, flags);
+        spin_lock(&s->lock);
         if (!list_empty(&s->valid_paths)) {
                 pi = list_entry(s->valid_paths.next, struct path_info, list);
                 list_move_tail(&pi->list, &s->valid_paths);
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index 869c83fb3c5d..f00f3e742265 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -2185,7 +2185,7 @@ static int gpmc_probe_dt(struct platform_device *pdev)
         return 0;
 }
 
-static int gpmc_probe_dt_children(struct platform_device *pdev)
+static void gpmc_probe_dt_children(struct platform_device *pdev)
 {
         int ret;
         struct device_node *child;
@@ -2200,11 +2200,11 @@ static int gpmc_probe_dt_children(struct platform_device *pdev)
                 else
                         ret = gpmc_probe_generic_child(pdev, child);
 
-                if (ret)
-                        return ret;
+                if (ret) {
+                        dev_err(&pdev->dev, "failed to probe DT child '%s': %d\n",
+                                child->name, ret);
+                }
         }
-
-        return 0;
 }
 #else
 static int gpmc_probe_dt(struct platform_device *pdev)
@@ -2212,9 +2212,8 @@ static int gpmc_probe_dt(struct platform_device *pdev)
         return 0;
 }
 
-static int gpmc_probe_dt_children(struct platform_device *pdev)
+static void gpmc_probe_dt_children(struct platform_device *pdev)
 {
-        return 0;
 }
 #endif /* CONFIG_OF */
 
@@ -2369,16 +2368,10 @@ static int gpmc_probe(struct platform_device *pdev)
                 goto setup_irq_failed;
         }
 
-        rc = gpmc_probe_dt_children(pdev);
-        if (rc < 0) {
-                dev_err(gpmc->dev, "failed to probe DT children\n");
-                goto dt_children_failed;
-        }
+        gpmc_probe_dt_children(pdev);
 
         return 0;
 
-dt_children_failed:
-        gpmc_free_irq(gpmc);
 setup_irq_failed:
         gpmc_gpio_exit(gpmc);
 gpio_init_failed:
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 1f276fa30ba6..217e8da0628c 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -152,7 +152,7 @@ module_param(lacp_rate, charp, 0);
 MODULE_PARM_DESC(lacp_rate, "LACPDU tx rate to request from 802.3ad partner; "
                             "0 for slow, 1 for fast");
 module_param(ad_select, charp, 0);
-MODULE_PARM_DESC(ad_select, "803.ad aggregation selection logic; "
+MODULE_PARM_DESC(ad_select, "802.3ad aggregation selection logic; "
                             "0 for stable (default), 1 for bandwidth, "
                             "2 for count");
 module_param(min_links, int, 0);
diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
index 8f12bddd5dc9..a0b453ea34c9 100644
--- a/drivers/net/dsa/b53/b53_regs.h
+++ b/drivers/net/dsa/b53/b53_regs.h
@@ -258,7 +258,7 @@
  * BCM5325 and BCM5365 share most definitions below
  */
 #define B53_ARLTBL_MAC_VID_ENTRY(n)     (0x10 * (n))
-#define   ARLTBL_MAC_MASK               0xffffffffffff
+#define   ARLTBL_MAC_MASK               0xffffffffffffULL
 #define   ARLTBL_VID_S                  48
 #define   ARLTBL_VID_MASK_25            0xff
 #define   ARLTBL_VID_MASK               0xfff
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index d36aedde8cb9..d1d9d3cf9139 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -3187,6 +3187,7 @@ static int mv88e6xxx_set_addr(struct dsa_switch *ds, u8 *addr)
         return err;
 }
 
+#ifdef CONFIG_NET_DSA_HWMON
 static int mv88e6xxx_mdio_page_read(struct dsa_switch *ds, int port, int page,
                                     int reg)
 {
@@ -3212,6 +3213,7 @@ static int mv88e6xxx_mdio_page_write(struct dsa_switch *ds, int port, int page,
 
         return ret;
 }
+#endif
 
 static int mv88e6xxx_port_to_mdio_addr(struct mv88e6xxx_chip *chip, int port)
 {
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index 37a0f463b8de..18bb9556dd00 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -793,6 +793,8 @@ int xgene_enet_phy_connect(struct net_device *ndev)
                         netdev_err(ndev, "Could not connect to PHY\n");
                         return  -ENODEV;
                 }
+#else
+                return -ENODEV;
 #endif
         }
 
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index 4bff0f3040df..b0da9693f28a 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -771,8 +771,10 @@ int arc_emac_probe(struct net_device *ndev, int interface)
         priv->dev = dev;
 
         priv->regs = devm_ioremap_resource(dev, &res_regs);
-        if (IS_ERR(priv->regs))
-                return PTR_ERR(priv->regs);
+        if (IS_ERR(priv->regs)) {
+                err = PTR_ERR(priv->regs);
+                goto out_put_node;
+        }
 
         dev_dbg(dev, "Registers base address is 0x%p\n", priv->regs);
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index ff300f7cf529..659261218d9f 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -12552,10 +12552,6 @@ static int tg3_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *info,
                                 info->data = TG3_RSS_MAX_NUM_QS;
                 }
 
-                /* The first interrupt vector only
-                 * handles link interrupts.
-                 */
-                info->data -= 1;
                 return 0;
 
         default:
@@ -14014,6 +14010,7 @@ static int tg3_set_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
         }
 
         if ((ec->rx_coalesce_usecs > MAX_RXCOL_TICKS) ||
+            (!ec->rx_coalesce_usecs) ||
             (ec->tx_coalesce_usecs > MAX_TXCOL_TICKS) ||
             (ec->rx_max_coalesced_frames > MAX_RXMAX_FRAMES) ||
             (ec->tx_max_coalesced_frames > MAX_TXMAX_FRAMES) ||
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 36893d8958d4..b6fcf10621b6 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -403,11 +403,11 @@
 #define MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII     0x00000004
 #define MACB_CAPS_NO_GIGABIT_HALF               0x00000008
 #define MACB_CAPS_USRIO_DISABLED                0x00000010
+#define MACB_CAPS_JUMBO                         0x00000020
 #define MACB_CAPS_FIFO_MODE                     0x10000000
 #define MACB_CAPS_GIGABIT_MODE_AVAILABLE        0x20000000
 #define MACB_CAPS_SG_DISABLED                   0x40000000
 #define MACB_CAPS_MACB_IS_GEM                   0x80000000
-#define MACB_CAPS_JUMBO                         0x00000010
 
 /* Bit manipulation macros */
 #define MACB_BIT(name)                                  \
diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index 1471e16ba719..f45385f5c6e5 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -1299,6 +1299,7 @@ static int
 dm9000_open(struct net_device *dev)
 {
         struct board_info *db = netdev_priv(dev);
+        unsigned int irq_flags = irq_get_trigger_type(dev->irq);
 
         if (netif_msg_ifup(db))
                 dev_dbg(db->dev, "enabling %s\n", dev->name);
@@ -1306,9 +1307,11 @@ dm9000_open(struct net_device *dev)
         /* If there is no IRQ type specified, tell the user that this is a
          * problem
          */
-        if (irq_get_trigger_type(dev->irq) == IRQF_TRIGGER_NONE)
+        if (irq_flags == IRQF_TRIGGER_NONE)
                 dev_warn(db->dev, "WARNING: no IRQ resource flags set.\n");
 
+        irq_flags |= IRQF_SHARED;
+
         /* GPIO0 on pre-activate PHY, Reg 1F is not set by reset */
         iow(db, DM9000_GPR, 0); /* REG_1F bit0 activate phyxcer */
         mdelay(1); /* delay needs by DM9000B */
@@ -1316,8 +1319,7 @@ dm9000_open(struct net_device *dev)
         /* Initialize DM9000 board */
         dm9000_init_dm9000(dev);
 
-        if (request_irq(dev->irq, dm9000_interrupt, IRQF_SHARED,
-                        dev->name, dev))
+        if (request_irq(dev->irq, dm9000_interrupt, irq_flags, dev->name, dev))
                 return -EAGAIN;
         /* Now that we have an interrupt handler hooked up we can unmask
          * our interrupts
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
index 1235c7f2564b..1e1eb92998fb 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
@@ -17,7 +17,7 @@ static const struct mac_stats_string g_gmac_stats_string[] = {
         {"gmac_rx_octets_total_ok", MAC_STATS_FIELD_OFF(rx_good_bytes)},
         {"gmac_rx_octets_bad", MAC_STATS_FIELD_OFF(rx_bad_bytes)},
         {"gmac_rx_uc_pkts", MAC_STATS_FIELD_OFF(rx_uc_pkts)},
-        {"gamc_rx_mc_pkts", MAC_STATS_FIELD_OFF(rx_mc_pkts)},
+        {"gmac_rx_mc_pkts", MAC_STATS_FIELD_OFF(rx_mc_pkts)},
         {"gmac_rx_bc_pkts", MAC_STATS_FIELD_OFF(rx_bc_pkts)},
         {"gmac_rx_pkts_64octets", MAC_STATS_FIELD_OFF(rx_64bytes)},
         {"gmac_rx_pkts_65to127", MAC_STATS_FIELD_OFF(rx_65to127)},
diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
index 7fd4d54599e4..6b03c8553e59 100644
--- a/drivers/net/ethernet/intel/e1000e/82571.c
+++ b/drivers/net/ethernet/intel/e1000e/82571.c
@@ -2032,7 +2032,8 @@ const struct e1000_info e1000_82574_info = {
                                   | FLAG2_DISABLE_ASPM_L0S
                                   | FLAG2_DISABLE_ASPM_L1
                                   | FLAG2_NO_DISABLE_RX
-                                  | FLAG2_DMA_BURST,
+                                  | FLAG2_DMA_BURST
+                                  | FLAG2_CHECK_SYSTIM_OVERFLOW,
         .pba                    = 32,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
@@ -2053,7 +2054,8 @@ const struct e1000_info e1000_82583_info = {
                                   | FLAG_HAS_CTRLEXT_ON_LOAD,
         .flags2                 = FLAG2_DISABLE_ASPM_L0S
                                   | FLAG2_DISABLE_ASPM_L1
-                                  | FLAG2_NO_DISABLE_RX,
+                                  | FLAG2_NO_DISABLE_RX
+                                  | FLAG2_CHECK_SYSTIM_OVERFLOW,
         .pba                    = 32,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
index ef96cd11d6d2..879cca47b021 100644
--- a/drivers/net/ethernet/intel/e1000e/e1000.h
+++ b/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -452,6 +452,7 @@ s32 e1000e_get_base_timinca(struct e1000_adapter *adapter, u32 *timinca);
 #define FLAG2_PCIM2PCI_ARBITER_WA         BIT(11)
 #define FLAG2_DFLT_CRC_STRIPPING          BIT(12)
 #define FLAG2_CHECK_RX_HWTSTAMP           BIT(13)
+#define FLAG2_CHECK_SYSTIM_OVERFLOW       BIT(14)
 
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 3e11322d8d58..f3aaca743ea3 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -5885,7 +5885,8 @@ const struct e1000_info e1000_pch_lpt_info = {
                                   | FLAG_HAS_JUMBO_FRAMES
                                   | FLAG_APME_IN_WUC,
         .flags2                 = FLAG2_HAS_PHY_STATS
-                                  | FLAG2_HAS_EEE,
+                                  | FLAG2_HAS_EEE
+                                  | FLAG2_CHECK_SYSTIM_OVERFLOW,
         .pba                    = 26,
         .max_hw_frame_size      = 9022,
         .get_variants           = e1000_get_variants_ich8lan,
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 02f443958f31..7017281ba2dc 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -4303,6 +4303,42 @@ void e1000e_reinit_locked(struct e1000_adapter *adapter)
 }
 
 /**
+ * e1000e_sanitize_systim - sanitize raw cycle counter reads
+ * @hw: pointer to the HW structure
+ * @systim: cycle_t value read, sanitized and returned
+ *
+ * Errata for 82574/82583 possible bad bits read from SYSTIMH/L:
+ * check to see that the time is incrementing at a reasonable
+ * rate and is a multiple of incvalue.
+ **/
+static cycle_t e1000e_sanitize_systim(struct e1000_hw *hw, cycle_t systim)
+{
+        u64 time_delta, rem, temp;
+        cycle_t systim_next;
+        u32 incvalue;
+        int i;
+
+        incvalue = er32(TIMINCA) & E1000_TIMINCA_INCVALUE_MASK;
+        for (i = 0; i < E1000_MAX_82574_SYSTIM_REREADS; i++) {
+                /* latch SYSTIMH on read of SYSTIML */
+                systim_next = (cycle_t)er32(SYSTIML);
+                systim_next |= (cycle_t)er32(SYSTIMH) << 32;
+
+                time_delta = systim_next - systim;
+                temp = time_delta;
+                /* VMWare users have seen incvalue of zero, don't div / 0 */
+                rem = incvalue ? do_div(temp, incvalue) : (time_delta != 0);
+
+                systim = systim_next;
+
+                if ((time_delta < E1000_82574_SYSTIM_EPSILON) && (rem == 0))
+                        break;
+        }
+
+        return systim;
+}
+
+/**
  * e1000e_cyclecounter_read - read raw cycle counter (used by time counter)
  * @cc: cyclecounter structure
  **/
@@ -4312,7 +4348,7 @@ static cycle_t e1000e_cyclecounter_read(const struct cyclecounter *cc)
                                                      cc);
         struct e1000_hw *hw = &adapter->hw;
         u32 systimel, systimeh;
-        cycle_t systim, systim_next;
+        cycle_t systim;
         /* SYSTIMH latching upon SYSTIML read does not work well.
          * This means that if SYSTIML overflows after we read it but before
          * we read SYSTIMH, the value of SYSTIMH has been incremented and we
@@ -4335,33 +4371,9 @@ static cycle_t e1000e_cyclecounter_read(const struct cyclecounter *cc)
         systim = (cycle_t)systimel;
         systim |= (cycle_t)systimeh << 32;
 
-        if ((hw->mac.type == e1000_82574) || (hw->mac.type == e1000_82583)) {
-                u64 time_delta, rem, temp;
-                u32 incvalue;
-                int i;
-
-                /* errata for 82574/82583 possible bad bits read from SYSTIMH/L
-                 * check to see that the time is incrementing at a reasonable
-                 * rate and is a multiple of incvalue
-                 */
-                incvalue = er32(TIMINCA) & E1000_TIMINCA_INCVALUE_MASK;
-                for (i = 0; i < E1000_MAX_82574_SYSTIM_REREADS; i++) {
-                        /* latch SYSTIMH on read of SYSTIML */
-                        systim_next = (cycle_t)er32(SYSTIML);
-                        systim_next |= (cycle_t)er32(SYSTIMH) << 32;
-
-                        time_delta = systim_next - systim;
-                        temp = time_delta;
-                        /* VMWare users have seen incvalue of zero, don't div / 0 */
-                        rem = incvalue ? do_div(temp, incvalue) : (time_delta != 0);
-
-                        systim = systim_next;
+        if (adapter->flags2 & FLAG2_CHECK_SYSTIM_OVERFLOW)
+                systim = e1000e_sanitize_systim(hw, systim);
 
-                        if ((time_delta < E1000_82574_SYSTIM_EPSILON) &&
-                            (rem == 0))
-                                break;
-                }
-        }
         return systim;
 }
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 81c99e1be708..c6ac7a61812f 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -4554,23 +4554,38 @@ static u8 i40e_get_iscsi_tc_map(struct i40e_pf *pf)
  **/
 static u8 i40e_dcb_get_num_tc(struct i40e_dcbx_config *dcbcfg)
 {
+        int i, tc_unused = 0;
         u8 num_tc = 0;
-        int i;
+        u8 ret = 0;
 
         /* Scan the ETS Config Priority Table to find
          * traffic class enabled for a given priority
-         * and use the traffic class index to get the
-         * number of traffic classes enabled
+         * and create a bitmask of enabled TCs
          */
-        for (i = 0; i < I40E_MAX_USER_PRIORITY; i++) {
-                if (dcbcfg->etscfg.prioritytable[i] > num_tc)
-                        num_tc = dcbcfg->etscfg.prioritytable[i];
-        }
+        for (i = 0; i < I40E_MAX_USER_PRIORITY; i++)
+                num_tc |= BIT(dcbcfg->etscfg.prioritytable[i]);
 
-        /* Traffic class index starts from zero so
-         * increment to return the actual count
+        /* Now scan the bitmask to check for
+         * contiguous TCs starting with TC0
          */
-        return num_tc + 1;
+        for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) {
+                if (num_tc & BIT(i)) {
+                        if (!tc_unused) {
+                                ret++;
+                        } else {
+                                pr_err("Non-contiguous TC - Disabling DCB\n");
+                                return 1;
+                        }
+                } else {
+                        tc_unused = 1;
+                }
+        }
+
+        /* There is always at least TC0 */
+        if (!ret)
+                ret = 1;
+
+        return ret;
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
index e61b647f5f2a..336c103ae374 100644
--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
+++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
@@ -744,7 +744,8 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter)
                 }
         }
 
-        shhwtstamps.hwtstamp = ktime_sub_ns(shhwtstamps.hwtstamp, adjust);
+        shhwtstamps.hwtstamp =
+                ktime_add_ns(shhwtstamps.hwtstamp, adjust);
 
         skb_tstamp_tx(adapter->ptp_tx_skb, &shhwtstamps);
         dev_kfree_skb_any(adapter->ptp_tx_skb);
@@ -767,13 +768,32 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector,
                          struct sk_buff *skb)
 {
         __le64 *regval = (__le64 *)va;
+        struct igb_adapter *adapter = q_vector->adapter;
+        int adjust = 0;
 
         /* The timestamp is recorded in little endian format.
          * DWORD: 0        1        2        3
          * Field: Reserved Reserved SYSTIML  SYSTIMH
          */
-        igb_ptp_systim_to_hwtstamp(q_vector->adapter, skb_hwtstamps(skb),
+        igb_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb),
                                    le64_to_cpu(regval[1]));
+
+        /* adjust timestamp for the RX latency based on link speed */
+        if (adapter->hw.mac.type == e1000_i210) {
+                switch (adapter->link_speed) {
+                case SPEED_10:
+                        adjust = IGB_I210_RX_LATENCY_10;
+                        break;
+                case SPEED_100:
+                        adjust = IGB_I210_RX_LATENCY_100;
+                        break;
+                case SPEED_1000:
+                        adjust = IGB_I210_RX_LATENCY_1000;
+                        break;
+                }
+        }
+        skb_hwtstamps(skb)->hwtstamp =
+                ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
 }
 
 /**
@@ -825,7 +845,7 @@ void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector,
                 }
         }
         skb_hwtstamps(skb)->hwtstamp =
-                ktime_add_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
+                ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
 
         /* Update the last_rx_timestamp timer in order to enable watchdog check
          * for error case of latched timestamp on a dropped packet.
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 5418c69a7463..b4f03748adc0 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4100,6 +4100,8 @@ static void ixgbe_vlan_promisc_enable(struct ixgbe_adapter *adapter)
         struct ixgbe_hw *hw = &adapter->hw;
         u32 vlnctrl, i;
 
+        vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+
         switch (hw->mac.type) {
         case ixgbe_mac_82599EB:
         case ixgbe_mac_X540:
@@ -4112,8 +4114,7 @@ static void ixgbe_vlan_promisc_enable(struct ixgbe_adapter *adapter)
                 /* fall through */
         case ixgbe_mac_82598EB:
                 /* legacy case, we can just disable VLAN filtering */
-                vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
-                vlnctrl &= ~(IXGBE_VLNCTRL_VFE | IXGBE_VLNCTRL_CFIEN);
+                vlnctrl &= ~IXGBE_VLNCTRL_VFE;
                 IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
                 return;
         }
@@ -4125,6 +4126,10 @@ static void ixgbe_vlan_promisc_enable(struct ixgbe_adapter *adapter)
         /* Set flag so we don't redo unnecessary work */
         adapter->flags2 |= IXGBE_FLAG2_VLAN_PROMISC;
 
+        /* For VMDq and SR-IOV we must leave VLAN filtering enabled */
+        vlnctrl |= IXGBE_VLNCTRL_VFE;
+        IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
+
         /* Add PF to all active pools */
         for (i = IXGBE_VLVF_ENTRIES; --i;) {
                 u32 reg_offset = IXGBE_VLVFB(i * 2 + VMDQ_P(0) / 32);
@@ -4191,6 +4196,11 @@ static void ixgbe_vlan_promisc_disable(struct ixgbe_adapter *adapter)
         struct ixgbe_hw *hw = &adapter->hw;
         u32 vlnctrl, i;
 
+        /* Set VLAN filtering to enabled */
+        vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+        vlnctrl |= IXGBE_VLNCTRL_VFE;
+        IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
+
         switch (hw->mac.type) {
         case ixgbe_mac_82599EB:
         case ixgbe_mac_X540:
@@ -4202,10 +4212,6 @@ static void ixgbe_vlan_promisc_disable(struct ixgbe_adapter *adapter)
                         break;
                 /* fall through */
         case ixgbe_mac_82598EB:
-                vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
-                vlnctrl &= ~IXGBE_VLNCTRL_CFIEN;
-                vlnctrl |= IXGBE_VLNCTRL_VFE;
-                IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
                 return;
         }
 
@@ -8390,12 +8396,14 @@ static int parse_tc_actions(struct ixgbe_adapter *adapter,
                             struct tcf_exts *exts, u64 *action, u8 *queue)
 {
         const struct tc_action *a;
+        LIST_HEAD(actions);
         int err;
 
         if (tc_no_actions(exts))
                 return -EINVAL;
 
-        tc_for_each_action(a, exts) {
+        tcf_exts_to_list(exts, &actions);
+        list_for_each_entry(a, &actions, list) {
 
                 /* Drop action */
                 if (is_tcf_gact_shot(a)) {
@@ -9517,6 +9525,7 @@ skip_sriov:
 
         /* copy netdev features into list of user selectable features */
         netdev->hw_features |= netdev->features |
+                               NETIF_F_HW_VLAN_CTAG_FILTER |
                                NETIF_F_HW_VLAN_CTAG_RX |
                                NETIF_F_HW_VLAN_CTAG_TX |
                                NETIF_F_RXALL |
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index b57ae3afb994..f1609542adf1 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -245,12 +245,16 @@ static int mtk_phy_connect(struct mtk_mac *mac)
         case PHY_INTERFACE_MODE_MII:
                 ge_mode = 1;
                 break;
-        case PHY_INTERFACE_MODE_RMII:
+        case PHY_INTERFACE_MODE_REVMII:
                 ge_mode = 2;
                 break;
+        case PHY_INTERFACE_MODE_RMII:
+                if (!mac->id)
+                        goto err_phy;
+                ge_mode = 3;
+                break;
         default:
-                dev_err(eth->dev, "invalid phy_mode\n");
-                return -1;
+                goto err_phy;
         }
 
         /* put the gmac into the right mode */
@@ -263,13 +267,25 @@ static int mtk_phy_connect(struct mtk_mac *mac)
         mac->phy_dev->autoneg = AUTONEG_ENABLE;
         mac->phy_dev->speed = 0;
         mac->phy_dev->duplex = 0;
+
+        if (of_phy_is_fixed_link(mac->of_node))
+                mac->phy_dev->supported |=
+                SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+
         mac->phy_dev->supported &= PHY_GBIT_FEATURES | SUPPORTED_Pause |
                                    SUPPORTED_Asym_Pause;
         mac->phy_dev->advertising = mac->phy_dev->supported |
                                     ADVERTISED_Autoneg;
         phy_start_aneg(mac->phy_dev);
 
+        of_node_put(np);
+
         return 0;
+
+err_phy:
+        of_node_put(np);
+        dev_err(eth->dev, "invalid phy_mode\n");
+        return -EINVAL;
 }
 
 static int mtk_mdio_init(struct mtk_eth *eth)
@@ -542,15 +558,15 @@ static inline struct mtk_tx_buf *mtk_desc_to_tx_buf(struct mtk_tx_ring *ring,
         return &ring->buf[idx];
 }
 
-static void mtk_tx_unmap(struct device *dev, struct mtk_tx_buf *tx_buf)
+static void mtk_tx_unmap(struct mtk_eth *eth, struct mtk_tx_buf *tx_buf)
 {
         if (tx_buf->flags & MTK_TX_FLAGS_SINGLE0) {
-                dma_unmap_single(dev,
+                dma_unmap_single(eth->dev,
                                  dma_unmap_addr(tx_buf, dma_addr0),
                                  dma_unmap_len(tx_buf, dma_len0),
                                  DMA_TO_DEVICE);
         } else if (tx_buf->flags & MTK_TX_FLAGS_PAGE0) {
-                dma_unmap_page(dev,
+                dma_unmap_page(eth->dev,
                                dma_unmap_addr(tx_buf, dma_addr0),
                                dma_unmap_len(tx_buf, dma_len0),
                                DMA_TO_DEVICE);
@@ -595,9 +611,9 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
         if (skb_vlan_tag_present(skb))
                 txd4 |= TX_DMA_INS_VLAN | skb_vlan_tag_get(skb);
 
-        mapped_addr = dma_map_single(&dev->dev, skb->data,
+        mapped_addr = dma_map_single(eth->dev, skb->data,
                                      skb_headlen(skb), DMA_TO_DEVICE);
-        if (unlikely(dma_mapping_error(&dev->dev, mapped_addr)))
+        if (unlikely(dma_mapping_error(eth->dev, mapped_addr)))
                 return -ENOMEM;
 
         WRITE_ONCE(itxd->txd1, mapped_addr);
@@ -623,10 +639,10 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
 
                         n_desc++;
                         frag_map_size = min(frag_size, MTK_TX_DMA_BUF_LEN);
-                        mapped_addr = skb_frag_dma_map(&dev->dev, frag, offset,
+                        mapped_addr = skb_frag_dma_map(eth->dev, frag, offset,
                                                        frag_map_size,
                                                        DMA_TO_DEVICE);
-                        if (unlikely(dma_mapping_error(&dev->dev, mapped_addr)))
+                        if (unlikely(dma_mapping_error(eth->dev, mapped_addr)))
                                 goto err_dma;
 
                         if (i == nr_frags - 1 &&
@@ -679,7 +695,7 @@ err_dma:
                 tx_buf = mtk_desc_to_tx_buf(ring, itxd);
 
                 /* unmap dma */
-                mtk_tx_unmap(&dev->dev, tx_buf);
+                mtk_tx_unmap(eth, tx_buf);
 
                 itxd->txd3 = TX_DMA_LS0 | TX_DMA_OWNER_CPU;
                 itxd = mtk_qdma_phys_to_virt(ring, itxd->txd2);
@@ -836,11 +852,11 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                         netdev->stats.rx_dropped++;
                         goto release_desc;
                 }
-                dma_addr = dma_map_single(&eth->netdev[mac]->dev,
+                dma_addr = dma_map_single(eth->dev,
                                           new_data + NET_SKB_PAD,
                                           ring->buf_size,
                                           DMA_FROM_DEVICE);
-                if (unlikely(dma_mapping_error(&netdev->dev, dma_addr))) {
+                if (unlikely(dma_mapping_error(eth->dev, dma_addr))) {
                         skb_free_frag(new_data);
                         netdev->stats.rx_dropped++;
                         goto release_desc;
@@ -855,7 +871,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                 }
                 skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);
 
-                dma_unmap_single(&netdev->dev, trxd.rxd1,
+                dma_unmap_single(eth->dev, trxd.rxd1,
                                  ring->buf_size, DMA_FROM_DEVICE);
                 pktlen = RX_DMA_GET_PLEN0(trxd.rxd2);
                 skb->dev = netdev;
@@ -937,7 +953,7 @@ static int mtk_poll_tx(struct mtk_eth *eth, int budget)
                         done[mac]++;
                         budget--;
                 }
-                mtk_tx_unmap(eth->dev, tx_buf);
+                mtk_tx_unmap(eth, tx_buf);
 
                 ring->last_free = desc;
                 atomic_inc(&ring->free_count);
@@ -1092,7 +1108,7 @@ static void mtk_tx_clean(struct mtk_eth *eth)
 
         if (ring->buf) {
                 for (i = 0; i < MTK_DMA_SIZE; i++)
-                        mtk_tx_unmap(eth->dev, &ring->buf[i]);
+                        mtk_tx_unmap(eth, &ring->buf[i]);
                 kfree(ring->buf);
                 ring->buf = NULL;
         }
@@ -1751,6 +1767,7 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
                 goto free_netdev;
         }
         spin_lock_init(&mac->hw_stats->stats_lock);
+        u64_stats_init(&mac->hw_stats->syncp);
         mac->hw_stats->reg_offset = id * MTK_STAT_OFFSET;
 
         SET_NETDEV_DEV(eth->netdev[id], eth->dev);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 0f19b01e3fff..dc8b1cb0fdc8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -318,6 +318,7 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 u32 *action, u32 *flow_tag)
 {
         const struct tc_action *a;
+        LIST_HEAD(actions);
 
         if (tc_no_actions(exts))
                 return -EINVAL;
@@ -325,7 +326,8 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
         *flow_tag = MLX5_FS_DEFAULT_FLOW_TAG;
         *action = 0;
 
-        tc_for_each_action(a, exts) {
+        tcf_exts_to_list(exts, &actions);
+        list_for_each_entry(a, &actions, list) {
                 /* Only support a single action per rule */
                 if (*action)
                         return -EINVAL;
@@ -362,13 +364,15 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 u32 *action, u32 *dest_vport)
 {
         const struct tc_action *a;
+        LIST_HEAD(actions);
 
         if (tc_no_actions(exts))
                 return -EINVAL;
 
         *action = 0;
 
-        tc_for_each_action(a, exts) {
+        tcf_exts_to_list(exts, &actions);
+        list_for_each_entry(a, &actions, list) {
                 /* Only support a single action per rule */
                 if (*action)
                         return -EINVAL;
@@ -503,6 +507,7 @@ int mlx5e_stats_flower(struct mlx5e_priv *priv,
         struct mlx5e_tc_flow *flow;
         struct tc_action *a;
         struct mlx5_fc *counter;
+        LIST_HEAD(actions);
         u64 bytes;
         u64 packets;
         u64 lastuse;
@@ -518,7 +523,8 @@ int mlx5e_stats_flower(struct mlx5e_priv *priv,
 
         mlx5_fc_query_cached(counter, &bytes, &packets, &lastuse);
 
-        tc_for_each_action(a, f->exts)
+        tcf_exts_to_list(f->exts, &actions);
+        list_for_each_entry(a, &actions, list)
                 tcf_action_stats_update(a, bytes, packets, lastuse);
 
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
index 7ca9201f7dcb..1721098eef13 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -3383,6 +3383,15 @@ MLXSW_ITEM32(reg, ritr, ipv4_fe, 0x04, 29, 1);
  */
 MLXSW_ITEM32(reg, ritr, ipv6_fe, 0x04, 28, 1);
 
+/* reg_ritr_lb_en
+ * Loop-back filter enable for unicast packets.
+ * If the flag is set then loop-back filter for unicast packets is
+ * implemented on the RIF. Multicast packets are always subject to
+ * loop-back filtering.
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, ritr, lb_en, 0x04, 24, 1);
+
 /* reg_ritr_virtual_router
  * Virtual router ID associated with the router interface.
  * Access: RW
@@ -3484,6 +3493,7 @@ static inline void mlxsw_reg_ritr_pack(char *payload, bool enable,
         mlxsw_reg_ritr_op_set(payload, op);
         mlxsw_reg_ritr_rif_set(payload, rif);
         mlxsw_reg_ritr_ipv4_fe_set(payload, 1);
+        mlxsw_reg_ritr_lb_en_set(payload, 1);
         mlxsw_reg_ritr_mtu_set(payload, mtu);
         mlxsw_reg_ritr_if_mac_memcpy_to(payload, mac);
 }
@@ -4000,6 +4010,7 @@ static inline void mlxsw_reg_ralue_pack(char *payload,
 {
         MLXSW_REG_ZERO(ralue, payload);
         mlxsw_reg_ralue_protocol_set(payload, protocol);
+        mlxsw_reg_ralue_op_set(payload, op);
         mlxsw_reg_ralue_virtual_router_set(payload, virtual_router);
         mlxsw_reg_ralue_prefix_len_set(payload, prefix_len);
         mlxsw_reg_ralue_entry_type_set(payload,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index c3e61500819d..1f8168906811 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -942,8 +942,8 @@ static void mlxsw_sp_port_vport_destroy(struct mlxsw_sp_port *mlxsw_sp_vport)
         kfree(mlxsw_sp_vport);
 }
 
-int mlxsw_sp_port_add_vid(struct net_device *dev, __be16 __always_unused proto,
-                          u16 vid)
+static int mlxsw_sp_port_add_vid(struct net_device *dev,
+                                 __be16 __always_unused proto, u16 vid)
 {
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
         struct mlxsw_sp_port *mlxsw_sp_vport;
@@ -956,16 +956,12 @@ int mlxsw_sp_port_add_vid(struct net_device *dev, __be16 __always_unused proto,
         if (!vid)
                 return 0;
 
-        if (mlxsw_sp_port_vport_find(mlxsw_sp_port, vid)) {
-                netdev_warn(dev, "VID=%d already configured\n", vid);
+        if (mlxsw_sp_port_vport_find(mlxsw_sp_port, vid))
                 return 0;
-        }
 
         mlxsw_sp_vport = mlxsw_sp_port_vport_create(mlxsw_sp_port, vid);
-        if (!mlxsw_sp_vport) {
-                netdev_err(dev, "Failed to create vPort for VID=%d\n", vid);
+        if (!mlxsw_sp_vport)
                 return -ENOMEM;
-        }
 
         /* When adding the first VLAN interface on a bridged port we need to
          * transition all the active 802.1Q bridge VLANs to use explicit
@@ -973,24 +969,17 @@ int mlxsw_sp_port_add_vid(struct net_device *dev, __be16 __always_unused proto,
          */
         if (list_is_singular(&mlxsw_sp_port->vports_list)) {
                 err = mlxsw_sp_port_vp_mode_trans(mlxsw_sp_port);
-                if (err) {
-                        netdev_err(dev, "Failed to set to Virtual mode\n");
+                if (err)
                         goto err_port_vp_mode_trans;
-                }
         }
 
         err = mlxsw_sp_port_vid_learning_set(mlxsw_sp_vport, vid, false);
-        if (err) {
-                netdev_err(dev, "Failed to disable learning for VID=%d\n", vid);
+        if (err)
                 goto err_port_vid_learning_set;
-        }
 
         err = mlxsw_sp_port_vlan_set(mlxsw_sp_vport, vid, vid, true, untagged);
-        if (err) {
-                netdev_err(dev, "Failed to set VLAN membership for VID=%d\n",
-                           vid);
+        if (err)
                 goto err_port_add_vid;
-        }
 
         return 0;
 
@@ -1010,7 +999,6 @@ static int mlxsw_sp_port_kill_vid(struct net_device *dev,
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
         struct mlxsw_sp_port *mlxsw_sp_vport;
         struct mlxsw_sp_fid *f;
-        int err;
 
         /* VLAN 0 is removed from HW filter when device goes down, but
          * it is reserved in our case, so simply return.
@@ -1019,23 +1007,12 @@ static int mlxsw_sp_port_kill_vid(struct net_device *dev,
                 return 0;
 
         mlxsw_sp_vport = mlxsw_sp_port_vport_find(mlxsw_sp_port, vid);
-        if (!mlxsw_sp_vport) {
-                netdev_warn(dev, "VID=%d does not exist\n", vid);
+        if (WARN_ON(!mlxsw_sp_vport))
                 return 0;
-        }
 
-        err = mlxsw_sp_port_vlan_set(mlxsw_sp_vport, vid, vid, false, false);
-        if (err) {
-                netdev_err(dev, "Failed to set VLAN membership for VID=%d\n",
-                           vid);
-                return err;
-        }
+        mlxsw_sp_port_vlan_set(mlxsw_sp_vport, vid, vid, false, false);
 
-        err = mlxsw_sp_port_vid_learning_set(mlxsw_sp_vport, vid, true);
-        if (err) {
-                netdev_err(dev, "Failed to enable learning for VID=%d\n", vid);
-                return err;
-        }
+        mlxsw_sp_port_vid_learning_set(mlxsw_sp_vport, vid, true);
 
         /* Drop FID reference. If this was the last reference the
          * resources will be freed.
@@ -1048,13 +1025,8 @@ static int mlxsw_sp_port_kill_vid(struct net_device *dev,
          * transition all active 802.1Q bridge VLANs to use VID to FID
          * mappings and set port's mode to VLAN mode.
          */
-        if (list_is_singular(&mlxsw_sp_port->vports_list)) {
-                err = mlxsw_sp_port_vlan_mode_trans(mlxsw_sp_port);
-                if (err) {
-                        netdev_err(dev, "Failed to set to VLAN mode\n");
-                        return err;
-                }
-        }
+        if (list_is_singular(&mlxsw_sp_port->vports_list))
+                mlxsw_sp_port_vlan_mode_trans(mlxsw_sp_port);
 
         mlxsw_sp_port_vport_destroy(mlxsw_sp_vport);
 
@@ -1149,6 +1121,7 @@ static int mlxsw_sp_port_add_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port,
                                           bool ingress)
 {
         const struct tc_action *a;
+        LIST_HEAD(actions);
         int err;
 
         if (!tc_single_action(cls->exts)) {
@@ -1156,7 +1129,8 @@ static int mlxsw_sp_port_add_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port,
                 return -ENOTSUPP;
         }
 
-        tc_for_each_action(a, cls->exts) {
+        tcf_exts_to_list(cls->exts, &actions);
+        list_for_each_entry(a, &actions, list) {
                 if (!is_tcf_mirred_mirror(a) || protocol != htons(ETH_P_ALL))
                         return -ENOTSUPP;
 
@@ -2076,6 +2050,18 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
         return 0;
 }
 
+static int mlxsw_sp_port_pvid_vport_create(struct mlxsw_sp_port *mlxsw_sp_port)
+{
+        mlxsw_sp_port->pvid = 1;
+
+        return mlxsw_sp_port_add_vid(mlxsw_sp_port->dev, 0, 1);
+}
+
+static int mlxsw_sp_port_pvid_vport_destroy(struct mlxsw_sp_port *mlxsw_sp_port)
+{
+        return mlxsw_sp_port_kill_vid(mlxsw_sp_port->dev, 0, 1);
+}
+
 static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                                 bool split, u8 module, u8 width, u8 lane)
 {
@@ -2191,7 +2177,15 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                 goto err_port_dcb_init;
         }
 
+        err = mlxsw_sp_port_pvid_vport_create(mlxsw_sp_port);
+        if (err) {
+                dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to create PVID vPort\n",
+                        mlxsw_sp_port->local_port);
+                goto err_port_pvid_vport_create;
+        }
+
         mlxsw_sp_port_switchdev_init(mlxsw_sp_port);
+        mlxsw_sp->ports[local_port] = mlxsw_sp_port;
         err = register_netdev(dev);
         if (err) {
                 dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to register netdev\n",
@@ -2208,24 +2202,23 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                 goto err_core_port_init;
         }
 
-        err = mlxsw_sp_port_vlan_init(mlxsw_sp_port);
-        if (err)
-                goto err_port_vlan_init;
-
-        mlxsw_sp->ports[local_port] = mlxsw_sp_port;
         return 0;
 
-err_port_vlan_init:
-        mlxsw_core_port_fini(&mlxsw_sp_port->core_port);
 err_core_port_init:
         unregister_netdev(dev);
 err_register_netdev:
+        mlxsw_sp->ports[local_port] = NULL;
+        mlxsw_sp_port_switchdev_fini(mlxsw_sp_port);
+        mlxsw_sp_port_pvid_vport_destroy(mlxsw_sp_port);
+err_port_pvid_vport_create:
+        mlxsw_sp_port_dcb_fini(mlxsw_sp_port);
 err_port_dcb_init:
 err_port_ets_init:
 err_port_buffers_init:
 err_port_admin_status_set:
 err_port_mtu_set:
 err_port_speed_by_width_set:
+        mlxsw_sp_port_swid_set(mlxsw_sp_port, MLXSW_PORT_SWID_DISABLED_PORT);
 err_port_swid_set:
 err_port_system_port_mapping_set:
 err_dev_addr_init:
@@ -2245,12 +2238,12 @@ static void mlxsw_sp_port_remove(struct mlxsw_sp *mlxsw_sp, u8 local_port)
 
         if (!mlxsw_sp_port)
                 return;
-        mlxsw_sp->ports[local_port] = NULL;
         mlxsw_core_port_fini(&mlxsw_sp_port->core_port);
         unregister_netdev(mlxsw_sp_port->dev); /* This calls ndo_stop */
-        mlxsw_sp_port_dcb_fini(mlxsw_sp_port);
-        mlxsw_sp_port_kill_vid(mlxsw_sp_port->dev, 0, 1);
+        mlxsw_sp->ports[local_port] = NULL;
         mlxsw_sp_port_switchdev_fini(mlxsw_sp_port);
+        mlxsw_sp_port_pvid_vport_destroy(mlxsw_sp_port);
+        mlxsw_sp_port_dcb_fini(mlxsw_sp_port);
         mlxsw_sp_port_swid_set(mlxsw_sp_port, MLXSW_PORT_SWID_DISABLED_PORT);
         mlxsw_sp_port_module_unmap(mlxsw_sp, mlxsw_sp_port->local_port);
         free_percpu(mlxsw_sp_port->pcpu_stats);
@@ -2662,6 +2655,26 @@ static const struct mlxsw_rx_listener mlxsw_sp_rx_listener[] = {
         {
                 .func = mlxsw_sp_rx_listener_func,
                 .local_port = MLXSW_PORT_DONT_CARE,
+                .trap_id = MLXSW_TRAP_ID_MTUERROR,
+        },
+        {
+                .func = mlxsw_sp_rx_listener_func,
+                .local_port = MLXSW_PORT_DONT_CARE,
+                .trap_id = MLXSW_TRAP_ID_TTLERROR,
+        },
+        {
+                .func = mlxsw_sp_rx_listener_func,
+                .local_port = MLXSW_PORT_DONT_CARE,
+                .trap_id = MLXSW_TRAP_ID_LBERROR,
+        },
+        {
+                .func = mlxsw_sp_rx_listener_func,
+                .local_port = MLXSW_PORT_DONT_CARE,
+                .trap_id = MLXSW_TRAP_ID_OSPF,
+        },
+        {
+                .func = mlxsw_sp_rx_listener_func,
+                .local_port = MLXSW_PORT_DONT_CARE,
                 .trap_id = MLXSW_TRAP_ID_IP2ME,
         },
         {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index f69aa37d1521..ab3feb81bd43 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -536,8 +536,6 @@ int mlxsw_sp_port_vid_to_fid_set(struct mlxsw_sp_port *mlxsw_sp_port,
                                  u16 vid);
 int mlxsw_sp_port_vlan_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid_begin,
                            u16 vid_end, bool is_member, bool untagged);
-int mlxsw_sp_port_add_vid(struct net_device *dev, __be16 __always_unused proto,
-                          u16 vid);
 int mlxsw_sp_vport_flood_set(struct mlxsw_sp_port *mlxsw_sp_vport, u16 fid,
                              bool set);
 void mlxsw_sp_port_active_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
index 074cdda7b6f3..237418a0e6e0 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -330,7 +330,7 @@ static const struct mlxsw_sp_sb_cm mlxsw_sp_cpu_port_sb_cms[] = {
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_CPU_PORT_SB_CM,
+        MLXSW_SP_SB_CM(MLXSW_SP_BYTES_TO_CELLS(10000), 0, 0),
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
index 01cfb7512827..b6ed7f7c531e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
@@ -341,6 +341,8 @@ static int mlxsw_sp_port_pfc_set(struct mlxsw_sp_port *mlxsw_sp_port,
         char pfcc_pl[MLXSW_REG_PFCC_LEN];
 
         mlxsw_reg_pfcc_pack(pfcc_pl, mlxsw_sp_port->local_port);
+        mlxsw_reg_pfcc_pprx_set(pfcc_pl, mlxsw_sp_port->link.rx_pause);
+        mlxsw_reg_pfcc_pptx_set(pfcc_pl, mlxsw_sp_port->link.tx_pause);
         mlxsw_reg_pfcc_prio_pack(pfcc_pl, pfc->pfc_en);
 
         return mlxsw_reg_write(mlxsw_sp_port->mlxsw_sp->core, MLXSW_REG(pfcc),
@@ -351,17 +353,17 @@ static int mlxsw_sp_dcbnl_ieee_setpfc(struct net_device *dev,
                                       struct ieee_pfc *pfc)
 {
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
+        bool pause_en = mlxsw_sp_port_is_pause_en(mlxsw_sp_port);
         int err;
 
