738 files changed, 7590 insertions, 3797 deletions
diff --git a/Documentation/admin-guide/pm/intel_pstate.rst b/Documentation/admin-guide/pm/intel_pstate.rst
index ab2fe0eda1d7..8f1d3de449b5 100644
--- a/Documentation/admin-guide/pm/intel_pstate.rst
+++ b/Documentation/admin-guide/pm/intel_pstate.rst
@@ -324,8 +324,7 @@ Global Attributes
 ``intel_pstate`` exposes several global attributes (files) in ``sysfs`` to
 control its functionality at the system level.  They are located in the
-``/sys/devices/system/cpu/cpufreq/intel_pstate/`` directory and affect all
+``/sys/devices/system/cpu/intel_pstate/`` directory and affect all CPUs.
-CPUs.
 Some of them are not present if the ``intel_pstate=per_cpu_perf_limits``
 argument is passed to the kernel in the command line.
@@ -379,6 +378,17 @@ argument is passed to the kernel in the command line.
        but it affects the maximum possible value of per-policy P-state limits
        (see `Interpretation of Policy Attributes`_ below for details).
+``hwp_dynamic_boost``
+        This attribute is only present if ``intel_pstate`` works in the
+        `active mode with the HWP feature enabled <Active Mode With HWP_>`_ in
+        the processor.  If set (equal to 1), it causes the minimum P-state limit
+        to be increased dynamically for a short time whenever a task previously
+        waiting on I/O is selected to run on a given logical CPU (the purpose
+        of this mechanism is to improve performance).
+        This setting has no effect on logical CPUs whose minimum P-state limit
+        is directly set to the highest non-turbo P-state or above it.
 .. _status_attr:
 ``status``
@@ -410,7 +420,7 @@ argument is passed to the kernel in the command line.
        That only is supported in some configurations, though (for example, if
        the `HWP feature is enabled in the processor <Active Mode With HWP_>`_,
        the operation mode of the driver cannot be changed), and if it is not
-        supported in the current configuration, writes to this attribute with
+        supported in the current configuration, writes to this attribute will
        fail with an appropriate error.
 Interpretation of Policy Attributes
diff --git a/Documentation/core-api/kernel-api.rst b/Documentation/core-api/kernel-api.rst
index 8e44aea366c2..76fe2d0f5e7d 100644
--- a/Documentation/core-api/kernel-api.rst
+++ b/Documentation/core-api/kernel-api.rst
@@ -284,7 +284,7 @@ Resources Management
 MTRR Handling
 -------------
-.. kernel-doc:: arch/x86/kernel/cpu/mtrr/main.c
+.. kernel-doc:: arch/x86/kernel/cpu/mtrr/mtrr.c
   :export:
 Security Framework
diff --git a/Documentation/devicetree/bindings/arm/bcm/brcm,brcmstb.txt b/Documentation/devicetree/bindings/arm/bcm/brcm,brcmstb.txt
index c052caad36e8..104cc9b41df4 100644
--- a/Documentation/devicetree/bindings/arm/bcm/brcm,brcmstb.txt
+++ b/Documentation/devicetree/bindings/arm/bcm/brcm,brcmstb.txt
@@ -189,7 +189,11 @@ Power-Down (SRPD), among other things.
 Required properties:
 - compatible     : should contain one of these
+        "brcm,brcmstb-memc-ddr-rev-b.2.1"
        "brcm,brcmstb-memc-ddr-rev-b.2.2"
+        "brcm,brcmstb-memc-ddr-rev-b.2.3"
+        "brcm,brcmstb-memc-ddr-rev-b.3.0"
+        "brcm,brcmstb-memc-ddr-rev-b.3.1"
        "brcm,brcmstb-memc-ddr"
 - reg            : the MEMC DDR register range
diff --git a/Documentation/devicetree/bindings/bus/ti-sysc.txt b/Documentation/devicetree/bindings/bus/ti-sysc.txt
index d8ed5b780ed9..91dc2333af01 100644
--- a/Documentation/devicetree/bindings/bus/ti-sysc.txt
+++ b/Documentation/devicetree/bindings/bus/ti-sysc.txt
@@ -36,6 +36,7 @@ Required standard properties:
                "ti,sysc-omap-aes"
                "ti,sysc-mcasp"
                "ti,sysc-usb-host-fs"
+                "ti,sysc-dra7-mcan"
 - reg           shall have register areas implemented for the interconnect
                target module in question such as revision, sysc and syss
diff --git a/Documentation/devicetree/bindings/input/sprd,sc27xx-vibra.txt b/Documentation/devicetree/bindings/input/sprd,sc27xx-vibra.txt
new file mode 100644
index 000000000000..f2ec0d4f2dff
--- /dev/null
+++ b/Documentation/devicetree/bindings/input/sprd,sc27xx-vibra.txt
@@ -0,0 +1,23 @@
+Spreadtrum SC27xx PMIC Vibrator
+Required properties:
+- compatible: should be "sprd,sc2731-vibrator".
+- reg: address of vibrator control register.
+Example :
+        sc2731_pmic: pmic@0 {
+                compatible = "sprd,sc2731";
+                reg = <0>;
+                spi-max-frequency = <26000000>;
+                interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
+                interrupt-controller;
+                #interrupt-cells = <2>;
+                #address-cells = <1>;
+                #size-cells = <0>;
+                vibrator@eb4 {
+                        compatible = "sprd,sc2731-vibrator";
+                        reg = <0xeb4>;
+                };
+        };
diff --git a/Documentation/driver-api/infrastructure.rst b/Documentation/driver-api/infrastructure.rst
index bee1b9a1702f..6172f3cc3d0b 100644
--- a/Documentation/driver-api/infrastructure.rst
+++ b/Documentation/driver-api/infrastructure.rst
@@ -49,10 +49,10 @@ Device Drivers Base
 Device Drivers DMA Management
 -----------------------------
-.. kernel-doc:: drivers/base/dma-coherent.c
+.. kernel-doc:: kernel/dma/coherent.c
   :export:
-.. kernel-doc:: drivers/base/dma-mapping.c
+.. kernel-doc:: kernel/dma/mapping.c
   :export:
 Device drivers PnP support
diff --git a/Documentation/filesystems/Locking b/Documentation/filesystems/Locking
index 2c391338c675..37bf0a9de75c 100644
--- a/Documentation/filesystems/Locking
+++ b/Documentation/filesystems/Locking
@@ -441,8 +441,6 @@ prototypes:
        int (*iterate) (struct file *, struct dir_context *);
        int (*iterate_shared) (struct file *, struct dir_context *);
        __poll_t (*poll) (struct file *, struct poll_table_struct *);
-        struct wait_queue_head * (*get_poll_head)(struct file *, __poll_t);
-        __poll_t (*poll_mask) (struct file *, __poll_t);
        long (*unlocked_ioctl) (struct file *, unsigned int, unsigned long);
        long (*compat_ioctl) (struct file *, unsigned int, unsigned long);
        int (*mmap) (struct file *, struct vm_area_struct *);
@@ -473,7 +471,7 @@ prototypes:
 };
 locking rules:
-        All except for ->poll_mask may block.
+        All may block.
 ->llseek() locking has moved from llseek to the individual llseek
 implementations.  If your fs is not using generic_file_llseek, you
@@ -505,9 +503,6 @@ in sys_read() and friends.
 the lease within the individual filesystem to record the result of the
 operation
->poll_mask can be called with or without the waitqueue lock for the waitqueue
-returned from ->get_poll_head.
 --------------------------- dquot_operations -------------------------------
 prototypes:
        int (*write_dquot) (struct dquot *);
diff --git a/Documentation/filesystems/cifs/AUTHORS b/Documentation/filesystems/cifs/AUTHORS
index 9f4f87e16240..75865da2ce14 100644
--- a/Documentation/filesystems/cifs/AUTHORS
+++ b/Documentation/filesystems/cifs/AUTHORS
@@ -42,9 +42,11 @@ Jeff Layton (many, many fixes, as well as great work on the cifs Kerberos code)
 Scott Lovenberg
 Pavel Shilovsky (for great work adding SMB2 support, and various SMB3 features)
 Aurelien Aptel (for DFS SMB3 work and some key bug fixes)
-Ronnie Sahlberg (for SMB3 xattr work and bug fixes)
+Ronnie Sahlberg (for SMB3 xattr work, bug fixes, and lots of great work on compounding)
 Shirish Pargaonkar (for many ACL patches over the years)
 Sachin Prabhu (many bug fixes, including for reconnect, copy offload and security)
+Paulo Alcantara
+Long Li (some great work on RDMA, SMB Direct)
 Test case and Bug Report contributors
@@ -58,5 +60,4 @@ mention to the Stanford Checker (SWAT) which pointed out many minor
 bugs in error paths.  Valuable suggestions also have come from Al Viro
 and Dave Miller.
-And thanks to the IBM LTC and Power test teams and SuSE testers for
+And thanks to the IBM LTC and Power test teams and SuSE and Citrix and RedHat testers for finding multiple bugs during excellent stress test runs.
-finding multiple bugs during excellent stress test runs.
diff --git a/Documentation/filesystems/cifs/CHANGES b/Documentation/filesystems/cifs/CHANGES
index bc0025cdd1c9..455e1cc494a9 100644
--- a/Documentation/filesystems/cifs/CHANGES
+++ b/Documentation/filesystems/cifs/CHANGES
@@ -1,3 +1,6 @@
+See https://wiki.samba.org/index.php/LinuxCIFSKernel for
+more current information.
 Version 1.62
 ------------
 Add sockopt=TCP_NODELAY mount option. EA (xattr) routines hardened
diff --git a/Documentation/filesystems/cifs/TODO b/Documentation/filesystems/cifs/TODO
index c5adf149b57f..852499aed64b 100644
--- a/Documentation/filesystems/cifs/TODO
+++ b/Documentation/filesystems/cifs/TODO
@@ -9,14 +9,14 @@ is a partial list of the known problems and missing features:
 a) SMB3 (and SMB3.02) missing optional features:
   - multichannel (started), integration with RDMA
-   - directory leases (improved metadata caching)
+   - directory leases (improved metadata caching), started (root dir only)
-   - T10 copy offload (copy chunk, and "Duplicate Extents" ioctl
+   - T10 copy offload ie "ODX" (copy chunk, and "Duplicate Extents" ioctl
     currently the only two server side copy mechanisms supported)
 b) improved sparse file support
 c) Directory entry caching relies on a 1 second timer, rather than
-using Directory Leases
+using Directory Leases, currently only the root file handle is cached longer
 d) quota support (needs minor kernel change since quota calls
 to make it to network filesystems or deviceless filesystems)
@@ -42,6 +42,8 @@ mount or a per server basis to client UIDs or nobody if no mapping
 exists. Also better integration with winbind for resolving SID owners
 k) Add tools to take advantage of more smb3 specific ioctls and features
+(passthrough ioctl/fsctl for sending various SMB3 fsctls to the server
+is in progress)
 l) encrypted file support
@@ -71,9 +73,8 @@ t) split cifs and smb3 support into separate modules so legacy (and less
 secure) CIFS dialect can be disabled in environments that don't need it
 and simplify the code.
-u) Finish up SMB3.1.1 dialect support
+v) POSIX Extensions for SMB3.1.1 (started, create and mkdir support added
+so far).
-v) POSIX Extensions for SMB3.1.1
 KNOWN BUGS
 ====================================
@@ -92,8 +93,8 @@ Misc testing to do
 1) check out max path names and max path name components against various server
 types. Try nested symlinks (8 deep). Return max path name in stat -f information
-2) Improve xfstest's cifs enablement and adapt xfstests where needed to test
+2) Improve xfstest's cifs/smb3 enablement and adapt xfstests where needed to test
-cifs better
+cifs/smb3 better
 3) Additional performance testing and optimization using iozone and similar - 
 there are some easy changes that can be done to parallelize sequential writes,
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index 829a7b7857a4..f608180ad59d 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -857,8 +857,6 @@ struct file_operations {
        ssize_t (*write_iter) (struct kiocb *, struct iov_iter *);
        int (*iterate) (struct file *, struct dir_context *);
        __poll_t (*poll) (struct file *, struct poll_table_struct *);
-        struct wait_queue_head * (*get_poll_head)(struct file *, __poll_t);
-        __poll_t (*poll_mask) (struct file *, __poll_t);
        long (*unlocked_ioctl) (struct file *, unsigned int, unsigned long);
        long (*compat_ioctl) (struct file *, unsigned int, unsigned long);
        int (*mmap) (struct file *, struct vm_area_struct *);
@@ -903,17 +901,6 @@ otherwise noted.
        activity on this file and (optionally) go to sleep until there
        is activity. Called by the select(2) and poll(2) system calls
-  get_poll_head: Returns the struct wait_queue_head that callers can
-  wait on.  Callers need to check the returned events using ->poll_mask
-  once woken.  Can return NULL to indicate polling is not supported,
-  or any error code using the ERR_PTR convention to indicate that a
-  grave error occured and ->poll_mask shall not be called.
-  poll_mask: return the mask of EPOLL* values describing the file descriptor
-  state.  Called either before going to sleep on the waitqueue returned by
-  get_poll_head, or after it has been woken.  If ->get_poll_head and
-  ->poll_mask are implemented ->poll does not need to be implement.
  unlocked_ioctl: called by the ioctl(2) system call.
  compat_ioctl: called by the ioctl(2) system call when 32 bit system calls
diff --git a/Documentation/hwmon/raspberrypi-hwmon b/Documentation/hwmon/raspberrypi-hwmon
new file mode 100644
index 000000000000..3c92e2cb52d6
--- /dev/null
+++ b/Documentation/hwmon/raspberrypi-hwmon
@@ -0,0 +1,22 @@
+Kernel driver raspberrypi-hwmon
+===============================
+Supported boards:
+  * Raspberry Pi A+ (via GPIO on SoC)
+  * Raspberry Pi B+ (via GPIO on SoC)
+  * Raspberry Pi 2 B (via GPIO on SoC)
+  * Raspberry Pi 3 B (via GPIO on port expander)
+  * Raspberry Pi 3 B+ (via PMIC)
+Author: Stefan Wahren <stefan.wahren@i2se.com>
+Description
+-----------
+This driver periodically polls a mailbox property of the VC4 firmware to detect
+undervoltage conditions.
+Sysfs entries
+-------------
+in0_lcrit_alarm         Undervoltage alarm
diff --git a/Documentation/kbuild/kconfig-language.txt b/Documentation/kbuild/kconfig-language.txt
index 3534a84d206c..64e0775a62d4 100644
--- a/Documentation/kbuild/kconfig-language.txt
+++ b/Documentation/kbuild/kconfig-language.txt
@@ -430,6 +430,12 @@ This sets the config program's title bar if the config program chooses
 to use it. It should be placed at the top of the configuration, before any
 other statement.
+'#' Kconfig source file comment:
+An unquoted '#' character anywhere in a source file line indicates
+the beginning of a source file comment.  The remainder of that line
+is a comment.
 Kconfig hints
 -------------
diff --git a/Documentation/networking/e100.rst b/Documentation/networking/e100.rst
index d4d837027925..9708f5fa76de 100644
--- a/Documentation/networking/e100.rst
+++ b/Documentation/networking/e100.rst
@@ -1,3 +1,4 @@
+==============================================================
 Linux* Base Driver for the Intel(R) PRO/100 Family of Adapters
 ==============================================================
@@ -86,83 +87,84 @@ Event Log Message Level:  The driver uses the message level flag to log events
 Additional Configurations
 =========================
-  Configuring the Driver on Different Distributions
+Configuring the Driver on Different Distributions
-  -------------------------------------------------
+-------------------------------------------------
-  Configuring a network driver to load properly when the system is started is
+Configuring a network driver to load properly when the system is started
-  distribution dependent. Typically, the configuration process involves adding
+is distribution dependent.  Typically, the configuration process involves
-  an alias line to /etc/modprobe.d/*.conf as well as editing other system
+adding an alias line to /etc/modprobe.d/*.conf as well as editing other
-  startup scripts and/or configuration files.  Many popular Linux
+system startup scripts and/or configuration files.  Many popular Linux
-  distributions ship with tools to make these changes for you. To learn the
+distributions ship with tools to make these changes for you.  To learn
-  proper way to configure a network device for your system, refer to your
+the proper way to configure a network device for your system, refer to
-  distribution documentation.  If during this process you are asked for the
+your distribution documentation.  If during this process you are asked
-  driver or module name, the name for the Linux Base Driver for the Intel
+for the driver or module name, the name for the Linux Base Driver for
-  PRO/100 Family of Adapters is e100.
+the Intel PRO/100 Family of Adapters is e100.
-  As an example, if you install the e100 driver for two PRO/100 adapters
+As an example, if you install the e100 driver for two PRO/100 adapters
-  (eth0 and eth1), add the following to a configuration file in /etc/modprobe.d/
+(eth0 and eth1), add the following to a configuration file in
+/etc/modprobe.d/::
       alias eth0 e100
       alias eth1 e100
-  Viewing Link Messages
+Viewing Link Messages
-  ---------------------
+---------------------
-  In order to see link messages and other Intel driver information on your
-  console, you must set the dmesg level up to six. This can be done by
-  entering the following on the command line before loading the e100 driver::
-       dmesg -n 6
-  If you wish to see all messages issued by the driver, including debug
+In order to see link messages and other Intel driver information on your
-  messages, set the dmesg level to eight.
+console, you must set the dmesg level up to six.  This can be done by
+entering the following on the command line before loading the e100
+driver::
-  NOTE: This setting is not saved across reboots.
+       dmesg -n 6
+If you wish to see all messages issued by the driver, including debug
+messages, set the dmesg level to eight.
-  ethtool
+NOTE: This setting is not saved across reboots.
-  -------
-  The driver utilizes the ethtool interface for driver configuration and
+ethtool
-  diagnostics, as well as displaying statistical information.  The ethtool
+-------
-  version 1.6 or later is required for this functionality.
-  The latest release of ethtool can be found from
+The driver utilizes the ethtool interface for driver configuration and
-  https://www.kernel.org/pub/software/network/ethtool/
+diagnostics, as well as displaying statistical information.  The ethtool
+version 1.6 or later is required for this functionality.
-  Enabling Wake on LAN* (WoL)
+The latest release of ethtool can be found from
-  ---------------------------
+https://www.kernel.org/pub/software/network/ethtool/
-  WoL is provided through the ethtool* utility.  For instructions on enabling
-  WoL with ethtool, refer to the ethtool man page.
-  WoL will be enabled on the system during the next shut down or reboot. For
+Enabling Wake on LAN* (WoL)
-  this driver version, in order to enable WoL, the e100 driver must be
+---------------------------
-  loaded when shutting down or rebooting the system.
+WoL is provided through the ethtool* utility.  For instructions on
+enabling WoL with ethtool, refer to the ethtool man page.  WoL will be
+enabled on the system during the next shut down or reboot.  For this
+driver version, in order to enable WoL, the e100 driver must be loaded
+when shutting down or rebooting the system.
-  NAPI
+NAPI
-  ----
+----
-  NAPI (Rx polling mode) is supported in the e100 driver.
+NAPI (Rx polling mode) is supported in the e100 driver.
-  See https://wiki.linuxfoundation.org/networking/napi for more information
+See https://wiki.linuxfoundation.org/networking/napi for more
-  on NAPI.
+information on NAPI.
-  Multiple Interfaces on Same Ethernet Broadcast Network
+Multiple Interfaces on Same Ethernet Broadcast Network
-  ------------------------------------------------------
+------------------------------------------------------
-  Due to the default ARP behavior on Linux, it is not possible to have
+Due to the default ARP behavior on Linux, it is not possible to have one
-  one system on two IP networks in the same Ethernet broadcast domain
+system on two IP networks in the same Ethernet broadcast domain
-  (non-partitioned switch) behave as expected. All Ethernet interfaces
+(non-partitioned switch) behave as expected.  All Ethernet interfaces
-  will respond to IP traffic for any IP address assigned to the system.
+will respond to IP traffic for any IP address assigned to the system.
-  This results in unbalanced receive traffic.
+This results in unbalanced receive traffic.
-  If you have multiple interfaces in a server, either turn on ARP
+If you have multiple interfaces in a server, either turn on ARP
-  filtering by
+filtering by
-  (1) entering:: echo 1 > /proc/sys/net/ipv4/conf/all/arp_filter
+(1) entering:: echo 1 > /proc/sys/net/ipv4/conf/all/arp_filter
-      (this only works if your kernel's version is higher than 2.4.5), or
+    (this only works if your kernel's version is higher than 2.4.5), or
-  (2) installing the interfaces in separate broadcast domains (either
+(2) installing the interfaces in separate broadcast domains (either
-      in different switches or in a switch partitioned to VLANs).
+    in different switches or in a switch partitioned to VLANs).
 Support
diff --git a/Documentation/networking/e1000.rst b/Documentation/networking/e1000.rst
index 616848940e63..144b87eef153 100644
--- a/Documentation/networking/e1000.rst
+++ b/Documentation/networking/e1000.rst
@@ -1,3 +1,4 @@
+===========================================================
 Linux* Base Driver for Intel(R) Ethernet Network Connection
 ===========================================================
@@ -354,57 +355,58 @@ previously mentioned to force the adapter to the same speed and duplex.
 Additional Configurations
 =========================
-  Jumbo Frames
+Jumbo Frames
-  ------------
+------------
-  Jumbo Frames support is enabled by changing the MTU to a value larger than
+Jumbo Frames support is enabled by changing the MTU to a value larger
-  the default of 1500.  Use the ifconfig command to increase the MTU size.
+than the default of 1500.  Use the ifconfig command to increase the MTU
-  For example::
+size.  For example::
       ifconfig eth<x> mtu 9000 up
-  This setting is not saved across reboots.  It can be made permanent if
+This setting is not saved across reboots.  It can be made permanent if
-  you add::
+you add::
       MTU=9000
-   to the file /etc/sysconfig/network-scripts/ifcfg-eth<x>.  This example
+to the file /etc/sysconfig/network-scripts/ifcfg-eth<x>.  This example
-   applies to the Red Hat distributions; other distributions may store this
+applies to the Red Hat distributions; other distributions may store this
-   setting in a different location.
+setting in a different location.
+Notes: Degradation in throughput performance may be observed in some
+Jumbo frames environments.  If this is observed, increasing the
+application's socket buffer size and/or increasing the
+/proc/sys/net/ipv4/tcp_*mem entry values may help.  See the specific
+application manual and /usr/src/linux*/Documentation/
+networking/ip-sysctl.txt for more details.
-  Notes:
+- The maximum MTU setting for Jumbo Frames is 16110.  This value
-  Degradation in throughput performance may be observed in some Jumbo frames
+  coincides with the maximum Jumbo Frames size of 16128.
-  environments. If this is observed, increasing the application's socket buffer
-  size and/or increasing the /proc/sys/net/ipv4/tcp_*mem entry values may help.
-  See the specific application manual and /usr/src/linux*/Documentation/
-  networking/ip-sysctl.txt for more details.
-  - The maximum MTU setting for Jumbo Frames is 16110.  This value coincides
+- Using Jumbo frames at 10 or 100 Mbps is not supported and may result
-    with the maximum Jumbo Frames size of 16128.
+  in poor performance or loss of link.
-  - Using Jumbo frames at 10 or 100 Mbps is not supported and may result in
+- Adapters based on the Intel(R) 82542 and 82573V/E controller do not
-    poor performance or loss of link.
+  support Jumbo Frames.  These correspond to the following product names:
+  Intel(R) PRO/1000 Gigabit Server Adapter Intel(R) PRO/1000 PM Network
+  Connection
-  - Adapters based on the Intel(R) 82542 and 82573V/E controller do not
+ethtool
-    support Jumbo Frames. These correspond to the following product names:
+-------
-     Intel(R) PRO/1000 Gigabit Server Adapter
+The driver utilizes the ethtool interface for driver configuration and
-     Intel(R) PRO/1000 PM Network Connection
+diagnostics, as well as displaying statistical information.  The ethtool
+version 1.6 or later is required for this functionality.
-  ethtool
+The latest release of ethtool can be found from
-  -------
+https://www.kernel.org/pub/software/network/ethtool/
-  The driver utilizes the ethtool interface for driver configuration and
-  diagnostics, as well as displaying statistical information.  The ethtool
-  version 1.6 or later is required for this functionality.
-  The latest release of ethtool can be found from
+Enabling Wake on LAN* (WoL)
-  https://www.kernel.org/pub/software/network/ethtool/
+---------------------------
+WoL is configured through the ethtool* utility.
-  Enabling Wake on LAN* (WoL)
+WoL will be enabled on the system during the next shut down or reboot.
-  ---------------------------
+For this driver version, in order to enable WoL, the e1000 driver must be
-  WoL is configured through the ethtool* utility.
+loaded when shutting down or rebooting the system.
-  WoL will be enabled on the system during the next shut down or reboot.
-  For this driver version, in order to enable WoL, the e1000 driver must be
-  loaded when shutting down or rebooting the system.
 Support
 =======
diff --git a/Documentation/networking/strparser.txt b/Documentation/networking/strparser.txt
index 13081b3decef..a7d354ddda7b 100644
--- a/Documentation/networking/strparser.txt
+++ b/Documentation/networking/strparser.txt
@@ -48,7 +48,7 @@ void strp_pause(struct strparser *strp)
     Temporarily pause a stream parser. Message parsing is suspended
     and no new messages are delivered to the upper layer.
-void strp_pause(struct strparser *strp)
+void strp_unpause(struct strparser *strp)
     Unpause a paused stream parser.
diff --git a/Documentation/trace/histogram.txt b/Documentation/trace/histogram.txt
index e73bcf9cb5f3..7ffea6aa22e3 100644
--- a/Documentation/trace/histogram.txt
+++ b/Documentation/trace/histogram.txt
@@ -1729,35 +1729,35 @@ If a variable isn't a key variable or prefixed with 'vals=', the
 associated event field will be saved in a variable but won't be summed
 as a value:
-  # echo 'hist:keys=next_pid:ts1=common_timestamp ... >> event/trigger
+  # echo 'hist:keys=next_pid:ts1=common_timestamp ...' >> event/trigger
 Multiple variables can be assigned at the same time.  The below would
 result in both ts0 and b being created as variables, with both
 common_timestamp and field1 additionally being summed as values:
-  # echo 'hist:keys=pid:vals=$ts0,$b:ts0=common_timestamp,b=field1 ... >> \
+  # echo 'hist:keys=pid:vals=$ts0,$b:ts0=common_timestamp,b=field1 ...' >> \
        event/trigger
 Note that variable assignments can appear either preceding or
 following their use.  The command below behaves identically to the
 command above:
-  # echo 'hist:keys=pid:ts0=common_timestamp,b=field1:vals=$ts0,$b ... >> \
+  # echo 'hist:keys=pid:ts0=common_timestamp,b=field1:vals=$ts0,$b ...' >> \
        event/trigger
 Any number of variables not bound to a 'vals=' prefix can also be
 assigned by simply separating them with colons.  Below is the same
 thing but without the values being summed in the histogram:
-  # echo 'hist:keys=pid:ts0=common_timestamp:b=field1 ... >> event/trigger
+  # echo 'hist:keys=pid:ts0=common_timestamp:b=field1 ...' >> event/trigger
 Variables set as above can be referenced and used in expressions on
 another event.
 For example, here's how a latency can be calculated:
-  # echo 'hist:keys=pid,prio:ts0=common_timestamp ... >> event1/trigger
+  # echo 'hist:keys=pid,prio:ts0=common_timestamp ...' >> event1/trigger
-  # echo 'hist:keys=next_pid:wakeup_lat=common_timestamp-$ts0 ... >> event2/trigger
+  # echo 'hist:keys=next_pid:wakeup_lat=common_timestamp-$ts0 ...' >> event2/trigger
 In the first line above, the event's timetamp is saved into the
 variable ts0.  In the next line, ts0 is subtracted from the second
@@ -1766,7 +1766,7 @@ yet another variable, 'wakeup_lat'.  The hist trigger below in turn
 makes use of the wakeup_lat variable to compute a combined latency
 using the same key and variable from yet another event:
-  # echo 'hist:key=pid:wakeupswitch_lat=$wakeup_lat+$switchtime_lat ... >> event3/trigger
+  # echo 'hist:key=pid:wakeupswitch_lat=$wakeup_lat+$switchtime_lat ...' >> event3/trigger
 2.2.2 Synthetic Events
 ----------------------
@@ -1807,10 +1807,11 @@ the command that defined it with a '!':
 At this point, there isn't yet an actual 'wakeup_latency' event
 instantiated in the event subsytem - for this to happen, a 'hist
 trigger action' needs to be instantiated and bound to actual fields
-and variables defined on other events (see Section 6.3.3 below).
+and variables defined on other events (see Section 2.2.3 below on
+how that is done using hist trigger 'onmatch' action). Once that is
+done, the 'wakeup_latency' synthetic event instance is created.
-Once that is done, an event instance is created, and a histogram can
+A histogram can now be defined for the new synthetic event:
-be defined using it:
  # echo 'hist:keys=pid,prio,lat.log2:sort=pid,lat' >> \
        /sys/kernel/debug/tracing/events/synthetic/wakeup_latency/trigger
@@ -1960,7 +1961,7 @@ hist trigger specification.
    back to that pid, the timestamp difference is calculated.  If the
    resulting latency, stored in wakeup_lat, exceeds the current
    maximum latency, the values specified in the save() fields are
-    recoreded:
+    recorded:
    # echo 'hist:keys=pid:ts0=common_timestamp.usecs \
            if comm=="cyclictest"' >> \
diff --git a/Documentation/usb/gadget_configfs.txt b/Documentation/usb/gadget_configfs.txt
index 635e57493709..b8cb38a98c19 100644
--- a/Documentation/usb/gadget_configfs.txt
+++ b/Documentation/usb/gadget_configfs.txt
@@ -226,7 +226,7 @@ $ rm configs/<config name>.<number>/<function>
 where <config name>.<number> specify the configuration and <function> is
 a symlink to a function being removed from the configuration, e.g.:
-$ rm configfs/c.1/ncm.usb0
+$ rm configs/c.1/ncm.usb0
 ...
 ...
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index 495b7742ab58..d10944e619d3 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -4610,7 +4610,7 @@ This capability indicates that kvm will implement the interfaces to handle
 reset, migration and nested KVM for branch prediction blocking. The stfle
 facility 82 should not be provided to the guest without this capability.
-8.14 KVM_CAP_HYPERV_TLBFLUSH
+8.18 KVM_CAP_HYPERV_TLBFLUSH
 Architectures: x86
diff --git a/MAINTAINERS b/MAINTAINERS
index 9d5eeff51b5f..07d1576fc766 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2971,9 +2971,13 @@ N:	bcm585*
 N:      bcm586*
 N:      bcm88312
 N:      hr2
-F:      arch/arm64/boot/dts/broadcom/ns2*
+N:      stingray
+F:      arch/arm64/boot/dts/broadcom/northstar2/*
+F:      arch/arm64/boot/dts/broadcom/stingray/*
 F:      drivers/clk/bcm/clk-ns*
+F:      drivers/clk/bcm/clk-sr*
 F:      drivers/pinctrl/bcm/pinctrl-ns*
+F:      include/dt-bindings/clock/bcm-sr*
 BROADCOM KONA GPIO DRIVER
 M:      Ray Jui <rjui@broadcom.com>
@@ -4360,12 +4364,7 @@ L:	iommu@lists.linux-foundation.org
 T:      git git://git.infradead.org/users/hch/dma-mapping.git
 W:      http://git.infradead.org/users/hch/dma-mapping.git
 S:      Supported
-F:      lib/dma-debug.c
+F:      kernel/dma/
-F:      lib/dma-direct.c
-F:      lib/dma-noncoherent.c
-F:      lib/dma-virt.c
-F:      drivers/base/dma-mapping.c
-F:      drivers/base/dma-coherent.c
 F:      include/asm-generic/dma-mapping.h
 F:      include/linux/dma-direct.h
 F:      include/linux/dma-mapping.h
@@ -5674,7 +5673,7 @@ F:	drivers/crypto/caam/
 F:      Documentation/devicetree/bindings/crypto/fsl-sec4.txt
 FREESCALE DIU FRAMEBUFFER DRIVER
-M:      Timur Tabi <timur@tabi.org>
+M:      Timur Tabi <timur@kernel.org>
 L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/fbdev/fsl-diu-fb.*
@@ -5774,7 +5773,7 @@ S:	Maintained
 F:      drivers/net/wan/fsl_ucc_hdlc*
 FREESCALE QUICC ENGINE UCC UART DRIVER
-M:      Timur Tabi <timur@tabi.org>
+M:      Timur Tabi <timur@kernel.org>
 L:      linuxppc-dev@lists.ozlabs.org
 S:      Maintained
 F:      drivers/tty/serial/ucc_uart.c
@@ -5798,7 +5797,7 @@ F:	drivers/net/ethernet/freescale/fs_enet/
 F:      include/linux/fs_enet_pd.h
 FREESCALE SOC SOUND DRIVERS
-M:      Timur Tabi <timur@tabi.org>
+M:      Timur Tabi <timur@kernel.org>
 M:      Nicolin Chen <nicoleotsuka@gmail.com>
 M:      Xiubo Li <Xiubo.Lee@gmail.com>
 R:      Fabio Estevam <fabio.estevam@nxp.com>
@@ -9756,6 +9755,11 @@ L:	linux-scsi@vger.kernel.org
 S:      Maintained
 F:      drivers/scsi/NCR_D700.*
+NCSI LIBRARY:
+M:      Samuel Mendoza-Jonas <sam@mendozajonas.com>
+S:      Maintained
+F:      net/ncsi/
 NCT6775 HARDWARE MONITOR DRIVER
 M:      Guenter Roeck <linux@roeck-us.net>
 L:      linux-hwmon@vger.kernel.org
@@ -9882,6 +9886,7 @@ M:	Andrew Lunn <andrew@lunn.ch>
 M:      Vivien Didelot <vivien.didelot@savoirfairelinux.com>
 M:      Florian Fainelli <f.fainelli@gmail.com>
 S:      Maintained
+F:      Documentation/devicetree/bindings/net/dsa/
 F:      net/dsa/
 F:      include/net/dsa.h
 F:      include/linux/dsa/
@@ -11476,6 +11481,15 @@ W:	http://wireless.kernel.org/en/users/Drivers/p54
 S:      Obsolete
 F:      drivers/net/wireless/intersil/prism54/
+PROC FILESYSTEM
+R:      Alexey Dobriyan <adobriyan@gmail.com>
+L:      linux-kernel@vger.kernel.org
+L:      linux-fsdevel@vger.kernel.org
+S:      Maintained
+F:      fs/proc/
+F:      include/linux/proc_fs.h
+F:      tools/testing/selftests/proc/
 PROC SYSCTL
 M:      "Luis R. Rodriguez" <mcgrof@kernel.org>
 M:      Kees Cook <keescook@chromium.org>
@@ -11808,9 +11822,9 @@ F:  Documentation/devicetree/bindings/opp/kryo-cpufreq.txt
 F:  drivers/cpufreq/qcom-cpufreq-kryo.c
 QUALCOMM EMAC GIGABIT ETHERNET DRIVER
-M:      Timur Tabi <timur@codeaurora.org>
+M:      Timur Tabi <timur@kernel.org>
 L:      netdev@vger.kernel.org
-S:      Supported
+S:      Maintained
 F:      drivers/net/ethernet/qualcomm/emac/
 QUALCOMM HEXAGON ARCHITECTURE
@@ -13648,7 +13662,7 @@ M:	Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
 L:      iommu@lists.linux-foundation.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb.git
 S:      Supported
-F:      lib/swiotlb.c
+F:      kernel/dma/swiotlb.c
 F:      arch/*/kernel/pci-swiotlb.c
 F:      include/linux/swiotlb.h
@@ -15572,9 +15586,17 @@ M:	x86@kernel.org
 L:      linux-kernel@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86/core
 S:      Maintained
+F:      Documentation/devicetree/bindings/x86/
 F:      Documentation/x86/
 F:      arch/x86/
+X86 ENTRY CODE
+M:      Andy Lutomirski <luto@kernel.org>
+L:      linux-kernel@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86/asm
+S:      Maintained
+F:      arch/x86/entry/
 X86 MCE INFRASTRUCTURE
 M:      Tony Luck <tony.luck@intel.com>
 M:      Borislav Petkov <bp@alien8.de>
@@ -15597,7 +15619,7 @@ F:	drivers/platform/x86/
 F:      drivers/platform/olpc/
 X86 VDSO
-M:      Andy Lutomirski <luto@amacapital.net>
+M:      Andy Lutomirski <luto@kernel.org>
 L:      linux-kernel@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86/vdso
 S:      Maintained
diff --git a/Makefile b/Makefile
index ca2af1ab91eb..c5ce55cbc543 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 18
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc3
 NAME = Merciless Moray
 # *DOCUMENTATION*
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 0c4805a572c8..04a4a138ed13 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -555,11 +555,6 @@ config SMP
          If you don't know what to do here, say N.
-config HAVE_DEC_LOCK
-        bool
-        depends on SMP
-        default y
 config NR_CPUS
        int "Maximum number of CPUs (2-32)"
        range 2 32
diff --git a/arch/alpha/lib/Makefile b/arch/alpha/lib/Makefile
index 04f9729de57c..854d5e79979e 100644
--- a/arch/alpha/lib/Makefile
+++ b/arch/alpha/lib/Makefile
@@ -35,8 +35,6 @@ lib-y =	__divqu.o __remqu.o __divlu.o __remlu.o \
        callback_srm.o srm_puts.o srm_printk.o \
        fls.o
-lib-$(CONFIG_SMP) += dec_and_lock.o
 # The division routines are built from single source, with different defines.
 AFLAGS___divqu.o = -DDIV
 AFLAGS___remqu.o =       -DREM
diff --git a/arch/alpha/lib/dec_and_lock.c b/arch/alpha/lib/dec_and_lock.c
deleted file mode 100644
index a117707f57fe..000000000000
--- a/arch/alpha/lib/dec_and_lock.c
+++ /dev/null
@@ -1,44 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * arch/alpha/lib/dec_and_lock.c
- *
- * ll/sc version of atomic_dec_and_lock()
- * 
- */
-#include <linux/spinlock.h>
-#include <linux/atomic.h>
-#include <linux/export.h>
-  asm (".text                                   \n\
-        .global _atomic_dec_and_lock            \n\
-        .ent _atomic_dec_and_lock               \n\
-        .align  4                               \n\
-_atomic_dec_and_lock:                           \n\
-        .prologue 0                             \n\
-1:      ldl_l   $1, 0($16)                      \n\
-        subl    $1, 1, $1                       \n\
-        beq     $1, 2f                          \n\
-        stl_c   $1, 0($16)                      \n\
-        beq     $1, 4f                          \n\
-        mb                                      \n\
-        clr     $0                              \n\
-        ret                                     \n\
-2:      br      $29, 3f                         \n\
-3:      ldgp    $29, 0($29)                     \n\
-        br      $atomic_dec_and_lock_1..ng      \n\
-        .subsection 2                           \n\
-4:      br      1b                              \n\
-        .previous                               \n\
-        .end _atomic_dec_and_lock");
-static int __used atomic_dec_and_lock_1(atomic_t *atomic, spinlock_t *lock)
-{
-        /* Slow path */
-        spin_lock(lock);
-        if (atomic_dec_and_test(atomic))
-                return 1;
-        spin_unlock(lock);
-        return 0;
-}
-EXPORT_SYMBOL(_atomic_dec_and_lock);
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 54eeb8d00bc6..843edfd000be 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1245,8 +1245,14 @@ config PCI
          VESA. If you have PCI, say Y, otherwise N.
 config PCI_DOMAINS
-        bool
+        bool "Support for multiple PCI domains"
        depends on PCI
+        help
+          Enable PCI domains kernel management. Say Y if your machine
+          has a PCI bus hierarchy that requires more than one PCI
+          domain (aka segment) to be correctly managed. Say N otherwise.
+          If you don't know what to do here, say N.