-        if ((mlxsw_sp_port->link.tx_pause || mlxsw_sp_port->link.rx_pause) &&
-            pfc->pfc_en) {
+        if (pause_en && pfc->pfc_en) {
                 netdev_err(dev, "PAUSE frames already enabled on port\n");
                 return -EINVAL;
         }
 
         err = __mlxsw_sp_port_headroom_set(mlxsw_sp_port, dev->mtu,
                                            mlxsw_sp_port->dcb.ets->prio_tc,
-                                           false, pfc);
+                                           pause_en, pfc);
         if (err) {
                 netdev_err(dev, "Failed to configure port's headroom for PFC\n");
                 return err;
@@ -380,7 +382,7 @@ static int mlxsw_sp_dcbnl_ieee_setpfc(struct net_device *dev,
 
 err_port_pfc_set:
         __mlxsw_sp_port_headroom_set(mlxsw_sp_port, dev->mtu,
-                                     mlxsw_sp_port->dcb.ets->prio_tc, false,
+                                     mlxsw_sp_port->dcb.ets->prio_tc, pause_en,
                                      mlxsw_sp_port->dcb.pfc);
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 81418d629231..90bb93b037ec 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -1651,9 +1651,10 @@ static void mlxsw_sp_router_fib4_add_info_destroy(void const *data)
         const struct mlxsw_sp_router_fib4_add_info *info = data;
         struct mlxsw_sp_fib_entry *fib_entry = info->fib_entry;
         struct mlxsw_sp *mlxsw_sp = info->mlxsw_sp;
+        struct mlxsw_sp_vr *vr = fib_entry->vr;
 
         mlxsw_sp_fib_entry_destroy(fib_entry);
-        mlxsw_sp_vr_put(mlxsw_sp, fib_entry->vr);
+        mlxsw_sp_vr_put(mlxsw_sp, vr);
         kfree(info);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index a1ad5e6bdfa8..d1b59cdfacc1 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -450,6 +450,8 @@ void mlxsw_sp_fid_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_fid *f)
 
         kfree(f);
 
+        mlxsw_sp_fid_map(mlxsw_sp, fid, false);
+
         mlxsw_sp_fid_op(mlxsw_sp, fid, false);
 }
 
@@ -997,13 +999,13 @@ static int mlxsw_sp_port_obj_add(struct net_device *dev,
 }
 
 static int __mlxsw_sp_port_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port,
-                                     u16 vid_begin, u16 vid_end, bool init)
+                                     u16 vid_begin, u16 vid_end)
 {
         struct net_device *dev = mlxsw_sp_port->dev;
         u16 vid, pvid;
         int err;
 
-        if (!init && !mlxsw_sp_port->bridged)
+        if (!mlxsw_sp_port->bridged)
                 return -EINVAL;
 
         err = __mlxsw_sp_port_vlans_set(mlxsw_sp_port, vid_begin, vid_end,
@@ -1014,9 +1016,6 @@ static int __mlxsw_sp_port_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port,
                 return err;
         }
 
-        if (init)
-                goto out;
-
         pvid = mlxsw_sp_port->pvid;
         if (pvid >= vid_begin && pvid <= vid_end) {
                 err = mlxsw_sp_port_pvid_set(mlxsw_sp_port, 0);
@@ -1028,7 +1027,6 @@ static int __mlxsw_sp_port_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port,
 
         mlxsw_sp_port_fid_leave(mlxsw_sp_port, vid_begin, vid_end);
 
-out:
         /* Changing activity bits only if HW operation succeded */
         for (vid = vid_begin; vid <= vid_end; vid++)
                 clear_bit(vid, mlxsw_sp_port->active_vlans);
@@ -1039,8 +1037,8 @@ out:
 static int mlxsw_sp_port_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port,
                                    const struct switchdev_obj_port_vlan *vlan)
 {
-        return __mlxsw_sp_port_vlans_del(mlxsw_sp_port,
-                                         vlan->vid_begin, vlan->vid_end, false);
+        return __mlxsw_sp_port_vlans_del(mlxsw_sp_port, vlan->vid_begin,
+                                         vlan->vid_end);
 }
 
 void mlxsw_sp_port_active_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port)
@@ -1048,7 +1046,7 @@ void mlxsw_sp_port_active_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port)
         u16 vid;
 
         for_each_set_bit(vid, mlxsw_sp_port->active_vlans, VLAN_N_VID)
-                __mlxsw_sp_port_vlans_del(mlxsw_sp_port, vid, vid, false);
+                __mlxsw_sp_port_vlans_del(mlxsw_sp_port, vid, vid);
 }
 
 static int
@@ -1546,32 +1544,6 @@ void mlxsw_sp_switchdev_fini(struct mlxsw_sp *mlxsw_sp)
         mlxsw_sp_fdb_fini(mlxsw_sp);
 }
 
-int mlxsw_sp_port_vlan_init(struct mlxsw_sp_port *mlxsw_sp_port)
-{
-        struct net_device *dev = mlxsw_sp_port->dev;
-        int err;
-
-        /* Allow only untagged packets to ingress and tag them internally
-         * with VID 1.
-         */
-        mlxsw_sp_port->pvid = 1;
-        err = __mlxsw_sp_port_vlans_del(mlxsw_sp_port, 0, VLAN_N_VID - 1,
-                                        true);
-        if (err) {
-                netdev_err(dev, "Unable to init VLANs\n");
-                return err;
-        }
-
-        /* Add implicit VLAN interface in the device, so that untagged
-         * packets will be classified to the default vFID.
-         */
-        err = mlxsw_sp_port_add_vid(dev, 0, 1);
-        if (err)
-                netdev_err(dev, "Failed to configure default vFID\n");
-
-        return err;
-}
-
 void mlxsw_sp_port_switchdev_init(struct mlxsw_sp_port *mlxsw_sp_port)
 {
         mlxsw_sp_port->dev->switchdev_ops = &mlxsw_sp_port_switchdev_ops;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/trap.h b/drivers/net/ethernet/mellanox/mlxsw/trap.h
index 470d7696e9fe..ed8e30186400 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/trap.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/trap.h
@@ -56,6 +56,10 @@ enum {
         MLXSW_TRAP_ID_IGMP_V3_REPORT = 0x34,
         MLXSW_TRAP_ID_ARPBC = 0x50,
         MLXSW_TRAP_ID_ARPUC = 0x51,
+        MLXSW_TRAP_ID_MTUERROR = 0x52,
+        MLXSW_TRAP_ID_TTLERROR = 0x53,
+        MLXSW_TRAP_ID_LBERROR = 0x54,
+        MLXSW_TRAP_ID_OSPF = 0x55,
         MLXSW_TRAP_ID_IP2ME = 0x5F,
         MLXSW_TRAP_ID_RTR_INGRESS0 = 0x70,
         MLXSW_TRAP_ID_HOST_MISS_IPV4 = 0x90,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index d0dc28f93c0e..226cb08cc055 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -52,40 +52,94 @@ static bool qed_dcbx_app_ethtype(u32 app_info_bitmap)
                   DCBX_APP_SF_ETHTYPE);
 }
 
+static bool qed_dcbx_ieee_app_ethtype(u32 app_info_bitmap)
+{
+        u8 mfw_val = QED_MFW_GET_FIELD(app_info_bitmap, DCBX_APP_SF_IEEE);
+
+        /* Old MFW */
+        if (mfw_val == DCBX_APP_SF_IEEE_RESERVED)
+                return qed_dcbx_app_ethtype(app_info_bitmap);
+
+        return !!(mfw_val == DCBX_APP_SF_IEEE_ETHTYPE);
+}
+
 static bool qed_dcbx_app_port(u32 app_info_bitmap)
 {
         return !!(QED_MFW_GET_FIELD(app_info_bitmap, DCBX_APP_SF) ==
                   DCBX_APP_SF_PORT);
 }
 
-static bool qed_dcbx_default_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_ieee_app_port(u32 app_info_bitmap, u8 type)
 {
-        return !!(qed_dcbx_app_ethtype(app_info_bitmap) &&
-                  proto_id == QED_ETH_TYPE_DEFAULT);
+        u8 mfw_val = QED_MFW_GET_FIELD(app_info_bitmap, DCBX_APP_SF_IEEE);
+
+        /* Old MFW */
+        if (mfw_val == DCBX_APP_SF_IEEE_RESERVED)
+                return qed_dcbx_app_port(app_info_bitmap);
+
+        return !!(mfw_val == type || mfw_val == DCBX_APP_SF_IEEE_TCP_UDP_PORT);
 }
 
-static bool qed_dcbx_iscsi_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_default_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
 {
-        return !!(qed_dcbx_app_port(app_info_bitmap) &&
-                  proto_id == QED_TCP_PORT_ISCSI);
+        bool ethtype;
+
+        if (ieee)
+                ethtype = qed_dcbx_ieee_app_ethtype(app_info_bitmap);
+        else
+                ethtype = qed_dcbx_app_ethtype(app_info_bitmap);
+
+        return !!(ethtype && (proto_id == QED_ETH_TYPE_DEFAULT));
 }
 
-static bool qed_dcbx_fcoe_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_iscsi_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
 {
-        return !!(qed_dcbx_app_ethtype(app_info_bitmap) &&
-                  proto_id == QED_ETH_TYPE_FCOE);
+        bool port;
+
+        if (ieee)
+                port = qed_dcbx_ieee_app_port(app_info_bitmap,
+                                              DCBX_APP_SF_IEEE_TCP_PORT);
+        else
+                port = qed_dcbx_app_port(app_info_bitmap);
+
+        return !!(port && (proto_id == QED_TCP_PORT_ISCSI));
 }
 
-static bool qed_dcbx_roce_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_fcoe_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
 {
-        return !!(qed_dcbx_app_ethtype(app_info_bitmap) &&
-                  proto_id == QED_ETH_TYPE_ROCE);
+        bool ethtype;
+
+        if (ieee)
+                ethtype = qed_dcbx_ieee_app_ethtype(app_info_bitmap);
+        else
+                ethtype = qed_dcbx_app_ethtype(app_info_bitmap);
+
+        return !!(ethtype && (proto_id == QED_ETH_TYPE_FCOE));
 }
 
-static bool qed_dcbx_roce_v2_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_roce_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
 {
-        return !!(qed_dcbx_app_port(app_info_bitmap) &&
-                  proto_id == QED_UDP_PORT_TYPE_ROCE_V2);
+        bool ethtype;
+
+        if (ieee)
+                ethtype = qed_dcbx_ieee_app_ethtype(app_info_bitmap);
+        else
+                ethtype = qed_dcbx_app_ethtype(app_info_bitmap);
+
+        return !!(ethtype && (proto_id == QED_ETH_TYPE_ROCE));
+}
+
+static bool qed_dcbx_roce_v2_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
+{
+        bool port;
+
+        if (ieee)
+                port = qed_dcbx_ieee_app_port(app_info_bitmap,
+                                              DCBX_APP_SF_IEEE_UDP_PORT);
+        else
+                port = qed_dcbx_app_port(app_info_bitmap);
+
+        return !!(port && (proto_id == QED_UDP_PORT_TYPE_ROCE_V2));
 }
 
 static void
@@ -164,17 +218,17 @@ qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
 static bool
 qed_dcbx_get_app_protocol_type(struct qed_hwfn *p_hwfn,
                                u32 app_prio_bitmap,
-                               u16 id, enum dcbx_protocol_type *type)
+                               u16 id, enum dcbx_protocol_type *type, bool ieee)
 {
-        if (qed_dcbx_fcoe_tlv(app_prio_bitmap, id)) {
+        if (qed_dcbx_fcoe_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_FCOE;
-        } else if (qed_dcbx_roce_tlv(app_prio_bitmap, id)) {
+        } else if (qed_dcbx_roce_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_ROCE;
-        } else if (qed_dcbx_iscsi_tlv(app_prio_bitmap, id)) {
+        } else if (qed_dcbx_iscsi_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_ISCSI;
-        } else if (qed_dcbx_default_tlv(app_prio_bitmap, id)) {
+        } else if (qed_dcbx_default_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_ETH;
-        } else if (qed_dcbx_roce_v2_tlv(app_prio_bitmap, id)) {
+        } else if (qed_dcbx_roce_v2_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_ROCE_V2;
         } else {
                 *type = DCBX_MAX_PROTOCOL_TYPE;
@@ -194,17 +248,18 @@ static int
 qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
                      struct qed_dcbx_results *p_data,
                      struct dcbx_app_priority_entry *p_tbl,
-                     u32 pri_tc_tbl, int count, bool dcbx_enabled)
+                     u32 pri_tc_tbl, int count, u8 dcbx_version)
 {
         u8 tc, priority_map;
         enum dcbx_protocol_type type;
+        bool enable, ieee;
         u16 protocol_id;
         int priority;
-        bool enable;
         int i;
 
         DP_VERBOSE(p_hwfn, QED_MSG_DCB, "Num APP entries = %d\n", count);
 
+        ieee = (dcbx_version == DCBX_CONFIG_VERSION_IEEE);
         /* Parse APP TLV */
         for (i = 0; i < count; i++) {
                 protocol_id = QED_MFW_GET_FIELD(p_tbl[i].entry,
@@ -219,7 +274,7 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
 
                 tc = QED_DCBX_PRIO2TC(pri_tc_tbl, priority);
                 if (qed_dcbx_get_app_protocol_type(p_hwfn, p_tbl[i].entry,
-                                                   protocol_id, &type)) {
+                                                   protocol_id, &type, ieee)) {
                         /* ETH always have the enable bit reset, as it gets
                          * vlan information per packet. For other protocols,
                          * should be set according to the dcbx_enabled
@@ -275,15 +330,12 @@ static int qed_dcbx_process_mib_info(struct qed_hwfn *p_hwfn)
         struct dcbx_ets_feature *p_ets;
         struct qed_hw_info *p_info;
         u32 pri_tc_tbl, flags;
-        bool dcbx_enabled;
+        u8 dcbx_version;
         int num_entries;
         int rc = 0;
 
-        /* If DCBx version is non zero, then negotiation was
-         * successfuly performed
-         */
         flags = p_hwfn->p_dcbx_info->operational.flags;
-        dcbx_enabled = !!QED_MFW_GET_FIELD(flags, DCBX_CONFIG_VERSION);
+        dcbx_version = QED_MFW_GET_FIELD(flags, DCBX_CONFIG_VERSION);
 
         p_app = &p_hwfn->p_dcbx_info->operational.features.app;
         p_tbl = p_app->app_pri_tbl;
@@ -295,13 +347,13 @@ static int qed_dcbx_process_mib_info(struct qed_hwfn *p_hwfn)
         num_entries = QED_MFW_GET_FIELD(p_app->flags, DCBX_APP_NUM_ENTRIES);
 
         rc = qed_dcbx_process_tlv(p_hwfn, &data, p_tbl, pri_tc_tbl,
-                                  num_entries, dcbx_enabled);
+                                  num_entries, dcbx_version);
         if (rc)
                 return rc;
 
         p_info->num_tc = QED_MFW_GET_FIELD(p_ets->flags, DCBX_ETS_MAX_TCS);
         data.pf_id = p_hwfn->rel_pf_id;
-        data.dcbx_enabled = dcbx_enabled;
+        data.dcbx_enabled = !!dcbx_version;
 
         qed_dcbx_dp_protocol(p_hwfn, &data);
 
@@ -400,7 +452,7 @@ static void
 qed_dcbx_get_app_data(struct qed_hwfn *p_hwfn,
                       struct dcbx_app_priority_feature *p_app,
                       struct dcbx_app_priority_entry *p_tbl,
-                      struct qed_dcbx_params *p_params)
+                      struct qed_dcbx_params *p_params, bool ieee)
 {
         struct qed_app_entry *entry;
         u8 pri_map;
@@ -414,15 +466,46 @@ qed_dcbx_get_app_data(struct qed_hwfn *p_hwfn,
                                                       DCBX_APP_NUM_ENTRIES);
         for (i = 0; i < DCBX_MAX_APP_PROTOCOL; i++) {
                 entry = &p_params->app_entry[i];
-                entry->ethtype = !(QED_MFW_GET_FIELD(p_tbl[i].entry,
-                                                     DCBX_APP_SF));
+                if (ieee) {
+                        u8 sf_ieee;
+                        u32 val;
+
+                        sf_ieee = QED_MFW_GET_FIELD(p_tbl[i].entry,
+                                                    DCBX_APP_SF_IEEE);
+                        switch (sf_ieee) {
+                        case DCBX_APP_SF_IEEE_RESERVED:
+                                /* Old MFW */
+                                val = QED_MFW_GET_FIELD(p_tbl[i].entry,
+                                                        DCBX_APP_SF);
+                                entry->sf_ieee = val ?
+                                    QED_DCBX_SF_IEEE_TCP_UDP_PORT :
+                                    QED_DCBX_SF_IEEE_ETHTYPE;
+                                break;
+                        case DCBX_APP_SF_IEEE_ETHTYPE:
+                                entry->sf_ieee = QED_DCBX_SF_IEEE_ETHTYPE;
+                                break;
+                        case DCBX_APP_SF_IEEE_TCP_PORT:
+                                entry->sf_ieee = QED_DCBX_SF_IEEE_TCP_PORT;
+                                break;
+                        case DCBX_APP_SF_IEEE_UDP_PORT:
+                                entry->sf_ieee = QED_DCBX_SF_IEEE_UDP_PORT;
+                                break;
+                        case DCBX_APP_SF_IEEE_TCP_UDP_PORT:
+                                entry->sf_ieee = QED_DCBX_SF_IEEE_TCP_UDP_PORT;
+                                break;
+                        }
+                } else {
+                        entry->ethtype = !(QED_MFW_GET_FIELD(p_tbl[i].entry,
+                                                             DCBX_APP_SF));
+                }
+
                 pri_map = QED_MFW_GET_FIELD(p_tbl[i].entry, DCBX_APP_PRI_MAP);
                 entry->prio = ffs(pri_map) - 1;
                 entry->proto_id = QED_MFW_GET_FIELD(p_tbl[i].entry,
                                                     DCBX_APP_PROTOCOL_ID);
                 qed_dcbx_get_app_protocol_type(p_hwfn, p_tbl[i].entry,
                                                entry->proto_id,
-                                               &entry->proto_type);
+                                               &entry->proto_type, ieee);
         }
 
         DP_VERBOSE(p_hwfn, QED_MSG_DCB,
@@ -483,7 +566,7 @@ qed_dcbx_get_ets_data(struct qed_hwfn *p_hwfn,
         bw_map[1] = be32_to_cpu(p_ets->tc_bw_tbl[1]);
         tsa_map[0] = be32_to_cpu(p_ets->tc_tsa_tbl[0]);
         tsa_map[1] = be32_to_cpu(p_ets->tc_tsa_tbl[1]);
-        pri_map = be32_to_cpu(p_ets->pri_tc_tbl[0]);
+        pri_map = p_ets->pri_tc_tbl[0];
         for (i = 0; i < QED_MAX_PFC_PRIORITIES; i++) {
                 p_params->ets_tc_bw_tbl[i] = ((u8 *)bw_map)[i];
                 p_params->ets_tc_tsa_tbl[i] = ((u8 *)tsa_map)[i];
@@ -500,9 +583,9 @@ qed_dcbx_get_common_params(struct qed_hwfn *p_hwfn,
                            struct dcbx_app_priority_feature *p_app,
                            struct dcbx_app_priority_entry *p_tbl,
                            struct dcbx_ets_feature *p_ets,
-                           u32 pfc, struct qed_dcbx_params *p_params)
+                           u32 pfc, struct qed_dcbx_params *p_params, bool ieee)
 {
-        qed_dcbx_get_app_data(p_hwfn, p_app, p_tbl, p_params);
+        qed_dcbx_get_app_data(p_hwfn, p_app, p_tbl, p_params, ieee);
         qed_dcbx_get_ets_data(p_hwfn, p_ets, p_params);
         qed_dcbx_get_pfc_data(p_hwfn, pfc, p_params);
 }
@@ -516,7 +599,7 @@ qed_dcbx_get_local_params(struct qed_hwfn *p_hwfn,
         p_feat = &p_hwfn->p_dcbx_info->local_admin.features;
         qed_dcbx_get_common_params(p_hwfn, &p_feat->app,
                                    p_feat->app.app_pri_tbl, &p_feat->ets,
-                                   p_feat->pfc, &params->local.params);
+                                   p_feat->pfc, &params->local.params, false);
         params->local.valid = true;
 }
 
@@ -529,7 +612,7 @@ qed_dcbx_get_remote_params(struct qed_hwfn *p_hwfn,
         p_feat = &p_hwfn->p_dcbx_info->remote.features;
         qed_dcbx_get_common_params(p_hwfn, &p_feat->app,
                                    p_feat->app.app_pri_tbl, &p_feat->ets,
-                                   p_feat->pfc, &params->remote.params);
+                                   p_feat->pfc, &params->remote.params, false);
         params->remote.valid = true;
 }
 
@@ -574,7 +657,8 @@ qed_dcbx_get_operational_params(struct qed_hwfn *p_hwfn,
 
         qed_dcbx_get_common_params(p_hwfn, &p_feat->app,
                                    p_feat->app.app_pri_tbl, &p_feat->ets,
-                                   p_feat->pfc, &params->operational.params);
+                                   p_feat->pfc, &params->operational.params,
+                                   p_operational->ieee);
         qed_dcbx_get_priority_info(p_hwfn, &p_operational->app_prio, p_results);
         err = QED_MFW_GET_FIELD(p_feat->app.flags, DCBX_APP_ERROR);
         p_operational->err = err;
@@ -944,7 +1028,6 @@ qed_dcbx_set_ets_data(struct qed_hwfn *p_hwfn,
                 val = (((u32)p_params->ets_pri_tc_tbl[i]) << ((7 - i) * 4));
                 p_ets->pri_tc_tbl[0] |= val;
         }
-        p_ets->pri_tc_tbl[0] = cpu_to_be32(p_ets->pri_tc_tbl[0]);
         for (i = 0; i < 2; i++) {
                 p_ets->tc_bw_tbl[i] = cpu_to_be32(p_ets->tc_bw_tbl[i]);
                 p_ets->tc_tsa_tbl[i] = cpu_to_be32(p_ets->tc_tsa_tbl[i]);
@@ -954,7 +1037,7 @@ qed_dcbx_set_ets_data(struct qed_hwfn *p_hwfn,
 static void
 qed_dcbx_set_app_data(struct qed_hwfn *p_hwfn,
                       struct dcbx_app_priority_feature *p_app,
-                      struct qed_dcbx_params *p_params)
+                      struct qed_dcbx_params *p_params, bool ieee)
 {
         u32 *entry;
         int i;
@@ -975,12 +1058,36 @@ qed_dcbx_set_app_data(struct qed_hwfn *p_hwfn,
 
         for (i = 0; i < DCBX_MAX_APP_PROTOCOL; i++) {
                 entry = &p_app->app_pri_tbl[i].entry;
-                *entry &= ~DCBX_APP_SF_MASK;
-                if (p_params->app_entry[i].ethtype)
-                        *entry |= ((u32)DCBX_APP_SF_ETHTYPE <<
-                                   DCBX_APP_SF_SHIFT);
-                else
-                        *entry |= ((u32)DCBX_APP_SF_PORT << DCBX_APP_SF_SHIFT);
+                if (ieee) {
+                        *entry &= ~DCBX_APP_SF_IEEE_MASK;
+                        switch (p_params->app_entry[i].sf_ieee) {
+                        case QED_DCBX_SF_IEEE_ETHTYPE:
+                                *entry |= ((u32)DCBX_APP_SF_IEEE_ETHTYPE <<
+                                           DCBX_APP_SF_IEEE_SHIFT);
+                                break;
+                        case QED_DCBX_SF_IEEE_TCP_PORT:
+                                *entry |= ((u32)DCBX_APP_SF_IEEE_TCP_PORT <<
+                                           DCBX_APP_SF_IEEE_SHIFT);
+                                break;
+                        case QED_DCBX_SF_IEEE_UDP_PORT:
+                                *entry |= ((u32)DCBX_APP_SF_IEEE_UDP_PORT <<
+                                           DCBX_APP_SF_IEEE_SHIFT);
+                                break;
+                        case QED_DCBX_SF_IEEE_TCP_UDP_PORT:
+                                *entry |= ((u32)DCBX_APP_SF_IEEE_TCP_UDP_PORT <<
+                                           DCBX_APP_SF_IEEE_SHIFT);
+                                break;
+                        }
+                } else {
+                        *entry &= ~DCBX_APP_SF_MASK;
+                        if (p_params->app_entry[i].ethtype)
+                                *entry |= ((u32)DCBX_APP_SF_ETHTYPE <<
+                                           DCBX_APP_SF_SHIFT);
+                        else
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
+                }
+
                 *entry &= ~DCBX_APP_PROTOCOL_ID_MASK;
                 *entry |= ((u32)p_params->app_entry[i].proto_id <<
                            DCBX_APP_PROTOCOL_ID_SHIFT);
@@ -995,15 +1102,19 @@ qed_dcbx_set_local_params(struct qed_hwfn *p_hwfn,
                           struct dcbx_local_params *local_admin,
                           struct qed_dcbx_set *params)
 {
+        bool ieee = false;
+
         local_admin->flags = 0;
         memcpy(&local_admin->features,
                &p_hwfn->p_dcbx_info->operational.features,
                sizeof(local_admin->features));
 
-        if (params->enabled)
+        if (params->enabled) {
                 local_admin->config = params->ver_num;
-        else
+                ieee = !!(params->ver_num & DCBX_CONFIG_VERSION_IEEE);
+        } else {
                 local_admin->config = DCBX_CONFIG_VERSION_DISABLED;
+        }
 
         if (params->override_flags & QED_DCBX_OVERRIDE_PFC_CFG)
                 qed_dcbx_set_pfc_data(p_hwfn, &local_admin->features.pfc,
@@ -1015,7 +1126,7 @@ qed_dcbx_set_local_params(struct qed_hwfn *p_hwfn,
 
         if (params->override_flags & QED_DCBX_OVERRIDE_APP_CFG)
                 qed_dcbx_set_app_data(p_hwfn, &local_admin->features.app,
-                                      &params->config.params);
+                                      &params->config.params, ieee);
 }
 
 int qed_dcbx_config_params(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
@@ -1596,8 +1707,10 @@ static int qed_dcbnl_setapp(struct qed_dev *cdev,
                 if ((entry->ethtype == ethtype) && (entry->proto_id == idval))
                         break;
                 /* First empty slot */
-                if (!entry->proto_id)
+                if (!entry->proto_id) {
+                        dcbx_set.config.params.num_app_entries++;
                         break;
+                }
         }
 
         if (i == QED_DCBX_MAX_APP_PROTOCOL) {
@@ -2117,8 +2230,10 @@ int qed_dcbnl_ieee_setapp(struct qed_dev *cdev, struct dcb_app *app)
                     (entry->proto_id == app->protocol))
                         break;
                 /* First empty slot */
-                if (!entry->proto_id)
+                if (!entry->proto_id) {
+                        dcbx_set.config.params.num_app_entries++;
                         break;
+                }
         }
 
         if (i == QED_DCBX_MAX_APP_PROTOCOL) {
diff --git a/drivers/net/ethernet/qlogic/qed/qed_hsi.h b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
index 592784019994..6f9d3b831a2a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_hsi.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
@@ -6850,6 +6850,14 @@ struct dcbx_app_priority_entry {
 #define DCBX_APP_SF_SHIFT               8
 #define DCBX_APP_SF_ETHTYPE             0
 #define DCBX_APP_SF_PORT                1
+#define DCBX_APP_SF_IEEE_MASK           0x0000f000
+#define DCBX_APP_SF_IEEE_SHIFT          12
+#define DCBX_APP_SF_IEEE_RESERVED       0
+#define DCBX_APP_SF_IEEE_ETHTYPE        1
+#define DCBX_APP_SF_IEEE_TCP_PORT       2
+#define DCBX_APP_SF_IEEE_UDP_PORT       3
+#define DCBX_APP_SF_IEEE_TCP_UDP_PORT   4
+
 #define DCBX_APP_PROTOCOL_ID_MASK       0xffff0000
 #define DCBX_APP_PROTOCOL_ID_SHIFT      16
 };
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index fd973f4f16c7..49bad00a0f8f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -37,8 +37,8 @@
 
 #define _QLCNIC_LINUX_MAJOR 5
 #define _QLCNIC_LINUX_MINOR 3
-#define _QLCNIC_LINUX_SUBVERSION 64
-#define QLCNIC_LINUX_VERSIONID  "5.3.64"
+#define _QLCNIC_LINUX_SUBVERSION 65
+#define QLCNIC_LINUX_VERSIONID  "5.3.65"
 #define QLCNIC_DRV_IDC_VER  0x01
 #define QLCNIC_DRIVER_VERSION  ((_QLCNIC_LINUX_MAJOR << 16) |\
                  (_QLCNIC_LINUX_MINOR << 8) | (_QLCNIC_LINUX_SUBVERSION))
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 87c642d3b075..fedd7366713c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -102,7 +102,6 @@
 #define QLCNIC_RESPONSE_DESC    0x05
 #define QLCNIC_LRO_DESC         0x12
 
-#define QLCNIC_TX_POLL_BUDGET           128
 #define QLCNIC_TCP_HDR_SIZE             20
 #define QLCNIC_TCP_TS_OPTION_SIZE       12
 #define QLCNIC_FETCH_RING_ID(handle)    ((handle) >> 63)
@@ -2008,7 +2007,6 @@ static int qlcnic_83xx_msix_tx_poll(struct napi_struct *napi, int budget)
         struct qlcnic_host_tx_ring *tx_ring;
         struct qlcnic_adapter *adapter;
 
-        budget = QLCNIC_TX_POLL_BUDGET;
         tx_ring = container_of(napi, struct qlcnic_host_tx_ring, napi);
         adapter = tx_ring->adapter;
         work_done = qlcnic_process_cmd_ring(adapter, tx_ring, budget);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
index 017d8c2c8285..24061b9b92e8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
@@ -156,10 +156,8 @@ struct qlcnic_vf_info {
         spinlock_t                      vlan_list_lock; /* Lock for VLAN list */
 };
 
-struct qlcnic_async_work_list {
+struct qlcnic_async_cmd {
         struct list_head        list;
-        struct work_struct      work;
-        void                    *ptr;
         struct qlcnic_cmd_args  *cmd;
 };
 
@@ -168,7 +166,10 @@ struct qlcnic_back_channel {
         struct workqueue_struct *bc_trans_wq;
         struct workqueue_struct *bc_async_wq;
         struct workqueue_struct *bc_flr_wq;
-        struct list_head        async_list;
+        struct qlcnic_adapter   *adapter;
+        struct list_head        async_cmd_list;
+        struct work_struct      vf_async_work;
+        spinlock_t              queue_lock; /* async_cmd_list queue lock */
 };
 
 struct qlcnic_sriov {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 7327b729ba2e..d7107055ec60 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -29,6 +29,7 @@
 #define QLC_83XX_VF_RESET_FAIL_THRESH   8
 #define QLC_BC_CMD_MAX_RETRY_CNT        5
 
+static void qlcnic_sriov_handle_async_issue_cmd(struct work_struct *work);
 static void qlcnic_sriov_vf_free_mac_list(struct qlcnic_adapter *);
 static int qlcnic_sriov_alloc_bc_mbx_args(struct qlcnic_cmd_args *, u32);
 static void qlcnic_sriov_vf_poll_dev_state(struct work_struct *);
@@ -177,7 +178,10 @@ int qlcnic_sriov_init(struct qlcnic_adapter *adapter, int num_vfs)
         }
 
         bc->bc_async_wq =  wq;
-        INIT_LIST_HEAD(&bc->async_list);
+        INIT_LIST_HEAD(&bc->async_cmd_list);
+        INIT_WORK(&bc->vf_async_work, qlcnic_sriov_handle_async_issue_cmd);
+        spin_lock_init(&bc->queue_lock);
+        bc->adapter = adapter;
 
         for (i = 0; i < num_vfs; i++) {
                 vf = &sriov->vf_info[i];
@@ -1517,17 +1521,21 @@ static void qlcnic_vf_add_mc_list(struct net_device *netdev, const u8 *mac,
 
 void qlcnic_sriov_cleanup_async_list(struct qlcnic_back_channel *bc)
 {
-        struct list_head *head = &bc->async_list;
-        struct qlcnic_async_work_list *entry;
+        struct list_head *head = &bc->async_cmd_list;
+        struct qlcnic_async_cmd *entry;
 
         flush_workqueue(bc->bc_async_wq);
+        cancel_work_sync(&bc->vf_async_work);
+
+        spin_lock(&bc->queue_lock);
         while (!list_empty(head)) {
-                entry = list_entry(head->next, struct qlcnic_async_work_list,
+                entry = list_entry(head->next, struct qlcnic_async_cmd,
                                    list);
-                cancel_work_sync(&entry->work);
                 list_del(&entry->list);
+                kfree(entry->cmd);
                 kfree(entry);
         }
+        spin_unlock(&bc->queue_lock);
 }
 
 void qlcnic_sriov_vf_set_multi(struct net_device *netdev)
@@ -1587,57 +1595,64 @@ void qlcnic_sriov_vf_set_multi(struct net_device *netdev)
 
 static void qlcnic_sriov_handle_async_issue_cmd(struct work_struct *work)
 {
-        struct qlcnic_async_work_list *entry;
-        struct qlcnic_adapter *adapter;
+        struct qlcnic_async_cmd *entry, *tmp;
+        struct qlcnic_back_channel *bc;
         struct qlcnic_cmd_args *cmd;
+        struct list_head *head;
+        LIST_HEAD(del_list);
+
+        bc = container_of(work, struct qlcnic_back_channel, vf_async_work);
+        head = &bc->async_cmd_list;
+
+        spin_lock(&bc->queue_lock);
+        list_splice_init(head, &del_list);
+        spin_unlock(&bc->queue_lock);
+
+        list_for_each_entry_safe(entry, tmp, &del_list, list) {
+                list_del(&entry->list);
+                cmd = entry->cmd;
+                __qlcnic_sriov_issue_cmd(bc->adapter, cmd);
+                kfree(entry);
+        }
+
+        if (!list_empty(head))
+                queue_work(bc->bc_async_wq, &bc->vf_async_work);
 
-        entry = container_of(work, struct qlcnic_async_work_list, work);
-        adapter = entry->ptr;
-        cmd = entry->cmd;
-        __qlcnic_sriov_issue_cmd(adapter, cmd);
         return;
 }
 
-static struct qlcnic_async_work_list *
-qlcnic_sriov_get_free_node_async_work(struct qlcnic_back_channel *bc)
+static struct qlcnic_async_cmd *
+qlcnic_sriov_alloc_async_cmd(struct qlcnic_back_channel *bc,
+                             struct qlcnic_cmd_args *cmd)
 {
-        struct list_head *node;
-        struct qlcnic_async_work_list *entry = NULL;
-        u8 empty = 0;
+        struct qlcnic_async_cmd *entry = NULL;
 
-        list_for_each(node, &bc->async_list) {
-                entry = list_entry(node, struct qlcnic_async_work_list, list);
-                if (!work_pending(&entry->work)) {
-                        empty = 1;
-                        break;
-                }
-        }
+        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
+        if (!entry)
+                return NULL;
 
-        if (!empty) {
-                entry = kzalloc(sizeof(struct qlcnic_async_work_list),
-                                GFP_ATOMIC);
-                if (entry == NULL)
-                        return NULL;
-                list_add_tail(&entry->list, &bc->async_list);
-        }
+        entry->cmd = cmd;
+
+        spin_lock(&bc->queue_lock);
+        list_add_tail(&entry->list, &bc->async_cmd_list);
+        spin_unlock(&bc->queue_lock);
 
         return entry;
 }
 
 static void qlcnic_sriov_schedule_async_cmd(struct qlcnic_back_channel *bc,
-                                            work_func_t func, void *data,
                                             struct qlcnic_cmd_args *cmd)
 {
-        struct qlcnic_async_work_list *entry = NULL;
+        struct qlcnic_async_cmd *entry = NULL;
 
-        entry = qlcnic_sriov_get_free_node_async_work(bc);
-        if (!entry)
+        entry = qlcnic_sriov_alloc_async_cmd(bc, cmd);
+        if (!entry) {
+                qlcnic_free_mbx_args(cmd);
+                kfree(cmd);
                 return;
+        }
 
-        entry->ptr = data;
-        entry->cmd = cmd;
-        INIT_WORK(&entry->work, func);
-        queue_work(bc->bc_async_wq, &entry->work);
+        queue_work(bc->bc_async_wq, &bc->vf_async_work);
 }
 
 static int qlcnic_sriov_async_issue_cmd(struct qlcnic_adapter *adapter,
@@ -1649,8 +1664,8 @@ static int qlcnic_sriov_async_issue_cmd(struct qlcnic_adapter *adapter,
         if (adapter->need_fw_reset)
                 return -EIO;
 
-        qlcnic_sriov_schedule_async_cmd(bc, qlcnic_sriov_handle_async_issue_cmd,
-                                        adapter, cmd);
+        qlcnic_sriov_schedule_async_cmd(bc, cmd);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index c51f34693eae..f85d605e4560 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -734,6 +734,7 @@ static void cpsw_rx_handler(void *token, int len, int status)
                 netif_receive_skb(skb);
                 ndev->stats.rx_bytes += len;
                 ndev->stats.rx_packets++;
+                kmemleak_not_leak(new_skb);
         } else {
                 ndev->stats.rx_dropped++;
                 new_skb = skb;
@@ -1325,6 +1326,7 @@ static int cpsw_ndo_open(struct net_device *ndev)
                                 kfree_skb(skb);
                                 goto err_cleanup;
                         }
+                        kmemleak_not_leak(skb);
                 }
                 /* continue even if we didn't manage to submit all
                  * receive descs
diff --git a/drivers/net/ethernet/tundra/tsi108_eth.c b/drivers/net/ethernet/tundra/tsi108_eth.c
index 01a77145a0fa..8fd131207ee1 100644
--- a/drivers/net/ethernet/tundra/tsi108_eth.c
+++ b/drivers/net/ethernet/tundra/tsi108_eth.c
@@ -166,6 +166,7 @@ static struct platform_driver tsi_eth_driver = {
 
 static void tsi108_timed_checker(unsigned long dev_ptr);
 
+#ifdef DEBUG
 static void dump_eth_one(struct net_device *dev)
 {
         struct tsi108_prv_data *data = netdev_priv(dev);
@@ -190,6 +191,7 @@ static void dump_eth_one(struct net_device *dev)
                TSI_READ(TSI108_EC_RXESTAT),
                TSI_READ(TSI108_EC_RXERR), data->rxpending);
 }
+#endif
 
 /* Synchronization is needed between the thread and up/down events.
  * Note that the PHY is accessed through the same registers for both
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 467fb8b4d083..591af71eae56 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -644,12 +644,6 @@ struct netvsc_reconfig {
         u32 event;
 };
 
-struct garp_wrk {
-        struct work_struct dwrk;
-        struct net_device *netdev;
-        struct netvsc_device *netvsc_dev;
-};
-
 /* The context of the netvsc device  */
 struct net_device_context {
         /* point back to our device context */
@@ -667,7 +661,6 @@ struct net_device_context {
 
         struct work_struct work;
         u32 msg_enable; /* debug level */
-        struct garp_wrk gwrk;
 
         struct netvsc_stats __percpu *tx_stats;
         struct netvsc_stats __percpu *rx_stats;
@@ -678,6 +671,15 @@ struct net_device_context {
 
         /* the device is going away */
         bool start_remove;
+
+        /* State to manage the associated VF interface. */
+        struct net_device *vf_netdev;
+        bool vf_inject;
+        atomic_t vf_use_cnt;
+        /* 1: allocated, serial number is valid. 0: not allocated */
+        u32 vf_alloc;
+        /* Serial number of the VF to team with */
+        u32 vf_serial;
 };
 
 /* Per netvsc device */
@@ -733,15 +735,7 @@ struct netvsc_device {
         u32 max_pkt; /* max number of pkt in one send, e.g. 8 */
         u32 pkt_align; /* alignment bytes, e.g. 8 */
 
-        /* 1: allocated, serial number is valid. 0: not allocated */
-        u32 vf_alloc;
-        /* Serial number of the VF to team with */
-        u32 vf_serial;
         atomic_t open_cnt;
-        /* State to manage the associated VF interface. */
-        bool vf_inject;
-        struct net_device *vf_netdev;
-        atomic_t vf_use_cnt;
 };
 
 static inline struct netvsc_device *
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 20e09174ff62..410fb8e81376 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -77,13 +77,9 @@ static struct netvsc_device *alloc_net_device(void)
         init_waitqueue_head(&net_device->wait_drain);
         net_device->destroy = false;
         atomic_set(&net_device->open_cnt, 0);
-        atomic_set(&net_device->vf_use_cnt, 0);
         net_device->max_pkt = RNDIS_MAX_PKT_DEFAULT;
         net_device->pkt_align = RNDIS_PKT_ALIGN_DEFAULT;
 
-        net_device->vf_netdev = NULL;
-        net_device->vf_inject = false;
-
         return net_device;
 }
 
@@ -1106,16 +1102,16 @@ static void netvsc_send_table(struct hv_device *hdev,
                 nvscdev->send_table[i] = tab[i];
 }
 