 config PCI_DOMAINS_GENERIC
        def_bool PCI_DOMAINS
diff --git a/arch/arm/boot/dts/armada-385-synology-ds116.dts b/arch/arm/boot/dts/armada-385-synology-ds116.dts
index 6782ce481ac9..d8769956cbfc 100644
--- a/arch/arm/boot/dts/armada-385-synology-ds116.dts
+++ b/arch/arm/boot/dts/armada-385-synology-ds116.dts
@@ -139,7 +139,7 @@
                                              3700 5
                                              3900 6
                                              4000 7>;
-                        cooling-cells = <2>;
+                        #cooling-cells = <2>;
                };
                gpio-leds {
diff --git a/arch/arm/boot/dts/bcm-cygnus.dtsi b/arch/arm/boot/dts/bcm-cygnus.dtsi
index 9fe4f5a6379e..2c4df2d2d4a6 100644
--- a/arch/arm/boot/dts/bcm-cygnus.dtsi
+++ b/arch/arm/boot/dts/bcm-cygnus.dtsi
@@ -216,7 +216,7 @@
                        reg = <0x18008000 0x100>;
                        #address-cells = <1>;
                        #size-cells = <0>;
-                        interrupts = <GIC_SPI 85 IRQ_TYPE_NONE>;
+                        interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
                        clock-frequency = <100000>;
                        status = "disabled";
                };
@@ -245,7 +245,7 @@
                        reg = <0x1800b000 0x100>;
                        #address-cells = <1>;
                        #size-cells = <0>;
-                        interrupts = <GIC_SPI 86 IRQ_TYPE_NONE>;
+                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
                        clock-frequency = <100000>;
                        status = "disabled";
                };
@@ -256,7 +256,7 @@
                        #interrupt-cells = <1>;
                        interrupt-map-mask = <0 0 0 0>;
-                        interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_NONE>;
+                        interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
                        linux,pci-domain = <0>;
@@ -278,10 +278,10 @@
                                compatible = "brcm,iproc-msi";
                                msi-controller;
                                interrupt-parent = <&gic>;
-                                interrupts = <GIC_SPI 96 IRQ_TYPE_NONE>,
+                                interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>,
-                                             <GIC_SPI 97 IRQ_TYPE_NONE>,
+                                             <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>,
-                                             <GIC_SPI 98 IRQ_TYPE_NONE>,
+                                             <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>,
-                                             <GIC_SPI 99 IRQ_TYPE_NONE>;
+                                             <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>;
                        };
                };
@@ -291,7 +291,7 @@
                        #interrupt-cells = <1>;
                        interrupt-map-mask = <0 0 0 0>;
-                        interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_NONE>;
+                        interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
                        linux,pci-domain = <1>;
@@ -313,10 +313,10 @@
                                compatible = "brcm,iproc-msi";
                                msi-controller;
                                interrupt-parent = <&gic>;
-                                interrupts = <GIC_SPI 102 IRQ_TYPE_NONE>,
+                                interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>,
-                                             <GIC_SPI 103 IRQ_TYPE_NONE>,
+                                             <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>,
-                                             <GIC_SPI 104 IRQ_TYPE_NONE>,
+                                             <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>,
-                                             <GIC_SPI 105 IRQ_TYPE_NONE>;
+                                             <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>;
                        };
                };
diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi
index 3f9cedd8011f..3084a7c95733 100644
--- a/arch/arm/boot/dts/bcm-hr2.dtsi
+++ b/arch/arm/boot/dts/bcm-hr2.dtsi
@@ -264,7 +264,7 @@
                        reg = <0x38000 0x50>;
                        #address-cells = <1>;
                        #size-cells = <0>;
-                        interrupts = <GIC_SPI 95 IRQ_TYPE_NONE>;
+                        interrupts = <GIC_SPI 95 IRQ_TYPE_LEVEL_HIGH>;
                        clock-frequency = <100000>;
                };
@@ -279,7 +279,7 @@
                        reg = <0x3b000 0x50>;
                        #address-cells = <1>;
                        #size-cells = <0>;
-                        interrupts = <GIC_SPI 96 IRQ_TYPE_NONE>;
+                        interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>;
                        clock-frequency = <100000>;
                };
        };
@@ -300,7 +300,7 @@
                #interrupt-cells = <1>;
                interrupt-map-mask = <0 0 0 0>;
-                interrupt-map = <0 0 0 0 &gic GIC_SPI 186 IRQ_TYPE_NONE>;
+                interrupt-map = <0 0 0 0 &gic GIC_SPI 186 IRQ_TYPE_LEVEL_HIGH>;
                linux,pci-domain = <0>;
@@ -322,10 +322,10 @@
                        compatible = "brcm,iproc-msi";
                        msi-controller;
                        interrupt-parent = <&gic>;
-                        interrupts = <GIC_SPI 182 IRQ_TYPE_NONE>,
+                        interrupts = <GIC_SPI 182 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 183 IRQ_TYPE_NONE>,
+                                     <GIC_SPI 183 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 184 IRQ_TYPE_NONE>,
+                                     <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 185 IRQ_TYPE_NONE>;
+                                     <GIC_SPI 185 IRQ_TYPE_LEVEL_HIGH>;
                        brcm,pcie-msi-inten;
                };
        };
@@ -336,7 +336,7 @@
                #interrupt-cells = <1>;
                interrupt-map-mask = <0 0 0 0>;
-                interrupt-map = <0 0 0 0 &gic GIC_SPI 192 IRQ_TYPE_NONE>;
+                interrupt-map = <0 0 0 0 &gic GIC_SPI 192 IRQ_TYPE_LEVEL_HIGH>;
                linux,pci-domain = <1>;
@@ -358,10 +358,10 @@
                        compatible = "brcm,iproc-msi";
                        msi-controller;
                        interrupt-parent = <&gic>;
-                        interrupts = <GIC_SPI 188 IRQ_TYPE_NONE>,
+                        interrupts = <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 189 IRQ_TYPE_NONE>,
+                                     <GIC_SPI 189 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 190 IRQ_TYPE_NONE>,
+                                     <GIC_SPI 190 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 191 IRQ_TYPE_NONE>;
+                                     <GIC_SPI 191 IRQ_TYPE_LEVEL_HIGH>;
                        brcm,pcie-msi-inten;
                };
        };
diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
index dcc55aa84583..09ba85046322 100644
--- a/arch/arm/boot/dts/bcm-nsp.dtsi
+++ b/arch/arm/boot/dts/bcm-nsp.dtsi
@@ -391,7 +391,7 @@
                        reg = <0x38000 0x50>;
                        #address-cells = <1>;
                        #size-cells = <0>;
-                        interrupts = <GIC_SPI 89 IRQ_TYPE_NONE>;
+                        interrupts = <GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>;
                        clock-frequency = <100000>;
                        dma-coherent;
                        status = "disabled";
@@ -496,7 +496,7 @@
                #interrupt-cells = <1>;
                interrupt-map-mask = <0 0 0 0>;
-                interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_NONE>;
+                interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
                linux,pci-domain = <0>;
@@ -519,10 +519,10 @@
                        compatible = "brcm,iproc-msi";
                        msi-controller;
                        interrupt-parent = <&gic>;
-                        interrupts = <GIC_SPI 127 IRQ_TYPE_NONE>,
+                        interrupts = <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 128 IRQ_TYPE_NONE>,
+                                     <GIC_SPI 128 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 129 IRQ_TYPE_NONE>,
+                                     <GIC_SPI 129 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 130 IRQ_TYPE_NONE>;
+                                     <GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>;
                        brcm,pcie-msi-inten;
                };
        };
@@ -533,7 +533,7 @@
                #interrupt-cells = <1>;
                interrupt-map-mask = <0 0 0 0>;
-                interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_NONE>;
+                interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
                linux,pci-domain = <1>;
@@ -556,10 +556,10 @@
                        compatible = "brcm,iproc-msi";
                        msi-controller;
                        interrupt-parent = <&gic>;
-                        interrupts = <GIC_SPI 133 IRQ_TYPE_NONE>,
+                        interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 134 IRQ_TYPE_NONE>,
+                                     <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 135 IRQ_TYPE_NONE>,
+                                     <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 136 IRQ_TYPE_NONE>;
+                                     <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
                        brcm,pcie-msi-inten;
                };
        };
@@ -570,7 +570,7 @@
                #interrupt-cells = <1>;
                interrupt-map-mask = <0 0 0 0>;
-                interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_NONE>;
+                interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
                linux,pci-domain = <2>;
@@ -593,10 +593,10 @@
                        compatible = "brcm,iproc-msi";
                        msi-controller;
                        interrupt-parent = <&gic>;
-                        interrupts = <GIC_SPI 139 IRQ_TYPE_NONE>,
+                        interrupts = <GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 140 IRQ_TYPE_NONE>,
+                                     <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 141 IRQ_TYPE_NONE>,
+                                     <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 142 IRQ_TYPE_NONE>;
+                                     <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>;
                        brcm,pcie-msi-inten;
                };
        };
diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
index 9a076c409f4e..ef995e50ee12 100644
--- a/arch/arm/boot/dts/bcm5301x.dtsi
+++ b/arch/arm/boot/dts/bcm5301x.dtsi
@@ -365,7 +365,7 @@
        i2c0: i2c@18009000 {
                compatible = "brcm,iproc-i2c";
                reg = <0x18009000 0x50>;
-                interrupts = <GIC_SPI 121 IRQ_TYPE_NONE>;
+                interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
                #address-cells = <1>;
                #size-cells = <0>;
                clock-frequency = <100000>;
diff --git a/arch/arm/boot/dts/da850.dtsi b/arch/arm/boot/dts/da850.dtsi
index f6f1597b03df..0f4f817a9e22 100644
--- a/arch/arm/boot/dts/da850.dtsi
+++ b/arch/arm/boot/dts/da850.dtsi
@@ -549,11 +549,7 @@
                        gpio-controller;
                        #gpio-cells = <2>;
                        reg = <0x226000 0x1000>;
-                        interrupts = <42 IRQ_TYPE_EDGE_BOTH
+                        interrupts = <42 43 44 45 46 47 48 49 50>;
-                                43 IRQ_TYPE_EDGE_BOTH 44 IRQ_TYPE_EDGE_BOTH
-                                45 IRQ_TYPE_EDGE_BOTH 46 IRQ_TYPE_EDGE_BOTH
-                                47 IRQ_TYPE_EDGE_BOTH 48 IRQ_TYPE_EDGE_BOTH
-                                49 IRQ_TYPE_EDGE_BOTH 50 IRQ_TYPE_EDGE_BOTH>;
                        ti,ngpio = <144>;
                        ti,davinci-gpio-unbanked = <0>;
                        status = "disabled";
diff --git a/arch/arm/boot/dts/imx6q.dtsi b/arch/arm/boot/dts/imx6q.dtsi
index 70483ce72ba6..77f8f030dd07 100644
--- a/arch/arm/boot/dts/imx6q.dtsi
+++ b/arch/arm/boot/dts/imx6q.dtsi
@@ -90,7 +90,7 @@
                                        clocks = <&clks IMX6Q_CLK_ECSPI5>,
                                                 <&clks IMX6Q_CLK_ECSPI5>;
                                        clock-names = "ipg", "per";
-                                        dmas = <&sdma 11 7 1>, <&sdma 12 7 2>;
+                                        dmas = <&sdma 11 8 1>, <&sdma 12 8 2>;
                                        dma-names = "rx", "tx";
                                        status = "disabled";
                                };
diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
index d8b94f47498b..4e4a55aad5c9 100644
--- a/arch/arm/boot/dts/imx6sx.dtsi
+++ b/arch/arm/boot/dts/imx6sx.dtsi
@@ -1344,7 +1344,7 @@
                        ranges = <0x81000000 0 0          0x08f80000 0 0x00010000 /* downstream I/O */
                                  0x82000000 0 0x08000000 0x08000000 0 0x00f00000>; /* non-prefetchable memory */
                        num-lanes = <1>;
-                        interrupts = <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
                        interrupt-names = "msi";
                        #interrupt-cells = <1>;
                        interrupt-map-mask = <0 0 0 0x7>;
diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi
index 486d4e7433ed..b38f8c240558 100644
--- a/arch/arm/boot/dts/socfpga.dtsi
+++ b/arch/arm/boot/dts/socfpga.dtsi
@@ -748,13 +748,13 @@
                nand0: nand@ff900000 {
                        #address-cells = <0x1>;
                        #size-cells = <0x1>;
-                        compatible = "denali,denali-nand-dt";
+                        compatible = "altr,socfpga-denali-nand";
                        reg = <0xff900000 0x100000>,
                              <0xffb80000 0x10000>;
                        reg-names = "nand_data", "denali_reg";
                        interrupts = <0x0 0x90 0x4>;
                        dma-mask = <0xffffffff>;
-                        clocks = <&nand_clk>;
+                        clocks = <&nand_x_clk>;
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi
index bead79e4b2aa..791ca15c799e 100644
--- a/arch/arm/boot/dts/socfpga_arria10.dtsi
+++ b/arch/arm/boot/dts/socfpga_arria10.dtsi
@@ -593,8 +593,7 @@
                        #size-cells = <0>;
                        reg = <0xffda5000 0x100>;
                        interrupts = <0 102 4>;
-                        num-chipselect = <4>;
+                        num-cs = <4>;
-                        bus-num = <0>;
                        /*32bit_access;*/
                        tx-dma-channel = <&pdma 16>;
                        rx-dma-channel = <&pdma 17>;
@@ -633,7 +632,7 @@
                nand: nand@ffb90000 {
                        #address-cells = <1>;
                        #size-cells = <1>;
-                        compatible = "denali,denali-nand-dt", "altr,socfpga-denali-nand";
+                        compatible = "altr,socfpga-denali-nand";
                        reg = <0xffb90000 0x72000>,
                              <0xffb80000 0x10000>;
                        reg-names = "nand_data", "denali_reg";
diff --git a/arch/arm/common/Makefile b/arch/arm/common/Makefile
index 1e9f7af8f70f..3157be413297 100644
--- a/arch/arm/common/Makefile
+++ b/arch/arm/common/Makefile
@@ -10,7 +10,7 @@ obj-$(CONFIG_DMABOUNCE)		+= dmabounce.o
 obj-$(CONFIG_SHARP_LOCOMO)      += locomo.o
 obj-$(CONFIG_SHARP_PARAM)       += sharpsl_param.o
 obj-$(CONFIG_SHARP_SCOOP)       += scoop.o
-obj-$(CONFIG_SMP)               += secure_cntvoff.o
+obj-$(CONFIG_CPU_V7)            += secure_cntvoff.o
 obj-$(CONFIG_PCI_HOST_ITE8152)  += it8152.o
 obj-$(CONFIG_MCPM)              += mcpm_head.o mcpm_entry.o mcpm_platsmp.o vlock.o
 CFLAGS_REMOVE_mcpm_entry.o      = -pg
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 7e1c543162c3..8f6be1982545 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -1,5 +1,4 @@
 CONFIG_SYSVIPC=y
-CONFIG_FHANDLE=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_CGROUPS=y
@@ -10,20 +9,10 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_CMDLINE_PARTITION=y
-CONFIG_ARCH_MULTI_V7=y
-# CONFIG_ARCH_MULTI_V5 is not set
-# CONFIG_ARCH_MULTI_V4 is not set
 CONFIG_ARCH_VIRT=y
 CONFIG_ARCH_ALPINE=y
 CONFIG_ARCH_ARTPEC=y
 CONFIG_MACH_ARTPEC6=y
-CONFIG_ARCH_MVEBU=y
-CONFIG_MACH_ARMADA_370=y
-CONFIG_MACH_ARMADA_375=y
-CONFIG_MACH_ARMADA_38X=y
-CONFIG_MACH_ARMADA_39X=y
-CONFIG_MACH_ARMADA_XP=y
-CONFIG_MACH_DOVE=y
 CONFIG_ARCH_AT91=y
 CONFIG_SOC_SAMA5D2=y
 CONFIG_SOC_SAMA5D3=y
@@ -32,9 +21,9 @@ CONFIG_ARCH_BCM=y
 CONFIG_ARCH_BCM_CYGNUS=y
 CONFIG_ARCH_BCM_HR2=y
 CONFIG_ARCH_BCM_NSP=y
-CONFIG_ARCH_BCM_21664=y
-CONFIG_ARCH_BCM_281XX=y
 CONFIG_ARCH_BCM_5301X=y
+CONFIG_ARCH_BCM_281XX=y
+CONFIG_ARCH_BCM_21664=y
 CONFIG_ARCH_BCM2835=y
 CONFIG_ARCH_BCM_63XX=y
 CONFIG_ARCH_BRCMSTB=y
@@ -43,14 +32,14 @@ CONFIG_MACH_BERLIN_BG2=y
 CONFIG_MACH_BERLIN_BG2CD=y
 CONFIG_MACH_BERLIN_BG2Q=y
 CONFIG_ARCH_DIGICOLOR=y
+CONFIG_ARCH_EXYNOS=y
+CONFIG_EXYNOS5420_MCPM=y
 CONFIG_ARCH_HIGHBANK=y
 CONFIG_ARCH_HISI=y
 CONFIG_ARCH_HI3xxx=y
-CONFIG_ARCH_HIX5HD2=y
 CONFIG_ARCH_HIP01=y
 CONFIG_ARCH_HIP04=y
-CONFIG_ARCH_KEYSTONE=y
+CONFIG_ARCH_HIX5HD2=y
-CONFIG_ARCH_MESON=y
 CONFIG_ARCH_MXC=y
 CONFIG_SOC_IMX50=y
 CONFIG_SOC_IMX51=y
@@ -60,29 +49,30 @@ CONFIG_SOC_IMX6SL=y
 CONFIG_SOC_IMX6SX=y
 CONFIG_SOC_IMX6UL=y
 CONFIG_SOC_IMX7D=y
-CONFIG_SOC_VF610=y
 CONFIG_SOC_LS1021A=y
+CONFIG_SOC_VF610=y
+CONFIG_ARCH_KEYSTONE=y
+CONFIG_ARCH_MEDIATEK=y
+CONFIG_ARCH_MESON=y
+CONFIG_ARCH_MVEBU=y
+CONFIG_MACH_ARMADA_370=y
+CONFIG_MACH_ARMADA_375=y
+CONFIG_MACH_ARMADA_38X=y
+CONFIG_MACH_ARMADA_39X=y
+CONFIG_MACH_ARMADA_XP=y
+CONFIG_MACH_DOVE=y
 CONFIG_ARCH_OMAP3=y
 CONFIG_ARCH_OMAP4=y
 CONFIG_SOC_OMAP5=y
 CONFIG_SOC_AM33XX=y
 CONFIG_SOC_AM43XX=y
 CONFIG_SOC_DRA7XX=y
+CONFIG_ARCH_SIRF=y
 CONFIG_ARCH_QCOM=y
-CONFIG_ARCH_MEDIATEK=y
 CONFIG_ARCH_MSM8X60=y
 CONFIG_ARCH_MSM8960=y
 CONFIG_ARCH_MSM8974=y
 CONFIG_ARCH_ROCKCHIP=y
-CONFIG_ARCH_SOCFPGA=y
-CONFIG_PLAT_SPEAR=y
-CONFIG_ARCH_SPEAR13XX=y
-CONFIG_MACH_SPEAR1310=y
-CONFIG_MACH_SPEAR1340=y
-CONFIG_ARCH_STI=y
-CONFIG_ARCH_STM32=y
-CONFIG_ARCH_EXYNOS=y
-CONFIG_EXYNOS5420_MCPM=y
 CONFIG_ARCH_RENESAS=y
 CONFIG_ARCH_EMEV2=y
 CONFIG_ARCH_R7S72100=y
@@ -99,40 +89,33 @@ CONFIG_ARCH_R8A7792=y
 CONFIG_ARCH_R8A7793=y
 CONFIG_ARCH_R8A7794=y
 CONFIG_ARCH_SH73A0=y
+CONFIG_ARCH_SOCFPGA=y
+CONFIG_PLAT_SPEAR=y
+CONFIG_ARCH_SPEAR13XX=y
+CONFIG_MACH_SPEAR1310=y
+CONFIG_MACH_SPEAR1340=y
+CONFIG_ARCH_STI=y
+CONFIG_ARCH_STM32=y
 CONFIG_ARCH_SUNXI=y
-CONFIG_ARCH_SIRF=y
 CONFIG_ARCH_TEGRA=y
-CONFIG_ARCH_TEGRA_2x_SOC=y
-CONFIG_ARCH_TEGRA_3x_SOC=y
-CONFIG_ARCH_TEGRA_114_SOC=y
-CONFIG_ARCH_TEGRA_124_SOC=y
 CONFIG_ARCH_UNIPHIER=y
 CONFIG_ARCH_U8500=y
-CONFIG_MACH_HREFV60=y
-CONFIG_MACH_SNOWBALL=y
 CONFIG_ARCH_VEXPRESS=y
 CONFIG_ARCH_VEXPRESS_TC2_PM=y
 CONFIG_ARCH_WM8850=y
 CONFIG_ARCH_ZYNQ=y
-CONFIG_TRUSTED_FOUNDATIONS=y
+CONFIG_PCIEPORTBUS=y
-CONFIG_PCI=y
-CONFIG_PCI_HOST_GENERIC=y
-CONFIG_PCI_DRA7XX=y
-CONFIG_PCI_DRA7XX_EP=y
-CONFIG_PCI_KEYSTONE=y
-CONFIG_PCI_MSI=y
 CONFIG_PCI_MVEBU=y
 CONFIG_PCI_TEGRA=y
 CONFIG_PCI_RCAR_GEN2=y
 CONFIG_PCIE_RCAR=y
-CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_DRA7XX_EP=y
+CONFIG_PCI_KEYSTONE=y
 CONFIG_PCI_ENDPOINT=y
 CONFIG_PCI_ENDPOINT_CONFIGFS=y
 CONFIG_PCI_EPF_TEST=m
 CONFIG_SMP=y
 CONFIG_NR_CPUS=16
-CONFIG_HIGHPTE=y
-CONFIG_CMA=y
 CONFIG_SECCOMP=y
 CONFIG_ARM_APPENDED_DTB=y
 CONFIG_ARM_ATAG_DTB_COMPAT=y
@@ -145,14 +128,14 @@ CONFIG_CPU_FREQ_GOV_POWERSAVE=m
 CONFIG_CPU_FREQ_GOV_USERSPACE=m
 CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
 CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPUFREQ_DT=y
 CONFIG_ARM_IMX6Q_CPUFREQ=y
 CONFIG_QORIQ_CPUFREQ=y
 CONFIG_CPU_IDLE=y
 CONFIG_ARM_CPUIDLE=y
-CONFIG_NEON=y
-CONFIG_KERNEL_MODE_NEON=y
 CONFIG_ARM_ZYNQ_CPUIDLE=y
 CONFIG_ARM_EXYNOS_CPUIDLE=y
+CONFIG_KERNEL_MODE_NEON=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
@@ -170,23 +153,13 @@ CONFIG_IPV6_MIP6=m
 CONFIG_IPV6_TUNNEL=m
 CONFIG_IPV6_MULTIPLE_TABLES=y
 CONFIG_NET_DSA=m
-CONFIG_NET_SWITCHDEV=y
 CONFIG_CAN=y
-CONFIG_CAN_RAW=y
-CONFIG_CAN_BCM=y
-CONFIG_CAN_DEV=y
 CONFIG_CAN_AT91=m
 CONFIG_CAN_FLEXCAN=m
-CONFIG_CAN_RCAR=m
+CONFIG_CAN_SUN4I=y
 CONFIG_CAN_XILINXCAN=y
+CONFIG_CAN_RCAR=m
 CONFIG_CAN_MCP251X=y
-CONFIG_NET_DSA_BCM_SF2=m
-CONFIG_B53=m
-CONFIG_B53_SPI_DRIVER=m
-CONFIG_B53_MDIO_DRIVER=m
-CONFIG_B53_MMAP_DRIVER=m
-CONFIG_B53_SRAB_DRIVER=m
-CONFIG_CAN_SUN4I=y
 CONFIG_BT=m
 CONFIG_BT_HCIUART=m
 CONFIG_BT_HCIUART_BCM=y
@@ -199,11 +172,9 @@ CONFIG_RFKILL_INPUT=y
 CONFIG_RFKILL_GPIO=y
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
-CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=64
 CONFIG_OMAP_OCP2SCP=y
 CONFIG_SIMPLE_PM_BUS=y
-CONFIG_SUNXI_RSB=y
 CONFIG_MTD=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_BLOCK=y
@@ -236,7 +207,6 @@ CONFIG_PCI_ENDPOINT_TEST=m
 CONFIG_EEPROM_AT24=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_DEV_SR=y
-CONFIG_SCSI_MULTI_LUN=y
 CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
 CONFIG_SATA_AHCI_PLATFORM=y
@@ -251,14 +221,20 @@ CONFIG_SATA_MV=y
 CONFIG_SATA_RCAR=y
 CONFIG_NETDEVICES=y
 CONFIG_VIRTIO_NET=y
-CONFIG_HIX5HD2_GMAC=y
+CONFIG_B53_SPI_DRIVER=m
+CONFIG_B53_MDIO_DRIVER=m
+CONFIG_B53_MMAP_DRIVER=m
+CONFIG_B53_SRAB_DRIVER=m
+CONFIG_NET_DSA_BCM_SF2=m
 CONFIG_SUN4I_EMAC=y
-CONFIG_MACB=y
 CONFIG_BCMGENET=m
 CONFIG_BGMAC_BCMA=y
 CONFIG_SYSTEMPORT=m
+CONFIG_MACB=y
 CONFIG_NET_CALXEDA_XGMAC=y
 CONFIG_GIANFAR=y
+CONFIG_HIX5HD2_GMAC=y
+CONFIG_E1000E=y
 CONFIG_IGB=y
 CONFIG_MV643XX_ETH=y
 CONFIG_MVNETA=y
@@ -268,19 +244,17 @@ CONFIG_R8169=y
 CONFIG_SH_ETH=y
 CONFIG_SMSC911X=y
 CONFIG_STMMAC_ETH=y
-CONFIG_STMMAC_PLATFORM=y
 CONFIG_DWMAC_DWC_QOS_ETH=y
 CONFIG_TI_CPSW=y
 CONFIG_XILINX_EMACLITE=y
 CONFIG_AT803X_PHY=y
-CONFIG_MARVELL_PHY=y
-CONFIG_SMSC_PHY=y
 CONFIG_BROADCOM_PHY=y
 CONFIG_ICPLUS_PHY=y
-CONFIG_REALTEK_PHY=y
+CONFIG_MARVELL_PHY=y
 CONFIG_MICREL_PHY=y
-CONFIG_FIXED_PHY=y
+CONFIG_REALTEK_PHY=y
 CONFIG_ROCKCHIP_PHY=y
+CONFIG_SMSC_PHY=y
 CONFIG_USB_PEGASUS=y
 CONFIG_USB_RTL8152=m
 CONFIG_USB_LAN78XX=m
@@ -288,29 +262,29 @@ CONFIG_USB_USBNET=y
 CONFIG_USB_NET_SMSC75XX=y
 CONFIG_USB_NET_SMSC95XX=y
 CONFIG_BRCMFMAC=m
-CONFIG_RT2X00=m
-CONFIG_RT2800USB=m
 CONFIG_MWIFIEX=m
 CONFIG_MWIFIEX_SDIO=m
+CONFIG_RT2X00=m
+CONFIG_RT2800USB=m
 CONFIG_INPUT_JOYDEV=y
 CONFIG_INPUT_EVDEV=y
 CONFIG_KEYBOARD_QT1070=m
 CONFIG_KEYBOARD_GPIO=y
 CONFIG_KEYBOARD_TEGRA=y
-CONFIG_KEYBOARD_SPEAR=y
+CONFIG_KEYBOARD_SAMSUNG=m
 CONFIG_KEYBOARD_ST_KEYSCAN=y
+CONFIG_KEYBOARD_SPEAR=y
 CONFIG_KEYBOARD_CROS_EC=m
-CONFIG_KEYBOARD_SAMSUNG=m
 CONFIG_MOUSE_PS2_ELANTECH=y
 CONFIG_MOUSE_CYAPA=m
 CONFIG_MOUSE_ELAN_I2C=y
 CONFIG_INPUT_TOUCHSCREEN=y
 CONFIG_TOUCHSCREEN_ATMEL_MXT=m
 CONFIG_TOUCHSCREEN_MMS114=m
+CONFIG_TOUCHSCREEN_WM97XX=m
 CONFIG_TOUCHSCREEN_ST1232=m
 CONFIG_TOUCHSCREEN_STMPE=y
 CONFIG_TOUCHSCREEN_SUN4I=y
-CONFIG_TOUCHSCREEN_WM97XX=m
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_MAX77693_HAPTIC=m
 CONFIG_INPUT_MAX8997_HAPTIC=m
@@ -327,13 +301,12 @@ CONFIG_SERIAL_8250_DW=y
 CONFIG_SERIAL_8250_EM=y
 CONFIG_SERIAL_8250_MT6577=y
 CONFIG_SERIAL_8250_UNIPHIER=y
+CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_ATMEL=y
 CONFIG_SERIAL_ATMEL_CONSOLE=y
 CONFIG_SERIAL_ATMEL_TTYAT=y
-CONFIG_SERIAL_BCM63XX=y
-CONFIG_SERIAL_BCM63XX_CONSOLE=y
 CONFIG_SERIAL_MESON=y
 CONFIG_SERIAL_MESON_CONSOLE=y
 CONFIG_SERIAL_SAMSUNG=y
@@ -345,15 +318,14 @@ CONFIG_SERIAL_IMX=y
 CONFIG_SERIAL_IMX_CONSOLE=y
 CONFIG_SERIAL_SH_SCI=y
 CONFIG_SERIAL_SH_SCI_NR_UARTS=20
-CONFIG_SERIAL_SH_SCI_CONSOLE=y
-CONFIG_SERIAL_SH_SCI_DMA=y
 CONFIG_SERIAL_MSM=y
 CONFIG_SERIAL_MSM_CONSOLE=y
 CONFIG_SERIAL_VT8500=y
 CONFIG_SERIAL_VT8500_CONSOLE=y
-CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_SERIAL_OMAP=y
 CONFIG_SERIAL_OMAP_CONSOLE=y
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
 CONFIG_SERIAL_XILINX_PS_UART=y
 CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
 CONFIG_SERIAL_FSL_LPUART=y
@@ -365,12 +337,10 @@ CONFIG_SERIAL_ST_ASC_CONSOLE=y
 CONFIG_SERIAL_STM32=y
 CONFIG_SERIAL_STM32_CONSOLE=y
 CONFIG_SERIAL_DEV_BUS=y
-CONFIG_HVC_DRIVER=y
 CONFIG_VIRTIO_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_ST=y
 CONFIG_I2C_CHARDEV=y
-CONFIG_I2C_DAVINCI=y
-CONFIG_I2C_MESON=y
-CONFIG_I2C_MUX=y
 CONFIG_I2C_ARB_GPIO_CHALLENGE=m
 CONFIG_I2C_MUX_PCA954x=y
 CONFIG_I2C_MUX_PINCTRL=y
@@ -378,12 +348,13 @@ CONFIG_I2C_DEMUX_PINCTRL=y
 CONFIG_I2C_AT91=m
 CONFIG_I2C_BCM2835=y
 CONFIG_I2C_CADENCE=y
+CONFIG_I2C_DAVINCI=y
 CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_I2C_DIGICOLOR=m
 CONFIG_I2C_EMEV2=m
 CONFIG_I2C_GPIO=m
-CONFIG_I2C_EXYNOS5=y
 CONFIG_I2C_IMX=y
+CONFIG_I2C_MESON=y
 CONFIG_I2C_MV64XXX=y
 CONFIG_I2C_RIIC=y
 CONFIG_I2C_RK3X=y
@@ -427,7 +398,6 @@ CONFIG_SPI_SPIDEV=y
 CONFIG_SPMI=y
 CONFIG_PINCTRL_AS3722=y
 CONFIG_PINCTRL_PALMAS=y
-CONFIG_PINCTRL_BCM2835=y
 CONFIG_PINCTRL_APQ8064=y
 CONFIG_PINCTRL_APQ8084=y
 CONFIG_PINCTRL_IPQ8064=y
@@ -437,25 +407,33 @@ CONFIG_PINCTRL_MSM8X74=y
 CONFIG_PINCTRL_MSM8916=y
 CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
 CONFIG_PINCTRL_QCOM_SSBI_PMIC=y
-CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_DAVINCI=y
 CONFIG_GPIO_DWAPB=y
 CONFIG_GPIO_EM=y
 CONFIG_GPIO_RCAR=y
+CONFIG_GPIO_SYSCON=y
 CONFIG_GPIO_UNIPHIER=y
 CONFIG_GPIO_XILINX=y
 CONFIG_GPIO_ZYNQ=y
 CONFIG_GPIO_PCA953X=y
 CONFIG_GPIO_PCA953X_IRQ=y
 CONFIG_GPIO_PCF857X=y
-CONFIG_GPIO_TWL4030=y
 CONFIG_GPIO_PALMAS=y
-CONFIG_GPIO_SYSCON=y
 CONFIG_GPIO_TPS6586X=y
 CONFIG_GPIO_TPS65910=y
+CONFIG_GPIO_TWL4030=y
+CONFIG_POWER_AVS=y
+CONFIG_ROCKCHIP_IODOMAIN=y
+CONFIG_POWER_RESET_AS3722=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_POWER_RESET_GPIO_RESTART=y
+CONFIG_POWER_RESET_ST=y
+CONFIG_POWER_RESET_KEYSTONE=y
+CONFIG_POWER_RESET_RMOBILE=y
 CONFIG_BATTERY_ACT8945A=y
 CONFIG_BATTERY_CPCAP=m
 CONFIG_BATTERY_SBS=y
+CONFIG_AXP20X_POWER=m
 CONFIG_BATTERY_MAX17040=m
 CONFIG_BATTERY_MAX17042=m
 CONFIG_CHARGER_CPCAP=m
@@ -464,15 +442,6 @@ CONFIG_CHARGER_MAX77693=m
 CONFIG_CHARGER_MAX8997=m
 CONFIG_CHARGER_MAX8998=m
 CONFIG_CHARGER_TPS65090=y
-CONFIG_AXP20X_POWER=m
-CONFIG_POWER_RESET_AS3722=y
-CONFIG_POWER_RESET_GPIO=y
-CONFIG_POWER_RESET_GPIO_RESTART=y
-CONFIG_POWER_RESET_KEYSTONE=y
-CONFIG_POWER_RESET_RMOBILE=y
-CONFIG_POWER_RESET_ST=y
-CONFIG_POWER_AVS=y
-CONFIG_ROCKCHIP_IODOMAIN=y
 CONFIG_SENSORS_IIO_HWMON=y
 CONFIG_SENSORS_LM90=y
 CONFIG_SENSORS_LM95245=y
@@ -480,14 +449,12 @@ CONFIG_SENSORS_NTC_THERMISTOR=m
 CONFIG_SENSORS_PWM_FAN=m
 CONFIG_SENSORS_INA2XX=m
 CONFIG_CPU_THERMAL=y
-CONFIG_BCM2835_THERMAL=m
-CONFIG_BRCMSTB_THERMAL=m
 CONFIG_IMX_THERMAL=y
 CONFIG_ROCKCHIP_THERMAL=y
 CONFIG_RCAR_THERMAL=y
 CONFIG_ARMADA_THERMAL=y
-CONFIG_DAVINCI_WATCHDOG=m
+CONFIG_BCM2835_THERMAL=m
-CONFIG_EXYNOS_THERMAL=m
+CONFIG_BRCMSTB_THERMAL=m
 CONFIG_ST_THERMAL_MEMMAP=y
 CONFIG_WATCHDOG=y
 CONFIG_DA9063_WATCHDOG=m
@@ -495,20 +462,24 @@ CONFIG_XILINX_WATCHDOG=y
 CONFIG_ARM_SP805_WATCHDOG=y
 CONFIG_AT91SAM9X_WATCHDOG=y
 CONFIG_SAMA5D4_WATCHDOG=y
+CONFIG_DW_WATCHDOG=y
+CONFIG_DAVINCI_WATCHDOG=m
 CONFIG_ORION_WATCHDOG=y
 CONFIG_RN5T618_WATCHDOG=y
-CONFIG_ST_LPC_WATCHDOG=y
 CONFIG_SUNXI_WATCHDOG=y
 CONFIG_IMX2_WDT=y
+CONFIG_ST_LPC_WATCHDOG=y
 CONFIG_TEGRA_WATCHDOG=m
 CONFIG_MESON_WATCHDOG=y
-CONFIG_DW_WATCHDOG=y
 CONFIG_DIGICOLOR_WATCHDOG=y
 CONFIG_RENESAS_WDT=m
-CONFIG_BCM2835_WDT=y
 CONFIG_BCM47XX_WDT=y
-CONFIG_BCM7038_WDT=m
+CONFIG_BCM2835_WDT=y
 CONFIG_BCM_KONA_WDT=y
+CONFIG_BCM7038_WDT=m
+CONFIG_BCMA_HOST_SOC=y
+CONFIG_BCMA_DRIVER_GMAC_CMN=y
+CONFIG_BCMA_DRIVER_GPIO=y
 CONFIG_MFD_ACT8945A=y
 CONFIG_MFD_AS3711=y
 CONFIG_MFD_AS3722=y
@@ -516,7 +487,6 @@ CONFIG_MFD_ATMEL_FLEXCOM=y
 CONFIG_MFD_ATMEL_HLCDC=m
 CONFIG_MFD_BCM590XX=y
 CONFIG_MFD_AC100=y
-CONFIG_MFD_AXP20X=y
 CONFIG_MFD_AXP20X_I2C=y
 CONFIG_MFD_AXP20X_RSB=y
 CONFIG_MFD_CROS_EC=m
@@ -529,11 +499,11 @@ CONFIG_MFD_MAX77693=m
 CONFIG_MFD_MAX8907=y
 CONFIG_MFD_MAX8997=y
 CONFIG_MFD_MAX8998=y
-CONFIG_MFD_RK808=y
 CONFIG_MFD_CPCAP=y
 CONFIG_MFD_PM8XXX=y
 CONFIG_MFD_QCOM_RPM=y
 CONFIG_MFD_SPMI_PMIC=y
+CONFIG_MFD_RK808=y
 CONFIG_MFD_RN5T618=y
 CONFIG_MFD_SEC_CORE=y
 CONFIG_MFD_STMPE=y
@@ -543,10 +513,10 @@ CONFIG_MFD_TPS65217=y
 CONFIG_MFD_TPS65218=y
 CONFIG_MFD_TPS6586X=y
 CONFIG_MFD_TPS65910=y
-CONFIG_REGULATOR_ACT8945A=y
-CONFIG_REGULATOR_AB8500=y
 CONFIG_REGULATOR_ACT8865=y
+CONFIG_REGULATOR_ACT8945A=y
 CONFIG_REGULATOR_ANATOP=y
+CONFIG_REGULATOR_AB8500=y
 CONFIG_REGULATOR_AS3711=y
 CONFIG_REGULATOR_AS3722=y
 CONFIG_REGULATOR_AXP20X=y
@@ -554,10 +524,7 @@ CONFIG_REGULATOR_BCM590XX=y
 CONFIG_REGULATOR_CPCAP=y
 CONFIG_REGULATOR_DA9210=y
 CONFIG_REGULATOR_FAN53555=y
-CONFIG_REGULATOR_RK808=y
 CONFIG_REGULATOR_GPIO=y
-CONFIG_MFD_SYSCON=y
-CONFIG_POWER_RESET_SYSCON=y
 CONFIG_REGULATOR_LP872X=y
 CONFIG_REGULATOR_MAX14577=m
 CONFIG_REGULATOR_MAX8907=y
@@ -571,7 +538,8 @@ CONFIG_REGULATOR_PALMAS=y
 CONFIG_REGULATOR_PBIAS=y
 CONFIG_REGULATOR_PWM=y
 CONFIG_REGULATOR_QCOM_RPM=y
-CONFIG_REGULATOR_QCOM_SMD_RPM=y
+CONFIG_REGULATOR_QCOM_SMD_RPM=m
+CONFIG_REGULATOR_RK808=y
 CONFIG_REGULATOR_RN5T618=y
 CONFIG_REGULATOR_S2MPS11=y
 CONFIG_REGULATOR_S5M8767=y
@@ -592,18 +560,17 @@ CONFIG_MEDIA_CEC_SUPPORT=y
 CONFIG_MEDIA_CONTROLLER=y
 CONFIG_VIDEO_V4L2_SUBDEV_API=y
 CONFIG_MEDIA_USB_SUPPORT=y
-CONFIG_USB_VIDEO_CLASS=y
+CONFIG_USB_VIDEO_CLASS=m
-CONFIG_USB_GSPCA=y
 CONFIG_V4L_PLATFORM_DRIVERS=y
 CONFIG_SOC_CAMERA=m
 CONFIG_SOC_CAMERA_PLATFORM=m
-CONFIG_VIDEO_RCAR_VIN=m
-CONFIG_VIDEO_ATMEL_ISI=m
 CONFIG_VIDEO_SAMSUNG_EXYNOS4_IS=m
 CONFIG_VIDEO_S5P_FIMC=m
 CONFIG_VIDEO_S5P_MIPI_CSIS=m
 CONFIG_VIDEO_EXYNOS_FIMC_LITE=m
 CONFIG_VIDEO_EXYNOS4_FIMC_IS=m
+CONFIG_VIDEO_RCAR_VIN=m
+CONFIG_VIDEO_ATMEL_ISI=m
 CONFIG_V4L_MEM2MEM_DRIVERS=y
 CONFIG_VIDEO_SAMSUNG_S5P_JPEG=m
 CONFIG_VIDEO_SAMSUNG_S5P_MFC=m
@@ -614,19 +581,15 @@ CONFIG_VIDEO_STI_DELTA=m
 CONFIG_VIDEO_RENESAS_JPU=m
 CONFIG_VIDEO_RENESAS_VSP1=m
 CONFIG_V4L_TEST_DRIVERS=y
+CONFIG_VIDEO_VIVID=m
 CONFIG_CEC_PLATFORM_DRIVERS=y
 CONFIG_VIDEO_SAMSUNG_S5P_CEC=m
 # CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
 CONFIG_VIDEO_ADV7180=m
 CONFIG_VIDEO_ML86V7667=m
 CONFIG_DRM=y
-CONFIG_DRM_I2C_ADV7511=m
-CONFIG_DRM_I2C_ADV7511_AUDIO=y
 # CONFIG_DRM_I2C_CH7006 is not set
 # CONFIG_DRM_I2C_SIL164 is not set
-CONFIG_DRM_DUMB_VGA_DAC=m
-CONFIG_DRM_NXP_PTN3460=m
-CONFIG_DRM_PARADE_PS8622=m
 CONFIG_DRM_NOUVEAU=m
 CONFIG_DRM_EXYNOS=m
 CONFIG_DRM_EXYNOS_FIMD=y
@@ -645,13 +608,18 @@ CONFIG_DRM_RCAR_LVDS=y
 CONFIG_DRM_SUN4I=m
 CONFIG_DRM_FSL_DCU=m
 CONFIG_DRM_TEGRA=y
+CONFIG_DRM_PANEL_SIMPLE=y
 CONFIG_DRM_PANEL_SAMSUNG_LD9040=m
 CONFIG_DRM_PANEL_SAMSUNG_S6E63J0X03=m
 CONFIG_DRM_PANEL_SAMSUNG_S6E8AA0=m
-CONFIG_DRM_PANEL_SIMPLE=y
+CONFIG_DRM_DUMB_VGA_DAC=m
+CONFIG_DRM_NXP_PTN3460=m
+CONFIG_DRM_PARADE_PS8622=m
 CONFIG_DRM_SII9234=m
+CONFIG_DRM_I2C_ADV7511=m
+CONFIG_DRM_I2C_ADV7511_AUDIO=y
 CONFIG_DRM_STI=m
-CONFIG_DRM_VC4=y
+CONFIG_DRM_VC4=m
 CONFIG_DRM_ETNAVIV=m
 CONFIG_DRM_MXSFB=m
 CONFIG_FB_ARMCLCD=y
@@ -659,8 +627,6 @@ CONFIG_FB_EFI=y
 CONFIG_FB_WM8505=y
 CONFIG_FB_SH_MOBILE_LCDC=y
 CONFIG_FB_SIMPLE=y
-CONFIG_BACKLIGHT_LCD_SUPPORT=y
-CONFIG_BACKLIGHT_CLASS_DEVICE=y
 CONFIG_LCD_PLATFORM=m
 CONFIG_BACKLIGHT_PWM=y
 CONFIG_BACKLIGHT_AS3711=y
@@ -668,7 +634,6 @@ CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
 CONFIG_SOUND=m
 CONFIG_SND=m
-CONFIG_SND_DYNAMIC_MINORS=y
 CONFIG_SND_HDA_TEGRA=m
 CONFIG_SND_HDA_INPUT_BEEP=y
 CONFIG_SND_HDA_PATCH_LOADER=y
@@ -692,7 +657,7 @@ CONFIG_SND_SOC_SNOW=m
 CONFIG_SND_SOC_ODROID=m
 CONFIG_SND_SOC_SH4_FSI=m
 CONFIG_SND_SOC_RCAR=m
-CONFIG_SND_SIMPLE_SCU_CARD=m
+CONFIG_SND_SOC_STI=m
 CONFIG_SND_SUN4I_CODEC=m
 CONFIG_SND_SOC_TEGRA=m
 CONFIG_SND_SOC_TEGRA20_I2S=m
@@ -703,31 +668,25 @@ CONFIG_SND_SOC_TEGRA_WM8903=m
 CONFIG_SND_SOC_TEGRA_WM9712=m
 CONFIG_SND_SOC_TEGRA_TRIMSLICE=m
 CONFIG_SND_SOC_TEGRA_ALC5632=m
-CONFIG_SND_SOC_CPCAP=m
 CONFIG_SND_SOC_TEGRA_MAX98090=m
 CONFIG_SND_SOC_AK4642=m
+CONFIG_SND_SOC_CPCAP=m
 CONFIG_SND_SOC_SGTL5000=m
 CONFIG_SND_SOC_SPDIF=m
-CONFIG_SND_SOC_WM8978=m
-CONFIG_SND_SOC_STI=m
 CONFIG_SND_SOC_STI_SAS=m
-CONFIG_SND_SIMPLE_CARD=m
+CONFIG_SND_SOC_WM8978=m
+CONFIG_SND_SIMPLE_SCU_CARD=m
 CONFIG_USB=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_XHCI_MVEBU=y
-CONFIG_USB_XHCI_RCAR=m
 CONFIG_USB_XHCI_TEGRA=m
 CONFIG_USB_EHCI_HCD=y
-CONFIG_USB_EHCI_MSM=m
-CONFIG_USB_EHCI_EXYNOS=y
-CONFIG_USB_EHCI_TEGRA=y
 CONFIG_USB_EHCI_HCD_STI=y
-CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_EHCI_TEGRA=y
-CONFIG_USB_ISP1760=y
+CONFIG_USB_EHCI_EXYNOS=y
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_OHCI_HCD_STI=y
-CONFIG_USB_OHCI_HCD_PLATFORM=y
 CONFIG_USB_OHCI_EXYNOS=m
 CONFIG_USB_R8A66597_HCD=m
 CONFIG_USB_RENESAS_USBHS=m
@@ -746,18 +705,18 @@ CONFIG_USB_TI_CPPI41_DMA=y
 CONFIG_USB_TUSB_OMAP_DMA=y
 CONFIG_USB_DWC3=y
 CONFIG_USB_DWC2=y
-CONFIG_USB_HSIC_USB3503=y
 CONFIG_USB_CHIPIDEA=y
 CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
+CONFIG_USB_ISP1760=y
+CONFIG_USB_HSIC_USB3503=y
 CONFIG_AB8500_USB=y
-CONFIG_KEYSTONE_USB_PHY=y
+CONFIG_KEYSTONE_USB_PHY=m
 CONFIG_NOP_USB_XCEIV=m
 CONFIG_AM335X_PHY_USB=m
 CONFIG_TWL6030_USB=m
 CONFIG_USB_GPIO_VBUS=y
 CONFIG_USB_ISP1301=y
-CONFIG_USB_MSM_OTG=m
 CONFIG_USB_MXS_PHY=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_FSL_USB2=y
@@ -793,21 +752,20 @@ CONFIG_MMC_SDHCI_OF_ESDHC=y
 CONFIG_MMC_SDHCI_ESDHC_IMX=y
 CONFIG_MMC_SDHCI_DOVE=y
 CONFIG_MMC_SDHCI_TEGRA=y
+CONFIG_MMC_SDHCI_S3C=y
 CONFIG_MMC_SDHCI_PXAV3=y
 CONFIG_MMC_SDHCI_SPEAR=y
-CONFIG_MMC_SDHCI_S3C=y
 CONFIG_MMC_SDHCI_S3C_DMA=y
 CONFIG_MMC_SDHCI_BCM_KONA=y
+CONFIG_MMC_MESON_MX_SDIO=y
 CONFIG_MMC_SDHCI_ST=y
 CONFIG_MMC_OMAP=y
 CONFIG_MMC_OMAP_HS=y
 CONFIG_MMC_ATMELMCI=y
 CONFIG_MMC_SDHCI_MSM=y
-CONFIG_MMC_MESON_MX_SDIO=y
 CONFIG_MMC_MVSDIO=y
 CONFIG_MMC_SDHI=y
 CONFIG_MMC_DW=y
-CONFIG_MMC_DW_PLTFM=y
 CONFIG_MMC_DW_EXYNOS=y
 CONFIG_MMC_DW_ROCKCHIP=y
 CONFIG_MMC_SH_MMCIF=y
@@ -847,94 +805,85 @@ CONFIG_RTC_DRV_MAX77686=y
 CONFIG_RTC_DRV_RK808=m
 CONFIG_RTC_DRV_RS5C372=m
 CONFIG_RTC_DRV_BQ32K=m
-CONFIG_RTC_DRV_PALMAS=y
-CONFIG_RTC_DRV_ST_LPC=y
 CONFIG_RTC_DRV_TWL4030=y
+CONFIG_RTC_DRV_PALMAS=y
 CONFIG_RTC_DRV_TPS6586X=y
 CONFIG_RTC_DRV_TPS65910=y
 CONFIG_RTC_DRV_S35390A=m
 CONFIG_RTC_DRV_RX8581=m
 CONFIG_RTC_DRV_EM3027=y
+CONFIG_RTC_DRV_S5M=m
 CONFIG_RTC_DRV_DA9063=m
 CONFIG_RTC_DRV_EFI=m
 CONFIG_RTC_DRV_DIGICOLOR=m
-CONFIG_RTC_DRV_S5M=m
 CONFIG_RTC_DRV_S3C=m
 CONFIG_RTC_DRV_PL031=y
 CONFIG_RTC_DRV_AT91RM9200=m
 CONFIG_RTC_DRV_AT91SAM9=m
 CONFIG_RTC_DRV_VT8500=y
-CONFIG_RTC_DRV_SUN6I=y
 CONFIG_RTC_DRV_SUNXI=y
 CONFIG_RTC_DRV_MV=y
 CONFIG_RTC_DRV_TEGRA=y
+CONFIG_RTC_DRV_ST_LPC=y
 CONFIG_RTC_DRV_CPCAP=m
 CONFIG_DMADEVICES=y
-CONFIG_DW_DMAC=y
 CONFIG_AT_HDMAC=y
 CONFIG_AT_XDMAC=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_SUN6I=y
 CONFIG_FSL_EDMA=y
+CONFIG_IMX_DMA=y
+CONFIG_IMX_SDMA=y
 CONFIG_MV_XOR=y
+CONFIG_MXS_DMA=y
+CONFIG_PL330_DMA=y
+CONFIG_SIRF_DMA=y
+CONFIG_STE_DMA40=y
+CONFIG_ST_FDMA=m
 CONFIG_TEGRA20_APB_DMA=y
+CONFIG_XILINX_DMA=y
+CONFIG_QCOM_BAM_DMA=y
+CONFIG_DW_DMAC=y
 CONFIG_SH_DMAE=y
 CONFIG_RCAR_DMAC=y
 CONFIG_RENESAS_USB_DMAC=m
-CONFIG_STE_DMA40=y
+CONFIG_VIRTIO_PCI=y
-CONFIG_SIRF_DMA=y
+CONFIG_VIRTIO_MMIO=y
-CONFIG_TI_EDMA=y
-CONFIG_PL330_DMA=y
-CONFIG_IMX_SDMA=y
-CONFIG_IMX_DMA=y
-CONFIG_MXS_DMA=y
-CONFIG_DMA_BCM2835=y
-CONFIG_DMA_OMAP=y
-CONFIG_QCOM_BAM_DMA=y
-CONFIG_XILINX_DMA=y
-CONFIG_DMA_SUN6I=y
-CONFIG_ST_FDMA=m
 CONFIG_STAGING=y
-CONFIG_SENSORS_ISL29018=y
-CONFIG_SENSORS_ISL29028=y
 CONFIG_MFD_NVEC=y
 CONFIG_KEYBOARD_NVEC=y
 CONFIG_SERIO_NVEC_PS2=y
 CONFIG_NVEC_POWER=y
 CONFIG_NVEC_PAZ00=y
-CONFIG_BCMA=y
-CONFIG_BCMA_HOST_SOC=y
-CONFIG_BCMA_DRIVER_GMAC_CMN=y
-CONFIG_BCMA_DRIVER_GPIO=y
-CONFIG_QCOM_GSBI=y
-CONFIG_QCOM_PM=y
-CONFIG_QCOM_SMEM=y
-CONFIG_QCOM_SMD_RPM=y
-CONFIG_QCOM_SMP2P=y
-CONFIG_QCOM_SMSM=y
-CONFIG_QCOM_WCNSS_CTRL=m
-CONFIG_ROCKCHIP_PM_DOMAINS=y
-CONFIG_COMMON_CLK_QCOM=y
-CONFIG_QCOM_CLK_RPM=y
-CONFIG_CHROME_PLATFORMS=y
 CONFIG_STAGING_BOARD=y
-CONFIG_CROS_EC_CHARDEV=m
 CONFIG_COMMON_CLK_MAX77686=y
 CONFIG_COMMON_CLK_RK808=m
 CONFIG_COMMON_CLK_S2MPS11=m
+CONFIG_COMMON_CLK_QCOM=y
+CONFIG_QCOM_CLK_RPM=y
 CONFIG_APQ_MMCC_8084=y
 CONFIG_MSM_GCC_8660=y
 CONFIG_MSM_MMCC_8960=y
 CONFIG_MSM_MMCC_8974=y
-CONFIG_HWSPINLOCK_QCOM=y
+CONFIG_BCM2835_MBOX=y
 CONFIG_ROCKCHIP_IOMMU=y
 CONFIG_TEGRA_IOMMU_GART=y
 CONFIG_TEGRA_IOMMU_SMMU=y
 CONFIG_REMOTEPROC=m
 CONFIG_ST_REMOTEPROC=m
 CONFIG_RPMSG_VIRTIO=m
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_QCOM_GSBI=y
+CONFIG_QCOM_PM=y
+CONFIG_QCOM_SMD_RPM=m
+CONFIG_QCOM_WCNSS_CTRL=m
+CONFIG_ROCKCHIP_PM_DOMAINS=y
+CONFIG_ARCH_TEGRA_2x_SOC=y
+CONFIG_ARCH_TEGRA_3x_SOC=y
+CONFIG_ARCH_TEGRA_114_SOC=y
+CONFIG_ARCH_TEGRA_124_SOC=y
 CONFIG_PM_DEVFREQ=y
 CONFIG_ARM_TEGRA_DEVFREQ=m
-CONFIG_MEMORY=y
-CONFIG_EXTCON=y
 CONFIG_TI_AEMIF=y
 CONFIG_IIO=y
 CONFIG_IIO_SW_TRIGGER=y
@@ -947,56 +896,54 @@ CONFIG_VF610_ADC=m
 CONFIG_XILINX_XADC=y
 CONFIG_MPU3050_I2C=y
 CONFIG_CM36651=m
+CONFIG_SENSORS_ISL29018=y
+CONFIG_SENSORS_ISL29028=y
 CONFIG_AK8975=y
-CONFIG_RASPBERRYPI_POWER=y
 CONFIG_IIO_HRTIMER_TRIGGER=y
 CONFIG_PWM=y
 CONFIG_PWM_ATMEL=m
 CONFIG_PWM_ATMEL_HLCDC_PWM=m
 CONFIG_PWM_ATMEL_TCB=m
+CONFIG_PWM_BCM2835=y
+CONFIG_PWM_BRCMSTB=m
 CONFIG_PWM_FSL_FTM=m
 CONFIG_PWM_MESON=m
 CONFIG_PWM_RCAR=m
 CONFIG_PWM_RENESAS_TPU=y
 CONFIG_PWM_ROCKCHIP=m
 CONFIG_PWM_SAMSUNG=m
+CONFIG_PWM_STI=y
 CONFIG_PWM_SUN4I=y
 CONFIG_PWM_TEGRA=y
 CONFIG_PWM_VT8500=y
+CONFIG_KEYSTONE_IRQ=y
+CONFIG_PHY_SUN4I_USB=y
+CONFIG_PHY_SUN9I_USB=y
 CONFIG_PHY_HIX5HD2_SATA=y
-CONFIG_E1000E=y
+CONFIG_PHY_BERLIN_SATA=y
-CONFIG_PWM_STI=y
-CONFIG_PWM_BCM2835=y
-CONFIG_PWM_BRCMSTB=m
-CONFIG_PHY_DM816X_USB=m
-CONFIG_OMAP_USB2=y
-CONFIG_TI_PIPE3=y
-CONFIG_TWL4030_USB=m
 CONFIG_PHY_BERLIN_USB=y
 CONFIG_PHY_CPCAP_USB=m
-CONFIG_PHY_BERLIN_SATA=y
+CONFIG_PHY_QCOM_APQ8064_SATA=m
+CONFIG_PHY_RCAR_GEN2=m
 CONFIG_PHY_ROCKCHIP_DP=m
 CONFIG_PHY_ROCKCHIP_USB=y
-CONFIG_PHY_QCOM_APQ8064_SATA=m
+CONFIG_PHY_SAMSUNG_USB2=m
 CONFIG_PHY_MIPHY28LP=y
-CONFIG_PHY_RCAR_GEN2=m
 CONFIG_PHY_STIH407_USB=y
 CONFIG_PHY_STM32_USBPHYC=y
-CONFIG_PHY_SUN4I_USB=y
-CONFIG_PHY_SUN9I_USB=y
-CONFIG_PHY_SAMSUNG_USB2=m
 CONFIG_PHY_TEGRA_XUSB=y
-CONFIG_PHY_BRCM_SATA=y
+CONFIG_PHY_DM816X_USB=m
-CONFIG_NVMEM=y
+CONFIG_OMAP_USB2=y
+CONFIG_TI_PIPE3=y
+CONFIG_TWL4030_USB=m
 CONFIG_NVMEM_IMX_OCOTP=y
 CONFIG_NVMEM_SUNXI_SID=y
 CONFIG_NVMEM_VF610_OCOTP=y
-CONFIG_BCM2835_MBOX=y
 CONFIG_RASPBERRYPI_FIRMWARE=y
-CONFIG_EFI_VARS=m
-CONFIG_EFI_CAPSULE_LOADER=m
 CONFIG_BCM47XX_NVRAM=y
 CONFIG_BCM47XX_SPROM=y
+CONFIG_EFI_VARS=m
+CONFIG_EFI_CAPSULE_LOADER=m
 CONFIG_EXT4_FS=y
 CONFIG_AUTOFS4_FS=y
 CONFIG_MSDOS_FS=y
@@ -1004,7 +951,6 @@ CONFIG_VFAT_FS=y
 CONFIG_NTFS_FS=y
 CONFIG_TMPFS_POSIX_ACL=y
 CONFIG_UBIFS_FS=y
-CONFIG_TMPFS=y
 CONFIG_SQUASHFS=y
 CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
@@ -1020,13 +966,7 @@ CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 CONFIG_NLS_UTF8=y
 CONFIG_PRINTK_TIME=y
-CONFIG_DEBUG_FS=y
 CONFIG_MAGIC_SYSRQ=y
-CONFIG_LOCKUP_DETECTOR=y
-CONFIG_CPUFREQ_DT=y
-CONFIG_KEYSTONE_IRQ=y
-CONFIG_HW_RANDOM=y
-CONFIG_HW_RANDOM_ST=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
@@ -1035,27 +975,19 @@ CONFIG_CRYPTO_USER_API_AEAD=m
 CONFIG_CRYPTO_DEV_MARVELL_CESA=m
 CONFIG_CRYPTO_DEV_EXYNOS_RNG=m
 CONFIG_CRYPTO_DEV_S5P=m
+CONFIG_CRYPTO_DEV_ATMEL_AES=m
+CONFIG_CRYPTO_DEV_ATMEL_TDES=m
+CONFIG_CRYPTO_DEV_ATMEL_SHA=m
 CONFIG_CRYPTO_DEV_SUN4I_SS=m
 CONFIG_CRYPTO_DEV_ROCKCHIP=m
 CONFIG_ARM_CRYPTO=y
-CONFIG_CRYPTO_SHA1_ARM=m
 CONFIG_CRYPTO_SHA1_ARM_NEON=m
 CONFIG_CRYPTO_SHA1_ARM_CE=m
 CONFIG_CRYPTO_SHA2_ARM_CE=m
-CONFIG_CRYPTO_SHA256_ARM=m
 CONFIG_CRYPTO_SHA512_ARM=m
 CONFIG_CRYPTO_AES_ARM=m
 CONFIG_CRYPTO_AES_ARM_BS=m
 CONFIG_CRYPTO_AES_ARM_CE=m
-CONFIG_CRYPTO_CHACHA20_NEON=m
-CONFIG_CRYPTO_CRC32_ARM_CE=m
-CONFIG_CRYPTO_CRCT10DIF_ARM_CE=m
 CONFIG_CRYPTO_GHASH_ARM_CE=m
-CONFIG_CRYPTO_DEV_ATMEL_AES=m
+CONFIG_CRYPTO_CRC32_ARM_CE=m
-CONFIG_CRYPTO_DEV_ATMEL_TDES=m
+CONFIG_CRYPTO_CHACHA20_NEON=m
-CONFIG_CRYPTO_DEV_ATMEL_SHA=m
-CONFIG_VIDEO_VIVID=m
-CONFIG_VIRTIO=y
-CONFIG_VIRTIO_PCI=y
-CONFIG_VIRTIO_PCI_LEGACY=y
-CONFIG_VIRTIO_MMIO=y
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index f09e9d66d605..dec130e7078c 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -544,7 +544,7 @@ static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
         * Increment event counter and perform fixup for the pre-signal
         * frame.
         */
-        rseq_signal_deliver(regs);
+        rseq_signal_deliver(ksig, regs);
        /*
         * Set up the stack frame
@@ -666,7 +666,7 @@ do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
                        } else {
                                clear_thread_flag(TIF_NOTIFY_RESUME);
                                tracehook_notify_resume(regs);
-                                rseq_handle_notify_resume(regs);
+                                rseq_handle_notify_resume(NULL, regs);
                        }
                }
                local_irq_disable();
diff --git a/arch/arm/mach-bcm/Kconfig b/arch/arm/mach-bcm/Kconfig
index c46a728df44e..25aac6ee2ab1 100644
--- a/arch/arm/mach-bcm/Kconfig
+++ b/arch/arm/mach-bcm/Kconfig
@@ -20,6 +20,7 @@ config ARCH_BCM_IPROC
        select GPIOLIB
        select ARM_AMBA
        select PINCTRL
+        select PCI_DOMAINS if PCI
        help
          This enables support for systems based on Broadcom IPROC architected SoCs.
          The IPROC complex contains one or more ARM CPUs along with common
diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c
index e22fb40e34bc..6d5beb11bd96 100644
--- a/arch/arm/mach-davinci/board-da850-evm.c
+++ b/arch/arm/mach-davinci/board-da850-evm.c
@@ -774,7 +774,7 @@ static struct gpiod_lookup_table mmc_gpios_table = {
                GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_CD_PIN, "cd",
                            GPIO_ACTIVE_LOW),
                GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_WP_PIN, "wp",
-                            GPIO_ACTIVE_LOW),
+                            GPIO_ACTIVE_HIGH),
        },
 };
diff --git a/arch/arm/mach-socfpga/Kconfig b/arch/arm/mach-socfpga/Kconfig
index d0f62eacf59d..4adb901dd5eb 100644
--- a/arch/arm/mach-socfpga/Kconfig
+++ b/arch/arm/mach-socfpga/Kconfig
@@ -10,6 +10,7 @@ menuconfig ARCH_SOCFPGA
        select HAVE_ARM_SCU
        select HAVE_ARM_TWD if SMP
        select MFD_SYSCON
+        select PCI_DOMAINS if PCI
 if ARCH_SOCFPGA
 config SOCFPGA_SUSPEND
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index 8073625371f5..07060e5b5864 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -59,6 +59,9 @@ struct xen_memory_region xen_extra_mem[XEN_EXTRA_MEM_MAX_REGIONS] __initdata;
 static __read_mostly unsigned int xen_events_irq;
+uint32_t xen_start_flags;
+EXPORT_SYMBOL(xen_start_flags);
 int xen_remap_domain_gfn_array(struct vm_area_struct *vma,
                               unsigned long addr,
                               xen_pfn_t *gfn, int nr,
@@ -293,9 +296,7 @@ void __init xen_early_init(void)
        xen_setup_features();
        if (xen_feature(XENFEAT_dom0))
-                xen_start_info->flags |= SIF_INITDOMAIN|SIF_PRIVILEGED;
+                xen_start_flags |= SIF_INITDOMAIN|SIF_PRIVILEGED;
-        else
-                xen_start_info->flags &= ~(SIF_INITDOMAIN|SIF_PRIVILEGED);
        if (!console_set_on_cmdline && !xen_initial_domain())
                add_preferred_console("hvc", 0, NULL);
diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
index e6b059378dc0..67dac595dc72 100644
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
@@ -309,8 +309,7 @@
                        interrupts = <0 99 4>;
                        resets = <&rst SPIM0_RESET>;
                        reg-io-width = <4>;
-                        num-chipselect = <4>;
+                        num-cs = <4>;
-                        bus-num = <0>;
                        status = "disabled";
                };
@@ -322,8 +321,7 @@
                        interrupts = <0 100 4>;
                        resets = <&rst SPIM1_RESET>;
                        reg-io-width = <4>;
-                        num-chipselect = <4>;
+                        num-cs = <4>;
-                        bus-num = <0>;
                        status = "disabled";
                };
diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts b/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts
index 4b3331fbfe39..dff9b15eb3c0 100644
--- a/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts
@@ -66,9 +66,22 @@
 &ethmac {
        status = "okay";
-        phy-mode = "rgmii";
        pinctrl-0 = <&eth_rgmii_y_pins>;
        pinctrl-names = "default";
+        phy-handle = <&eth_phy0>;
+        phy-mode = "rgmii";
+        mdio {
+                compatible = "snps,dwmac-mdio";
+                #address-cells = <1>;
+                #size-cells = <0>;
+                eth_phy0: ethernet-phy@0 {
+                        /* Realtek RTL8211F (0x001cc916) */
+                        reg = <0>;
+                        eee-broken-1000t;
+                };
+        };
 };
 &uart_A {
diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
index fee87737a201..67d7115e4eff 100644
--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
@@ -132,7 +132,7 @@
                        sd_emmc_b: sd@5000 {
                                compatible = "amlogic,meson-axg-mmc";
-                                reg = <0x0 0x5000 0x0 0x2000>;
+                                reg = <0x0 0x5000 0x0 0x800>;
                                interrupts = <GIC_SPI 217 IRQ_TYPE_EDGE_RISING>;
                                status = "disabled";
                                clocks = <&clkc CLKID_SD_EMMC_B>,
@@ -144,7 +144,7 @@
                        sd_emmc_c: mmc@7000 {
                                compatible = "amlogic,meson-axg-mmc";
-                                reg = <0x0 0x7000 0x0 0x2000>;
+                                reg = <0x0 0x7000 0x0 0x800>;
                                interrupts = <GIC_SPI 218 IRQ_TYPE_EDGE_RISING>;
                                status = "disabled";
                                clocks = <&clkc CLKID_SD_EMMC_C>,
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
index 3c31e21cbed7..b8dc4dbb391b 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
@@ -35,6 +35,12 @@
                        no-map;
                };
+                /* Alternate 3 MiB reserved for ARM Trusted Firmware (BL31) */
+                secmon_reserved_alt: secmon@5000000 {
+                        reg = <0x0 0x05000000 0x0 0x300000>;
+                        no-map;
+                };
                linux,cma {
                        compatible = "shared-dma-pool";
                        reusable;
@@ -457,21 +463,21 @@
                        sd_emmc_a: mmc@70000 {
                                compatible = "amlogic,meson-gx-mmc", "amlogic,meson-gxbb-mmc";
-                                reg = <0x0 0x70000 0x0 0x2000>;
+                                reg = <0x0 0x70000 0x0 0x800>;
                                interrupts = <GIC_SPI 216 IRQ_TYPE_EDGE_RISING>;
                                status = "disabled";
                        };
                        sd_emmc_b: mmc@72000 {
                                compatible = "amlogic,meson-gx-mmc", "amlogic,meson-gxbb-mmc";
-                                reg = <0x0 0x72000 0x0 0x2000>;
+                                reg = <0x0 0x72000 0x0 0x800>;
                                interrupts = <GIC_SPI 217 IRQ_TYPE_EDGE_RISING>;
                                status = "disabled";
                        };
                        sd_emmc_c: mmc@74000 {
                                compatible = "amlogic,meson-gx-mmc", "amlogic,meson-gxbb-mmc";
-                                reg = <0x0 0x74000 0x0 0x2000>;
+                                reg = <0x0 0x74000 0x0 0x800>;
                                interrupts = <GIC_SPI 218 IRQ_TYPE_EDGE_RISING>;
                                status = "disabled";
                        };
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi
index eb327664a4d8..6aaafff674f9 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi
@@ -6,7 +6,7 @@
 &apb {
        mali: gpu@c0000 {
-                compatible = "amlogic,meson-gxbb-mali", "arm,mali-450";
+                compatible = "amlogic,meson-gxl-mali", "arm,mali-450";
                reg = <0x0 0xc0000 0x0 0x40000>;
                interrupts = <GIC_SPI 160 IRQ_TYPE_LEVEL_HIGH>,
                             <GIC_SPI 161 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
index 3e3eb31748a3..f63bceb88caa 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
@@ -234,9 +234,6 @@
        bus-width = <4>;
        cap-sd-highspeed;
-        sd-uhs-sdr12;
-        sd-uhs-sdr25;
-        sd-uhs-sdr50;
        max-frequency = <100000000>;
        disable-wp;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
index 0cfd701809de..a1b31013ab6e 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
@@ -189,3 +189,10 @@
 &usb0 {
        status = "okay";
 };
+&usb2_phy0 {
+        /*
+         * HDMI_5V is also used as supply for the USB VBUS.
+         */
+        phy-supply = <&hdmi_5v>;
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
index 27538eea547b..c87a80e9bcc6 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
@@ -13,14 +13,6 @@
 / {
        compatible = "amlogic,meson-gxl";
-        reserved-memory {
-                /* Alternate 3 MiB reserved for ARM Trusted Firmware (BL31) */
-                secmon_reserved_alt: secmon@5000000 {
-                        reg = <0x0 0x05000000 0x0 0x300000>;
-                        no-map;
-                };
-        };
        soc {
                usb0: usb@c9000000 {
                        status = "disabled";
diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
index 4a2a6af8e752..4057197048dc 100644
--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
@@ -118,7 +118,7 @@
                #interrupt-cells = <1>;
                interrupt-map-mask = <0 0 0 0>;
-                interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 281 IRQ_TYPE_NONE>;
+                interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 281 IRQ_TYPE_LEVEL_HIGH>;
                linux,pci-domain = <0>;
@@ -149,7 +149,7 @@
                #interrupt-cells = <1>;
                interrupt-map-mask = <0 0 0 0>;
-                interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 305 IRQ_TYPE_NONE>;
+                interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 305 IRQ_TYPE_LEVEL_HIGH>;
                linux,pci-domain = <4>;
@@ -566,7 +566,7 @@
                        reg = <0x66080000 0x100>;
                        #address-cells = <1>;
                        #size-cells = <0>;
-                        interrupts = <GIC_SPI 394 IRQ_TYPE_NONE>;
+                        interrupts = <GIC_SPI 394 IRQ_TYPE_LEVEL_HIGH>;
                        clock-frequency = <100000>;
                        status = "disabled";
                };
@@ -594,7 +594,7 @@
                        reg = <0x660b0000 0x100>;
                        #address-cells = <1>;
                        #size-cells = <0>;
-                        interrupts = <GIC_SPI 395 IRQ_TYPE_NONE>;
+                        interrupts = <GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>;
                        clock-frequency = <100000>;
                        status = "disabled";
                };
diff --git a/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts b/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts
index eb6f08cdbd79..77efa28c4dd5 100644
--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts
+++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts
@@ -43,6 +43,10 @@
        enet-phy-lane-swap;
 };
+&sdio0 {
+        mmc-ddr-1_8v;
+};
 &uart2 {
        status = "okay";
 };
diff --git a/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts b/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts
index 5084b037320f..55ba495ef56e 100644
--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts
+++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts
@@ -42,3 +42,7 @@
 &gphy0 {
        enet-phy-lane-swap;
 };
+&sdio0 {
+        mmc-ddr-1_8v;
+};
diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
index 99aaff0b6d72..b203152ad67c 100644
--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
@@ -409,7 +409,7 @@
                        reg = <0x000b0000 0x100>;
                        #address-cells = <1>;
                        #size-cells = <0>;
-                        interrupts = <GIC_SPI 177 IRQ_TYPE_NONE>;
+                        interrupts = <GIC_SPI 177 IRQ_TYPE_LEVEL_HIGH>;
                        clock-frequency = <100000>;
                        status = "disabled";
                };
@@ -453,7 +453,7 @@
                        reg = <0x000e0000 0x100>;
                        #address-cells = <1>;
                        #size-cells = <0>;
-                        interrupts = <GIC_SPI 178 IRQ_TYPE_NONE>;
+                        interrupts = <GIC_SPI 178 IRQ_TYPE_LEVEL_HIGH>;
                        clock-frequency = <100000>;
                        status = "disabled";
                };
diff --git a/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts b/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts
index c6999624ed8a..68c5a6c819ae 100644
--- a/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts
+++ b/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts
@@ -585,6 +585,8 @@
        vmmc-supply = <&wlan_en>;
        ti,non-removable;
        non-removable;
+        cap-power-off-card;
+        keep-power-in-suspend;
        #address-cells = <0x1>;
        #size-cells = <0x0>;
        status = "ok";
diff --git a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
index edb4ee0b8896..7f12624f6c8e 100644
--- a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
+++ b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
@@ -322,6 +322,8 @@
                dwmmc_2: dwmmc2@f723f000 {
                        bus-width = <0x4>;
                        non-removable;
+                        cap-power-off-card;
+                        keep-power-in-suspend;
                        vmmc-supply = <&reg_vdd_3v3>;
                        mmc-pwrseq = <&wl1835_pwrseq>;
diff --git a/arch/arm64/boot/dts/marvell/armada-cp110.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110.dtsi
index 7dabe25f6774..1c6ff8197a88 100644
--- a/arch/arm64/boot/dts/marvell/armada-cp110.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-cp110.dtsi
@@ -149,7 +149,7 @@
                CP110_LABEL(icu): interrupt-controller@1e0000 {
                        compatible = "marvell,cp110-icu";
-                        reg = <0x1e0000 0x10>;
+                        reg = <0x1e0000 0x440>;
                        #interrupt-cells = <3>;
                        interrupt-controller;
                        msi-parent = <&gicp>;
diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
index 0f829db33efe..4d5ef01f43a3 100644
--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
+++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
@@ -75,7 +75,7 @@
                serial@75b1000 {
                        label = "LS-UART0";
-                        status = "okay";
+                        status = "disabled";
                        pinctrl-names = "default", "sleep";
                        pinctrl-0 = <&blsp2_uart2_4pins_default>;
                        pinctrl-1 = <&blsp2_uart2_4pins_sleep>;
diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
index 650f356f69ca..c2625d15a8c0 100644
--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
@@ -1191,14 +1191,14 @@
                                port@0 {
                                        reg = <0>;
-                                        etf_out: endpoint {
+                                        etf_in: endpoint {
                                                slave-mode;
                                                remote-endpoint = <&funnel0_out>;
                                        };
                                };
                                port@1 {
                                        reg = <0>;
-                                        etf_in: endpoint {
+                                        etf_out: endpoint {
                                                remote-endpoint = <&replicator_in>;
                                        };
                                };
diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts b/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts
index 9b4dc41703e3..ae3b5adf32df 100644
--- a/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts
+++ b/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts
@@ -54,7 +54,7 @@
        sound {
                compatible = "audio-graph-card";
                label = "UniPhier LD11";
-                widgets = "Headphone", "Headphone Jack";
+                widgets = "Headphone", "Headphones";
                dais = <&i2s_port2
                        &i2s_port3
                        &i2s_port4
diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts b/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts
index fe6608ea3277..7919233c9ce2 100644
--- a/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts
+++ b/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts
@@ -54,7 +54,7 @@
        sound {
                compatible = "audio-graph-card";
                label = "UniPhier LD20";
-                widgets = "Headphone", "Headphone Jack";
+                widgets = "Headphone", "Headphones";
                dais = <&i2s_port2
                        &i2s_port3
                        &i2s_port4
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 3cfa8ca26738..f9a186f6af8a 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -47,6 +47,7 @@ CONFIG_ARCH_MVEBU=y
 CONFIG_ARCH_QCOM=y
 CONFIG_ARCH_ROCKCHIP=y
 CONFIG_ARCH_SEATTLE=y
+CONFIG_ARCH_SYNQUACER=y
 CONFIG_ARCH_RENESAS=y
 CONFIG_ARCH_R8A7795=y
 CONFIG_ARCH_R8A7796=y
@@ -58,7 +59,6 @@ CONFIG_ARCH_R8A77995=y
 CONFIG_ARCH_STRATIX10=y
 CONFIG_ARCH_TEGRA=y
 CONFIG_ARCH_SPRD=y
-CONFIG_ARCH_SYNQUACER=y
 CONFIG_ARCH_THUNDER=y
 CONFIG_ARCH_THUNDER2=y
 CONFIG_ARCH_UNIPHIER=y
@@ -67,25 +67,23 @@ CONFIG_ARCH_XGENE=y
 CONFIG_ARCH_ZX=y
 CONFIG_ARCH_ZYNQMP=y
 CONFIG_PCI=y
-CONFIG_HOTPLUG_PCI_PCIE=y
 CONFIG_PCI_IOV=y
 CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=y
-CONFIG_PCI_LAYERSCAPE=y
-CONFIG_PCI_HISI=y
-CONFIG_PCIE_QCOM=y
-CONFIG_PCIE_KIRIN=y
-CONFIG_PCIE_ARMADA_8K=y
-CONFIG_PCIE_HISI_STB=y
 CONFIG_PCI_AARDVARK=y
 CONFIG_PCI_TEGRA=y
 CONFIG_PCIE_RCAR=y
-CONFIG_PCIE_ROCKCHIP=y
-CONFIG_PCIE_ROCKCHIP_HOST=m
 CONFIG_PCI_HOST_GENERIC=y
 CONFIG_PCI_XGENE=y
 CONFIG_PCI_HOST_THUNDER_PEM=y
 CONFIG_PCI_HOST_THUNDER_ECAM=y
+CONFIG_PCIE_ROCKCHIP_HOST=m
+CONFIG_PCI_LAYERSCAPE=y
+CONFIG_PCI_HISI=y
+CONFIG_PCIE_QCOM=y
+CONFIG_PCIE_ARMADA_8K=y
+CONFIG_PCIE_KIRIN=y
+CONFIG_PCIE_HISI_STB=y
 CONFIG_ARM64_VA_BITS_48=y
 CONFIG_SCHED_MC=y
 CONFIG_NUMA=y
@@ -104,8 +102,6 @@ CONFIG_HIBERNATION=y
 CONFIG_WQ_POWER_EFFICIENT_DEFAULT=y
 CONFIG_ARM_CPUIDLE=y
 CONFIG_CPU_FREQ=y
-CONFIG_CPU_FREQ_GOV_ATTR_SET=y
-CONFIG_CPU_FREQ_GOV_COMMON=y
 CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_FREQ_GOV_POWERSAVE=m
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
@@ -113,11 +109,11 @@ CONFIG_CPU_FREQ_GOV_ONDEMAND=y
 CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
 CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
 CONFIG_CPUFREQ_DT=y
+CONFIG_ACPI_CPPC_CPUFREQ=m
 CONFIG_ARM_ARMADA_37XX_CPUFREQ=y
 CONFIG_ARM_BIG_LITTLE_CPUFREQ=y
 CONFIG_ARM_SCPI_CPUFREQ=y
 CONFIG_ARM_TEGRA186_CPUFREQ=y
-CONFIG_ACPI_CPPC_CPUFREQ=m
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
@@ -236,11 +232,6 @@ CONFIG_SMSC911X=y
 CONFIG_SNI_AVE=y
 CONFIG_SNI_NETSEC=y
 CONFIG_STMMAC_ETH=m
-CONFIG_DWMAC_IPQ806X=m
-CONFIG_DWMAC_MESON=m
-CONFIG_DWMAC_ROCKCHIP=m
-CONFIG_DWMAC_SUNXI=m
-CONFIG_DWMAC_SUN8I=m
 CONFIG_MDIO_BUS_MUX_MMIOREG=y
 CONFIG_AT803X_PHY=m
 CONFIG_MARVELL_PHY=m
@@ -269,8 +260,8 @@ CONFIG_WL18XX=m
 CONFIG_WLCORE_SDIO=m
 CONFIG_INPUT_EVDEV=y
 CONFIG_KEYBOARD_ADC=m
-CONFIG_KEYBOARD_CROS_EC=y
 CONFIG_KEYBOARD_GPIO=y
+CONFIG_KEYBOARD_CROS_EC=y
 CONFIG_INPUT_TOUCHSCREEN=y
 CONFIG_TOUCHSCREEN_ATMEL_MXT=m
 CONFIG_INPUT_MISC=y
@@ -296,17 +287,13 @@ CONFIG_SERIAL_SAMSUNG=y
 CONFIG_SERIAL_SAMSUNG_CONSOLE=y
 CONFIG_SERIAL_TEGRA=y
 CONFIG_SERIAL_SH_SCI=y
-CONFIG_SERIAL_SH_SCI_NR_UARTS=11
-CONFIG_SERIAL_SH_SCI_CONSOLE=y
 CONFIG_SERIAL_MSM=y
 CONFIG_SERIAL_MSM_CONSOLE=y
 CONFIG_SERIAL_XILINX_PS_UART=y
 CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
 CONFIG_SERIAL_MVEBU_UART=y
 CONFIG_SERIAL_DEV_BUS=y
-CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
 CONFIG_VIRTIO_CONSOLE=y
-CONFIG_I2C_HID=m
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MUX=y
 CONFIG_I2C_MUX_PCA954x=y
@@ -325,26 +312,26 @@ CONFIG_I2C_RCAR=y
 CONFIG_I2C_CROS_EC_TUNNEL=y
 CONFIG_SPI=y
 CONFIG_SPI_ARMADA_3700=y
-CONFIG_SPI_MESON_SPICC=m
-CONFIG_SPI_MESON_SPIFC=m
 CONFIG_SPI_BCM2835=m
 CONFIG_SPI_BCM2835AUX=m
+CONFIG_SPI_MESON_SPICC=m
+CONFIG_SPI_MESON_SPIFC=m
 CONFIG_SPI_ORION=y
 CONFIG_SPI_PL022=y
-CONFIG_SPI_QUP=y
 CONFIG_SPI_ROCKCHIP=y
+CONFIG_SPI_QUP=y
 CONFIG_SPI_S3C64XX=y
 CONFIG_SPI_SPIDEV=m
 CONFIG_SPMI=y
-CONFIG_PINCTRL_IPQ8074=y
 CONFIG_PINCTRL_SINGLE=y
 CONFIG_PINCTRL_MAX77620=y
+CONFIG_PINCTRL_IPQ8074=y
 CONFIG_PINCTRL_MSM8916=y
 CONFIG_PINCTRL_MSM8994=y
 CONFIG_PINCTRL_MSM8996=y
-CONFIG_PINCTRL_MT7622=y
 CONFIG_PINCTRL_QDF2XXX=y
 CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
+CONFIG_PINCTRL_MT7622=y
 CONFIG_GPIO_DWAPB=y
 CONFIG_GPIO_MB86S7X=y
 CONFIG_GPIO_PL061=y
@@ -368,13 +355,13 @@ CONFIG_SENSORS_INA2XX=m
 CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y
 CONFIG_CPU_THERMAL=y
 CONFIG_THERMAL_EMULATION=y
+CONFIG_ROCKCHIP_THERMAL=m
+CONFIG_RCAR_GEN3_THERMAL=y
 CONFIG_ARMADA_THERMAL=y
 CONFIG_BRCMSTB_THERMAL=m
 CONFIG_EXYNOS_THERMAL=y
-CONFIG_RCAR_GEN3_THERMAL=y
-CONFIG_QCOM_TSENS=y
-CONFIG_ROCKCHIP_THERMAL=m
 CONFIG_TEGRA_BPMP_THERMAL=m
+CONFIG_QCOM_TSENS=y
 CONFIG_UNIPHIER_THERMAL=y
 CONFIG_WATCHDOG=y
 CONFIG_S3C2410_WATCHDOG=y
@@ -395,9 +382,9 @@ CONFIG_MFD_MAX77620=y
 CONFIG_MFD_SPMI_PMIC=y
 CONFIG_MFD_RK808=y
 CONFIG_MFD_SEC_CORE=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_AXP20X=y
 CONFIG_REGULATOR_FAN53555=y
-CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_HI6421V530=y
 CONFIG_REGULATOR_HI655X=y
@@ -407,16 +394,15 @@ CONFIG_REGULATOR_QCOM_SMD_RPM=y
 CONFIG_REGULATOR_QCOM_SPMI=y
 CONFIG_REGULATOR_RK808=y
 CONFIG_REGULATOR_S2MPS11=y
+CONFIG_RC_CORE=m
+CONFIG_RC_DECODERS=y
+CONFIG_RC_DEVICES=y
+CONFIG_IR_MESON=m
 CONFIG_MEDIA_SUPPORT=m
 CONFIG_MEDIA_CAMERA_SUPPORT=y
 CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
 CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
 CONFIG_MEDIA_CONTROLLER=y
-CONFIG_MEDIA_RC_SUPPORT=y
-CONFIG_RC_CORE=m
-CONFIG_RC_DEVICES=y
-CONFIG_RC_DECODERS=y
-CONFIG_IR_MESON=m
 CONFIG_VIDEO_V4L2_SUBDEV_API=y
 # CONFIG_DVB_NET is not set
 CONFIG_V4L_MEM2MEM_DRIVERS=y
@@ -441,8 +427,7 @@ CONFIG_ROCKCHIP_DW_HDMI=y
 CONFIG_ROCKCHIP_DW_MIPI_DSI=y
 CONFIG_ROCKCHIP_INNO_HDMI=y
 CONFIG_DRM_RCAR_DU=m
-CONFIG_DRM_RCAR_LVDS=y
+CONFIG_DRM_RCAR_LVDS=m
-CONFIG_DRM_RCAR_VSP=y
 CONFIG_DRM_TEGRA=m
 CONFIG_DRM_PANEL_SIMPLE=m
 CONFIG_DRM_I2C_ADV7511=m
@@ -455,7 +440,6 @@ CONFIG_FB_ARMCLCD=y
 CONFIG_BACKLIGHT_GENERIC=m
 CONFIG_BACKLIGHT_PWM=m
 CONFIG_BACKLIGHT_LP855X=m
-CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_MONO is not set
 # CONFIG_LOGO_LINUX_VGA16 is not set
@@ -468,6 +452,7 @@ CONFIG_SND_SOC_RCAR=m
 CONFIG_SND_SOC_AK4613=m
 CONFIG_SND_SIMPLE_CARD=m
 CONFIG_SND_AUDIO_GRAPH_CARD=m
+CONFIG_I2C_HID=m
 CONFIG_USB=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=y
@@ -501,12 +486,12 @@ CONFIG_MMC_BLOCK_MINORS=32
 CONFIG_MMC_ARMMMCI=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_ACPI=y
-CONFIG_MMC_SDHCI_F_SDH30=y
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_OF_ARASAN=y
 CONFIG_MMC_SDHCI_OF_ESDHC=y
 CONFIG_MMC_SDHCI_CADENCE=y
 CONFIG_MMC_SDHCI_TEGRA=y
+CONFIG_MMC_SDHCI_F_SDH30=y
 CONFIG_MMC_MESON_GX=y
 CONFIG_MMC_SDHCI_MSM=y
 CONFIG_MMC_SPI=y
@@ -524,11 +509,11 @@ CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_PWM=y
 CONFIG_LEDS_SYSCON=y
+CONFIG_LEDS_TRIGGER_DISK=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_LEDS_TRIGGER_CPU=y
 CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 CONFIG_LEDS_TRIGGER_PANIC=y
-CONFIG_LEDS_TRIGGER_DISK=y
 CONFIG_EDAC=y
 CONFIG_EDAC_GHES=y
 CONFIG_RTC_CLASS=y
@@ -537,13 +522,13 @@ CONFIG_RTC_DRV_RK808=m
 CONFIG_RTC_DRV_S5M=y
 CONFIG_RTC_DRV_DS3232=y
 CONFIG_RTC_DRV_EFI=y
+CONFIG_RTC_DRV_CROS_EC=y
 CONFIG_RTC_DRV_S3C=y
 CONFIG_RTC_DRV_PL031=y
 CONFIG_RTC_DRV_SUN6I=y
 CONFIG_RTC_DRV_ARMADA38X=y
 CONFIG_RTC_DRV_TEGRA=y
 CONFIG_RTC_DRV_XGENE=y
-CONFIG_RTC_DRV_CROS_EC=y
 CONFIG_DMADEVICES=y
 CONFIG_DMA_BCM2835=m
 CONFIG_K3_DMA=y
@@ -579,7 +564,6 @@ CONFIG_HWSPINLOCK_QCOM=y
 CONFIG_ARM_MHU=y
 CONFIG_PLATFORM_MHU=y
 CONFIG_BCM2835_MBOX=y
-CONFIG_HI6220_MBOX=y
 CONFIG_QCOM_APCS_IPC=y
 CONFIG_ROCKCHIP_IOMMU=y
 CONFIG_TEGRA_IOMMU_SMMU=y
@@ -602,7 +586,6 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=y
 CONFIG_EXTCON_USB_GPIO=y
 CONFIG_EXTCON_USBC_CROS_EC=y
 CONFIG_MEMORY=y
-CONFIG_TEGRA_MC=y
 CONFIG_IIO=y
 CONFIG_EXYNOS_ADC=y
 CONFIG_ROCKCHIP_SARADC=m
@@ -618,27 +601,27 @@ CONFIG_PWM_RCAR=m
 CONFIG_PWM_ROCKCHIP=y
 CONFIG_PWM_SAMSUNG=y
 CONFIG_PWM_TEGRA=m
+CONFIG_PHY_XGENE=y
+CONFIG_PHY_SUN4I_USB=y
+CONFIG_PHY_HI6220_USB=y
 CONFIG_PHY_HISTB_COMBPHY=y
 CONFIG_PHY_HISI_INNO_USB2=y
-CONFIG_PHY_RCAR_GEN3_USB2=y
-CONFIG_PHY_RCAR_GEN3_USB3=m
-CONFIG_PHY_HI6220_USB=y
-CONFIG_PHY_QCOM_USB_HS=y
-CONFIG_PHY_SUN4I_USB=y
 CONFIG_PHY_MVEBU_CP110_COMPHY=y
 CONFIG_PHY_QCOM_QMP=m
-CONFIG_PHY_ROCKCHIP_INNO_USB2=y
+CONFIG_PHY_QCOM_USB_HS=y
+CONFIG_PHY_RCAR_GEN3_USB2=y
+CONFIG_PHY_RCAR_GEN3_USB3=m
 CONFIG_PHY_ROCKCHIP_EMMC=y
+CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PHY_ROCKCHIP_PCIE=m
 CONFIG_PHY_ROCKCHIP_TYPEC=y
-CONFIG_PHY_XGENE=y
 CONFIG_PHY_TEGRA_XUSB=y
 CONFIG_QCOM_L2_PMU=y
 CONFIG_QCOM_L3_PMU=y
-CONFIG_MESON_EFUSE=m
 CONFIG_QCOM_QFPROM=y
 CONFIG_ROCKCHIP_EFUSE=y
 CONFIG_UNIPHIER_EFUSE=y
+CONFIG_MESON_EFUSE=m
 CONFIG_TEE=y
 CONFIG_OPTEE=y
 CONFIG_ARM_SCPI_PROTOCOL=y
@@ -647,7 +630,6 @@ CONFIG_EFI_CAPSULE_LOADER=y
 CONFIG_ACPI=y
 CONFIG_ACPI_APEI=y
 CONFIG_ACPI_APEI_GHES=y
-CONFIG_ACPI_APEI_PCIEAER=y
 CONFIG_ACPI_APEI_MEMORY_FAILURE=y
 CONFIG_ACPI_APEI_EINJ=y
 CONFIG_EXT2_FS=y
@@ -682,7 +664,6 @@ CONFIG_DEBUG_INFO=y
 CONFIG_DEBUG_FS=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
-CONFIG_LOCKUP_DETECTOR=y
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_DEBUG_PREEMPT is not set
 # CONFIG_FTRACE is not set
@@ -691,20 +672,15 @@ CONFIG_SECURITY=y
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_ARM64_CRYPTO=y
-CONFIG_CRYPTO_SHA256_ARM64=m
-CONFIG_CRYPTO_SHA512_ARM64=m
 CONFIG_CRYPTO_SHA1_ARM64_CE=y
 CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_SHA512_ARM64_CE=m
+CONFIG_CRYPTO_SHA3_ARM64=m
+CONFIG_CRYPTO_SM3_ARM64_CE=m
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
 CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=m
 CONFIG_CRYPTO_CRC32_ARM64_CE=m
-CONFIG_CRYPTO_AES_ARM64=m
-CONFIG_CRYPTO_AES_ARM64_CE=m
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
-CONFIG_CRYPTO_AES_ARM64_NEON_BLK=m
 CONFIG_CRYPTO_CHACHA20_NEON=m
 CONFIG_CRYPTO_AES_ARM64_BS=m
-CONFIG_CRYPTO_SHA512_ARM64_CE=m
-CONFIG_CRYPTO_SHA3_ARM64=m
-CONFIG_CRYPTO_SM3_ARM64_CE=m
diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c
index 253188fb8cb0..e3e50950a863 100644
--- a/arch/arm64/crypto/aes-glue.c
+++ b/arch/arm64/crypto/aes-glue.c
@@ -223,8 +223,8 @@ static int ctr_encrypt(struct skcipher_request *req)
                kernel_neon_begin();
                aes_ctr_encrypt(walk.dst.virt.addr, walk.src.virt.addr,
                                (u8 *)ctx->key_enc, rounds, blocks, walk.iv);
-                err = skcipher_walk_done(&walk, walk.nbytes % AES_BLOCK_SIZE);
                kernel_neon_end();
+                err = skcipher_walk_done(&walk, walk.nbytes % AES_BLOCK_SIZE);
        }
        if (walk.nbytes) {
                u8 __aligned(8) tail[AES_BLOCK_SIZE];
diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
index a91933b1e2e6..4b650ec1d7dd 100644
--- a/arch/arm64/include/asm/alternative.h
+++ b/arch/arm64/include/asm/alternative.h
@@ -28,7 +28,12 @@ typedef void (*alternative_cb_t)(struct alt_instr *alt,
                                 __le32 *origptr, __le32 *updptr, int nr_inst);
 void __init apply_alternatives_all(void);
-void apply_alternatives(void *start, size_t length);
+#ifdef CONFIG_MODULES
+void apply_alternatives_module(void *start, size_t length);
+#else
+static inline void apply_alternatives_module(void *start, size_t length) { }
+#endif
 #define ALTINSTR_ENTRY(feature,cb)                                            \
        " .word 661b - .\n"                             /* label           */ \
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index fda9a8ca48be..fe8777b12f86 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -306,6 +306,7 @@ struct kvm_vcpu_arch {
 #define KVM_ARM64_FP_ENABLED            (1 << 1) /* guest FP regs loaded */
 #define KVM_ARM64_FP_HOST               (1 << 2) /* host FP regs loaded */
 #define KVM_ARM64_HOST_SVE_IN_USE       (1 << 3) /* backup for host TIF_SVE */
+#define KVM_ARM64_HOST_SVE_ENABLED      (1 << 4) /* SVE enabled for EL0 */
 #define vcpu_gp_regs(v)         (&(v)->arch.ctxt.gp_regs)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 9f82d6b53851..1bdeca8918a6 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -224,10 +224,8 @@ static inline void set_pte(pte_t *ptep, pte_t pte)
         * Only if the new pte is valid and kernel, otherwise TLB maintenance
         * or update_mmu_cache() have the necessary barriers.
         */
-        if (pte_valid_not_user(pte)) {
+        if (pte_valid_not_user(pte))
                dsb(ishst);
-                isb();
-        }
 }
 extern void __sync_icache_dcache(pte_t pteval);
@@ -434,7 +432,6 @@ static inline void set_pmd(pmd_t *pmdp, pmd_t pmd)
 {
        WRITE_ONCE(*pmdp, pmd);
        dsb(ishst);
-        isb();
 }
 static inline void pmd_clear(pmd_t *pmdp)
@@ -485,7 +482,6 @@ static inline void set_pud(pud_t *pudp, pud_t pud)
 {
        WRITE_ONCE(*pudp, pud);
        dsb(ishst);
-        isb();
 }
 static inline void pud_clear(pud_t *pudp)
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index 6171178075dc..a8f84812c6e8 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -728,6 +728,17 @@ asm(
        asm volatile("msr_s " __stringify(r) ", %x0" : : "rZ" (__val)); \
 } while (0)
+/*
+ * Modify bits in a sysreg. Bits in the clear mask are zeroed, then bits in the
+ * set mask are set. Other bits are left as-is.
+ */
+#define sysreg_clear_set(sysreg, clear, set) do {                       \
+        u64 __scs_val = read_sysreg(sysreg);                            \
+        u64 __scs_new = (__scs_val & ~(u64)(clear)) | (set);            \
+        if (__scs_new != __scs_val)                                     \
+                write_sysreg(__scs_new, sysreg);                        \
+} while (0)
 static inline void config_sctlr_el1(u32 clear, u32 set)
 {
        u32 val;
diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c
index 5c4bce4ac381..36fb069fd049 100644
--- a/arch/arm64/kernel/alternative.c
+++ b/arch/arm64/kernel/alternative.c
@@ -122,7 +122,30 @@ static void patch_alternative(struct alt_instr *alt,
        }
 }
-static void __apply_alternatives(void *alt_region, bool use_linear_alias)
+/*
+ * We provide our own, private D-cache cleaning function so that we don't
+ * accidentally call into the cache.S code, which is patched by us at
+ * runtime.
+ */
+static void clean_dcache_range_nopatch(u64 start, u64 end)
+{
+        u64 cur, d_size, ctr_el0;
+        ctr_el0 = read_sanitised_ftr_reg(SYS_CTR_EL0);
+        d_size = 4 << cpuid_feature_extract_unsigned_field(ctr_el0,
+                                                           CTR_DMINLINE_SHIFT);
+        cur = start & ~(d_size - 1);
+        do {
+                /*
+                 * We must clean+invalidate to the PoC in order to avoid
+                 * Cortex-A53 errata 826319, 827319, 824069 and 819472
+                 * (this corresponds to ARM64_WORKAROUND_CLEAN_CACHE)
+                 */
+                asm volatile("dc civac, %0" : : "r" (cur) : "memory");
+        } while (cur += d_size, cur < end);
+}
+static void __apply_alternatives(void *alt_region, bool is_module)
 {
        struct alt_instr *alt;
        struct alt_region *region = alt_region;
@@ -145,7 +168,7 @@ static void __apply_alternatives(void *alt_region, bool use_linear_alias)
                pr_info_once("patching kernel code\n");
                origptr = ALT_ORIG_PTR(alt);
-                updptr = use_linear_alias ? lm_alias(origptr) : origptr;
+                updptr = is_module ? origptr : lm_alias(origptr);
                nr_inst = alt->orig_len / AARCH64_INSN_SIZE;
                if (alt->cpufeature < ARM64_CB_PATCH)
@@ -155,8 +178,20 @@ static void __apply_alternatives(void *alt_region, bool use_linear_alias)
                alt_cb(alt, origptr, updptr, nr_inst);
-                flush_icache_range((uintptr_t)origptr,
+                if (!is_module) {
-                                   (uintptr_t)(origptr + nr_inst));
+                        clean_dcache_range_nopatch((u64)origptr,
+                                                   (u64)(origptr + nr_inst));
+                }
+        }
+        /*
+         * The core module code takes care of cache maintenance in
+         * flush_module_icache().
+         */
+        if (!is_module) {
+                dsb(ish);
+                __flush_icache_all();
+                isb();
        }
 }
@@ -178,7 +213,7 @@ static int __apply_alternatives_multi_stop(void *unused)
                isb();
        } else {
                BUG_ON(alternatives_applied);
-                __apply_alternatives(&region, true);
+                __apply_alternatives(&region, false);
                /* Barriers provided by the cache flushing */
                WRITE_ONCE(alternatives_applied, 1);
        }
@@ -192,12 +227,14 @@ void __init apply_alternatives_all(void)
        stop_machine(__apply_alternatives_multi_stop, NULL, cpu_online_mask);
 }
-void apply_alternatives(void *start, size_t length)
+#ifdef CONFIG_MODULES
+void apply_alternatives_module(void *start, size_t length)
 {
        struct alt_region region = {
                .begin  = start,
                .end    = start + length,
        };
-        __apply_alternatives(&region, false);
+        __apply_alternatives(&region, true);
 }
+#endif
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index d2856b129097..f24892a40d2c 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -937,7 +937,7 @@ static int __init parse_kpti(char *str)
        __kpti_forced = enabled ? 1 : -1;
        return 0;
 }
-__setup("kpti=", parse_kpti);
+early_param("kpti", parse_kpti);
 #endif  /* CONFIG_UNMAP_KERNEL_AT_EL0 */
 #ifdef CONFIG_ARM64_HW_AFDBM
diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
index 155fd91e78f4..f0f27aeefb73 100644
--- a/arch/arm64/kernel/module.c
+++ b/arch/arm64/kernel/module.c
@@ -448,9 +448,8 @@ int module_finalize(const Elf_Ehdr *hdr,
        const char *secstrs = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
        for (s = sechdrs, se = sechdrs + hdr->e_shnum; s < se; s++) {
-                if (strcmp(".altinstructions", secstrs + s->sh_name) == 0) {
+                if (strcmp(".altinstructions", secstrs + s->sh_name) == 0)
-                        apply_alternatives((void *)s->sh_addr, s->sh_size);
+                        apply_alternatives_module((void *)s->sh_addr, s->sh_size);
-                }
 #ifdef CONFIG_ARM64_MODULE_PLTS
                if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) &&
                    !strcmp(".text.ftrace_trampoline", secstrs + s->sh_name))
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index f3e2e3aec0b0..2faa9863d2e5 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -179,7 +179,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
 * This is the secondary CPU boot entry.  We're using this CPUs
 * idle thread stack, but a set of temporary page tables.