-static void netvsc_send_vf(struct netvsc_device *nvdev,
+static void netvsc_send_vf(struct net_device_context *net_device_ctx,
                            struct nvsp_message *nvmsg)
 {
-        nvdev->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
-        nvdev->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
+        net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
+        net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
 }
 
 static inline void netvsc_receive_inband(struct hv_device *hdev,
-                                         struct netvsc_device *nvdev,
-                                         struct nvsp_message *nvmsg)
+                                 struct net_device_context *net_device_ctx,
+                                 struct nvsp_message *nvmsg)
 {
         switch (nvmsg->hdr.msg_type) {
         case NVSP_MSG5_TYPE_SEND_INDIRECTION_TABLE:
@@ -1123,7 +1119,7 @@ static inline void netvsc_receive_inband(struct hv_device *hdev,
                 break;
 
         case NVSP_MSG4_TYPE_SEND_VF_ASSOCIATION:
-                netvsc_send_vf(nvdev, nvmsg);
+                netvsc_send_vf(net_device_ctx, nvmsg);
                 break;
         }
 }
@@ -1136,6 +1132,7 @@ static void netvsc_process_raw_pkt(struct hv_device *device,
                                    struct vmpacket_descriptor *desc)
 {
         struct nvsp_message *nvmsg;
+        struct net_device_context *net_device_ctx = netdev_priv(ndev);
 
         nvmsg = (struct nvsp_message *)((unsigned long)
                 desc + (desc->offset8 << 3));
@@ -1150,7 +1147,7 @@ static void netvsc_process_raw_pkt(struct hv_device *device,
                 break;
 
         case VM_PKT_DATA_INBAND:
-                netvsc_receive_inband(device, net_device, nvmsg);
+                netvsc_receive_inband(device, net_device_ctx, nvmsg);
                 break;
 
         default:
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 41bd952cc28d..3ba29fc80d05 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -658,20 +658,19 @@ int netvsc_recv_callback(struct hv_device *device_obj,
         struct sk_buff *skb;
         struct sk_buff *vf_skb;
         struct netvsc_stats *rx_stats;
-        struct netvsc_device *netvsc_dev = net_device_ctx->nvdev;
         u32 bytes_recvd = packet->total_data_buflen;
         int ret = 0;
 
         if (!net || net->reg_state != NETREG_REGISTERED)
                 return NVSP_STAT_FAIL;
 
-        if (READ_ONCE(netvsc_dev->vf_inject)) {
-                atomic_inc(&netvsc_dev->vf_use_cnt);
-                if (!READ_ONCE(netvsc_dev->vf_inject)) {
+        if (READ_ONCE(net_device_ctx->vf_inject)) {
+                atomic_inc(&net_device_ctx->vf_use_cnt);
+                if (!READ_ONCE(net_device_ctx->vf_inject)) {
                         /*
                          * We raced; just move on.
                          */
-                        atomic_dec(&netvsc_dev->vf_use_cnt);
+                        atomic_dec(&net_device_ctx->vf_use_cnt);
                         goto vf_injection_done;
                 }
 
@@ -683,17 +682,19 @@ int netvsc_recv_callback(struct hv_device *device_obj,
                  * the host). Deliver these via the VF interface
                  * in the guest.
                  */
-                vf_skb = netvsc_alloc_recv_skb(netvsc_dev->vf_netdev, packet,
-                                               csum_info, *data, vlan_tci);
+                vf_skb = netvsc_alloc_recv_skb(net_device_ctx->vf_netdev,
+                                               packet, csum_info, *data,
+                                               vlan_tci);
                 if (vf_skb != NULL) {
-                        ++netvsc_dev->vf_netdev->stats.rx_packets;
-                        netvsc_dev->vf_netdev->stats.rx_bytes += bytes_recvd;
+                        ++net_device_ctx->vf_netdev->stats.rx_packets;
+                        net_device_ctx->vf_netdev->stats.rx_bytes +=
+                                bytes_recvd;
                         netif_receive_skb(vf_skb);
                 } else {
                         ++net->stats.rx_dropped;
                         ret = NVSP_STAT_FAIL;
                 }
-                atomic_dec(&netvsc_dev->vf_use_cnt);
+                atomic_dec(&net_device_ctx->vf_use_cnt);
                 return ret;
         }
 
@@ -1150,17 +1151,6 @@ static void netvsc_free_netdev(struct net_device *netdev)
         free_netdev(netdev);
 }
 
-static void netvsc_notify_peers(struct work_struct *wrk)
-{
-        struct garp_wrk *gwrk;
-
-        gwrk = container_of(wrk, struct garp_wrk, dwrk);
-
-        netdev_notify_peers(gwrk->netdev);
-
-        atomic_dec(&gwrk->netvsc_dev->vf_use_cnt);
-}
-
 static struct net_device *get_netvsc_net_device(char *mac)
 {
         struct net_device *dev, *found = NULL;
@@ -1203,7 +1193,7 @@ static int netvsc_register_vf(struct net_device *vf_netdev)
 
         net_device_ctx = netdev_priv(ndev);
         netvsc_dev = net_device_ctx->nvdev;
-        if (netvsc_dev == NULL)
+        if (!netvsc_dev || net_device_ctx->vf_netdev)
                 return NOTIFY_DONE;
 
         netdev_info(ndev, "VF registering: %s\n", vf_netdev->name);
@@ -1211,10 +1201,23 @@ static int netvsc_register_vf(struct net_device *vf_netdev)
          * Take a reference on the module.
          */
         try_module_get(THIS_MODULE);
-        netvsc_dev->vf_netdev = vf_netdev;
+        net_device_ctx->vf_netdev = vf_netdev;
         return NOTIFY_OK;
 }
 
+static void netvsc_inject_enable(struct net_device_context *net_device_ctx)
+{
+        net_device_ctx->vf_inject = true;
+}
+
+static void netvsc_inject_disable(struct net_device_context *net_device_ctx)
+{
+        net_device_ctx->vf_inject = false;
+
+        /* Wait for currently active users to drain out. */
+        while (atomic_read(&net_device_ctx->vf_use_cnt) != 0)
+                udelay(50);
+}
 
 static int netvsc_vf_up(struct net_device *vf_netdev)
 {
@@ -1233,11 +1236,11 @@ static int netvsc_vf_up(struct net_device *vf_netdev)
         net_device_ctx = netdev_priv(ndev);
         netvsc_dev = net_device_ctx->nvdev;
 
-        if ((netvsc_dev == NULL) || (netvsc_dev->vf_netdev == NULL))
+        if (!netvsc_dev || !net_device_ctx->vf_netdev)
                 return NOTIFY_DONE;
 
         netdev_info(ndev, "VF up: %s\n", vf_netdev->name);
-        netvsc_dev->vf_inject = true;
+        netvsc_inject_enable(net_device_ctx);
 
         /*
          * Open the device before switching data path.
@@ -1252,15 +1255,8 @@ static int netvsc_vf_up(struct net_device *vf_netdev)
 
         netif_carrier_off(ndev);
 
-        /*
-         * Now notify peers. We are scheduling work to
-         * notify peers; take a reference to prevent
-         * the VF interface from vanishing.
-         */
-        atomic_inc(&netvsc_dev->vf_use_cnt);
-        net_device_ctx->gwrk.netdev = vf_netdev;
-        net_device_ctx->gwrk.netvsc_dev = netvsc_dev;
-        schedule_work(&net_device_ctx->gwrk.dwrk);
+        /* Now notify peers through VF device. */
+        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, vf_netdev);
 
         return NOTIFY_OK;
 }
@@ -1283,29 +1279,18 @@ static int netvsc_vf_down(struct net_device *vf_netdev)
         net_device_ctx = netdev_priv(ndev);
         netvsc_dev = net_device_ctx->nvdev;
 
-        if ((netvsc_dev == NULL) || (netvsc_dev->vf_netdev == NULL))
+        if (!netvsc_dev || !net_device_ctx->vf_netdev)
                 return NOTIFY_DONE;
 
         netdev_info(ndev, "VF down: %s\n", vf_netdev->name);
-        netvsc_dev->vf_inject = false;
-        /*
-         * Wait for currently active users to
-         * drain out.
-         */
-
-        while (atomic_read(&netvsc_dev->vf_use_cnt) != 0)
-                udelay(50);
+        netvsc_inject_disable(net_device_ctx);
         netvsc_switch_datapath(ndev, false);
         netdev_info(ndev, "Data path switched from VF: %s\n", vf_netdev->name);
         rndis_filter_close(netvsc_dev);
         netif_carrier_on(ndev);
-        /*
-         * Notify peers.
-         */
-        atomic_inc(&netvsc_dev->vf_use_cnt);
-        net_device_ctx->gwrk.netdev = ndev;
-        net_device_ctx->gwrk.netvsc_dev = netvsc_dev;
-        schedule_work(&net_device_ctx->gwrk.dwrk);
+
+        /* Now notify peers through netvsc device. */
+        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, ndev);
 
         return NOTIFY_OK;
 }
@@ -1327,11 +1312,11 @@ static int netvsc_unregister_vf(struct net_device *vf_netdev)
 
         net_device_ctx = netdev_priv(ndev);
         netvsc_dev = net_device_ctx->nvdev;
-        if (netvsc_dev == NULL)
+        if (!netvsc_dev || !net_device_ctx->vf_netdev)
                 return NOTIFY_DONE;
         netdev_info(ndev, "VF unregistering: %s\n", vf_netdev->name);
-
-        netvsc_dev->vf_netdev = NULL;
+        netvsc_inject_disable(net_device_ctx);
+        net_device_ctx->vf_netdev = NULL;
         module_put(THIS_MODULE);
         return NOTIFY_OK;
 }
@@ -1377,11 +1362,14 @@ static int netvsc_probe(struct hv_device *dev,
 
         INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change);
         INIT_WORK(&net_device_ctx->work, do_set_multicast);
-        INIT_WORK(&net_device_ctx->gwrk.dwrk, netvsc_notify_peers);
 
         spin_lock_init(&net_device_ctx->lock);
         INIT_LIST_HEAD(&net_device_ctx->reconfig_events);
 
+        atomic_set(&net_device_ctx->vf_use_cnt, 0);
+        net_device_ctx->vf_netdev = NULL;
+        net_device_ctx->vf_inject = false;
+
         net->netdev_ops = &device_ops;
 
         net->hw_features = NETVSC_HW_FEATURES;
@@ -1494,8 +1482,13 @@ static int netvsc_netdev_event(struct notifier_block *this,
 {
         struct net_device *event_dev = netdev_notifier_info_to_dev(ptr);
 
-        /* Avoid Vlan, Bonding dev with same MAC registering as VF */
-        if (event_dev->priv_flags & (IFF_802_1Q_VLAN | IFF_BONDING))
+        /* Avoid Vlan dev with same MAC registering as VF */
+        if (event_dev->priv_flags & IFF_802_1Q_VLAN)
+                return NOTIFY_DONE;
+
+        /* Avoid Bonding master dev with same MAC registering as VF */
+        if (event_dev->priv_flags & IFF_BONDING &&
+            event_dev->flags & IFF_MASTER)
                 return NOTIFY_DONE;
 
         switch (event) {
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index d13e6e15d7b5..351e701eb043 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -270,6 +270,7 @@ struct macsec_dev {
         struct pcpu_secy_stats __percpu *stats;
         struct list_head secys;
         struct gro_cells gro_cells;
+        unsigned int nest_level;
 };
 
 /**
@@ -2699,6 +2700,8 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb,
 
 #define MACSEC_FEATURES \
         (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST)
+static struct lock_class_key macsec_netdev_addr_lock_key;
+
 static int macsec_dev_init(struct net_device *dev)
 {
         struct macsec_dev *macsec = macsec_priv(dev);
@@ -2910,6 +2913,13 @@ static int macsec_get_iflink(const struct net_device *dev)
         return macsec_priv(dev)->real_dev->ifindex;
 }
 
+
+static int macsec_get_nest_level(struct net_device *dev)
+{
+        return macsec_priv(dev)->nest_level;
+}
+
+
 static const struct net_device_ops macsec_netdev_ops = {
         .ndo_init               = macsec_dev_init,
         .ndo_uninit             = macsec_dev_uninit,
@@ -2923,6 +2933,7 @@ static const struct net_device_ops macsec_netdev_ops = {
         .ndo_start_xmit         = macsec_start_xmit,
         .ndo_get_stats64        = macsec_get_stats64,
         .ndo_get_iflink         = macsec_get_iflink,
+        .ndo_get_lock_subclass  = macsec_get_nest_level,
 };
 
 static const struct device_type macsec_type = {
@@ -3047,22 +3058,31 @@ static void macsec_del_dev(struct macsec_dev *macsec)
         }
 }
 
+static void macsec_common_dellink(struct net_device *dev, struct list_head *head)
+{
+        struct macsec_dev *macsec = macsec_priv(dev);
+        struct net_device *real_dev = macsec->real_dev;
+
+        unregister_netdevice_queue(dev, head);
+        list_del_rcu(&macsec->secys);
+        macsec_del_dev(macsec);
+        netdev_upper_dev_unlink(real_dev, dev);
+
+        macsec_generation++;
+}
+
 static void macsec_dellink(struct net_device *dev, struct list_head *head)
 {
         struct macsec_dev *macsec = macsec_priv(dev);
         struct net_device *real_dev = macsec->real_dev;
         struct macsec_rxh_data *rxd = macsec_data_rtnl(real_dev);
 
-        macsec_generation++;
+        macsec_common_dellink(dev, head);
 
-        unregister_netdevice_queue(dev, head);
-        list_del_rcu(&macsec->secys);
         if (list_empty(&rxd->secys)) {
                 netdev_rx_handler_unregister(real_dev);
                 kfree(rxd);
         }
-
-        macsec_del_dev(macsec);
 }
 
 static int register_macsec_dev(struct net_device *real_dev,
@@ -3181,6 +3201,16 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
 
         dev_hold(real_dev);
 
+        macsec->nest_level = dev_get_nest_level(real_dev) + 1;
+        netdev_lockdep_set_classes(dev);
+        lockdep_set_class_and_subclass(&dev->addr_list_lock,
+                                       &macsec_netdev_addr_lock_key,
+                                       macsec_get_nest_level(dev));
+
+        err = netdev_upper_dev_link(real_dev, dev);
+        if (err < 0)
+                goto unregister;
+
         /* need to be already registered so that ->init has run and
          * the MAC addr is set
          */
@@ -3193,12 +3223,12 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
 
         if (rx_handler && sci_exists(real_dev, sci)) {
                 err = -EBUSY;
-                goto unregister;
+                goto unlink;
         }
 
         err = macsec_add_dev(dev, sci, icv_len);
         if (err)
-                goto unregister;
+                goto unlink;
 
         if (data)
                 macsec_changelink_common(dev, data);
@@ -3213,6 +3243,8 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
 
 del_dev:
         macsec_del_dev(macsec);
+unlink:
+        netdev_upper_dev_unlink(real_dev, dev);
 unregister:
         unregister_netdevice(dev);
         return err;
@@ -3382,8 +3414,12 @@ static int macsec_notify(struct notifier_block *this, unsigned long event,
 
                 rxd = macsec_data_rtnl(real_dev);
                 list_for_each_entry_safe(m, n, &rxd->secys, secys) {
-                        macsec_dellink(m->secy.netdev, &head);
+                        macsec_common_dellink(m->secy.netdev, &head);
                 }
+
+                netdev_rx_handler_unregister(real_dev);
+                kfree(rxd);
+
                 unregister_netdevice_many(&head);
                 break;
         }
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index cd9b53834bf6..3234fcdea317 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1315,7 +1315,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
         vlan->dev      = dev;
         vlan->port     = port;
         vlan->set_features = MACVLAN_FEATURES;
-        vlan->nest_level = dev_get_nest_level(lowerdev, netif_is_macvlan) + 1;
+        vlan->nest_level = dev_get_nest_level(lowerdev) + 1;
 
         vlan->mode     = MACVLAN_MODE_VEPA;
         if (data && data[IFLA_MACVLAN_MODE])
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index a38c0dac514b..070e3290aa6e 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -275,7 +275,6 @@ static void macvtap_put_queue(struct macvtap_queue *q)
         rtnl_unlock();
 
         synchronize_rcu();
-        skb_array_cleanup(&q->skb_array);
         sock_put(&q->sk);
 }
 
@@ -533,10 +532,8 @@ static void macvtap_sock_write_space(struct sock *sk)
 static void macvtap_sock_destruct(struct sock *sk)
 {
         struct macvtap_queue *q = container_of(sk, struct macvtap_queue, sk);
-        struct sk_buff *skb;
 
-        while ((skb = skb_array_consume(&q->skb_array)) != NULL)
-                kfree_skb(skb);
+        skb_array_cleanup(&q->skb_array);
 }
 
 static int macvtap_open(struct inode *inode, struct file *file)
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 1882d9828c99..053e87905b94 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -677,17 +677,28 @@ static void kszphy_get_stats(struct phy_device *phydev,
                 data[i] = kszphy_get_stat(phydev, i);
 }
 
-static int kszphy_resume(struct phy_device *phydev)
+static int kszphy_suspend(struct phy_device *phydev)
 {
-        int value;
+        /* Disable PHY Interrupts */
+        if (phy_interrupt_is_valid(phydev)) {
+                phydev->interrupts = PHY_INTERRUPT_DISABLED;
+                if (phydev->drv->config_intr)
+                        phydev->drv->config_intr(phydev);
+        }
 
-        mutex_lock(&phydev->lock);
+        return genphy_suspend(phydev);
+}
 
-        value = phy_read(phydev, MII_BMCR);
-        phy_write(phydev, MII_BMCR, value & ~BMCR_PDOWN);
+static int kszphy_resume(struct phy_device *phydev)
+{
+        genphy_resume(phydev);
 
-        kszphy_config_intr(phydev);
-        mutex_unlock(&phydev->lock);
+        /* Enable PHY Interrupts */
+        if (phy_interrupt_is_valid(phydev)) {
+                phydev->interrupts = PHY_INTERRUPT_ENABLED;
+                if (phydev->drv->config_intr)
+                        phydev->drv->config_intr(phydev);
+        }
 
         return 0;
 }
@@ -900,7 +911,7 @@ static struct phy_driver ksphy_driver[] = {
         .get_sset_count = kszphy_get_sset_count,
         .get_strings    = kszphy_get_strings,
         .get_stats      = kszphy_get_stats,
-        .suspend        = genphy_suspend,
+        .suspend        = kszphy_suspend,
         .resume         = kszphy_resume,
 }, {
         .phy_id         = PHY_ID_KSZ8061,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index da4e3d6632f6..c0dda6fc0921 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1811,7 +1811,7 @@ static struct rtable *vxlan_get_route(struct vxlan_dev *vxlan,
         fl4.flowi4_mark = skb->mark;
         fl4.flowi4_proto = IPPROTO_UDP;
         fl4.daddr = daddr;
-        fl4.saddr = vxlan->cfg.saddr.sin.sin_addr.s_addr;
+        fl4.saddr = *saddr;
 
         rt = ip_route_output_key(vxlan->net, &fl4);
         if (!IS_ERR(rt)) {
@@ -1847,7 +1847,7 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
         memset(&fl6, 0, sizeof(fl6));
         fl6.flowi6_oif = oif;
         fl6.daddr = *daddr;
-        fl6.saddr = vxlan->cfg.saddr.sin6.sin6_addr;
+        fl6.saddr = *saddr;
         fl6.flowlabel = ip6_make_flowinfo(RT_TOS(tos), label);
         fl6.flowi6_mark = skb->mark;
         fl6.flowi6_proto = IPPROTO_UDP;
@@ -1920,7 +1920,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
         struct rtable *rt = NULL;
         const struct iphdr *old_iph;
         union vxlan_addr *dst;
-        union vxlan_addr remote_ip;
+        union vxlan_addr remote_ip, local_ip;
+        union vxlan_addr *src;
         struct vxlan_metadata _md;
         struct vxlan_metadata *md = &_md;
         __be16 src_port = 0, dst_port;
@@ -1938,6 +1939,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 dst_port = rdst->remote_port ? rdst->remote_port : vxlan->cfg.dst_port;
                 vni = rdst->remote_vni;
                 dst = &rdst->remote_ip;
+                src = &vxlan->cfg.saddr;
                 dst_cache = &rdst->dst_cache;
         } else {
                 if (!info) {
@@ -1948,11 +1950,15 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 dst_port = info->key.tp_dst ? : vxlan->cfg.dst_port;
                 vni = vxlan_tun_id_to_vni(info->key.tun_id);
                 remote_ip.sa.sa_family = ip_tunnel_info_af(info);
-                if (remote_ip.sa.sa_family == AF_INET)
+                if (remote_ip.sa.sa_family == AF_INET) {
                         remote_ip.sin.sin_addr.s_addr = info->key.u.ipv4.dst;
-                else
+                        local_ip.sin.sin_addr.s_addr = info->key.u.ipv4.src;
+                } else {
                         remote_ip.sin6.sin6_addr = info->key.u.ipv6.dst;
+                        local_ip.sin6.sin6_addr = info->key.u.ipv6.src;
+                }
                 dst = &remote_ip;
+                src = &local_ip;
                 dst_cache = &info->dst_cache;
         }
 
@@ -1992,15 +1998,14 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
         }
 
         if (dst->sa.sa_family == AF_INET) {
-                __be32 saddr;
-
                 if (!vxlan->vn4_sock)
                         goto drop;
                 sk = vxlan->vn4_sock->sock->sk;
 
                 rt = vxlan_get_route(vxlan, skb,
                                      rdst ? rdst->remote_ifindex : 0, tos,
-                                     dst->sin.sin_addr.s_addr, &saddr,
+                                     dst->sin.sin_addr.s_addr,
+                                     &src->sin.sin_addr.s_addr,
                                      dst_cache, info);
                 if (IS_ERR(rt)) {
                         netdev_dbg(dev, "no route to %pI4\n",
@@ -2017,7 +2022,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 }
 
                 /* Bypass encapsulation if the destination is local */
-                if (rt->rt_flags & RTCF_LOCAL &&
+                if (!info && rt->rt_flags & RTCF_LOCAL &&
                     !(rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))) {
                         struct vxlan_dev *dst_vxlan;
 
@@ -2043,13 +2048,12 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 if (err < 0)
                         goto xmit_tx_error;
 
-                udp_tunnel_xmit_skb(rt, sk, skb, saddr,
+                udp_tunnel_xmit_skb(rt, sk, skb, src->sin.sin_addr.s_addr,
                                     dst->sin.sin_addr.s_addr, tos, ttl, df,
                                     src_port, dst_port, xnet, !udp_sum);
 #if IS_ENABLED(CONFIG_IPV6)
         } else {
                 struct dst_entry *ndst;
-                struct in6_addr saddr;
                 u32 rt6i_flags;
 
                 if (!vxlan->vn6_sock)
@@ -2058,7 +2062,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 
                 ndst = vxlan6_get_route(vxlan, skb,
                                         rdst ? rdst->remote_ifindex : 0, tos,
-                                        label, &dst->sin6.sin6_addr, &saddr,
+                                        label, &dst->sin6.sin6_addr,
+                                        &src->sin6.sin6_addr,
                                         dst_cache, info);
                 if (IS_ERR(ndst)) {
                         netdev_dbg(dev, "no route to %pI6\n",
@@ -2077,7 +2082,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 
                 /* Bypass encapsulation if the destination is local */
                 rt6i_flags = ((struct rt6_info *)ndst)->rt6i_flags;
-                if (rt6i_flags & RTF_LOCAL &&
+                if (!info && rt6i_flags & RTF_LOCAL &&
                     !(rt6i_flags & (RTCF_BROADCAST | RTCF_MULTICAST))) {
                         struct vxlan_dev *dst_vxlan;
 
@@ -2104,7 +2109,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                         return;
                 }
                 udp_tunnel6_xmit_skb(ndst, sk, skb, dev,
-                                     &saddr, &dst->sin6.sin6_addr, tos, ttl,
+                                     &src->sin6.sin6_addr,
+                                     &dst->sin6.sin6_addr, tos, ttl,
                                      label, src_port, dst_port, !udp_sum);
 #endif
         }
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 1d689169da76..9e1f2d9c9865 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -5700,10 +5700,11 @@ out:
         mutex_unlock(&wl->mutex);
 }
 
-static u32 wlcore_op_get_expected_throughput(struct ieee80211_sta *sta)
+static u32 wlcore_op_get_expected_throughput(struct ieee80211_hw *hw,
+                                             struct ieee80211_sta *sta)
 {
         struct wl1271_station *wl_sta = (struct wl1271_station *)sta->drv_priv;
-        struct wl1271 *wl = wl_sta->wl;
+        struct wl1271 *wl = hw->priv;
         u8 hlid = wl_sta->hlid;
 
         /* return in units of Kbps */
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 7792266db259..3ce69536a7b3 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1631,8 +1631,7 @@ static int __of_parse_phandle_with_args(const struct device_node *np,
          */
 
  err:
-        if (it.node)
-                of_node_put(it.node);
+        of_node_put(it.node);
         return rc;
 }
 
@@ -2343,20 +2342,13 @@ struct device_node *of_graph_get_endpoint_by_regs(
         const struct device_node *parent, int port_reg, int reg)
 {
         struct of_endpoint endpoint;
-        struct device_node *node, *prev_node = NULL;
-
-        while (1) {
-                node = of_graph_get_next_endpoint(parent, prev_node);
-                of_node_put(prev_node);
-                if (!node)
-                        break;
+        struct device_node *node = NULL;
 
+        for_each_endpoint_of_node(parent, node) {
                 of_graph_parse_endpoint(node, &endpoint);
                 if (((port_reg == -1) || (endpoint.port == port_reg)) &&
                         ((reg == -1) || (endpoint.id == reg)))
                         return node;
-
-                prev_node = node;
         }
 
         return NULL;
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 55f1b8391149..085c6389afd1 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -517,7 +517,7 @@ static void *__unflatten_device_tree(const void *blob,
                 pr_warning("End of tree marker overwritten: %08x\n",
                            be32_to_cpup(mem + size));
 
-        if (detached) {
+        if (detached && mynodes) {
                 of_node_set_flag(*mynodes, OF_DETACHED);
                 pr_debug("unflattened tree is detached\n");
         }
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 89a71c6074fc..a2e68f740eda 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -544,12 +544,15 @@ void __init of_irq_init(const struct of_device_id *matches)
 
                         list_del(&desc->list);
 
+                        of_node_set_flag(desc->dev, OF_POPULATED);
+
                         pr_debug("of_irq_init: init %s (%p), parent %p\n",
                                  desc->dev->full_name,
                                  desc->dev, desc->interrupt_parent);
                         ret = desc->irq_init_cb(desc->dev,
                                                 desc->interrupt_parent);
                         if (ret) {
+                                of_node_clear_flag(desc->dev, OF_POPULATED);
                                 kfree(desc);
                                 continue;
                         }
@@ -559,8 +562,6 @@ void __init of_irq_init(const struct of_device_id *matches)
                          * its children can get processed in a subsequent pass.
                          */
                         list_add_tail(&desc->list, &intc_parent_list);
-
-                        of_node_set_flag(desc->dev, OF_POPULATED);
                 }
 
                 /* Get the next pending parent that might have children */
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 8aa197691074..f39ccd5aa701 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -497,6 +497,7 @@ int of_platform_default_populate(struct device_node *root,
 }
 EXPORT_SYMBOL_GPL(of_platform_default_populate);
 
+#ifndef CONFIG_PPC
 static int __init of_platform_default_populate_init(void)
 {
         struct device_node *node;
@@ -521,6 +522,7 @@ static int __init of_platform_default_populate_init(void)
         return 0;
 }
 arch_initcall_sync(of_platform_default_populate_init);
+#endif
 
 static int of_platform_device_destroy(struct device *dev, void *data)
 {
diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
index eb4990ff26ca..7fb765642ee7 100644
--- a/drivers/pinctrl/intel/pinctrl-merrifield.c
+++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
@@ -11,6 +11,7 @@
 
 #include <linux/bitops.h>
 #include <linux/err.h>
+#include <linux/io.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/pinctrl/pinconf.h>
diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
index 11623c6b0cb3..44e69c963f5d 100644
--- a/drivers/pinctrl/meson/pinctrl-meson.c
+++ b/drivers/pinctrl/meson/pinctrl-meson.c
@@ -727,13 +727,7 @@ static int meson_pinctrl_probe(struct platform_device *pdev)
                 return PTR_ERR(pc->pcdev);
         }
 
-        ret = meson_gpiolib_register(pc);
-        if (ret) {
-                pinctrl_unregister(pc->pcdev);
-                return ret;
-        }
-
-        return 0;
+        return meson_gpiolib_register(pc);
 }
 
 static struct platform_driver meson_pinctrl_driver = {
diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index 634b4d30eefb..b3e772390ab6 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -43,17 +43,6 @@ static int amd_gpio_direction_input(struct gpio_chip *gc, unsigned offset)
 
         spin_lock_irqsave(&gpio_dev->lock, flags);
         pin_reg = readl(gpio_dev->base + offset * 4);
-        /*
-         * Suppose BIOS or Bootloader sets specific debounce for the
-         * GPIO. if not, set debounce to be  2.75ms and remove glitch.
-        */
-        if ((pin_reg & DB_TMR_OUT_MASK) == 0) {
-                pin_reg |= 0xf;
-                pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
-                pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
-                pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
-        }
-
         pin_reg &= ~BIT(OUTPUT_ENABLE_OFF);
         writel(pin_reg, gpio_dev->base + offset * 4);
         spin_unlock_irqrestore(&gpio_dev->lock, flags);
@@ -326,15 +315,6 @@ static void amd_gpio_irq_enable(struct irq_data *d)
 
         spin_lock_irqsave(&gpio_dev->lock, flags);
         pin_reg = readl(gpio_dev->base + (d->hwirq)*4);
-        /*
-                Suppose BIOS or Bootloader sets specific debounce for the
-                GPIO. if not, set debounce to be  2.75ms.
-        */
-        if ((pin_reg & DB_TMR_OUT_MASK) == 0) {
-                pin_reg |= 0xf;
-                pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
-                pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
-        }
         pin_reg |= BIT(INTERRUPT_ENABLE_OFF);
         pin_reg |= BIT(INTERRUPT_MASK_OFF);
         writel(pin_reg, gpio_dev->base + (d->hwirq)*4);
diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c
index c6d410ef8de0..7bad200bd67c 100644
--- a/drivers/pinctrl/pinctrl-pistachio.c
+++ b/drivers/pinctrl/pinctrl-pistachio.c
@@ -1432,7 +1432,6 @@ static int pistachio_pinctrl_probe(struct platform_device *pdev)
 {
         struct pistachio_pinctrl *pctl;
         struct resource *res;
-        int ret;
 
         pctl = devm_kzalloc(&pdev->dev, sizeof(*pctl), GFP_KERNEL);
         if (!pctl)
@@ -1464,13 +1463,7 @@ static int pistachio_pinctrl_probe(struct platform_device *pdev)
                 return PTR_ERR(pctl->pctldev);
         }
 
-        ret = pistachio_gpio_register(pctl);
-        if (ret < 0) {
-                pinctrl_unregister(pctl->pctldev);
-                return ret;
-        }
-
-        return 0;
+        return pistachio_gpio_register(pctl);
 }
 
 static struct platform_driver pistachio_pinctrl_driver = {
diff --git a/drivers/power/max17042_battery.c b/drivers/power/max17042_battery.c
index 9c65f134d447..da7a75f82489 100644
--- a/drivers/power/max17042_battery.c
+++ b/drivers/power/max17042_battery.c
@@ -457,13 +457,16 @@ static inline void max17042_write_model_data(struct max17042_chip *chip,
 }
 
 static inline void max17042_read_model_data(struct max17042_chip *chip,
-                                        u8 addr, u32 *data, int size)
+                                        u8 addr, u16 *data, int size)
 {
         struct regmap *map = chip->regmap;
         int i;
+        u32 tmp;
 
-        for (i = 0; i < size; i++)
-                regmap_read(map, addr + i, &data[i]);
+        for (i = 0; i < size; i++) {
+                regmap_read(map, addr + i, &tmp);
+                data[i] = (u16)tmp;
+        }
 }
 
 static inline int max17042_model_data_compare(struct max17042_chip *chip,
@@ -486,7 +489,7 @@ static int max17042_init_model(struct max17042_chip *chip)
 {
         int ret;
         int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
-        u32 *temp_data;
+        u16 *temp_data;
 
         temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
         if (!temp_data)
@@ -501,7 +504,7 @@ static int max17042_init_model(struct max17042_chip *chip)
         ret = max17042_model_data_compare(
                 chip,
                 chip->pdata->config_data->cell_char_tbl,
-                (u16 *)temp_data,
+                temp_data,
                 table_size);
 
         max10742_lock_model(chip);
@@ -514,7 +517,7 @@ static int max17042_verify_model_lock(struct max17042_chip *chip)
 {
         int i;
         int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
-        u32 *temp_data;
+        u16 *temp_data;
         int ret = 0;
 
         temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
diff --git a/drivers/power/reset/Kconfig b/drivers/power/reset/Kconfig
index 3bfac539334b..c74c3f67b8da 100644
--- a/drivers/power/reset/Kconfig
+++ b/drivers/power/reset/Kconfig
@@ -200,8 +200,8 @@ config REBOOT_MODE
 config SYSCON_REBOOT_MODE
         tristate "Generic SYSCON regmap reboot mode driver"
         depends on OF
+        depends on MFD_SYSCON
         select REBOOT_MODE
-        select MFD_SYSCON
         help
           Say y here will enable reboot mode driver. This will
           get reboot mode arguments and store it in SYSCON mapped
diff --git a/drivers/power/reset/hisi-reboot.c b/drivers/power/reset/hisi-reboot.c
index 9ab7f562a83b..f69387e12c1e 100644
--- a/drivers/power/reset/hisi-reboot.c
+++ b/drivers/power/reset/hisi-reboot.c
@@ -53,13 +53,16 @@ static int hisi_reboot_probe(struct platform_device *pdev)
 
         if (of_property_read_u32(np, "reboot-offset", &reboot_offset) < 0) {
                 pr_err("failed to find reboot-offset property\n");
+                iounmap(base);
                 return -EINVAL;
         }
 
         err = register_restart_handler(&hisi_restart_nb);
-        if (err)
+        if (err) {
                 dev_err(&pdev->dev, "cannot register restart handler (err=%d)\n",
                         err);
+                iounmap(base);
+        }
 
         return err;
 }
diff --git a/drivers/power/tps65217_charger.c b/drivers/power/tps65217_charger.c
index 73dfae41def8..4c56e54af6ac 100644
--- a/drivers/power/tps65217_charger.c
+++ b/drivers/power/tps65217_charger.c
@@ -206,6 +206,7 @@ static int tps65217_charger_probe(struct platform_device *pdev)
         if (!charger)
                 return -ENOMEM;
 
+        platform_set_drvdata(pdev, charger);
         charger->tps = tps;
         charger->dev = &pdev->dev;
 
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 8973d34ce5ba..fb1b56a71475 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1643,9 +1643,18 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
         u8 *sense = NULL;
         int expires;
 
+        cqr = (struct dasd_ccw_req *) intparm;
         if (IS_ERR(irb)) {
                 switch (PTR_ERR(irb)) {
                 case -EIO:
+                        if (cqr && cqr->status == DASD_CQR_CLEAR_PENDING) {
+                                device = (struct dasd_device *) cqr->startdev;
+                                cqr->status = DASD_CQR_CLEARED;
+                                dasd_device_clear_timer(device);
+                                wake_up(&dasd_flush_wq);
+                                dasd_schedule_device_bh(device);
+                                return;
+                        }
                         break;
                 case -ETIMEDOUT:
                         DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: "
@@ -1661,7 +1670,6 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
         }
 
         now = get_tod_clock();
-        cqr = (struct dasd_ccw_req *) intparm;
         /* check for conditions that should be handled immediately */
         if (!cqr ||
             !(scsw_dstat(&irb->scsw) == (DEV_STAT_CHN_END | DEV_STAT_DEV_END) &&
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index fd2eff440098..98bbec44bcd0 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -5078,6 +5078,8 @@ static int dasd_eckd_read_message_buffer(struct dasd_device *device,
                 return PTR_ERR(cqr);
         }
 
+        cqr->lpm = lpum;
+retry:
         cqr->startdev = device;
         cqr->memdev = device;
         cqr->block = NULL;
@@ -5122,6 +5124,14 @@ static int dasd_eckd_read_message_buffer(struct dasd_device *device,
                         (prssdp + 1);
                 memcpy(messages, message_buf,
                        sizeof(struct dasd_rssd_messages));
+        } else if (cqr->lpm) {
+                /*
+                 * on z/VM we might not be able to do I/O on the requested path
+                 * but instead we get the required information on any path
+                 * so retry with open path mask
+                 */
+                cqr->lpm = 0;
+                goto retry;
         } else
                 DBF_EVENT_DEVID(DBF_WARNING, device->cdev,
                                 "Reading messages failed with rc=%d\n"
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 7ada078ffdd0..6a58bc8f46e2 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -762,7 +762,6 @@ static int io_subchannel_initialize_dev(struct subchannel *sch,
         priv->state = DEV_STATE_NOT_OPER;
         priv->dev_id.devno = sch->schib.pmcw.dev;
         priv->dev_id.ssid = sch->schid.ssid;
-        priv->schid = sch->schid;
 
         INIT_WORK(&priv->todo_work, ccw_device_todo);
         INIT_LIST_HEAD(&priv->cmb_list);
@@ -1000,7 +999,6 @@ static int ccw_device_move_to_sch(struct ccw_device *cdev,
         put_device(&old_sch->dev);
         /* Initialize new subchannel. */
         spin_lock_irq(sch->lock);
-        cdev->private->schid = sch->schid;
         cdev->ccwlock = sch->lock;
         if (!sch_is_pseudo_sch(sch))
                 sch_set_cdev(sch, cdev);
diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index 15b56a15db15..9bc3512374c9 100644
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -26,6 +26,7 @@
 static void
 ccw_device_msg_control_check(struct ccw_device *cdev, struct irb *irb)
 {
+        struct subchannel *sch = to_subchannel(cdev->dev.parent);
         char dbf_text[15];
 
         if (!scsw_is_valid_cstat(&irb->scsw) ||
@@ -36,10 +37,10 @@ ccw_device_msg_control_check(struct ccw_device *cdev, struct irb *irb)
                       "received"
                       " ... device %04x on subchannel 0.%x.%04x, dev_stat "
                       ": %02X sch_stat : %02X\n",
-                      cdev->private->dev_id.devno, cdev->private->schid.ssid,
-                      cdev->private->schid.sch_no,
+                      cdev->private->dev_id.devno, sch->schid.ssid,
+                      sch->schid.sch_no,
                       scsw_dstat(&irb->scsw), scsw_cstat(&irb->scsw));
-        sprintf(dbf_text, "chk%x", cdev->private->schid.sch_no);
+        sprintf(dbf_text, "chk%x", sch->schid.sch_no);
         CIO_TRACE_EVENT(0, dbf_text);
         CIO_HEX_EVENT(0, irb, sizeof(struct irb));
 }
diff --git a/drivers/s390/cio/io_sch.h b/drivers/s390/cio/io_sch.h
index 8975060af96c..220f49145b2f 100644
--- a/drivers/s390/cio/io_sch.h
+++ b/drivers/s390/cio/io_sch.h
@@ -120,7 +120,6 @@ struct ccw_device_private {
         int state;              /* device state */
         atomic_t onoff;
         struct ccw_dev_id dev_id;       /* device id */
-        struct subchannel_id schid;     /* subchannel number */
         struct ccw_request req;         /* internal I/O request */
         int iretry;
         u8 pgid_valid_mask;     /* mask of valid PGIDs */
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 4bb5262f7aee..71bf9bded485 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -686,6 +686,15 @@ static void qdio_kick_handler(struct qdio_q *q)
         q->qdio_error = 0;
 }
 
+static inline int qdio_tasklet_schedule(struct qdio_q *q)
+{
+        if (likely(q->irq_ptr->state == QDIO_IRQ_STATE_ACTIVE)) {
+                tasklet_schedule(&q->tasklet);
+                return 0;
+        }
+        return -EPERM;
+}
+
 static void __qdio_inbound_processing(struct qdio_q *q)
 {
         qperf_inc(q, tasklet_inbound);
@@ -698,10 +707,8 @@ static void __qdio_inbound_processing(struct qdio_q *q)
         if (!qdio_inbound_q_done(q)) {
                 /* means poll time is not yet over */
                 qperf_inc(q, tasklet_inbound_resched);
-                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED)) {
-                        tasklet_schedule(&q->tasklet);
+                if (!qdio_tasklet_schedule(q))
                         return;
-                }
         }
 
         qdio_stop_polling(q);
@@ -711,8 +718,7 @@ static void __qdio_inbound_processing(struct qdio_q *q)
          */
         if (!qdio_inbound_q_done(q)) {
                 qperf_inc(q, tasklet_inbound_resched2);
-                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED))
-                        tasklet_schedule(&q->tasklet);
+                qdio_tasklet_schedule(q);
         }
 }
 
@@ -869,16 +875,15 @@ static void __qdio_outbound_processing(struct qdio_q *q)
          * is noticed and outbound_handler is called after some time.
          */
         if (qdio_outbound_q_done(q))
-                del_timer(&q->u.out.timer);
+                del_timer_sync(&q->u.out.timer);
         else
-                if (!timer_pending(&q->u.out.timer))
+                if (!timer_pending(&q->u.out.timer) &&
+                    likely(q->irq_ptr->state == QDIO_IRQ_STATE_ACTIVE))
                         mod_timer(&q->u.out.timer, jiffies + 10 * HZ);
         return;
 
 sched:
-        if (unlikely(q->irq_ptr->state == QDIO_IRQ_STATE_STOPPED))
-                return;
-        tasklet_schedule(&q->tasklet);
+        qdio_tasklet_schedule(q);
 }
 
 /* outbound tasklet */
@@ -892,9 +897,7 @@ void qdio_outbound_timer(unsigned long data)
 {
         struct qdio_q *q = (struct qdio_q *)data;
 
-        if (unlikely(q->irq_ptr->state == QDIO_IRQ_STATE_STOPPED))
-                return;
-        tasklet_schedule(&q->tasklet);
+        qdio_tasklet_schedule(q);
 }
 
 static inline void qdio_check_outbound_after_thinint(struct qdio_q *q)
@@ -907,7 +910,7 @@ static inline void qdio_check_outbound_after_thinint(struct qdio_q *q)
 
         for_each_output_queue(q->irq_ptr, out, i)
                 if (!qdio_outbound_q_done(out))
-                        tasklet_schedule(&out->tasklet);
+                        qdio_tasklet_schedule(out);
 }
 
 static void __tiqdio_inbound_processing(struct qdio_q *q)
@@ -929,10 +932,8 @@ static void __tiqdio_inbound_processing(struct qdio_q *q)
 
         if (!qdio_inbound_q_done(q)) {
                 qperf_inc(q, tasklet_inbound_resched);
-                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED)) {
-                        tasklet_schedule(&q->tasklet);
+                if (!qdio_tasklet_schedule(q))
                         return;
-                }
         }
 
         qdio_stop_polling(q);
@@ -942,8 +943,7 @@ static void __tiqdio_inbound_processing(struct qdio_q *q)
          */
         if (!qdio_inbound_q_done(q)) {
                 qperf_inc(q, tasklet_inbound_resched2);
-                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED))
-                        tasklet_schedule(&q->tasklet);
+                qdio_tasklet_schedule(q);
         }
 }
 
@@ -977,7 +977,7 @@ static void qdio_int_handler_pci(struct qdio_irq *irq_ptr)
         int i;
         struct qdio_q *q;
 
-        if (unlikely(irq_ptr->state == QDIO_IRQ_STATE_STOPPED))
+        if (unlikely(irq_ptr->state != QDIO_IRQ_STATE_ACTIVE))
                 return;
 
         for_each_input_queue(irq_ptr, q, i) {
@@ -1003,7 +1003,7 @@ static void qdio_int_handler_pci(struct qdio_irq *irq_ptr)
                         continue;
                 if (need_siga_sync(q) && need_siga_sync_out_after_pci(q))
                         qdio_siga_sync_q(q);
-                tasklet_schedule(&q->tasklet);
+                qdio_tasklet_schedule(q);
         }
 }
 
@@ -1066,10 +1066,12 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
                       struct irb *irb)
 {
         struct qdio_irq *irq_ptr = cdev->private->qdio_data;
+        struct subchannel_id schid;
         int cstat, dstat;
 
         if (!intparm || !irq_ptr) {
-                DBF_ERROR("qint:%4x", cdev->private->schid.sch_no);
+                ccw_device_get_schid(cdev, &schid);
+                DBF_ERROR("qint:%4x", schid.sch_no);
                 return;
         }
 
@@ -1122,12 +1124,14 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
 int qdio_get_ssqd_desc(struct ccw_device *cdev,
                        struct qdio_ssqd_desc *data)
 {
+        struct subchannel_id schid;
 
         if (!cdev || !cdev->private)
                 return -EINVAL;
 
-        DBF_EVENT("get ssqd:%4x", cdev->private->schid.sch_no);
-        return qdio_setup_get_ssqd(NULL, &cdev->private->schid, data);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("get ssqd:%4x", schid.sch_no);
+        return qdio_setup_get_ssqd(NULL, &schid, data);
 }
 EXPORT_SYMBOL_GPL(qdio_get_ssqd_desc);
 
@@ -1141,7 +1145,7 @@ static void qdio_shutdown_queues(struct ccw_device *cdev)
                 tasklet_kill(&q->tasklet);
 
         for_each_output_queue(irq_ptr, q, i) {
-                del_timer(&q->u.out.timer);
+                del_timer_sync(&q->u.out.timer);
                 tasklet_kill(&q->tasklet);
         }
 }
@@ -1154,14 +1158,15 @@ static void qdio_shutdown_queues(struct ccw_device *cdev)
 int qdio_shutdown(struct ccw_device *cdev, int how)
 {
         struct qdio_irq *irq_ptr = cdev->private->qdio_data;
+        struct subchannel_id schid;
         int rc;
-        unsigned long flags;
 
         if (!irq_ptr)
                 return -ENODEV;
 
         WARN_ON_ONCE(irqs_disabled());
-        DBF_EVENT("qshutdown:%4x", cdev->private->schid.sch_no);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("qshutdown:%4x", schid.sch_no);
 
         mutex_lock(&irq_ptr->setup_mutex);
         /*
@@ -1184,7 +1189,7 @@ int qdio_shutdown(struct ccw_device *cdev, int how)
         qdio_shutdown_debug_entries(irq_ptr);
 
         /* cleanup subchannel */
-        spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
+        spin_lock_irq(get_ccwdev_lock(cdev));
 
         if (how & QDIO_FLAG_CLEANUP_USING_CLEAR)
                 rc = ccw_device_clear(cdev, QDIO_DOING_CLEANUP);
@@ -1198,12 +1203,12 @@ int qdio_shutdown(struct ccw_device *cdev, int how)
         }
 
         qdio_set_state(irq_ptr, QDIO_IRQ_STATE_CLEANUP);
-        spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
+        spin_unlock_irq(get_ccwdev_lock(cdev));
         wait_event_interruptible_timeout(cdev->private->wait_q,
                 irq_ptr->state == QDIO_IRQ_STATE_INACTIVE ||
                 irq_ptr->state == QDIO_IRQ_STATE_ERR,
                 10 * HZ);
-        spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
+        spin_lock_irq(get_ccwdev_lock(cdev));
 
 no_cleanup:
         qdio_shutdown_thinint(irq_ptr);
@@ -1211,7 +1216,7 @@ no_cleanup:
         /* restore interrupt handler */
         if ((void *)cdev->handler == (void *)qdio_int_handler)
                 cdev->handler = irq_ptr->orig_handler;
-        spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
+        spin_unlock_irq(get_ccwdev_lock(cdev));
 
         qdio_set_state(irq_ptr, QDIO_IRQ_STATE_INACTIVE);
         mutex_unlock(&irq_ptr->setup_mutex);
@@ -1228,11 +1233,13 @@ EXPORT_SYMBOL_GPL(qdio_shutdown);
 int qdio_free(struct ccw_device *cdev)
 {
         struct qdio_irq *irq_ptr = cdev->private->qdio_data;
+        struct subchannel_id schid;
 
         if (!irq_ptr)
                 return -ENODEV;
 
-        DBF_EVENT("qfree:%4x", cdev->private->schid.sch_no);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("qfree:%4x", schid.sch_no);
         DBF_DEV_EVENT(DBF_ERR, irq_ptr, "dbf abandoned");
         mutex_lock(&irq_ptr->setup_mutex);
 
@@ -1251,9 +1258,11 @@ EXPORT_SYMBOL_GPL(qdio_free);
  */
 int qdio_allocate(struct qdio_initialize *init_data)
 {
+        struct subchannel_id schid;
         struct qdio_irq *irq_ptr;
 
-        DBF_EVENT("qallocate:%4x", init_data->cdev->private->schid.sch_no);
+        ccw_device_get_schid(init_data->cdev, &schid);
+        DBF_EVENT("qallocate:%4x", schid.sch_no);
 
         if ((init_data->no_input_qs && !init_data->input_handler) ||
             (init_data->no_output_qs && !init_data->output_handler))
@@ -1331,20 +1340,18 @@ static void qdio_detect_hsicq(struct qdio_irq *irq_ptr)
  */
 int qdio_establish(struct qdio_initialize *init_data)
 {
-        struct qdio_irq *irq_ptr;
         struct ccw_device *cdev = init_data->cdev;
-        unsigned long saveflags;
+        struct subchannel_id schid;
+        struct qdio_irq *irq_ptr;
         int rc;
 
-        DBF_EVENT("qestablish:%4x", cdev->private->schid.sch_no);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("qestablish:%4x", schid.sch_no);
 
         irq_ptr = cdev->private->qdio_data;
         if (!irq_ptr)
                 return -ENODEV;
 
-        if (cdev->private->state != DEV_STATE_ONLINE)
-                return -EINVAL;
-
         mutex_lock(&irq_ptr->setup_mutex);
         qdio_setup_irq(init_data);
 
@@ -1361,17 +1368,14 @@ int qdio_establish(struct qdio_initialize *init_data)
         irq_ptr->ccw.count = irq_ptr->equeue.count;
         irq_ptr->ccw.cda = (u32)((addr_t)irq_ptr->qdr);
 
-        spin_lock_irqsave(get_ccwdev_lock(cdev), saveflags);
+        spin_lock_irq(get_ccwdev_lock(cdev));
         ccw_device_set_options_mask(cdev, 0);
 
         rc = ccw_device_start(cdev, &irq_ptr->ccw, QDIO_DOING_ESTABLISH, 0, 0);
+        spin_unlock_irq(get_ccwdev_lock(cdev));
         if (rc) {
                 DBF_ERROR("%4x est IO ERR", irq_ptr->schid.sch_no);
                 DBF_ERROR("rc:%4x", rc);
-        }
-        spin_unlock_irqrestore(get_ccwdev_lock(cdev), saveflags);
-
-        if (rc) {
                 mutex_unlock(&irq_ptr->setup_mutex);
                 qdio_shutdown(cdev, QDIO_FLAG_CLEANUP_USING_CLEAR);
                 return rc;
@@ -1407,19 +1411,17 @@ EXPORT_SYMBOL_GPL(qdio_establish);
  */
 int qdio_activate(struct ccw_device *cdev)
 {
+        struct subchannel_id schid;
         struct qdio_irq *irq_ptr;
         int rc;
-        unsigned long saveflags;
 
-        DBF_EVENT("qactivate:%4x", cdev->private->schid.sch_no);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("qactivate:%4x", schid.sch_no);
 
         irq_ptr = cdev->private->qdio_data;
         if (!irq_ptr)
                 return -ENODEV;
 
-        if (cdev->private->state != DEV_STATE_ONLINE)
-                return -EINVAL;
-
         mutex_lock(&irq_ptr->setup_mutex);
         if (irq_ptr->state == QDIO_IRQ_STATE_INACTIVE) {
                 rc = -EBUSY;
@@ -1431,19 +1433,17 @@ int qdio_activate(struct ccw_device *cdev)
         irq_ptr->ccw.count = irq_ptr->aqueue.count;
         irq_ptr->ccw.cda = 0;
 
-        spin_lock_irqsave(get_ccwdev_lock(cdev), saveflags);
+        spin_lock_irq(get_ccwdev_lock(cdev));
         ccw_device_set_options(cdev, CCWDEV_REPORT_ALL);
 
         rc = ccw_device_start(cdev, &irq_ptr->ccw, QDIO_DOING_ACTIVATE,
                               0, DOIO_DENY_PREFETCH);
+        spin_unlock_irq(get_ccwdev_lock(cdev));
         if (rc) {
                 DBF_ERROR("%4x act IO ERR", irq_ptr->schid.sch_no);
                 DBF_ERROR("rc:%4x", rc);
-        }
-        spin_unlock_irqrestore(get_ccwdev_lock(cdev), saveflags);
-
-        if (rc)
                 goto out;
+        }
 
         if (is_thinint_irq(irq_ptr))
                 tiqdio_add_input_queues(irq_ptr);
@@ -1585,10 +1585,11 @@ static int handle_outbound(struct qdio_q *q, unsigned int callflags,
 
         /* in case of SIGA errors we must process the error immediately */
         if (used >= q->u.out.scan_threshold || rc)
-                tasklet_schedule(&q->tasklet);
+                qdio_tasklet_schedule(q);
         else
                 /* free the SBALs in case of no further traffic */
-                if (!timer_pending(&q->u.out.timer))
+                if (!timer_pending(&q->u.out.timer) &&
+                    likely(q->irq_ptr->state == QDIO_IRQ_STATE_ACTIVE))
                         mod_timer(&q->u.out.timer, jiffies + HZ);
         return rc;
 }
diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
index b381b3718a98..5648b715fed9 100644
--- a/drivers/scsi/aacraid/commctrl.c
+++ b/drivers/scsi/aacraid/commctrl.c
@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
         struct fib *fibptr;
         struct hw_fib * hw_fib = (struct hw_fib *)0;
         dma_addr_t hw_fib_pa = (dma_addr_t)0LL;
-        unsigned size;
+        unsigned int size, osize;
         int retval;
 
         if (dev->in_reset) {
@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
          *      will not overrun the buffer when we copy the memory. Return
          *      an error if we would.
          */
-        size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr);
+        osize = size = le16_to_cpu(kfib->header.Size) +
+                sizeof(struct aac_fibhdr);
         if (size < le16_to_cpu(kfib->header.SenderSize))
                 size = le16_to_cpu(kfib->header.SenderSize);
         if (size > dev->max_fib_size) {
@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
                 goto cleanup;
         }
 
+        /* Sanity check the second copy */
+        if ((osize != le16_to_cpu(kfib->header.Size) +
+                sizeof(struct aac_fibhdr))
+                || (size < le16_to_cpu(kfib->header.SenderSize))) {
+                retval = -EINVAL;
+                goto cleanup;
+        }
+
         if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) {
                 aac_adapter_interrupt(dev);
                 /*
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index a569c65f22b1..dcf36537a767 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -2923,7 +2923,7 @@ static int fcoe_ctlr_vlan_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
         mutex_unlock(&fip->ctlr_mutex);
 
 drop:
-        kfree(skb);
+        kfree_skb(skb);
         return rc;
 }
 
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 2dab3dc2aa69..c1ed25adb17e 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -5037,7 +5037,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
         /* Find first memory bar */
         bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM);
         instance->bar = find_first_bit(&bar_list, sizeof(unsigned long));
-        if (pci_request_selected_regions(instance->pdev, instance->bar,
+        if (pci_request_selected_regions(instance->pdev, 1<<instance->bar,
                                          "megasas: LSI")) {
                 dev_printk(KERN_DEBUG, &instance->pdev->dev, "IO memory region busy!\n");
                 return -EBUSY;
@@ -5339,7 +5339,7 @@ fail_ready_state:
         iounmap(instance->reg_set);
 
       fail_ioremap:
-        pci_release_selected_regions(instance->pdev, instance->bar);
+        pci_release_selected_regions(instance->pdev, 1<<instance->bar);
 
         return -EINVAL;
 }
@@ -5360,7 +5360,7 @@ static void megasas_release_mfi(struct megasas_instance *instance)
 
         iounmap(instance->reg_set);
 
-        pci_release_selected_regions(instance->pdev, instance->bar);
+        pci_release_selected_regions(instance->pdev, 1<<instance->bar);
 }
 
 /**
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index ec837544f784..52d8bbf7feb5 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -2603,7 +2603,7 @@ megasas_release_fusion(struct megasas_instance *instance)
 
         iounmap(instance->reg_set);
 
-        pci_release_selected_regions(instance->pdev, instance->bar);
+        pci_release_selected_regions(instance->pdev, 1<<instance->bar);
 }
 
 /**
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 751f13edece0..750f82c339d4 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -2188,6 +2188,17 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc)
         } else
                 ioc->msix96_vector = 0;
 
+        if (ioc->is_warpdrive) {
+                ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
+                    &ioc->chip->ReplyPostHostIndex;
+
+                for (i = 1; i < ioc->cpu_msix_table_sz; i++)
+                        ioc->reply_post_host_index[i] =
+                        (resource_size_t __iomem *)
+                        ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
+                        * 4)));
+        }
+
         list_for_each_entry(reply_q, &ioc->reply_queue_list, list)
                 pr_info(MPT3SAS_FMT "%s: IRQ %d\n",
                     reply_q->name,  ((ioc->msix_enable) ? "PCI-MSI-X enabled" :
@@ -5280,17 +5291,6 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc)
         if (r)
                 goto out_free_resources;
 
-        if (ioc->is_warpdrive) {
-                ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
-                    &ioc->chip->ReplyPostHostIndex;
-
-                for (i = 1; i < ioc->cpu_msix_table_sz; i++)
-                        ioc->reply_post_host_index[i] =
-                        (resource_size_t __iomem *)
-                        ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
-                        * 4)));
-        }
-
         pci_set_drvdata(ioc->pdev, ioc->shost);
         r = _base_get_ioc_facts(ioc, CAN_SLEEP);
         if (r)
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 53ef1cb6418e..0e8601aa877a 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -778,6 +778,8 @@ static void ses_intf_remove_enclosure(struct scsi_device *sdev)
         if (!edev)
                 return;
 
+        enclosure_unregister(edev);
+
         ses_dev = edev->scratch;
         edev->scratch = NULL;
 
@@ -789,7 +791,6 @@ static void ses_intf_remove_enclosure(struct scsi_device *sdev)
         kfree(edev->component[0].scratch);
 
         put_device(&edev->edev);
-        enclosure_unregister(edev);
 }
 
 static void ses_intf_remove(struct device *cdev,
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 71912301ef7f..0f3f62e81e5b 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1354,7 +1354,6 @@ made_compressed_probe:
         spin_lock_init(&acm->write_lock);
         spin_lock_init(&acm->read_lock);
         mutex_init(&acm->mutex);
-        acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress);
         acm->is_int_ep = usb_endpoint_xfer_int(epread);
         if (acm->is_int_ep)
                 acm->bInterval = epread->bInterval;
@@ -1394,14 +1393,14 @@ made_compressed_probe:
                 urb->transfer_dma = rb->dma;
                 if (acm->is_int_ep) {
                         usb_fill_int_urb(urb, acm->dev,
-                                         acm->rx_endpoint,
+                                         usb_rcvintpipe(usb_dev, epread->bEndpointAddress),
                                          rb->base,
                                          acm->readsize,
                                          acm_read_bulk_callback, rb,
                                          acm->bInterval);
                 } else {
                         usb_fill_bulk_urb(urb, acm->dev,
-                                          acm->rx_endpoint,
+                                          usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress),
                                           rb->base,
                                           acm->readsize,
                                           acm_read_bulk_callback, rb);
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index 05ce308d5d2a..1f1eabfd8462 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -96,7 +96,6 @@ struct acm {
         struct acm_rb read_buffers[ACM_NR];
         struct acm_wb *putbuffer;                       /* for acm_tty_put_char() */
         int rx_buflimit;
-        int rx_endpoint;
         spinlock_t read_lock;
         int write_used;                                 /* number of non-empty write buffers */
         int transmitting;
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 31ccdccd7a04..051163189810 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -171,6 +171,31 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
                                                         ep, buffer, size);
 }
 
+static const unsigned short low_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 8,
+        [USB_ENDPOINT_XFER_ISOC] = 0,
+        [USB_ENDPOINT_XFER_BULK] = 0,
+        [USB_ENDPOINT_XFER_INT] = 8,
+};
+static const unsigned short full_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 64,
+        [USB_ENDPOINT_XFER_ISOC] = 1023,
+        [USB_ENDPOINT_XFER_BULK] = 64,
+        [USB_ENDPOINT_XFER_INT] = 64,
+};
+static const unsigned short high_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 64,
+        [USB_ENDPOINT_XFER_ISOC] = 1024,
+        [USB_ENDPOINT_XFER_BULK] = 512,
+        [USB_ENDPOINT_XFER_INT] = 1023,
+};
+static const unsigned short super_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 512,
+        [USB_ENDPOINT_XFER_ISOC] = 1024,
+        [USB_ENDPOINT_XFER_BULK] = 1024,
+        [USB_ENDPOINT_XFER_INT] = 1024,
+};
+
 static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
     int asnum, struct usb_host_interface *ifp, int num_ep,
     unsigned char *buffer, int size)
@@ -179,6 +204,8 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
         struct usb_endpoint_descriptor *d;
         struct usb_host_endpoint *endpoint;
         int n, i, j, retval;
+        unsigned int maxp;
+        const unsigned short *maxpacket_maxes;
 
         d = (struct usb_endpoint_descriptor *) buffer;
         buffer += d->bLength;
@@ -286,6 +313,42 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                         endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
         }
 
+        /* Validate the wMaxPacketSize field */
+        maxp = usb_endpoint_maxp(&endpoint->desc);
+
+        /* Find the highest legal maxpacket size for this endpoint */
+        i = 0;          /* additional transactions per microframe */
+        switch (to_usb_device(ddev)->speed) {
+        case USB_SPEED_LOW:
+                maxpacket_maxes = low_speed_maxpacket_maxes;
+                break;
+        case USB_SPEED_FULL:
+                maxpacket_maxes = full_speed_maxpacket_maxes;
+                break;
+        case USB_SPEED_HIGH:
+                /* Bits 12..11 are allowed only for HS periodic endpoints */
+                if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
+                        i = maxp & (BIT(12) | BIT(11));
+                        maxp &= ~i;
+                }
+                /* fallthrough */
+        default:
+                maxpacket_maxes = high_speed_maxpacket_maxes;
+                break;
+        case USB_SPEED_SUPER:
+        case USB_SPEED_SUPER_PLUS:
+                maxpacket_maxes = super_speed_maxpacket_maxes;
+                break;
+        }
+        j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)];
+
+        if (maxp > j) {
+                dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n",
+                    cfgno, inum, asnum, d->bEndpointAddress, maxp, j);
+                maxp = j;
+                endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp);
+        }
+
         /*
          * Some buggy high speed devices have bulk endpoints using
          * maxpacket sizes other than 512.  High speed HCDs may not
@@ -293,9 +356,6 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
          */
         if (to_usb_device(ddev)->speed == USB_SPEED_HIGH
                         && usb_endpoint_xfer_bulk(d)) {
-                unsigned maxp;
-
-                maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff;
                 if (maxp != 512)
                         dev_warn(ddev, "config %d interface %d altsetting %d "
                                 "bulk endpoint 0x%X has invalid maxpacket %d\n",
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index e9f5043a2167..e6a6d67c8705 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -241,7 +241,8 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
                 goto error_decrease_mem;
         }
 
-        mem = usb_alloc_coherent(ps->dev, size, GFP_USER, &dma_handle);
+        mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN,
+                        &dma_handle);
         if (!mem) {
                 ret = -ENOMEM;
                 goto error_free_usbm;
@@ -2582,7 +2583,9 @@ static unsigned int usbdev_poll(struct file *file,
         if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
                 mask |= POLLOUT | POLLWRNORM;
         if (!connected(ps))
-                mask |= POLLERR | POLLHUP;
+                mask |= POLLHUP;
+        if (list_empty(&ps->list))
+                mask |= POLLERR;
         return mask;
 }
 
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index bee13517676f..1d5fc32d06d0 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1052,14 +1052,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 
         /* Continue a partial initialization */
         if (type == HUB_INIT2 || type == HUB_INIT3) {
-                device_lock(hub->intfdev);
+                device_lock(&hdev->dev);
 
                 /* Was the hub disconnected while we were waiting? */
-                if (hub->disconnected) {
-                        device_unlock(hub->intfdev);
-                        kref_put(&hub->kref, hub_release);
-                        return;
-                }
+                if (hub->disconnected)
+                        goto disconnected;
                 if (type == HUB_INIT2)
                         goto init2;
                 goto init3;
@@ -1262,7 +1259,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
                         queue_delayed_work(system_power_efficient_wq,
                                         &hub->init_work,
                                         msecs_to_jiffies(delay));
-                        device_unlock(hub->intfdev);
+                        device_unlock(&hdev->dev);
                         return;         /* Continues at init3: below */
                 } else {
                         msleep(delay);
@@ -1281,12 +1278,12 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
         /* Scan all ports that need attention */
         kick_hub_wq(hub);
 
-        /* Allow autosuspend if it was suppressed */
-        if (type <= HUB_INIT3)
+        if (type == HUB_INIT2 || type == HUB_INIT3) {
+                /* Allow autosuspend if it was suppressed */
+ disconnected:
                 usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
-
-        if (type == HUB_INIT2 || type == HUB_INIT3)
-                device_unlock(hub->intfdev);
+                device_unlock(&hdev->dev);
+        }
 
         kref_put(&hub->kref, hub_release);
 }
@@ -1315,8 +1312,6 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type)
         struct usb_device *hdev = hub->hdev;
         int i;
 
-        cancel_delayed_work_sync(&hub->init_work);
-
         /* hub_wq and related activity won't re-trigger */
         hub->quiescing = 1;
 
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index 974335377d9f..e56d59b19a0e 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -61,6 +61,7 @@ static int dwc3_of_simple_probe(struct platform_device *pdev)
         if (!simple->clks)
                 return -ENOMEM;
 
+        platform_set_drvdata(pdev, simple);
         simple->dev = dev;
 
         for (i = 0; i < simple->num_clocks; i++) {
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 45f5a232d9fb..2eb84d6c24a6 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -37,6 +37,7 @@
 #define PCI_DEVICE_ID_INTEL_BXT                 0x0aaa
 #define PCI_DEVICE_ID_INTEL_BXT_M               0x1aaa
 #define PCI_DEVICE_ID_INTEL_APL                 0x5aaa
+#define PCI_DEVICE_ID_INTEL_KBP                 0xa2b0
 
 static const struct acpi_gpio_params reset_gpios = { 0, 0, false };
 static const struct acpi_gpio_params cs_gpios = { 1, 0, false };
@@ -227,6 +228,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT_M), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
         {  }    /* Terminating Entry */
 };
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 8f8c2157910e..1f5597ef945d 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -829,7 +829,7 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
         if (!req->request.no_interrupt && !chain)
                 trb->ctrl |= DWC3_TRB_CTRL_IOC | DWC3_TRB_CTRL_ISP_IMI;
 
-        if (last)
+        if (last && !usb_endpoint_xfer_isoc(dep->endpoint.desc))
                 trb->ctrl |= DWC3_TRB_CTRL_LST;
 
         if (chain)
@@ -1955,7 +1955,8 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
 
 static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
                 struct dwc3_request *req, struct dwc3_trb *trb,
-                const struct dwc3_event_depevt *event, int status)
+                const struct dwc3_event_depevt *event, int status,
+                int chain)
 {
         unsigned int            count;
         unsigned int            s_pkt = 0;
@@ -1964,17 +1965,22 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
         dep->queued_requests--;
         trace_dwc3_complete_trb(dep, trb);
 
+        /*
+         * If we're in the middle of series of chained TRBs and we
+         * receive a short transfer along the way, DWC3 will skip
+         * through all TRBs including the last TRB in the chain (the
+         * where CHN bit is zero. DWC3 will also avoid clearing HWO
+         * bit and SW has to do it manually.
+         *
+         * We're going to do that here to avoid problems of HW trying
+         * to use bogus TRBs for transfers.
+         */
+        if (chain && (trb->ctrl & DWC3_TRB_CTRL_HWO))
+                trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+
         if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
-                /*
-                 * We continue despite the error. There is not much we
-                 * can do. If we don't clean it up we loop forever. If
-                 * we skip the TRB then it gets overwritten after a
-                 * while since we use them in a ring buffer. A BUG()
-                 * would help. Lets hope that if this occurs, someone
-                 * fixes the root cause instead of looking away :)
-                 */
-                dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n",
-                                dep->name, trb);
+                return 1;
+
         count = trb->size & DWC3_TRB_SIZE_MASK;
 
         if (dep->direction) {
@@ -2013,15 +2019,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
                         s_pkt = 1;
         }
 
-        /*
-         * We assume here we will always receive the entire data block
-         * which we should receive. Meaning, if we program RX to
-         * receive 4K but we receive only 2K, we assume that's all we
-         * should receive and we simply bounce the request back to the
-         * gadget driver for further processing.
-         */
-        req->request.actual += req->request.length - count;
-        if (s_pkt)
+        if (s_pkt && !chain)
                 return 1;
         if ((event->status & DEPEVT_STATUS_LST) &&
                         (trb->ctrl & (DWC3_TRB_CTRL_LST |
@@ -2040,13 +2038,17 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
         struct dwc3_trb         *trb;
         unsigned int            slot;
         unsigned int            i;
+        int                     count = 0;
         int                     ret;
 
         do {
+                int chain;
+
                 req = next_request(&dep->started_list);
                 if (WARN_ON_ONCE(!req))
                         return 1;
 
+                chain = req->request.num_mapped_sgs > 0;
                 i = 0;
                 do {
                         slot = req->first_trb_index + i;
@@ -2054,13 +2056,22 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
                                 slot++;
                         slot %= DWC3_TRB_NUM;
                         trb = &dep->trb_pool[slot];
+                        count += trb->size & DWC3_TRB_SIZE_MASK;
 
                         ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb,
-                                        event, status);
+                                        event, status, chain);
                         if (ret)
                                 break;
                 } while (++i < req->request.num_mapped_sgs);
 
+                /*
+                 * We assume here we will always receive the entire data block
+                 * which we should receive. Meaning, if we program RX to
+                 * receive 4K but we receive only 2K, we assume that's all we
+                 * should receive and we simply bounce the request back to the
+                 * gadget driver for further processing.
+                 */
+                req->request.actual += req->request.length - count;
                 dwc3_gadget_giveback(dep, req, status);
 
                 if (ret)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index eb648485a58c..5ebe6af7976e 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1913,6 +1913,8 @@ unknown:
                         break;
 
                 case USB_RECIP_ENDPOINT:
+                        if (!cdev->config)
+                                break;
                         endp = ((w_index & 0x80) >> 3) | (w_index & 0x0f);
                         list_for_each_entry(f, &cdev->config->functions, list) {
                                 if (test_bit(endp, f->endpoints))
@@ -2124,14 +2126,14 @@ int composite_os_desc_req_prepare(struct usb_composite_dev *cdev,
 
         cdev->os_desc_req = usb_ep_alloc_request(ep0, GFP_KERNEL);
         if (!cdev->os_desc_req) {
-                ret = PTR_ERR(cdev->os_desc_req);
+                ret = -ENOMEM;
                 goto end;
         }
 
         /* OS feature descriptor length <= 4kB */
         cdev->os_desc_req->buf = kmalloc(4096, GFP_KERNEL);
         if (!cdev->os_desc_req->buf) {
-                ret = PTR_ERR(cdev->os_desc_req->buf);
+                ret = -ENOMEM;
                 kfree(cdev->os_desc_req);
                 goto end;
         }
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 70cf3477f951..f9237fe2be05 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1490,7 +1490,9 @@ void unregister_gadget_item(struct config_item *item)
 {
         struct gadget_info *gi = to_gadget_info(item);
 
+        mutex_lock(&gi->lock);
         unregister_gadget(gi);
+        mutex_unlock(&gi->lock);
 }
 EXPORT_SYMBOL_GPL(unregister_gadget_item);
 
diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
index 943c21aafd3b..ab6ac1b74ac0 100644
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -680,6 +680,12 @@ static int rndis_reset_response(struct rndis_params *params,
 {
         rndis_reset_cmplt_type *resp;
         rndis_resp_t *r;
+        u8 *xbuf;
+        u32 length;
+
+        /* drain the response queue */
+        while ((xbuf = rndis_get_next_response(params, &length)))
+                rndis_free_response(params, xbuf);
 
         r = rndis_add_response(params, sizeof(rndis_reset_cmplt_type));
         if (!r)
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index a3f7e7c55ebb..5f562c1ec795 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -556,7 +556,8 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
                         /* Multi frame CDC protocols may store the frame for
                          * later which is not a dropped frame.
                          */
-                        if (dev->port_usb->supports_multi_frame)
+                        if (dev->port_usb &&
+                                        dev->port_usb->supports_multi_frame)
                                 goto multiframe;
                         goto drop;
                 }
diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
index 66753ba7a42e..31125a4a2658 100644
--- a/drivers/usb/gadget/function/uvc_configfs.c
+++ b/drivers/usb/gadget/function/uvc_configfs.c
@@ -2023,7 +2023,7 @@ static int uvcg_streaming_class_allow_link(struct config_item *src,
         if (!data) {
                 kfree(*class_array);
                 *class_array = NULL;
-                ret = PTR_ERR(data);
+                ret = -ENOMEM;
                 goto unlock;
         }
         cl_arr = *class_array;
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index aa3707bdebb4..16104b5ebdcb 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -542,7 +542,7 @@ static ssize_t ep_aio(struct kiocb *iocb,
          */
         spin_lock_irq(&epdata->dev->lock);
         value = -ENODEV;
-        if (unlikely(epdata->ep))
+        if (unlikely(epdata->ep == NULL))
                 goto fail;
 
         req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
@@ -606,7 +606,7 @@ ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
         }
         if (is_sync_kiocb(iocb)) {
                 value = ep_io(epdata, buf, len);
-                if (value >= 0 && copy_to_iter(buf, value, to))
+                if (value >= 0 && (copy_to_iter(buf, value, to) != value))
                         value = -EFAULT;
         } else {
                 struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index ff8685ea7219..934f83881c30 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1145,7 +1145,7 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
                         if (ret != -EPROBE_DEFER)
                                 list_del(&driver->pending);
                         if (ret)
-                                goto err4;
+                                goto err5;
                         break;
                 }
         }
@@ -1154,6 +1154,9 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
 
         return 0;
 
+err5:
+        device_del(&udc->dev);
+
 err4:
         list_del(&udc->list);
         mutex_unlock(&udc_lock);
diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
index 93d28cb00b76..cf8819a5c5b2 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
@@ -2053,7 +2053,7 @@ static void setup_received_handle(struct qe_udc *udc,
                         struct qe_ep *ep;
 
                         if (wValue != 0 || wLength != 0
-                                || pipe > USB_MAX_ENDPOINTS)
+                                || pipe >= USB_MAX_ENDPOINTS)
                                 break;
                         ep = &udc->eps[pipe];
 
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index a962b89b65a6..1e5f529d51a2 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -332,11 +332,11 @@ static void ehci_turn_off_all_ports(struct ehci_hcd *ehci)
         int     port = HCS_N_PORTS(ehci->hcs_params);
 
         while (port--) {
-                ehci_writel(ehci, PORT_RWC_BITS,
-                                &ehci->regs->port_status[port]);
                 spin_unlock_irq(&ehci->lock);
                 ehci_port_power(ehci, port, false);
                 spin_lock_irq(&ehci->lock);
+                ehci_writel(ehci, PORT_RWC_BITS,
+                                &ehci->regs->port_status[port]);
         }
 }
 
diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index c369c29e496d..2f7690092a7f 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1675,7 +1675,7 @@ max3421_gpout_set_value(struct usb_hcd *hcd, u8 pin_number, u8 value)
         if (pin_number > 7)
                 return;
 
-        mask = 1u << pin_number;
+        mask = 1u << (pin_number % 4);
         idx = pin_number / 4;
 
         if (value)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index d61fcc48099e..730b9fd26685 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -386,6 +386,9 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
 
         ret = 0;
         virt_dev = xhci->devs[slot_id];
+        if (!virt_dev)
+                return -ENODEV;
+
         cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO);
         if (!cmd) {
                 xhci_dbg(xhci, "Couldn't allocate command structure.\n");
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 4fd041bec332..d7b0f97abbad 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -314,11 +314,12 @@ static void xhci_pci_remove(struct pci_dev *dev)
                 usb_remove_hcd(xhci->shared_hcd);
                 usb_put_hcd(xhci->shared_hcd);
         }
-        usb_hcd_pci_remove(dev);
 
         /* Workaround for spurious wakeups at shutdown with HSW */
         if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
                 pci_set_power_state(dev, PCI_D3hot);
+
+        usb_hcd_pci_remove(dev);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 918e0c739b79..fd9fd12e4861 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1334,12 +1334,6 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
 
         cmd = list_entry(xhci->cmd_list.next, struct xhci_command, cmd_list);
 
-        if (cmd->command_trb != xhci->cmd_ring->dequeue) {
-                xhci_err(xhci,
-                         "Command completion event does not match command\n");
-                return;
-        }
-
         del_timer(&xhci->cmd_timer);
 
         trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event);
@@ -1351,6 +1345,13 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                 xhci_handle_stopped_cmd_ring(xhci, cmd);
                 return;
         }
+
+        if (cmd->command_trb != xhci->cmd_ring->dequeue) {
+                xhci_err(xhci,
+                         "Command completion event does not match command\n");
+                return;
+        }
+
         /*
          * Host aborted the command ring, check if the current command was
          * supposed to be aborted, otherwise continue normally.
@@ -3243,7 +3244,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         send_addr = addr;
 
         /* Queue the TRBs, even if they are zero-length */
-        for (enqd_len = 0; enqd_len < full_len; enqd_len += trb_buff_len) {
+        for (enqd_len = 0; first_trb || enqd_len < full_len;
+                        enqd_len += trb_buff_len) {
                 field = TRB_TYPE(TRB_NORMAL);
 
                 /* TRB buffer should not cross 64KB boundaries */
diff --git a/drivers/usb/misc/ftdi-elan.c b/drivers/usb/misc/ftdi-elan.c
index 52c27cab78c3..9b5b3b2281ca 100644
--- a/drivers/usb/misc/ftdi-elan.c
+++ b/drivers/usb/misc/ftdi-elan.c
@@ -665,7 +665,7 @@ static ssize_t ftdi_elan_read(struct file *file, char __user *buffer,
 {
         char data[30 *3 + 4];
         char *d = data;
-        int m = (sizeof(data) - 1) / 3;
+        int m = (sizeof(data) - 1) / 3 - 1;
         int bytes_read = 0;
         int retry_on_empty = 10;
         int retry_on_timeout = 5;
@@ -1684,7 +1684,7 @@ wait:if (ftdi->disconnected > 0) {
                         int i = 0;
                         char data[30 *3 + 4];
                         char *d = data;
-                        int m = (sizeof(data) - 1) / 3;
+                        int m = (sizeof(data) - 1) / 3 - 1;
                         int l = 0;
                         struct u132_target *target = &ftdi->target[ed];
                         struct u132_command *command = &ftdi->command[
@@ -1876,7 +1876,7 @@ more:{
                 if (packet_bytes > 2) {
                         char diag[30 *3 + 4];
                         char *d = diag;
-                        int m = (sizeof(diag) - 1) / 3;
+                        int m = (sizeof(diag) - 1) / 3 - 1;
                         char *b = ftdi->bulk_in_buffer;
                         int bytes_read = 0;
                         diag[0] = 0;
@@ -2053,7 +2053,7 @@ static int ftdi_elan_synchronize(struct usb_ftdi *ftdi)
                         if (packet_bytes > 2) {
                                 char diag[30 *3 + 4];
                                 char *d = diag;
-                                int m = (sizeof(diag) - 1) / 3;
+                                int m = (sizeof(diag) - 1) / 3 - 1;
                                 char *b = ftdi->bulk_in_buffer;
                                 int bytes_read = 0;
                                 unsigned char c = 0;
@@ -2155,7 +2155,7 @@ more:{
                 if (packet_bytes > 2) {
                         char diag[30 *3 + 4];
                         char *d = diag;
-                        int m = (sizeof(diag) - 1) / 3;
+                        int m = (sizeof(diag) - 1) / 3 - 1;
                         char *b = ftdi->bulk_in_buffer;
                         int bytes_read = 0;
                         diag[0] = 0;
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 6b978f04b8d7..5c8210dc6fd9 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -585,7 +585,6 @@ static void sg_timeout(unsigned long _req)
 {
         struct usb_sg_request   *req = (struct usb_sg_request *) _req;
 
-        req->status = -ETIMEDOUT;
         usb_sg_cancel(req);
 }
 
@@ -616,8 +615,10 @@ static int perform_sglist(
                 mod_timer(&sg_timer, jiffies +
                                 msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
                 usb_sg_wait(req);
-                del_timer_sync(&sg_timer);
-                retval = req->status;
+                if (!del_timer_sync(&sg_timer))
+                        retval = -ETIMEDOUT;
+                else
+                        retval = req->status;
 
                 /* FIXME check resulting data pattern */
 
@@ -2602,7 +2603,7 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
         ktime_get_ts64(&start);
 
         retval = usbtest_do_ioctl(intf, param_32);
-        if (retval)
+        if (retval < 0)
                 goto free_mutex;
 
         ktime_get_ts64(&end);
diff --git a/drivers/usb/phy/phy-omap-otg.c b/drivers/usb/phy/phy-omap-otg.c
index 6f6d2a7fd5a0..6523af4f8f93 100644
--- a/drivers/usb/phy/phy-omap-otg.c
+++ b/drivers/usb/phy/phy-omap-otg.c
@@ -140,6 +140,8 @@ static int omap_otg_probe(struct platform_device *pdev)
                  (rev >> 4) & 0xf, rev & 0xf, config->extcon, otg_dev->id,
                  otg_dev->vbus);
 
+        platform_set_drvdata(pdev, otg_dev);
+
         return 0;
 }
 
diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
index 8fbbc2d32371..ac67bab9124c 100644
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -514,7 +514,8 @@ static struct renesas_usbhs_platform_info *usbhs_parse_dt(struct device *dev)
         if (gpio > 0)
                 dparam->enable_gpio = gpio;
 
-        if (dparam->type == USBHS_TYPE_RCAR_GEN2)
+        if (dparam->type == USBHS_TYPE_RCAR_GEN2 ||
+            dparam->type == USBHS_TYPE_RCAR_GEN3)
                 dparam->has_usb_dmac = 1;
 
         return info;
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index 280ed5ff021b..857e78337324 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -871,7 +871,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
 
         /* use PIO if packet is less than pio_dma_border or pipe is DCP */
         if ((len < usbhs_get_dparam(priv, pio_dma_border)) ||
-            usbhs_pipe_is_dcp(pipe))
+            usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC))
                 goto usbhsf_pio_prepare_push;
 
         /* check data length if this driver don't use USB-DMAC */
@@ -976,7 +976,7 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt,
 
         /* use PIO if packet is less than pio_dma_border or pipe is DCP */
         if ((pkt->length < usbhs_get_dparam(priv, pio_dma_border)) ||
-            usbhs_pipe_is_dcp(pipe))
+            usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC))
                 goto usbhsf_pio_prepare_pop;
 
         fifo = usbhsf_get_dma_fifo(priv, pkt);
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index 50f3363cc382..92bc83b92d10 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -617,10 +617,13 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
                  * use dmaengine if possible.
                  * It will use pio handler if impossible.
                  */
-                if (usb_endpoint_dir_in(desc))
+                if (usb_endpoint_dir_in(desc)) {
                         pipe->handler = &usbhs_fifo_dma_push_handler;
-                else
+                } else {
                         pipe->handler = &usbhs_fifo_dma_pop_handler;
+                        usbhs_xxxsts_clear(priv, BRDYSTS,
+                                           usbhs_pipe_number(pipe));
+                }
 
                 ret = 0;
         }
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 00820809139a..b2d767e743fc 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -648,6 +648,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_PALMSENS_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_IVIUM_XSTAT_PID) },
         { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
         { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
         { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
@@ -1008,6 +1010,7 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
         { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
         { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
+        { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index c5d6c1e73e8e..f87a938cf005 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -406,6 +406,12 @@
 #define FTDI_4N_GALAXY_DE_3_PID 0xF3C2
 
 /*
+ * Ivium Technologies product IDs
+ */
+#define FTDI_PALMSENS_PID       0xf440
+#define FTDI_IVIUM_XSTAT_PID    0xf441
+
+/*
  * Linx Technologies product ids
  */
 #define LINX_SDMUSBQSS_PID      0xF448  /* Linx SDM-USB-QS-S */
@@ -673,6 +679,12 @@
 #define INTREPID_NEOVI_PID      0x0701
 
 /*
+ * WICED USB UART
+ */
+#define WICED_VID               0x0A5C
+#define WICED_USB20706V2_PID    0x6422
+
+/*
  * Definitions for ID TECH (www.idt-net.com) devices
  */
 #define IDTECH_VID              0x0ACD  /* ID TECH Vendor ID */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 8e07536c233a..bc472584a229 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -274,6 +274,12 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_LE920                     0x1200
 #define TELIT_PRODUCT_LE910                     0x1201
 #define TELIT_PRODUCT_LE910_USBCFG4             0x1206
+#define TELIT_PRODUCT_LE920A4_1207              0x1207
+#define TELIT_PRODUCT_LE920A4_1208              0x1208
+#define TELIT_PRODUCT_LE920A4_1211              0x1211
+#define TELIT_PRODUCT_LE920A4_1212              0x1212
+#define TELIT_PRODUCT_LE920A4_1213              0x1213
+#define TELIT_PRODUCT_LE920A4_1214              0x1214
 
 /* ZTE PRODUCTS */
 #define ZTE_VENDOR_ID                           0x19d2
@@ -628,6 +634,11 @@ static const struct option_blacklist_info telit_le920_blacklist = {
         .reserved = BIT(1) | BIT(5),
 };
 