 */
-asmlinkage void secondary_start_kernel(void)
+asmlinkage notrace void secondary_start_kernel(void)
 {
        u64 mpidr = read_cpuid_mpidr() & MPIDR_HWID_BITMASK;
        struct mm_struct *mm = &init_mm;
diff --git a/arch/arm64/kvm/fpsimd.c b/arch/arm64/kvm/fpsimd.c
index dc6ecfa5a2d2..aac7808ce216 100644
--- a/arch/arm64/kvm/fpsimd.c
+++ b/arch/arm64/kvm/fpsimd.c
@@ -5,13 +5,14 @@
 * Copyright 2018 Arm Limited
 * Author: Dave Martin <Dave.Martin@arm.com>
 */
-#include <linux/bottom_half.h>
+#include <linux/irqflags.h>
 #include <linux/sched.h>
 #include <linux/thread_info.h>
 #include <linux/kvm_host.h>
 #include <asm/kvm_asm.h>
 #include <asm/kvm_host.h>
 #include <asm/kvm_mmu.h>
+#include <asm/sysreg.h>
 /*
 * Called on entry to KVM_RUN unless this vcpu previously ran at least
@@ -61,10 +62,16 @@ void kvm_arch_vcpu_load_fp(struct kvm_vcpu *vcpu)
 {
        BUG_ON(!current->mm);
-        vcpu->arch.flags &= ~(KVM_ARM64_FP_ENABLED | KVM_ARM64_HOST_SVE_IN_USE);
+        vcpu->arch.flags &= ~(KVM_ARM64_FP_ENABLED |
+                              KVM_ARM64_HOST_SVE_IN_USE |
+                              KVM_ARM64_HOST_SVE_ENABLED);
        vcpu->arch.flags |= KVM_ARM64_FP_HOST;
        if (test_thread_flag(TIF_SVE))
                vcpu->arch.flags |= KVM_ARM64_HOST_SVE_IN_USE;
+        if (read_sysreg(cpacr_el1) & CPACR_EL1_ZEN_EL0EN)
+                vcpu->arch.flags |= KVM_ARM64_HOST_SVE_ENABLED;
 }
 /*
@@ -92,19 +99,30 @@ void kvm_arch_vcpu_ctxsync_fp(struct kvm_vcpu *vcpu)
 */
 void kvm_arch_vcpu_put_fp(struct kvm_vcpu *vcpu)
 {
-        local_bh_disable();
+        unsigned long flags;
-        update_thread_flag(TIF_SVE,
+        local_irq_save(flags);
-                           vcpu->arch.flags & KVM_ARM64_HOST_SVE_IN_USE);
        if (vcpu->arch.flags & KVM_ARM64_FP_ENABLED) {
                /* Clean guest FP state to memory and invalidate cpu view */
                fpsimd_save();
                fpsimd_flush_cpu_state();
-        } else if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) {
+        } else if (system_supports_sve()) {
-                /* Ensure user trap controls are correctly restored */
+                /*
-                fpsimd_bind_task_to_cpu();
+                 * The FPSIMD/SVE state in the CPU has not been touched, and we
+                 * have SVE (and VHE): CPACR_EL1 (alias CPTR_EL2) has been
+                 * reset to CPACR_EL1_DEFAULT by the Hyp code, disabling SVE
+                 * for EL0.  To avoid spurious traps, restore the trap state
+                 * seen by kvm_arch_vcpu_load_fp():
+                 */
+                if (vcpu->arch.flags & KVM_ARM64_HOST_SVE_ENABLED)
+                        sysreg_clear_set(CPACR_EL1, 0, CPACR_EL1_ZEN_EL0EN);
+                else
+                        sysreg_clear_set(CPACR_EL1, CPACR_EL1_ZEN_EL0EN, 0);
        }
-        local_bh_enable();
+        update_thread_flag(TIF_SVE,
+                           vcpu->arch.flags & KVM_ARM64_HOST_SVE_IN_USE);
+        local_irq_restore(flags);
 }
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 49e217ac7e1e..61e93f0b5482 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -583,13 +583,14 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
                                                    size >> PAGE_SHIFT);
                        return NULL;
                }
-                if (!coherent)
-                        __dma_flush_area(page_to_virt(page), iosize);
                addr = dma_common_contiguous_remap(page, size, VM_USERMAP,
                                                   prot,
                                                   __builtin_return_address(0));
-                if (!addr) {
+                if (addr) {
+                        memset(addr, 0, size);
+                        if (!coherent)
+                                __dma_flush_area(page_to_virt(page), iosize);
+                } else {
                        iommu_dma_unmap_page(dev, *handle, iosize, 0, attrs);
                        dma_release_from_contiguous(dev, page,
                                                    size >> PAGE_SHIFT);
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 5f9a73a4452c..03646e6a2ef4 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -217,8 +217,9 @@ ENDPROC(idmap_cpu_replace_ttbr1)
        .macro __idmap_kpti_put_pgtable_ent_ng, type
        orr     \type, \type, #PTE_NG           // Same bit for blocks and pages
-        str     \type, [cur_\()\type\()p]       // Update the entry and ensure it
+        str     \type, [cur_\()\type\()p]       // Update the entry and ensure
-        dc      civac, cur_\()\type\()p         // is visible to all CPUs.
+        dmb     sy                              // that it is visible to all
+        dc      civac, cur_\()\type\()p         // CPUs.
        .endm
 /*
diff --git a/arch/microblaze/Kconfig.debug b/arch/microblaze/Kconfig.debug
index 331a3bb66297..93a737c8d1a6 100644
--- a/arch/microblaze/Kconfig.debug
+++ b/arch/microblaze/Kconfig.debug
@@ -8,11 +8,4 @@ config TRACE_IRQFLAGS_SUPPORT
 source "lib/Kconfig.debug"
-config HEART_BEAT
-        bool "Heart beat function for kernel"
-        default n
-        help
-          This option turns on/off heart beat kernel functionality.
-          First GPIO node is taken.
 endmenu
diff --git a/arch/microblaze/include/asm/setup.h b/arch/microblaze/include/asm/setup.h
index d5384f6f36f7..ce9b7b786156 100644
--- a/arch/microblaze/include/asm/setup.h
+++ b/arch/microblaze/include/asm/setup.h
@@ -19,15 +19,10 @@ extern char cmd_line[COMMAND_LINE_SIZE];
 extern char *klimit;
-void microblaze_heartbeat(void);
-void microblaze_setup_heartbeat(void);
 #   ifdef CONFIG_MMU
 extern void mmu_reset(void);
 #   endif /* CONFIG_MMU */
-extern void of_platform_reset_gpio_probe(void);
 void time_init(void);
 void init_IRQ(void);
 void machine_early_init(const char *cmdline, unsigned int ram,
diff --git a/arch/microblaze/include/asm/unistd.h b/arch/microblaze/include/asm/unistd.h
index 9774e1d9507b..a62d09420a47 100644
--- a/arch/microblaze/include/asm/unistd.h
+++ b/arch/microblaze/include/asm/unistd.h
@@ -38,6 +38,6 @@
 #endif /* __ASSEMBLY__ */
-#define __NR_syscalls         399
+#define __NR_syscalls         401
 #endif /* _ASM_MICROBLAZE_UNISTD_H */
diff --git a/arch/microblaze/include/uapi/asm/unistd.h b/arch/microblaze/include/uapi/asm/unistd.h
index eb156f914793..7a9f16a76413 100644
--- a/arch/microblaze/include/uapi/asm/unistd.h
+++ b/arch/microblaze/include/uapi/asm/unistd.h
@@ -415,5 +415,7 @@
 #define __NR_pkey_alloc         396
 #define __NR_pkey_free          397
 #define __NR_statx              398
+#define __NR_io_pgetevents      399
+#define __NR_rseq               400
 #endif /* _UAPI_ASM_MICROBLAZE_UNISTD_H */
diff --git a/arch/microblaze/kernel/Makefile b/arch/microblaze/kernel/Makefile
index 7e99cf6984a1..dd71637437f4 100644
--- a/arch/microblaze/kernel/Makefile
+++ b/arch/microblaze/kernel/Makefile
@@ -8,7 +8,6 @@ ifdef CONFIG_FUNCTION_TRACER
 CFLAGS_REMOVE_timer.o = -pg
 CFLAGS_REMOVE_intc.o = -pg
 CFLAGS_REMOVE_early_printk.o = -pg
-CFLAGS_REMOVE_heartbeat.o = -pg
 CFLAGS_REMOVE_ftrace.o = -pg
 CFLAGS_REMOVE_process.o = -pg
 endif
@@ -17,12 +16,11 @@ extra-y := head.o vmlinux.lds
 obj-y += dma.o exceptions.o \
        hw_exception_handler.o irq.o \
-        platform.o process.o prom.o ptrace.o \
+        process.o prom.o ptrace.o \
        reset.o setup.o signal.o sys_microblaze.o timer.o traps.o unwind.o
 obj-y += cpu/
-obj-$(CONFIG_HEART_BEAT)        += heartbeat.o
 obj-$(CONFIG_MODULES)           += microblaze_ksyms.o module.o
 obj-$(CONFIG_MMU)               += misc.o
 obj-$(CONFIG_STACKTRACE)        += stacktrace.o
diff --git a/arch/microblaze/kernel/heartbeat.c b/arch/microblaze/kernel/heartbeat.c
deleted file mode 100644
index 2022130139d2..000000000000
--- a/arch/microblaze/kernel/heartbeat.c
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright (C) 2007-2009 Michal Simek <monstr@monstr.eu>
- * Copyright (C) 2007-2009 PetaLogix
- * Copyright (C) 2006 Atmark Techno, Inc.
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License. See the file "COPYING" in the main directory of this archive
- * for more details.
- */
-#include <linux/sched.h>
-#include <linux/sched/loadavg.h>
-#include <linux/io.h>
-#include <asm/setup.h>
-#include <asm/page.h>
-#include <asm/prom.h>
-static unsigned int base_addr;
-void microblaze_heartbeat(void)
-{
-        static unsigned int cnt, period, dist;
-        if (base_addr) {
-                if (cnt == 0 || cnt == dist)
-                        out_be32(base_addr, 1);
-                else if (cnt == 7 || cnt == dist + 7)
-                        out_be32(base_addr, 0);
-                if (++cnt > period) {
-                        cnt = 0;
-                        /*
-                         * The hyperbolic function below modifies the heartbeat
-                         * period length in dependency of the current (5min)
-                         * load. It goes through the points f(0)=126, f(1)=86,
-                         * f(5)=51, f(inf)->30.
-                         */
-                        period = ((672 << FSHIFT) / (5 * avenrun[0] +
-                                                (7 << FSHIFT))) + 30;
-                        dist = period / 4;
-                }
-        }
-}
-void microblaze_setup_heartbeat(void)
-{
-        struct device_node *gpio = NULL;
-        int *prop;
-        int j;
-        const char * const gpio_list[] = {
-                "xlnx,xps-gpio-1.00.a",
-                NULL
-        };
-        for (j = 0; gpio_list[j] != NULL; j++) {
-                gpio = of_find_compatible_node(NULL, NULL, gpio_list[j]);
-                if (gpio)
-                        break;
-        }
-        if (gpio) {
-                base_addr = be32_to_cpup(of_get_property(gpio, "reg", NULL));
-                base_addr = (unsigned long) ioremap(base_addr, PAGE_SIZE);
-                pr_notice("Heartbeat GPIO at 0x%x\n", base_addr);
-                /* GPIO is configured as output */
-                prop = (int *) of_get_property(gpio, "xlnx,is-bidir", NULL);
-                if (prop)
-                        out_be32(base_addr + 4, 0);
-        }
-}
diff --git a/arch/microblaze/kernel/platform.c b/arch/microblaze/kernel/platform.c
deleted file mode 100644
index 2540d60610d9..000000000000
--- a/arch/microblaze/kernel/platform.c
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright 2008 Michal Simek <monstr@monstr.eu>
- *
- * based on virtex.c file
- *
- * Copyright 2007 Secret Lab Technologies Ltd.
- *
- * This file is licensed under the terms of the GNU General Public License
- * version 2. This program is licensed "as is" without any warranty of any
- * kind, whether express or implied.
- */
-#include <linux/init.h>
-#include <linux/of_platform.h>
-#include <asm/setup.h>
-static struct of_device_id xilinx_of_bus_ids[] __initdata = {
-        { .compatible = "simple-bus", },
-        { .compatible = "xlnx,compound", },
-        {}
-};
-static int __init microblaze_device_probe(void)
-{
-        of_platform_bus_probe(NULL, xilinx_of_bus_ids, NULL);
-        of_platform_reset_gpio_probe();
-        return 0;
-}
-device_initcall(microblaze_device_probe);
diff --git a/arch/microblaze/kernel/reset.c b/arch/microblaze/kernel/reset.c
index bab4c8330ef4..fcbe1daf6316 100644
--- a/arch/microblaze/kernel/reset.c
+++ b/arch/microblaze/kernel/reset.c
@@ -18,7 +18,7 @@
 static int handle; /* reset pin handle */
 static unsigned int reset_val;
-void of_platform_reset_gpio_probe(void)
+static int of_platform_reset_gpio_probe(void)
 {
        int ret;
        handle = of_get_named_gpio(of_find_node_by_path("/"),
@@ -27,13 +27,13 @@ void of_platform_reset_gpio_probe(void)
        if (!gpio_is_valid(handle)) {
                pr_info("Skipping unavailable RESET gpio %d (%s)\n",
                                handle, "reset");
-                return;
+                return -ENODEV;
        }
        ret = gpio_request(handle, "reset");
        if (ret < 0) {
                pr_info("GPIO pin is already allocated\n");
-                return;
+                return ret;
        }
        /* get current setup value */
@@ -51,11 +51,12 @@ void of_platform_reset_gpio_probe(void)
        pr_info("RESET: Registered gpio device: %d, current val: %d\n",
                                                        handle, reset_val);
-        return;
+        return 0;
 err:
        gpio_free(handle);
-        return;
+        return ret;
 }
+device_initcall(of_platform_reset_gpio_probe);
 static void gpio_system_reset(void)
diff --git a/arch/microblaze/kernel/syscall_table.S b/arch/microblaze/kernel/syscall_table.S
index 56bcf313121f..6ab650593792 100644
--- a/arch/microblaze/kernel/syscall_table.S
+++ b/arch/microblaze/kernel/syscall_table.S
@@ -400,3 +400,5 @@ ENTRY(sys_call_table)
        .long sys_pkey_alloc
        .long sys_pkey_free
        .long sys_statx
+        .long sys_io_pgetevents
+        .long sys_rseq
diff --git a/arch/microblaze/kernel/timer.c b/arch/microblaze/kernel/timer.c
index 7de941cbbd94..a6683484b3a1 100644
--- a/arch/microblaze/kernel/timer.c
+++ b/arch/microblaze/kernel/timer.c
@@ -156,9 +156,6 @@ static inline void timer_ack(void)
 static irqreturn_t timer_interrupt(int irq, void *dev_id)
 {
        struct clock_event_device *evt = &clockevent_xilinx_timer;
-#ifdef CONFIG_HEART_BEAT
-        microblaze_heartbeat();
-#endif
        timer_ack();
        evt->event_handler(evt);
        return IRQ_HANDLED;
@@ -318,10 +315,6 @@ static int __init xilinx_timer_init(struct device_node *timer)
                return ret;
        }
-#ifdef CONFIG_HEART_BEAT
-        microblaze_setup_heartbeat();
-#endif
        ret = xilinx_clocksource_init();
        if (ret)
                return ret;
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 3f9deec70b92..08c10c518f83 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -65,6 +65,7 @@ config MIPS
        select HAVE_OPROFILE
        select HAVE_PERF_EVENTS
        select HAVE_REGS_AND_STACK_ACCESS_API
+        select HAVE_RSEQ
        select HAVE_STACKPROTECTOR
        select HAVE_SYSCALL_TRACEPOINTS
        select HAVE_VIRT_CPU_ACCOUNTING_GEN if 64BIT || !SMP
diff --git a/arch/mips/ath79/mach-pb44.c b/arch/mips/ath79/mach-pb44.c
index 6b2c6f3baefa..75fb96ca61db 100644
--- a/arch/mips/ath79/mach-pb44.c
+++ b/arch/mips/ath79/mach-pb44.c
@@ -34,7 +34,7 @@
 #define PB44_KEYS_DEBOUNCE_INTERVAL     (3 * PB44_KEYS_POLL_INTERVAL)
 static struct gpiod_lookup_table pb44_i2c_gpiod_table = {
-        .dev_id = "i2c-gpio",
+        .dev_id = "i2c-gpio.0",
        .table = {
                GPIO_LOOKUP_IDX("ath79-gpio", PB44_GPIO_I2C_SDA,
                                NULL, 0, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c
index 6054d49e608e..8c9cbf13d32a 100644
--- a/arch/mips/bcm47xx/setup.c
+++ b/arch/mips/bcm47xx/setup.c
@@ -212,6 +212,12 @@ static int __init bcm47xx_cpu_fixes(void)
                 */
                if (bcm47xx_bus.bcma.bus.chipinfo.id == BCMA_CHIP_ID_BCM4706)
                        cpu_wait = NULL;
+                /*
+                 * BCM47XX Erratum "R10: PCIe Transactions Periodically Fail"
+                 * Enable ExternalSync for sync instruction to take effect
+                 */
+                set_c0_config7(MIPS_CONF7_ES);
                break;
 #endif
        }
diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
index a7d0b836f2f7..cea8ad864b3f 100644
--- a/arch/mips/include/asm/io.h
+++ b/arch/mips/include/asm/io.h
@@ -414,6 +414,8 @@ static inline type pfx##in##bwlq##p(unsigned long port)			\
        __val = *__addr;                                                \
        slow;                                                           \
                                                                        \
+        /* prevent prefetching of coherent DMA data prematurely */      \
+        rmb();                                                          \
        return pfx##ioswab##bwlq(__addr, __val);                        \
 }
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index ae461d91cd1f..0bc270806ec5 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -681,6 +681,8 @@
 #define MIPS_CONF7_WII          (_ULCAST_(1) << 31)
 #define MIPS_CONF7_RPS          (_ULCAST_(1) << 2)
+/* ExternalSync */
+#define MIPS_CONF7_ES           (_ULCAST_(1) << 8)
 #define MIPS_CONF7_IAR          (_ULCAST_(1) << 10)
 #define MIPS_CONF7_AR           (_ULCAST_(1) << 16)
@@ -2765,6 +2767,7 @@ __BUILD_SET_C0(status)
 __BUILD_SET_C0(cause)
 __BUILD_SET_C0(config)
 __BUILD_SET_C0(config5)
+__BUILD_SET_C0(config7)
 __BUILD_SET_C0(intcontrol)
 __BUILD_SET_C0(intctl)
 __BUILD_SET_C0(srsmap)
diff --git a/arch/mips/include/uapi/asm/unistd.h b/arch/mips/include/uapi/asm/unistd.h
index bb05e9916a5f..f25dd1d83fb7 100644
--- a/arch/mips/include/uapi/asm/unistd.h
+++ b/arch/mips/include/uapi/asm/unistd.h
@@ -388,17 +388,19 @@
 #define __NR_pkey_alloc                 (__NR_Linux + 364)
 #define __NR_pkey_free                  (__NR_Linux + 365)
 #define __NR_statx                      (__NR_Linux + 366)
+#define __NR_rseq                       (__NR_Linux + 367)
+#define __NR_io_pgetevents              (__NR_Linux + 368)
 /*
 * Offset of the last Linux o32 flavoured syscall
 */
-#define __NR_Linux_syscalls             366
+#define __NR_Linux_syscalls             368
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         366
+#define __NR_O32_Linux_syscalls         368
 #if _MIPS_SIM == _MIPS_SIM_ABI64
@@ -733,16 +735,18 @@
 #define __NR_pkey_alloc                 (__NR_Linux + 324)
 #define __NR_pkey_free                  (__NR_Linux + 325)
 #define __NR_statx                      (__NR_Linux + 326)
+#define __NR_rseq                       (__NR_Linux + 327)
+#define __NR_io_pgetevents              (__NR_Linux + 328)
 /*
 * Offset of the last Linux 64-bit flavoured syscall
 */
-#define __NR_Linux_syscalls             326
+#define __NR_Linux_syscalls             328
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          326
+#define __NR_64_Linux_syscalls          328
 #if _MIPS_SIM == _MIPS_SIM_NABI32
@@ -1081,15 +1085,17 @@
 #define __NR_pkey_alloc                 (__NR_Linux + 328)
 #define __NR_pkey_free                  (__NR_Linux + 329)
 #define __NR_statx                      (__NR_Linux + 330)
+#define __NR_rseq                       (__NR_Linux + 331)
+#define __NR_io_pgetevents              (__NR_Linux + 332)
 /*
 * Offset of the last N32 flavoured syscall
 */
-#define __NR_Linux_syscalls             330
+#define __NR_Linux_syscalls             332
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         330
+#define __NR_N32_Linux_syscalls         332
 #endif /* _UAPI_ASM_UNISTD_H */
diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
index 38a302919e6b..d7de8adcfcc8 100644
--- a/arch/mips/kernel/entry.S
+++ b/arch/mips/kernel/entry.S
@@ -79,6 +79,10 @@ FEXPORT(ret_from_fork)
        jal     schedule_tail           # a0 = struct task_struct *prev
 FEXPORT(syscall_exit)
+#ifdef CONFIG_DEBUG_RSEQ
+        move    a0, sp
+        jal     rseq_syscall
+#endif
        local_irq_disable               # make sure need_resched and
                                        # signals dont change between
                                        # sampling and return
@@ -141,6 +145,10 @@ work_notifysig:				# deal with pending signals and
        j       resume_userspace_check
 FEXPORT(syscall_exit_partial)
+#ifdef CONFIG_DEBUG_RSEQ
+        move    a0, sp
+        jal     rseq_syscall
+#endif
        local_irq_disable               # make sure need_resched doesn't
                                        # change between and return
        LONG_L  a2, TI_FLAGS($28)       # current->work
diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S
index f2ee7e1e3342..cff52b283e03 100644
--- a/arch/mips/kernel/mcount.S
+++ b/arch/mips/kernel/mcount.S
@@ -119,10 +119,20 @@ NESTED(_mcount, PT_SIZE, ra)
 EXPORT_SYMBOL(_mcount)
        PTR_LA  t1, ftrace_stub
        PTR_L   t2, ftrace_trace_function /* Prepare t2 for (1) */
-        bne     t1, t2, static_trace
+        beq     t1, t2, fgraph_trace
         nop
+        MCOUNT_SAVE_REGS
+        move    a0, ra          /* arg1: self return address */
+        jalr    t2              /* (1) call *ftrace_trace_function */
+         move   a1, AT          /* arg2: parent's return address */
+        MCOUNT_RESTORE_REGS
+fgraph_trace:
 #ifdef  CONFIG_FUNCTION_GRAPH_TRACER
+        PTR_LA  t1, ftrace_stub
        PTR_L   t3, ftrace_graph_return
        bne     t1, t3, ftrace_graph_caller
         nop
@@ -131,24 +141,11 @@ EXPORT_SYMBOL(_mcount)
        bne     t1, t3, ftrace_graph_caller
         nop
 #endif
-        b       ftrace_stub
-#ifdef CONFIG_32BIT
-         addiu sp, sp, 8
-#else
-         nop
-#endif
-static_trace:
-        MCOUNT_SAVE_REGS
-        move    a0, ra          /* arg1: self return address */
-        jalr    t2              /* (1) call *ftrace_trace_function */
-         move   a1, AT          /* arg2: parent's return address */
-        MCOUNT_RESTORE_REGS
 #ifdef CONFIG_32BIT
        addiu sp, sp, 8
 #endif
        .globl ftrace_stub
 ftrace_stub:
        RETURN_BACK
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index a9a7d78803cd..91d3c8c46097 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -590,3 +590,5 @@ EXPORT(sys_call_table)
        PTR     sys_pkey_alloc
        PTR     sys_pkey_free                   /* 4365 */
        PTR     sys_statx
+        PTR     sys_rseq
+        PTR     sys_io_pgetevents
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index 65d5aeeb9bdb..358d9599983d 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -439,4 +439,6 @@ EXPORT(sys_call_table)
        PTR     sys_pkey_alloc
        PTR     sys_pkey_free                   /* 5325 */
        PTR     sys_statx
+        PTR     sys_rseq
+        PTR     sys_io_pgetevents
        .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index cbf190ef9e8a..c65eaacc1abf 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -434,4 +434,6 @@ EXPORT(sysn32_call_table)
        PTR     sys_pkey_alloc
        PTR     sys_pkey_free
        PTR     sys_statx                       /* 6330 */
+        PTR     sys_rseq
+        PTR     compat_sys_io_pgetevents
        .size   sysn32_call_table,.-sysn32_call_table
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 9ebe3e2403b1..73913f072e39 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -583,4 +583,6 @@ EXPORT(sys32_call_table)
        PTR     sys_pkey_alloc
        PTR     sys_pkey_free                   /* 4365 */
        PTR     sys_statx
+        PTR     sys_rseq
+        PTR     compat_sys_io_pgetevents
        .size   sys32_call_table,.-sys32_call_table
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index 9e224469c788..0a9cfe7a0372 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -801,6 +801,8 @@ static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
                regs->regs[0] = 0;              /* Don't deal with this again.  */
        }
+        rseq_signal_deliver(ksig, regs);
        if (sig_uses_siginfo(&ksig->ka, abi))
                ret = abi->setup_rt_frame(vdso + abi->vdso->off_rt_sigreturn,
                                          ksig, regs, oldset);
@@ -868,6 +870,7 @@ asmlinkage void do_notify_resume(struct pt_regs *regs, void *unused,
        if (thread_info_flags & _TIF_NOTIFY_RESUME) {
                clear_thread_flag(TIF_NOTIFY_RESUME);
                tracehook_notify_resume(regs);
+                rseq_handle_notify_resume(NULL, regs);
        }
        user_enter();
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index c480770fabcd..17526bebcbd2 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -244,11 +244,11 @@ config PARISC_PAGE_SIZE_4KB
 config PARISC_PAGE_SIZE_16KB
        bool "16KB"
-        depends on PA8X00
+        depends on PA8X00 && BROKEN
 config PARISC_PAGE_SIZE_64KB
        bool "64KB"
-        depends on PA8X00
+        depends on PA8X00 && BROKEN
 endchoice
@@ -347,7 +347,7 @@ config NR_CPUS
        int "Maximum number of CPUs (2-32)"
        range 2 32
        depends on SMP
-        default "32"
+        default "4"
 endmenu
diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
index 714284ea6cc2..5ce030266e7d 100644
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -65,10 +65,6 @@ endif
 # kernel.
 cflags-y        += -mdisable-fpregs
-# Without this, "ld -r" results in .text sections that are too big
-# (> 0x40000) for branches to reach stubs.
-cflags-y        += -ffunction-sections
 # Use long jumps instead of long branches (needed if your linker fails to
 # link a too big vmlinux executable). Not enabled for building modules.
 ifdef CONFIG_MLONGCALLS
diff --git a/arch/parisc/include/asm/signal.h b/arch/parisc/include/asm/signal.h
index eeb5c8858663..715c96ba2ec8 100644
--- a/arch/parisc/include/asm/signal.h
+++ b/arch/parisc/include/asm/signal.h
@@ -21,14 +21,6 @@ typedef struct {
        unsigned long sig[_NSIG_WORDS];
 } sigset_t;
-#ifndef __KERNEL__
-struct sigaction {
-        __sighandler_t sa_handler;
-        unsigned long sa_flags;
-        sigset_t sa_mask;               /* mask last for extensibility */
-};
-#endif
 #include <asm/sigcontext.h>
 #endif /* !__ASSEMBLY */
diff --git a/arch/parisc/include/uapi/asm/unistd.h b/arch/parisc/include/uapi/asm/unistd.h
index 4872e77aa96b..dc77c5a51db7 100644
--- a/arch/parisc/include/uapi/asm/unistd.h
+++ b/arch/parisc/include/uapi/asm/unistd.h
@@ -364,8 +364,9 @@
 #define __NR_preadv2            (__NR_Linux + 347)
 #define __NR_pwritev2           (__NR_Linux + 348)
 #define __NR_statx              (__NR_Linux + 349)
+#define __NR_io_pgetevents      (__NR_Linux + 350)
-#define __NR_Linux_syscalls     (__NR_statx + 1)
+#define __NR_Linux_syscalls     (__NR_io_pgetevents + 1)
 #define __IGNORE_select         /* newselect */
diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
index e0e1c9775c32..5eb979d04b90 100644
--- a/arch/parisc/kernel/drivers.c
+++ b/arch/parisc/kernel/drivers.c
@@ -154,17 +154,14 @@ int register_parisc_driver(struct parisc_driver *driver)
 {
        /* FIXME: we need this because apparently the sti
         * driver can be registered twice */
-        if(driver->drv.name) {
+        if (driver->drv.name) {
-                printk(KERN_WARNING 
+                pr_warn("BUG: skipping previously registered driver %s\n",
-                       "BUG: skipping previously registered driver %s\n",
+                        driver->name);
-                       driver->name);
                return 1;
        }
        if (!driver->probe) {
-                printk(KERN_WARNING 
+                pr_warn("BUG: driver %s has no probe routine\n", driver->name);
-                       "BUG: driver %s has no probe routine\n",
-                       driver->name);
                return 1;
        }
@@ -491,12 +488,9 @@ alloc_pa_dev(unsigned long hpa, struct hardware_path *mod_path)
        dev = create_parisc_device(mod_path);
        if (dev->id.hw_type != HPHW_FAULTY) {
-                printk(KERN_ERR "Two devices have hardware path [%s].  "
+                pr_err("Two devices have hardware path [%s].  IODC data for second device: %7phN\n"
-                                "IODC data for second device: "
+                       "Rearranging GSC cards sometimes helps\n",
-                                "%02x%02x%02x%02x%02x%02x\n"
+                        parisc_pathname(dev), iodc_data);
-                                "Rearranging GSC cards sometimes helps\n",
-                        parisc_pathname(dev), iodc_data[0], iodc_data[1],
-                        iodc_data[3], iodc_data[4], iodc_data[5], iodc_data[6]);
                return NULL;
        }
@@ -528,8 +522,7 @@ alloc_pa_dev(unsigned long hpa, struct hardware_path *mod_path)
         * the keyboard controller
         */
        if ((hpa & 0xfff) == 0 && insert_resource(&iomem_resource, &dev->hpa))
-                printk("Unable to claim HPA %lx for device %s\n",
+                pr_warn("Unable to claim HPA %lx for device %s\n", hpa, name);
-                                hpa, name);
        return dev;
 }
@@ -875,7 +868,7 @@ static void print_parisc_device(struct parisc_device *dev)
        static int count;
        print_pa_hwpath(dev, hw_path);
-        printk(KERN_INFO "%d. %s at 0x%px [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }",
+        pr_info("%d. %s at 0x%px [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }",
                ++count, dev->name, (void*) dev->hpa.start, hw_path, dev->id.hw_type,
                dev->id.hversion_rev, dev->id.hversion, dev->id.sversion);
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 6308749359e4..fe3f2a49d2b1 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -445,6 +445,7 @@
        ENTRY_COMP(preadv2)
        ENTRY_COMP(pwritev2)
        ENTRY_SAME(statx)
+        ENTRY_COMP(io_pgetevents)       /* 350 */
 .ifne (. - 90b) - (__NR_Linux_syscalls * (91b - 90b))
diff --git a/arch/parisc/kernel/unwind.c b/arch/parisc/kernel/unwind.c
index 143f90e2f9f3..2ef83d78eec4 100644
--- a/arch/parisc/kernel/unwind.c
+++ b/arch/parisc/kernel/unwind.c
@@ -25,7 +25,7 @@
 /* #define DEBUG 1 */
 #ifdef DEBUG
-#define dbg(x...) printk(x)
+#define dbg(x...) pr_debug(x)
 #else
 #define dbg(x...)
 #endif
@@ -182,7 +182,7 @@ int __init unwind_init(void)
        start = (long)&__start___unwind[0];
        stop = (long)&__stop___unwind[0];
-        printk("unwind_init: start = 0x%lx, end = 0x%lx, entries = %lu\n", 
+        dbg("unwind_init: start = 0x%lx, end = 0x%lx, entries = %lu\n",
            start, stop,
            (stop - start) / sizeof(struct unwind_table_entry));
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index bd06a3ccda31..2ea575cb3401 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -244,6 +244,7 @@ cpu-as-$(CONFIG_4xx)		+= -Wa,-m405
 cpu-as-$(CONFIG_ALTIVEC)        += $(call as-option,-Wa$(comma)-maltivec)
 cpu-as-$(CONFIG_E200)           += -Wa,-me200
 cpu-as-$(CONFIG_PPC_BOOK3S_64)  += -Wa,-mpower4
+cpu-as-$(CONFIG_PPC_E500MC)     += $(call as-option,-Wa$(comma)-me500mc)
 KBUILD_AFLAGS += $(cpu-as-y)
 KBUILD_CFLAGS += $(cpu-as-y)
diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h b/arch/powerpc/include/asm/book3s/32/pgalloc.h
index 6a6673907e45..82e44b1a00ae 100644
--- a/arch/powerpc/include/asm/book3s/32/pgalloc.h
+++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h
@@ -108,6 +108,7 @@ static inline void pgtable_free(void *table, unsigned index_size)
 }
 #define check_pgt_cache()       do { } while (0)
+#define get_hugepd_cache_index(x)  (x)
 #ifdef CONFIG_SMP
 static inline void pgtable_free_tlb(struct mmu_gather *tlb,
@@ -137,7 +138,6 @@ static inline void pgtable_free_tlb(struct mmu_gather *tlb,
 static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t table,
                                  unsigned long address)
 {
-        pgtable_page_dtor(table);
        pgtable_free_tlb(tlb, page_address(table), 0);
 }
 #endif /* _ASM_POWERPC_BOOK3S_32_PGALLOC_H */
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable-4k.h b/arch/powerpc/include/asm/book3s/64/pgtable-4k.h
index af5f2baac80f..a069dfcac9a9 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable-4k.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable-4k.h
@@ -49,6 +49,27 @@ static inline int hugepd_ok(hugepd_t hpd)
 }
 #define is_hugepd(hpd)          (hugepd_ok(hpd))
+/*
+ * 16M and 16G huge page directory tables are allocated from slab cache
+ *
+ */
+#define H_16M_CACHE_INDEX (PAGE_SHIFT + H_PTE_INDEX_SIZE + H_PMD_INDEX_SIZE - 24)
+#define H_16G_CACHE_INDEX                                                      \
+        (PAGE_SHIFT + H_PTE_INDEX_SIZE + H_PMD_INDEX_SIZE + H_PUD_INDEX_SIZE - 34)
+static inline int get_hugepd_cache_index(int index)
+{
+        switch (index) {
+        case H_16M_CACHE_INDEX:
+                return HTLB_16M_INDEX;
+        case H_16G_CACHE_INDEX:
+                return HTLB_16G_INDEX;
+        default:
+                BUG();
+        }
+        /* should not reach */
+}
 #else /* !CONFIG_HUGETLB_PAGE */
 static inline int pmd_huge(pmd_t pmd) { return 0; }
 static inline int pud_huge(pud_t pud) { return 0; }
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable-64k.h b/arch/powerpc/include/asm/book3s/64/pgtable-64k.h
index fb4b3ba52339..d7ee249d6890 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable-64k.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable-64k.h
@@ -45,8 +45,17 @@ static inline int hugepd_ok(hugepd_t hpd)
 {
        return 0;
 }
 #define is_hugepd(pdep)                 0
+/*
+ * This should never get called
+ */
+static inline int get_hugepd_cache_index(int index)
+{
+        BUG();
+}
 #else /* !CONFIG_HUGETLB_PAGE */
 static inline int pmd_huge(pmd_t pmd) { return 0; }
 static inline int pud_huge(pud_t pud) { return 0; }
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index 63cee159022b..42aafba7a308 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -287,6 +287,11 @@ enum pgtable_index {
        PMD_INDEX,
        PUD_INDEX,
        PGD_INDEX,
+        /*
+         * Below are used with 4k page size and hugetlb
+         */
+        HTLB_16M_INDEX,
+        HTLB_16G_INDEX,
 };
 extern unsigned long __vmalloc_start;
diff --git a/arch/powerpc/include/asm/nmi.h b/arch/powerpc/include/asm/nmi.h
index 0f571e0ebca1..bd9ba8defd72 100644
--- a/arch/powerpc/include/asm/nmi.h
+++ b/arch/powerpc/include/asm/nmi.h
@@ -8,7 +8,7 @@ extern void arch_touch_nmi_watchdog(void);
 static inline void arch_touch_nmi_watchdog(void) {}
 #endif
-#if defined(CONFIG_PPC_BOOK3S_64) && defined(CONFIG_STACKTRACE)
+#if defined(CONFIG_NMI_IPI) && defined(CONFIG_STACKTRACE)
 extern void arch_trigger_cpumask_backtrace(const cpumask_t *mask,
                                           bool exclude_self);
 #define arch_trigger_cpumask_backtrace arch_trigger_cpumask_backtrace
diff --git a/arch/powerpc/include/asm/nohash/32/pgalloc.h b/arch/powerpc/include/asm/nohash/32/pgalloc.h
index 1707781d2f20..8825953c225b 100644
--- a/arch/powerpc/include/asm/nohash/32/pgalloc.h
+++ b/arch/powerpc/include/asm/nohash/32/pgalloc.h
@@ -109,6 +109,7 @@ static inline void pgtable_free(void *table, unsigned index_size)
 }
 #define check_pgt_cache()       do { } while (0)
+#define get_hugepd_cache_index(x)       (x)
 #ifdef CONFIG_SMP
 static inline void pgtable_free_tlb(struct mmu_gather *tlb,
@@ -139,7 +140,6 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t table,
                                  unsigned long address)
 {
        tlb_flush_pgtable(tlb, address);
-        pgtable_page_dtor(table);
        pgtable_free_tlb(tlb, page_address(table), 0);
 }
 #endif /* _ASM_POWERPC_PGALLOC_32_H */
diff --git a/arch/powerpc/include/asm/nohash/64/pgalloc.h b/arch/powerpc/include/asm/nohash/64/pgalloc.h
index 0e693f322cb2..e2d62d033708 100644
--- a/arch/powerpc/include/asm/nohash/64/pgalloc.h
+++ b/arch/powerpc/include/asm/nohash/64/pgalloc.h
@@ -141,6 +141,7 @@ static inline void pgtable_free(void *table, int shift)
        }
 }
+#define get_hugepd_cache_index(x)       (x)
 #ifdef CONFIG_SMP
 static inline void pgtable_free_tlb(struct mmu_gather *tlb, void *table, int shift)
 {
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index cfcf6a874cfa..01b5171ea189 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -393,3 +393,4 @@ SYSCALL(pkey_alloc)
 SYSCALL(pkey_free)
 SYSCALL(pkey_mprotect)
 SYSCALL(rseq)
+COMPAT_SYS(io_pgetevents)
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index 1e9708632dce..c19379f0a32e 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -12,7 +12,7 @@
 #include <uapi/asm/unistd.h>
-#define NR_syscalls             388
+#define NR_syscalls             389
 #define __NR__exit __NR_exit
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index ac5ba55066dd..985534d0b448 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -399,5 +399,6 @@
 #define __NR_pkey_free          385
 #define __NR_pkey_mprotect      386
 #define __NR_rseq               387
+#define __NR_io_pgetevents      388
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
index 4be1c0de9406..96dd3d871986 100644
--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
+++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
@@ -711,7 +711,8 @@ static __init void cpufeatures_cpu_quirks(void)
                cur_cpu_spec->cpu_features |= CPU_FTR_P9_TM_HV_ASSIST;
                cur_cpu_spec->cpu_features |= CPU_FTR_P9_TM_XER_SO_BUG;
                cur_cpu_spec->cpu_features |= CPU_FTR_POWER9_DD2_1;
-        } else /* DD2.1 and up have DD2_1 */
+        } else if ((version & 0xffff0000) == 0x004e0000)
+                /* DD2.1 and up have DD2_1 */
                cur_cpu_spec->cpu_features |= CPU_FTR_POWER9_DD2_1;
        if ((version & 0xffff0000) == 0x004e0000) {
diff --git a/arch/powerpc/kernel/pci_32.c b/arch/powerpc/kernel/pci_32.c
index 4f861055a852..d63b488d34d7 100644
--- a/arch/powerpc/kernel/pci_32.c
+++ b/arch/powerpc/kernel/pci_32.c
@@ -285,9 +285,6 @@ pci_bus_to_hose(int bus)
 * Note that the returned IO or memory base is a physical address
 */
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wpragmas"
-#pragma GCC diagnostic ignored "-Wattribute-alias"
 SYSCALL_DEFINE3(pciconfig_iobase, long, which,
                unsigned long, bus, unsigned long, devfn)
 {
@@ -313,4 +310,3 @@ SYSCALL_DEFINE3(pciconfig_iobase, long, which,
        return result;
 }
-#pragma GCC diagnostic pop
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index 812171c09f42..dff28f903512 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -203,9 +203,6 @@ void pcibios_setup_phb_io_space(struct pci_controller *hose)
 #define IOBASE_ISA_IO           3
 #define IOBASE_ISA_MEM          4
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wpragmas"
-#pragma GCC diagnostic ignored "-Wattribute-alias"
 SYSCALL_DEFINE3(pciconfig_iobase, long, which, unsigned long, in_bus,
                          unsigned long, in_devfn)
 {
@@ -259,7 +256,6 @@ SYSCALL_DEFINE3(pciconfig_iobase, long, which, unsigned long, in_bus,
        return -EOPNOTSUPP;
 }
-#pragma GCC diagnostic pop
 #ifdef CONFIG_NUMA
 int pcibus_to_node(struct pci_bus *bus)
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index 7fb9f83dcde8..8afd146bc9c7 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -1051,9 +1051,6 @@ struct pseries_errorlog *get_pseries_errorlog(struct rtas_error_log *log,
 }
 /* We assume to be passed big endian arguments */
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wpragmas"
-#pragma GCC diagnostic ignored "-Wattribute-alias"
 SYSCALL_DEFINE1(rtas, struct rtas_args __user *, uargs)
 {
        struct rtas_args args;
@@ -1140,7 +1137,6 @@ SYSCALL_DEFINE1(rtas, struct rtas_args __user *, uargs)
        return 0;
 }
-#pragma GCC diagnostic pop
 /*
 * Call early during boot, before mem init, to retrieve the RTAS
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 62b1a40d8957..40b44bb53a4e 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -701,11 +701,18 @@ static int ppc_panic_event(struct notifier_block *this,
                             unsigned long event, void *ptr)
 {
        /*
+         * panic does a local_irq_disable, but we really
+         * want interrupts to be hard disabled.
+         */
+        hard_irq_disable();
+        /*
         * If firmware-assisted dump has been registered then trigger
         * firmware-assisted dump and let firmware handle everything else.
         */
        crash_fadump(NULL, ptr);
-        ppc_md.panic(ptr);  /* May not return */
+        if (ppc_md.panic)
+                ppc_md.panic(ptr);  /* May not return */
        return NOTIFY_DONE;
 }
@@ -716,7 +723,8 @@ static struct notifier_block ppc_panic_block = {
 void __init setup_panic(void)
 {
-        if (!ppc_md.panic)
+        /* PPC64 always does a hard irq disable in its panic handler */
+        if (!IS_ENABLED(CONFIG_PPC64) && !ppc_md.panic)
                return;
        atomic_notifier_chain_register(&panic_notifier_list, &ppc_panic_block);
 }
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 7a7ce8ad455e..225bc5f91049 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -387,6 +387,14 @@ void early_setup_secondary(void)
 #endif /* CONFIG_SMP */
+void panic_smp_self_stop(void)
+{
+        hard_irq_disable();
+        spin_begin();
+        while (1)
+                spin_cpu_relax();
+}
 #if defined(CONFIG_SMP) || defined(CONFIG_KEXEC_CORE)
 static bool use_spinloop(void)
 {
diff --git a/arch/powerpc/kernel/signal.c b/arch/powerpc/kernel/signal.c
index 17fe4339ba59..b3e8db376ecd 100644
--- a/arch/powerpc/kernel/signal.c
+++ b/arch/powerpc/kernel/signal.c
@@ -134,7 +134,7 @@ static void do_signal(struct task_struct *tsk)
        /* Re-enable the breakpoints for the signal stack */
        thread_change_pc(tsk, tsk->thread.regs);
-        rseq_signal_deliver(tsk->thread.regs);
+        rseq_signal_deliver(&ksig, tsk->thread.regs);
        if (is32) {
                if (ksig.ka.sa.sa_flags & SA_SIGINFO)
@@ -170,7 +170,7 @@ void do_notify_resume(struct pt_regs *regs, unsigned long thread_info_flags)
        if (thread_info_flags & _TIF_NOTIFY_RESUME) {
                clear_thread_flag(TIF_NOTIFY_RESUME);
                tracehook_notify_resume(regs);
-                rseq_handle_notify_resume(regs);
+                rseq_handle_notify_resume(NULL, regs);
        }
        user_enter();
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 5eedbb282d42..e6474a45cef5 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -1038,9 +1038,6 @@ static int do_setcontext_tm(struct ucontext __user *ucp,
 }
 #endif
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wpragmas"
-#pragma GCC diagnostic ignored "-Wattribute-alias"
 #ifdef CONFIG_PPC64
 COMPAT_SYSCALL_DEFINE3(swapcontext, struct ucontext __user *, old_ctx,
                       struct ucontext __user *, new_ctx, int, ctx_size)
@@ -1134,7 +1131,6 @@ SYSCALL_DEFINE3(swapcontext, struct ucontext __user *, old_ctx,
        set_thread_flag(TIF_RESTOREALL);
        return 0;
 }
-#pragma GCC diagnostic pop
 #ifdef CONFIG_PPC64
 COMPAT_SYSCALL_DEFINE0(rt_sigreturn)
@@ -1231,9 +1227,6 @@ SYSCALL_DEFINE0(rt_sigreturn)
        return 0;
 }
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wpragmas"
-#pragma GCC diagnostic ignored "-Wattribute-alias"
 #ifdef CONFIG_PPC32
 SYSCALL_DEFINE3(debug_setcontext, struct ucontext __user *, ctx,
                         int, ndbg, struct sig_dbg_op __user *, dbg)
@@ -1337,7 +1330,6 @@ SYSCALL_DEFINE3(debug_setcontext, struct ucontext __user *, ctx,
        return 0;
 }
 #endif
-#pragma GCC diagnostic pop
 /*
 * OK, we're invoking a handler
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index d42b60020389..83d51bf586c7 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -625,9 +625,6 @@ static long setup_trampoline(unsigned int syscall, unsigned int __user *tramp)
 /*
 * Handle {get,set,swap}_context operations
 */
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wpragmas"
-#pragma GCC diagnostic ignored "-Wattribute-alias"
 SYSCALL_DEFINE3(swapcontext, struct ucontext __user *, old_ctx,
                struct ucontext __user *, new_ctx, long, ctx_size)
 {
@@ -693,7 +690,6 @@ SYSCALL_DEFINE3(swapcontext, struct ucontext __user *, old_ctx,
        set_thread_flag(TIF_RESTOREALL);
        return 0;
 }
-#pragma GCC diagnostic pop
 /*
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 5eadfffabe35..4794d6b4f4d2 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -600,9 +600,6 @@ static void nmi_stop_this_cpu(struct pt_regs *regs)
        nmi_ipi_busy_count--;
        nmi_ipi_unlock();
-        /* Remove this CPU */
-        set_cpu_online(smp_processor_id(), false);
        spin_begin();
        while (1)
                spin_cpu_relax();
@@ -617,9 +614,6 @@ void smp_send_stop(void)
 static void stop_this_cpu(void *dummy)
 {
-        /* Remove this CPU */
-        set_cpu_online(smp_processor_id(), false);
        hard_irq_disable();
        spin_begin();
        while (1)
diff --git a/arch/powerpc/kernel/stacktrace.c b/arch/powerpc/kernel/stacktrace.c
index 07e97f289c52..e2c50b55138f 100644
--- a/arch/powerpc/kernel/stacktrace.c
+++ b/arch/powerpc/kernel/stacktrace.c
@@ -196,7 +196,7 @@ save_stack_trace_tsk_reliable(struct task_struct *tsk,
 EXPORT_SYMBOL_GPL(save_stack_trace_tsk_reliable);
 #endif /* CONFIG_HAVE_RELIABLE_STACKTRACE */
-#ifdef CONFIG_PPC_BOOK3S_64
+#if defined(CONFIG_PPC_BOOK3S_64) && defined(CONFIG_NMI_IPI)
 static void handle_backtrace_ipi(struct pt_regs *regs)
 {
        nmi_cpu_backtrace(regs);
@@ -242,4 +242,4 @@ void arch_trigger_cpumask_backtrace(const cpumask_t *mask, bool exclude_self)
 {
        nmi_trigger_cpumask_backtrace(mask, exclude_self, raise_backtrace_ipi);
 }
-#endif /* CONFIG_PPC64 */
+#endif /* defined(CONFIG_PPC_BOOK3S_64) && defined(CONFIG_NMI_IPI) */
diff --git a/arch/powerpc/kernel/syscalls.c b/arch/powerpc/kernel/syscalls.c
index 083fa06962fd..466216506eb2 100644
--- a/arch/powerpc/kernel/syscalls.c
+++ b/arch/powerpc/kernel/syscalls.c
@@ -62,9 +62,6 @@ out:
        return ret;
 }
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wpragmas"
-#pragma GCC diagnostic ignored "-Wattribute-alias"
 SYSCALL_DEFINE6(mmap2, unsigned long, addr, size_t, len,
                unsigned long, prot, unsigned long, flags,
                unsigned long, fd, unsigned long, pgoff)
@@ -78,7 +75,6 @@ SYSCALL_DEFINE6(mmap, unsigned long, addr, size_t, len,
 {
        return do_mmap2(addr, len, prot, flags, fd, offset, PAGE_SHIFT);
 }
-#pragma GCC diagnostic pop
 #ifdef CONFIG_PPC32
 /*
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 7c5f479c5c00..8a9a49c13865 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -337,7 +337,8 @@ static void free_hugepd_range(struct mmu_gather *tlb, hugepd_t *hpdp, int pdshif
        if (shift >= pdshift)
                hugepd_free(tlb, hugepte);
        else
-                pgtable_free_tlb(tlb, hugepte, pdshift - shift);
+                pgtable_free_tlb(tlb, hugepte,
+                                 get_hugepd_cache_index(pdshift - shift));
 }
 static void hugetlb_free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
diff --git a/arch/powerpc/mm/pgtable-book3s64.c b/arch/powerpc/mm/pgtable-book3s64.c
index c1f4ca45c93a..4afbfbb64bfd 100644
--- a/arch/powerpc/mm/pgtable-book3s64.c
+++ b/arch/powerpc/mm/pgtable-book3s64.c
@@ -409,6 +409,18 @@ static inline void pgtable_free(void *table, int index)
        case PUD_INDEX:
                kmem_cache_free(PGT_CACHE(PUD_CACHE_INDEX), table);
                break;
+#if defined(CONFIG_PPC_4K_PAGES) && defined(CONFIG_HUGETLB_PAGE)
+                /* 16M hugepd directory at pud level */
+        case HTLB_16M_INDEX:
+                BUILD_BUG_ON(H_16M_CACHE_INDEX <= 0);
+                kmem_cache_free(PGT_CACHE(H_16M_CACHE_INDEX), table);
+                break;
+                /* 16G hugepd directory at the pgd level */
+        case HTLB_16G_INDEX:
+                BUILD_BUG_ON(H_16G_CACHE_INDEX <= 0);
+                kmem_cache_free(PGT_CACHE(H_16G_CACHE_INDEX), table);
+                break;
+#endif
                /* We don't free pgd table via RCU callback */
        default:
                BUG();
diff --git a/arch/powerpc/mm/subpage-prot.c b/arch/powerpc/mm/subpage-prot.c
index 75cb646a79c3..9d16ee251fc0 100644
--- a/arch/powerpc/mm/subpage-prot.c
+++ b/arch/powerpc/mm/subpage-prot.c
@@ -186,9 +186,6 @@ static void subpage_mark_vma_nohuge(struct mm_struct *mm, unsigned long addr,
 * in a 2-bit field won't allow writes to a page that is otherwise
 * write-protected.
 */
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wpragmas"
-#pragma GCC diagnostic ignored "-Wattribute-alias"
 SYSCALL_DEFINE3(subpage_prot, unsigned long, addr,
                unsigned long, len, u32 __user *, map)
 {
@@ -272,4 +269,3 @@ SYSCALL_DEFINE3(subpage_prot, unsigned long, addr,
        up_write(&mm->mmap_sem);
        return err;
 }
-#pragma GCC diagnostic pop
diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
index 67a6e86d3e7e..1135b43a597c 100644
--- a/arch/powerpc/mm/tlb-radix.c
+++ b/arch/powerpc/mm/tlb-radix.c
@@ -689,22 +689,17 @@ EXPORT_SYMBOL(radix__flush_tlb_kernel_range);
 static unsigned long tlb_single_page_flush_ceiling __read_mostly = 33;
 static unsigned long tlb_local_single_page_flush_ceiling __read_mostly = POWER9_TLB_SETS_RADIX * 2;
-void radix__flush_tlb_range(struct vm_area_struct *vma, unsigned long start,
+static inline void __radix__flush_tlb_range(struct mm_struct *mm,
-                     unsigned long end)
+                                        unsigned long start, unsigned long end,
+                                        bool flush_all_sizes)
 {
-        struct mm_struct *mm = vma->vm_mm;
        unsigned long pid;
        unsigned int page_shift = mmu_psize_defs[mmu_virtual_psize].shift;
        unsigned long page_size = 1UL << page_shift;
        unsigned long nr_pages = (end - start) >> page_shift;
        bool local, full;
-#ifdef CONFIG_HUGETLB_PAGE
-        if (is_vm_hugetlb_page(vma))
-                return radix__flush_hugetlb_tlb_range(vma, start, end);
-#endif
        pid = mm->context.id;
        if (unlikely(pid == MMU_NO_CONTEXT))
                return;
@@ -738,37 +733,64 @@ is_local:
                                _tlbie_pid(pid, RIC_FLUSH_TLB);
                }
        } else {
-                bool hflush = false;
+                bool hflush = flush_all_sizes;
+                bool gflush = flush_all_sizes;
                unsigned long hstart, hend;
+                unsigned long gstart, gend;
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+                if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE))
-                hstart = (start + HPAGE_PMD_SIZE - 1) >> HPAGE_PMD_SHIFT;
-                hend = end >> HPAGE_PMD_SHIFT;
-                if (hstart < hend) {
-                        hstart <<= HPAGE_PMD_SHIFT;
-                        hend <<= HPAGE_PMD_SHIFT;
                        hflush = true;
+                if (hflush) {
+                        hstart = (start + PMD_SIZE - 1) & PMD_MASK;
+                        hend = end & PMD_MASK;
+                        if (hstart == hend)
+                                hflush = false;
+                }
+                if (gflush) {
+                        gstart = (start + PUD_SIZE - 1) & PUD_MASK;
+                        gend = end & PUD_MASK;
+                        if (gstart == gend)
+                                gflush = false;
                }
-#endif
                asm volatile("ptesync": : :"memory");
                if (local) {
                        __tlbiel_va_range(start, end, pid, page_size, mmu_virtual_psize);
                        if (hflush)
                                __tlbiel_va_range(hstart, hend, pid,
-                                                HPAGE_PMD_SIZE, MMU_PAGE_2M);
+                                                PMD_SIZE, MMU_PAGE_2M);
+                        if (gflush)
+                                __tlbiel_va_range(gstart, gend, pid,
+                                                PUD_SIZE, MMU_PAGE_1G);
                        asm volatile("ptesync": : :"memory");
                } else {
                        __tlbie_va_range(start, end, pid, page_size, mmu_virtual_psize);
                        if (hflush)
                                __tlbie_va_range(hstart, hend, pid,
-                                                HPAGE_PMD_SIZE, MMU_PAGE_2M);
+                                                PMD_SIZE, MMU_PAGE_2M);
+                        if (gflush)
+                                __tlbie_va_range(gstart, gend, pid,
+                                                PUD_SIZE, MMU_PAGE_1G);
                        fixup_tlbie();
                        asm volatile("eieio; tlbsync; ptesync": : :"memory");
                }
        }
        preempt_enable();
 }
+void radix__flush_tlb_range(struct vm_area_struct *vma, unsigned long start,
+                     unsigned long end)
+{
+#ifdef CONFIG_HUGETLB_PAGE
+        if (is_vm_hugetlb_page(vma))
+                return radix__flush_hugetlb_tlb_range(vma, start, end);
+#endif
+        __radix__flush_tlb_range(vma->vm_mm, start, end, false);
+}
 EXPORT_SYMBOL(radix__flush_tlb_range);
 static int radix_get_mmu_psize(int page_size)
@@ -837,6 +859,8 @@ void radix__tlb_flush(struct mmu_gather *tlb)
        int psize = 0;
        struct mm_struct *mm = tlb->mm;
        int page_size = tlb->page_size;
+        unsigned long start = tlb->start;
+        unsigned long end = tlb->end;
        /*
         * if page size is not something we understand, do a full mm flush
@@ -847,15 +871,45 @@ void radix__tlb_flush(struct mmu_gather *tlb)
         */
        if (tlb->fullmm) {
                __flush_all_mm(mm, true);
+#if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_HUGETLB_PAGE)
+        } else if (mm_tlb_flush_nested(mm)) {
+                /*
+                 * If there is a concurrent invalidation that is clearing ptes,
+                 * then it's possible this invalidation will miss one of those
+                 * cleared ptes and miss flushing the TLB. If this invalidate
+                 * returns before the other one flushes TLBs, that can result
+                 * in it returning while there are still valid TLBs inside the
+                 * range to be invalidated.
+                 *
+                 * See mm/memory.c:tlb_finish_mmu() for more details.
+                 *
+                 * The solution to this is ensure the entire range is always
+                 * flushed here. The problem for powerpc is that the flushes
+                 * are page size specific, so this "forced flush" would not
+                 * do the right thing if there are a mix of page sizes in
+                 * the range to be invalidated. So use __flush_tlb_range
+                 * which invalidates all possible page sizes in the range.
+                 *
+                 * PWC flush probably is not be required because the core code
+                 * shouldn't free page tables in this path, but accounting
+                 * for the possibility makes us a bit more robust.
+                 *
+                 * need_flush_all is an uncommon case because page table
+                 * teardown should be done with exclusive locks held (but
+                 * after locks are dropped another invalidate could come
+                 * in), it could be optimized further if necessary.
+                 */
+                if (!tlb->need_flush_all)
+                        __radix__flush_tlb_range(mm, start, end, true);
+                else
+                        radix__flush_all_mm(mm);
+#endif
        } else if ( (psize = radix_get_mmu_psize(page_size)) == -1) {
                if (!tlb->need_flush_all)
                        radix__flush_tlb_mm(mm);
                else
                        radix__flush_all_mm(mm);
        } else {
-                unsigned long start = tlb->start;
-                unsigned long end = tlb->end;
                if (!tlb->need_flush_all)
                        radix__flush_tlb_range_psize(mm, start, end, psize);
                else
@@ -1043,6 +1097,8 @@ extern void radix_kvm_prefetch_workaround(struct mm_struct *mm)
                for (; sib <= cpu_last_thread_sibling(cpu) && !flush; sib++) {
                        if (sib == cpu)
                                continue;
+                        if (!cpu_possible(sib))
+                                continue;
                        if (paca_ptrs[sib]->kvm_hstate.kvm_vcpu)
                                flush = true;
                }
diff --git a/arch/powerpc/platforms/powermac/time.c b/arch/powerpc/platforms/powermac/time.c
index 7c968e46736f..12e6e4d30602 100644
--- a/arch/powerpc/platforms/powermac/time.c
+++ b/arch/powerpc/platforms/powermac/time.c
@@ -42,7 +42,11 @@
 #define DBG(x...)
 #endif
-/* Apparently the RTC stores seconds since 1 Jan 1904 */
+/*
+ * Offset between Unix time (1970-based) and Mac time (1904-based). Cuda and PMU
+ * times wrap in 2040. If we need to handle later times, the read_time functions
+ * need to be changed to interpret wrapped times as post-2040.
+ */
 #define RTC_OFFSET      2082844800
 /*
@@ -97,8 +101,11 @@ static time64_t cuda_get_time(void)
        if (req.reply_len != 7)
                printk(KERN_ERR "cuda_get_time: got %d byte reply\n",
                       req.reply_len);
-        now = (req.reply[3] << 24) + (req.reply[4] << 16)
+        now = (u32)((req.reply[3] << 24) + (req.reply[4] << 16) +
-                + (req.reply[5] << 8) + req.reply[6];
+                    (req.reply[5] << 8) + req.reply[6]);
+        /* it's either after year 2040, or the RTC has gone backwards */
+        WARN_ON(now < RTC_OFFSET);
        return now - RTC_OFFSET;
 }
@@ -106,10 +113,10 @@ static time64_t cuda_get_time(void)
 static int cuda_set_rtc_time(struct rtc_time *tm)
 {
-        time64_t nowtime;
+        u32 nowtime;
        struct adb_request req;
-        nowtime = rtc_tm_to_time64(tm) + RTC_OFFSET;
+        nowtime = lower_32_bits(rtc_tm_to_time64(tm) + RTC_OFFSET);
        if (cuda_request(&req, NULL, 6, CUDA_PACKET, CUDA_SET_TIME,
                         nowtime >> 24, nowtime >> 16, nowtime >> 8,
                         nowtime) < 0)
@@ -140,8 +147,12 @@ static time64_t pmu_get_time(void)
        if (req.reply_len != 4)
                printk(KERN_ERR "pmu_get_time: got %d byte reply from PMU\n",
                       req.reply_len);
-        now = (req.reply[0] << 24) + (req.reply[1] << 16)
+        now = (u32)((req.reply[0] << 24) + (req.reply[1] << 16) +
-                + (req.reply[2] << 8) + req.reply[3];
+                    (req.reply[2] << 8) + req.reply[3]);
+        /* it's either after year 2040, or the RTC has gone backwards */
+        WARN_ON(now < RTC_OFFSET);
        return now - RTC_OFFSET;
 }
@@ -149,10 +160,10 @@ static time64_t pmu_get_time(void)
 static int pmu_set_rtc_time(struct rtc_time *tm)
 {
-        time64_t nowtime;
+        u32 nowtime;
        struct adb_request req;
-        nowtime = rtc_tm_to_time64(tm) + RTC_OFFSET;
+        nowtime = lower_32_bits(rtc_tm_to_time64(tm) + RTC_OFFSET);
        if (pmu_request(&req, NULL, 5, PMU_SET_RTC, nowtime >> 24,
                        nowtime >> 16, nowtime >> 8, nowtime) < 0)
                return -ENXIO;
diff --git a/arch/s390/include/asm/css_chars.h b/arch/s390/include/asm/css_chars.h
index 0563fd3e8458..480bb02ccacd 100644
--- a/arch/s390/include/asm/css_chars.h
+++ b/arch/s390/include/asm/css_chars.h
@@ -6,36 +6,38 @@
 struct css_general_char {
        u64 : 12;
-        u32 dynio : 1;   /* bit 12 */
+        u64 dynio : 1;   /* bit 12 */
-        u32 : 4;
+        u64 : 4;
-        u32 eadm : 1;    /* bit 17 */
+        u64 eadm : 1;    /* bit 17 */
-        u32 : 23;
+        u64 : 23;
-        u32 aif : 1;     /* bit 41 */
+        u64 aif : 1;     /* bit 41 */
-        u32 : 3;
+        u64 : 3;
-        u32 mcss : 1;    /* bit 45 */
+        u64 mcss : 1;    /* bit 45 */
-        u32 fcs : 1;     /* bit 46 */
+        u64 fcs : 1;     /* bit 46 */
-        u32 : 1;
+        u64 : 1;
-        u32 ext_mb : 1;  /* bit 48 */
+        u64 ext_mb : 1;  /* bit 48 */
-        u32 : 7;
+        u64 : 7;
-        u32 aif_tdd : 1; /* bit 56 */
+        u64 aif_tdd : 1; /* bit 56 */
-        u32 : 1;
+        u64 : 1;
-        u32 qebsm : 1;   /* bit 58 */
+        u64 qebsm : 1;   /* bit 58 */
-        u32 : 2;
+        u64 : 2;
-        u32 aiv : 1;     /* bit 61 */
+        u64 aiv : 1;     /* bit 61 */
-        u32 : 5;
+        u64 : 2;
-        u32 aif_osa : 1; /* bit 67 */
-        u32 : 12;
+        u64 : 3;
-        u32 eadm_rf : 1; /* bit 80 */
+        u64 aif_osa : 1; /* bit 67 */
-        u32 : 1;
+        u64 : 12;
-        u32 cib : 1;     /* bit 82 */
+        u64 eadm_rf : 1; /* bit 80 */
-        u32 : 5;
+        u64 : 1;
-        u32 fcx : 1;     /* bit 88 */
+        u64 cib : 1;     /* bit 82 */
-        u32 : 19;
+        u64 : 5;
-        u32 alt_ssi : 1; /* bit 108 */
+        u64 fcx : 1;     /* bit 88 */
-        u32 : 1;
+        u64 : 19;
-        u32 narf : 1;    /* bit 110 */
+        u64 alt_ssi : 1; /* bit 108 */
-        u32 : 12;
+        u64 : 1;
-        u32 util_str : 1;/* bit 123 */
+        u64 narf : 1;    /* bit 110 */
+        u64 : 12;
+        u64 util_str : 1;/* bit 123 */
 } __packed;
 extern struct css_general_char css_general_characteristics;
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index f0a6ea22429d..a08e82856563 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -258,11 +258,6 @@ archscripts: scripts_basic
 archheaders:
        $(Q)$(MAKE) $(build)=arch/x86/entry/syscalls all
-archprepare:
-ifeq ($(CONFIG_KEXEC_FILE),y)
-        $(Q)$(MAKE) $(build)=arch/x86/purgatory arch/x86/purgatory/kexec-purgatory.c
-endif
 ###
 # Kernel objects
@@ -327,7 +322,6 @@ archclean:
        $(Q)rm -rf $(objtree)/arch/x86_64
        $(Q)$(MAKE) $(clean)=$(boot)
        $(Q)$(MAKE) $(clean)=arch/x86/tools
-        $(Q)$(MAKE) $(clean)=arch/x86/purgatory
 define archhelp
  echo  '* bzImage      - Compressed kernel image (arch/x86/boot/bzImage)'
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index a8a8642d2b0b..e57665b4ba1c 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -118,7 +118,7 @@ __setup_efi_pci(efi_pci_io_protocol_t *pci, struct pci_setup_rom **__rom)
        void *romimage;
        status = efi_call_proto(efi_pci_io_protocol, attributes, pci,
-                                EfiPciIoAttributeOperationGet, 0, 0,
+                                EfiPciIoAttributeOperationGet, 0ULL,
                                &attributes);
        if (status != EFI_SUCCESS)
                return status;
diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
index 92190879b228..3b2490b81918 100644
--- a/arch/x86/entry/common.c
+++ b/arch/x86/entry/common.c
@@ -164,7 +164,7 @@ static void exit_to_usermode_loop(struct pt_regs *regs, u32 cached_flags)
                if (cached_flags & _TIF_NOTIFY_RESUME) {
                        clear_thread_flag(TIF_NOTIFY_RESUME);
                        tracehook_notify_resume(regs);
-                        rseq_handle_notify_resume(regs);
+                        rseq_handle_notify_resume(NULL, regs);
                }
                if (cached_flags & _TIF_USER_RETURN_NOTIFY)
diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index 2582881d19ce..c371bfee137a 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -477,7 +477,7 @@ ENTRY(entry_SYSENTER_32)
         * whereas POPF does not.)
         */
        addl    $PT_EFLAGS-PT_DS, %esp  /* point esp at pt_regs->flags */
-        btr     $X86_EFLAGS_IF_BIT, (%esp)
+        btrl    $X86_EFLAGS_IF_BIT, (%esp)
        popfl
        /*
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index 9de7f1e1dede..7d0df78db727 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -84,13 +84,13 @@ ENTRY(entry_SYSENTER_compat)
        pushq   %rdx                    /* pt_regs->dx */
        pushq   %rcx                    /* pt_regs->cx */
        pushq   $-ENOSYS                /* pt_regs->ax */
-        pushq   %r8                     /* pt_regs->r8 */
+        pushq   $0                      /* pt_regs->r8  = 0 */
        xorl    %r8d, %r8d              /* nospec   r8 */
-        pushq   %r9                     /* pt_regs->r9 */
+        pushq   $0                      /* pt_regs->r9  = 0 */
        xorl    %r9d, %r9d              /* nospec   r9 */
-        pushq   %r10                    /* pt_regs->r10 */
+        pushq   $0                      /* pt_regs->r10 = 0 */
        xorl    %r10d, %r10d            /* nospec   r10 */
-        pushq   %r11                    /* pt_regs->r11 */
+        pushq   $0                      /* pt_regs->r11 = 0 */
        xorl    %r11d, %r11d            /* nospec   r11 */
        pushq   %rbx                    /* pt_regs->rbx */
        xorl    %ebx, %ebx              /* nospec   rbx */
@@ -374,13 +374,13 @@ ENTRY(entry_INT80_compat)
        pushq   %rcx                    /* pt_regs->cx */
        xorl    %ecx, %ecx              /* nospec   cx */
        pushq   $-ENOSYS                /* pt_regs->ax */
-        pushq   $0                      /* pt_regs->r8  = 0 */
+        pushq   %r8                     /* pt_regs->r8 */
        xorl    %r8d, %r8d              /* nospec   r8 */
-        pushq   $0                      /* pt_regs->r9  = 0 */
+        pushq   %r9                     /* pt_regs->r9 */
        xorl    %r9d, %r9d              /* nospec   r9 */
-        pushq   $0                      /* pt_regs->r10 = 0 */
+        pushq   %r10                    /* pt_regs->r10*/
        xorl    %r10d, %r10d            /* nospec   r10 */
-        pushq   $0                      /* pt_regs->r11 = 0 */
+        pushq   %r11                    /* pt_regs->r11 */
        xorl    %r11d, %r11d            /* nospec   r11 */
        pushq   %rbx                    /* pt_regs->rbx */
        xorl    %ebx, %ebx              /* nospec   rbx */
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index 042b5e892ed1..14de0432d288 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -38,7 +38,7 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 {
        unsigned long mask;
-        asm ("cmp %1,%2; sbb %0,%0;"
+        asm volatile ("cmp %1,%2; sbb %0,%0;"
                        :"=r" (mask)
                        :"g"(size),"r" (index)
                        :"cc");
diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
index ada6410fd2ec..fbd578daa66e 100644
--- a/arch/x86/include/asm/pgalloc.h
+++ b/arch/x86/include/asm/pgalloc.h
@@ -184,6 +184,9 @@ static inline p4d_t *p4d_alloc_one(struct mm_struct *mm, unsigned long addr)
 static inline void p4d_free(struct mm_struct *mm, p4d_t *p4d)
 {
+        if (!pgtable_l5_enabled())
+                return;
        BUG_ON((unsigned long)p4d & (PAGE_SIZE-1));
        free_page((unsigned long)p4d);
 }
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 99ecde23c3ec..5715647fc4fe 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -898,7 +898,7 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd)
 #define pgd_page(pgd)   pfn_to_page(pgd_pfn(pgd))
 /* to find an entry in a page-table-directory. */
-static __always_inline p4d_t *p4d_offset(pgd_t *pgd, unsigned long address)
+static inline p4d_t *p4d_offset(pgd_t *pgd, unsigned long address)
 {
        if (!pgtable_l5_enabled())
                return (p4d_t *)pgd;
diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
index 0fdcd21dadbd..3c5385f9a88f 100644
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -216,7 +216,7 @@ static inline pgd_t pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd)
 }
 #endif
-static __always_inline void native_set_p4d(p4d_t *p4dp, p4d_t p4d)
+static inline void native_set_p4d(p4d_t *p4dp, p4d_t p4d)
 {
        pgd_t pgd;
@@ -230,7 +230,7 @@ static __always_inline void native_set_p4d(p4d_t *p4dp, p4d_t p4d)
        *p4dp = native_make_p4d(native_pgd_val(pgd));
 }
-static __always_inline void native_p4d_clear(p4d_t *p4d)
+static inline void native_p4d_clear(p4d_t *p4d)
 {
        native_set_p4d(p4d, native_make_p4d(0));
 }
diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
index 425e6b8b9547..6aa8499e1f62 100644
--- a/arch/x86/include/asm/vmx.h
+++ b/arch/x86/include/asm/vmx.h
@@ -114,6 +114,7 @@
 #define VMX_MISC_PREEMPTION_TIMER_RATE_MASK     0x0000001f
 #define VMX_MISC_SAVE_EFER_LMA                  0x00000020
 #define VMX_MISC_ACTIVITY_HLT                   0x00000040
+#define VMX_MISC_ZERO_LEN_INS                   0x40000000
 /* VMFUNC functions */
 #define VMX_VMFUNC_EPTP_SWITCHING               0x00000001
@@ -351,11 +352,13 @@ enum vmcs_field {
 #define VECTORING_INFO_VALID_MASK               INTR_INFO_VALID_MASK
 #define INTR_TYPE_EXT_INTR              (0 << 8) /* external interrupt */
+#define INTR_TYPE_RESERVED              (1 << 8) /* reserved */
 #define INTR_TYPE_NMI_INTR              (2 << 8) /* NMI */
 #define INTR_TYPE_HARD_EXCEPTION        (3 << 8) /* processor exception */
 #define INTR_TYPE_SOFT_INTR             (4 << 8) /* software interrupt */
 #define INTR_TYPE_PRIV_SW_EXCEPTION     (5 << 8) /* ICE breakpoint - undocumented */
 #define INTR_TYPE_SOFT_EXCEPTION        (6 << 8) /* software exception */
+#define INTR_TYPE_OTHER_EVENT           (7 << 8) /* other event */
 /* GUEST_INTERRUPTIBILITY_INFO flags. */
 #define GUEST_INTR_STATE_STI            0x00000001
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index efaf2d4f9c3c..d492752f79e1 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -26,6 +26,7 @@
 #include <linux/delay.h>
 #include <linux/crash_dump.h>
 #include <linux/reboot.h>
+#include <linux/memory.h>
 #include <asm/uv/uv_mmrs.h>
 #include <asm/uv/uv_hub.h>
@@ -392,6 +393,51 @@ extern int uv_hub_info_version(void)
 }
 EXPORT_SYMBOL(uv_hub_info_version);
+/* Default UV memory block size is 2GB */
+static unsigned long mem_block_size = (2UL << 30);
+/* Kernel parameter to specify UV mem block size */
+static int parse_mem_block_size(char *ptr)
+{
+        unsigned long size = memparse(ptr, NULL);
+        /* Size will be rounded down by set_block_size() below */
+        mem_block_size = size;
+        return 0;
+}
+early_param("uv_memblksize", parse_mem_block_size);
+static __init int adj_blksize(u32 lgre)
+{
+        unsigned long base = (unsigned long)lgre << UV_GAM_RANGE_SHFT;
+        unsigned long size;
+        for (size = mem_block_size; size > MIN_MEMORY_BLOCK_SIZE; size >>= 1)
+                if (IS_ALIGNED(base, size))
+                        break;
+        if (size >= mem_block_size)
+                return 0;
+        mem_block_size = size;
+        return 1;
+}
+static __init void set_block_size(void)
+{
+        unsigned int order = ffs(mem_block_size);
+        if (order) {
+                /* adjust for ffs return of 1..64 */
+                set_memory_block_size_order(order - 1);
+                pr_info("UV: mem_block_size set to 0x%lx\n", mem_block_size);
+        } else {
+                /* bad or zero value, default to 1UL << 31 (2GB) */
+                pr_err("UV: mem_block_size error with 0x%lx\n", mem_block_size);
+                set_memory_block_size_order(31);
+        }
+}
 /* Build GAM range lookup table: */
 static __init void build_uv_gr_table(void)
 {
@@ -1180,23 +1226,30 @@ static void __init decode_gam_rng_tbl(unsigned long ptr)
                                        << UV_GAM_RANGE_SHFT);
                int order = 0;
                char suffix[] = " KMGTPE";
+                int flag = ' ';
                while (size > 9999 && order < sizeof(suffix)) {
                        size /= 1024;
                        order++;
                }
+                /* adjust max block size to current range start */
+                if (gre->type == 1 || gre->type == 2)
+                        if (adj_blksize(lgre))
+                                flag = '*';
                if (!index) {
                        pr_info("UV: GAM Range Table...\n");
-                        pr_info("UV:  # %20s %14s %5s %4s %5s %3s %2s\n", "Range", "", "Size", "Type", "NASID", "SID", "PN");
+                        pr_info("UV:  # %20s %14s %6s %4s %5s %3s %2s\n", "Range", "", "Size", "Type", "NASID", "SID", "PN");
                }
-                pr_info("UV: %2d: 0x%014lx-0x%014lx %5lu%c %3d   %04x  %02x %02x\n",
+                pr_info("UV: %2d: 0x%014lx-0x%014lx%c %5lu%c %3d   %04x  %02x %02x\n",
                        index++,
                        (unsigned long)lgre << UV_GAM_RANGE_SHFT,
                        (unsigned long)gre->limit << UV_GAM_RANGE_SHFT,
-                        size, suffix[order],
+                        flag, size, suffix[order],
                        gre->type, gre->nasid, gre->sockid, gre->pnode);
+                /* update to next range start */
                lgre = gre->limit;
                if (sock_min > gre->sockid)
                        sock_min = gre->sockid;
@@ -1427,6 +1480,7 @@ static void __init uv_system_init_hub(void)
        build_socket_tables();
        build_uv_gr_table();
+        set_block_size();
        uv_init_hub_info(&hub_info);
        uv_possible_blades = num_possible_nodes();
        if (!_node_to_pnode)
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index cd0fda1fff6d..404df26b7de8 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -27,6 +27,7 @@
 #include <asm/pgtable.h>
 #include <asm/set_memory.h>
 #include <asm/intel-family.h>
+#include <asm/hypervisor.h>
 static void __init spectre_v2_select_mitigation(void);
 static void __init ssb_select_mitigation(void);
@@ -664,6 +665,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
                if (boot_cpu_has(X86_FEATURE_PTI))
                        return sprintf(buf, "Mitigation: PTI\n");
+                if (hypervisor_is_type(X86_HYPER_XEN_PV))
+                        return sprintf(buf, "Unknown (XEN PV detected, hypervisor mitigation required)\n");
                break;
        case X86_BUG_SPECTRE_V1:
diff --git a/arch/x86/kernel/cpu/cacheinfo.c b/arch/x86/kernel/cpu/cacheinfo.c
index 38354c66df81..0c5fcbd998cf 100644
--- a/arch/x86/kernel/cpu/cacheinfo.c
+++ b/arch/x86/kernel/cpu/cacheinfo.c
@@ -671,7 +671,7 @@ void cacheinfo_amd_init_llc_id(struct cpuinfo_x86 *c, int cpu, u8 node_id)
                        num_sharing_cache = ((eax >> 14) & 0xfff) + 1;
                if (num_sharing_cache) {
-                        int bits = get_count_order(num_sharing_cache) - 1;
+                        int bits = get_count_order(num_sharing_cache);
                        per_cpu(cpu_llc_id, cpu) = c->apicid >> bits;
                }
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 0df7151cfef4..eb4cb3efd20e 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1,3 +1,6 @@
+/* cpu_feature_enabled() cannot be used this early */
+#define USE_EARLY_PGTABLE_L5
 #include <linux/bootmem.h>
 #include <linux/linkage.h>
 #include <linux/bitops.h>
diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c
index 5bbd06f38ff6..f34d89c01edc 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
+++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
@@ -160,6 +160,11 @@ static struct severity {
                SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR|MCACOD, MCI_UC_SAR|MCI_ADDR|MCACOD_INSTR),
                USER
                ),
+        MCESEV(
+                PANIC, "Data load in unrecoverable area of kernel",
+                SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR|MCACOD, MCI_UC_SAR|MCI_ADDR|MCACOD_DATA),
+                KERNEL
+                ),
 #endif
        MCESEV(
                PANIC, "Action required: unknown MCACOD",
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index e4cf6ff1c2e1..c102ad51025e 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -772,23 +772,25 @@ EXPORT_SYMBOL_GPL(machine_check_poll);
 static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
                          struct pt_regs *regs)
 {
-        int i, ret = 0;
        char *tmp;
+        int i;
        for (i = 0; i < mca_cfg.banks; i++) {
                m->status = mce_rdmsrl(msr_ops.status(i));
-                if (m->status & MCI_STATUS_VAL) {
+                if (!(m->status & MCI_STATUS_VAL))
-                        __set_bit(i, validp);
+                        continue;
-                        if (quirk_no_way_out)
-                                quirk_no_way_out(i, m, regs);
+                __set_bit(i, validp);
-                }
+                if (quirk_no_way_out)
+                        quirk_no_way_out(i, m, regs);
                if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) {
+                        mce_read_aux(m, i);
                        *msg = tmp;
-                        ret = 1;
+                        return 1;
                }
        }
-        return ret;
+        return 0;
 }
 /*
@@ -1205,13 +1207,18 @@ void do_machine_check(struct pt_regs *regs, long error_code)
                lmce = m.mcgstatus & MCG_STATUS_LMCES;
        /*
+         * Local machine check may already know that we have to panic.
+         * Broadcast machine check begins rendezvous in mce_start()
         * Go through all banks in exclusion of the other CPUs. This way we
         * don't report duplicated events on shared banks because the first one
-         * to see it will clear it. If this is a Local MCE, then no need to
+         * to see it will clear it.
-         * perform rendezvous.
         */
-        if (!lmce)
+        if (lmce) {
+                if (no_way_out)
+                        mce_panic("Fatal local machine check", &m, msg);
+        } else {
                order = mce_start(&no_way_out);
+        }
        for (i = 0; i < cfg->banks; i++) {
                __clear_bit(i, toclear);
@@ -1287,12 +1294,17 @@ void do_machine_check(struct pt_regs *regs, long error_code)
                        no_way_out = worst >= MCE_PANIC_SEVERITY;
        } else {
                /*
-                 * Local MCE skipped calling mce_reign()
+                 * If there was a fatal machine check we should have
-                 * If we found a fatal error, we need to panic here.
+                 * already called mce_panic earlier in this function.
+                 * Since we re-read the banks, we might have found
+                 * something new. Check again to see if we found a
+                 * fatal error. We call "mce_severity()" again to
+                 * make sure we have the right "msg".
                 */
-                 if (worst >= MCE_PANIC_SEVERITY && mca_cfg.tolerant < 3)
+                if (worst >= MCE_PANIC_SEVERITY && mca_cfg.tolerant < 3) {
-                        mce_panic("Machine check from unknown source",
+                        mce_severity(&m, cfg->tolerant, &msg, true);
-                                NULL, NULL);
+                        mce_panic("Local fatal machine check!", &m, msg);
+                }
        }
        /*
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 1c2cfa0644aa..97ccf4c3b45b 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -190,8 +190,11 @@ static void save_microcode_patch(void *data, unsigned int size)
                        p = memdup_patch(data, size);
                        if (!p)
                                pr_err("Error allocating buffer %p\n", data);
-                        else
+                        else {
                                list_replace(&iter->plist, &p->plist);
+                                kfree(iter->data);
+                                kfree(iter);
+                        }
                }
        }
diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
index d1f25c831447..c88c23c658c1 100644
--- a/arch/x86/kernel/e820.c
+++ b/arch/x86/kernel/e820.c
@@ -1248,6 +1248,7 @@ void __init e820__memblock_setup(void)
 {
        int i;
        u64 end;
+        u64 addr = 0;
        /*
         * The bootstrap memblock region count maximum is 128 entries
@@ -1264,13 +1265,21 @@ void __init e820__memblock_setup(void)
                struct e820_entry *entry = &e820_table->entries[i];
                end = entry->addr + entry->size;
+                if (addr < entry->addr)
+                        memblock_reserve(addr, entry->addr - addr);
+                addr = end;
                if (end != (resource_size_t)end)
                        continue;
+                /*
+                 * all !E820_TYPE_RAM ranges (including gap ranges) are put
+                 * into memblock.reserved to make sure that struct pages in
+                 * such regions are not left uninitialized after bootup.
+                 */
                if (entry->type != E820_TYPE_RAM && entry->type != E820_TYPE_RESERVED_KERN)
-                        continue;
+                        memblock_reserve(entry->addr, entry->size);
+                else
-                memblock_add(entry->addr, entry->size);
+                        memblock_add(entry->addr, entry->size);
        }
        /* Throw away partial pages: */
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index a21d6ace648e..8047379e575a 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -44,7 +44,7 @@ static unsigned int __initdata next_early_pgt;
 pmdval_t early_pmd_flags = __PAGE_KERNEL_LARGE & ~(_PAGE_GLOBAL | _PAGE_NX);
 #ifdef CONFIG_X86_5LEVEL
-unsigned int __pgtable_l5_enabled __initdata;
+unsigned int __pgtable_l5_enabled __ro_after_init;
 unsigned int pgdir_shift __ro_after_init = 39;
 EXPORT_SYMBOL(pgdir_shift);
 unsigned int ptrs_per_p4d __ro_after_init = 1;
diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
index 697a4ce04308..736348ead421 100644
--- a/arch/x86/kernel/quirks.c
+++ b/arch/x86/kernel/quirks.c
@@ -645,12 +645,19 @@ static void quirk_intel_brickland_xeon_ras_cap(struct pci_dev *pdev)
 /* Skylake */
 static void quirk_intel_purley_xeon_ras_cap(struct pci_dev *pdev)
 {
-        u32 capid0;
+        u32 capid0, capid5;
        pci_read_config_dword(pdev, 0x84, &capid0);
+        pci_read_config_dword(pdev, 0x98, &capid5);
-        if ((capid0 & 0xc0) == 0xc0)
+        /*
+         * CAPID0{7:6} indicate whether this is an advanced RAS SKU
+         * CAPID5{8:5} indicate that various NVDIMM usage modes are
+         * enabled, so memory machine check recovery is also enabled.
+         */
+        if ((capid0 & 0xc0) == 0xc0 || (capid5 & 0x1e0))
                static_branch_inc(&mcsafe_key);
 }
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x0ec3, quirk_intel_brickland_xeon_ras_cap);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2fc0, quirk_intel_brickland_xeon_ras_cap);
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index 445ca11ff863..92a3b312a53c 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -692,7 +692,7 @@ setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs)
         * Increment event counter and perform fixup for the pre-signal
         * frame.
         */
-        rseq_signal_deliver(regs);
+        rseq_signal_deliver(ksig, regs);
        /* Set up the stack frame */
        if (is_ia32_frame(ksig)) {
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index a535dd64de63..e6db475164ed 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -835,16 +835,18 @@ static void math_error(struct pt_regs *regs, int error_code, int trapnr)
        char *str = (trapnr == X86_TRAP_MF) ? "fpu exception" :
                                                "simd exception";
-        if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, SIGFPE) == NOTIFY_STOP)
-                return;
        cond_local_irq_enable(regs);
        if (!user_mode(regs)) {
-                if (!fixup_exception(regs, trapnr)) {
+                if (fixup_exception(regs, trapnr))
-                        task->thread.error_code = error_code;
+                        return;
-                        task->thread.trap_nr = trapnr;
+                task->thread.error_code = error_code;
+                task->thread.trap_nr = trapnr;
+                if (notify_die(DIE_TRAP, str, regs, error_code,
+                                        trapnr, SIGFPE) != NOTIFY_STOP)
                        die(str, regs, error_code);
-                }
                return;
        }
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 58d8d800875d..deb576b23b7c 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -293,7 +293,7 @@ static int uprobe_init_insn(struct arch_uprobe *auprobe, struct insn *insn, bool
        insn_init(insn, auprobe->insn, sizeof(auprobe->insn), x86_64);
        /* has the side-effect of processing the entire instruction */
        insn_get_length(insn);
-        if (WARN_ON_ONCE(!insn_complete(insn)))
+        if (!insn_complete(insn))
                return -ENOEXEC;
        if (is_prefix_bad(insn))
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 559a12b6184d..1689f433f3a0 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1705,6 +1705,17 @@ static inline bool nested_cpu_has_vmwrite_any_field(struct kvm_vcpu *vcpu)
                MSR_IA32_VMX_MISC_VMWRITE_SHADOW_RO_FIELDS;
 }
+static inline bool nested_cpu_has_zero_length_injection(struct kvm_vcpu *vcpu)
+{
+        return to_vmx(vcpu)->nested.msrs.misc_low & VMX_MISC_ZERO_LEN_INS;
+}
+static inline bool nested_cpu_supports_monitor_trap_flag(struct kvm_vcpu *vcpu)
+{
+        return to_vmx(vcpu)->nested.msrs.procbased_ctls_high &
+                        CPU_BASED_MONITOR_TRAP_FLAG;
+}
 static inline bool nested_cpu_has(struct vmcs12 *vmcs12, u32 bit)
 {
        return vmcs12->cpu_based_vm_exec_control & bit;
@@ -11620,6 +11631,62 @@ static int check_vmentry_prereqs(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
            !nested_cr3_valid(vcpu, vmcs12->host_cr3))
                return VMXERR_ENTRY_INVALID_HOST_STATE_FIELD;
+        /*
+         * From the Intel SDM, volume 3:
+         * Fields relevant to VM-entry event injection must be set properly.
+         * These fields are the VM-entry interruption-information field, the
+         * VM-entry exception error code, and the VM-entry instruction length.
+         */
+        if (vmcs12->vm_entry_intr_info_field & INTR_INFO_VALID_MASK) {
+                u32 intr_info = vmcs12->vm_entry_intr_info_field;
+                u8 vector = intr_info & INTR_INFO_VECTOR_MASK;
+                u32 intr_type = intr_info & INTR_INFO_INTR_TYPE_MASK;
+                bool has_error_code = intr_info & INTR_INFO_DELIVER_CODE_MASK;
+                bool should_have_error_code;
+                bool urg = nested_cpu_has2(vmcs12,
+                                           SECONDARY_EXEC_UNRESTRICTED_GUEST);
+                bool prot_mode = !urg || vmcs12->guest_cr0 & X86_CR0_PE;
+                /* VM-entry interruption-info field: interruption type */
+                if (intr_type == INTR_TYPE_RESERVED ||
+                    (intr_type == INTR_TYPE_OTHER_EVENT &&
+                     !nested_cpu_supports_monitor_trap_flag(vcpu)))
+                        return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+                /* VM-entry interruption-info field: vector */
+                if ((intr_type == INTR_TYPE_NMI_INTR && vector != NMI_VECTOR) ||
+                    (intr_type == INTR_TYPE_HARD_EXCEPTION && vector > 31) ||
+                    (intr_type == INTR_TYPE_OTHER_EVENT && vector != 0))
+                        return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+                /* VM-entry interruption-info field: deliver error code */
+                should_have_error_code =
+                        intr_type == INTR_TYPE_HARD_EXCEPTION && prot_mode &&
+                        x86_exception_has_error_code(vector);
+                if (has_error_code != should_have_error_code)
+                        return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+                /* VM-entry exception error code */
+                if (has_error_code &&
+                    vmcs12->vm_entry_exception_error_code & GENMASK(31, 15))
+                        return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+                /* VM-entry interruption-info field: reserved bits */
+                if (intr_info & INTR_INFO_RESVD_BITS_MASK)
+                        return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+                /* VM-entry instruction length */
+                switch (intr_type) {
+                case INTR_TYPE_SOFT_EXCEPTION:
+                case INTR_TYPE_SOFT_INTR:
+                case INTR_TYPE_PRIV_SW_EXCEPTION:
+                        if ((vmcs12->vm_entry_instruction_len > 15) ||
+                            (vmcs12->vm_entry_instruction_len == 0 &&
+                             !nested_cpu_has_zero_length_injection(vcpu)))
+                                return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+                }
+        }
        return 0;
 }
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 331993c49dae..257f27620bc2 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -110,6 +110,15 @@ static inline bool is_la57_mode(struct kvm_vcpu *vcpu)
 #endif
 }
+static inline bool x86_exception_has_error_code(unsigned int vector)
+{
+        static u32 exception_has_error_code = BIT(DF_VECTOR) | BIT(TS_VECTOR) |
+                        BIT(NP_VECTOR) | BIT(SS_VECTOR) | BIT(GP_VECTOR) |
+                        BIT(PF_VECTOR) | BIT(AC_VECTOR);
+        return (1U << vector) & exception_has_error_code;
+}
 static inline bool mmu_is_nested(struct kvm_vcpu *vcpu)
 {
        return vcpu->arch.walk_mmu == &vcpu->arch.nested_mmu;
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 9a84a0d08727..2aafa6ab6103 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -641,11 +641,6 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
        return 0;
 }
-static const char nx_warning[] = KERN_CRIT
-"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
-static const char smep_warning[] = KERN_CRIT
-"unable to execute userspace code (SMEP?) (uid: %d)\n";
 static void
 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
                unsigned long address)
@@ -664,20 +659,18 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
                pte = lookup_address_in_pgd(pgd, address, &level);
                if (pte && pte_present(*pte) && !pte_exec(*pte))
-                        printk(nx_warning, from_kuid(&init_user_ns, current_uid()));
+                        pr_crit("kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n",
+                                from_kuid(&init_user_ns, current_uid()));
                if (pte && pte_present(*pte) && pte_exec(*pte) &&
                                (pgd_flags(*pgd) & _PAGE_USER) &&
                                (__read_cr4() & X86_CR4_SMEP))
-                        printk(smep_warning, from_kuid(&init_user_ns, current_uid()));
+                        pr_crit("unable to execute userspace code (SMEP?) (uid: %d)\n",
+                                from_kuid(&init_user_ns, current_uid()));
        }
-        printk(KERN_ALERT "BUG: unable to handle kernel ");
+        pr_alert("BUG: unable to handle kernel %s at %px\n",
-        if (address < PAGE_SIZE)
+                 address < PAGE_SIZE ? "NULL pointer dereference" : "paging request",
-                printk(KERN_CONT "NULL pointer dereference");
+                 (void *)address);
-        else
-                printk(KERN_CONT "paging request");
-        printk(KERN_CONT " at %px\n", (void *) address);
        dump_pagetable(address);
 }
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 045f492d5f68..a688617c727e 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1350,16 +1350,28 @@ int kern_addr_valid(unsigned long addr)
 /* Amount of ram needed to start using large blocks */
 #define MEM_SIZE_FOR_LARGE_BLOCK (64UL << 30)
+/* Adjustable memory block size */
+static unsigned long set_memory_block_size;
+int __init set_memory_block_size_order(unsigned int order)
+{
+        unsigned long size = 1UL << order;
+        if (size > MEM_SIZE_FOR_LARGE_BLOCK || size < MIN_MEMORY_BLOCK_SIZE)
+                return -EINVAL;
+        set_memory_block_size = size;
+        return 0;
+}
 static unsigned long probe_memory_block_size(void)
 {
        unsigned long boot_mem_end = max_pfn << PAGE_SHIFT;
        unsigned long bz;
-        /* If this is UV system, always set 2G block size */
+        /* If memory block size has been set, then use it */
-        if (is_uv_system()) {
+        bz = set_memory_block_size;
-                bz = MAX_BLOCK_SIZE;
+        if (bz)
                goto done;
-        }
        /* Use regular block if RAM is smaller than MEM_SIZE_FOR_LARGE_BLOCK */
        if (boot_mem_end < MEM_SIZE_FOR_LARGE_BLOCK) {
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index e01f7ceb9e7a..77873ce700ae 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -166,14 +166,14 @@ void __init efi_call_phys_epilog(pgd_t *save_pgd)
                pgd = pgd_offset_k(pgd_idx * PGDIR_SIZE);
                set_pgd(pgd_offset_k(pgd_idx * PGDIR_SIZE), save_pgd[pgd_idx]);
-                if (!(pgd_val(*pgd) & _PAGE_PRESENT))
+                if (!pgd_present(*pgd))
                        continue;
                for (i = 0; i < PTRS_PER_P4D; i++) {
                        p4d = p4d_offset(pgd,
                                         pgd_idx * PGDIR_SIZE + i * P4D_SIZE);
-                        if (!(p4d_val(*p4d) & _PAGE_PRESENT))
+                        if (!p4d_present(*p4d))
                                continue;
                        pud = (pud_t *)p4d_page_vaddr(*p4d);
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index c9081c6671f0..3b5318505c69 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -65,6 +65,13 @@ __read_mostly int xen_have_vector_callback;
 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
 /*
+ * NB: needs to live in .data because it's used by xen_prepare_pvh which runs
+ * before clearing the bss.