+static const struct option_blacklist_info telit_le920a4_blacklist_1 = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(1),
+};
+
 static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = {
         .sendsetup = BIT(2),
         .reserved = BIT(0) | BIT(1) | BIT(3),
@@ -1203,6 +1214,16 @@ static const struct usb_device_id option_ids[] = {
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
                 .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208),
+                .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211),
+                .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212),
+                .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
+        { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
+                .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
@@ -1966,6 +1987,7 @@ static const struct usb_device_id option_ids[] = {
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
         { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                /* OLICARD300 - MT6225 */
         { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
         { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index b1b9bac44016..d213cf44a7e4 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1433,7 +1433,7 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
 
         rc = usb_register(udriver);
         if (rc)
-                return rc;
+                goto failed_usb_register;
 
         for (sd = serial_drivers; *sd; ++sd) {
                 (*sd)->usb_driver = udriver;
@@ -1451,6 +1451,8 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
         while (sd-- > serial_drivers)
                 usb_serial_deregister(*sd);
         usb_deregister(udriver);
+failed_usb_register:
+        kfree(udriver);
         return rc;
 }
 EXPORT_SYMBOL_GPL(usb_serial_register_drivers);
diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index 388eec4e1a90..97fb2f8fa930 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -220,20 +220,20 @@ static long vhost_test_reset_owner(struct vhost_test *n)
 {
         void *priv = NULL;
         long err;
-        struct vhost_memory *memory;
+        struct vhost_umem *umem;
 
         mutex_lock(&n->dev.mutex);
         err = vhost_dev_check_owner(&n->dev);
         if (err)
                 goto done;
-        memory = vhost_dev_reset_owner_prepare();
-        if (!memory) {
+        umem = vhost_dev_reset_owner_prepare();
+        if (!umem) {
                 err = -ENOMEM;
                 goto done;
         }
         vhost_test_stop(n, &priv);
         vhost_test_flush(n);
-        vhost_dev_reset_owner(&n->dev, memory);
+        vhost_dev_reset_owner(&n->dev, umem);
 done:
         mutex_unlock(&n->dev.mutex);
         return err;
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index 4b0eff6da674..85737e96ab8b 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -189,11 +189,8 @@ static int afs_deliver_cb_callback(struct afs_call *call, struct sk_buff *skb,
         case 1:
                 _debug("extract FID count");
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->count = ntohl(call->tmp);
                 _debug("FID count: %u", call->count);
@@ -210,11 +207,8 @@ static int afs_deliver_cb_callback(struct afs_call *call, struct sk_buff *skb,
                 _debug("extract FID array");
                 ret = afs_extract_data(call, skb, last, call->buffer,
                                        call->count * 3 * 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 _debug("unmarshall FID array");
                 call->request = kcalloc(call->count,
@@ -239,11 +233,8 @@ static int afs_deliver_cb_callback(struct afs_call *call, struct sk_buff *skb,
         case 3:
                 _debug("extract CB count");
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 tmp = ntohl(call->tmp);
                 _debug("CB count: %u", tmp);
@@ -258,11 +249,8 @@ static int afs_deliver_cb_callback(struct afs_call *call, struct sk_buff *skb,
                 _debug("extract CB array");
                 ret = afs_extract_data(call, skb, last, call->request,
                                        call->count * 3 * 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 _debug("unmarshall CB array");
                 cb = call->request;
@@ -278,9 +266,9 @@ static int afs_deliver_cb_callback(struct afs_call *call, struct sk_buff *skb,
                 call->unmarshall++;
 
         case 5:
-                _debug("trailer");
-                if (skb->len != 0)
-                        return -EBADMSG;
+                ret = afs_data_complete(call, skb, last);
+                if (ret < 0)
+                        return ret;
 
                 /* Record that the message was unmarshalled successfully so
                  * that the call destructor can know do the callback breaking
@@ -294,8 +282,6 @@ static int afs_deliver_cb_callback(struct afs_call *call, struct sk_buff *skb,
                 break;
         }
 
-        if (!last)
-                return 0;
 
         call->state = AFS_CALL_REPLYING;
 
@@ -335,13 +321,13 @@ static int afs_deliver_cb_init_call_back_state(struct afs_call *call,
 {
         struct afs_server *server;
         struct in_addr addr;
+        int ret;
 
         _enter(",{%u},%d", skb->len, last);
 
-        if (skb->len > 0)
-                return -EBADMSG;
-        if (!last)
-                return 0;
+        ret = afs_data_complete(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* no unmarshalling required */
         call->state = AFS_CALL_REPLYING;
@@ -371,8 +357,10 @@ static int afs_deliver_cb_init_call_back_state3(struct afs_call *call,
 
         _enter(",{%u},%d", skb->len, last);
 
+        /* There are some arguments that we ignore */
+        afs_data_consumed(call, skb);
         if (!last)
-                return 0;
+                return -EAGAIN;
 
         /* no unmarshalling required */
         call->state = AFS_CALL_REPLYING;
@@ -408,12 +396,13 @@ static void SRXAFSCB_Probe(struct work_struct *work)
 static int afs_deliver_cb_probe(struct afs_call *call, struct sk_buff *skb,
                                 bool last)
 {
+        int ret;
+
         _enter(",{%u},%d", skb->len, last);
 
-        if (skb->len > 0)
-                return -EBADMSG;
-        if (!last)
-                return 0;
+        ret = afs_data_complete(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* no unmarshalling required */
         call->state = AFS_CALL_REPLYING;
@@ -460,10 +449,9 @@ static int afs_deliver_cb_probe_uuid(struct afs_call *call, struct sk_buff *skb,
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        if (skb->len > 0)
-                return -EBADMSG;
-        if (!last)
-                return 0;
+        ret = afs_data_complete(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         switch (call->unmarshall) {
         case 0:
@@ -509,8 +497,9 @@ static int afs_deliver_cb_probe_uuid(struct afs_call *call, struct sk_buff *skb,
                 break;
         }
 
-        if (!last)
-                return 0;
+        ret = afs_data_complete(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         call->state = AFS_CALL_REPLYING;
 
@@ -588,12 +577,13 @@ static void SRXAFSCB_TellMeAboutYourself(struct work_struct *work)
 static int afs_deliver_cb_tell_me_about_yourself(struct afs_call *call,
                                                  struct sk_buff *skb, bool last)
 {
+        int ret;
+
         _enter(",{%u},%d", skb->len, last);
 
-        if (skb->len > 0)
-                return -EBADMSG;
-        if (!last)
-                return 0;
+        ret = afs_data_complete(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* no unmarshalling required */
         call->state = AFS_CALL_REPLYING;
diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
index c2e930ec2888..9312b92e54be 100644
--- a/fs/afs/fsclient.c
+++ b/fs/afs/fsclient.c
@@ -240,15 +240,13 @@ static int afs_deliver_fs_fetch_status(struct afs_call *call,
 {
         struct afs_vnode *vnode = call->reply;
         const __be32 *bp;
+        int ret;
 
         _enter(",,%u", last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -335,11 +333,8 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call,
         case 1:
                 _debug("extract data length (MSW)");
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->count = ntohl(call->tmp);
                 _debug("DATA length MSW: %u", call->count);
@@ -353,11 +348,8 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call,
         case 2:
                 _debug("extract data length");
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->count = ntohl(call->tmp);
                 _debug("DATA length: %u", call->count);
@@ -375,11 +367,8 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call,
                         ret = afs_extract_data(call, skb, last, buffer,
                                                call->count);
                         kunmap_atomic(buffer);
-                        switch (ret) {
-                        case 0:         break;
-                        case -EAGAIN:   return 0;
-                        default:        return ret;
-                        }
+                        if (ret < 0)
+                                return ret;
                 }
 
                 call->offset = 0;
@@ -389,11 +378,8 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call,
         case 4:
                 ret = afs_extract_data(call, skb, last, call->buffer,
                                        (21 + 3 + 6) * 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 bp = call->buffer;
                 xdr_decode_AFSFetchStatus(&bp, &vnode->status, vnode, NULL);
@@ -405,15 +391,12 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call,
                 call->unmarshall++;
 
         case 5:
-                _debug("trailer");
-                if (skb->len != 0)
-                        return -EBADMSG;
+                ret = afs_data_complete(call, skb, last);
+                if (ret < 0)
+                        return ret;
                 break;
         }
 
-        if (!last)
-                return 0;
-
         if (call->count < PAGE_SIZE) {
                 _debug("clear");
                 page = call->reply3;
@@ -537,9 +520,8 @@ static int afs_deliver_fs_give_up_callbacks(struct afs_call *call,
 {
         _enter(",{%u},%d", skb->len, last);
 
-        if (skb->len > 0)
-                return -EBADMSG; /* shouldn't be any reply data */
-        return 0;
+        /* shouldn't be any reply data */
+        return afs_data_complete(call, skb, last);
 }
 
 /*
@@ -622,15 +604,13 @@ static int afs_deliver_fs_create_vnode(struct afs_call *call,
 {
         struct afs_vnode *vnode = call->reply;
         const __be32 *bp;
+        int ret;
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -721,15 +701,13 @@ static int afs_deliver_fs_remove(struct afs_call *call,
 {
         struct afs_vnode *vnode = call->reply;
         const __be32 *bp;
+        int ret;
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -804,15 +782,13 @@ static int afs_deliver_fs_link(struct afs_call *call,
 {
         struct afs_vnode *dvnode = call->reply, *vnode = call->reply2;
         const __be32 *bp;
+        int ret;
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -892,15 +868,13 @@ static int afs_deliver_fs_symlink(struct afs_call *call,
 {
         struct afs_vnode *vnode = call->reply;
         const __be32 *bp;
+        int ret;
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -999,15 +973,13 @@ static int afs_deliver_fs_rename(struct afs_call *call,
 {
         struct afs_vnode *orig_dvnode = call->reply, *new_dvnode = call->reply2;
         const __be32 *bp;
+        int ret;
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -1105,20 +1077,13 @@ static int afs_deliver_fs_store_data(struct afs_call *call,
 {
         struct afs_vnode *vnode = call->reply;
         const __be32 *bp;
+        int ret;
 
         _enter(",,%u", last);
 
-        afs_transfer_reply(call, skb);
-        if (!last) {
-                _leave(" = 0 [more]");
-                return 0;
-        }
-
-        if (call->reply_size != call->reply_max) {
-                _leave(" = -EBADMSG [%u != %u]",
-                       call->reply_size, call->reply_max);
-                return -EBADMSG;
-        }
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -1292,20 +1257,13 @@ static int afs_deliver_fs_store_status(struct afs_call *call,
         afs_dataversion_t *store_version;
         struct afs_vnode *vnode = call->reply;
         const __be32 *bp;
+        int ret;
 
         _enter(",,%u", last);
 
-        afs_transfer_reply(call, skb);
-        if (!last) {
-                _leave(" = 0 [more]");
-                return 0;
-        }
-
-        if (call->reply_size != call->reply_max) {
-                _leave(" = -EBADMSG [%u != %u]",
-                       call->reply_size, call->reply_max);
-                return -EBADMSG;
-        }
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         store_version = NULL;
@@ -1504,11 +1462,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 _debug("extract status");
                 ret = afs_extract_data(call, skb, last, call->buffer,
                                        12 * 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 bp = call->buffer;
                 xdr_decode_AFSFetchVolumeStatus(&bp, call->reply2);
@@ -1518,11 +1473,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 /* extract the volume name length */
         case 2:
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->count = ntohl(call->tmp);
                 _debug("volname length: %u", call->count);
@@ -1537,11 +1489,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 if (call->count > 0) {
                         ret = afs_extract_data(call, skb, last, call->reply3,
                                                call->count);
-                        switch (ret) {
-                        case 0:         break;
-                        case -EAGAIN:   return 0;
-                        default:        return ret;
-                        }
+                        if (ret < 0)
+                                return ret;
                 }
 
                 p = call->reply3;
@@ -1561,11 +1510,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
         case 4:
                 ret = afs_extract_data(call, skb, last, call->buffer,
                                        call->count);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->offset = 0;
                 call->unmarshall++;
@@ -1574,11 +1520,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 /* extract the offline message length */
         case 5:
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->count = ntohl(call->tmp);
                 _debug("offline msg length: %u", call->count);
@@ -1593,11 +1536,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 if (call->count > 0) {
                         ret = afs_extract_data(call, skb, last, call->reply3,
                                                call->count);
-                        switch (ret) {
-                        case 0:         break;
-                        case -EAGAIN:   return 0;
-                        default:        return ret;
-                        }
+                        if (ret < 0)
+                                return ret;
                 }
 
                 p = call->reply3;
@@ -1617,11 +1557,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
         case 7:
                 ret = afs_extract_data(call, skb, last, call->buffer,
                                        call->count);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->offset = 0;
                 call->unmarshall++;
@@ -1630,11 +1567,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 /* extract the message of the day length */
         case 8:
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->count = ntohl(call->tmp);
                 _debug("motd length: %u", call->count);
@@ -1649,11 +1583,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 if (call->count > 0) {
                         ret = afs_extract_data(call, skb, last, call->reply3,
                                                call->count);
-                        switch (ret) {
-                        case 0:         break;
-                        case -EAGAIN:   return 0;
-                        default:        return ret;
-                        }
+                        if (ret < 0)
+                                return ret;
                 }
 
                 p = call->reply3;
@@ -1673,26 +1604,20 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
         case 10:
                 ret = afs_extract_data(call, skb, last, call->buffer,
                                        call->count);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->offset = 0;
                 call->unmarshall++;
         no_motd_padding:
 
         case 11:
-                _debug("trailer %d", skb->len);
-                if (skb->len != 0)
-                        return -EBADMSG;
+                ret = afs_data_complete(call, skb, last);
+                if (ret < 0)
+                        return ret;
                 break;
         }
 
-        if (!last)
-                return 0;
-
         _leave(" = 0 [done]");
         return 0;
 }
@@ -1764,15 +1689,13 @@ static int afs_deliver_fs_xxxx_lock(struct afs_call *call,
                                     struct sk_buff *skb, bool last)
 {
         const __be32 *bp;
+        int ret;
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 71d5982312f3..df976b2a7f40 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -609,17 +609,29 @@ extern void afs_proc_cell_remove(struct afs_cell *);
  */
 extern int afs_open_socket(void);
 extern void afs_close_socket(void);
+extern void afs_data_consumed(struct afs_call *, struct sk_buff *);
 extern int afs_make_call(struct in_addr *, struct afs_call *, gfp_t,
                          const struct afs_wait_mode *);
 extern struct afs_call *afs_alloc_flat_call(const struct afs_call_type *,
                                             size_t, size_t);
 extern void afs_flat_call_destructor(struct afs_call *);
-extern void afs_transfer_reply(struct afs_call *, struct sk_buff *);
+extern int afs_transfer_reply(struct afs_call *, struct sk_buff *, bool);
 extern void afs_send_empty_reply(struct afs_call *);
 extern void afs_send_simple_reply(struct afs_call *, const void *, size_t);
 extern int afs_extract_data(struct afs_call *, struct sk_buff *, bool, void *,
                             size_t);
 
+static inline int afs_data_complete(struct afs_call *call, struct sk_buff *skb,
+                                    bool last)
+{
+        if (skb->len > 0)
+                return -EBADMSG;
+        afs_data_consumed(call, skb);
+        if (!last)
+                return -EAGAIN;
+        return 0;
+}
+
 /*
  * security.c
  */
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 4832de84d52c..14d04c848465 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -150,10 +150,9 @@ void afs_close_socket(void)
 }
 
 /*
- * note that the data in a socket buffer is now delivered and that the buffer
- * should be freed
+ * Note that the data in a socket buffer is now consumed.
  */
-static void afs_data_delivered(struct sk_buff *skb)
+void afs_data_consumed(struct afs_call *call, struct sk_buff *skb)
 {
         if (!skb) {
                 _debug("DLVR NULL [%d]", atomic_read(&afs_outstanding_skbs));
@@ -161,9 +160,7 @@ static void afs_data_delivered(struct sk_buff *skb)
         } else {
                 _debug("DLVR %p{%u} [%d]",
                        skb, skb->mark, atomic_read(&afs_outstanding_skbs));
-                if (atomic_dec_return(&afs_outstanding_skbs) == -1)
-                        BUG();
-                rxrpc_kernel_data_delivered(skb);
+                rxrpc_kernel_data_consumed(call->rxcall, skb);
         }
 }
 
@@ -489,9 +486,15 @@ static void afs_deliver_to_call(struct afs_call *call)
                         last = rxrpc_kernel_is_data_last(skb);
                         ret = call->type->deliver(call, skb, last);
                         switch (ret) {
+                        case -EAGAIN:
+                                if (last) {
+                                        _debug("short data");
+                                        goto unmarshal_error;
+                                }
+                                break;
                         case 0:
-                                if (last &&
-                                    call->state == AFS_CALL_AWAIT_REPLY)
+                                ASSERT(last);
+                                if (call->state == AFS_CALL_AWAIT_REPLY)
                                         call->state = AFS_CALL_COMPLETE;
                                 break;
                         case -ENOTCONN:
@@ -501,6 +504,7 @@ static void afs_deliver_to_call(struct afs_call *call)
                                 abort_code = RX_INVALID_OPERATION;
                                 goto do_abort;
                         default:
+                        unmarshal_error:
                                 abort_code = RXGEN_CC_UNMARSHAL;
                                 if (call->state != AFS_CALL_AWAIT_REPLY)
                                         abort_code = RXGEN_SS_UNMARSHAL;
@@ -511,9 +515,7 @@ static void afs_deliver_to_call(struct afs_call *call)
                                 call->state = AFS_CALL_ERROR;
                                 break;
                         }
-                        afs_data_delivered(skb);
-                        skb = NULL;
-                        continue;
+                        break;
                 case RXRPC_SKB_MARK_FINAL_ACK:
                         _debug("Rcv ACK");
                         call->state = AFS_CALL_COMPLETE;
@@ -685,15 +687,35 @@ static void afs_process_async_call(struct afs_call *call)
 }
 
 /*
- * empty a socket buffer into a flat reply buffer
+ * Empty a socket buffer into a flat reply buffer.
  */
-void afs_transfer_reply(struct afs_call *call, struct sk_buff *skb)
+int afs_transfer_reply(struct afs_call *call, struct sk_buff *skb, bool last)
 {
         size_t len = skb->len;
 
-        if (skb_copy_bits(skb, 0, call->buffer + call->reply_size, len) < 0)
-                BUG();
-        call->reply_size += len;
+        if (len > call->reply_max - call->reply_size) {
+                _leave(" = -EBADMSG [%zu > %u]",
+                       len, call->reply_max - call->reply_size);
+                return -EBADMSG;
+        }
+
+        if (len > 0) {
+                if (skb_copy_bits(skb, 0, call->buffer + call->reply_size,
+                                  len) < 0)
+                        BUG();
+                call->reply_size += len;
+        }
+
+        afs_data_consumed(call, skb);
+        if (!last)
+                return -EAGAIN;
+
+        if (call->reply_size != call->reply_max) {
+                _leave(" = -EBADMSG [%u != %u]",
+                       call->reply_size, call->reply_max);
+                return -EBADMSG;
+        }
+        return 0;
 }
 
 /*
@@ -745,7 +767,8 @@ static void afs_collect_incoming_call(struct work_struct *work)
 }
 
 /*
- * grab the operation ID from an incoming cache manager call
+ * Grab the operation ID from an incoming cache manager call.  The socket
+ * buffer is discarded on error or if we don't yet have sufficient data.
  */
 static int afs_deliver_cm_op_id(struct afs_call *call, struct sk_buff *skb,
                                 bool last)
@@ -766,12 +789,9 @@ static int afs_deliver_cm_op_id(struct afs_call *call, struct sk_buff *skb,
         call->offset += len;
 
         if (call->offset < 4) {
-                if (last) {
-                        _leave(" = -EBADMSG [op ID short]");
-                        return -EBADMSG;
-                }
-                _leave(" = 0 [incomplete]");
-                return 0;
+                afs_data_consumed(call, skb);
+                _leave(" = -EAGAIN");
+                return -EAGAIN;
         }
 
         call->state = AFS_CALL_AWAIT_REQUEST;
@@ -855,7 +875,7 @@ void afs_send_simple_reply(struct afs_call *call, const void *buf, size_t len)
 }
 
 /*
- * extract a piece of data from the received data socket buffers
+ * Extract a piece of data from the received data socket buffers.
  */
 int afs_extract_data(struct afs_call *call, struct sk_buff *skb,
                      bool last, void *buf, size_t count)
@@ -873,10 +893,7 @@ int afs_extract_data(struct afs_call *call, struct sk_buff *skb,
         call->offset += len;
 
         if (call->offset < count) {
-                if (last) {
-                        _leave(" = -EBADMSG [%d < %zu]", call->offset, count);
-                        return -EBADMSG;
-                }
+                afs_data_consumed(call, skb);
                 _leave(" = -EAGAIN");
                 return -EAGAIN;
         }
diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c
index 340afd0cd182..f94d1abdc3eb 100644
--- a/fs/afs/vlclient.c
+++ b/fs/afs/vlclient.c
@@ -64,16 +64,13 @@ static int afs_deliver_vl_get_entry_by_xxx(struct afs_call *call,
         struct afs_cache_vlocation *entry;
         __be32 *bp;
         u32 tmp;
-        int loop;
+        int loop, ret;
 
         _enter(",,%u", last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         entry = call->reply;
diff --git a/fs/iomap.c b/fs/iomap.c
index 48141b8eff5f..0342254646e3 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -84,8 +84,11 @@ iomap_apply(struct inode *inode, loff_t pos, loff_t length, unsigned flags,
          * Now the data has been copied, commit the range we've copied.  This
          * should not fail unless the filesystem has had a fatal error.
          */
-        ret = ops->iomap_end(inode, pos, length, written > 0 ? written : 0,
-                        flags, &iomap);
+        if (ops->iomap_end) {
+                ret = ops->iomap_end(inode, pos, length,
+                                     written > 0 ? written : 0,
+                                     flags, &iomap);
+        }
 
         return written ? written : ret;
 }
@@ -194,12 +197,9 @@ again:
                 if (mapping_writably_mapped(inode->i_mapping))
                         flush_dcache_page(page);
 
-                pagefault_disable();
                 copied = iov_iter_copy_from_user_atomic(page, i, offset, bytes);
-                pagefault_enable();
 
                 flush_dcache_page(page);
-                mark_page_accessed(page);
 
                 status = iomap_write_end(inode, pos, bytes, copied, page);
                 if (unlikely(status < 0))
@@ -470,13 +470,18 @@ int iomap_fiemap(struct inode *inode, struct fiemap_extent_info *fi,
         if (ret)
                 return ret;
 
-        ret = filemap_write_and_wait(inode->i_mapping);
-        if (ret)
-                return ret;
+        if (fi->fi_flags & FIEMAP_FLAG_SYNC) {
+                ret = filemap_write_and_wait(inode->i_mapping);
+                if (ret)
+                        return ret;
+        }
 
         while (len > 0) {
                 ret = iomap_apply(inode, start, len, 0, ops, &ctx,
                                 iomap_fiemap_actor);
+                /* inode with no (attribute) mapping will give ENOENT */
+                if (ret == -ENOENT)
+                        break;
                 if (ret < 0)
                         return ret;
                 if (ret == 0)
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index 776ae2f325d1..3dd8f1d54498 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -1582,6 +1582,7 @@ xfs_alloc_ag_vextent_small(
         xfs_extlen_t    *flenp, /* result length */
         int             *stat)  /* status: 0-freelist, 1-normal/none */
 {
+        struct xfs_owner_info   oinfo;
         int             error;
         xfs_agblock_t   fbno;
         xfs_extlen_t    flen;
@@ -1624,6 +1625,18 @@ xfs_alloc_ag_vextent_small(
                                 error0);
                         args->wasfromfl = 1;
                         trace_xfs_alloc_small_freelist(args);
+
+                        /*
+                         * If we're feeding an AGFL block to something that
+                         * doesn't live in the free space, we need to clear
+                         * out the OWN_AG rmap.
+                         */
+                        xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_AG);
+                        error = xfs_rmap_free(args->tp, args->agbp, args->agno,
+                                        fbno, 1, &oinfo);
+                        if (error)
+                                goto error0;
+
                         *stat = 0;
                         return 0;
                 }
@@ -2264,6 +2277,7 @@ xfs_alloc_log_agf(
                 offsetof(xfs_agf_t, agf_longest),
                 offsetof(xfs_agf_t, agf_btreeblks),
                 offsetof(xfs_agf_t, agf_uuid),
+                offsetof(xfs_agf_t, agf_rmap_blocks),
                 sizeof(xfs_agf_t)
         };
 
diff --git a/fs/xfs/libxfs/xfs_format.h b/fs/xfs/libxfs/xfs_format.h
index f814d42c73b2..e6a8bea0f7ba 100644
--- a/fs/xfs/libxfs/xfs_format.h
+++ b/fs/xfs/libxfs/xfs_format.h
@@ -640,12 +640,15 @@ typedef struct xfs_agf {
         __be32          agf_btreeblks;  /* # of blocks held in AGF btrees */
         uuid_t          agf_uuid;       /* uuid of filesystem */
 
+        __be32          agf_rmap_blocks;        /* rmapbt blocks used */
+        __be32          agf_padding;            /* padding */
+
         /*
          * reserve some contiguous space for future logged fields before we add
          * the unlogged fields. This makes the range logging via flags and
          * structure offsets much simpler.
          */
-        __be64          agf_spare64[16];
+        __be64          agf_spare64[15];
 
         /* unlogged fields, written during buffer writeback. */
         __be64          agf_lsn;        /* last write sequence */
@@ -670,7 +673,8 @@ typedef struct xfs_agf {
 #define XFS_AGF_LONGEST         0x00000400
 #define XFS_AGF_BTREEBLKS       0x00000800
 #define XFS_AGF_UUID            0x00001000
-#define XFS_AGF_NUM_BITS        13
+#define XFS_AGF_RMAP_BLOCKS     0x00002000
+#define XFS_AGF_NUM_BITS        14
 #define XFS_AGF_ALL_BITS        ((1 << XFS_AGF_NUM_BITS) - 1)
 
 #define XFS_AGF_FLAGS \
@@ -686,7 +690,8 @@ typedef struct xfs_agf {
         { XFS_AGF_FREEBLKS,     "FREEBLKS" }, \
         { XFS_AGF_LONGEST,      "LONGEST" }, \
         { XFS_AGF_BTREEBLKS,    "BTREEBLKS" }, \
-        { XFS_AGF_UUID,         "UUID" }
+        { XFS_AGF_UUID,         "UUID" }, \
+        { XFS_AGF_RMAP_BLOCKS,  "RMAP_BLOCKS" }
 
 /* disk block (xfs_daddr_t) in the AG */
 #define XFS_AGF_DADDR(mp)       ((xfs_daddr_t)(1 << (mp)->m_sectbb_log))
diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c
index bc1faebc84ec..17b8eeb34ac8 100644
--- a/fs/xfs/libxfs/xfs_rmap_btree.c
+++ b/fs/xfs/libxfs/xfs_rmap_btree.c
@@ -98,6 +98,8 @@ xfs_rmapbt_alloc_block(
         union xfs_btree_ptr     *new,
         int                     *stat)
 {
+        struct xfs_buf          *agbp = cur->bc_private.a.agbp;
+        struct xfs_agf          *agf = XFS_BUF_TO_AGF(agbp);
         int                     error;
         xfs_agblock_t           bno;
 
@@ -124,6 +126,8 @@ xfs_rmapbt_alloc_block(
 
         xfs_trans_agbtree_delta(cur->bc_tp, 1);
         new->s = cpu_to_be32(bno);
+        be32_add_cpu(&agf->agf_rmap_blocks, 1);
+        xfs_alloc_log_agf(cur->bc_tp, agbp, XFS_AGF_RMAP_BLOCKS);
 
         XFS_BTREE_TRACE_CURSOR(cur, XBT_EXIT);
         *stat = 1;
@@ -143,6 +147,8 @@ xfs_rmapbt_free_block(
         bno = xfs_daddr_to_agbno(cur->bc_mp, XFS_BUF_ADDR(bp));
         trace_xfs_rmapbt_free_block(cur->bc_mp, cur->bc_private.a.agno,
                         bno, 1);
+        be32_add_cpu(&agf->agf_rmap_blocks, -1);
+        xfs_alloc_log_agf(cur->bc_tp, agbp, XFS_AGF_RMAP_BLOCKS);
         error = xfs_alloc_put_freelist(cur->bc_tp, agbp, NULL, bno, 1);
         if (error)
                 return error;
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 47a318ce82e0..607cc29bba21 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -115,7 +115,6 @@ xfs_buf_ioacct_dec(
         if (!(bp->b_flags & _XBF_IN_FLIGHT))
                 return;
 
-        ASSERT(bp->b_flags & XBF_ASYNC);
         bp->b_flags &= ~_XBF_IN_FLIGHT;
         percpu_counter_dec(&bp->b_target->bt_io_count);
 }
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index ed95e5bb04e6..e612a0233710 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -741,9 +741,20 @@ xfs_file_dax_write(
          * page is inserted into the pagecache when we have to serve a write
          * fault on a hole.  It should never be dirtied and can simply be
          * dropped from the pagecache once we get real data for the page.
+         *
+         * XXX: This is racy against mmap, and there's nothing we can do about
+         * it. dax_do_io() should really do this invalidation internally as
+         * it will know if we've allocated over a holei for this specific IO and
+         * if so it needs to update the mapping tree and invalidate existing
+         * PTEs over the newly allocated range. Remove this invalidation when
+         * dax_do_io() is fixed up.
          */
         if (mapping->nrpages) {
-                ret = invalidate_inode_pages2(mapping);
+                loff_t end = iocb->ki_pos + iov_iter_count(from) - 1;
+
+                ret = invalidate_inode_pages2_range(mapping,
+                                                    iocb->ki_pos >> PAGE_SHIFT,
+                                                    end >> PAGE_SHIFT);
                 WARN_ON_ONCE(ret);
         }
 
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index 0f96847b90e1..0b7f986745c1 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -248,6 +248,7 @@ xfs_growfs_data_private(
                         agf->agf_roots[XFS_BTNUM_RMAPi] =
                                                 cpu_to_be32(XFS_RMAP_BLOCK(mp));
                         agf->agf_levels[XFS_BTNUM_RMAPi] = cpu_to_be32(1);
+                        agf->agf_rmap_blocks = cpu_to_be32(1);
                 }
 
                 agf->agf_flfirst = cpu_to_be32(1);
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 2114d53df433..2af0dda1c978 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -715,12 +715,16 @@ xfs_iomap_write_allocate(
                  * is in the delayed allocation extent on which we sit
                  * but before our buffer starts.
                  */
-
                 nimaps = 0;
                 while (nimaps == 0) {
                         nres = XFS_EXTENTADD_SPACE_RES(mp, XFS_DATA_FORK);
-
-                        error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, nres,
+                        /*
+                         * We have already reserved space for the extent and any
+                         * indirect blocks when creating the delalloc extent,
+                         * there is no need to reserve space in this transaction
+                         * again.
+                         */
+                        error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, 0,
                                         0, XFS_TRANS_RESERVE, &tp);
                         if (error)
                                 return error;
@@ -1037,20 +1041,14 @@ xfs_file_iomap_begin(
                         return error;
 
                 trace_xfs_iomap_alloc(ip, offset, length, 0, &imap);
-                xfs_bmbt_to_iomap(ip, iomap, &imap);
-        } else if (nimaps) {
-                xfs_iunlock(ip, XFS_ILOCK_EXCL);
-                trace_xfs_iomap_found(ip, offset, length, 0, &imap);
-                xfs_bmbt_to_iomap(ip, iomap, &imap);
         } else {
+                ASSERT(nimaps);
+
                 xfs_iunlock(ip, XFS_ILOCK_EXCL);
-                trace_xfs_iomap_not_found(ip, offset, length, 0, &imap);
-                iomap->blkno = IOMAP_NULL_BLOCK;
-                iomap->type = IOMAP_HOLE;
-                iomap->offset = offset;
-                iomap->length = length;
+                trace_xfs_iomap_found(ip, offset, length, 0, &imap);
         }
 
+        xfs_bmbt_to_iomap(ip, iomap, &imap);
         return 0;
 }
 
@@ -1112,3 +1110,48 @@ struct iomap_ops xfs_iomap_ops = {
         .iomap_begin            = xfs_file_iomap_begin,
         .iomap_end              = xfs_file_iomap_end,
 };
+
+static int
+xfs_xattr_iomap_begin(
+        struct inode            *inode,
+        loff_t                  offset,
+        loff_t                  length,
+        unsigned                flags,
+        struct iomap            *iomap)
+{
+        struct xfs_inode        *ip = XFS_I(inode);
+        struct xfs_mount        *mp = ip->i_mount;
+        xfs_fileoff_t           offset_fsb = XFS_B_TO_FSBT(mp, offset);
+        xfs_fileoff_t           end_fsb = XFS_B_TO_FSB(mp, offset + length);
+        struct xfs_bmbt_irec    imap;
+        int                     nimaps = 1, error = 0;
+        unsigned                lockmode;
+
+        if (XFS_FORCED_SHUTDOWN(mp))
+                return -EIO;
+
+        lockmode = xfs_ilock_data_map_shared(ip);
+
+        /* if there are no attribute fork or extents, return ENOENT */
+        if (XFS_IFORK_Q(ip) || !ip->i_d.di_anextents) {
+                error = -ENOENT;
+                goto out_unlock;
+        }
+
+        ASSERT(ip->i_d.di_aformat != XFS_DINODE_FMT_LOCAL);
+        error = xfs_bmapi_read(ip, offset_fsb, end_fsb - offset_fsb, &imap,
+                               &nimaps, XFS_BMAPI_ENTIRE | XFS_BMAPI_ATTRFORK);
+out_unlock:
+        xfs_iunlock(ip, lockmode);
+
+        if (!error) {
+                ASSERT(nimaps);
+                xfs_bmbt_to_iomap(ip, iomap, &imap);
+        }
+
+        return error;
+}
+
+struct iomap_ops xfs_xattr_iomap_ops = {
+        .iomap_begin            = xfs_xattr_iomap_begin,
+};
diff --git a/fs/xfs/xfs_iomap.h b/fs/xfs/xfs_iomap.h
index e066d045e2ff..fb8aca3d69ab 100644
--- a/fs/xfs/xfs_iomap.h
+++ b/fs/xfs/xfs_iomap.h
@@ -35,5 +35,6 @@ void xfs_bmbt_to_iomap(struct xfs_inode *, struct iomap *,
                 struct xfs_bmbt_irec *);
 
 extern struct iomap_ops xfs_iomap_ops;
+extern struct iomap_ops xfs_xattr_iomap_ops;
 
 #endif /* __XFS_IOMAP_H__*/
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index ab820f84ed50..b24c3102fa93 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -1009,7 +1009,14 @@ xfs_vn_fiemap(
         int                     error;
 
         xfs_ilock(XFS_I(inode), XFS_IOLOCK_SHARED);
-        error = iomap_fiemap(inode, fieinfo, start, length, &xfs_iomap_ops);
+        if (fieinfo->fi_flags & FIEMAP_FLAG_XATTR) {
+                fieinfo->fi_flags &= ~FIEMAP_FLAG_XATTR;
+                error = iomap_fiemap(inode, fieinfo, start, length,
+                                &xfs_xattr_iomap_ops);
+        } else {
+                error = iomap_fiemap(inode, fieinfo, start, length,
+                                &xfs_iomap_ops);
+        }
         xfs_iunlock(XFS_I(inode), XFS_IOLOCK_SHARED);
 
         return error;
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index 551b7e26980c..7e88bec3f359 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -1298,7 +1298,6 @@ DEFINE_IOMAP_EVENT(xfs_get_blocks_alloc);
 DEFINE_IOMAP_EVENT(xfs_get_blocks_map_direct);
 DEFINE_IOMAP_EVENT(xfs_iomap_alloc);
 DEFINE_IOMAP_EVENT(xfs_iomap_found);
-DEFINE_IOMAP_EVENT(xfs_iomap_not_found);
 
 DECLARE_EVENT_CLASS(xfs_simple_io_class,
         TP_PROTO(struct xfs_inode *ip, xfs_off_t offset, ssize_t count),
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 1bb954842725..436aa4e42221 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -527,13 +527,13 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
  * object's lifetime is managed by something other than RCU.  That
  * "something other" might be reference counting or simple immortality.
  *
- * The seemingly unused void * variable is to validate @p is indeed a pointer
- * type. All pointer types silently cast to void *.
+ * The seemingly unused size_t variable is to validate @p is indeed a pointer
+ * type by making sure it can be dereferenced.
  */
 #define lockless_dereference(p) \
 ({ \
         typeof(p) _________p1 = READ_ONCE(p); \
-        __maybe_unused const void * const _________p2 = _________p1; \
+        size_t __maybe_unused __size_of_ptr = sizeof(*(p)); \
         smp_read_barrier_depends(); /* Dependency order vs. p above. */ \
         (_________p1); \
 })
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 076df5360ba5..3a788bf0affd 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3891,8 +3891,7 @@ void netdev_default_l2upper_neigh_destroy(struct net_device *dev,
 extern u8 netdev_rss_key[NETDEV_RSS_KEY_LEN] __read_mostly;
 void netdev_rss_key_fill(void *buffer, size_t len);
 
-int dev_get_nest_level(struct net_device *dev,
-                       bool (*type_check)(const struct net_device *dev));
+int dev_get_nest_level(struct net_device *dev);
 int skb_checksum_help(struct sk_buff *skb);
 struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
                                   netdev_features_t features, bool tx_path);
diff --git a/include/linux/qed/qed_if.h b/include/linux/qed/qed_if.h
index b1e3c57c7117..d6c4177df7cb 100644
--- a/include/linux/qed/qed_if.h
+++ b/include/linux/qed/qed_if.h
@@ -70,8 +70,16 @@ struct qed_dbcx_pfc_params {
         u8 max_tc;
 };
 
+enum qed_dcbx_sf_ieee_type {
+        QED_DCBX_SF_IEEE_ETHTYPE,
+        QED_DCBX_SF_IEEE_TCP_PORT,
+        QED_DCBX_SF_IEEE_UDP_PORT,
+        QED_DCBX_SF_IEEE_TCP_UDP_PORT
+};
+
 struct qed_app_entry {
         bool ethtype;
+        enum qed_dcbx_sf_ieee_type sf_ieee;
         bool enabled;
         u8 prio;
         u16 proto_id;
diff --git a/include/linux/sctp.h b/include/linux/sctp.h
index de1f64318fc4..fcb4c3646173 100644
--- a/include/linux/sctp.h
+++ b/include/linux/sctp.h
@@ -705,70 +705,6 @@ typedef struct sctp_auth_chunk {
         sctp_authhdr_t auth_hdr;
 } __packed sctp_auth_chunk_t;
 
-struct sctp_info {
-        __u32   sctpi_tag;
-        __u32   sctpi_state;
-        __u32   sctpi_rwnd;
-        __u16   sctpi_unackdata;
-        __u16   sctpi_penddata;
-        __u16   sctpi_instrms;
-        __u16   sctpi_outstrms;
-        __u32   sctpi_fragmentation_point;
-        __u32   sctpi_inqueue;
-        __u32   sctpi_outqueue;
-        __u32   sctpi_overall_error;
-        __u32   sctpi_max_burst;
-        __u32   sctpi_maxseg;
-        __u32   sctpi_peer_rwnd;
-        __u32   sctpi_peer_tag;
-        __u8    sctpi_peer_capable;
-        __u8    sctpi_peer_sack;
-        __u16   __reserved1;
-
-        /* assoc status info */
-        __u64   sctpi_isacks;
-        __u64   sctpi_osacks;
-        __u64   sctpi_opackets;
-        __u64   sctpi_ipackets;
-        __u64   sctpi_rtxchunks;
-        __u64   sctpi_outofseqtsns;
-        __u64   sctpi_idupchunks;
-        __u64   sctpi_gapcnt;
-        __u64   sctpi_ouodchunks;
-        __u64   sctpi_iuodchunks;
-        __u64   sctpi_oodchunks;
-        __u64   sctpi_iodchunks;
-        __u64   sctpi_octrlchunks;
-        __u64   sctpi_ictrlchunks;
-
-        /* primary transport info */
-        struct sockaddr_storage sctpi_p_address;
-        __s32   sctpi_p_state;
-        __u32   sctpi_p_cwnd;
-        __u32   sctpi_p_srtt;
-        __u32   sctpi_p_rto;
-        __u32   sctpi_p_hbinterval;
-        __u32   sctpi_p_pathmaxrxt;
-        __u32   sctpi_p_sackdelay;
-        __u32   sctpi_p_sackfreq;
-        __u32   sctpi_p_ssthresh;
-        __u32   sctpi_p_partial_bytes_acked;
-        __u32   sctpi_p_flight_size;
-        __u16   sctpi_p_error;
-        __u16   __reserved2;
-
-        /* sctp sock info */
-        __u32   sctpi_s_autoclose;
-        __u32   sctpi_s_adaptation_ind;
-        __u32   sctpi_s_pd_point;
-        __u8    sctpi_s_nodelay;
-        __u8    sctpi_s_disable_fragments;
-        __u8    sctpi_s_v4mapped;
-        __u8    sctpi_s_frag_interleave;
-        __u32   sctpi_s_type;
-        __u32   __reserved3;
-};
-
 struct sctp_infox {
         struct sctp_info *sctpinfo;
         struct sctp_association *asoc;
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 6f0b3e0adc73..0f665cb26b50 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2847,6 +2847,18 @@ static inline int skb_linearize_cow(struct sk_buff *skb)
                __skb_linearize(skb) : 0;
 }
 
+static __always_inline void
+__skb_postpull_rcsum(struct sk_buff *skb, const void *start, unsigned int len,
+                     unsigned int off)
+{
+        if (skb->ip_summed == CHECKSUM_COMPLETE)
+                skb->csum = csum_block_sub(skb->csum,
+                                           csum_partial(start, len, 0), off);
+        else if (skb->ip_summed == CHECKSUM_PARTIAL &&
+                 skb_checksum_start_offset(skb) < 0)
+                skb->ip_summed = CHECKSUM_NONE;
+}
+
 /**
  *      skb_postpull_rcsum - update checksum for received skb after pull
  *      @skb: buffer to update
@@ -2857,36 +2869,38 @@ static inline int skb_linearize_cow(struct sk_buff *skb)
  *      update the CHECKSUM_COMPLETE checksum, or set ip_summed to
  *      CHECKSUM_NONE so that it can be recomputed from scratch.
  */
-
 static inline void skb_postpull_rcsum(struct sk_buff *skb,
                                       const void *start, unsigned int len)
 {
-        if (skb->ip_summed == CHECKSUM_COMPLETE)
-                skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0));
-        else if (skb->ip_summed == CHECKSUM_PARTIAL &&
-                 skb_checksum_start_offset(skb) < 0)
-                skb->ip_summed = CHECKSUM_NONE;
+        __skb_postpull_rcsum(skb, start, len, 0);
 }
 
-unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len);
+static __always_inline void
+__skb_postpush_rcsum(struct sk_buff *skb, const void *start, unsigned int len,
+                     unsigned int off)
+{
+        if (skb->ip_summed == CHECKSUM_COMPLETE)
+                skb->csum = csum_block_add(skb->csum,
+                                           csum_partial(start, len, 0), off);
+}
 
+/**
+ *      skb_postpush_rcsum - update checksum for received skb after push
+ *      @skb: buffer to update
+ *      @start: start of data after push
+ *      @len: length of data pushed
+ *
+ *      After doing a push on a received packet, you need to call this to
+ *      update the CHECKSUM_COMPLETE checksum.
+ */
 static inline void skb_postpush_rcsum(struct sk_buff *skb,
                                       const void *start, unsigned int len)
 {
-        /* For performing the reverse operation to skb_postpull_rcsum(),
-         * we can instead of ...
-         *
-         *   skb->csum = csum_add(skb->csum, csum_partial(start, len, 0));
-         *
-         * ... just use this equivalent version here to save a few
-         * instructions. Feeding csum of 0 in csum_partial() and later
-         * on adding skb->csum is equivalent to feed skb->csum in the
-         * first place.
-         */
-        if (skb->ip_summed == CHECKSUM_COMPLETE)
-                skb->csum = csum_partial(start, len, skb->csum);
+        __skb_postpush_rcsum(skb, start, len, 0);
 }
 
+unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len);
+
 /**
  *      skb_push_rcsum - push skb and update receive checksum
  *      @skb: buffer to update
diff --git a/include/net/act_api.h b/include/net/act_api.h
index 41e6a24a44b9..82f3c912a5b1 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -176,8 +176,8 @@ int tcf_register_action(struct tc_action_ops *a, struct pernet_operations *ops);
 int tcf_unregister_action(struct tc_action_ops *a,
                           struct pernet_operations *ops);
 int tcf_action_destroy(struct list_head *actions, int bind);
-int tcf_action_exec(struct sk_buff *skb, const struct list_head *actions,
-                    struct tcf_result *res);
+int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions,
+                    int nr_actions, struct tcf_result *res);
 int tcf_action_init(struct net *net, struct nlattr *nla,
                                   struct nlattr *est, char *n, int ovr,
                                   int bind, struct list_head *);
@@ -189,30 +189,17 @@ int tcf_action_dump_old(struct sk_buff *skb, struct tc_action *a, int, int);
 int tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int, int);
 int tcf_action_copy_stats(struct sk_buff *, struct tc_action *, int);
 
-#define tc_no_actions(_exts) \
-        (list_empty(&(_exts)->actions))
-
-#define tc_for_each_action(_a, _exts) \
-        list_for_each_entry(a, &(_exts)->actions, list)
-
-#define tc_single_action(_exts) \
-        (list_is_singular(&(_exts)->actions))
+#endif /* CONFIG_NET_CLS_ACT */
 
 static inline void tcf_action_stats_update(struct tc_action *a, u64 bytes,
                                            u64 packets, u64 lastuse)
 {
+#ifdef CONFIG_NET_CLS_ACT
         if (!a->ops->stats_update)
                 return;
 
         a->ops->stats_update(a, bytes, packets, lastuse);
+#endif
 }
 
-#else /* CONFIG_NET_CLS_ACT */
-
-#define tc_no_actions(_exts) true
-#define tc_for_each_action(_a, _exts) while ((void)(_a), 0)
-#define tc_single_action(_exts) false
-#define tcf_action_stats_update(a, bytes, packets, lastuse)
-
-#endif /* CONFIG_NET_CLS_ACT */
 #endif
diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index ac1bc3c49fbd..7b0f88699b25 100644
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -40,12 +40,12 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *,
                                            unsigned long,
                                            gfp_t);
 int rxrpc_kernel_send_data(struct rxrpc_call *, struct msghdr *, size_t);
+void rxrpc_kernel_data_consumed(struct rxrpc_call *, struct sk_buff *);
 void rxrpc_kernel_abort_call(struct rxrpc_call *, u32);
 void rxrpc_kernel_end_call(struct rxrpc_call *);
 bool rxrpc_kernel_is_data_last(struct sk_buff *);
 u32 rxrpc_kernel_get_abort_code(struct sk_buff *);
 int rxrpc_kernel_get_error_number(struct sk_buff *);
-void rxrpc_kernel_data_delivered(struct sk_buff *);
 void rxrpc_kernel_free_skb(struct sk_buff *);
 struct rxrpc_call *rxrpc_kernel_accept_call(struct socket *, unsigned long);
 int rxrpc_kernel_reject_call(struct socket *);
diff --git a/include/net/gre.h b/include/net/gre.h
index 7a54a31d1d4c..73ea256eb7d7 100644
--- a/include/net/gre.h
+++ b/include/net/gre.h
@@ -104,6 +104,7 @@ static inline void gre_build_header(struct sk_buff *skb, int hdr_len,
 
         skb_push(skb, hdr_len);
 
+        skb_set_inner_protocol(skb, proto);
         skb_reset_transport_header(skb);
         greh = (struct gre_base_hdr *)skb->data;
         greh->flags = gre_tnl_flags_to_gre_flags(flags);
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index 0dc0a51da38f..dce2d586d9ce 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -128,7 +128,8 @@ static inline int IP6_ECN_set_ce(struct sk_buff *skb, struct ipv6hdr *iph)
         to = from | htonl(INET_ECN_CE << 20);
         *(__be32 *)iph = to;
         if (skb->ip_summed == CHECKSUM_COMPLETE)
-                skb->csum = csum_add(csum_sub(skb->csum, from), to);
+                skb->csum = csum_add(csum_sub(skb->csum, (__force __wsum)from),
+                                     (__force __wsum)to);
         return 1;
 }
 
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index b4faadbb4e01..cca510a585c3 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -3620,7 +3620,8 @@ struct ieee80211_ops {
 
         int (*join_ibss)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
         void (*leave_ibss)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
-        u32 (*get_expected_throughput)(struct ieee80211_sta *sta);
+        u32 (*get_expected_throughput)(struct ieee80211_hw *hw,
+                                       struct ieee80211_sta *sta);
         int (*get_txpower)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                            int *dbm);
 
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index 6f8d65342d3a..c99508d426cc 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -59,7 +59,8 @@ tcf_unbind_filter(struct tcf_proto *tp, struct tcf_result *r)
 struct tcf_exts {
 #ifdef CONFIG_NET_CLS_ACT
         __u32   type; /* for backward compat(TCA_OLD_COMPAT) */
-        struct list_head actions;
+        int nr_actions;
+        struct tc_action **actions;
 #endif
         /* Map to export classifier specific extension TLV types to the
          * generic extensions API. Unsupported extensions must be set to 0.
@@ -72,7 +73,10 @@ static inline void tcf_exts_init(struct tcf_exts *exts, int action, int police)
 {
 #ifdef CONFIG_NET_CLS_ACT
         exts->type = 0;
-        INIT_LIST_HEAD(&exts->actions);
+        exts->nr_actions = 0;
+        exts->actions = kcalloc(TCA_ACT_MAX_PRIO, sizeof(struct tc_action *),
+                                GFP_KERNEL);
+        WARN_ON(!exts->actions); /* TODO: propagate the error to callers */
 #endif
         exts->action = action;
         exts->police = police;
@@ -89,7 +93,7 @@ static inline int
 tcf_exts_is_predicative(struct tcf_exts *exts)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        return !list_empty(&exts->actions);
+        return exts->nr_actions;
 #else
         return 0;
 #endif
@@ -108,6 +112,20 @@ tcf_exts_is_available(struct tcf_exts *exts)
         return tcf_exts_is_predicative(exts);
 }
 
+static inline void tcf_exts_to_list(const struct tcf_exts *exts,
+                                    struct list_head *actions)
+{
+#ifdef CONFIG_NET_CLS_ACT
+        int i;
+
+        for (i = 0; i < exts->nr_actions; i++) {
+                struct tc_action *a = exts->actions[i];
+
+                list_add(&a->list, actions);
+        }
+#endif
+}
+
 /**
  * tcf_exts_exec - execute tc filter extensions
  * @skb: socket buffer
@@ -124,12 +142,25 @@ tcf_exts_exec(struct sk_buff *skb, struct tcf_exts *exts,
                struct tcf_result *res)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        if (!list_empty(&exts->actions))
-                return tcf_action_exec(skb, &exts->actions, res);
+        if (exts->nr_actions)
+                return tcf_action_exec(skb, exts->actions, exts->nr_actions,
+                                       res);
 #endif
         return 0;
 }
 
+#ifdef CONFIG_NET_CLS_ACT
+
+#define tc_no_actions(_exts)  ((_exts)->nr_actions == 0)
+#define tc_single_action(_exts) ((_exts)->nr_actions == 1)
+
+#else /* CONFIG_NET_CLS_ACT */
+
+#define tc_no_actions(_exts) true
+#define tc_single_action(_exts) false
+
+#endif /* CONFIG_NET_CLS_ACT */
+
 int tcf_exts_validate(struct net *net, struct tcf_proto *tp,
                       struct nlattr **tb, struct nlattr *rate_tlv,
                       struct tcf_exts *exts, bool ovr);
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index da218fec6056..9e5fc168c8a3 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -339,7 +339,7 @@ enum bpf_func_id {
         BPF_FUNC_skb_change_type,
 
         /**
-         * bpf_skb_in_cgroup(skb, map, index) - Check cgroup2 membership of skb
+         * bpf_skb_under_cgroup(skb, map, index) - Check cgroup2 membership of skb
          * @skb: pointer to skb
          * @map: pointer to bpf_map in BPF_MAP_TYPE_CGROUP_ARRAY type
          * @index: index of the cgroup in the bpf_map
@@ -348,7 +348,7 @@ enum bpf_func_id {
          *   == 1 skb succeeded the cgroup2 descendant test
          *    < 0 error
          */
-        BPF_FUNC_skb_in_cgroup,
+        BPF_FUNC_skb_under_cgroup,
 
         /**
          * bpf_get_hash_recalc(skb)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 01751faccaf8..c674ba2563b7 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -24,7 +24,7 @@ enum nft_registers {
         __NFT_REG_MAX,
 
         NFT_REG32_00    = 8,
-        MFT_REG32_01,
+        NFT_REG32_01,
         NFT_REG32_02,
         NFT_REG32_03,
         NFT_REG32_04,
diff --git a/include/uapi/linux/sctp.h b/include/uapi/linux/sctp.h
index d304f4c9792c..a406adcc0793 100644
--- a/include/uapi/linux/sctp.h
+++ b/include/uapi/linux/sctp.h
@@ -944,4 +944,68 @@ struct sctp_default_prinfo {
         __u16 pr_policy;
 };
 
+struct sctp_info {
+        __u32   sctpi_tag;
+        __u32   sctpi_state;
+        __u32   sctpi_rwnd;
+        __u16   sctpi_unackdata;
+        __u16   sctpi_penddata;
+        __u16   sctpi_instrms;
+        __u16   sctpi_outstrms;
+        __u32   sctpi_fragmentation_point;
+        __u32   sctpi_inqueue;
+        __u32   sctpi_outqueue;
+        __u32   sctpi_overall_error;
+        __u32   sctpi_max_burst;
+        __u32   sctpi_maxseg;
+        __u32   sctpi_peer_rwnd;
+        __u32   sctpi_peer_tag;
+        __u8    sctpi_peer_capable;
+        __u8    sctpi_peer_sack;
+        __u16   __reserved1;
+
+        /* assoc status info */
+        __u64   sctpi_isacks;
+        __u64   sctpi_osacks;
+        __u64   sctpi_opackets;
+        __u64   sctpi_ipackets;
+        __u64   sctpi_rtxchunks;
+        __u64   sctpi_outofseqtsns;
+        __u64   sctpi_idupchunks;
+        __u64   sctpi_gapcnt;
+        __u64   sctpi_ouodchunks;
+        __u64   sctpi_iuodchunks;
+        __u64   sctpi_oodchunks;
+        __u64   sctpi_iodchunks;
+        __u64   sctpi_octrlchunks;
+        __u64   sctpi_ictrlchunks;
+
+        /* primary transport info */
+        struct sockaddr_storage sctpi_p_address;
+        __s32   sctpi_p_state;
+        __u32   sctpi_p_cwnd;
+        __u32   sctpi_p_srtt;
+        __u32   sctpi_p_rto;
+        __u32   sctpi_p_hbinterval;
+        __u32   sctpi_p_pathmaxrxt;
+        __u32   sctpi_p_sackdelay;
+        __u32   sctpi_p_sackfreq;
+        __u32   sctpi_p_ssthresh;
+        __u32   sctpi_p_partial_bytes_acked;
+        __u32   sctpi_p_flight_size;
+        __u16   sctpi_p_error;
+        __u16   __reserved2;
+
+        /* sctp sock info */
+        __u32   sctpi_s_autoclose;
+        __u32   sctpi_s_adaptation_ind;
+        __u32   sctpi_s_pd_point;
+        __u8    sctpi_s_nodelay;
+        __u8    sctpi_s_disable_fragments;
+        __u8    sctpi_s_v4mapped;
+        __u8    sctpi_s_frag_interleave;
+        __u32   sctpi_s_type;
+        __u32   __reserved3;
+};
+
 #endif /* _UAPI_SCTP_H */
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index fff3650d52fc..570eeca7bdfa 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -26,11 +26,18 @@ struct bpf_htab {
         struct bucket *buckets;
         void *elems;
         struct pcpu_freelist freelist;
+        void __percpu *extra_elems;
         atomic_t count; /* number of elements in this hashtable */
         u32 n_buckets;  /* number of hash buckets */
         u32 elem_size;  /* size of each element in bytes */
 };
 
+enum extra_elem_state {
+        HTAB_NOT_AN_EXTRA_ELEM = 0,
+        HTAB_EXTRA_ELEM_FREE,
+        HTAB_EXTRA_ELEM_USED
+};
+
 /* each htab element is struct htab_elem + key + value */
 struct htab_elem {
         union {
@@ -38,7 +45,10 @@ struct htab_elem {
                 struct bpf_htab *htab;
                 struct pcpu_freelist_node fnode;
         };
-        struct rcu_head rcu;
+        union {
+                struct rcu_head rcu;
+                enum extra_elem_state state;
+        };
         u32 hash;
         char key[0] __aligned(8);
 };
@@ -113,6 +123,23 @@ free_elems:
         return err;
 }
 
+static int alloc_extra_elems(struct bpf_htab *htab)
+{
+        void __percpu *pptr;
+        int cpu;
+
+        pptr = __alloc_percpu_gfp(htab->elem_size, 8, GFP_USER | __GFP_NOWARN);
+        if (!pptr)
+                return -ENOMEM;
+
+        for_each_possible_cpu(cpu) {
+                ((struct htab_elem *)per_cpu_ptr(pptr, cpu))->state =
+                        HTAB_EXTRA_ELEM_FREE;
+        }
+        htab->extra_elems = pptr;
+        return 0;
+}
+
 /* Called from syscall */
 static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
 {
@@ -185,6 +212,8 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
         if (percpu)
                 cost += (u64) round_up(htab->map.value_size, 8) *
                         num_possible_cpus() * htab->map.max_entries;
+        else
+               cost += (u64) htab->elem_size * num_possible_cpus();
 
         if (cost >= U32_MAX - PAGE_SIZE)
                 /* make sure page count doesn't overflow */
@@ -212,14 +241,22 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
                 raw_spin_lock_init(&htab->buckets[i].lock);
         }
 
+        if (!percpu) {
+                err = alloc_extra_elems(htab);
+                if (err)
+                        goto free_buckets;
+        }
+
         if (!(attr->map_flags & BPF_F_NO_PREALLOC)) {
                 err = prealloc_elems_and_freelist(htab);
                 if (err)
-                        goto free_buckets;
+                        goto free_extra_elems;
         }
 
         return &htab->map;
 
+free_extra_elems:
+        free_percpu(htab->extra_elems);
 free_buckets:
         kvfree(htab->buckets);
 free_htab:
@@ -349,7 +386,6 @@ static void htab_elem_free(struct bpf_htab *htab, struct htab_elem *l)
         if (htab->map.map_type == BPF_MAP_TYPE_PERCPU_HASH)
                 free_percpu(htab_elem_get_ptr(l, htab->map.key_size));
         kfree(l);
-
 }
 
 static void htab_elem_free_rcu(struct rcu_head *head)
@@ -370,6 +406,11 @@ static void htab_elem_free_rcu(struct rcu_head *head)
 
 static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
 {
+        if (l->state == HTAB_EXTRA_ELEM_USED) {
+                l->state = HTAB_EXTRA_ELEM_FREE;
+                return;
+        }
+
         if (!(htab->map.map_flags & BPF_F_NO_PREALLOC)) {
                 pcpu_freelist_push(&htab->freelist, &l->fnode);
         } else {
@@ -381,25 +422,44 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
 
 static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
                                          void *value, u32 key_size, u32 hash,
-                                         bool percpu, bool onallcpus)
+                                         bool percpu, bool onallcpus,
+                                         bool old_elem_exists)
 {
         u32 size = htab->map.value_size;
         bool prealloc = !(htab->map.map_flags & BPF_F_NO_PREALLOC);
         struct htab_elem *l_new;
         void __percpu *pptr;
+        int err = 0;
 
         if (prealloc) {
                 l_new = (struct htab_elem *)pcpu_freelist_pop(&htab->freelist);
                 if (!l_new)
-                        return ERR_PTR(-E2BIG);
+                        err = -E2BIG;
         } else {
                 if (atomic_inc_return(&htab->count) > htab->map.max_entries) {
                         atomic_dec(&htab->count);
-                        return ERR_PTR(-E2BIG);
+                        err = -E2BIG;
+                } else {
+                        l_new = kmalloc(htab->elem_size,
+                                        GFP_ATOMIC | __GFP_NOWARN);
+                        if (!l_new)
+                                return ERR_PTR(-ENOMEM);
                 }
-                l_new = kmalloc(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN);
-                if (!l_new)
-                        return ERR_PTR(-ENOMEM);
+        }
+
+        if (err) {
+                if (!old_elem_exists)
+                        return ERR_PTR(err);
+
+                /* if we're updating the existing element and the hash table
+                 * is full, use per-cpu extra elems
+                 */
+                l_new = this_cpu_ptr(htab->extra_elems);
+                if (l_new->state != HTAB_EXTRA_ELEM_FREE)
+                        return ERR_PTR(-E2BIG);
+                l_new->state = HTAB_EXTRA_ELEM_USED;
+        } else {
+                l_new->state = HTAB_NOT_AN_EXTRA_ELEM;
         }
 
         memcpy(l_new->key, key, key_size);
@@ -489,7 +549,8 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
         if (ret)
                 goto err;
 
-        l_new = alloc_htab_elem(htab, key, value, key_size, hash, false, false);
+        l_new = alloc_htab_elem(htab, key, value, key_size, hash, false, false,
+                                !!l_old);
         if (IS_ERR(l_new)) {
                 /* all pre-allocated elements are in use or memory exhausted */
                 ret = PTR_ERR(l_new);
@@ -563,7 +624,7 @@ static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key,
                 }
         } else {
                 l_new = alloc_htab_elem(htab, key, value, key_size,
-                                        hash, true, onallcpus);
+                                        hash, true, onallcpus, false);
                 if (IS_ERR(l_new)) {
                         ret = PTR_ERR(l_new);
                         goto err;
@@ -652,6 +713,7 @@ static void htab_map_free(struct bpf_map *map)
                 htab_free_elems(htab);
                 pcpu_freelist_destroy(&htab->freelist);
         }
+        free_percpu(htab->extra_elems);
         kvfree(htab->buckets);
         kfree(htab);
 }
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index f72f23b8fdab..daea765d72e6 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -194,6 +194,7 @@ struct verifier_env {
         struct verifier_state_list **explored_states; /* search pruning optimization */
         struct bpf_map *used_maps[MAX_USED_MAPS]; /* array of map's used by eBPF program */
         u32 used_map_cnt;               /* number of used maps */
+        u32 id_gen;                     /* used to generate unique reg IDs */
         bool allow_ptr_leaks;
 };
 
@@ -1052,7 +1053,7 @@ static int check_map_func_compatibility(struct bpf_map *map, int func_id)
                         goto error;
                 break;
         case BPF_MAP_TYPE_CGROUP_ARRAY:
-                if (func_id != BPF_FUNC_skb_in_cgroup)
+                if (func_id != BPF_FUNC_skb_under_cgroup)
                         goto error;
                 break;
         default:
@@ -1074,7 +1075,7 @@ static int check_map_func_compatibility(struct bpf_map *map, int func_id)
                 if (map->map_type != BPF_MAP_TYPE_STACK_TRACE)
                         goto error;
                 break;
-        case BPF_FUNC_skb_in_cgroup:
+        case BPF_FUNC_skb_under_cgroup:
                 if (map->map_type != BPF_MAP_TYPE_CGROUP_ARRAY)
                         goto error;
                 break;
@@ -1301,7 +1302,7 @@ add_imm:
                 /* dst_reg stays as pkt_ptr type and since some positive
                  * integer value was added to the pointer, increment its 'id'
                  */
-                dst_reg->id++;
+                dst_reg->id = ++env->id_gen;
 
                 /* something was added to pkt_ptr, set range and off to zero */
                 dst_reg->off = 0;
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 1903b8f3a705..5650f5317e0c 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -242,18 +242,6 @@ unlock:
         return ret;
 }
 
-static void event_function_local(struct perf_event *event, event_f func, void *data)
-{
-        struct event_function_struct efs = {
-                .event = event,
-                .func = func,
-                .data = data,
-        };
-
-        int ret = event_function(&efs);
-        WARN_ON_ONCE(ret);
-}
-
 static void event_function_call(struct perf_event *event, event_f func, void *data)
 {
         struct perf_event_context *ctx = event->ctx;
@@ -303,6 +291,54 @@ again:
         raw_spin_unlock_irq(&ctx->lock);
 }
 
+/*
+ * Similar to event_function_call() + event_function(), but hard assumes IRQs
+ * are already disabled and we're on the right CPU.
+ */
+static void event_function_local(struct perf_event *event, event_f func, void *data)
+{
+        struct perf_event_context *ctx = event->ctx;
+        struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
+        struct task_struct *task = READ_ONCE(ctx->task);
+        struct perf_event_context *task_ctx = NULL;
+
+        WARN_ON_ONCE(!irqs_disabled());
+
+        if (task) {
+                if (task == TASK_TOMBSTONE)
+                        return;
+
+                task_ctx = ctx;
+        }
+
+        perf_ctx_lock(cpuctx, task_ctx);
+
+        task = ctx->task;
+        if (task == TASK_TOMBSTONE)
+                goto unlock;
+
+        if (task) {
+                /*
+                 * We must be either inactive or active and the right task,
+                 * otherwise we're screwed, since we cannot IPI to somewhere
+                 * else.
+                 */
+                if (ctx->is_active) {
+                        if (WARN_ON_ONCE(task != current))
+                                goto unlock;
+
+                        if (WARN_ON_ONCE(cpuctx->task_ctx != ctx))
+                                goto unlock;
+                }
+        } else {
+                WARN_ON_ONCE(&cpuctx->ctx != ctx);
+        }
+
+        func(event, cpuctx, ctx, data);
+unlock:
+        perf_ctx_unlock(cpuctx, task_ctx);
+}
+
 #define PERF_FLAG_ALL (PERF_FLAG_FD_NO_GROUP |\
                        PERF_FLAG_FD_OUTPUT  |\
                        PERF_FLAG_PID_CGROUP |\
@@ -3513,9 +3549,10 @@ static int perf_event_read(struct perf_event *event, bool group)
                         .group = group,
                         .ret = 0,
                 };
-                smp_call_function_single(event->oncpu,
-                                         __perf_event_read, &data, 1);
-                ret = data.ret;
+                ret = smp_call_function_single(event->oncpu, __perf_event_read, &data, 1);
+                /* The event must have been read from an online CPU: */
+                WARN_ON_ONCE(ret);
+                ret = ret ? : data.ret;
         } else if (event->state == PERF_EVENT_STATE_INACTIVE) {
                 struct perf_event_context *ctx = event->ctx;
                 unsigned long flags;
@@ -6584,15 +6621,6 @@ got_name:
 }
 
 /*
- * Whether this @filter depends on a dynamic object which is not loaded
- * yet or its load addresses are not known.
- */
-static bool perf_addr_filter_needs_mmap(struct perf_addr_filter *filter)
-{
-        return filter->filter && filter->inode;
-}
-
-/*
  * Check whether inode and address range match filter criteria.
  */
 static bool perf_addr_filter_match(struct perf_addr_filter *filter,
@@ -6653,6 +6681,13 @@ static void perf_addr_filters_adjust(struct vm_area_struct *vma)
         struct perf_event_context *ctx;
         int ctxn;
 
+        /*
+         * Data tracing isn't supported yet and as such there is no need
+         * to keep track of anything that isn't related to executable code:
+         */
+        if (!(vma->vm_flags & VM_EXEC))
+                return;
+
         rcu_read_lock();
         for_each_task_context_nr(ctxn) {
                 ctx = rcu_dereference(current->perf_event_ctxp[ctxn]);
@@ -7805,7 +7840,11 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
         list_for_each_entry(filter, &ifh->list, entry) {
                 event->addr_filters_offs[count] = 0;
 
-                if (perf_addr_filter_needs_mmap(filter))
+                /*
+                 * Adjust base offset if the filter is associated to a binary
+                 * that needs to be mapped:
+                 */
+                if (filter->inode)
                         event->addr_filters_offs[count] =
                                 perf_addr_filter_apply(filter, mm);
 
@@ -7936,8 +7975,10 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr,
                                         goto fail;
                         }
 
-                        if (token == IF_SRC_FILE) {
-                                filename = match_strdup(&args[2]);
+                        if (token == IF_SRC_FILE || token == IF_SRC_FILEADDR) {
+                                int fpos = filter->range ? 2 : 1;
+
+                                filename = match_strdup(&args[fpos]);
                                 if (!filename) {
                                         ret = -ENOMEM;
                                         goto fail;
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index b7a525ab2083..8c50276b60d1 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -172,8 +172,10 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
         mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
         err = -EAGAIN;
         ptep = page_check_address(page, mm, addr, &ptl, 0);
-        if (!ptep)
+        if (!ptep) {
+                mem_cgroup_cancel_charge(kpage, memcg, false);
                 goto unlock;
+        }
 
         get_page(kpage);
         page_add_new_anon_rmap(kpage, vma, addr, false);
@@ -200,7 +202,6 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
 
         err = 0;
  unlock:
-        mem_cgroup_cancel_charge(kpage, memcg, false);
         mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
         unlock_page(page);
         return err;
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 9a0178c2ac1d..b02228411d57 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -835,9 +835,9 @@ static bool memory_bm_pfn_present(struct memory_bitmap *bm, unsigned long pfn)
  */
 static bool rtree_next_node(struct memory_bitmap *bm)
 {
-        bm->cur.node = list_entry(bm->cur.node->list.next,
-                                  struct rtree_node, list);
-        if (&bm->cur.node->list != &bm->cur.zone->leaves) {
+        if (!list_is_last(&bm->cur.node->list, &bm->cur.zone->leaves)) {
+                bm->cur.node = list_entry(bm->cur.node->list.next,
+                                          struct rtree_node, list);
                 bm->cur.node_pfn += BM_BITS_PER_BLOCK;
                 bm->cur.node_bit  = 0;
                 touch_softlockup_watchdog();
@@ -845,9 +845,9 @@ static bool rtree_next_node(struct memory_bitmap *bm)
         }
 
         /* No more nodes, goto next zone */
-        bm->cur.zone = list_entry(bm->cur.zone->list.next,
+        if (!list_is_last(&bm->cur.zone->list, &bm->zones)) {
+                bm->cur.zone = list_entry(bm->cur.zone->list.next,
                                   struct mem_zone_bm_rtree, list);
-        if (&bm->cur.zone->list != &bm->zones) {
                 bm->cur.node = list_entry(bm->cur.zone->leaves.next,
                                           struct rtree_node, list);
                 bm->cur.node_pfn = 0;
diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
index 9858266fb0b3..a846cf89eb96 100644
--- a/kernel/sched/cputime.c
+++ b/kernel/sched/cputime.c
@@ -263,6 +263,11 @@ void account_idle_time(cputime_t cputime)
                 cpustat[CPUTIME_IDLE] += (__force u64) cputime;
 }
 
+/*
+ * When a guest is interrupted for a longer amount of time, missed clock
+ * ticks are not redelivered later. Due to that, this function may on
+ * occasion account more time than the calling functions think elapsed.
+ */
 static __always_inline cputime_t steal_account_process_time(cputime_t maxtime)
 {
 #ifdef CONFIG_PARAVIRT
@@ -371,7 +376,7 @@ static void irqtime_account_process_tick(struct task_struct *p, int user_tick,
          * idle, or potentially user or system time. Due to rounding,
          * other time can exceed ticks occasionally.
          */
-        other = account_other_time(cputime);
+        other = account_other_time(ULONG_MAX);
         if (other >= cputime)
                 return;
         cputime -= other;
@@ -486,7 +491,7 @@ void account_process_tick(struct task_struct *p, int user_tick)
         }
 
         cputime = cputime_one_jiffy;
-        steal = steal_account_process_time(cputime);
+        steal = steal_account_process_time(ULONG_MAX);
 
         if (steal >= cputime)
                 return;
@@ -516,7 +521,7 @@ void account_idle_ticks(unsigned long ticks)
         }
 
         cputime = jiffies_to_cputime(ticks);
-        steal = steal_account_process_time(cputime);
+        steal = steal_account_process_time(ULONG_MAX);
 
         if (steal >= cputime)
                 return;
@@ -614,19 +619,25 @@ static void cputime_adjust(struct task_cputime *curr,
         stime = curr->stime;
         utime = curr->utime;
 
-        if (utime == 0) {
-                stime = rtime;
+        /*
+         * If either stime or both stime and utime are 0, assume all runtime is
+         * userspace. Once a task gets some ticks, the monotonicy code at
+         * 'update' will ensure things converge to the observed ratio.
+         */
+        if (stime == 0) {
+                utime = rtime;
                 goto update;
         }
 
-        if (stime == 0) {
-                utime = rtime;
+        if (utime == 0) {
+                stime = rtime;
                 goto update;
         }
 
         stime = scale_stime((__force u64)stime, (__force u64)rtime,
                             (__force u64)(stime + utime));
 
+update:
         /*
          * Make sure stime doesn't go backwards; this preserves monotonicity
          * for utime because rtime is monotonic.
@@ -649,7 +660,6 @@ static void cputime_adjust(struct task_cputime *curr,
                 stime = rtime - utime;
         }
 
-update:
         prev->stime = stime;
         prev->utime = utime;
 out:
@@ -694,6 +704,13 @@ static cputime_t get_vtime_delta(struct task_struct *tsk)
         unsigned long now = READ_ONCE(jiffies);
         cputime_t delta, other;
 
+        /*
+         * Unlike tick based timing, vtime based timing never has lost
+         * ticks, and no need for steal time accounting to make up for
+         * lost ticks. Vtime accounts a rounded version of actual
+         * elapsed time. Limit account_other_time to prevent rounding
+         * errors from causing elapsed vtime to go negative.
+         */
         delta = jiffies_to_cputime(now - tsk->vtime_snap);
         other = account_other_time(delta);
         WARN_ON_ONCE(tsk->vtime_snap_whence == VTIME_INACTIVE);
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 5d845ffd7982..5ba520b544d7 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -30,7 +30,7 @@
 
 #define HASH_DEFAULT_SIZE       64UL
 #define HASH_MIN_SIZE           4U
-#define BUCKET_LOCKS_PER_CPU   128UL
+#define BUCKET_LOCKS_PER_CPU    32UL
 
 static u32 head_hashfn(struct rhashtable *ht,
                        const struct bucket_table *tbl,
@@ -70,7 +70,7 @@ static int alloc_bucket_locks(struct rhashtable *ht, struct bucket_table *tbl,
         unsigned int nr_pcpus = num_possible_cpus();
 #endif
 
-        nr_pcpus = min_t(unsigned int, nr_pcpus, 32UL);
+        nr_pcpus = min_t(unsigned int, nr_pcpus, 64UL);
         size = roundup_pow_of_two(nr_pcpus * ht->p.locks_mul);
 
         /* Never allocate more than 0.5 locks per bucket */
@@ -83,6 +83,9 @@ static int alloc_bucket_locks(struct rhashtable *ht, struct bucket_table *tbl,
                         tbl->locks = vmalloc(size * sizeof(spinlock_t));
                 else
 #endif
+                if (gfp != GFP_KERNEL)
+                        gfp |= __GFP_NOWARN | __GFP_NORETRY;
+
                 tbl->locks = kmalloc_array(size, sizeof(spinlock_t),
                                            gfp);
                 if (!tbl->locks)
@@ -321,12 +324,14 @@ static int rhashtable_expand(struct rhashtable *ht)
 static int rhashtable_shrink(struct rhashtable *ht)
 {
         struct bucket_table *new_tbl, *old_tbl = rht_dereference(ht->tbl, ht);
-        unsigned int size;
+        unsigned int nelems = atomic_read(&ht->nelems);
+        unsigned int size = 0;
         int err;
 
         ASSERT_RHT_MUTEX(ht);
 
-        size = roundup_pow_of_two(atomic_read(&ht->nelems) * 3 / 2);
+        if (nelems)
+                size = roundup_pow_of_two(nelems * 3 / 2);
         if (size < ht->p.min_size)
                 size = ht->p.min_size;
 
diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
index 297fdb5e74bd..64e899b63337 100644
--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -38,7 +38,7 @@ MODULE_PARM_DESC(runs, "Number of test runs per variant (default: 4)");
 
 static int max_size = 0;
 module_param(max_size, int, 0);
-MODULE_PARM_DESC(runs, "Maximum table size (default: calculated)");
+MODULE_PARM_DESC(max_size, "Maximum table size (default: calculated)");
 
 static bool shrinking = false;
 module_param(shrinking, bool, 0);
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 82a116ba590e..8de138d3306b 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -169,7 +169,7 @@ int register_vlan_dev(struct net_device *dev)
         if (err < 0)
                 goto out_uninit_mvrp;
 
-        vlan->nest_level = dev_get_nest_level(real_dev, is_vlan_dev) + 1;
+        vlan->nest_level = dev_get_nest_level(real_dev) + 1;
         err = register_netdevice(dev);
         if (err < 0)
                 goto out_uninit_mvrp;
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index c18080ad4085..cd620fab41b0 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -267,7 +267,7 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
 
         /* If old entry was unassociated with any port, then delete it. */
         f = __br_fdb_get(br, br->dev->dev_addr, 0);
-        if (f && f->is_local && !f->dst)
+        if (f && f->is_local && !f->dst && !f->added_by_user)
                 fdb_delete_local(br, NULL, f);
 
         fdb_insert(br, NULL, newaddr, 0);
@@ -282,7 +282,7 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
                 if (!br_vlan_should_use(v))
                         continue;
                 f = __br_fdb_get(br, br->dev->dev_addr, v->vid);
-                if (f && f->is_local && !f->dst)
+                if (f && f->is_local && !f->dst && !f->added_by_user)
                         fdb_delete_local(br, NULL, f);
                 fdb_insert(br, NULL, newaddr, v->vid);
         }
@@ -764,20 +764,25 @@ out:
 }
 
 /* Update (create or replace) forwarding database entry */
-static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
-                         __u16 state, __u16 flags, __u16 vid)
+static int fdb_add_entry(struct net_bridge *br, struct net_bridge_port *source,
+                         const __u8 *addr, __u16 state, __u16 flags, __u16 vid)
 {
-        struct net_bridge *br = source->br;
         struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
         struct net_bridge_fdb_entry *fdb;
         bool modified = false;
 
         /* If the port cannot learn allow only local and static entries */
-        if (!(state & NUD_PERMANENT) && !(state & NUD_NOARP) &&
+        if (source && !(state & NUD_PERMANENT) && !(state & NUD_NOARP) &&
             !(source->state == BR_STATE_LEARNING ||
               source->state == BR_STATE_FORWARDING))
                 return -EPERM;
 
+        if (!source && !(state & NUD_PERMANENT)) {
+                pr_info("bridge: RTM_NEWNEIGH %s without NUD_PERMANENT\n",
+                        br->dev->name);
+                return -EINVAL;
+        }
+
         fdb = fdb_find(head, addr, vid);
         if (fdb == NULL) {
                 if (!(flags & NLM_F_CREATE))
@@ -832,22 +837,28 @@ static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
         return 0;
 }
 
-static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge_port *p,
-               const unsigned char *addr, u16 nlh_flags, u16 vid)
+static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge *br,
+                        struct net_bridge_port *p, const unsigned char *addr,
+                        u16 nlh_flags, u16 vid)
 {
         int err = 0;
 
         if (ndm->ndm_flags & NTF_USE) {
+                if (!p) {
+                        pr_info("bridge: RTM_NEWNEIGH %s with NTF_USE is not supported\n",
+                                br->dev->name);
+                        return -EINVAL;
+                }
                 local_bh_disable();
                 rcu_read_lock();
-                br_fdb_update(p->br, p, addr, vid, true);
+                br_fdb_update(br, p, addr, vid, true);
                 rcu_read_unlock();
                 local_bh_enable();
         } else {
-                spin_lock_bh(&p->br->hash_lock);
-                err = fdb_add_entry(p, addr, ndm->ndm_state,
+                spin_lock_bh(&br->hash_lock);
+                err = fdb_add_entry(br, p, addr, ndm->ndm_state,
                                     nlh_flags, vid);
-                spin_unlock_bh(&p->br->hash_lock);
+                spin_unlock_bh(&br->hash_lock);
         }
 
         return err;
@@ -884,6 +895,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                                 dev->name);
                         return -EINVAL;
                 }
+                br = p->br;
                 vg = nbp_vlan_group(p);
         }
 
@@ -895,15 +907,9 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                 }
 
                 /* VID was specified, so use it. */
-                if (dev->priv_flags & IFF_EBRIDGE)
-                        err = br_fdb_insert(br, NULL, addr, vid);
-                else
-                        err = __br_fdb_add(ndm, p, addr, nlh_flags, vid);
+                err = __br_fdb_add(ndm, br, p, addr, nlh_flags, vid);
         } else {
-                if (dev->priv_flags & IFF_EBRIDGE)
-                        err = br_fdb_insert(br, NULL, addr, 0);
-                else
-                        err = __br_fdb_add(ndm, p, addr, nlh_flags, 0);
+                err = __br_fdb_add(ndm, br, p, addr, nlh_flags, 0);
                 if (err || !vg || !vg->num_vlans)
                         goto out;
 
@@ -914,11 +920,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                 list_for_each_entry(v, &vg->vlan_list, vlist) {
                         if (!br_vlan_should_use(v))
                                 continue;
-                        if (dev->priv_flags & IFF_EBRIDGE)
-                                err = br_fdb_insert(br, NULL, addr, v->vid);
-                        else
-                                err = __br_fdb_add(ndm, p, addr, nlh_flags,
-                                                   v->vid);
+                        err = __br_fdb_add(ndm, br, p, addr, nlh_flags, v->vid);
                         if (err)
                                 goto out;
                 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 4ce07dc25573..dd6ce598de89 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6045,8 +6045,7 @@ void *netdev_lower_dev_get_private(struct net_device *dev,
 EXPORT_SYMBOL(netdev_lower_dev_get_private);
 
 
-int dev_get_nest_level(struct net_device *dev,
-                       bool (*type_check)(const struct net_device *dev))
+int dev_get_nest_level(struct net_device *dev)
 {
         struct net_device *lower = NULL;
         struct list_head *iter;
@@ -6056,15 +6055,12 @@ int dev_get_nest_level(struct net_device *dev,
         ASSERT_RTNL();
 
         netdev_for_each_lower_dev(dev, lower, iter) {
-                nest = dev_get_nest_level(lower, type_check);
+                nest = dev_get_nest_level(lower);
                 if (max_nest < nest)
                         max_nest = nest;
         }
 
-        if (type_check(dev))
-                max_nest++;
-
-        return max_nest;
+        return max_nest + 1;
 }
 EXPORT_SYMBOL(dev_get_nest_level);
 
diff --git a/net/core/filter.c b/net/core/filter.c
index 5708999f8a79..cb06aceb512a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1355,56 +1355,47 @@ static inline int bpf_try_make_writable(struct sk_buff *skb,
 {
         int err;
 
-        if (!skb_cloned(skb))
-                return 0;
-        if (skb_clone_writable(skb, write_len))
-                return 0;
-        err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
-        if (!err)
-                bpf_compute_data_end(skb);
+        err = skb_ensure_writable(skb, write_len);
+        bpf_compute_data_end(skb);
+
         return err;
 }
 
+static inline void bpf_push_mac_rcsum(struct sk_buff *skb)
+{
+        if (skb_at_tc_ingress(skb))
+                skb_postpush_rcsum(skb, skb_mac_header(skb), skb->mac_len);
+}
+
+static inline void bpf_pull_mac_rcsum(struct sk_buff *skb)
+{
+        if (skb_at_tc_ingress(skb))
+                skb_postpull_rcsum(skb, skb_mac_header(skb), skb->mac_len);
+}
+
 static u64 bpf_skb_store_bytes(u64 r1, u64 r2, u64 r3, u64 r4, u64 flags)
 {
-        struct bpf_scratchpad *sp = this_cpu_ptr(&bpf_sp);
         struct sk_buff *skb = (struct sk_buff *) (long) r1;
-        int offset = (int) r2;
+        unsigned int offset = (unsigned int) r2;
         void *from = (void *) (long) r3;
         unsigned int len = (unsigned int) r4;
         void *ptr;
 
         if (unlikely(flags & ~(BPF_F_RECOMPUTE_CSUM | BPF_F_INVALIDATE_HASH)))
                 return -EINVAL;
-
-        /* bpf verifier guarantees that:
-         * 'from' pointer points to bpf program stack
-         * 'len' bytes of it were initialized
-         * 'len' > 0
-         * 'skb' is a valid pointer to 'struct sk_buff'
-         *
-         * so check for invalid 'offset' and too large 'len'
-         */
-        if (unlikely((u32) offset > 0xffff || len > sizeof(sp->buff)))
+        if (unlikely(offset > 0xffff))
                 return -EFAULT;
         if (unlikely(bpf_try_make_writable(skb, offset + len)))
                 return -EFAULT;
 
-        ptr = skb_header_pointer(skb, offset, len, sp->buff);
-        if (unlikely(!ptr))
-                return -EFAULT;
-
+        ptr = skb->data + offset;
         if (flags & BPF_F_RECOMPUTE_CSUM)
-                skb_postpull_rcsum(skb, ptr, len);
+                __skb_postpull_rcsum(skb, ptr, len, offset);
 
         memcpy(ptr, from, len);
 
-        if (ptr == sp->buff)
-                /* skb_store_bits cannot return -EFAULT here */
-                skb_store_bits(skb, offset, ptr, len);
-
         if (flags & BPF_F_RECOMPUTE_CSUM)
-                skb_postpush_rcsum(skb, ptr, len);
+                __skb_postpush_rcsum(skb, ptr, len, offset);
         if (flags & BPF_F_INVALIDATE_HASH)
                 skb_clear_hash(skb);
 
@@ -1425,12 +1416,12 @@ static const struct bpf_func_proto bpf_skb_store_bytes_proto = {
 static u64 bpf_skb_load_bytes(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
 {
         const struct sk_buff *skb = (const struct sk_buff *)(unsigned long) r1;
-        int offset = (int) r2;
+        unsigned int offset = (unsigned int) r2;
         void *to = (void *)(unsigned long) r3;
         unsigned int len = (unsigned int) r4;
         void *ptr;
 
-        if (unlikely((u32) offset > 0xffff))
+        if (unlikely(offset > 0xffff))
                 goto err_clear;
 
         ptr = skb_header_pointer(skb, offset, len, to);
@@ -1458,20 +1449,17 @@ static const struct bpf_func_proto bpf_skb_load_bytes_proto = {
 static u64 bpf_l3_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags)
 {
         struct sk_buff *skb = (struct sk_buff *) (long) r1;
-        int offset = (int) r2;
-        __sum16 sum, *ptr;
+        unsigned int offset = (unsigned int) r2;
+        __sum16 *ptr;
 
         if (unlikely(flags & ~(BPF_F_HDR_FIELD_MASK)))
                 return -EINVAL;
-        if (unlikely((u32) offset > 0xffff))
+        if (unlikely(offset > 0xffff || offset & 1))
                 return -EFAULT;
-        if (unlikely(bpf_try_make_writable(skb, offset + sizeof(sum))))
-                return -EFAULT;
-
-        ptr = skb_header_pointer(skb, offset, sizeof(sum), &sum);
-        if (unlikely(!ptr))
+        if (unlikely(bpf_try_make_writable(skb, offset + sizeof(*ptr))))
                 return -EFAULT;
 
+        ptr = (__sum16 *)(skb->data + offset);
         switch (flags & BPF_F_HDR_FIELD_MASK) {
         case 0:
                 if (unlikely(from != 0))
@@ -1489,10 +1477,6 @@ static u64 bpf_l3_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags)
                 return -EINVAL;
         }
 