+ */
+uint32_t xen_start_flags __attribute__((section(".data"))) = 0;
+EXPORT_SYMBOL(xen_start_flags);
+/*
 * Point at some empty memory to start with. We map the real shared_info
 * page as soon as fixmap is up and running.
 */
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index 357969a3697c..8d4e2e1ae60b 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -1203,6 +1203,7 @@ asmlinkage __visible void __init xen_start_kernel(void)
                return;
        xen_domain_type = XEN_PV_DOMAIN;
+        xen_start_flags = xen_start_info->flags;
        xen_setup_features();
diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c
index aa1c6a6831a9..c85d1a88f476 100644
--- a/arch/x86/xen/enlighten_pvh.c
+++ b/arch/x86/xen/enlighten_pvh.c
@@ -97,6 +97,7 @@ void __init xen_prepare_pvh(void)
        }
        xen_pvh = 1;
+        xen_start_flags = pvh_start_info.flags;
        msr = cpuid_ebx(xen_cpuid_base() + 2);
        pfn = __pa(hypercall_page);
diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
index 2e20ae2fa2d6..e3b18ad49889 100644
--- a/arch/x86/xen/smp_pv.c
+++ b/arch/x86/xen/smp_pv.c
@@ -32,6 +32,7 @@
 #include <xen/interface/vcpu.h>
 #include <xen/interface/xenpmu.h>
+#include <asm/spec-ctrl.h>
 #include <asm/xen/interface.h>
 #include <asm/xen/hypercall.h>
@@ -70,6 +71,8 @@ static void cpu_bringup(void)
        cpu_data(cpu).x86_max_cores = 1;
        set_cpu_sibling_map(cpu);
+        speculative_store_bypass_ht_init();
        xen_setup_cpu_clockevents();
        notify_cpu_starting(cpu);
@@ -250,6 +253,8 @@ static void __init xen_pv_smp_prepare_cpus(unsigned int max_cpus)
        }
        set_cpu_sibling_map(0);
+        speculative_store_bypass_ht_init();
        xen_pmu_init(0);
        if (xen_smp_intr_init(0) || xen_smp_intr_init_pv(0))
diff --git a/block/bio.c b/block/bio.c
index 9710e275f230..67eff5eddc49 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1807,9 +1807,6 @@ again:
        if (!bio_integrity_endio(bio))
                return;
-        if (WARN_ONCE(bio->bi_next, "driver left bi_next not NULL"))
-                bio->bi_next = NULL;
        /*
         * Need to have a real endio function for chained bios, otherwise
         * various corner cases will break (like stacking block devices that
diff --git a/block/blk-core.c b/block/blk-core.c
index cf0ee764b908..f84a9b7b6f5a 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -273,10 +273,6 @@ static void req_bio_endio(struct request *rq, struct bio *bio,
        bio_advance(bio, nbytes);
        /* don't actually finish bio if it's part of flush sequence */
-        /*
-         * XXX this code looks suspicious - it's not consistent with advancing
-         * req->bio in caller
-         */
        if (bio->bi_iter.bi_size == 0 && !(rq->rq_flags & RQF_FLUSH_SEQ))
                bio_endio(bio);
 }
@@ -3081,10 +3077,8 @@ bool blk_update_request(struct request *req, blk_status_t error,
                struct bio *bio = req->bio;
                unsigned bio_bytes = min(bio->bi_iter.bi_size, nr_bytes);
-                if (bio_bytes == bio->bi_iter.bi_size) {
+                if (bio_bytes == bio->bi_iter.bi_size)
                        req->bio = bio->bi_next;
-                        bio->bi_next = NULL;
-                }
                /* Completion has already been traced */
                bio_clear_flag(bio, BIO_TRACE_COMPLETION);
@@ -3479,6 +3473,10 @@ static void __blk_rq_prep_clone(struct request *dst, struct request *src)
        dst->cpu = src->cpu;
        dst->__sector = blk_rq_pos(src);
        dst->__data_len = blk_rq_bytes(src);
+        if (src->rq_flags & RQF_SPECIAL_PAYLOAD) {
+                dst->rq_flags |= RQF_SPECIAL_PAYLOAD;
+                dst->special_vec = src->special_vec;
+        }
        dst->nr_phys_segments = src->nr_phys_segments;
        dst->ioprio = src->ioprio;
        dst->extra_len = src->extra_len;
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index ffa622366922..1c4532e92938 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -356,7 +356,7 @@ static const char *const blk_mq_rq_state_name_array[] = {
 static const char *blk_mq_rq_state_name(enum mq_rq_state rq_state)
 {
-        if (WARN_ON_ONCE((unsigned int)rq_state >
+        if (WARN_ON_ONCE((unsigned int)rq_state >=
                         ARRAY_SIZE(blk_mq_rq_state_name_array)))
                return "(?)";
        return blk_mq_rq_state_name_array[rq_state];
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 70c65bb6c013..95919268564b 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -781,7 +781,6 @@ static void blk_mq_rq_timed_out(struct request *req, bool reserved)
                WARN_ON_ONCE(ret != BLK_EH_RESET_TIMER);
        }
-        req->rq_flags &= ~RQF_TIMED_OUT;
        blk_add_timer(req);
 }
@@ -1076,6 +1075,9 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx **hctx,
 #define BLK_MQ_RESOURCE_DELAY   3               /* ms units */
+/*
+ * Returns true if we did some work AND can potentially do more.
+ */
 bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
                             bool got_budget)
 {
@@ -1206,8 +1208,17 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
                        blk_mq_run_hw_queue(hctx, true);
                else if (needs_restart && (ret == BLK_STS_RESOURCE))
                        blk_mq_delay_run_hw_queue(hctx, BLK_MQ_RESOURCE_DELAY);
+                return false;
        }
+        /*
+         * If the host/device is unable to accept more work, inform the
+         * caller of that.
+         */
+        if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE)
+                return false;
        return (queued + errors) != 0;
 }
diff --git a/block/blk-softirq.c b/block/blk-softirq.c
index 01e2b353a2b9..15c1f5e12eb8 100644
--- a/block/blk-softirq.c
+++ b/block/blk-softirq.c
@@ -144,6 +144,7 @@ do_local:
        local_irq_restore(flags);
 }
+EXPORT_SYMBOL(__blk_complete_request);
 /**
 * blk_complete_request - end I/O on a request
diff --git a/block/blk-timeout.c b/block/blk-timeout.c
index 4b8a48d48ba1..f2cfd56e1606 100644
--- a/block/blk-timeout.c
+++ b/block/blk-timeout.c
@@ -210,6 +210,7 @@ void blk_add_timer(struct request *req)
        if (!req->timeout)
                req->timeout = q->rq_timeout;
+        req->rq_flags &= ~RQF_TIMED_OUT;
        blk_rq_set_deadline(req, jiffies + req->timeout);
        /*
diff --git a/block/sed-opal.c b/block/sed-opal.c
index 945f4b8610e0..e0de4dd448b3 100644
--- a/block/sed-opal.c
+++ b/block/sed-opal.c
@@ -877,7 +877,7 @@ static size_t response_get_string(const struct parsed_resp *resp, int n,
                return 0;
        }
-        if (n > resp->num) {
+        if (n >= resp->num) {
                pr_debug("Response has %d tokens. Can't access %d\n",
                         resp->num, n);
                return 0;
@@ -916,7 +916,7 @@ static u64 response_get_u64(const struct parsed_resp *resp, int n)
                return 0;
        }
-        if (n > resp->num) {
+        if (n >= resp->num) {
                pr_debug("Response has %d tokens. Can't access %d\n",
                         resp->num, n);
                return 0;
diff --git a/certs/blacklist.h b/certs/blacklist.h
index 150d82da8e99..1efd6fa0dc60 100644
--- a/certs/blacklist.h
+++ b/certs/blacklist.h
@@ -1,3 +1,3 @@
 #include <linux/kernel.h>
-extern const char __initdata *const blacklist_hashes[];
+extern const char __initconst *const blacklist_hashes[];
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 49fa8582138b..314c52c967e5 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -1060,12 +1060,19 @@ void af_alg_async_cb(struct crypto_async_request *_req, int err)
 }
 EXPORT_SYMBOL_GPL(af_alg_async_cb);
-__poll_t af_alg_poll_mask(struct socket *sock, __poll_t events)
+/**
+ * af_alg_poll - poll system call handler
+ */
+__poll_t af_alg_poll(struct file *file, struct socket *sock,
+                         poll_table *wait)
 {
        struct sock *sk = sock->sk;
        struct alg_sock *ask = alg_sk(sk);
        struct af_alg_ctx *ctx = ask->private;
-        __poll_t mask = 0;
+        __poll_t mask;
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
        if (!ctx->more || ctx->used)
                mask |= EPOLLIN | EPOLLRDNORM;
@@ -1075,7 +1082,7 @@ __poll_t af_alg_poll_mask(struct socket *sock, __poll_t events)
        return mask;
 }
-EXPORT_SYMBOL_GPL(af_alg_poll_mask);
+EXPORT_SYMBOL_GPL(af_alg_poll);
 /**
 * af_alg_alloc_areq - allocate struct af_alg_async_req
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index 825524f27438..c40a8c7ee8ae 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -375,7 +375,7 @@ static struct proto_ops algif_aead_ops = {
        .sendmsg        =       aead_sendmsg,
        .sendpage       =       af_alg_sendpage,
        .recvmsg        =       aead_recvmsg,
-        .poll_mask      =       af_alg_poll_mask,
+        .poll           =       af_alg_poll,
 };
 static int aead_check_key(struct socket *sock)
@@ -471,7 +471,7 @@ static struct proto_ops algif_aead_ops_nokey = {
        .sendmsg        =       aead_sendmsg_nokey,
        .sendpage       =       aead_sendpage_nokey,
        .recvmsg        =       aead_recvmsg_nokey,
-        .poll_mask      =       af_alg_poll_mask,
+        .poll           =       af_alg_poll,
 };
 static void *aead_bind(const char *name, u32 type, u32 mask)
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 4c04eb9888ad..cfdaab2b7d76 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -206,7 +206,7 @@ static struct proto_ops algif_skcipher_ops = {
        .sendmsg        =       skcipher_sendmsg,
        .sendpage       =       af_alg_sendpage,
        .recvmsg        =       skcipher_recvmsg,
-        .poll_mask      =       af_alg_poll_mask,
+        .poll           =       af_alg_poll,
 };
 static int skcipher_check_key(struct socket *sock)
@@ -302,7 +302,7 @@ static struct proto_ops algif_skcipher_ops_nokey = {
        .sendmsg        =       skcipher_sendmsg_nokey,
        .sendpage       =       skcipher_sendpage_nokey,
        .recvmsg        =       skcipher_recvmsg_nokey,
-        .poll_mask      =       af_alg_poll_mask,
+        .poll           =       af_alg_poll,
 };
 static void *skcipher_bind(const char *name, u32 type, u32 mask)
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index 7d81e6bb461a..b6cabac4b62b 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -249,6 +249,15 @@ int x509_note_signature(void *context, size_t hdrlen,
                return -EINVAL;
        }
+        if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0) {
+                /* Discard the BIT STRING metadata */
+                if (vlen < 1 || *(const u8 *)value != 0)
+                        return -EBADMSG;
+                value++;
+                vlen--;
+        }
        ctx->cert->raw_sig = value;
        ctx->cert->raw_sig_size = vlen;
        return 0;
diff --git a/crypto/morus640.c b/crypto/morus640.c
index 9fbcde307daf..5eede3749e64 100644
--- a/crypto/morus640.c
+++ b/crypto/morus640.c
@@ -274,8 +274,9 @@ static void crypto_morus640_decrypt_chunk(struct morus640_state *state, u8 *dst,
                union morus640_block_in tail;
                memcpy(tail.bytes, src, size);
+                memset(tail.bytes + size, 0, MORUS640_BLOCK_SIZE - size);
-                crypto_morus640_load_a(&m, src);
+                crypto_morus640_load_a(&m, tail.bytes);
                crypto_morus640_core(state, &m);
                crypto_morus640_store_a(tail.bytes, &m);
                memset(tail.bytes + size, 0, MORUS640_BLOCK_SIZE - size);
diff --git a/crypto/sha3_generic.c b/crypto/sha3_generic.c
index 264ec12c0b9c..7f6735d9003f 100644
--- a/crypto/sha3_generic.c
+++ b/crypto/sha3_generic.c
@@ -152,7 +152,7 @@ static SHA3_INLINE void keccakf_round(u64 st[25])
        st[24] ^= bc[ 4];
 }
-static void __optimize("O3") keccakf(u64 st[25])
+static void keccakf(u64 st[25])
 {
        int round;
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 38a286975c31..f8fecfec5df9 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -22,6 +22,7 @@
 #include <linux/pm_domain.h>
 #include <linux/pm_runtime.h>
 #include <linux/pwm.h>
+#include <linux/suspend.h>
 #include <linux/delay.h>
 #include "internal.h"
@@ -946,9 +947,10 @@ static void lpss_iosf_exit_d3_state(void)
        mutex_unlock(&lpss_iosf_mutex);
 }
-static int acpi_lpss_suspend(struct device *dev, bool wakeup)
+static int acpi_lpss_suspend(struct device *dev, bool runtime)
 {
        struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
+        bool wakeup = runtime || device_may_wakeup(dev);
        int ret;
        if (pdata->dev_desc->flags & LPSS_SAVE_CTX)
@@ -961,13 +963,14 @@ static int acpi_lpss_suspend(struct device *dev, bool wakeup)
         * wrong status for devices being about to be powered off. See
         * lpss_iosf_enter_d3_state() for further information.
         */
-        if (lpss_quirks & LPSS_QUIRK_ALWAYS_POWER_ON && iosf_mbi_available())
+        if ((runtime || !pm_suspend_via_firmware()) &&
+            lpss_quirks & LPSS_QUIRK_ALWAYS_POWER_ON && iosf_mbi_available())
                lpss_iosf_enter_d3_state();
        return ret;
 }
-static int acpi_lpss_resume(struct device *dev)
+static int acpi_lpss_resume(struct device *dev, bool runtime)
 {
        struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
        int ret;
@@ -976,7 +979,8 @@ static int acpi_lpss_resume(struct device *dev)
         * This call is kept first to be in symmetry with
         * acpi_lpss_runtime_suspend() one.
         */
-        if (lpss_quirks & LPSS_QUIRK_ALWAYS_POWER_ON && iosf_mbi_available())
+        if ((runtime || !pm_resume_via_firmware()) &&
+            lpss_quirks & LPSS_QUIRK_ALWAYS_POWER_ON && iosf_mbi_available())
                lpss_iosf_exit_d3_state();
        ret = acpi_dev_resume(dev);
@@ -1000,12 +1004,12 @@ static int acpi_lpss_suspend_late(struct device *dev)
                return 0;
        ret = pm_generic_suspend_late(dev);
-        return ret ? ret : acpi_lpss_suspend(dev, device_may_wakeup(dev));
+        return ret ? ret : acpi_lpss_suspend(dev, false);
 }
 static int acpi_lpss_resume_early(struct device *dev)
 {
-        int ret = acpi_lpss_resume(dev);
+        int ret = acpi_lpss_resume(dev, false);
        return ret ? ret : pm_generic_resume_early(dev);
 }
@@ -1020,7 +1024,7 @@ static int acpi_lpss_runtime_suspend(struct device *dev)
 static int acpi_lpss_runtime_resume(struct device *dev)
 {
-        int ret = acpi_lpss_resume(dev);
+        int ret = acpi_lpss_resume(dev, true);
        return ret ? ret : pm_generic_runtime_resume(dev);
 }
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index bb94cf0731fe..442a9e24f439 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -2037,6 +2037,17 @@ static inline void acpi_ec_query_exit(void)
        }
 }
+static const struct dmi_system_id acpi_ec_no_wakeup[] = {
+        {
+                .ident = "Thinkpad X1 Carbon 6th",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "20KGS3JF01"),
+                },
+        },
+        { },
+};
 int __init acpi_ec_init(void)
 {
        int result;
@@ -2047,6 +2058,15 @@ int __init acpi_ec_init(void)
        if (result)
                return result;
+        /*
+         * Disable EC wakeup on following systems to prevent periodic
+         * wakeup from EC GPE.
+         */
+        if (dmi_check_system(acpi_ec_no_wakeup)) {
+                ec_no_wakeup = true;
+                pr_debug("Disabling EC wakeup on suspend-to-idle\n");
+        }
        /* Drivers must be started after acpi_ec_query_init() */
        dsdt_fail = acpi_bus_register_driver(&acpi_ec_driver);
        /*
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 7ca41bf023c9..8df9abfa947b 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -45,6 +45,8 @@
 #include <linux/uaccess.h>
 #include <linux/io-64-nonatomic-lo-hi.h>
+#include "acpica/accommon.h"
+#include "acpica/acnamesp.h"
 #include "internal.h"
 #define _COMPONENT              ACPI_OS_SERVICES
@@ -1490,6 +1492,76 @@ int acpi_check_region(resource_size_t start, resource_size_t n,
 }
 EXPORT_SYMBOL(acpi_check_region);
+static acpi_status acpi_deactivate_mem_region(acpi_handle handle, u32 level,
+                                              void *_res, void **return_value)
+{
+        struct acpi_mem_space_context **mem_ctx;
+        union acpi_operand_object *handler_obj;
+        union acpi_operand_object *region_obj2;
+        union acpi_operand_object *region_obj;
+        struct resource *res = _res;
+        acpi_status status;
+        region_obj = acpi_ns_get_attached_object(handle);
+        if (!region_obj)
+                return AE_OK;
+        handler_obj = region_obj->region.handler;
+        if (!handler_obj)
+                return AE_OK;
+        if (region_obj->region.space_id != ACPI_ADR_SPACE_SYSTEM_MEMORY)
+                return AE_OK;
+        if (!(region_obj->region.flags & AOPOBJ_SETUP_COMPLETE))
+                return AE_OK;
+        region_obj2 = acpi_ns_get_secondary_object(region_obj);
+        if (!region_obj2)
+                return AE_OK;
+        mem_ctx = (void *)&region_obj2->extra.region_context;
+        if (!(mem_ctx[0]->address >= res->start &&
+              mem_ctx[0]->address < res->end))
+                return AE_OK;
+        status = handler_obj->address_space.setup(region_obj,
+                                                  ACPI_REGION_DEACTIVATE,
+                                                  NULL, (void **)mem_ctx);
+        if (ACPI_SUCCESS(status))
+                region_obj->region.flags &= ~(AOPOBJ_SETUP_COMPLETE);
+        return status;
+}
+/**
+ * acpi_release_memory - Release any mappings done to a memory region
+ * @handle: Handle to namespace node
+ * @res: Memory resource
+ * @level: A level that terminates the search
+ *
+ * Walks through @handle and unmaps all SystemMemory Operation Regions that
+ * overlap with @res and that have already been activated (mapped).
+ *
+ * This is a helper that allows drivers to place special requirements on memory
+ * region that may overlap with operation regions, primarily allowing them to
+ * safely map the region as non-cached memory.
+ *
+ * The unmapped Operation Regions will be automatically remapped next time they
+ * are called, so the drivers do not need to do anything else.
+ */
+acpi_status acpi_release_memory(acpi_handle handle, struct resource *res,
+                                u32 level)
+{
+        if (!(res->flags & IORESOURCE_MEM))
+                return AE_TYPE;
+        return acpi_walk_namespace(ACPI_TYPE_REGION, handle, level,
+                                   acpi_deactivate_mem_region, NULL, res, NULL);
+}
+EXPORT_SYMBOL_GPL(acpi_release_memory);
 /*
 * Let drivers know whether the resource checks are effective
 */
diff --git a/drivers/base/Makefile b/drivers/base/Makefile
index b074f242a435..704f44295810 100644
--- a/drivers/base/Makefile
+++ b/drivers/base/Makefile
@@ -8,10 +8,7 @@ obj-y			:= component.o core.o bus.o dd.o syscore.o \
                           topology.o container.o property.o cacheinfo.o \
                           devcon.o
 obj-$(CONFIG_DEVTMPFS)  += devtmpfs.o
-obj-$(CONFIG_DMA_CMA) += dma-contiguous.o
 obj-y                   += power/
-obj-$(CONFIG_HAS_DMA)   += dma-mapping.o
-obj-$(CONFIG_HAVE_GENERIC_DMA_COHERENT) += dma-coherent.o
 obj-$(CONFIG_ISA_BUS_API)       += isa.o
 obj-y                           += firmware_loader/
 obj-$(CONFIG_NUMA)      += node.o
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 36622b52e419..df3e1a44707a 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -236,6 +236,13 @@ struct device_link *device_link_add(struct device *consumer,
                        link->rpm_active = true;
                }
                pm_runtime_new_link(consumer);
+                /*
+                 * If the link is being added by the consumer driver at probe
+                 * time, balance the decrementation of the supplier's runtime PM
+                 * usage counter after consumer probe in driver_probe_device().
+                 */
+                if (consumer->links.status == DL_DEV_PROBING)
+                        pm_runtime_get_noresume(supplier);
        }
        get_device(supplier);
        link->supplier = supplier;
@@ -255,12 +262,12 @@ struct device_link *device_link_add(struct device *consumer,
                        switch (consumer->links.status) {
                        case DL_DEV_PROBING:
                                /*
-                                 * Balance the decrementation of the supplier's
+                                 * Some callers expect the link creation during
-                                 * runtime PM usage counter after consumer probe
+                                 * consumer driver probe to resume the supplier
-                                 * in driver_probe_device().
+                                 * even without DL_FLAG_RPM_ACTIVE.
                                 */
                                if (flags & DL_FLAG_PM_RUNTIME)
-                                        pm_runtime_get_sync(supplier);
+                                        pm_runtime_resume(supplier);
                                link->status = DL_STATE_CONSUMER_PROBE;
                                break;
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 4925af5c4cf0..c298de8a8308 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -2487,10 +2487,9 @@ EXPORT_SYMBOL_GPL(of_genpd_parse_idle_states);
 * power domain corresponding to a DT node's "required-opps" property.
 *
 * @dev: Device for which the performance-state needs to be found.
- * @opp_node: DT node where the "required-opps" property is present. This can be
+ * @np: DT node where the "required-opps" property is present. This can be
 *      the device node itself (if it doesn't have an OPP table) or a node
 *      within the OPP table of a device (if device has an OPP table).
- * @state: Pointer to return performance state.
 *
 * Returns performance state corresponding to the "required-opps" property of
 * a DT node. This calls platform specific genpd->opp_to_performance_state()
@@ -2499,7 +2498,7 @@ EXPORT_SYMBOL_GPL(of_genpd_parse_idle_states);
 * Returns performance state on success and 0 on failure.
 */
 unsigned int of_genpd_opp_to_performance_state(struct device *dev,
-                                               struct device_node *opp_node)
+                                               struct device_node *np)
 {
        struct generic_pm_domain *genpd;
        struct dev_pm_opp *opp;
@@ -2514,7 +2513,7 @@ unsigned int of_genpd_opp_to_performance_state(struct device *dev,
        genpd_lock(genpd);
-        opp = of_dev_pm_opp_find_required_opp(&genpd->dev, opp_node);
+        opp = of_dev_pm_opp_find_required_opp(&genpd->dev, np);
        if (IS_ERR(opp)) {
                dev_err(dev, "Failed to find required OPP: %ld\n",
                        PTR_ERR(opp));
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index a47e4987ee46..d146fedc38bb 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -1244,8 +1244,8 @@ drbd_request_prepare(struct drbd_device *device, struct bio *bio, unsigned long
        _drbd_start_io_acct(device, req);
        /* process discards always from our submitter thread */
-        if ((bio_op(bio) & REQ_OP_WRITE_ZEROES) ||
+        if (bio_op(bio) == REQ_OP_WRITE_ZEROES ||
-            (bio_op(bio) & REQ_OP_DISCARD))
+            bio_op(bio) == REQ_OP_DISCARD)
                goto queue_for_submitter_thread;
        if (rw == WRITE && req->private_bio && req->i.size
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 3b7083b8ecbb..74a05561b620 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -76,6 +76,7 @@ struct link_dead_args {
 #define NBD_HAS_CONFIG_REF              4
 #define NBD_BOUND                       5
 #define NBD_DESTROY_ON_DISCONNECT       6
+#define NBD_DISCONNECT_ON_CLOSE         7
 struct nbd_config {
        u32 flags;
@@ -138,6 +139,7 @@ static void nbd_config_put(struct nbd_device *nbd);
 static void nbd_connect_reply(struct genl_info *info, int index);
 static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info);
 static void nbd_dead_link_work(struct work_struct *work);
+static void nbd_disconnect_and_put(struct nbd_device *nbd);
 static inline struct device *nbd_to_dev(struct nbd_device *nbd)
 {
@@ -1305,6 +1307,12 @@ out:
 static void nbd_release(struct gendisk *disk, fmode_t mode)
 {
        struct nbd_device *nbd = disk->private_data;
+        struct block_device *bdev = bdget_disk(disk, 0);
+        if (test_bit(NBD_DISCONNECT_ON_CLOSE, &nbd->config->runtime_flags) &&
+                        bdev->bd_openers == 0)
+                nbd_disconnect_and_put(nbd);
        nbd_config_put(nbd);
        nbd_put(nbd);
 }
@@ -1705,6 +1713,10 @@ again:
                                &config->runtime_flags);
                        put_dev = true;
                }
+                if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) {
+                        set_bit(NBD_DISCONNECT_ON_CLOSE,
+                                &config->runtime_flags);
+                }
        }
        if (info->attrs[NBD_ATTR_SOCKETS]) {
@@ -1749,6 +1761,17 @@ out:
        return ret;
 }
+static void nbd_disconnect_and_put(struct nbd_device *nbd)
+{
+        mutex_lock(&nbd->config_lock);
+        nbd_disconnect(nbd);
+        nbd_clear_sock(nbd);
+        mutex_unlock(&nbd->config_lock);
+        if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
+                               &nbd->config->runtime_flags))
+                nbd_config_put(nbd);
+}
 static int nbd_genl_disconnect(struct sk_buff *skb, struct genl_info *info)
 {
        struct nbd_device *nbd;
@@ -1781,13 +1804,7 @@ static int nbd_genl_disconnect(struct sk_buff *skb, struct genl_info *info)
                nbd_put(nbd);
                return 0;
        }
-        mutex_lock(&nbd->config_lock);
+        nbd_disconnect_and_put(nbd);
-        nbd_disconnect(nbd);
-        nbd_clear_sock(nbd);
-        mutex_unlock(&nbd->config_lock);
-        if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
-                               &nbd->config->runtime_flags))
-                nbd_config_put(nbd);
        nbd_config_put(nbd);
        nbd_put(nbd);
        return 0;
@@ -1798,7 +1815,7 @@ static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info)
        struct nbd_device *nbd = NULL;
        struct nbd_config *config;
        int index;
-        int ret = -EINVAL;
+        int ret = 0;
        bool put_dev = false;
        if (!netlink_capable(skb, CAP_SYS_ADMIN))
@@ -1838,6 +1855,7 @@ static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info)
            !nbd->task_recv) {
                dev_err(nbd_to_dev(nbd),
                        "not configured, cannot reconfigure\n");
+                ret = -EINVAL;
                goto out;
        }
@@ -1862,6 +1880,14 @@ static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info)
                                               &config->runtime_flags))
                                refcount_inc(&nbd->refs);
                }
+                if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) {
+                        set_bit(NBD_DISCONNECT_ON_CLOSE,
+                                        &config->runtime_flags);
+                } else {
+                        clear_bit(NBD_DISCONNECT_ON_CLOSE,
+                                        &config->runtime_flags);
+                }
        }
        if (info->attrs[NBD_ATTR_SOCKETS]) {
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 7948049f6c43..042c778e5a4e 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -1365,7 +1365,7 @@ static blk_qc_t null_queue_bio(struct request_queue *q, struct bio *bio)
 static enum blk_eh_timer_return null_rq_timed_out_fn(struct request *rq)
 {
        pr_info("null: rq %p timed out\n", rq);
-        blk_mq_complete_request(rq);
+        __blk_complete_request(rq);
        return BLK_EH_DONE;
 }
diff --git a/drivers/bluetooth/hci_nokia.c b/drivers/bluetooth/hci_nokia.c
index 14d159e2042d..2dc33e65d2d0 100644
--- a/drivers/bluetooth/hci_nokia.c
+++ b/drivers/bluetooth/hci_nokia.c
@@ -29,7 +29,7 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/types.h>
-#include <linux/unaligned/le_struct.h>
+#include <asm/unaligned.h>
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index 1cc29629d238..c9bac9dc4637 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -23,11 +23,14 @@
 #include <linux/of_address.h>
 #include <linux/of_platform.h>
 #include <linux/slab.h>
+#include <linux/iopoll.h>
 #include <linux/platform_data/ti-sysc.h>
 #include <dt-bindings/bus/ti-sysc.h>
+#define MAX_MODULE_SOFTRESET_WAIT               10000
 static const char * const reg_names[] = { "rev", "sysc", "syss", };
 enum sysc_clocks {
@@ -88,6 +91,11 @@ struct sysc {
        struct delayed_work idle_work;
 };
+void sysc_write(struct sysc *ddata, int offset, u32 value)
+{
+        writel_relaxed(value, ddata->module_va + offset);
+}
 static u32 sysc_read(struct sysc *ddata, int offset)
 {
        if (ddata->cfg.quirks & SYSC_QUIRK_16BIT) {
@@ -169,9 +177,9 @@ static int sysc_get_clocks(struct sysc *ddata)
        const char *name;
        int nr_fck = 0, nr_ick = 0, i, error = 0;
-        ddata->clock_roles = devm_kzalloc(ddata->dev,
+        ddata->clock_roles = devm_kcalloc(ddata->dev,
-                                          sizeof(*ddata->clock_roles) *
                                          SYSC_MAX_CLOCKS,
+                                          sizeof(*ddata->clock_roles),
                                          GFP_KERNEL);
        if (!ddata->clock_roles)
                return -ENOMEM;
@@ -200,8 +208,8 @@ static int sysc_get_clocks(struct sysc *ddata)
                return -EINVAL;
        }
-        ddata->clocks = devm_kzalloc(ddata->dev,
+        ddata->clocks = devm_kcalloc(ddata->dev,
-                                     sizeof(*ddata->clocks) * ddata->nr_clocks,
+                                     ddata->nr_clocks, sizeof(*ddata->clocks),
                                     GFP_KERNEL);
        if (!ddata->clocks)
                return -ENOMEM;
@@ -943,6 +951,36 @@ static void sysc_init_revision_quirks(struct sysc *ddata)
        }
 }
+static int sysc_reset(struct sysc *ddata)
+{
+        int offset = ddata->offsets[SYSC_SYSCONFIG];
+        int val;
+        if (ddata->legacy_mode || offset < 0 ||
+            ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT)
+                return 0;
+        /*
+         * Currently only support reset status in sysstatus.
+         * Warn and return error in all other cases
+         */
+        if (!ddata->cfg.syss_mask) {
+                dev_err(ddata->dev, "No ti,syss-mask. Reset failed\n");
+                return -EINVAL;
+        }
+        val = sysc_read(ddata, offset);
+        val |= (0x1 << ddata->cap->regbits->srst_shift);
+        sysc_write(ddata, offset, val);
+        /* Poll on reset status */
+        offset = ddata->offsets[SYSC_SYSSTATUS];
+        return readl_poll_timeout(ddata->module_va + offset, val,
+                                  (val & ddata->cfg.syss_mask) == 0x0,
+                                  100, MAX_MODULE_SOFTRESET_WAIT);
+}
 /* At this point the module is configured enough to read the revision */
 static int sysc_init_module(struct sysc *ddata)
 {
@@ -960,6 +998,14 @@ static int sysc_init_module(struct sysc *ddata)
                return 0;
        }
+        error = sysc_reset(ddata);
+        if (error) {
+                dev_err(ddata->dev, "Reset failed with %d\n", error);
+                pm_runtime_put_sync(ddata->dev);
+                return error;
+        }
        ddata->revision = sysc_read_revision(ddata);
        pm_runtime_put_sync(ddata->dev);
@@ -1552,6 +1598,23 @@ static const struct sysc_capabilities sysc_omap4_usb_host_fs = {
        .regbits = &sysc_regbits_omap4_usb_host_fs,
 };
+static const struct sysc_regbits sysc_regbits_dra7_mcan = {
+        .dmadisable_shift = -ENODEV,
+        .midle_shift = -ENODEV,
+        .sidle_shift = -ENODEV,
+        .clkact_shift = -ENODEV,
+        .enwkup_shift = 4,
+        .srst_shift = 0,
+        .emufree_shift = -ENODEV,
+        .autoidle_shift = -ENODEV,
+};
+static const struct sysc_capabilities sysc_dra7_mcan = {
+        .type = TI_SYSC_DRA7_MCAN,
+        .sysc_mask = SYSC_DRA7_MCAN_ENAWAKEUP | SYSC_OMAP4_SOFTRESET,
+        .regbits = &sysc_regbits_dra7_mcan,
+};
 static int sysc_init_pdata(struct sysc *ddata)
 {
        struct ti_sysc_platform_data *pdata = dev_get_platdata(ddata->dev);
@@ -1743,6 +1806,7 @@ static const struct of_device_id sysc_match[] = {
        { .compatible = "ti,sysc-mcasp", .data = &sysc_omap4_mcasp, },
        { .compatible = "ti,sysc-usb-host-fs",
          .data = &sysc_omap4_usb_host_fs, },
+        { .compatible = "ti,sysc-dra7-mcan", .data = &sysc_dra7_mcan, },
        {  },
 };
 MODULE_DEVICE_TABLE(of, sysc_match);
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 91bb98c42a1c..aaf9e5afaad4 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -516,11 +516,18 @@ EXPORT_SYMBOL_GPL(hwrng_register);
 void hwrng_unregister(struct hwrng *rng)
 {
+        int err;
        mutex_lock(&rng_mutex);
        list_del(&rng->list);
-        if (current_rng == rng)
+        if (current_rng == rng) {
-                enable_best_rng();
+                err = enable_best_rng();
+                if (err) {
+                        drop_current_rng();
+                        cur_rng_set_by_user = 0;
+                }
+        }
        if (list_empty(&rng_list)) {
                mutex_unlock(&rng_mutex);
diff --git a/drivers/char/random.c b/drivers/char/random.c
index a8fb0020ba5c..cd888d4ee605 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -402,7 +402,8 @@ static struct poolinfo {
 /*
 * Static global variables
 */
-static DECLARE_WAIT_QUEUE_HEAD(random_wait);
+static DECLARE_WAIT_QUEUE_HEAD(random_read_wait);
+static DECLARE_WAIT_QUEUE_HEAD(random_write_wait);
 static struct fasync_struct *fasync;
 static DEFINE_SPINLOCK(random_ready_list_lock);
@@ -721,8 +722,8 @@ retry:
                /* should we wake readers? */
                if (entropy_bits >= random_read_wakeup_bits &&
-                    wq_has_sleeper(&random_wait)) {
+                    wq_has_sleeper(&random_read_wait)) {
-                        wake_up_interruptible_poll(&random_wait, POLLIN);
+                        wake_up_interruptible(&random_read_wait);
                        kill_fasync(&fasync, SIGIO, POLL_IN);
                }
                /* If the input pool is getting full, send some
@@ -1396,7 +1397,7 @@ retry:
        trace_debit_entropy(r->name, 8 * ibytes);
        if (ibytes &&
            (r->entropy_count >> ENTROPY_SHIFT) < random_write_wakeup_bits) {
-                wake_up_interruptible_poll(&random_wait, POLLOUT);
+                wake_up_interruptible(&random_write_wait);
                kill_fasync(&fasync, SIGIO, POLL_OUT);
        }
@@ -1838,7 +1839,7 @@ _random_read(int nonblock, char __user *buf, size_t nbytes)
                if (nonblock)
                        return -EAGAIN;
-                wait_event_interruptible(random_wait,
+                wait_event_interruptible(random_read_wait,
                        ENTROPY_BITS(&input_pool) >=
                        random_read_wakeup_bits);
                if (signal_pending(current))
@@ -1875,17 +1876,14 @@ urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
        return ret;
 }
-static struct wait_queue_head *
-random_get_poll_head(struct file *file, __poll_t events)
-{
-        return &random_wait;
-}
 static __poll_t
-random_poll_mask(struct file *file, __poll_t events)
+random_poll(struct file *file, poll_table * wait)
 {
-        __poll_t mask = 0;
+        __poll_t mask;
+        poll_wait(file, &random_read_wait, wait);
+        poll_wait(file, &random_write_wait, wait);
+        mask = 0;
        if (ENTROPY_BITS(&input_pool) >= random_read_wakeup_bits)
                mask |= EPOLLIN | EPOLLRDNORM;
        if (ENTROPY_BITS(&input_pool) < random_write_wakeup_bits)
@@ -1992,8 +1990,7 @@ static int random_fasync(int fd, struct file *filp, int on)
 const struct file_operations random_fops = {
        .read  = random_read,
        .write = random_write,
-        .get_poll_head  = random_get_poll_head,
+        .poll  = random_poll,
-        .poll_mask  = random_poll_mask,
        .unlocked_ioctl = random_ioctl,
        .fasync = random_fasync,
        .llseek = noop_llseek,
@@ -2326,7 +2323,7 @@ void add_hwgenerator_randomness(const char *buffer, size_t count,
         * We'll be woken up again once below random_write_wakeup_thresh,
         * or when the calling thread is about to terminate.
         */
-        wait_event_interruptible(random_wait, kthread_should_stop() ||
+        wait_event_interruptible(random_write_wait, kthread_should_stop() ||
                        ENTROPY_BITS(&input_pool) <= random_write_wakeup_bits);
        mix_pool_bytes(poolp, buffer, count);
        credit_entropy_bits(poolp, entropy);
diff --git a/drivers/clk/ti/clk-7xx.c b/drivers/clk/ti/clk-7xx.c
index fb249a1637a5..71a122b2dc67 100644
--- a/drivers/clk/ti/clk-7xx.c
+++ b/drivers/clk/ti/clk-7xx.c
@@ -708,6 +708,7 @@ static const struct omap_clkctrl_reg_data dra7_wkupaon_clkctrl_regs[] __initcons
        { DRA7_COUNTER_32K_CLKCTRL, NULL, 0, "wkupaon_iclk_mux" },
        { DRA7_UART10_CLKCTRL, dra7_uart10_bit_data, CLKF_SW_SUP, "wkupaon_cm:clk:0060:24" },
        { DRA7_DCAN1_CLKCTRL, dra7_dcan1_bit_data, CLKF_SW_SUP, "wkupaon_cm:clk:0068:24" },
+        { DRA7_ADC_CLKCTRL, NULL, CLKF_SW_SUP, "mcan_clk"},
        { 0 },
 };
diff --git a/drivers/clocksource/timer-stm32.c b/drivers/clocksource/timer-stm32.c
index e5cdc3af684c..2717f88c7904 100644
--- a/drivers/clocksource/timer-stm32.c
+++ b/drivers/clocksource/timer-stm32.c
@@ -304,8 +304,10 @@ static int __init stm32_timer_init(struct device_node *node)
        to->private_data = kzalloc(sizeof(struct stm32_timer_private),
                                   GFP_KERNEL);
-        if (!to->private_data)
+        if (!to->private_data) {
+                ret = -ENOMEM;
                goto deinit;
+        }
        rstc = of_reset_control_get(node, NULL);
        if (!IS_ERR(rstc)) {
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 1de5ec8d5ea3..ece120da3353 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -294,6 +294,7 @@ struct pstate_funcs {
 static struct pstate_funcs pstate_funcs __read_mostly;
 static int hwp_active __read_mostly;
+static int hwp_mode_bdw __read_mostly;
 static bool per_cpu_limits __read_mostly;
 static bool hwp_boost __read_mostly;
@@ -1413,7 +1414,15 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
        cpu->pstate.turbo_pstate = pstate_funcs.get_turbo();
        cpu->pstate.scaling = pstate_funcs.get_scaling();
        cpu->pstate.max_freq = cpu->pstate.max_pstate * cpu->pstate.scaling;
-        cpu->pstate.turbo_freq = cpu->pstate.turbo_pstate * cpu->pstate.scaling;
+        if (hwp_active && !hwp_mode_bdw) {
+                unsigned int phy_max, current_max;
+                intel_pstate_get_hwp_max(cpu->cpu, &phy_max, &current_max);
+                cpu->pstate.turbo_freq = phy_max * cpu->pstate.scaling;
+        } else {
+                cpu->pstate.turbo_freq = cpu->pstate.turbo_pstate * cpu->pstate.scaling;
+        }
        if (pstate_funcs.get_aperf_mperf_shift)
                cpu->aperf_mperf_shift = pstate_funcs.get_aperf_mperf_shift();
@@ -2467,28 +2476,36 @@ static inline bool intel_pstate_has_acpi_ppc(void) { return false; }
 static inline void intel_pstate_request_control_from_smm(void) {}
 #endif /* CONFIG_ACPI */
+#define INTEL_PSTATE_HWP_BROADWELL      0x01
+#define ICPU_HWP(model, hwp_mode) \
+        { X86_VENDOR_INTEL, 6, model, X86_FEATURE_HWP, hwp_mode }
 static const struct x86_cpu_id hwp_support_ids[] __initconst = {
-        { X86_VENDOR_INTEL, 6, X86_MODEL_ANY, X86_FEATURE_HWP },
+        ICPU_HWP(INTEL_FAM6_BROADWELL_X, INTEL_PSTATE_HWP_BROADWELL),
+        ICPU_HWP(INTEL_FAM6_BROADWELL_XEON_D, INTEL_PSTATE_HWP_BROADWELL),
+        ICPU_HWP(X86_MODEL_ANY, 0),
        {}
 };
 static int __init intel_pstate_init(void)
 {
+        const struct x86_cpu_id *id;
        int rc;
        if (no_load)
                return -ENODEV;
-        if (x86_match_cpu(hwp_support_ids)) {
+        id = x86_match_cpu(hwp_support_ids);
+        if (id) {
                copy_cpu_funcs(&core_funcs);
                if (!no_hwp) {
                        hwp_active++;
+                        hwp_mode_bdw = id->driver_data;
                        intel_pstate.attr = hwp_cpufreq_attrs;
                        goto hwp_cpu_matched;
                }
        } else {
-                const struct x86_cpu_id *id;
                id = x86_match_cpu(intel_pstate_cpu_ids);
                if (!id)
                        return -ENODEV;
diff --git a/drivers/cpufreq/qcom-cpufreq-kryo.c b/drivers/cpufreq/qcom-cpufreq-kryo.c
index d049fe4b80c4..29389accf3e9 100644
--- a/drivers/cpufreq/qcom-cpufreq-kryo.c
+++ b/drivers/cpufreq/qcom-cpufreq-kryo.c
@@ -42,6 +42,8 @@ enum _msm8996_version {
        NUM_OF_MSM8996_VERSIONS,
 };
+struct platform_device *cpufreq_dt_pdev, *kryo_cpufreq_pdev;
 static enum _msm8996_version __init qcom_cpufreq_kryo_get_msm_id(void)
 {
        size_t len;
@@ -74,7 +76,6 @@ static enum _msm8996_version __init qcom_cpufreq_kryo_get_msm_id(void)
 static int qcom_cpufreq_kryo_probe(struct platform_device *pdev)
 {
        struct opp_table *opp_tables[NR_CPUS] = {0};
-        struct platform_device *cpufreq_dt_pdev;
        enum _msm8996_version msm8996_version;
        struct nvmem_cell *speedbin_nvmem;
        struct device_node *np;
@@ -86,8 +87,8 @@ static int qcom_cpufreq_kryo_probe(struct platform_device *pdev)
        int ret;
        cpu_dev = get_cpu_device(0);
-        if (NULL == cpu_dev)
+        if (!cpu_dev)
-                ret = -ENODEV;
+                return -ENODEV;
        msm8996_version = qcom_cpufreq_kryo_get_msm_id();
        if (NUM_OF_MSM8996_VERSIONS == msm8996_version) {
@@ -96,8 +97,8 @@ static int qcom_cpufreq_kryo_probe(struct platform_device *pdev)
        }
        np = dev_pm_opp_of_get_opp_desc_node(cpu_dev);
-        if (IS_ERR(np))
+        if (!np)
-                return PTR_ERR(np);
+                return -ENOENT;
        ret = of_device_is_compatible(np, "operating-points-v2-kryo-cpu");
        if (!ret) {
@@ -115,6 +116,8 @@ static int qcom_cpufreq_kryo_probe(struct platform_device *pdev)
        speedbin = nvmem_cell_read(speedbin_nvmem, &len);
        nvmem_cell_put(speedbin_nvmem);
+        if (IS_ERR(speedbin))
+                return PTR_ERR(speedbin);
        switch (msm8996_version) {
        case MSM8996_V3:
@@ -127,6 +130,7 @@ static int qcom_cpufreq_kryo_probe(struct platform_device *pdev)
                BUG();
                break;
        }
+        kfree(speedbin);
        for_each_possible_cpu(cpu) {
                cpu_dev = get_cpu_device(cpu);
@@ -162,8 +166,15 @@ free_opp:
        return ret;
 }
+static int qcom_cpufreq_kryo_remove(struct platform_device *pdev)
+{
+        platform_device_unregister(cpufreq_dt_pdev);
+        return 0;
+}
 static struct platform_driver qcom_cpufreq_kryo_driver = {
        .probe = qcom_cpufreq_kryo_probe,
+        .remove = qcom_cpufreq_kryo_remove,
        .driver = {
                .name = "qcom-cpufreq-kryo",
        },
@@ -198,8 +209,9 @@ static int __init qcom_cpufreq_kryo_init(void)
        if (unlikely(ret < 0))
                return ret;
-        ret = PTR_ERR_OR_ZERO(platform_device_register_simple(
+        kryo_cpufreq_pdev = platform_device_register_simple(
-                "qcom-cpufreq-kryo", -1, NULL, 0));
+                "qcom-cpufreq-kryo", -1, NULL, 0);
+        ret = PTR_ERR_OR_ZERO(kryo_cpufreq_pdev);
        if (0 == ret)
                return 0;
@@ -208,5 +220,12 @@ static int __init qcom_cpufreq_kryo_init(void)
 }
 module_init(qcom_cpufreq_kryo_init);
+static void __init qcom_cpufreq_kryo_exit(void)
+{
+        platform_device_unregister(kryo_cpufreq_pdev);
+        platform_driver_unregister(&qcom_cpufreq_kryo_driver);
+}
+module_exit(qcom_cpufreq_kryo_exit);
 MODULE_DESCRIPTION("Qualcomm Technologies, Inc. Kryo CPUfreq driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/crypto/chelsio/chtls/chtls_io.c b/drivers/crypto/chelsio/chtls/chtls_io.c
index 00c7aab8e7d0..afebbd87c4aa 100644
--- a/drivers/crypto/chelsio/chtls/chtls_io.c
+++ b/drivers/crypto/chelsio/chtls/chtls_io.c
@@ -1548,15 +1548,14 @@ skip_copy:
                        tp->urg_data = 0;
                if ((avail + offset) >= skb->len) {
-                        if (likely(skb))
-                                chtls_free_skb(sk, skb);
-                        buffers_freed++;
                        if (ULP_SKB_CB(skb)->flags & ULPCB_FLAG_TLS_HDR) {
                                tp->copied_seq += skb->len;
                                hws->rcvpld = skb->hdr_len;
                        } else {
                                tp->copied_seq += hws->rcvpld;
                        }
+                        chtls_free_skb(sk, skb);
+                        buffers_freed++;
                        hws->copied_seq = 0;
                        if (copied >= target &&
                            !skb_peek(&sk->sk_receive_queue))
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index 903d9c473749..45276abf03aa 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -86,6 +86,7 @@ bool __bdev_dax_supported(struct block_device *bdev, int blocksize)
 {
        struct dax_device *dax_dev;
        bool dax_enabled = false;
+        struct request_queue *q;
        pgoff_t pgoff;
        int err, id;
        void *kaddr;
@@ -99,6 +100,13 @@ bool __bdev_dax_supported(struct block_device *bdev, int blocksize)
                return false;
        }
+        q = bdev_get_queue(bdev);
+        if (!q || !blk_queue_dax(q)) {
+                pr_debug("%s: error: request queue doesn't support dax\n",
+                                bdevname(bdev, buf));
+                return false;
+        }
        err = bdev_dax_pgoff(bdev, 0, PAGE_SIZE, &pgoff);
        if (err) {
                pr_debug("%s: error: unaligned partition for dax\n",
diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c
index 951b6c79f166..624a11cb07e2 100644
--- a/drivers/firmware/dmi-id.c
+++ b/drivers/firmware/dmi-id.c
@@ -47,6 +47,7 @@ DEFINE_DMI_ATTR_WITH_SHOW(product_name,		0444, DMI_PRODUCT_NAME);
 DEFINE_DMI_ATTR_WITH_SHOW(product_version,      0444, DMI_PRODUCT_VERSION);
 DEFINE_DMI_ATTR_WITH_SHOW(product_serial,       0400, DMI_PRODUCT_SERIAL);
 DEFINE_DMI_ATTR_WITH_SHOW(product_uuid,         0400, DMI_PRODUCT_UUID);
+DEFINE_DMI_ATTR_WITH_SHOW(product_sku,          0444, DMI_PRODUCT_SKU);
 DEFINE_DMI_ATTR_WITH_SHOW(product_family,       0444, DMI_PRODUCT_FAMILY);
 DEFINE_DMI_ATTR_WITH_SHOW(board_vendor,         0444, DMI_BOARD_VENDOR);
 DEFINE_DMI_ATTR_WITH_SHOW(board_name,           0444, DMI_BOARD_NAME);
@@ -193,6 +194,7 @@ static void __init dmi_id_init_attr_table(void)
        ADD_DMI_ATTR(product_serial,    DMI_PRODUCT_SERIAL);
        ADD_DMI_ATTR(product_uuid,      DMI_PRODUCT_UUID);
        ADD_DMI_ATTR(product_family,    DMI_PRODUCT_FAMILY);
+        ADD_DMI_ATTR(product_sku,       DMI_PRODUCT_SKU);
        ADD_DMI_ATTR(board_vendor,      DMI_BOARD_VENDOR);
        ADD_DMI_ATTR(board_name,        DMI_BOARD_NAME);
        ADD_DMI_ATTR(board_version,     DMI_BOARD_VERSION);
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 54e66adef252..f2483548cde9 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -447,6 +447,7 @@ static void __init dmi_decode(const struct dmi_header *dm, void *dummy)
                dmi_save_ident(dm, DMI_PRODUCT_VERSION, 6);
                dmi_save_ident(dm, DMI_PRODUCT_SERIAL, 7);
                dmi_save_uuid(dm, DMI_PRODUCT_UUID, 8);
+                dmi_save_ident(dm, DMI_PRODUCT_SKU, 25);
                dmi_save_ident(dm, DMI_PRODUCT_FAMILY, 26);
                break;
        case 2:         /* Base Board Information */
diff --git a/drivers/firmware/efi/libstub/tpm.c b/drivers/firmware/efi/libstub/tpm.c
index caa37a6dd9d4..a90b0b8fc69a 100644
--- a/drivers/firmware/efi/libstub/tpm.c
+++ b/drivers/firmware/efi/libstub/tpm.c
@@ -64,7 +64,7 @@ static void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg)
        efi_guid_t tcg2_guid = EFI_TCG2_PROTOCOL_GUID;
        efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID;
        efi_status_t status;
-        efi_physical_addr_t log_location, log_last_entry;
+        efi_physical_addr_t log_location = 0, log_last_entry = 0;
        struct linux_efi_tpm_eventlog *log_tbl = NULL;
        unsigned long first_entry_addr, last_entry_addr;
        size_t log_size, last_entry_size;
diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index 6692888f04cf..a200a2174611 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -21,6 +21,10 @@
 #define MBOX_DATA28(msg)                ((msg) & ~0xf)
 #define MBOX_CHAN_PROPERTY              8
+#define MAX_RPI_FW_PROP_BUF_SIZE        32
+static struct platform_device *rpi_hwmon;
 struct rpi_firmware {
        struct mbox_client cl;
        struct mbox_chan *chan; /* The property channel. */
@@ -143,18 +147,22 @@ int rpi_firmware_property(struct rpi_firmware *fw,
        /* Single tags are very small (generally 8 bytes), so the
         * stack should be safe.