-        if (ptr == &sum)
-                /* skb_store_bits guaranteed to not return -EFAULT here */
-                skb_store_bits(skb, offset, ptr, sizeof(sum));
-
         return 0;
 }
 
@@ -1512,20 +1496,18 @@ static u64 bpf_l4_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags)
         struct sk_buff *skb = (struct sk_buff *) (long) r1;
         bool is_pseudo = flags & BPF_F_PSEUDO_HDR;
         bool is_mmzero = flags & BPF_F_MARK_MANGLED_0;
-        int offset = (int) r2;
-        __sum16 sum, *ptr;
+        unsigned int offset = (unsigned int) r2;
+        __sum16 *ptr;
 
         if (unlikely(flags & ~(BPF_F_MARK_MANGLED_0 | BPF_F_PSEUDO_HDR |
                                BPF_F_HDR_FIELD_MASK)))
                 return -EINVAL;
-        if (unlikely((u32) offset > 0xffff))
+        if (unlikely(offset > 0xffff || offset & 1))
                 return -EFAULT;
-        if (unlikely(bpf_try_make_writable(skb, offset + sizeof(sum))))
+        if (unlikely(bpf_try_make_writable(skb, offset + sizeof(*ptr))))
                 return -EFAULT;
 
-        ptr = skb_header_pointer(skb, offset, sizeof(sum), &sum);
-        if (unlikely(!ptr))
-                return -EFAULT;
+        ptr = (__sum16 *)(skb->data + offset);
         if (is_mmzero && !*ptr)
                 return 0;
 
@@ -1548,10 +1530,6 @@ static u64 bpf_l4_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags)
 
         if (is_mmzero && !*ptr)
                 *ptr = CSUM_MANGLED_0;
-        if (ptr == &sum)
-                /* skb_store_bits guaranteed to not return -EFAULT here */
-                skb_store_bits(skb, offset, ptr, sizeof(sum));
-
         return 0;
 }
 
@@ -1607,9 +1585,6 @@ static const struct bpf_func_proto bpf_csum_diff_proto = {
 
 static inline int __bpf_rx_skb(struct net_device *dev, struct sk_buff *skb)
 {
-        if (skb_at_tc_ingress(skb))
-                skb_postpush_rcsum(skb, skb_mac_header(skb), skb->mac_len);
-
         return dev_forward_skb(dev, skb);
 }
 
@@ -1648,6 +1623,8 @@ static u64 bpf_clone_redirect(u64 r1, u64 ifindex, u64 flags, u64 r4, u64 r5)
         if (unlikely(!skb))
                 return -ENOMEM;
 
+        bpf_push_mac_rcsum(skb);
+
         return flags & BPF_F_INGRESS ?
                __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb);
 }
@@ -1693,6 +1670,8 @@ int skb_do_redirect(struct sk_buff *skb)
                 return -EINVAL;
         }
 
+        bpf_push_mac_rcsum(skb);
+
         return ri->flags & BPF_F_INGRESS ?
                __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb);
 }
@@ -1756,7 +1735,10 @@ static u64 bpf_skb_vlan_push(u64 r1, u64 r2, u64 vlan_tci, u64 r4, u64 r5)
                      vlan_proto != htons(ETH_P_8021AD)))
                 vlan_proto = htons(ETH_P_8021Q);
 
+        bpf_push_mac_rcsum(skb);
         ret = skb_vlan_push(skb, vlan_proto, vlan_tci);
+        bpf_pull_mac_rcsum(skb);
+
         bpf_compute_data_end(skb);
         return ret;
 }
@@ -1776,7 +1758,10 @@ static u64 bpf_skb_vlan_pop(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
         struct sk_buff *skb = (struct sk_buff *) (long) r1;
         int ret;
 
+        bpf_push_mac_rcsum(skb);
         ret = skb_vlan_pop(skb);
+        bpf_pull_mac_rcsum(skb);
+
         bpf_compute_data_end(skb);
         return ret;
 }
@@ -2298,7 +2283,7 @@ bpf_get_skb_set_tunnel_proto(enum bpf_func_id which)
 }
 
 #ifdef CONFIG_SOCK_CGROUP_DATA
-static u64 bpf_skb_in_cgroup(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
+static u64 bpf_skb_under_cgroup(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
 {
         struct sk_buff *skb = (struct sk_buff *)(long)r1;
         struct bpf_map *map = (struct bpf_map *)(long)r2;
@@ -2321,8 +2306,8 @@ static u64 bpf_skb_in_cgroup(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
         return cgroup_is_descendant(sock_cgroup_ptr(&sk->sk_cgrp_data), cgrp);
 }
 
-static const struct bpf_func_proto bpf_skb_in_cgroup_proto = {
-        .func           = bpf_skb_in_cgroup,
+static const struct bpf_func_proto bpf_skb_under_cgroup_proto = {
+        .func           = bpf_skb_under_cgroup,
         .gpl_only       = false,
         .ret_type       = RET_INTEGER,
         .arg1_type      = ARG_PTR_TO_CTX,
@@ -2402,8 +2387,8 @@ tc_cls_act_func_proto(enum bpf_func_id func_id)
         case BPF_FUNC_get_smp_processor_id:
                 return &bpf_get_smp_processor_id_proto;
 #ifdef CONFIG_SOCK_CGROUP_DATA
-        case BPF_FUNC_skb_in_cgroup:
-                return &bpf_skb_in_cgroup_proto;
+        case BPF_FUNC_skb_under_cgroup:
+                return &bpf_skb_under_cgroup_proto;
 #endif
         default:
                 return sk_filter_func_proto(func_id);
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index d07fc076bea0..febca0f1008c 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2452,9 +2452,7 @@ struct fib_route_iter {
 static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter,
                                             loff_t pos)
 {
-        struct fib_table *tb = iter->main_tb;
         struct key_vector *l, **tp = &iter->tnode;
-        struct trie *t;
         t_key key;
 
         /* use cache location of next-to-find key */
@@ -2462,8 +2460,6 @@ static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter,
                 pos -= iter->pos;
                 key = iter->key;
         } else {
-                t = (struct trie *)tb->tb_data;
-                iter->tnode = t->kv;
                 iter->pos = 0;
                 key = 0;
         }
@@ -2504,12 +2500,12 @@ static void *fib_route_seq_start(struct seq_file *seq, loff_t *pos)
                 return NULL;
 
         iter->main_tb = tb;
+        t = (struct trie *)tb->tb_data;
+        iter->tnode = t->kv;
 
         if (*pos != 0)
                 return fib_route_get_idx(iter, *pos);
 
-        t = (struct trie *)tb->tb_data;
-        iter->tnode = t->kv;
         iter->pos = 0;
         iter->key = 0;
 
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 5b1481be0282..113cc43df789 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -370,7 +370,6 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
                          tunnel->parms.o_flags, proto, tunnel->parms.o_key,
                          htonl(tunnel->o_seqno));
 
-        skb_set_inner_protocol(skb, proto);
         ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol);
 }
 
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index a917903d5e97..cc701fa70b12 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -557,6 +557,33 @@ static struct rtnl_link_ops vti_link_ops __read_mostly = {
         .get_link_net   = ip_tunnel_get_link_net,
 };
 
+static bool is_vti_tunnel(const struct net_device *dev)
+{
+        return dev->netdev_ops == &vti_netdev_ops;
+}
+
+static int vti_device_event(struct notifier_block *unused,
+                            unsigned long event, void *ptr)
+{
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct ip_tunnel *tunnel = netdev_priv(dev);
+
+        if (!is_vti_tunnel(dev))
+                return NOTIFY_DONE;
+
+        switch (event) {
+        case NETDEV_DOWN:
+                if (!net_eq(tunnel->net, dev_net(dev)))
+                        xfrm_garbage_collect(tunnel->net);
+                break;
+        }
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block vti_notifier_block __read_mostly = {
+        .notifier_call = vti_device_event,
+};
+
 static int __init vti_init(void)
 {
         const char *msg;
@@ -564,6 +591,8 @@ static int __init vti_init(void)
 
         pr_info("IPv4 over IPsec tunneling driver\n");
 
+        register_netdevice_notifier(&vti_notifier_block);
+
         msg = "tunnel device";
         err = register_pernet_device(&vti_net_ops);
         if (err < 0)
@@ -596,6 +625,7 @@ xfrm_proto_ah_failed:
 xfrm_proto_esp_failed:
         unregister_pernet_device(&vti_net_ops);
 pernet_dev_failed:
+        unregister_netdevice_notifier(&vti_notifier_block);
         pr_err("vti init: failed to register %s\n", msg);
         return err;
 }
@@ -607,6 +637,7 @@ static void __exit vti_fini(void)
         xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
         xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP);
         unregister_pernet_device(&vti_net_ops);
+        unregister_netdevice_notifier(&vti_notifier_block);
 }
 
 module_init(vti_init);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index ab3e796596b1..df8425fcbc2c 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3543,7 +3543,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
         /* combine the user config with event to determine if permanent
          * addresses are to be removed from address hash table
          */
-        keep_addr = !(how || _keep_addr <= 0);
+        keep_addr = !(how || _keep_addr <= 0 || idev->cnf.disable_ipv6);
 
         /* Step 2: clear hash table */
         for (i = 0; i < IN6_ADDR_HSIZE; i++) {
@@ -3599,7 +3599,7 @@ restart:
         /* re-combine the user config with event to determine if permanent
          * addresses are to be removed from the interface list
          */
-        keep_addr = (!how && _keep_addr > 0);
+        keep_addr = (!how && _keep_addr > 0 && !idev->cnf.disable_ipv6);
 
         INIT_LIST_HEAD(&del_list);
         list_for_each_entry_safe(ifa, tmp, &idev->addr_list, if_list) {
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index c53b92c617c5..37ac9de713c6 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -952,8 +952,10 @@ calipso_opt_insert(struct ipv6_opt_hdr *hop,
                 memcpy(new, hop, start);
         ret_val = calipso_genopt((unsigned char *)new, start, buf_len, doi_def,
                                  secattr);
-        if (ret_val < 0)
+        if (ret_val < 0) {
+                kfree(new);
                 return ERR_PTR(ret_val);
+        }
 
         buf_len = start + ret_val;
         /* At this point buf_len aligns to 4n, so (buf_len & 4) pads to 8n */
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 776d145113e1..704274cbd495 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -519,8 +519,6 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb,
         gre_build_header(skb, tunnel->tun_hlen, tunnel->parms.o_flags,
                          protocol, tunnel->parms.o_key, htonl(tunnel->o_seqno));
 
-        skb_set_inner_protocol(skb, protocol);
-
         return ip6_tnl_xmit(skb, dev, dsfield, fl6, encap_limit, pmtu,
                             NEXTHDR_GRE);
 }
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index fed40d1ec29b..0900352c924c 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -55,7 +55,7 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         struct icmp6hdr user_icmph;
         int addr_type;
         struct in6_addr *daddr;
-        int iif = 0;
+        int oif = 0;
         struct flowi6 fl6;
         int err;
         struct dst_entry *dst;
@@ -78,25 +78,30 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
                 if (u->sin6_family != AF_INET6) {
                         return -EAFNOSUPPORT;
                 }
-                if (sk->sk_bound_dev_if &&
-                    sk->sk_bound_dev_if != u->sin6_scope_id) {
-                        return -EINVAL;
-                }
                 daddr = &(u->sin6_addr);
-                iif = u->sin6_scope_id;
+                if (__ipv6_addr_needs_scope_id(ipv6_addr_type(daddr)))
+                        oif = u->sin6_scope_id;
         } else {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
                 daddr = &sk->sk_v6_daddr;
         }
 
-        if (!iif)
-                iif = sk->sk_bound_dev_if;
+        if (!oif)
+                oif = sk->sk_bound_dev_if;
+
+        if (!oif)
+                oif = np->sticky_pktinfo.ipi6_ifindex;
+
+        if (!oif && ipv6_addr_is_multicast(daddr))
+                oif = np->mcast_oif;
+        else if (!oif)
+                oif = np->ucast_oif;
 
         addr_type = ipv6_addr_type(daddr);
-        if (__ipv6_addr_needs_scope_id(addr_type) && !iif)
-                return -EINVAL;
-        if (addr_type & IPV6_ADDR_MAPPED)
+        if ((__ipv6_addr_needs_scope_id(addr_type) && !oif) ||
+            (addr_type & IPV6_ADDR_MAPPED) ||
+            (oif && sk->sk_bound_dev_if && oif != sk->sk_bound_dev_if))
                 return -EINVAL;
 
         /* TODO: use ip6_datagram_send_ctl to get options from cmsg */
@@ -106,16 +111,12 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         fl6.flowi6_proto = IPPROTO_ICMPV6;
         fl6.saddr = np->saddr;
         fl6.daddr = *daddr;
+        fl6.flowi6_oif = oif;
         fl6.flowi6_mark = sk->sk_mark;
         fl6.fl6_icmp_type = user_icmph.icmp6_type;
         fl6.fl6_icmp_code = user_icmph.icmp6_code;
         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 
-        if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
-                fl6.flowi6_oif = np->mcast_oif;
-        else if (!fl6.flowi6_oif)
-                fl6.flowi6_oif = np->ucast_oif;
-
         ipc6.tclass = np->tclass;
         fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel);
 
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index 4a7ae32afa09..1138eaf5c682 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -185,8 +185,12 @@ struct iriap_cb *iriap_open(__u8 slsap_sel, int mode, void *priv,
 
         self->magic = IAS_MAGIC;
         self->mode = mode;
-        if (mode == IAS_CLIENT)
-                iriap_register_lsap(self, slsap_sel, mode);
+        if (mode == IAS_CLIENT) {
+                if (iriap_register_lsap(self, slsap_sel, mode)) {
+                        kfree(self);
+                        return NULL;
+                }
+        }
 
         self->confirm = callback;
         self->priv = priv;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 47e99ab8d97a..543b1d4fc33d 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -869,7 +869,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 
         /* free all potentially still buffered bcast frames */
         local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
-        skb_queue_purge(&sdata->u.ap.ps.bc_buf);
+        ieee80211_purge_tx_queue(&local->hw, &sdata->u.ap.ps.bc_buf);
 
         mutex_lock(&local->mtx);
         ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 184473c257eb..ba5fc1f01e53 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -1094,7 +1094,7 @@ static inline u32 drv_get_expected_throughput(struct ieee80211_local *local,
 
         trace_drv_get_expected_throughput(sta);
         if (local->ops->get_expected_throughput)
-                ret = local->ops->get_expected_throughput(sta);
+                ret = local->ops->get_expected_throughput(&local->hw, sta);
         trace_drv_return_u32(local, ret);
 
         return ret;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index c66411df9863..42120d965263 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -881,20 +881,22 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
 
         netif_carrier_off(sdata->dev);
 
+        /* flush STAs and mpaths on this iface */
+        sta_info_flush(sdata);
+        mesh_path_flush_by_iface(sdata);
+
         /* stop the beacon */
         ifmsh->mesh_id_len = 0;
         sdata->vif.bss_conf.enable_beacon = false;
         clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
+
+        /* remove beacon */
         bcn = rcu_dereference_protected(ifmsh->beacon,
                                         lockdep_is_held(&sdata->wdev.mtx));
         RCU_INIT_POINTER(ifmsh->beacon, NULL);
         kfree_rcu(bcn, rcu_head);
 
-        /* flush STAs and mpaths on this iface */
-        sta_info_flush(sdata);
-        mesh_path_flush_by_iface(sdata);
-
         /* free all potentially still buffered group-addressed frames */
         local->total_ps_buffered -= skb_queue_len(&ifmsh->ps.bc_buf);
         skb_queue_purge(&ifmsh->ps.bc_buf);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 2e8a9024625a..9dce3b157908 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1268,7 +1268,7 @@ static void sta_ps_start(struct sta_info *sta)
         for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
                 struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);
 
-                if (!txqi->tin.backlog_packets)
+                if (txqi->tin.backlog_packets)
                         set_bit(tid, &sta->txq_buffered_tids);
                 else
                         clear_bit(tid, &sta->txq_buffered_tids);
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index c6d5c724e032..a2a68269675d 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -771,6 +771,13 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         clear_sta_flag(sta, WLAN_STA_SP);
 
                 acked = !!(info->flags & IEEE80211_TX_STAT_ACK);
+
+                /* mesh Peer Service Period support */
+                if (ieee80211_vif_is_mesh(&sta->sdata->vif) &&
+                    ieee80211_is_data_qos(fc))
+                        ieee80211_mpsp_trigger_process(
+                                ieee80211_get_qos_ctl(hdr), sta, true, acked);
+
                 if (!acked && test_sta_flag(sta, WLAN_STA_PS_STA)) {
                         /*
                          * The STA is in power save mode, so assume
@@ -781,13 +788,6 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         return;
                 }
 
-                /* mesh Peer Service Period support */
-                if (ieee80211_vif_is_mesh(&sta->sdata->vif) &&
-                    ieee80211_is_data_qos(fc))
-                        ieee80211_mpsp_trigger_process(
-                                        ieee80211_get_qos_ctl(hdr),
-                                        sta, true, acked);
-
                 if (ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL) &&
                     (ieee80211_is_data(hdr->frame_control)) &&
                     (rates_idx != -1))
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 91461c415525..502396694f47 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -368,7 +368,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
                 skb = skb_dequeue(&ps->bc_buf);
                 if (skb) {
                         purged++;
-                        dev_kfree_skb(skb);
+                        ieee80211_free_txskb(&local->hw, skb);
                 }
                 total += skb_queue_len(&ps->bc_buf);
         }
@@ -451,7 +451,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
                 ps_dbg(tx->sdata,
                        "BC TX buffer full - dropping the oldest frame\n");
-                dev_kfree_skb(skb_dequeue(&ps->bc_buf));
+                ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf));
         } else
                 tx->local->total_ps_buffered++;
 
@@ -4275,7 +4275,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                         sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
                 if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
                         break;
-                dev_kfree_skb_any(skb);
+                ieee80211_free_txskb(hw, skb);
         }
 
         info = IEEE80211_SKB_CB(skb);
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 9e3693128313..f8dbacf66795 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -574,7 +574,7 @@ static int exp_seq_show(struct seq_file *s, void *v)
         helper = rcu_dereference(nfct_help(expect->master)->helper);
         if (helper) {
                 seq_printf(s, "%s%s", expect->flags ? " " : "", helper->name);
-                if (helper->expect_policy[expect->class].name)
+                if (helper->expect_policy[expect->class].name[0])
                         seq_printf(s, "/%s",
                                    helper->expect_policy[expect->class].name);
         }
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index bb77a97961bf..5c0db5c64734 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1473,7 +1473,8 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
                                  "timeout to %u seconds for",
                                  info->timeout);
                         nf_ct_dump_tuple(&exp->tuple);
-                        mod_timer(&exp->timeout, jiffies + info->timeout * HZ);
+                        mod_timer_pending(&exp->timeout,
+                                          jiffies + info->timeout * HZ);
                 }
                 spin_unlock_bh(&nf_conntrack_expect_lock);
         }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 050bb3420a6b..fdfc71f416b7 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1894,6 +1894,8 @@ static int ctnetlink_new_conntrack(struct net *net, struct sock *ctnl,
 
                         if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])
                                 return -EINVAL;
+                        if (otuple.dst.protonum != rtuple.dst.protonum)
+                                return -EINVAL;
 
                         ct = ctnetlink_create_conntrack(net, &zone, cda, &otuple,
                                                         &rtuple, u3);
@@ -2362,12 +2364,8 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,
                 return PTR_ERR(exp);
 
         err = nf_ct_expect_related_report(exp, portid, report);
-        if (err < 0) {
-                nf_ct_expect_put(exp);
-                return err;
-        }
-
-        return 0;
+        nf_ct_expect_put(exp);
+        return err;
 }
 
 static void ctnetlink_glue_seqadj(struct sk_buff *skb, struct nf_conn *ct,
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 8d9db9d4702b..7d77217de6a3 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1383,7 +1383,7 @@ static int process_sip_response(struct sk_buff *skb, unsigned int protoff,
                 return NF_DROP;
         }
         cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
-        if (!cseq) {
+        if (!cseq && *(*dptr + matchoff) != '0') {
                 nf_ct_helper_log(skb, ct, "cannot get cseq");
                 return NF_DROP;
         }
@@ -1446,7 +1446,7 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
                         return NF_DROP;
                 }
                 cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
-                if (!cseq) {
+                if (!cseq && *(*dptr + matchoff) != '0') {
                         nf_ct_helper_log(skb, ct, "cannot get cseq");
                         return NF_DROP;
                 }
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 5d36a0926b4a..f49f45081acb 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1145,10 +1145,8 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
         struct nfnl_queue_net *q = nfnl_queue_pernet(net);
         int err;
 
-        queue = instance_lookup(q, queue_num);
-        if (!queue)
-                queue = verdict_instance_lookup(q, queue_num,
-                                                NETLINK_CB(skb).portid);
+        queue = verdict_instance_lookup(q, queue_num,
+                                        NETLINK_CB(skb).portid);
         if (IS_ERR(queue))
                 return PTR_ERR(queue);
 
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index ba7aed13e174..82c264e40278 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -59,6 +59,7 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
                            const struct nlattr * const tb[])
 {
         struct nft_exthdr *priv = nft_expr_priv(expr);
+        u32 offset, len;
 
         if (tb[NFTA_EXTHDR_DREG] == NULL ||
             tb[NFTA_EXTHDR_TYPE] == NULL ||
@@ -66,9 +67,15 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
             tb[NFTA_EXTHDR_LEN] == NULL)
                 return -EINVAL;
 
+        offset = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OFFSET]));
+        len = ntohl(nla_get_be32(tb[NFTA_EXTHDR_LEN]));
+
+        if (offset > U8_MAX || len > U8_MAX)
+                return -ERANGE;
+
         priv->type   = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
-        priv->offset = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OFFSET]));
-        priv->len    = ntohl(nla_get_be32(tb[NFTA_EXTHDR_LEN]));
+        priv->offset = offset;
+        priv->len    = len;
         priv->dreg   = nft_parse_register(tb[NFTA_EXTHDR_DREG]);
 
         return nft_validate_register_store(ctx, priv->dreg, NULL,
diff --git a/net/netfilter/nft_rbtree.c b/net/netfilter/nft_rbtree.c
index 6473936d05c6..ffe9ae062d23 100644
--- a/net/netfilter/nft_rbtree.c
+++ b/net/netfilter/nft_rbtree.c
@@ -70,7 +70,6 @@ static bool nft_rbtree_lookup(const struct net *net, const struct nft_set *set,
                 } else if (d > 0)
                         parent = parent->rb_right;
                 else {
-found:
                         if (!nft_set_elem_active(&rbe->ext, genmask)) {
                                 parent = parent->rb_left;
                                 continue;
@@ -84,9 +83,12 @@ found:
                 }
         }
 
-        if (set->flags & NFT_SET_INTERVAL && interval != NULL) {
-                rbe = interval;
-                goto found;
+        if (set->flags & NFT_SET_INTERVAL && interval != NULL &&
+            nft_set_elem_active(&interval->ext, genmask) &&
+            !nft_rbtree_interval_end(interval)) {
+                spin_unlock_bh(&nft_rbtree_lock);
+                *ext = &interval->ext;
+                return true;
         }
 out:
         spin_unlock_bh(&nft_rbtree_lock);
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index c644c78ed485..e054a748ff25 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -433,7 +433,6 @@ ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
         struct nf_conntrack_l4proto *l4proto;
         struct nf_conntrack_tuple tuple;
         struct nf_conntrack_tuple_hash *h;
-        enum ip_conntrack_info ctinfo;
         struct nf_conn *ct;
         unsigned int dataoff;
         u8 protonum;
@@ -458,13 +457,8 @@ ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
 
         ct = nf_ct_tuplehash_to_ctrack(h);
 
-        ctinfo = ovs_ct_get_info(h);
-        if (ctinfo == IP_CT_NEW) {
-                /* This should not happen. */
-                WARN_ONCE(1, "ovs_ct_find_existing: new packet for %p\n", ct);
-        }
         skb->nfct = &ct->ct_general;
-        skb->nfctinfo = ctinfo;
+        skb->nfctinfo = ovs_ct_get_info(h);
         return ct;
 }
 
diff --git a/net/openvswitch/vport-geneve.c b/net/openvswitch/vport-geneve.c
index 1a1fcec88695..5aaf3babfc3f 100644
--- a/net/openvswitch/vport-geneve.c
+++ b/net/openvswitch/vport-geneve.c
@@ -93,7 +93,14 @@ static struct vport *geneve_tnl_create(const struct vport_parms *parms)
                 return ERR_CAST(dev);
         }
 
-        dev_change_flags(dev, dev->flags | IFF_UP);
+        err = dev_change_flags(dev, dev->flags | IFF_UP);
+        if (err < 0) {
+                rtnl_delete_link(dev);
+                rtnl_unlock();
+                ovs_vport_free(vport);
+                goto error;
+        }
+
         rtnl_unlock();
         return vport;
 error:
diff --git a/net/openvswitch/vport-gre.c b/net/openvswitch/vport-gre.c
index 7f8897f33a67..0e72d95b0e8f 100644
--- a/net/openvswitch/vport-gre.c
+++ b/net/openvswitch/vport-gre.c
@@ -54,6 +54,7 @@ static struct vport *gre_tnl_create(const struct vport_parms *parms)
         struct net *net = ovs_dp_get_net(parms->dp);
         struct net_device *dev;
         struct vport *vport;
+        int err;
 
         vport = ovs_vport_alloc(0, &ovs_gre_vport_ops, parms);
         if (IS_ERR(vport))
@@ -67,9 +68,15 @@ static struct vport *gre_tnl_create(const struct vport_parms *parms)
                 return ERR_CAST(dev);
         }
 
-        dev_change_flags(dev, dev->flags | IFF_UP);
-        rtnl_unlock();
+        err = dev_change_flags(dev, dev->flags | IFF_UP);
+        if (err < 0) {
+                rtnl_delete_link(dev);
+                rtnl_unlock();
+                ovs_vport_free(vport);
+                return ERR_PTR(err);
+        }
 
+        rtnl_unlock();
         return vport;
 }
 
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 434e04c3a189..95c36147a6e1 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -140,7 +140,7 @@ internal_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)
 
 static void internal_set_rx_headroom(struct net_device *dev, int new_hr)
 {
-        dev->needed_headroom = new_hr;
+        dev->needed_headroom = new_hr < 0 ? 0 : new_hr;
 }
 
 static const struct net_device_ops internal_dev_netdev_ops = {
diff --git a/net/openvswitch/vport-vxlan.c b/net/openvswitch/vport-vxlan.c
index 5eb7694348b5..7eb955e453e6 100644
--- a/net/openvswitch/vport-vxlan.c
+++ b/net/openvswitch/vport-vxlan.c
@@ -130,7 +130,14 @@ static struct vport *vxlan_tnl_create(const struct vport_parms *parms)
                 return ERR_CAST(dev);
         }
 
-        dev_change_flags(dev, dev->flags | IFF_UP);
+        err = dev_change_flags(dev, dev->flags | IFF_UP);
+        if (err < 0) {
+                rtnl_delete_link(dev);
+                rtnl_unlock();
+                ovs_vport_free(vport);
+                goto error;
+        }
+
         rtnl_unlock();
         return vport;
 error:
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 1bb9e7ac9e14..ff83fb1ddd47 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -425,6 +425,7 @@ struct rxrpc_call {
         spinlock_t              lock;
         rwlock_t                state_lock;     /* lock for state transition */
         atomic_t                usage;
+        atomic_t                skb_count;      /* Outstanding packets on this call */
         atomic_t                sequence;       /* Tx data packet sequence counter */
         u32                     local_abort;    /* local abort code */
         u32                     remote_abort;   /* remote abort code */
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index 0b2832141bd0..9bae21e66d65 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -130,6 +130,7 @@ static int rxrpc_accept_incoming_call(struct rxrpc_local *local,
                         call->state = RXRPC_CALL_SERVER_ACCEPTING;
                         list_add_tail(&call->accept_link, &rx->acceptq);
                         rxrpc_get_call(call);
+                        atomic_inc(&call->skb_count);
                         nsp = rxrpc_skb(notification);
                         nsp->call = call;
 
diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index fc32aa5764a2..e60cf65c2232 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -460,6 +460,7 @@ static void rxrpc_insert_oos_packet(struct rxrpc_call *call,
         ASSERTCMP(sp->call, ==, NULL);
         sp->call = call;
         rxrpc_get_call(call);
+        atomic_inc(&call->skb_count);
 
         /* insert into the buffer in sequence order */
         spin_lock_bh(&call->lock);
@@ -734,6 +735,7 @@ all_acked:
                 skb->mark = RXRPC_SKB_MARK_FINAL_ACK;
                 sp->call = call;
                 rxrpc_get_call(call);
+                atomic_inc(&call->skb_count);
                 spin_lock_bh(&call->lock);
                 if (rxrpc_queue_rcv_skb(call, skb, true, true) < 0)
                         BUG();
@@ -793,6 +795,7 @@ static int rxrpc_post_message(struct rxrpc_call *call, u32 mark, u32 error,
                 sp->error = error;
                 sp->call = call;
                 rxrpc_get_call(call);
+                atomic_inc(&call->skb_count);
 
                 spin_lock_bh(&call->lock);
                 ret = rxrpc_queue_rcv_skb(call, skb, true, fatal);
@@ -834,6 +837,9 @@ void rxrpc_process_call(struct work_struct *work)
                 return;
         }
 
+        if (!call->conn)
+                goto skip_msg_init;
+
         /* there's a good chance we're going to have to send a message, so set
          * one up in advance */
         msg.msg_name    = &call->conn->params.peer->srx.transport;
@@ -856,6 +862,7 @@ void rxrpc_process_call(struct work_struct *work)
         memset(iov, 0, sizeof(iov));
         iov[0].iov_base = &whdr;
         iov[0].iov_len  = sizeof(whdr);
+skip_msg_init:
 
         /* deal with events of a final nature */
         if (test_bit(RXRPC_CALL_EV_RCVD_ERROR, &call->events)) {
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index 91287c9d01bb..ae057e0740f3 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -275,6 +275,7 @@ error:
         list_del_init(&call->link);
         write_unlock_bh(&rxrpc_call_lock);
 
+        set_bit(RXRPC_CALL_RELEASED, &call->flags);
         call->state = RXRPC_CALL_DEAD;
         rxrpc_put_call(call);
         _leave(" = %d", ret);
@@ -287,6 +288,7 @@ error:
          */
 found_user_ID_now_present:
         write_unlock(&rx->call_lock);
+        set_bit(RXRPC_CALL_RELEASED, &call->flags);
         call->state = RXRPC_CALL_DEAD;
         rxrpc_put_call(call);
         _leave(" = -EEXIST [%p]", call);
@@ -491,15 +493,9 @@ void rxrpc_release_call(struct rxrpc_call *call)
                 spin_lock_bh(&call->lock);
                 while ((skb = skb_dequeue(&call->rx_queue)) ||
                        (skb = skb_dequeue(&call->rx_oos_queue))) {
-                        sp = rxrpc_skb(skb);
-                        if (sp->call) {
-                                ASSERTCMP(sp->call, ==, call);
-                                rxrpc_put_call(call);
-                                sp->call = NULL;
-                        }
-                        skb->destructor = NULL;
                         spin_unlock_bh(&call->lock);
 
+                        sp = rxrpc_skb(skb);
                         _debug("- zap %s %%%u #%u",
                                rxrpc_pkts[sp->hdr.type],
                                sp->hdr.serial, sp->hdr.seq);
@@ -605,6 +601,7 @@ void __rxrpc_put_call(struct rxrpc_call *call)
 
         if (atomic_dec_and_test(&call->usage)) {
                 _debug("call %d dead", call->debug_id);
+                WARN_ON(atomic_read(&call->skb_count) != 0);
                 ASSERTCMP(call->state, ==, RXRPC_CALL_DEAD);
                 rxrpc_queue_work(&call->destroyer);
         }
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 991a20d25093..70bb77818dea 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -55,9 +55,6 @@ int rxrpc_queue_rcv_skb(struct rxrpc_call *call, struct sk_buff *skb,
         if (test_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags)) {
                 _debug("already terminated");
                 ASSERTCMP(call->state, >=, RXRPC_CALL_COMPLETE);
-                skb->destructor = NULL;
-                sp->call = NULL;
-                rxrpc_put_call(call);
                 rxrpc_free_skb(skb);
                 return 0;
         }
@@ -111,13 +108,7 @@ int rxrpc_queue_rcv_skb(struct rxrpc_call *call, struct sk_buff *skb,
         ret = 0;
 
 out:
-        /* release the socket buffer */
-        if (skb) {
-                skb->destructor = NULL;
-                sp->call = NULL;
-                rxrpc_put_call(call);
-                rxrpc_free_skb(skb);
-        }
+        rxrpc_free_skb(skb);
 
         _leave(" = %d", ret);
         return ret;
@@ -133,11 +124,15 @@ static int rxrpc_fast_process_data(struct rxrpc_call *call,
         struct rxrpc_skb_priv *sp;
         bool terminal;
         int ret, ackbit, ack;
+        u32 serial;
+        u8 flags;
 
         _enter("{%u,%u},,{%u}", call->rx_data_post, call->rx_first_oos, seq);
 
         sp = rxrpc_skb(skb);
         ASSERTCMP(sp->call, ==, NULL);
+        flags = sp->hdr.flags;
+        serial = sp->hdr.serial;
 
         spin_lock(&call->lock);
 
@@ -200,8 +195,9 @@ static int rxrpc_fast_process_data(struct rxrpc_call *call,
 
         sp->call = call;
         rxrpc_get_call(call);
-        terminal = ((sp->hdr.flags & RXRPC_LAST_PACKET) &&
-                    !(sp->hdr.flags & RXRPC_CLIENT_INITIATED));
+        atomic_inc(&call->skb_count);
+        terminal = ((flags & RXRPC_LAST_PACKET) &&
+                    !(flags & RXRPC_CLIENT_INITIATED));
         ret = rxrpc_queue_rcv_skb(call, skb, false, terminal);
         if (ret < 0) {
                 if (ret == -ENOMEM || ret == -ENOBUFS) {
@@ -213,12 +209,13 @@ static int rxrpc_fast_process_data(struct rxrpc_call *call,
         }
 
         skb = NULL;
+        sp = NULL;
 
         _debug("post #%u", seq);
         ASSERTCMP(call->rx_data_post, ==, seq);
         call->rx_data_post++;
 
-        if (sp->hdr.flags & RXRPC_LAST_PACKET)
+        if (flags & RXRPC_LAST_PACKET)
                 set_bit(RXRPC_CALL_RCVD_LAST, &call->flags);
 
         /* if we've reached an out of sequence packet then we need to drain
@@ -234,7 +231,7 @@ static int rxrpc_fast_process_data(struct rxrpc_call *call,
 
         spin_unlock(&call->lock);
         atomic_inc(&call->ackr_not_idle);
-        rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, sp->hdr.serial, false);
+        rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, serial, false);
         _leave(" = 0 [posted]");
         return 0;
 
@@ -247,7 +244,7 @@ out:
 
 discard_and_ack:
         _debug("discard and ACK packet %p", skb);
-        __rxrpc_propose_ACK(call, ack, sp->hdr.serial, true);
+        __rxrpc_propose_ACK(call, ack, serial, true);
 discard:
         spin_unlock(&call->lock);
         rxrpc_free_skb(skb);
@@ -255,7 +252,7 @@ discard:
         return 0;
 
 enqueue_and_ack:
-        __rxrpc_propose_ACK(call, ack, sp->hdr.serial, true);
+        __rxrpc_propose_ACK(call, ack, serial, true);
 enqueue_packet:
         _net("defer skb %p", skb);
         spin_unlock(&call->lock);
@@ -575,13 +572,13 @@ done:
  * post connection-level events to the connection
  * - this includes challenges, responses and some aborts
  */
-static bool rxrpc_post_packet_to_conn(struct rxrpc_connection *conn,
+static void rxrpc_post_packet_to_conn(struct rxrpc_connection *conn,
                                       struct sk_buff *skb)
 {
         _enter("%p,%p", conn, skb);
 
         skb_queue_tail(&conn->rx_queue, skb);
-        return rxrpc_queue_conn(conn);
+        rxrpc_queue_conn(conn);
 }
 
 /*
@@ -702,7 +699,6 @@ void rxrpc_data_ready(struct sock *sk)
 
         rcu_read_lock();
 
-retry_find_conn:
         conn = rxrpc_find_connection_rcu(local, skb);
         if (!conn)
                 goto cant_route_call;
@@ -710,8 +706,7 @@ retry_find_conn:
         if (sp->hdr.callNumber == 0) {
                 /* Connection-level packet */
                 _debug("CONN %p {%d}", conn, conn->debug_id);
-                if (!rxrpc_post_packet_to_conn(conn, skb))
-                        goto retry_find_conn;
+                rxrpc_post_packet_to_conn(conn, skb);
         } else {
                 /* Call-bound packets are routed by connection channel. */
                 unsigned int channel = sp->hdr.cid & RXRPC_CHANNELMASK;
@@ -749,6 +744,8 @@ cant_route_call:
         if (sp->hdr.type != RXRPC_PACKET_TYPE_ABORT) {
                 _debug("reject type %d",sp->hdr.type);
                 rxrpc_reject_packet(local, skb);
+        } else {
+                rxrpc_free_skb(skb);
         }
         _leave(" [no call]");
         return;
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index a3fa2ed85d63..9ed66d533002 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -203,6 +203,9 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                 }
 
                 /* we transferred the whole data packet */
+                if (!(flags & MSG_PEEK))
+                        rxrpc_kernel_data_consumed(call, skb);
+
                 if (sp->hdr.flags & RXRPC_LAST_PACKET) {
                         _debug("last");
                         if (rxrpc_conn_is_client(call->conn)) {
@@ -360,28 +363,6 @@ wait_error:
 }
 
 /**
- * rxrpc_kernel_data_delivered - Record delivery of data message
- * @skb: Message holding data
- *
- * Record the delivery of a data message.  This permits RxRPC to keep its
- * tracking correct.  The socket buffer will be deleted.
- */
-void rxrpc_kernel_data_delivered(struct sk_buff *skb)
-{
-        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
-        struct rxrpc_call *call = sp->call;
-
-        ASSERTCMP(sp->hdr.seq, >=, call->rx_data_recv);
-        ASSERTCMP(sp->hdr.seq, <=, call->rx_data_recv + 1);
-        call->rx_data_recv = sp->hdr.seq;
-
-        ASSERTCMP(sp->hdr.seq, >, call->rx_data_eaten);
-        rxrpc_free_skb(skb);
-}
-
-EXPORT_SYMBOL(rxrpc_kernel_data_delivered);
-
-/**
  * rxrpc_kernel_is_data_last - Determine if data message is last one
  * @skb: Message holding data
  *
diff --git a/net/rxrpc/skbuff.c b/net/rxrpc/skbuff.c
index eee0cfd9ac8c..06c51d4b622d 100644
--- a/net/rxrpc/skbuff.c
+++ b/net/rxrpc/skbuff.c
@@ -98,11 +98,39 @@ static void rxrpc_hard_ACK_data(struct rxrpc_call *call,
         spin_unlock_bh(&call->lock);
 }
 
+/**
+ * rxrpc_kernel_data_consumed - Record consumption of data message
+ * @call: The call to which the message pertains.
+ * @skb: Message holding data
+ *
+ * Record the consumption of a data message and generate an ACK if appropriate.
+ * The call state is shifted if this was the final packet.  The caller must be
+ * in process context with no spinlocks held.
+ *
+ * TODO: Actually generate the ACK here rather than punting this to the
+ * workqueue.
+ */
+void rxrpc_kernel_data_consumed(struct rxrpc_call *call, struct sk_buff *skb)
+{
+        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
+
+        _enter("%d,%p{%u}", call->debug_id, skb, sp->hdr.seq);
+
+        ASSERTCMP(sp->call, ==, call);
+        ASSERTCMP(sp->hdr.type, ==, RXRPC_PACKET_TYPE_DATA);
+
+        /* TODO: Fix the sequence number tracking */
+        ASSERTCMP(sp->hdr.seq, >=, call->rx_data_recv);
+        ASSERTCMP(sp->hdr.seq, <=, call->rx_data_recv + 1);
+        ASSERTCMP(sp->hdr.seq, >, call->rx_data_eaten);
+
+        call->rx_data_recv = sp->hdr.seq;
+        rxrpc_hard_ACK_data(call, sp);
+}
+EXPORT_SYMBOL(rxrpc_kernel_data_consumed);
+
 /*
- * destroy a packet that has an RxRPC control buffer
- * - advance the hard-ACK state of the parent call (done here in case something
- *   in the kernel bypasses recvmsg() and steals the packet directly off of the
- *   socket receive queue)
+ * Destroy a packet that has an RxRPC control buffer
  */
 void rxrpc_packet_destructor(struct sk_buff *skb)
 {
@@ -112,9 +140,8 @@ void rxrpc_packet_destructor(struct sk_buff *skb)
         _enter("%p{%p}", skb, call);
 
         if (call) {
-                /* send the final ACK on a client call */
-                if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA)
-                        rxrpc_hard_ACK_data(call, sp);
+                if (atomic_dec_return(&call->skb_count) < 0)
+                        BUG();
                 rxrpc_put_call(call);
                 sp->call = NULL;
         }
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index e4a5f2607ffa..d09d0687594b 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -64,7 +64,6 @@ int __tcf_hash_release(struct tc_action *p, bool bind, bool strict)
                 if (p->tcfa_bindcnt <= 0 && p->tcfa_refcnt <= 0) {
                         if (p->ops->cleanup)
                                 p->ops->cleanup(p, bind);
-                        list_del(&p->list);
                         tcf_hash_destroy(p->hinfo, p);
                         ret = ACT_P_DELETED;
                 }
@@ -421,18 +420,19 @@ static struct tc_action_ops *tc_lookup_action(struct nlattr *kind)
         return res;
 }
 
-int tcf_action_exec(struct sk_buff *skb, const struct list_head *actions,
-                    struct tcf_result *res)
+int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions,
+                    int nr_actions, struct tcf_result *res)
 {
-        const struct tc_action *a;
-        int ret = -1;
+        int ret = -1, i;
 
         if (skb->tc_verd & TC_NCLS) {
                 skb->tc_verd = CLR_TC_NCLS(skb->tc_verd);
                 ret = TC_ACT_OK;
                 goto exec_done;
         }
-        list_for_each_entry(a, actions, list) {
+        for (i = 0; i < nr_actions; i++) {
+                const struct tc_action *a = actions[i];
+
 repeat:
                 ret = a->ops->act(skb, a, res);
                 if (ret == TC_ACT_REPEAT)
@@ -754,16 +754,6 @@ err_out:
         return ERR_PTR(err);
 }
 
-static void cleanup_a(struct list_head *actions)
-{
-        struct tc_action *a, *tmp;
-
-        list_for_each_entry_safe(a, tmp, actions, list) {
-                list_del(&a->list);
-                kfree(a);
-        }
-}
-
 static int tca_action_flush(struct net *net, struct nlattr *nla,
                             struct nlmsghdr *n, u32 portid)
 {
@@ -905,7 +895,7 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
                 return ret;
         }
 err:
-        cleanup_a(&actions);
+        tcf_action_destroy(&actions, 0);
         return ret;
 }
 