         */
-        u8 data[buf_size + sizeof(struct rpi_firmware_property_tag_header)];
+        u8 data[sizeof(struct rpi_firmware_property_tag_header) +
+                MAX_RPI_FW_PROP_BUF_SIZE];
        struct rpi_firmware_property_tag_header *header =
                (struct rpi_firmware_property_tag_header *)data;
        int ret;
+        if (WARN_ON(buf_size > sizeof(data) - sizeof(*header)))
+                return -EINVAL;
        header->tag = tag;
        header->buf_size = buf_size;
        header->req_resp_size = 0;
        memcpy(data + sizeof(struct rpi_firmware_property_tag_header),
               tag_data, buf_size);
-        ret = rpi_firmware_property_list(fw, &data, sizeof(data));
+        ret = rpi_firmware_property_list(fw, &data, buf_size + sizeof(*header));
        memcpy(tag_data,
               data + sizeof(struct rpi_firmware_property_tag_header),
               buf_size);
@@ -183,6 +191,20 @@ rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
        }
 }
+static void
+rpi_register_hwmon_driver(struct device *dev, struct rpi_firmware *fw)
+{
+        u32 packet;
+        int ret = rpi_firmware_property(fw, RPI_FIRMWARE_GET_THROTTLED,
+                                        &packet, sizeof(packet));
+        if (ret)
+                return;
+        rpi_hwmon = platform_device_register_data(dev, "raspberrypi-hwmon",
+                                                  -1, NULL, 0);
+}
 static int rpi_firmware_probe(struct platform_device *pdev)
 {
        struct device *dev = &pdev->dev;
@@ -209,6 +231,7 @@ static int rpi_firmware_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, fw);
        rpi_firmware_print_firmware_revision(fw);
+        rpi_register_hwmon_driver(dev, fw);
        return 0;
 }
@@ -217,6 +240,8 @@ static int rpi_firmware_remove(struct platform_device *pdev)
 {
        struct rpi_firmware *fw = platform_get_drvdata(pdev);
+        platform_device_unregister(rpi_hwmon);
+        rpi_hwmon = NULL;
        mbox_free_channel(fw->chan);
        return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 3317d1536f4f..6e5284e6c028 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2158,10 +2158,18 @@ bool amdgpu_device_asic_has_dc_support(enum amd_asic_type asic_type)
        switch (asic_type) {
 #if defined(CONFIG_DRM_AMD_DC)
        case CHIP_BONAIRE:
-        case CHIP_HAWAII:
        case CHIP_KAVERI:
        case CHIP_KABINI:
        case CHIP_MULLINS:
+                /*
+                 * We have systems in the wild with these ASICs that require
+                 * LVDS and VGA support which is not supported with DC.
+                 *
+                 * Fallback to the non-DC driver here by default so as not to
+                 * cause regressions.
+                 */
+                return amdgpu_dc > 0;
+        case CHIP_HAWAII:
        case CHIP_CARRIZO:
        case CHIP_STONEY:
        case CHIP_POLARIS10:
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
index 39ec6b8890a1..e74d620d9699 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
@@ -376,7 +376,7 @@ int amdgpu_fence_driver_start_ring(struct amdgpu_ring *ring,
        struct amdgpu_device *adev = ring->adev;
        uint64_t index;
-        if (ring != &adev->uvd.inst[ring->me].ring) {
+        if (ring->funcs->type != AMDGPU_RING_TYPE_UVD) {
                ring->fence_drv.cpu_addr = &adev->wb.wb[ring->fence_offs];
                ring->fence_drv.gpu_addr = adev->wb.gpu_addr + (ring->fence_offs * 4);
        } else {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index 5e4e1bd90383..3526efa8960e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -762,8 +762,7 @@ int amdgpu_bo_pin_restricted(struct amdgpu_bo *bo, u32 domain,
        domain = amdgpu_mem_type_to_domain(bo->tbo.mem.mem_type);
        if (domain == AMDGPU_GEM_DOMAIN_VRAM) {
                adev->vram_pin_size += amdgpu_bo_size(bo);
-                if (bo->flags & AMDGPU_GEM_CREATE_NO_CPU_ACCESS)
+                adev->invisible_pin_size += amdgpu_vram_mgr_bo_invisible_size(bo);
-                        adev->invisible_pin_size += amdgpu_bo_size(bo);
        } else if (domain == AMDGPU_GEM_DOMAIN_GTT) {
                adev->gart_pin_size += amdgpu_bo_size(bo);
        }
@@ -790,25 +789,22 @@ int amdgpu_bo_unpin(struct amdgpu_bo *bo)
        bo->pin_count--;
        if (bo->pin_count)
                return 0;
-        for (i = 0; i < bo->placement.num_placement; i++) {
-                bo->placements[i].lpfn = 0;
-                bo->placements[i].flags &= ~TTM_PL_FLAG_NO_EVICT;
-        }
-        r = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx);
-        if (unlikely(r)) {
-                dev_err(adev->dev, "%p validate failed for unpin\n", bo);
-                goto error;
-        }
        if (bo->tbo.mem.mem_type == TTM_PL_VRAM) {
                adev->vram_pin_size -= amdgpu_bo_size(bo);
-                if (bo->flags & AMDGPU_GEM_CREATE_NO_CPU_ACCESS)
+                adev->invisible_pin_size -= amdgpu_vram_mgr_bo_invisible_size(bo);
-                        adev->invisible_pin_size -= amdgpu_bo_size(bo);
        } else if (bo->tbo.mem.mem_type == TTM_PL_TT) {
                adev->gart_pin_size -= amdgpu_bo_size(bo);
        }
-error:
+        for (i = 0; i < bo->placement.num_placement; i++) {
+                bo->placements[i].lpfn = 0;
+                bo->placements[i].flags &= ~TTM_PL_FLAG_NO_EVICT;
+        }
+        r = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx);
+        if (unlikely(r))
+                dev_err(adev->dev, "%p validate failed for unpin\n", bo);
        return r;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
index e969c879d87e..e5da4654b630 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
@@ -73,6 +73,7 @@ bool amdgpu_gtt_mgr_has_gart_addr(struct ttm_mem_reg *mem);
 uint64_t amdgpu_gtt_mgr_usage(struct ttm_mem_type_manager *man);
 int amdgpu_gtt_mgr_recover(struct ttm_mem_type_manager *man);
+u64 amdgpu_vram_mgr_bo_invisible_size(struct amdgpu_bo *bo);
 uint64_t amdgpu_vram_mgr_usage(struct ttm_mem_type_manager *man);
 uint64_t amdgpu_vram_mgr_vis_usage(struct ttm_mem_type_manager *man);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index bcf68f80bbf0..3ff08e326838 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -130,7 +130,7 @@ int amdgpu_uvd_sw_init(struct amdgpu_device *adev)
        unsigned version_major, version_minor, family_id;
        int i, j, r;
-        INIT_DELAYED_WORK(&adev->uvd.inst->idle_work, amdgpu_uvd_idle_work_handler);
+        INIT_DELAYED_WORK(&adev->uvd.idle_work, amdgpu_uvd_idle_work_handler);
        switch (adev->asic_type) {
 #ifdef CONFIG_DRM_AMDGPU_CIK
@@ -314,12 +314,12 @@ int amdgpu_uvd_suspend(struct amdgpu_device *adev)
        void *ptr;
        int i, j;
+        cancel_delayed_work_sync(&adev->uvd.idle_work);
        for (j = 0; j < adev->uvd.num_uvd_inst; ++j) {
                if (adev->uvd.inst[j].vcpu_bo == NULL)
                        continue;
-                cancel_delayed_work_sync(&adev->uvd.inst[j].idle_work);
                /* only valid for physical mode */
                if (adev->asic_type < CHIP_POLARIS10) {
                        for (i = 0; i < adev->uvd.max_handles; ++i)
@@ -1145,7 +1145,7 @@ int amdgpu_uvd_get_destroy_msg(struct amdgpu_ring *ring, uint32_t handle,
 static void amdgpu_uvd_idle_work_handler(struct work_struct *work)
 {
        struct amdgpu_device *adev =
-                container_of(work, struct amdgpu_device, uvd.inst->idle_work.work);
+                container_of(work, struct amdgpu_device, uvd.idle_work.work);
        unsigned fences = 0, i, j;
        for (i = 0; i < adev->uvd.num_uvd_inst; ++i) {
@@ -1167,7 +1167,7 @@ static void amdgpu_uvd_idle_work_handler(struct work_struct *work)
                                                               AMD_CG_STATE_GATE);
                }
        } else {
-                schedule_delayed_work(&adev->uvd.inst->idle_work, UVD_IDLE_TIMEOUT);
+                schedule_delayed_work(&adev->uvd.idle_work, UVD_IDLE_TIMEOUT);
        }
 }
@@ -1179,7 +1179,7 @@ void amdgpu_uvd_ring_begin_use(struct amdgpu_ring *ring)
        if (amdgpu_sriov_vf(adev))
                return;
-        set_clocks = !cancel_delayed_work_sync(&adev->uvd.inst->idle_work);
+        set_clocks = !cancel_delayed_work_sync(&adev->uvd.idle_work);
        if (set_clocks) {
                if (adev->pm.dpm_enabled) {
                        amdgpu_dpm_enable_uvd(adev, true);
@@ -1196,7 +1196,7 @@ void amdgpu_uvd_ring_begin_use(struct amdgpu_ring *ring)
 void amdgpu_uvd_ring_end_use(struct amdgpu_ring *ring)
 {
        if (!amdgpu_sriov_vf(ring->adev))
-                schedule_delayed_work(&ring->adev->uvd.inst->idle_work, UVD_IDLE_TIMEOUT);
+                schedule_delayed_work(&ring->adev->uvd.idle_work, UVD_IDLE_TIMEOUT);
 }
 /**
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.h
index b1579fba134c..8b23a1b00c76 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.h
@@ -44,7 +44,6 @@ struct amdgpu_uvd_inst {
        void                    *saved_bo;
        atomic_t                handles[AMDGPU_MAX_UVD_HANDLES];
        struct drm_file         *filp[AMDGPU_MAX_UVD_HANDLES];
-        struct delayed_work     idle_work;
        struct amdgpu_ring      ring;
        struct amdgpu_ring      ring_enc[AMDGPU_MAX_UVD_ENC_RINGS];
        struct amdgpu_irq_src   irq;
@@ -62,6 +61,7 @@ struct amdgpu_uvd {
        bool                    address_64_bit;
        bool                    use_ctx_buf;
        struct amdgpu_uvd_inst          inst[AMDGPU_MAX_UVD_INSTANCES];
+        struct delayed_work     idle_work;
 };
 int amdgpu_uvd_sw_init(struct amdgpu_device *adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index 127e87b470ff..1b4ad9b2a755 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -52,7 +52,7 @@ int amdgpu_vcn_sw_init(struct amdgpu_device *adev)
        unsigned long bo_size;
        const char *fw_name;
        const struct common_firmware_header *hdr;
-        unsigned version_major, version_minor, family_id;
+        unsigned char fw_check;
        int r;
        INIT_DELAYED_WORK(&adev->vcn.idle_work, amdgpu_vcn_idle_work_handler);
@@ -83,12 +83,33 @@ int amdgpu_vcn_sw_init(struct amdgpu_device *adev)
        hdr = (const struct common_firmware_header *)adev->vcn.fw->data;
        adev->vcn.fw_version = le32_to_cpu(hdr->ucode_version);
-        family_id = le32_to_cpu(hdr->ucode_version) & 0xff;
-        version_major = (le32_to_cpu(hdr->ucode_version) >> 24) & 0xff;
-        version_minor = (le32_to_cpu(hdr->ucode_version) >> 8) & 0xff;
-        DRM_INFO("Found VCN firmware Version: %hu.%hu Family ID: %hu\n",
-                version_major, version_minor, family_id);
+        /* Bit 20-23, it is encode major and non-zero for new naming convention.
+         * This field is part of version minor and DRM_DISABLED_FLAG in old naming
+         * convention. Since the l:wq!atest version minor is 0x5B and DRM_DISABLED_FLAG
+         * is zero in old naming convention, this field is always zero so far.
+         * These four bits are used to tell which naming convention is present.
+         */
+        fw_check = (le32_to_cpu(hdr->ucode_version) >> 20) & 0xf;
+        if (fw_check) {
+                unsigned int dec_ver, enc_major, enc_minor, vep, fw_rev;
+                fw_rev = le32_to_cpu(hdr->ucode_version) & 0xfff;
+                enc_minor = (le32_to_cpu(hdr->ucode_version) >> 12) & 0xff;
+                enc_major = fw_check;
+                dec_ver = (le32_to_cpu(hdr->ucode_version) >> 24) & 0xf;
+                vep = (le32_to_cpu(hdr->ucode_version) >> 28) & 0xf;
+                DRM_INFO("Found VCN firmware Version ENC: %hu.%hu DEC: %hu VEP: %hu Revision: %hu\n",
+                        enc_major, enc_minor, dec_ver, vep, fw_rev);
+        } else {
+                unsigned int version_major, version_minor, family_id;
+                family_id = le32_to_cpu(hdr->ucode_version) & 0xff;
+                version_major = (le32_to_cpu(hdr->ucode_version) >> 24) & 0xff;
+                version_minor = (le32_to_cpu(hdr->ucode_version) >> 8) & 0xff;
+                DRM_INFO("Found VCN firmware Version: %hu.%hu Family ID: %hu\n",
+                        version_major, version_minor, family_id);
+        }
        bo_size = AMDGPU_GPU_PAGE_ALIGN(le32_to_cpu(hdr->ucode_size_bytes) + 8)
                  +  AMDGPU_VCN_STACK_SIZE + AMDGPU_VCN_HEAP_SIZE
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index b0eb2f537392..edf16b2b957a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -1463,7 +1463,9 @@ static int amdgpu_vm_bo_split_mapping(struct amdgpu_device *adev,
                        uint64_t count;
                        max_entries = min(max_entries, 16ull * 1024ull);
-                        for (count = 1; count < max_entries; ++count) {
+                        for (count = 1;
+                             count < max_entries / (PAGE_SIZE / AMDGPU_GPU_PAGE_SIZE);
+                             ++count) {
                                uint64_t idx = pfn + count;
                                if (pages_addr[idx] !=
@@ -1476,7 +1478,7 @@ static int amdgpu_vm_bo_split_mapping(struct amdgpu_device *adev,
                                dma_addr = pages_addr;
                        } else {
                                addr = pages_addr[pfn];
-                                max_entries = count;
+                                max_entries = count * (PAGE_SIZE / AMDGPU_GPU_PAGE_SIZE);
                        }
                } else if (flags & AMDGPU_PTE_VALID) {
@@ -1491,7 +1493,7 @@ static int amdgpu_vm_bo_split_mapping(struct amdgpu_device *adev,
                if (r)
                        return r;
-                pfn += last - start + 1;
+                pfn += (last - start + 1) / (PAGE_SIZE / AMDGPU_GPU_PAGE_SIZE);
                if (nodes && nodes->size == pfn) {
                        pfn = 0;
                        ++nodes;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
index 9aca653bec07..b6333f92ba45 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
@@ -97,6 +97,38 @@ static u64 amdgpu_vram_mgr_vis_size(struct amdgpu_device *adev,
 }
 /**
+ * amdgpu_vram_mgr_bo_invisible_size - CPU invisible BO size
+ *
+ * @bo: &amdgpu_bo buffer object (must be in VRAM)
+ *
+ * Returns:
+ * How much of the given &amdgpu_bo buffer object lies in CPU invisible VRAM.
+ */
+u64 amdgpu_vram_mgr_bo_invisible_size(struct amdgpu_bo *bo)
+{
+        struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev);
+        struct ttm_mem_reg *mem = &bo->tbo.mem;
+        struct drm_mm_node *nodes = mem->mm_node;
+        unsigned pages = mem->num_pages;
+        u64 usage = 0;
+        if (adev->gmc.visible_vram_size == adev->gmc.real_vram_size)
+                return 0;
+        if (mem->start >= adev->gmc.visible_vram_size >> PAGE_SHIFT)
+                return amdgpu_bo_size(bo);
+        while (nodes && pages) {
+                usage += nodes->size << PAGE_SHIFT;
+                usage -= amdgpu_vram_mgr_vis_size(adev, nodes);
+                pages -= nodes->size;
+                ++nodes;
+        }
+        return usage;
+}
+/**
 * amdgpu_vram_mgr_new - allocate new ranges
 *
 * @man: TTM memory type manager
@@ -135,7 +167,8 @@ static int amdgpu_vram_mgr_new(struct ttm_mem_type_manager *man,
                num_nodes = DIV_ROUND_UP(mem->num_pages, pages_per_node);
        }
-        nodes = kcalloc(num_nodes, sizeof(*nodes), GFP_KERNEL);
+        nodes = kvmalloc_array(num_nodes, sizeof(*nodes),
+                               GFP_KERNEL | __GFP_ZERO);
        if (!nodes)
                return -ENOMEM;
@@ -190,7 +223,7 @@ error:
                drm_mm_remove_node(&nodes[i]);
        spin_unlock(&mgr->lock);
-        kfree(nodes);
+        kvfree(nodes);
        return r == -ENOSPC ? 0 : r;
 }
@@ -229,7 +262,7 @@ static void amdgpu_vram_mgr_del(struct ttm_mem_type_manager *man,
        atomic64_sub(usage, &mgr->usage);
        atomic64_sub(vis_usage, &mgr->vis_usage);
-        kfree(mem->mm_node);
+        kvfree(mem->mm_node);
        mem->mm_node = NULL;
 }
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index f9add85157e7..3a8d6356afc2 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -3928,10 +3928,11 @@ static void amdgpu_dm_do_flip(struct drm_crtc *crtc,
        if (acrtc->base.state->event)
                prepare_flip_isr(acrtc);
+        spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
        surface_updates->surface = dc_stream_get_status(acrtc_state->stream)->plane_states[0];
        surface_updates->flip_addr = &addr;
        dc_commit_updates_for_stream(adev->dm.dc,
                                             surface_updates,
                                             1,
@@ -3944,9 +3945,6 @@ static void amdgpu_dm_do_flip(struct drm_crtc *crtc,
                         __func__,
                         addr.address.grph.addr.high_part,
                         addr.address.grph.addr.low_part);
-        spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
 }
 /*
@@ -4206,6 +4204,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
        struct drm_connector *connector;
        struct drm_connector_state *old_con_state, *new_con_state;
        struct dm_crtc_state *dm_old_crtc_state, *dm_new_crtc_state;
+        int crtc_disable_count = 0;
        drm_atomic_helper_update_legacy_modeset_state(dev, state);
@@ -4410,6 +4409,9 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
                struct amdgpu_crtc *acrtc = to_amdgpu_crtc(crtc);
                bool modeset_needed;
+                if (old_crtc_state->active && !new_crtc_state->active)
+                        crtc_disable_count++;
                dm_new_crtc_state = to_dm_crtc_state(new_crtc_state);
                dm_old_crtc_state = to_dm_crtc_state(old_crtc_state);
                modeset_needed = modeset_required(
@@ -4463,11 +4465,9 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
         * so we can put the GPU into runtime suspend if we're not driving any
         * displays anymore
         */
+        for (i = 0; i < crtc_disable_count; i++)
+                pm_runtime_put_autosuspend(dev->dev);
        pm_runtime_mark_last_busy(dev->dev);
-        for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
-                if (old_crtc_state->active && !new_crtc_state->active)
-                        pm_runtime_put_autosuspend(dev->dev);
-        }
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c
index dbe4b1f66784..22364875a943 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c
@@ -1090,7 +1090,7 @@ static int vega10_disable_se_edc_config(struct pp_hwmgr *hwmgr)
 static int vega10_enable_psm_gc_edc_config(struct pp_hwmgr *hwmgr)
 {
        struct amdgpu_device *adev = hwmgr->adev;
-        int result;
+        int result = 0;
        uint32_t num_se = 0;
        uint32_t count, data;
diff --git a/drivers/gpu/drm/arm/malidp_drv.c b/drivers/gpu/drm/arm/malidp_drv.c
index 8d20faa198cf..0a788d76ed5f 100644
--- a/drivers/gpu/drm/arm/malidp_drv.c
+++ b/drivers/gpu/drm/arm/malidp_drv.c
@@ -278,7 +278,6 @@ static int malidp_init(struct drm_device *drm)
 static void malidp_fini(struct drm_device *drm)
 {
-        drm_atomic_helper_shutdown(drm);
        drm_mode_config_cleanup(drm);
 }
@@ -646,6 +645,7 @@ vblank_fail:
        malidp_de_irq_fini(drm);
        drm->irq_enabled = false;
 irq_init_fail:
+        drm_atomic_helper_shutdown(drm);
        component_unbind_all(dev, drm);
 bind_fail:
        of_node_put(malidp->crtc.port);
@@ -681,6 +681,7 @@ static void malidp_unbind(struct device *dev)
        malidp_se_irq_fini(drm);
        malidp_de_irq_fini(drm);
        drm->irq_enabled = false;
+        drm_atomic_helper_shutdown(drm);
        component_unbind_all(dev, drm);
        of_node_put(malidp->crtc.port);
        malidp->crtc.port = NULL;
diff --git a/drivers/gpu/drm/arm/malidp_hw.c b/drivers/gpu/drm/arm/malidp_hw.c
index d789b46dc817..069783e715f1 100644
--- a/drivers/gpu/drm/arm/malidp_hw.c
+++ b/drivers/gpu/drm/arm/malidp_hw.c
@@ -634,7 +634,8 @@ const struct malidp_hw malidp_device[MALIDP_MAX_DEVICES] = {
                                .vsync_irq = MALIDP500_DE_IRQ_VSYNC,
                        },
                        .se_irq_map = {
-                                .irq_mask = MALIDP500_SE_IRQ_CONF_MODE,
+                                .irq_mask = MALIDP500_SE_IRQ_CONF_MODE |
+                                            MALIDP500_SE_IRQ_GLOBAL,
                                .vsync_irq = 0,
                        },
                        .dc_irq_map = {
diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
index 7a44897c50fe..29409a65d864 100644
--- a/drivers/gpu/drm/arm/malidp_planes.c
+++ b/drivers/gpu/drm/arm/malidp_planes.c
@@ -23,6 +23,7 @@
 /* Layer specific register offsets */
 #define MALIDP_LAYER_FORMAT             0x000
+#define   LAYER_FORMAT_MASK             0x3f
 #define MALIDP_LAYER_CONTROL            0x004
 #define   LAYER_ENABLE                  (1 << 0)
 #define   LAYER_FLOWCFG_MASK            7
@@ -235,8 +236,8 @@ static int malidp_de_plane_check(struct drm_plane *plane,
        if (state->rotation & MALIDP_ROTATED_MASK) {
                int val;
-                val = mp->hwdev->hw->rotmem_required(mp->hwdev, state->crtc_h,
+                val = mp->hwdev->hw->rotmem_required(mp->hwdev, state->crtc_w,
-                                                     state->crtc_w,
+                                                     state->crtc_h,
                                                     fb->format->format);
                if (val < 0)
                        return val;
@@ -337,7 +338,9 @@ static void malidp_de_plane_update(struct drm_plane *plane,
        dest_w = plane->state->crtc_w;
        dest_h = plane->state->crtc_h;
-        malidp_hw_write(mp->hwdev, ms->format, mp->layer->base);
+        val = malidp_hw_read(mp->hwdev, mp->layer->base);
+        val = (val & ~LAYER_FORMAT_MASK) | ms->format;
+        malidp_hw_write(mp->hwdev, val, mp->layer->base);
        for (i = 0; i < ms->n_planes; i++) {
                /* calculate the offset for the layer's plane registers */
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
index 73c875db45f4..47e0992f3908 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
@@ -839,7 +839,7 @@ static int atmel_hlcdc_plane_init_properties(struct atmel_hlcdc_plane *plane)
                        return ret;
        }
-        if (desc->layout.xstride && desc->layout.pstride) {
+        if (desc->layout.xstride[0] && desc->layout.pstride[0]) {
                int ret;
                ret = drm_plane_create_rotation_property(&plane->base,
diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
index 7ab36042a822..250effa0e6b8 100644
--- a/drivers/gpu/drm/bridge/sil-sii8620.c
+++ b/drivers/gpu/drm/bridge/sil-sii8620.c
@@ -36,8 +36,11 @@
 #define SII8620_BURST_BUF_LEN 288
 #define VAL_RX_HDMI_CTRL2_DEFVAL VAL_RX_HDMI_CTRL2_IDLE_CNT(3)
-#define MHL1_MAX_LCLK 225000
-#define MHL3_MAX_LCLK 600000
+#define MHL1_MAX_PCLK 75000
+#define MHL1_MAX_PCLK_PP_MODE 150000
+#define MHL3_MAX_PCLK 200000
+#define MHL3_MAX_PCLK_PP_MODE 300000
 enum sii8620_mode {
        CM_DISCONNECTED,
@@ -80,6 +83,9 @@ struct sii8620 {
        u8 devcap[MHL_DCAP_SIZE];
        u8 xdevcap[MHL_XDC_SIZE];
        u8 avif[HDMI_INFOFRAME_SIZE(AVI)];
+        bool feature_complete;
+        bool devcap_read;
+        bool sink_detected;
        struct edid *edid;
        unsigned int gen2_write_burst:1;
        enum sii8620_mt_state mt_state;
@@ -476,7 +482,7 @@ static void sii8620_update_array(u8 *dst, u8 *src, int count)
        }
 }
-static void sii8620_sink_detected(struct sii8620 *ctx, int ret)
+static void sii8620_identify_sink(struct sii8620 *ctx)
 {
        static const char * const sink_str[] = {
                [SINK_NONE] = "NONE",
@@ -487,7 +493,7 @@ static void sii8620_sink_detected(struct sii8620 *ctx, int ret)
        char sink_name[20];
        struct device *dev = ctx->dev;
-        if (ret < 0)
+        if (!ctx->sink_detected || !ctx->devcap_read)
                return;
        sii8620_fetch_edid(ctx);
@@ -496,6 +502,7 @@ static void sii8620_sink_detected(struct sii8620 *ctx, int ret)
                sii8620_mhl_disconnected(ctx);
                return;
        }
+        sii8620_set_upstream_edid(ctx);
        if (drm_detect_hdmi_monitor(ctx->edid))
                ctx->sink_type = SINK_HDMI;
@@ -508,53 +515,6 @@ static void sii8620_sink_detected(struct sii8620 *ctx, int ret)
                 sink_str[ctx->sink_type], sink_name);
 }
-static void sii8620_hsic_init(struct sii8620 *ctx)
-{
-        if (!sii8620_is_mhl3(ctx))
-                return;
-        sii8620_write(ctx, REG_FCGC,
-                BIT_FCGC_HSIC_HOSTMODE | BIT_FCGC_HSIC_ENABLE);
-        sii8620_setbits(ctx, REG_HRXCTRL3,
-                BIT_HRXCTRL3_HRX_STAY_RESET | BIT_HRXCTRL3_STATUS_EN, ~0);
-        sii8620_setbits(ctx, REG_TTXNUMB, MSK_TTXNUMB_TTX_NUMBPS, 4);
-        sii8620_setbits(ctx, REG_TRXCTRL, BIT_TRXCTRL_TRX_FROM_SE_COC, ~0);
-        sii8620_setbits(ctx, REG_HTXCTRL, BIT_HTXCTRL_HTX_DRVCONN1, 0);
-        sii8620_setbits(ctx, REG_KEEPER, MSK_KEEPER_MODE, VAL_KEEPER_MODE_HOST);
-        sii8620_write_seq_static(ctx,
-                REG_TDMLLCTL, 0,
-                REG_UTSRST, BIT_UTSRST_HRX_SRST | BIT_UTSRST_HTX_SRST |
-                        BIT_UTSRST_KEEPER_SRST | BIT_UTSRST_FC_SRST,
-                REG_UTSRST, BIT_UTSRST_HRX_SRST | BIT_UTSRST_HTX_SRST,
-                REG_HRXINTL, 0xff,
-                REG_HRXINTH, 0xff,
-                REG_TTXINTL, 0xff,
-                REG_TTXINTH, 0xff,
-                REG_TRXINTL, 0xff,
-                REG_TRXINTH, 0xff,
-                REG_HTXINTL, 0xff,
-                REG_HTXINTH, 0xff,
-                REG_FCINTR0, 0xff,
-                REG_FCINTR1, 0xff,
-                REG_FCINTR2, 0xff,
-                REG_FCINTR3, 0xff,
-                REG_FCINTR4, 0xff,
-                REG_FCINTR5, 0xff,
-                REG_FCINTR6, 0xff,
-                REG_FCINTR7, 0xff
-        );
-}
-static void sii8620_edid_read(struct sii8620 *ctx, int ret)
-{
-        if (ret < 0)
-                return;
-        sii8620_set_upstream_edid(ctx);
-        sii8620_hsic_init(ctx);
-        sii8620_enable_hpd(ctx);
-}
 static void sii8620_mr_devcap(struct sii8620 *ctx)
 {
        u8 dcap[MHL_DCAP_SIZE];
@@ -570,6 +530,8 @@ static void sii8620_mr_devcap(struct sii8620 *ctx)
                 dcap[MHL_DCAP_ADOPTER_ID_H], dcap[MHL_DCAP_ADOPTER_ID_L],
                 dcap[MHL_DCAP_DEVICE_ID_H], dcap[MHL_DCAP_DEVICE_ID_L]);
        sii8620_update_array(ctx->devcap, dcap, MHL_DCAP_SIZE);
+        ctx->devcap_read = true;
+        sii8620_identify_sink(ctx);
 }
 static void sii8620_mr_xdevcap(struct sii8620 *ctx)
@@ -807,6 +769,7 @@ static void sii8620_burst_rx_all(struct sii8620 *ctx)
 static void sii8620_fetch_edid(struct sii8620 *ctx)
 {
        u8 lm_ddc, ddc_cmd, int3, cbus;
+        unsigned long timeout;
        int fetched, i;
        int edid_len = EDID_LENGTH;
        u8 *edid;
@@ -856,23 +819,31 @@ static void sii8620_fetch_edid(struct sii8620 *ctx)
                        REG_DDC_CMD, ddc_cmd | VAL_DDC_CMD_ENH_DDC_READ_NO_ACK
                );
-                do {
+                int3 = 0;
-                        int3 = sii8620_readb(ctx, REG_INTR3);
+                timeout = jiffies + msecs_to_jiffies(200);
+                for (;;) {
                        cbus = sii8620_readb(ctx, REG_CBUS_STATUS);
+                        if (~cbus & BIT_CBUS_STATUS_CBUS_CONNECTED) {
-                        if (int3 & BIT_DDC_CMD_DONE)
+                                kfree(edid);
-                                break;
+                                edid = NULL;
+                                goto end;
-                        if (!(cbus & BIT_CBUS_STATUS_CBUS_CONNECTED)) {
+                        }
+                        if (int3 & BIT_DDC_CMD_DONE) {
+                                if (sii8620_readb(ctx, REG_DDC_DOUT_CNT)
+                                    >= FETCH_SIZE)
+                                        break;
+                        } else {
+                                int3 = sii8620_readb(ctx, REG_INTR3);
+                        }
+                        if (time_is_before_jiffies(timeout)) {
+                                ctx->error = -ETIMEDOUT;
+                                dev_err(ctx->dev, "timeout during EDID read\n");
                                kfree(edid);
                                edid = NULL;
                                goto end;
                        }
-                } while (1);
-                sii8620_readb(ctx, REG_DDC_STATUS);
-                while (sii8620_readb(ctx, REG_DDC_DOUT_CNT) < FETCH_SIZE)
                        usleep_range(10, 20);
+                }
                sii8620_read_buf(ctx, REG_DDC_DATA, edid + fetched, FETCH_SIZE);
                if (fetched + FETCH_SIZE == EDID_LENGTH) {
@@ -971,8 +942,17 @@ static int sii8620_hw_on(struct sii8620 *ctx)
        ret = regulator_bulk_enable(ARRAY_SIZE(ctx->supplies), ctx->supplies);
        if (ret)
                return ret;
        usleep_range(10000, 20000);
-        return clk_prepare_enable(ctx->clk_xtal);
+        ret = clk_prepare_enable(ctx->clk_xtal);
+        if (ret)
+                return ret;
+        msleep(100);
+        gpiod_set_value(ctx->gpio_reset, 0);
+        msleep(100);
+        return 0;
 }
 static int sii8620_hw_off(struct sii8620 *ctx)
@@ -982,17 +962,6 @@ static int sii8620_hw_off(struct sii8620 *ctx)
        return regulator_bulk_disable(ARRAY_SIZE(ctx->supplies), ctx->supplies);
 }
-static void sii8620_hw_reset(struct sii8620 *ctx)
-{
-        usleep_range(10000, 20000);
-        gpiod_set_value(ctx->gpio_reset, 0);
-        usleep_range(5000, 20000);
-        gpiod_set_value(ctx->gpio_reset, 1);
-        usleep_range(10000, 20000);
-        gpiod_set_value(ctx->gpio_reset, 0);
-        msleep(300);
-}
 static void sii8620_cbus_reset(struct sii8620 *ctx)
 {
        sii8620_write(ctx, REG_PWD_SRST, BIT_PWD_SRST_CBUS_RST
@@ -1048,20 +1017,11 @@ static void sii8620_stop_video(struct sii8620 *ctx)
 static void sii8620_set_format(struct sii8620 *ctx)
 {
-        u8 out_fmt;
        if (sii8620_is_mhl3(ctx)) {
                sii8620_setbits(ctx, REG_M3_P0CTRL,
                                BIT_M3_P0CTRL_MHL3_P0_PIXEL_MODE_PACKED,
                                ctx->use_packed_pixel ? ~0 : 0);
        } else {
-                if (ctx->use_packed_pixel)
-                        sii8620_write_seq_static(ctx,
-                                REG_VID_MODE, BIT_VID_MODE_M1080P,
-                                REG_MHL_TOP_CTL, BIT_MHL_TOP_CTL_MHL_PP_SEL | 1,
-                                REG_MHLTX_CTL6, 0x60
-                        );
-                else
                        sii8620_write_seq_static(ctx,
                                REG_VID_MODE, 0,
                                REG_MHL_TOP_CTL, 1,
@@ -1069,15 +1029,9 @@ static void sii8620_set_format(struct sii8620 *ctx)
                        );
        }
-        if (ctx->use_packed_pixel)
-                out_fmt = VAL_TPI_FORMAT(YCBCR422, FULL) |
-                        BIT_TPI_OUTPUT_CSCMODE709;
-        else
-                out_fmt = VAL_TPI_FORMAT(RGB, FULL);
        sii8620_write_seq(ctx,
                REG_TPI_INPUT, VAL_TPI_FORMAT(RGB, FULL),
-                REG_TPI_OUTPUT, out_fmt,
+                REG_TPI_OUTPUT, VAL_TPI_FORMAT(RGB, FULL),
        );
 }
@@ -1216,7 +1170,7 @@ static void sii8620_start_video(struct sii8620 *ctx)
                int clk = ctx->pixel_clock * (ctx->use_packed_pixel ? 2 : 3);
                int i;
-                for (i = 0; i < ARRAY_SIZE(clk_spec); ++i)
+                for (i = 0; i < ARRAY_SIZE(clk_spec) - 1; ++i)
                        if (clk < clk_spec[i].max_clk)
                                break;
@@ -1534,6 +1488,16 @@ static void sii8620_set_mode(struct sii8620 *ctx, enum sii8620_mode mode)
        );
 }
+static void sii8620_hpd_unplugged(struct sii8620 *ctx)
+{
+        sii8620_disable_hpd(ctx);
+        ctx->sink_type = SINK_NONE;
+        ctx->sink_detected = false;
+        ctx->feature_complete = false;
+        kfree(ctx->edid);
+        ctx->edid = NULL;
+}
 static void sii8620_disconnect(struct sii8620 *ctx)
 {
        sii8620_disable_gen2_write_burst(ctx);
@@ -1561,7 +1525,7 @@ static void sii8620_disconnect(struct sii8620 *ctx)
                REG_MHL_DP_CTL6, 0x2A,
                REG_MHL_DP_CTL7, 0x03
        );
-        sii8620_disable_hpd(ctx);
+        sii8620_hpd_unplugged(ctx);
        sii8620_write_seq_static(ctx,
                REG_M3_CTRL, VAL_M3_CTRL_MHL3_VALUE,
                REG_MHL_COC_CTL1, 0x07,
@@ -1609,10 +1573,8 @@ static void sii8620_disconnect(struct sii8620 *ctx)
        memset(ctx->xstat, 0, sizeof(ctx->xstat));
        memset(ctx->devcap, 0, sizeof(ctx->devcap));
        memset(ctx->xdevcap, 0, sizeof(ctx->xdevcap));
+        ctx->devcap_read = false;
        ctx->cbus_status = 0;
-        ctx->sink_type = SINK_NONE;
-        kfree(ctx->edid);
-        ctx->edid = NULL;
        sii8620_mt_cleanup(ctx);
 }
@@ -1703,9 +1665,6 @@ static void sii8620_status_changed_path(struct sii8620 *ctx)
                sii8620_mt_write_stat(ctx, MHL_DST_REG(LINK_MODE),
                                      MHL_DST_LM_CLK_MODE_NORMAL
                                      | MHL_DST_LM_PATH_ENABLED);
-                if (!sii8620_is_mhl3(ctx))
-                        sii8620_mt_read_devcap(ctx, false);
-                sii8620_mt_set_cont(ctx, sii8620_sink_detected);
        } else {
                sii8620_mt_write_stat(ctx, MHL_DST_REG(LINK_MODE),
                                      MHL_DST_LM_CLK_MODE_NORMAL);
@@ -1722,9 +1681,14 @@ static void sii8620_msc_mr_write_stat(struct sii8620 *ctx)
        sii8620_update_array(ctx->stat, st, MHL_DST_SIZE);
        sii8620_update_array(ctx->xstat, xst, MHL_XDS_SIZE);
-        if (ctx->stat[MHL_DST_CONNECTED_RDY] & MHL_DST_CONN_DCAP_RDY)
+        if (ctx->stat[MHL_DST_CONNECTED_RDY] & st[MHL_DST_CONNECTED_RDY] &
+            MHL_DST_CONN_DCAP_RDY) {
                sii8620_status_dcap_ready(ctx);
+                if (!sii8620_is_mhl3(ctx))
+                        sii8620_mt_read_devcap(ctx, false);
+        }
        if (st[MHL_DST_LINK_MODE] & MHL_DST_LM_PATH_ENABLED)
                sii8620_status_changed_path(ctx);
 }
@@ -1808,8 +1772,11 @@ static void sii8620_msc_mr_set_int(struct sii8620 *ctx)
        }
        if (ints[MHL_INT_RCHANGE] & MHL_INT_RC_FEAT_REQ)
                sii8620_send_features(ctx);
-        if (ints[MHL_INT_RCHANGE] & MHL_INT_RC_FEAT_COMPLETE)
+        if (ints[MHL_INT_RCHANGE] & MHL_INT_RC_FEAT_COMPLETE) {
-                sii8620_edid_read(ctx, 0);
+                ctx->feature_complete = true;
+                if (ctx->edid)
+                        sii8620_enable_hpd(ctx);
+        }
 }
 static struct sii8620_mt_msg *sii8620_msc_msg_first(struct sii8620 *ctx)
@@ -1884,6 +1851,15 @@ static void sii8620_irq_msc(struct sii8620 *ctx)
        if (stat & BIT_CBUS_MSC_MR_WRITE_STAT)
                sii8620_msc_mr_write_stat(ctx);
+        if (stat & BIT_CBUS_HPD_CHG) {
+                if (ctx->cbus_status & BIT_CBUS_STATUS_CBUS_HPD) {
+                        ctx->sink_detected = true;
+                        sii8620_identify_sink(ctx);
+                } else {
+                        sii8620_hpd_unplugged(ctx);
+                }
+        }
        if (stat & BIT_CBUS_MSC_MR_SET_INT)
                sii8620_msc_mr_set_int(ctx);
@@ -1931,14 +1907,6 @@ static void sii8620_irq_edid(struct sii8620 *ctx)
                ctx->mt_state = MT_STATE_DONE;
 }
-static void sii8620_scdt_high(struct sii8620 *ctx)
-{
-        sii8620_write_seq_static(ctx,
-                REG_INTR8_MASK, BIT_CEA_NEW_AVI | BIT_CEA_NEW_VSI,
-                REG_TPI_SC, BIT_TPI_SC_TPI_OUTPUT_MODE_0_HDMI,
-        );
-}
 static void sii8620_irq_scdt(struct sii8620 *ctx)
 {
        u8 stat = sii8620_readb(ctx, REG_INTR5);
@@ -1946,53 +1914,13 @@ static void sii8620_irq_scdt(struct sii8620 *ctx)
        if (stat & BIT_INTR_SCDT_CHANGE) {
                u8 cstat = sii8620_readb(ctx, REG_TMDS_CSTAT_P3);
-                if (cstat & BIT_TMDS_CSTAT_P3_SCDT) {
+                if (cstat & BIT_TMDS_CSTAT_P3_SCDT)
-                        if (ctx->sink_type == SINK_HDMI)
+                        sii8620_start_video(ctx);
-                                /* enable infoframe interrupt */
-                                sii8620_scdt_high(ctx);
-                        else
-                                sii8620_start_video(ctx);
-                }
        }
        sii8620_write(ctx, REG_INTR5, stat);
 }
-static void sii8620_new_vsi(struct sii8620 *ctx)
-{
-        u8 vsif[11];
-        sii8620_write(ctx, REG_RX_HDMI_CTRL2,
-                      VAL_RX_HDMI_CTRL2_DEFVAL |
-                      BIT_RX_HDMI_CTRL2_VSI_MON_SEL_VSI);
-        sii8620_read_buf(ctx, REG_RX_HDMI_MON_PKT_HEADER1, vsif,
-                         ARRAY_SIZE(vsif));
-}
-static void sii8620_new_avi(struct sii8620 *ctx)
-{
-        sii8620_write(ctx, REG_RX_HDMI_CTRL2, VAL_RX_HDMI_CTRL2_DEFVAL);
-        sii8620_read_buf(ctx, REG_RX_HDMI_MON_PKT_HEADER1, ctx->avif,
-                         ARRAY_SIZE(ctx->avif));
-}
-static void sii8620_irq_infr(struct sii8620 *ctx)
-{
-        u8 stat = sii8620_readb(ctx, REG_INTR8)
-                & (BIT_CEA_NEW_VSI | BIT_CEA_NEW_AVI);
-        sii8620_write(ctx, REG_INTR8, stat);
-        if (stat & BIT_CEA_NEW_VSI)
-                sii8620_new_vsi(ctx);
-        if (stat & BIT_CEA_NEW_AVI)
-                sii8620_new_avi(ctx);
-        if (stat & (BIT_CEA_NEW_VSI | BIT_CEA_NEW_AVI))
-                sii8620_start_video(ctx);
-}
 static void sii8620_got_xdevcap(struct sii8620 *ctx, int ret)
 {
        if (ret < 0)
@@ -2043,11 +1971,11 @@ static void sii8620_irq_ddc(struct sii8620 *ctx)
        if (stat & BIT_DDC_CMD_DONE) {
                sii8620_write(ctx, REG_INTR3_MASK, 0);
-                if (sii8620_is_mhl3(ctx))
+                if (sii8620_is_mhl3(ctx) && !ctx->feature_complete)
                        sii8620_mt_set_int(ctx, MHL_INT_REG(RCHANGE),
                                           MHL_INT_RC_FEAT_REQ);
                else
-                        sii8620_edid_read(ctx, 0);
+                        sii8620_enable_hpd(ctx);
        }
        sii8620_write(ctx, REG_INTR3, stat);
 }
@@ -2074,7 +2002,6 @@ static irqreturn_t sii8620_irq_thread(int irq, void *data)
                { BIT_FAST_INTR_STAT_EDID, sii8620_irq_edid },
                { BIT_FAST_INTR_STAT_DDC, sii8620_irq_ddc },
                { BIT_FAST_INTR_STAT_SCDT, sii8620_irq_scdt },
-                { BIT_FAST_INTR_STAT_INFR, sii8620_irq_infr },
        };
        struct sii8620 *ctx = data;
        u8 stats[LEN_FAST_INTR_STAT];
@@ -2112,7 +2039,6 @@ static void sii8620_cable_in(struct sii8620 *ctx)
                dev_err(dev, "Error powering on, %d.\n", ret);
                return;
        }
-        sii8620_hw_reset(ctx);
        sii8620_read_buf(ctx, REG_VND_IDL, ver, ARRAY_SIZE(ver));
        ret = sii8620_clear_error(ctx);
@@ -2268,17 +2194,43 @@ static void sii8620_detach(struct drm_bridge *bridge)
        rc_unregister_device(ctx->rc_dev);
 }
+static int sii8620_is_packing_required(struct sii8620 *ctx,
+                                       const struct drm_display_mode *mode)
+{
+        int max_pclk, max_pclk_pp_mode;
+        if (sii8620_is_mhl3(ctx)) {
+                max_pclk = MHL3_MAX_PCLK;
+                max_pclk_pp_mode = MHL3_MAX_PCLK_PP_MODE;
+        } else {
+                max_pclk = MHL1_MAX_PCLK;
+                max_pclk_pp_mode = MHL1_MAX_PCLK_PP_MODE;
+        }
+        if (mode->clock < max_pclk)
+                return 0;
+        else if (mode->clock < max_pclk_pp_mode)
+                return 1;
+        else
+                return -1;
+}
 static enum drm_mode_status sii8620_mode_valid(struct drm_bridge *bridge,
                                         const struct drm_display_mode *mode)
 {
        struct sii8620 *ctx = bridge_to_sii8620(bridge);
+        int pack_required = sii8620_is_packing_required(ctx, mode);
        bool can_pack = ctx->devcap[MHL_DCAP_VID_LINK_MODE] &
                        MHL_DCAP_VID_LINK_PPIXEL;
-        unsigned int max_pclk = sii8620_is_mhl3(ctx) ? MHL3_MAX_LCLK :
-                                                       MHL1_MAX_LCLK;
-        max_pclk /= can_pack ? 2 : 3;
-        return (mode->clock > max_pclk) ? MODE_CLOCK_HIGH : MODE_OK;
+        switch (pack_required) {
+        case 0:
+                return MODE_OK;
+        case 1:
+                return (can_pack) ? MODE_OK : MODE_CLOCK_HIGH;
+        default:
+                return MODE_CLOCK_HIGH;
+        }
 }
 static bool sii8620_mode_fixup(struct drm_bridge *bridge,
@@ -2286,43 +2238,16 @@ static bool sii8620_mode_fixup(struct drm_bridge *bridge,
                               struct drm_display_mode *adjusted_mode)
 {
        struct sii8620 *ctx = bridge_to_sii8620(bridge);
-        int max_lclk;
-        bool ret = true;
        mutex_lock(&ctx->lock);
-        max_lclk = sii8620_is_mhl3(ctx) ? MHL3_MAX_LCLK : MHL1_MAX_LCLK;
+        ctx->use_packed_pixel = sii8620_is_packing_required(ctx, adjusted_mode);
-        if (max_lclk > 3 * adjusted_mode->clock) {
+        ctx->video_code = drm_match_cea_mode(adjusted_mode);
-                ctx->use_packed_pixel = 0;
+        ctx->pixel_clock = adjusted_mode->clock;
-                goto end;
-        }
-        if ((ctx->devcap[MHL_DCAP_VID_LINK_MODE] & MHL_DCAP_VID_LINK_PPIXEL) &&
-            max_lclk > 2 * adjusted_mode->clock) {
-                ctx->use_packed_pixel = 1;
-                goto end;
-        }
-        ret = false;
-end:
-        if (ret) {
-                u8 vic = drm_match_cea_mode(adjusted_mode);
-                if (!vic) {
-                        union hdmi_infoframe frm;
-                        u8 mhl_vic[] = { 0, 95, 94, 93, 98 };
-                        /* FIXME: We need the connector here */
-                        drm_hdmi_vendor_infoframe_from_display_mode(
-                                &frm.vendor.hdmi, NULL, adjusted_mode);
-                        vic = frm.vendor.hdmi.vic;
-                        if (vic >= ARRAY_SIZE(mhl_vic))
-                                vic = 0;
-                        vic = mhl_vic[vic];
-                }
-                ctx->video_code = vic;
-                ctx->pixel_clock = adjusted_mode->clock;
-        }
        mutex_unlock(&ctx->lock);
-        return ret;
+        return true;
 }
 static const struct drm_bridge_funcs sii8620_bridge_funcs = {
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index b553a6f2ff0e..7af748ed1c58 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -369,13 +369,6 @@ EXPORT_SYMBOL(drm_dev_exit);
 */
 void drm_dev_unplug(struct drm_device *dev)
 {
-        drm_dev_unregister(dev);
-        mutex_lock(&drm_global_mutex);
-        if (dev->open_count == 0)
-                drm_dev_put(dev);
-        mutex_unlock(&drm_global_mutex);
        /*
         * After synchronizing any critical read section is guaranteed to see
         * the new value of ->unplugged, and any critical section which might
@@ -384,6 +377,13 @@ void drm_dev_unplug(struct drm_device *dev)
         */
        dev->unplugged = true;
        synchronize_srcu(&drm_unplug_srcu);
+        drm_dev_unregister(dev);
+        mutex_lock(&drm_global_mutex);
+        if (dev->open_count == 0)
+                drm_dev_put(dev);
+        mutex_unlock(&drm_global_mutex);
 }
 EXPORT_SYMBOL(drm_dev_unplug);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 34c125e2d90c..52f3b91d14fd 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -340,14 +340,21 @@ struct drm_i915_file_private {
        unsigned int bsd_engine;
-/* Client can have a maximum of 3 contexts banned before
+/*
- * it is denied of creating new contexts. As one context
+ * Every context ban increments per client ban score. Also
- * ban needs 4 consecutive hangs, and more if there is
+ * hangs in short succession increments ban score. If ban threshold
- * progress in between, this is a last resort stop gap measure
+ * is reached, client is considered banned and submitting more work
- * to limit the badly behaving clients access to gpu.