@@ -942,15 +932,9 @@ tcf_action_add(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
 
         ret = tcf_action_init(net, nla, NULL, NULL, ovr, 0, &actions);
         if (ret)
-                goto done;
+                return ret;
 
-        /* dump then free all the actions after update; inserted policy
-         * stays intact
-         */
-        ret = tcf_add_notify(net, n, &actions, portid);
-        cleanup_a(&actions);
-done:
-        return ret;
+        return tcf_add_notify(net, n, &actions, portid);
 }
 
 static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n)
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index b3c7e975fc9e..8a3be1d99775 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -63,49 +63,8 @@ static int tcf_act_police_walker(struct net *net, struct sk_buff *skb,
                                  const struct tc_action_ops *ops)
 {
         struct tc_action_net *tn = net_generic(net, police_net_id);
-        struct tcf_hashinfo *hinfo = tn->hinfo;
-        int err = 0, index = -1, i = 0, s_i = 0, n_i = 0;
-        struct nlattr *nest;
-
-        spin_lock_bh(&hinfo->lock);
-
-        s_i = cb->args[0];
-
-        for (i = 0; i < (POL_TAB_MASK + 1); i++) {
-                struct hlist_head *head;
-                struct tc_action *p;
-
-                head = &hinfo->htab[tcf_hash(i, POL_TAB_MASK)];
-
-                hlist_for_each_entry_rcu(p, head, tcfa_head) {
-                        index++;
-                        if (index < s_i)
-                                continue;
-                        nest = nla_nest_start(skb, index);
-                        if (nest == NULL)
-                                goto nla_put_failure;
-                        if (type == RTM_DELACTION)
-                                err = tcf_action_dump_1(skb, p, 0, 1);
-                        else
-                                err = tcf_action_dump_1(skb, p, 0, 0);
-                        if (err < 0) {
-                                index--;
-                                nla_nest_cancel(skb, nest);
-                                goto done;
-                        }
-                        nla_nest_end(skb, nest);
-                        n_i++;
-                }
-        }
-done:
-        spin_unlock_bh(&hinfo->lock);
-        if (n_i)
-                cb->args[0] += n_i;
-        return n_i;
 
-nla_put_failure:
-        nla_nest_cancel(skb, nest);
-        goto done;
+        return tcf_generic_walker(tn, skb, cb, type, ops);
 }
 
 static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = {
@@ -125,6 +84,7 @@ static int tcf_act_police_init(struct net *net, struct nlattr *nla,
         struct tcf_police *police;
         struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL;
         struct tc_action_net *tn = net_generic(net, police_net_id);
+        bool exists = false;
         int size;
 
         if (nla == NULL)
@@ -139,24 +99,24 @@ static int tcf_act_police_init(struct net *net, struct nlattr *nla,
         size = nla_len(tb[TCA_POLICE_TBF]);
         if (size != sizeof(*parm) && size != sizeof(struct tc_police_compat))
                 return -EINVAL;
+
         parm = nla_data(tb[TCA_POLICE_TBF]);
+        exists = tcf_hash_check(tn, parm->index, a, bind);
+        if (exists && bind)
+                return 0;
 
-        if (parm->index) {
-                if (tcf_hash_check(tn, parm->index, a, bind)) {
-                        if (ovr)
-                                goto override;
-                        /* not replacing */
-                        return -EEXIST;
-                }
-        } else {
+        if (!exists) {
                 ret = tcf_hash_create(tn, parm->index, NULL, a,
                                       &act_police_ops, bind, false);
                 if (ret)
                         return ret;
                 ret = ACT_P_CREATED;
+        } else {
+                tcf_hash_release(*a, bind);
+                if (!ovr)
+                        return -EEXIST;
         }
 
-override:
         police = to_police(*a);
         if (parm->rate.rate) {
                 err = -ENOMEM;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 843a716a4303..a7c5645373af 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -541,8 +541,12 @@ out:
 void tcf_exts_destroy(struct tcf_exts *exts)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        tcf_action_destroy(&exts->actions, TCA_ACT_UNBIND);
-        INIT_LIST_HEAD(&exts->actions);
+        LIST_HEAD(actions);
+
+        tcf_exts_to_list(exts, &actions);
+        tcf_action_destroy(&actions, TCA_ACT_UNBIND);
+        kfree(exts->actions);
+        exts->nr_actions = 0;
 #endif
 }
 EXPORT_SYMBOL(tcf_exts_destroy);
@@ -554,7 +558,6 @@ int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb,
         {
                 struct tc_action *act;
 
-                INIT_LIST_HEAD(&exts->actions);
                 if (exts->police && tb[exts->police]) {
                         act = tcf_action_init_1(net, tb[exts->police], rate_tlv,
                                                 "police", ovr,
@@ -563,14 +566,20 @@ int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb,
                                 return PTR_ERR(act);
 
                         act->type = exts->type = TCA_OLD_COMPAT;
-                        list_add(&act->list, &exts->actions);
+                        exts->actions[0] = act;
+                        exts->nr_actions = 1;
                 } else if (exts->action && tb[exts->action]) {
-                        int err;
+                        LIST_HEAD(actions);
+                        int err, i = 0;
+
                         err = tcf_action_init(net, tb[exts->action], rate_tlv,
                                               NULL, ovr,
-                                              TCA_ACT_BIND, &exts->actions);
+                                              TCA_ACT_BIND, &actions);
                         if (err)
                                 return err;
+                        list_for_each_entry(act, &actions, list)
+                                exts->actions[i++] = act;
+                        exts->nr_actions = i;
                 }
         }
 #else
@@ -587,37 +596,49 @@ void tcf_exts_change(struct tcf_proto *tp, struct tcf_exts *dst,
                      struct tcf_exts *src)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        LIST_HEAD(tmp);
+        struct tcf_exts old = *dst;
+
         tcf_tree_lock(tp);
-        list_splice_init(&dst->actions, &tmp);
-        list_splice(&src->actions, &dst->actions);
+        dst->nr_actions = src->nr_actions;
+        dst->actions = src->actions;
         dst->type = src->type;
         tcf_tree_unlock(tp);
-        tcf_action_destroy(&tmp, TCA_ACT_UNBIND);
+
+        tcf_exts_destroy(&old);
 #endif
 }
 EXPORT_SYMBOL(tcf_exts_change);
 
-#define tcf_exts_first_act(ext)                                 \
-        list_first_entry_or_null(&(exts)->actions,              \
-                                 struct tc_action, list)
+#ifdef CONFIG_NET_CLS_ACT
+static struct tc_action *tcf_exts_first_act(struct tcf_exts *exts)
+{
+        if (exts->nr_actions == 0)
+                return NULL;
+        else
+                return exts->actions[0];
+}
+#endif
 
 int tcf_exts_dump(struct sk_buff *skb, struct tcf_exts *exts)
 {
 #ifdef CONFIG_NET_CLS_ACT
         struct nlattr *nest;
 
-        if (exts->action && !list_empty(&exts->actions)) {
+        if (exts->action && exts->nr_actions) {
                 /*
                  * again for backward compatible mode - we want
                  * to work with both old and new modes of entering
                  * tc data even if iproute2  was newer - jhs
                  */
                 if (exts->type != TCA_OLD_COMPAT) {
+                        LIST_HEAD(actions);
+
                         nest = nla_nest_start(skb, exts->action);
                         if (nest == NULL)
                                 goto nla_put_failure;
-                        if (tcf_action_dump(skb, &exts->actions, 0, 0) < 0)
+
+                        tcf_exts_to_list(exts, &actions);
+                        if (tcf_action_dump(skb, &actions, 0, 0) < 0)
                                 goto nla_put_failure;
                         nla_nest_end(skb, nest);
                 } else if (exts->police) {
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 4cb5aedfe3ee..ef8ba77a5bea 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -293,6 +293,7 @@ static void *sctp_transport_seq_start(struct seq_file *seq, loff_t *pos)
                 return ERR_PTR(err);
         }
 
+        iter->start_fail = 0;
         return sctp_transport_get_idx(seq_file_net(seq), &iter->hti, *pos);
 }
 
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
index f69edcf219e5..bb691538adc8 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -13,6 +13,7 @@ static void inet_diag_msg_sctpasoc_fill(struct inet_diag_msg *r,
 {
         union sctp_addr laddr, paddr;
         struct dst_entry *dst;
+        struct timer_list *t3_rtx = &asoc->peer.primary_path->T3_rtx_timer;
 
         laddr = list_entry(asoc->base.bind_addr.address_list.next,
                            struct sctp_sockaddr_entry, list)->a;
@@ -40,10 +41,15 @@ static void inet_diag_msg_sctpasoc_fill(struct inet_diag_msg *r,
         }
 
         r->idiag_state = asoc->state;
-        r->idiag_timer = SCTP_EVENT_TIMEOUT_T3_RTX;
-        r->idiag_retrans = asoc->rtx_data_chunks;
-        r->idiag_expires = jiffies_to_msecs(
-                asoc->timeouts[SCTP_EVENT_TIMEOUT_T3_RTX] - jiffies);
+        if (timer_pending(t3_rtx)) {
+                r->idiag_timer = SCTP_EVENT_TIMEOUT_T3_RTX;
+                r->idiag_retrans = asoc->rtx_data_chunks;
+                r->idiag_expires = jiffies_to_msecs(t3_rtx->expires - jiffies);
+        } else {
+                r->idiag_timer = 0;
+                r->idiag_retrans = 0;
+                r->idiag_expires = 0;
+        }
 }
 
 static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,
@@ -350,7 +356,7 @@ static int sctp_ep_dump(struct sctp_endpoint *ep, void *p)
         if (cb->args[4] < cb->args[1])
                 goto next;
 
-        if ((r->idiag_states & ~TCPF_LISTEN) && !list_empty(&ep->asocs))
+        if (!(r->idiag_states & TCPF_LISTEN) && !list_empty(&ep->asocs))
                 goto next;
 
         if (r->sdiag_family != AF_UNSPEC &&
@@ -465,7 +471,7 @@ skip:
          * 3 : to mark if we have dumped the ep info of the current asoc
          * 4 : to work as a temporary variable to traversal list
          */
-        if (!(idiag_states & ~TCPF_LISTEN))
+        if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE)))
                 goto done;
         sctp_for_each_transport(sctp_tsp_dump, net, cb->args[2], &commp);
 done:
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 1bc4f71aaba8..d85b803da11d 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -702,14 +702,14 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
          */
         sctp_ulpevent_init(event, 0, skb->len + sizeof(struct sk_buff));
 
-        sctp_ulpevent_receive_data(event, asoc);
-
         /* And hold the chunk as we need it for getting the IP headers
          * later in recvmsg
          */
         sctp_chunk_hold(chunk);
         event->chunk = chunk;
 
+        sctp_ulpevent_receive_data(event, asoc);
+
         event->stream = ntohs(chunk->subh.data_hdr->stream);
         event->ssn = ntohs(chunk->subh.data_hdr->ssn);
         event->ppid = chunk->subh.data_hdr->ppid;
diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
index b62caa1c770c..ed97a5876ebe 100644
--- a/net/tipc/monitor.c
+++ b/net/tipc/monitor.c
@@ -728,12 +728,13 @@ int tipc_nl_add_monitor_peer(struct net *net, struct tipc_nl_msg *msg,
                              u32 bearer_id, u32 *prev_node)
 {
         struct tipc_monitor *mon = tipc_monitor(net, bearer_id);
-        struct tipc_peer *peer = mon->self;
+        struct tipc_peer *peer;
 
         if (!mon)
                 return -EINVAL;
 
         read_lock_bh(&mon->lock);
+        peer = mon->self;
         do {
                 if (*prev_node) {
                         if (peer->addr == *prev_node)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index c49b8df438cb..f9f5f3c3dab5 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2180,7 +2180,8 @@ restart:
                                               TIPC_CONN_MSG, SHORT_H_SIZE,
                                               0, dnode, onode, dport, oport,
                                               TIPC_CONN_SHUTDOWN);
-                        tipc_node_xmit_skb(net, skb, dnode, tsk->portid);
+                        if (skb)
+                                tipc_node_xmit_skb(net, skb, dnode, tsk->portid);
                 }
                 tsk->connected = 0;
                 sock->state = SS_DISCONNECTING;
diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
index 699dfabdbccd..936d7eee62d0 100644
--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
@@ -87,9 +87,6 @@ virtio_transport_send_pkt_work(struct work_struct *work)
 
         vq = vsock->vqs[VSOCK_VQ_TX];
 
-        /* Avoid unnecessary interrupts while we're processing the ring */
-        virtqueue_disable_cb(vq);
-
         for (;;) {
                 struct virtio_vsock_pkt *pkt;
                 struct scatterlist hdr, buf, *sgs[2];
@@ -99,7 +96,6 @@ virtio_transport_send_pkt_work(struct work_struct *work)
                 spin_lock_bh(&vsock->send_pkt_list_lock);
                 if (list_empty(&vsock->send_pkt_list)) {
                         spin_unlock_bh(&vsock->send_pkt_list_lock);
-                        virtqueue_enable_cb(vq);
                         break;
                 }
 
@@ -118,13 +114,13 @@ virtio_transport_send_pkt_work(struct work_struct *work)
                 }
 
                 ret = virtqueue_add_sgs(vq, sgs, out_sg, in_sg, pkt, GFP_KERNEL);
+                /* Usually this means that there is no more space available in
+                 * the vq
+                 */
                 if (ret < 0) {
                         spin_lock_bh(&vsock->send_pkt_list_lock);
                         list_add(&pkt->list, &vsock->send_pkt_list);
                         spin_unlock_bh(&vsock->send_pkt_list_lock);
-
-                        if (!virtqueue_enable_cb(vq) && ret == -ENOSPC)
-                                continue; /* retry now that we have more space */
                         break;
                 }
 
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index b0e11b6dc994..0f506220a3bd 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -513,6 +513,7 @@ static bool cfg80211_chandef_dfs_available(struct wiphy *wiphy,
                 r = cfg80211_get_chans_dfs_available(wiphy,
                                                      chandef->center_freq2,
                                                      width);
+                break;
         default:
                 WARN_ON(chandef->center_freq2);
                 break;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 46417f9cce68..f02653a08993 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5380,6 +5380,7 @@ static int nl80211_parse_mesh_config(struct genl_info *info,
 {
         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
         u32 mask = 0;
+        u16 ht_opmode;
 
 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
 do {                                                                        \
@@ -5471,9 +5472,36 @@ do {									    \
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
                                   nl80211_check_s32);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
-                                  mask, NL80211_MESHCONF_HT_OPMODE,
-                                  nl80211_check_u16);
+        /*
+         * Check HT operation mode based on
+         * IEEE 802.11 2012 8.4.2.59 HT Operation element.
+         */
+        if (tb[NL80211_MESHCONF_HT_OPMODE]) {
+                ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
+
+                if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
+                                  IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
+                                  IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+                        return -EINVAL;
+
+                if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
+                    (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+                        return -EINVAL;
+
+                switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
+                case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
+                case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
+                        if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
+                                return -EINVAL;
+                        break;
+                case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
+                case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
+                        if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+                                return -EINVAL;
+                        break;
+                }
+                cfg->ht_opmode = ht_opmode;
+        }
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
                                   1, 65535, mask,
                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
diff --git a/samples/bpf/bpf_helpers.h b/samples/bpf/bpf_helpers.h
index 217c8d507f2e..7927a090fa0d 100644
--- a/samples/bpf/bpf_helpers.h
+++ b/samples/bpf/bpf_helpers.h
@@ -72,8 +72,8 @@ static int (*bpf_l3_csum_replace)(void *ctx, int off, int from, int to, int flag
         (void *) BPF_FUNC_l3_csum_replace;
 static int (*bpf_l4_csum_replace)(void *ctx, int off, int from, int to, int flags) =
         (void *) BPF_FUNC_l4_csum_replace;
-static int (*bpf_skb_in_cgroup)(void *ctx, void *map, int index) =
-        (void *) BPF_FUNC_skb_in_cgroup;
+static int (*bpf_skb_under_cgroup)(void *ctx, void *map, int index) =
+        (void *) BPF_FUNC_skb_under_cgroup;
 
 #if defined(__x86_64__)
 
diff --git a/samples/bpf/test_cgrp2_tc_kern.c b/samples/bpf/test_cgrp2_tc_kern.c
index 2732c37c8d5b..10ff73404e3a 100644
--- a/samples/bpf/test_cgrp2_tc_kern.c
+++ b/samples/bpf/test_cgrp2_tc_kern.c
@@ -57,7 +57,7 @@ int handle_egress(struct __sk_buff *skb)
                 bpf_trace_printk(dont_care_msg, sizeof(dont_care_msg),
                                  eth->h_proto, ip6h->nexthdr);
                 return TC_ACT_OK;
-        } else if (bpf_skb_in_cgroup(skb, &test_cgrp2_array_pin, 0) != 1) {
+        } else if (bpf_skb_under_cgroup(skb, &test_cgrp2_array_pin, 0) != 1) {
                 bpf_trace_printk(pass_msg, sizeof(pass_msg));
                 return TC_ACT_OK;
         } else {
diff --git a/samples/bpf/test_maps.c b/samples/bpf/test_maps.c
index 47bf0858f9e4..cce2b59751eb 100644
--- a/samples/bpf/test_maps.c
+++ b/samples/bpf/test_maps.c
@@ -68,7 +68,16 @@ static void test_hashmap_sanity(int i, void *data)
         assert(bpf_update_elem(map_fd, &key, &value, BPF_NOEXIST) == -1 &&
                errno == E2BIG);
 
+        /* update existing element, thought the map is full */
+        key = 1;
+        assert(bpf_update_elem(map_fd, &key, &value, BPF_EXIST) == 0);
+        key = 2;
+        assert(bpf_update_elem(map_fd, &key, &value, BPF_ANY) == 0);
+        key = 1;
+        assert(bpf_update_elem(map_fd, &key, &value, BPF_ANY) == 0);
+
         /* check that key = 0 doesn't exist */
+        key = 0;
         assert(bpf_delete_elem(map_fd, &key) == -1 && errno == ENOENT);
 
         /* iterate over two elements */
@@ -413,10 +422,12 @@ static void do_work(int fn, void *data)
 
         for (i = fn; i < MAP_SIZE; i += TASKS) {
                 key = value = i;
-                if (do_update)
+                if (do_update) {
                         assert(bpf_update_elem(map_fd, &key, &value, BPF_NOEXIST) == 0);
-                else
+                        assert(bpf_update_elem(map_fd, &key, &value, BPF_EXIST) == 0);
+                } else {
                         assert(bpf_delete_elem(map_fd, &key) == 0);
+                }
         }
 }
 
diff --git a/security/Kconfig b/security/Kconfig
index df28f2b6f3e1..da10d9b573a4 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -136,6 +136,7 @@ config HAVE_ARCH_HARDENED_USERCOPY
 config HARDENED_USERCOPY
         bool "Harden memory copies between kernel and userspace"
         depends on HAVE_ARCH_HARDENED_USERCOPY
+        depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
         select BUG
         help
           This option checks for obviously wrong memory regions when
diff --git a/tools/arch/arm64/include/uapi/asm/kvm.h b/tools/arch/arm64/include/uapi/asm/kvm.h
index f209ea151dca..3051f86a9b5f 100644
--- a/tools/arch/arm64/include/uapi/asm/kvm.h
+++ b/tools/arch/arm64/include/uapi/asm/kvm.h
@@ -87,9 +87,11 @@ struct kvm_regs {
 /* Supported VGICv3 address types  */
 #define KVM_VGIC_V3_ADDR_TYPE_DIST      2
 #define KVM_VGIC_V3_ADDR_TYPE_REDIST    3
+#define KVM_VGIC_ITS_ADDR_TYPE          4
 
 #define KVM_VGIC_V3_DIST_SIZE           SZ_64K
 #define KVM_VGIC_V3_REDIST_SIZE         (2 * SZ_64K)
+#define KVM_VGIC_V3_ITS_SIZE            (2 * SZ_64K)
 
 #define KVM_ARM_VCPU_POWER_OFF          0 /* CPU is started in OFF state */
 #define KVM_ARM_VCPU_EL1_32BIT          1 /* CPU running a 32bit VM */
diff --git a/tools/arch/s390/include/uapi/asm/kvm.h b/tools/arch/s390/include/uapi/asm/kvm.h
index 3b8e99ef9d58..a2ffec4139ad 100644
--- a/tools/arch/s390/include/uapi/asm/kvm.h
+++ b/tools/arch/s390/include/uapi/asm/kvm.h
@@ -93,6 +93,47 @@ struct kvm_s390_vm_cpu_machine {
         __u64 fac_list[256];
 };
 
+#define KVM_S390_VM_CPU_PROCESSOR_FEAT  2
+#define KVM_S390_VM_CPU_MACHINE_FEAT    3
+
+#define KVM_S390_VM_CPU_FEAT_NR_BITS    1024
+#define KVM_S390_VM_CPU_FEAT_ESOP       0
+#define KVM_S390_VM_CPU_FEAT_SIEF2      1
+#define KVM_S390_VM_CPU_FEAT_64BSCAO    2
+#define KVM_S390_VM_CPU_FEAT_SIIF       3
+#define KVM_S390_VM_CPU_FEAT_GPERE      4
+#define KVM_S390_VM_CPU_FEAT_GSLS       5
+#define KVM_S390_VM_CPU_FEAT_IB         6
+#define KVM_S390_VM_CPU_FEAT_CEI        7
+#define KVM_S390_VM_CPU_FEAT_IBS        8
+#define KVM_S390_VM_CPU_FEAT_SKEY       9
+#define KVM_S390_VM_CPU_FEAT_CMMA       10
+#define KVM_S390_VM_CPU_FEAT_PFMFI      11
+#define KVM_S390_VM_CPU_FEAT_SIGPIF     12
+struct kvm_s390_vm_cpu_feat {
+        __u64 feat[16];
+};
+
+#define KVM_S390_VM_CPU_PROCESSOR_SUBFUNC       4
+#define KVM_S390_VM_CPU_MACHINE_SUBFUNC         5
+/* for "test bit" instructions MSB 0 bit ordering, for "query" raw blocks */
+struct kvm_s390_vm_cpu_subfunc {
+        __u8 plo[32];           /* always */
+        __u8 ptff[16];          /* with TOD-clock steering */
+        __u8 kmac[16];          /* with MSA */
+        __u8 kmc[16];           /* with MSA */
+        __u8 km[16];            /* with MSA */
+        __u8 kimd[16];          /* with MSA */
+        __u8 klmd[16];          /* with MSA */
+        __u8 pckmo[16];         /* with MSA3 */
+        __u8 kmctr[16];         /* with MSA4 */
+        __u8 kmf[16];           /* with MSA4 */
+        __u8 kmo[16];           /* with MSA4 */
+        __u8 pcc[16];           /* with MSA4 */
+        __u8 ppno[16];          /* with MSA5 */
+        __u8 reserved[1824];
+};
+
 /* kvm attributes for crypto */
 #define KVM_S390_VM_CRYPTO_ENABLE_AES_KW        0
 #define KVM_S390_VM_CRYPTO_ENABLE_DEA_KW        1
diff --git a/tools/arch/s390/include/uapi/asm/sie.h b/tools/arch/s390/include/uapi/asm/sie.h
index 8fb5d4a6dd25..3ac634368939 100644
--- a/tools/arch/s390/include/uapi/asm/sie.h
+++ b/tools/arch/s390/include/uapi/asm/sie.h
@@ -140,6 +140,7 @@
         exit_code_ipa0(0xB2, 0x4c, "TAR"),      \
         exit_code_ipa0(0xB2, 0x50, "CSP"),      \
         exit_code_ipa0(0xB2, 0x54, "MVPG"),     \
+        exit_code_ipa0(0xB2, 0x56, "STHYI"),    \
         exit_code_ipa0(0xB2, 0x58, "BSG"),      \
         exit_code_ipa0(0xB2, 0x5a, "BSA"),      \
         exit_code_ipa0(0xB2, 0x5f, "CHSC"),     \
diff --git a/tools/perf/arch/powerpc/util/sym-handling.c b/tools/perf/arch/powerpc/util/sym-handling.c
index 8d4dc97d80ba..35745a733100 100644
--- a/tools/perf/arch/powerpc/util/sym-handling.c
+++ b/tools/perf/arch/powerpc/util/sym-handling.c
@@ -97,6 +97,7 @@ void arch__fix_tev_from_maps(struct perf_probe_event *pev,
         }
 }
 
+#ifdef HAVE_LIBELF_SUPPORT
 void arch__post_process_probe_trace_events(struct perf_probe_event *pev,
                                            int ntevs)
 {
@@ -118,5 +119,6 @@ void arch__post_process_probe_trace_events(struct perf_probe_event *pev,
                 }
         }
 }
+#endif /* HAVE_LIBELF_SUPPORT */
 
 #endif
diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c
index fb51457ba338..a2412e9d883b 100644
--- a/tools/perf/arch/x86/util/intel-pt.c
+++ b/tools/perf/arch/x86/util/intel-pt.c
@@ -501,7 +501,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr,
         struct intel_pt_recording *ptr =
                         container_of(itr, struct intel_pt_recording, itr);
         struct perf_pmu *intel_pt_pmu = ptr->intel_pt_pmu;
-        bool have_timing_info;
+        bool have_timing_info, need_immediate = false;
         struct perf_evsel *evsel, *intel_pt_evsel = NULL;
         const struct cpu_map *cpus = evlist->cpus;
         bool privileged = geteuid() == 0 || perf_event_paranoid() < 0;
@@ -655,6 +655,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr,
                                 ptr->have_sched_switch = 3;
                         } else {
                                 opts->record_switch_events = true;
+                                need_immediate = true;
                                 if (cpu_wide)
                                         ptr->have_sched_switch = 3;
                                 else
@@ -700,6 +701,9 @@ static int intel_pt_recording_options(struct auxtrace_record *itr,
                 tracking_evsel->attr.freq = 0;
                 tracking_evsel->attr.sample_period = 1;
 
+                if (need_immediate)
+                        tracking_evsel->immediate = true;
+
                 /* In per-cpu case, always need the time of mmap events etc */
                 if (!cpu_map__empty(cpus)) {
                         perf_evsel__set_sample_bit(tracking_evsel, TIME);
diff --git a/tools/perf/builtin-mem.c b/tools/perf/builtin-mem.c
index d608a2c9e48c..d1ce29be560e 100644
--- a/tools/perf/builtin-mem.c
+++ b/tools/perf/builtin-mem.c
@@ -88,6 +88,9 @@ static int __cmd_record(int argc, const char **argv, struct perf_mem *mem)
         if (mem->operation & MEM_OPERATION_LOAD)
                 perf_mem_events[PERF_MEM_EVENTS__LOAD].record = true;
 
+        if (mem->operation & MEM_OPERATION_STORE)
+                perf_mem_events[PERF_MEM_EVENTS__STORE].record = true;
+
         if (perf_mem_events[PERF_MEM_EVENTS__LOAD].record)
                 rec_argv[i++] = "-W";
 
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index 9c640a8081c7..c859e59dfe3e 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -371,14 +371,16 @@ static int perf_session__check_output_opt(struct perf_session *session)
 
         if (!no_callchain) {
                 bool use_callchain = false;
+                bool not_pipe = false;
 
                 evlist__for_each_entry(session->evlist, evsel) {
+                        not_pipe = true;
                         if (evsel->attr.sample_type & PERF_SAMPLE_CALLCHAIN) {
                                 use_callchain = true;
                                 break;
                         }
                 }
-                if (!use_callchain)
+                if (not_pipe && !use_callchain)
                         symbol_conf.use_callchain = false;
         }
 
@@ -1690,8 +1692,13 @@ static int list_available_scripts(const struct option *opt __maybe_unused,
         snprintf(scripts_path, MAXPATHLEN, "%s/scripts", get_argv_exec_path());
 
         scripts_dir = opendir(scripts_path);
-        if (!scripts_dir)
-                return -1;
+        if (!scripts_dir) {
+                fprintf(stdout,
+                        "open(%s) failed.\n"
+                        "Check \"PERF_EXEC_PATH\" env to set scripts dir.\n",
+                        scripts_path);
+                exit(-1);
+        }
 
         for_each_lang(scripts_path, scripts_dir, lang_dirent) {
                 snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
index 9c8f15da86ce..8ff6c6a61291 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -123,8 +123,6 @@ struct intel_pt_decoder {
         bool have_calc_cyc_to_tsc;
         int exec_mode;
         unsigned int insn_bytes;
-        uint64_t sign_bit;
-        uint64_t sign_bits;
         uint64_t period;
         enum intel_pt_period_type period_type;
         uint64_t tot_insn_cnt;
@@ -191,9 +189,6 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct intel_pt_params *params)
         decoder->data               = params->data;
         decoder->return_compression = params->return_compression;
 
-        decoder->sign_bit           = (uint64_t)1 << 47;
-        decoder->sign_bits          = ~(((uint64_t)1 << 48) - 1);
-
         decoder->period             = params->period;
         decoder->period_type        = params->period_type;
 
@@ -362,21 +357,30 @@ int intel_pt__strerror(int code, char *buf, size_t buflen)
         return 0;
 }
 
-static uint64_t intel_pt_calc_ip(struct intel_pt_decoder *decoder,
-                                 const struct intel_pt_pkt *packet,
+static uint64_t intel_pt_calc_ip(const struct intel_pt_pkt *packet,
                                  uint64_t last_ip)
 {
         uint64_t ip;
 
         switch (packet->count) {
-        case 2:
+        case 1:
                 ip = (last_ip & (uint64_t)0xffffffffffff0000ULL) |
                      packet->payload;
                 break;
-        case 4:
+        case 2:
                 ip = (last_ip & (uint64_t)0xffffffff00000000ULL) |
                      packet->payload;
                 break;
+        case 3:
+                ip = packet->payload;
+                /* Sign-extend 6-byte ip */
+                if (ip & (uint64_t)0x800000000000ULL)
+                        ip |= (uint64_t)0xffff000000000000ULL;
+                break;
+        case 4:
+                ip = (last_ip & (uint64_t)0xffff000000000000ULL) |
+                     packet->payload;
+                break;
         case 6:
                 ip = packet->payload;
                 break;
@@ -384,16 +388,12 @@ static uint64_t intel_pt_calc_ip(struct intel_pt_decoder *decoder,
                 return 0;
         }
 
-        if (ip & decoder->sign_bit)
-                return ip | decoder->sign_bits;
-
         return ip;
 }
 
 static inline void intel_pt_set_last_ip(struct intel_pt_decoder *decoder)
 {
-        decoder->last_ip = intel_pt_calc_ip(decoder, &decoder->packet,
-                                            decoder->last_ip);
+        decoder->last_ip = intel_pt_calc_ip(&decoder->packet, decoder->last_ip);
 }
 
 static inline void intel_pt_set_ip(struct intel_pt_decoder *decoder)
@@ -1657,6 +1657,12 @@ next:
         }
 }
 
+static inline bool intel_pt_have_ip(struct intel_pt_decoder *decoder)
+{
+        return decoder->last_ip || decoder->packet.count == 0 ||
+               decoder->packet.count == 3 || decoder->packet.count == 6;
+}
+
 /* Walk PSB+ packets to get in sync. */
 static int intel_pt_walk_psb(struct intel_pt_decoder *decoder)
 {
@@ -1677,8 +1683,7 @@ static int intel_pt_walk_psb(struct intel_pt_decoder *decoder)
 
                 case INTEL_PT_FUP:
                         decoder->pge = true;
-                        if (decoder->last_ip || decoder->packet.count == 6 ||
-                            decoder->packet.count == 0) {
+                        if (intel_pt_have_ip(decoder)) {
                                 uint64_t current_ip = decoder->ip;
 
                                 intel_pt_set_ip(decoder);
@@ -1767,8 +1772,7 @@ static int intel_pt_walk_to_ip(struct intel_pt_decoder *decoder)
                 case INTEL_PT_TIP_PGE:
                 case INTEL_PT_TIP:
                         decoder->pge = decoder->packet.type != INTEL_PT_TIP_PGD;
-                        if (decoder->last_ip || decoder->packet.count == 6 ||
-                            decoder->packet.count == 0)
+                        if (intel_pt_have_ip(decoder))
                                 intel_pt_set_ip(decoder);
                         if (decoder->ip)
                                 return 0;
@@ -1776,9 +1780,7 @@ static int intel_pt_walk_to_ip(struct intel_pt_decoder *decoder)
 
                 case INTEL_PT_FUP:
                         if (decoder->overflow) {
-                                if (decoder->last_ip ||
-                                    decoder->packet.count == 6 ||
-                                    decoder->packet.count == 0)
+                                if (intel_pt_have_ip(decoder))
                                         intel_pt_set_ip(decoder);
                                 if (decoder->ip)
                                         return 0;
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
index b1257c816310..4f7b32020487 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
@@ -292,36 +292,46 @@ static int intel_pt_get_ip(enum intel_pt_pkt_type type, unsigned int byte,
                            const unsigned char *buf, size_t len,
                            struct intel_pt_pkt *packet)
 {
-        switch (byte >> 5) {
+        int ip_len;
+
+        packet->count = byte >> 5;
+
+        switch (packet->count) {
         case 0:
-                packet->count = 0;
+                ip_len = 0;
                 break;
         case 1:
                 if (len < 3)
                         return INTEL_PT_NEED_MORE_BYTES;
-                packet->count = 2;
+                ip_len = 2;
                 packet->payload = le16_to_cpu(*(uint16_t *)(buf + 1));
                 break;
         case 2:
                 if (len < 5)
                         return INTEL_PT_NEED_MORE_BYTES;
-                packet->count = 4;
+                ip_len = 4;
                 packet->payload = le32_to_cpu(*(uint32_t *)(buf + 1));
                 break;
         case 3:
-        case 6:
+        case 4:
                 if (len < 7)
                         return INTEL_PT_NEED_MORE_BYTES;
-                packet->count = 6;
+                ip_len = 6;
                 memcpy_le64(&packet->payload, buf + 1, 6);
                 break;
+        case 6:
+                if (len < 9)
+                        return INTEL_PT_NEED_MORE_BYTES;
+                ip_len = 8;
+                packet->payload = le64_to_cpu(*(uint64_t *)(buf + 1));
+                break;
         default:
                 return INTEL_PT_BAD_PACKET;
         }
 
         packet->type = type;
 
-        return packet->count + 1;
+        return ip_len + 1;
 }
 
 static int intel_pt_get_mode(const unsigned char *buf, size_t len,
diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c
index 9f3305f6b6d5..95f0884aae02 100644
--- a/tools/perf/util/jitdump.c
+++ b/tools/perf/util/jitdump.c
@@ -1,3 +1,4 @@
+#include <sys/sysmacros.h>
 #include <sys/types.h>
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/tools/perf/util/probe-file.c b/tools/perf/util/probe-file.c
index 9aed9c332da6..9c3b9ed5b3c3 100644
--- a/tools/perf/util/probe-file.c
+++ b/tools/perf/util/probe-file.c
@@ -133,7 +133,7 @@ int probe_file__open_both(int *kfd, int *ufd, int flag)
 /* Get raw string list of current kprobe_events  or uprobe_events */
 struct strlist *probe_file__get_rawlist(int fd)
 {
-        int ret, idx;
+        int ret, idx, fddup;
         FILE *fp;
         char buf[MAX_CMDLEN];
         char *p;
@@ -143,8 +143,17 @@ struct strlist *probe_file__get_rawlist(int fd)
                 return NULL;
 
         sl = strlist__new(NULL, NULL);
+        if (sl == NULL)
+                return NULL;
+
+        fddup = dup(fd);
+        if (fddup < 0)
+                goto out_free_sl;
+
+        fp = fdopen(fddup, "r");
+        if (!fp)
+                goto out_close_fddup;
 
-        fp = fdopen(dup(fd), "r");
         while (!feof(fp)) {
                 p = fgets(buf, MAX_CMDLEN, fp);
                 if (!p)
@@ -156,13 +165,21 @@ struct strlist *probe_file__get_rawlist(int fd)
                 ret = strlist__add(sl, buf);
                 if (ret < 0) {
                         pr_debug("strlist__add failed (%d)\n", ret);
-                        strlist__delete(sl);
-                        return NULL;
+                        goto out_close_fp;
                 }
         }
         fclose(fp);
 
         return sl;
+
+out_close_fp:
+        fclose(fp);
+        goto out_free_sl;
+out_close_fddup:
+        close(fddup);
+out_free_sl:
+        strlist__delete(sl);
+        return NULL;
 }
 
 static struct strlist *__probe_file__get_namelist(int fd, bool include_group)
@@ -447,12 +464,17 @@ static int probe_cache__load(struct probe_cache *pcache)
 {
         struct probe_cache_entry *entry = NULL;
         char buf[MAX_CMDLEN], *p;
-        int ret = 0;
+        int ret = 0, fddup;
         FILE *fp;
 
-        fp = fdopen(dup(pcache->fd), "r");
-        if (!fp)
+        fddup = dup(pcache->fd);
+        if (fddup < 0)
+                return -errno;
+        fp = fdopen(fddup, "r");
+        if (!fp) {
+                close(fddup);
                 return -EINVAL;
+        }
 
         while (!feof(fp)) {
                 if (!fgets(buf, MAX_CMDLEN, fp))
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index a34321e9b44d..a811c13a74d6 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -837,7 +837,8 @@ int dso__load_sym(struct dso *dso, struct map *map,
         sec = syms_ss->symtab;
         shdr = syms_ss->symshdr;
 
-        if (elf_section_by_name(elf, &ehdr, &tshdr, ".text", NULL))
+        if (elf_section_by_name(runtime_ss->elf, &runtime_ss->ehdr, &tshdr,
+                                ".text", NULL))
                 dso->text_offset = tshdr.sh_addr - tshdr.sh_offset;
 
         if (runtime_ss->opdsec)
diff --git a/tools/virtio/linux/dma-mapping.h b/tools/virtio/linux/dma-mapping.h
index 4f93af89ae16..18601f6689b9 100644
--- a/tools/virtio/linux/dma-mapping.h
+++ b/tools/virtio/linux/dma-mapping.h
@@ -14,4 +14,20 @@ enum dma_data_direction {
         DMA_NONE = 3,
 };
 
+#define dma_alloc_coherent(d, s, hp, f) ({ \
+        void *__dma_alloc_coherent_p = kmalloc((s), (f)); \
+        *(hp) = (unsigned long)__dma_alloc_coherent_p; \
+        __dma_alloc_coherent_p; \
+})
+
+#define dma_free_coherent(d, s, p, h) kfree(p)
+
+#define dma_map_page(d, p, o, s, dir) (page_to_phys(p) + (o))
+
+#define dma_map_single(d, p, s, dir) (virt_to_phys(p))
+#define dma_mapping_error(...) (0)
+
+#define dma_unmap_single(...) do { } while (0)
+#define dma_unmap_page(...) do { } while (0)
+
 #endif
diff --git a/tools/virtio/linux/kernel.h b/tools/virtio/linux/kernel.h
index 033849948215..d9554fc3f340 100644
--- a/tools/virtio/linux/kernel.h
+++ b/tools/virtio/linux/kernel.h
@@ -20,7 +20,9 @@
 
 #define PAGE_SIZE getpagesize()
 #define PAGE_MASK (~(PAGE_SIZE-1))
+#define PAGE_ALIGN(x) ((x + PAGE_SIZE - 1) & PAGE_MASK)
 
+typedef unsigned long long phys_addr_t;
 typedef unsigned long long dma_addr_t;
 typedef size_t __kernel_size_t;
 typedef unsigned int __wsum;
@@ -57,6 +59,11 @@ static inline void *kzalloc(size_t s, gfp_t gfp)
         return p;
 }
 
+static inline void *alloc_pages_exact(size_t s, gfp_t gfp)
+{
+        return kmalloc(s, gfp);
+}
+
 static inline void kfree(void *p)
 {
         if (p >= __kfree_ignore_start && p < __kfree_ignore_end)
@@ -64,6 +71,11 @@ static inline void kfree(void *p)
         free(p);
 }
 
+static inline void free_pages_exact(void *p, size_t s)
+{
+        kfree(p);
+}
+
 static inline void *krealloc(void *p, size_t s, gfp_t gfp)
 {
         return realloc(p, s);
@@ -105,6 +117,8 @@ static inline void free_page(unsigned long addr)
 #define dev_err(dev, format, ...) fprintf (stderr, format, ## __VA_ARGS__)
 #define dev_warn(dev, format, ...) fprintf (stderr, format, ## __VA_ARGS__)
 
+#define WARN_ON_ONCE(cond) ((cond) && fprintf (stderr, "WARNING\n"))
+
 #define min(x, y) ({                            \
         typeof(x) _min1 = (x);                  \
         typeof(y) _min2 = (y);                  \
diff --git a/tools/virtio/linux/slab.h b/tools/virtio/linux/slab.h
index 81baeac8ae40..7e1c1197d439 100644
--- a/tools/virtio/linux/slab.h
+++ b/tools/virtio/linux/slab.h
@@ -1,2 +1,6 @@
 #ifndef LINUX_SLAB_H
+#define GFP_KERNEL 0
+#define GFP_ATOMIC 0
+#define __GFP_NOWARN 0
+#define __GFP_ZERO 0
 #endif
diff --git a/tools/virtio/linux/virtio.h b/tools/virtio/linux/virtio.h
index ee125e714053..9377c8b4ac16 100644
--- a/tools/virtio/linux/virtio.h
+++ b/tools/virtio/linux/virtio.h
@@ -3,8 +3,12 @@
 #include <linux/scatterlist.h>
 #include <linux/kernel.h>
 
+struct device {
+        void *parent;
+};
+
 struct virtio_device {
-        void *dev;
+        struct device dev;
         u64 features;
 };
 
diff --git a/tools/virtio/linux/virtio_config.h b/tools/virtio/linux/virtio_config.h
index 57a6964a1e35..9ba11815e0a1 100644
--- a/tools/virtio/linux/virtio_config.h
+++ b/tools/virtio/linux/virtio_config.h
@@ -40,6 +40,19 @@ static inline void __virtio_clear_bit(struct virtio_device *vdev,
 #define virtio_has_feature(dev, feature) \
         (__virtio_test_bit((dev), feature))
 
+/**
+ * virtio_has_iommu_quirk - determine whether this device has the iommu quirk
+ * @vdev: the device
+ */
+static inline bool virtio_has_iommu_quirk(const struct virtio_device *vdev)
+{
+        /*
+         * Note the reverse polarity of the quirk feature (compared to most
+         * other features), this is for compatibility with legacy systems.
+         */
+        return !virtio_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM);
+}
+
 static inline bool virtio_is_little_endian(struct virtio_device *vdev)
 {
         return virtio_has_feature(vdev, VIRTIO_F_VERSION_1) ||
diff --git a/tools/virtio/ringtest/ptr_ring.c b/tools/virtio/ringtest/ptr_ring.c
index 68e4f9f0da3a..bd2ad1d3b7a9 100644
--- a/tools/virtio/ringtest/ptr_ring.c
+++ b/tools/virtio/ringtest/ptr_ring.c
@@ -13,6 +13,7 @@
 #define cache_line_size() SMP_CACHE_BYTES
 #define ____cacheline_aligned_in_smp __attribute__ ((aligned (SMP_CACHE_BYTES)))
 #define unlikely(x)    (__builtin_expect(!!(x), 0))
+#define likely(x)    (__builtin_expect(!!(x), 1))
 #define ALIGN(x, a) (((x) + (a) - 1) / (a) * (a))
 typedef pthread_spinlock_t  spinlock_t;