+ * will fail. This is a stop gap measure to limit the badly behaving
+ * clients access to gpu. Note that unbannable contexts never increment
+ * the client ban score.
 */
-#define I915_MAX_CLIENT_CONTEXT_BANS 3
+#define I915_CLIENT_SCORE_HANG_FAST     1
-        atomic_t context_bans;
+#define   I915_CLIENT_FAST_HANG_JIFFIES (60 * HZ)
+#define I915_CLIENT_SCORE_CONTEXT_BAN   3
+#define I915_CLIENT_SCORE_BANNED        9
+        /** ban_score: Accumulated score of all ctx bans and fast hangs. */
+        atomic_t ban_score;
+        unsigned long hang_timestamp;
 };
 /* Interface history:
@@ -2238,9 +2245,6 @@ static inline struct scatterlist *____sg_next(struct scatterlist *sg)
 **/
 static inline struct scatterlist *__sg_next(struct scatterlist *sg)
 {
-#ifdef CONFIG_DEBUG_SG
-        BUG_ON(sg->sg_magic != SG_MAGIC);
-#endif
        return sg_is_last(sg) ? NULL : ____sg_next(sg);
 }
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 3704f4c0c2c9..d44ad7bc1e94 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2933,32 +2933,54 @@ i915_gem_object_pwrite_gtt(struct drm_i915_gem_object *obj,
        return 0;
 }
+static void i915_gem_client_mark_guilty(struct drm_i915_file_private *file_priv,
+                                        const struct i915_gem_context *ctx)
+{
+        unsigned int score;
+        unsigned long prev_hang;
+        if (i915_gem_context_is_banned(ctx))
+                score = I915_CLIENT_SCORE_CONTEXT_BAN;
+        else
+                score = 0;
+        prev_hang = xchg(&file_priv->hang_timestamp, jiffies);
+        if (time_before(jiffies, prev_hang + I915_CLIENT_FAST_HANG_JIFFIES))
+                score += I915_CLIENT_SCORE_HANG_FAST;
+        if (score) {
+                atomic_add(score, &file_priv->ban_score);
+                DRM_DEBUG_DRIVER("client %s: gained %u ban score, now %u\n",
+                                 ctx->name, score,
+                                 atomic_read(&file_priv->ban_score));
+        }
+}
 static void i915_gem_context_mark_guilty(struct i915_gem_context *ctx)
 {
-        bool banned;
+        unsigned int score;
+        bool banned, bannable;
        atomic_inc(&ctx->guilty_count);
-        banned = false;
+        bannable = i915_gem_context_is_bannable(ctx);
-        if (i915_gem_context_is_bannable(ctx)) {
+        score = atomic_add_return(CONTEXT_SCORE_GUILTY, &ctx->ban_score);
-                unsigned int score;
+        banned = score >= CONTEXT_SCORE_BAN_THRESHOLD;
-                score = atomic_add_return(CONTEXT_SCORE_GUILTY,
+        DRM_DEBUG_DRIVER("context %s: guilty %d, score %u, ban %s\n",
-                                          &ctx->ban_score);
+                         ctx->name, atomic_read(&ctx->guilty_count),
-                banned = score >= CONTEXT_SCORE_BAN_THRESHOLD;
+                         score, yesno(banned && bannable));
-                DRM_DEBUG_DRIVER("context %s marked guilty (score %d) banned? %s\n",
+        /* Cool contexts don't accumulate client ban score */
-                                 ctx->name, score, yesno(banned));
+        if (!bannable)
-        }
-        if (!banned)
                return;
-        i915_gem_context_set_banned(ctx);
+        if (banned)
-        if (!IS_ERR_OR_NULL(ctx->file_priv)) {
+                i915_gem_context_set_banned(ctx);
-                atomic_inc(&ctx->file_priv->context_bans);
-                DRM_DEBUG_DRIVER("client %s has had %d context banned\n",
+        if (!IS_ERR_OR_NULL(ctx->file_priv))
-                                 ctx->name, atomic_read(&ctx->file_priv->context_bans));
+                i915_gem_client_mark_guilty(ctx->file_priv, ctx);
-        }
 }
 static void i915_gem_context_mark_innocent(struct i915_gem_context *ctx)
@@ -5736,6 +5758,7 @@ int i915_gem_open(struct drm_i915_private *i915, struct drm_file *file)
        INIT_LIST_HEAD(&file_priv->mm.request_list);
        file_priv->bsd_engine = -1;
+        file_priv->hang_timestamp = jiffies;
        ret = i915_gem_context_open(i915, file);
        if (ret)
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 33f8a4b3c981..060335d3d9e0 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -652,7 +652,7 @@ int i915_gem_switch_to_kernel_context(struct drm_i915_private *dev_priv)
 static bool client_is_banned(struct drm_i915_file_private *file_priv)
 {
-        return atomic_read(&file_priv->context_bans) > I915_MAX_CLIENT_CONTEXT_BANS;
+        return atomic_read(&file_priv->ban_score) >= I915_CLIENT_SCORE_BANNED;
 }
 int i915_gem_context_create_ioctl(struct drm_device *dev, void *data,
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index f627a8c47c58..22df17c8ca9b 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -489,7 +489,9 @@ eb_validate_vma(struct i915_execbuffer *eb,
 }
 static int
-eb_add_vma(struct i915_execbuffer *eb, unsigned int i, struct i915_vma *vma)
+eb_add_vma(struct i915_execbuffer *eb,
+           unsigned int i, unsigned batch_idx,
+           struct i915_vma *vma)
 {
        struct drm_i915_gem_exec_object2 *entry = &eb->exec[i];
        int err;
@@ -522,6 +524,24 @@ eb_add_vma(struct i915_execbuffer *eb, unsigned int i, struct i915_vma *vma)
        eb->flags[i] = entry->flags;
        vma->exec_flags = &eb->flags[i];
+        /*
+         * SNA is doing fancy tricks with compressing batch buffers, which leads
+         * to negative relocation deltas. Usually that works out ok since the
+         * relocate address is still positive, except when the batch is placed
+         * very low in the GTT. Ensure this doesn't happen.
+         *
+         * Note that actual hangs have only been observed on gen7, but for
+         * paranoia do it everywhere.
+         */
+        if (i == batch_idx) {
+                if (!(eb->flags[i] & EXEC_OBJECT_PINNED))
+                        eb->flags[i] |= __EXEC_OBJECT_NEEDS_BIAS;
+                if (eb->reloc_cache.has_fence)
+                        eb->flags[i] |= EXEC_OBJECT_NEEDS_FENCE;
+                eb->batch = vma;
+        }
        err = 0;
        if (eb_pin_vma(eb, entry, vma)) {
                if (entry->offset != vma->node.start) {
@@ -716,7 +736,7 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb)
 {
        struct radix_tree_root *handles_vma = &eb->ctx->handles_vma;
        struct drm_i915_gem_object *obj;
-        unsigned int i;
+        unsigned int i, batch;
        int err;
        if (unlikely(i915_gem_context_is_closed(eb->ctx)))
@@ -728,6 +748,8 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb)
        INIT_LIST_HEAD(&eb->relocs);
        INIT_LIST_HEAD(&eb->unbound);
+        batch = eb_batch_index(eb);
        for (i = 0; i < eb->buffer_count; i++) {
                u32 handle = eb->exec[i].handle;
                struct i915_lut_handle *lut;
@@ -770,33 +792,16 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb)
                lut->handle = handle;
 add_vma:
-                err = eb_add_vma(eb, i, vma);
+                err = eb_add_vma(eb, i, batch, vma);
                if (unlikely(err))
                        goto err_vma;
                GEM_BUG_ON(vma != eb->vma[i]);
                GEM_BUG_ON(vma->exec_flags != &eb->flags[i]);
+                GEM_BUG_ON(drm_mm_node_allocated(&vma->node) &&
+                           eb_vma_misplaced(&eb->exec[i], vma, eb->flags[i]));
        }
-        /* take note of the batch buffer before we might reorder the lists */
-        i = eb_batch_index(eb);
-        eb->batch = eb->vma[i];
-        GEM_BUG_ON(eb->batch->exec_flags != &eb->flags[i]);
-        /*
-         * SNA is doing fancy tricks with compressing batch buffers, which leads
-         * to negative relocation deltas. Usually that works out ok since the
-         * relocate address is still positive, except when the batch is placed
-         * very low in the GTT. Ensure this doesn't happen.
-         *
-         * Note that actual hangs have only been observed on gen7, but for
-         * paranoia do it everywhere.
-         */
-        if (!(eb->flags[i] & EXEC_OBJECT_PINNED))
-                eb->flags[i] |= __EXEC_OBJECT_NEEDS_BIAS;
-        if (eb->reloc_cache.has_fence)
-                eb->flags[i] |= EXEC_OBJECT_NEEDS_FENCE;
        eb->args->flags |= __EXEC_VALIDATED;
        return eb_reserve(eb);
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index f9bc3aaa90d0..4a02747ac658 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1893,9 +1893,17 @@ static void i9xx_pipestat_irq_ack(struct drm_i915_private *dev_priv,
                /*
                 * Clear the PIPE*STAT regs before the IIR
+                 *
+                 * Toggle the enable bits to make sure we get an
+                 * edge in the ISR pipe event bit if we don't clear
+                 * all the enabled status bits. Otherwise the edge
+                 * triggered IIR on i965/g4x wouldn't notice that
+                 * an interrupt is still pending.
                 */
-                if (pipe_stats[pipe])
+                if (pipe_stats[pipe]) {
-                        I915_WRITE(reg, enable_mask | pipe_stats[pipe]);
+                        I915_WRITE(reg, pipe_stats[pipe]);
+                        I915_WRITE(reg, enable_mask);
+                }
        }
        spin_unlock(&dev_priv->irq_lock);
 }
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index f11bb213ec07..7720569f2024 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -2425,12 +2425,17 @@ enum i915_power_well_id {
 #define _3D_CHICKEN     _MMIO(0x2084)
 #define  _3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB      (1 << 10)
 #define _3D_CHICKEN2    _MMIO(0x208c)
+#define FF_SLICE_CHICKEN        _MMIO(0x2088)
+#define  FF_SLICE_CHICKEN_CL_PROVOKING_VERTEX_FIX       (1 << 1)
 /* Disables pipelining of read flushes past the SF-WIZ interface.
 * Required on all Ironlake steppings according to the B-Spec, but the
 * particular danger of not doing so is not specified.
 */
 # define _3D_CHICKEN2_WM_READ_PIPELINED                 (1 << 14)
 #define _3D_CHICKEN3    _MMIO(0x2090)
+#define  _3D_CHICKEN_SF_PROVOKING_VERTEX_FIX            (1 << 12)
 #define  _3D_CHICKEN_SF_DISABLE_OBJEND_CULL             (1 << 10)
 #define  _3D_CHICKEN3_AA_LINE_QUALITY_FIX_ENABLE        (1 << 5)
 #define  _3D_CHICKEN3_SF_DISABLE_FASTCLIP_CULL          (1 << 5)
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index de0e22322c76..072b326d5ee0 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -304,6 +304,9 @@ intel_crt_mode_valid(struct drm_connector *connector,
        int max_dotclk = dev_priv->max_dotclk_freq;
        int max_clock;
+        if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return MODE_NO_DBLESCAN;
        if (mode->clock < 25000)
                return MODE_CLOCK_LOW;
@@ -337,6 +340,12 @@ static bool intel_crt_compute_config(struct intel_encoder *encoder,
                                     struct intel_crtc_state *pipe_config,
                                     struct drm_connector_state *conn_state)
 {
+        struct drm_display_mode *adjusted_mode =
+                &pipe_config->base.adjusted_mode;
+        if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return false;
        return true;
 }
@@ -344,6 +353,12 @@ static bool pch_crt_compute_config(struct intel_encoder *encoder,
                                   struct intel_crtc_state *pipe_config,
                                   struct drm_connector_state *conn_state)
 {
+        struct drm_display_mode *adjusted_mode =
+                &pipe_config->base.adjusted_mode;
+        if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return false;
        pipe_config->has_pch_encoder = true;
        return true;
@@ -354,6 +369,11 @@ static bool hsw_crt_compute_config(struct intel_encoder *encoder,
                                   struct drm_connector_state *conn_state)
 {
        struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
+        struct drm_display_mode *adjusted_mode =
+                &pipe_config->base.adjusted_mode;
+        if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return false;
        pipe_config->has_pch_encoder = true;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index dee3a8e659f1..2cc6faa1daa8 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -14469,12 +14469,22 @@ static enum drm_mode_status
 intel_mode_valid(struct drm_device *dev,
                 const struct drm_display_mode *mode)
 {
+        /*
+         * Can't reject DBLSCAN here because Xorg ddxen can add piles
+         * of DBLSCAN modes to the output's mode list when they detect
+         * the scaling mode property on the connector. And they don't
+         * ask the kernel to validate those modes in any way until
+         * modeset time at which point the client gets a protocol error.
+         * So in order to not upset those clients we silently ignore the
+         * DBLSCAN flag on such connectors. For other connectors we will
+         * reject modes with the DBLSCAN flag in encoder->compute_config().
+         * And we always reject DBLSCAN modes in connector->mode_valid()
+         * as we never want such modes on the connector's mode list.
+         */
        if (mode->vscan > 1)
                return MODE_NO_VSCAN;
-        if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
-                return MODE_NO_DBLESCAN;
        if (mode->flags & DRM_MODE_FLAG_HSKEW)
                return MODE_H_ILLEGAL;
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 8320f0e8e3be..16faea30114a 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -420,6 +420,9 @@ intel_dp_mode_valid(struct drm_connector *connector,
        int max_rate, mode_rate, max_lanes, max_link_clock;
        int max_dotclk;
+        if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return MODE_NO_DBLESCAN;
        max_dotclk = intel_dp_downstream_max_dotclock(intel_dp);
        if (intel_dp_is_edp(intel_dp) && fixed_mode) {
@@ -1862,7 +1865,10 @@ intel_dp_compute_config(struct intel_encoder *encoder,
                                                conn_state->scaling_mode);
        }
-        if ((IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) &&
+        if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return false;
+        if (HAS_GMCH_DISPLAY(dev_priv) &&
            adjusted_mode->flags & DRM_MODE_FLAG_INTERLACE)
                return false;
@@ -2784,16 +2790,6 @@ static void g4x_disable_dp(struct intel_encoder *encoder,
                           const struct drm_connector_state *old_conn_state)
 {
        intel_disable_dp(encoder, old_crtc_state, old_conn_state);
-        /* disable the port before the pipe on g4x */
-        intel_dp_link_down(encoder, old_crtc_state);
-}
-static void ilk_disable_dp(struct intel_encoder *encoder,
-                           const struct intel_crtc_state *old_crtc_state,
-                           const struct drm_connector_state *old_conn_state)
-{
-        intel_disable_dp(encoder, old_crtc_state, old_conn_state);
 }
 static void vlv_disable_dp(struct intel_encoder *encoder,
@@ -2807,13 +2803,19 @@ static void vlv_disable_dp(struct intel_encoder *encoder,
        intel_disable_dp(encoder, old_crtc_state, old_conn_state);
 }
-static void ilk_post_disable_dp(struct intel_encoder *encoder,
+static void g4x_post_disable_dp(struct intel_encoder *encoder,
                                const struct intel_crtc_state *old_crtc_state,
                                const struct drm_connector_state *old_conn_state)
 {
        struct intel_dp *intel_dp = enc_to_intel_dp(&encoder->base);
        enum port port = encoder->port;
+        /*
+         * Bspec does not list a specific disable sequence for g4x DP.
+         * Follow the ilk+ sequence (disable pipe before the port) for
+         * g4x DP as it does not suffer from underruns like the normal
+         * g4x modeset sequence (disable pipe after the port).
+         */
        intel_dp_link_down(encoder, old_crtc_state);
        /* Only ilk+ has port A */
@@ -6337,7 +6339,7 @@ intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
        drm_connector_init(dev, connector, &intel_dp_connector_funcs, type);
        drm_connector_helper_add(connector, &intel_dp_connector_helper_funcs);
-        if (!IS_VALLEYVIEW(dev_priv) && !IS_CHERRYVIEW(dev_priv))
+        if (!HAS_GMCH_DISPLAY(dev_priv))
                connector->interlace_allowed = true;
        connector->doublescan_allowed = 0;
@@ -6436,15 +6438,11 @@ bool intel_dp_init(struct drm_i915_private *dev_priv,
                intel_encoder->enable = vlv_enable_dp;
                intel_encoder->disable = vlv_disable_dp;
                intel_encoder->post_disable = vlv_post_disable_dp;
-        } else if (INTEL_GEN(dev_priv) >= 5) {
-                intel_encoder->pre_enable = g4x_pre_enable_dp;
-                intel_encoder->enable = g4x_enable_dp;
-                intel_encoder->disable = ilk_disable_dp;
-                intel_encoder->post_disable = ilk_post_disable_dp;
        } else {
                intel_encoder->pre_enable = g4x_pre_enable_dp;
                intel_encoder->enable = g4x_enable_dp;
                intel_encoder->disable = g4x_disable_dp;
+                intel_encoder->post_disable = g4x_post_disable_dp;
        }
        intel_dig_port->dp.output_reg = output_reg;
diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
index 9e6956c08688..5890500a3a8b 100644
--- a/drivers/gpu/drm/i915/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/intel_dp_mst.c
@@ -48,6 +48,9 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
        bool reduce_m_n = drm_dp_has_quirk(&intel_dp->desc,
                                           DP_DPCD_QUIRK_LIMITED_M_N);
+        if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return false;
        pipe_config->has_pch_encoder = false;
        bpp = 24;
        if (intel_dp->compliance.test_data.bpc) {
@@ -366,6 +369,9 @@ intel_dp_mst_mode_valid(struct drm_connector *connector,
        if (!intel_dp)
                return MODE_ERROR;
+        if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return MODE_NO_DBLESCAN;
        max_link_clock = intel_dp_max_link_rate(intel_dp);
        max_lanes = intel_dp_max_lane_count(intel_dp);
diff --git a/drivers/gpu/drm/i915/intel_dsi.c b/drivers/gpu/drm/i915/intel_dsi.c
index cf39ca90d887..f349b3920199 100644
--- a/drivers/gpu/drm/i915/intel_dsi.c
+++ b/drivers/gpu/drm/i915/intel_dsi.c
@@ -326,6 +326,9 @@ static bool intel_dsi_compute_config(struct intel_encoder *encoder,
                                                conn_state->scaling_mode);
        }
+        if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return false;
        /* DSI uses short packets for sync events, so clear mode flags for DSI */
        adjusted_mode->flags = 0;
@@ -1266,6 +1269,9 @@ intel_dsi_mode_valid(struct drm_connector *connector,
        DRM_DEBUG_KMS("\n");
+        if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return MODE_NO_DBLESCAN;
        if (fixed_mode) {
                if (mode->hdisplay > fixed_mode->hdisplay)
                        return MODE_PANEL;
diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
index a70d767313aa..61d908e0df0e 100644
--- a/drivers/gpu/drm/i915/intel_dvo.c
+++ b/drivers/gpu/drm/i915/intel_dvo.c
@@ -219,6 +219,9 @@ intel_dvo_mode_valid(struct drm_connector *connector,
        int max_dotclk = to_i915(connector->dev)->max_dotclk_freq;
        int target_clock = mode->clock;
+        if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return MODE_NO_DBLESCAN;
        /* XXX: Validate clock range */
        if (fixed_mode) {
@@ -254,6 +257,9 @@ static bool intel_dvo_compute_config(struct intel_encoder *encoder,
        if (fixed_mode)
                intel_fixed_panel_mode(fixed_mode, adjusted_mode);
+        if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return false;
        return true;
 }
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index ee929f31f7db..d8cb53ef4351 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -1557,6 +1557,9 @@ intel_hdmi_mode_valid(struct drm_connector *connector,
        bool force_dvi =
                READ_ONCE(to_intel_digital_connector_state(connector->state)->force_audio) == HDMI_AUDIO_OFF_DVI;
+        if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return MODE_NO_DBLESCAN;
        clock = mode->clock;
        if ((mode->flags & DRM_MODE_FLAG_3D_MASK) == DRM_MODE_FLAG_3D_FRAME_PACKING)
@@ -1677,6 +1680,9 @@ bool intel_hdmi_compute_config(struct intel_encoder *encoder,
        int desired_bpp;
        bool force_dvi = intel_conn_state->force_audio == HDMI_AUDIO_OFF_DVI;
+        if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return false;
        pipe_config->has_hdmi_sink = !force_dvi && intel_hdmi->has_hdmi_sink;
        if (pipe_config->has_hdmi_sink)
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 15434cad5430..7c4c8fb1dae4 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -1545,11 +1545,21 @@ static u32 *gen9_init_indirectctx_bb(struct intel_engine_cs *engine, u32 *batch)
        /* WaFlushCoherentL3CacheLinesAtContextSwitch:skl,bxt,glk */
        batch = gen8_emit_flush_coherentl3_wa(engine, batch);
+        *batch++ = MI_LOAD_REGISTER_IMM(3);
        /* WaDisableGatherAtSetShaderCommonSlice:skl,bxt,kbl,glk */
-        *batch++ = MI_LOAD_REGISTER_IMM(1);
        *batch++ = i915_mmio_reg_offset(COMMON_SLICE_CHICKEN2);
        *batch++ = _MASKED_BIT_DISABLE(
                        GEN9_DISABLE_GATHER_AT_SET_SHADER_COMMON_SLICE);
+        /* BSpec: 11391 */
+        *batch++ = i915_mmio_reg_offset(FF_SLICE_CHICKEN);
+        *batch++ = _MASKED_BIT_ENABLE(FF_SLICE_CHICKEN_CL_PROVOKING_VERTEX_FIX);
+        /* BSpec: 11299 */
+        *batch++ = i915_mmio_reg_offset(_3D_CHICKEN3);
+        *batch++ = _MASKED_BIT_ENABLE(_3D_CHICKEN_SF_PROVOKING_VERTEX_FIX);
        *batch++ = MI_NOOP;
        /* WaClearSlmSpaceAtContextSwitch:kbl */
@@ -2641,10 +2651,8 @@ static int execlists_context_deferred_alloc(struct i915_gem_context *ctx,
        context_size += LRC_HEADER_PAGES * PAGE_SIZE;
        ctx_obj = i915_gem_object_create(ctx->i915, context_size);
-        if (IS_ERR(ctx_obj)) {
+        if (IS_ERR(ctx_obj))
-                ret = PTR_ERR(ctx_obj);
+                return PTR_ERR(ctx_obj);
-                goto error_deref_obj;
-        }
        vma = i915_vma_instance(ctx_obj, &ctx->i915->ggtt.base, NULL);
        if (IS_ERR(vma)) {
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index d278f24ba6ae..48f618dc9abb 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -380,6 +380,8 @@ intel_lvds_mode_valid(struct drm_connector *connector,
        struct drm_display_mode *fixed_mode = intel_connector->panel.fixed_mode;
        int max_pixclk = to_i915(connector->dev)->max_dotclk_freq;
+        if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return MODE_NO_DBLESCAN;
        if (mode->hdisplay > fixed_mode->hdisplay)
                return MODE_PANEL;
        if (mode->vdisplay > fixed_mode->vdisplay)
@@ -429,6 +431,9 @@ static bool intel_lvds_compute_config(struct intel_encoder *intel_encoder,
        intel_fixed_panel_mode(intel_connector->panel.fixed_mode,
                               adjusted_mode);
+        if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return false;
        if (HAS_PCH_SPLIT(dev_priv)) {
                pipe_config->has_pch_encoder = true;
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 25005023c243..26975df4e593 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -1160,6 +1160,9 @@ static bool intel_sdvo_compute_config(struct intel_encoder *encoder,
                                                           adjusted_mode);
        }
+        if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return false;
        /*
         * Make the CRTC code factor in the SDVO pixel multiplier.  The
         * SDVO device will factor out the multiplier during mode_set.
@@ -1621,6 +1624,9 @@ intel_sdvo_mode_valid(struct drm_connector *connector,
        struct intel_sdvo *intel_sdvo = intel_attached_sdvo(connector);
        int max_dotclk = to_i915(connector->dev)->max_dotclk_freq;
+        if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return MODE_NO_DBLESCAN;
        if (intel_sdvo->pixel_clock_min > mode->clock)
                return MODE_CLOCK_LOW;
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index 885fc3809f7f..b55b5c157e38 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -850,6 +850,9 @@ intel_tv_mode_valid(struct drm_connector *connector,
        const struct tv_mode *tv_mode = intel_tv_mode_find(connector->state);
        int max_dotclk = to_i915(connector->dev)->max_dotclk_freq;
+        if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return MODE_NO_DBLESCAN;
        if (mode->clock > max_dotclk)
                return MODE_CLOCK_HIGH;
@@ -877,16 +880,21 @@ intel_tv_compute_config(struct intel_encoder *encoder,
                        struct drm_connector_state *conn_state)
 {
        const struct tv_mode *tv_mode = intel_tv_mode_find(conn_state);
+        struct drm_display_mode *adjusted_mode =
+                &pipe_config->base.adjusted_mode;
        if (!tv_mode)
                return false;
-        pipe_config->base.adjusted_mode.crtc_clock = tv_mode->clock;
+        if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN)
+                return false;
+        adjusted_mode->crtc_clock = tv_mode->clock;
        DRM_DEBUG_KMS("forcing bpc to 8 for TV\n");
        pipe_config->pipe_bpp = 8*3;
        /* TV has it's own notion of sync and other mode flags, so clear them. */
-        pipe_config->base.adjusted_mode.flags = 0;
+        adjusted_mode->flags = 0;
        /*
         * FIXME: We don't check whether the input mode is actually what we want
diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
index 32b1a6cdecfc..d3443125e661 100644
--- a/drivers/gpu/drm/meson/meson_drv.c
+++ b/drivers/gpu/drm/meson/meson_drv.c
@@ -197,8 +197,10 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
        priv->io_base = regs;
        res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "hhi");
-        if (!res)
+        if (!res) {
-                return -EINVAL;
+                ret = -EINVAL;
+                goto free_drm;
+        }
        /* Simply ioremap since it may be a shared register zone */
        regs = devm_ioremap(dev, res->start, resource_size(res));
        if (!regs) {
@@ -215,8 +217,10 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
        }
        res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dmc");
-        if (!res)
+        if (!res) {
-                return -EINVAL;
+                ret = -EINVAL;
+                goto free_drm;
+        }
        /* Simply ioremap since it may be a shared register zone */
        regs = devm_ioremap(dev, res->start, resource_size(res));
        if (!regs) {
diff --git a/drivers/gpu/drm/nouveau/dispnv50/curs507a.c b/drivers/gpu/drm/nouveau/dispnv50/curs507a.c
index 291c08117ab6..397143b639c6 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/curs507a.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/curs507a.c
@@ -132,7 +132,7 @@ curs507a_new_(const struct nv50_wimm_func *func, struct nouveau_drm *drm,
        nvif_object_map(&wndw->wimm.base.user, NULL, 0);
        wndw->immd = func;
-        wndw->ctxdma.parent = &disp->core->chan.base.user;
+        wndw->ctxdma.parent = NULL;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/dispnv50/wndw.c b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
index 224963b533a6..c5a9bc1af5af 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/wndw.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
@@ -444,14 +444,17 @@ nv50_wndw_prepare_fb(struct drm_plane *plane, struct drm_plane_state *state)
        if (ret)
                return ret;
-        ctxdma = nv50_wndw_ctxdma_new(wndw, fb);
+        if (wndw->ctxdma.parent) {
-        if (IS_ERR(ctxdma)) {
+                ctxdma = nv50_wndw_ctxdma_new(wndw, fb);
-                nouveau_bo_unpin(fb->nvbo);
+                if (IS_ERR(ctxdma)) {
-                return PTR_ERR(ctxdma);
+                        nouveau_bo_unpin(fb->nvbo);
+                        return PTR_ERR(ctxdma);
+                }
+                asyw->image.handle[0] = ctxdma->object.handle;
        }
        asyw->state.fence = reservation_object_get_excl_rcu(fb->nvbo->bo.resv);
-        asyw->image.handle[0] = ctxdma->object.handle;
        asyw->image.offset[0] = fb->nvbo->bo.offset;
        if (wndw->func->prepare) {
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index b8cda9449241..768207fbbae3 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -623,7 +623,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
        struct qxl_cursor_cmd *cmd;
        struct qxl_cursor *cursor;
        struct drm_gem_object *obj;
-        struct qxl_bo *cursor_bo = NULL, *user_bo = NULL;
+        struct qxl_bo *cursor_bo = NULL, *user_bo = NULL, *old_cursor_bo = NULL;
        int ret;
        void *user_ptr;
        int size = 64*64*4;
@@ -677,7 +677,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
                                                           cursor_bo, 0);
                cmd->type = QXL_CURSOR_SET;
-                qxl_bo_unref(&qcrtc->cursor_bo);
+                old_cursor_bo = qcrtc->cursor_bo;
                qcrtc->cursor_bo = cursor_bo;
                cursor_bo = NULL;
        } else {
@@ -697,6 +697,9 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
        qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
        qxl_release_fence_buffer_objects(release);
+        if (old_cursor_bo)
+                qxl_bo_unref(&old_cursor_bo);
        qxl_bo_unref(&cursor_bo);
        return;
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index 08747fc3ee71..8232b39e16ca 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -17,7 +17,6 @@
 #include <drm/drm_encoder.h>
 #include <drm/drm_modes.h>
 #include <drm/drm_of.h>
-#include <drm/drm_panel.h>
 #include <uapi/drm/drm_mode.h>
@@ -418,9 +417,6 @@ static void sun4i_tcon0_mode_set_lvds(struct sun4i_tcon *tcon,
 static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon,
                                     const struct drm_display_mode *mode)
 {
-        struct drm_panel *panel = tcon->panel;
-        struct drm_connector *connector = panel->connector;
-        struct drm_display_info display_info = connector->display_info;
        unsigned int bp, hsync, vsync;
        u8 clk_delay;
        u32 val = 0;
@@ -478,27 +474,6 @@ static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon,
        if (mode->flags & DRM_MODE_FLAG_PVSYNC)
                val |= SUN4I_TCON0_IO_POL_VSYNC_POSITIVE;
-        /*
-         * On A20 and similar SoCs, the only way to achieve Positive Edge
-         * (Rising Edge), is setting dclk clock phase to 2/3(240°).
-         * By default TCON works in Negative Edge(Falling Edge),
-         * this is why phase is set to 0 in that case.
-         * Unfortunately there's no way to logically invert dclk through
-         * IO_POL register.
-         * The only acceptable way to work, triple checked with scope,
-         * is using clock phase set to 0° for Negative Edge and set to 240°
-         * for Positive Edge.
-         * On A33 and similar SoCs there would be a 90° phase option,
-         * but it divides also dclk by 2.
-         * Following code is a way to avoid quirks all around TCON
-         * and DOTCLOCK drivers.
-         */
-        if (display_info.bus_flags & DRM_BUS_FLAG_PIXDATA_POSEDGE)
-                clk_set_phase(tcon->dclk, 240);
-        if (display_info.bus_flags & DRM_BUS_FLAG_PIXDATA_NEGEDGE)
-                clk_set_phase(tcon->dclk, 0);
        regmap_update_bits(tcon->regs, SUN4I_TCON0_IO_POL_REG,
                           SUN4I_TCON0_IO_POL_HSYNC_POSITIVE | SUN4I_TCON0_IO_POL_VSYNC_POSITIVE,
                           val);
diff --git a/drivers/hid/hid-google-hammer.c b/drivers/hid/hid-google-hammer.c
index 7b8e17b03cb8..6bf4da7ad63a 100644
--- a/drivers/hid/hid-google-hammer.c
+++ b/drivers/hid/hid-google-hammer.c
@@ -124,6 +124,8 @@ static const struct hid_device_id hammer_devices[] = {
                     USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_STAFF) },
        { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
                     USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_WAND) },
+        { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+                     USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_WHISKERS) },
        { }
 };
 MODULE_DEVICE_TABLE(hid, hammer_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index a85634fe033f..c7981ddd8776 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -452,6 +452,7 @@
 #define USB_DEVICE_ID_GOOGLE_TOUCH_ROSE 0x5028
 #define USB_DEVICE_ID_GOOGLE_STAFF      0x502b
 #define USB_DEVICE_ID_GOOGLE_WAND       0x502d
+#define USB_DEVICE_ID_GOOGLE_WHISKERS   0x5030
 #define USB_VENDOR_ID_GOTOP             0x08f2
 #define USB_DEVICE_ID_SUPER_Q2          0x007f
diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
index cb86cc834201..0422ec2b13d2 100644
--- a/drivers/hid/hid-steam.c
+++ b/drivers/hid/hid-steam.c
@@ -573,7 +573,7 @@ static bool steam_is_valve_interface(struct hid_device *hdev)
 static int steam_client_ll_parse(struct hid_device *hdev)
 {
-        struct steam_device *steam = hid_get_drvdata(hdev);
+        struct steam_device *steam = hdev->driver_data;
        return hid_parse_report(hdev, steam->hdev->dev_rdesc,
                        steam->hdev->dev_rsize);
@@ -590,7 +590,7 @@ static void steam_client_ll_stop(struct hid_device *hdev)
 static int steam_client_ll_open(struct hid_device *hdev)
 {
-        struct steam_device *steam = hid_get_drvdata(hdev);
+        struct steam_device *steam = hdev->driver_data;
        int ret;
        ret = hid_hw_open(steam->hdev);
@@ -605,7 +605,7 @@ static int steam_client_ll_open(struct hid_device *hdev)
 static void steam_client_ll_close(struct hid_device *hdev)
 {
-        struct steam_device *steam = hid_get_drvdata(hdev);
+        struct steam_device *steam = hdev->driver_data;
        mutex_lock(&steam->mutex);
        steam->client_opened = false;
@@ -623,7 +623,7 @@ static int steam_client_ll_raw_request(struct hid_device *hdev,
                                size_t count, unsigned char report_type,
                                int reqtype)
 {
-        struct steam_device *steam = hid_get_drvdata(hdev);
+        struct steam_device *steam = hdev->driver_data;
        return hid_hw_raw_request(steam->hdev, reportnum, buf, count,
                        report_type, reqtype);
@@ -710,7 +710,7 @@ static int steam_probe(struct hid_device *hdev,
                ret = PTR_ERR(steam->client_hdev);
                goto client_hdev_fail;
        }
-        hid_set_drvdata(steam->client_hdev, steam);
+        steam->client_hdev->driver_data = steam;
        /*
         * With the real steam controller interface, do not connect hidraw.
diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
index 582e449be9fe..a2c53ea3b5ed 100644
--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
@@ -205,8 +205,7 @@ static void ish_remove(struct pci_dev *pdev)
        kfree(ishtp_dev);
 }
-#ifdef CONFIG_PM
+static struct device __maybe_unused *ish_resume_device;
-static struct device *ish_resume_device;
 /* 50ms to get resume response */
 #define WAIT_FOR_RESUME_ACK_MS          50
@@ -220,7 +219,7 @@ static struct device *ish_resume_device;
 * in that case a simple resume message is enough, others we need
 * a reset sequence.
 */
-static void ish_resume_handler(struct work_struct *work)
+static void __maybe_unused ish_resume_handler(struct work_struct *work)
 {
        struct pci_dev *pdev = to_pci_dev(ish_resume_device);
        struct ishtp_device *dev = pci_get_drvdata(pdev);
@@ -262,7 +261,7 @@ static void ish_resume_handler(struct work_struct *work)
 *
 * Return: 0 to the pm core
 */
-static int ish_suspend(struct device *device)
+static int __maybe_unused ish_suspend(struct device *device)
 {
        struct pci_dev *pdev = to_pci_dev(device);
        struct ishtp_device *dev = pci_get_drvdata(pdev);
@@ -288,7 +287,7 @@ static int ish_suspend(struct device *device)
        return 0;
 }
-static DECLARE_WORK(resume_work, ish_resume_handler);
+static __maybe_unused DECLARE_WORK(resume_work, ish_resume_handler);
 /**
 * ish_resume() - ISH resume callback
 * @device:     device pointer
@@ -297,7 +296,7 @@ static DECLARE_WORK(resume_work, ish_resume_handler);
 *
 * Return: 0 to the pm core
 */
-static int ish_resume(struct device *device)
+static int __maybe_unused ish_resume(struct device *device)
 {
        struct pci_dev *pdev = to_pci_dev(device);
        struct ishtp_device *dev = pci_get_drvdata(pdev);
@@ -311,21 +310,14 @@ static int ish_resume(struct device *device)
        return 0;
 }
-static const struct dev_pm_ops ish_pm_ops = {
+static SIMPLE_DEV_PM_OPS(ish_pm_ops, ish_suspend, ish_resume);
-        .suspend = ish_suspend,
-        .resume = ish_resume,
-};
-#define ISHTP_ISH_PM_OPS        (&ish_pm_ops)
-#else
-#define ISHTP_ISH_PM_OPS        NULL
-#endif /* CONFIG_PM */
 static struct pci_driver ish_driver = {
        .name = KBUILD_MODNAME,
        .id_table = ish_pci_tbl,
        .probe = ish_probe,
        .remove = ish_remove,
-        .driver.pm = ISHTP_ISH_PM_OPS,
+        .driver.pm = &ish_pm_ops,
 };
 module_pci_driver(ish_driver);
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index c101369b51de..d6797535fff9 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -395,6 +395,14 @@ static void wacom_usage_mapping(struct hid_device *hdev,
                }
        }
+        /* 2nd-generation Intuos Pro Large has incorrect Y maximum */
+        if (hdev->vendor == USB_VENDOR_ID_WACOM &&
+            hdev->product == 0x0358 &&
+            WACOM_PEN_FIELD(field) &&
+            wacom_equivalent_usage(usage->hid) == HID_GD_Y) {
+                field->logical_maximum = 43200;
+        }
        switch (usage->hid) {
        case HID_GD_X:
                features->x_max = field->logical_maximum;
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index f10840ad465c..195154178aff 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1298,6 +1298,16 @@ config SENSORS_PWM_FAN
          This driver can also be built as a module.  If so, the module
          will be called pwm-fan.
+config SENSORS_RASPBERRYPI_HWMON
+        tristate "Raspberry Pi voltage monitor"
+        depends on RASPBERRYPI_FIRMWARE || (COMPILE_TEST && !RASPBERRYPI_FIRMWARE)
+        help
+          If you say yes here you get support for voltage sensor on the
+          Raspberry Pi.
+          This driver can also be built as a module. If so, the module
+          will be called raspberrypi-hwmon.
 config SENSORS_SHT15
        tristate "Sensiron humidity and temperature sensors. SHT15 and compat."
        depends on GPIOLIB || COMPILE_TEST
diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile
index e7d52a36e6c4..a9297703fd6e 100644
--- a/drivers/hwmon/Makefile
+++ b/drivers/hwmon/Makefile
@@ -141,6 +141,7 @@ obj-$(CONFIG_SENSORS_PC87427)	+= pc87427.o
 obj-$(CONFIG_SENSORS_PCF8591)   += pcf8591.o
 obj-$(CONFIG_SENSORS_POWR1220)  += powr1220.o
 obj-$(CONFIG_SENSORS_PWM_FAN)   += pwm-fan.o
+obj-$(CONFIG_SENSORS_RASPBERRYPI_HWMON) += raspberrypi-hwmon.o
 obj-$(CONFIG_SENSORS_S3C)       += s3c-hwmon.o
 obj-$(CONFIG_SENSORS_SCH56XX_COMMON)+= sch56xx-common.o
 obj-$(CONFIG_SENSORS_SCH5627)   += sch5627.o
diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
index bf3bb7e1adab..9d3ef879dc51 100644
--- a/drivers/hwmon/dell-smm-hwmon.c
+++ b/drivers/hwmon/dell-smm-hwmon.c
@@ -1074,6 +1074,13 @@ static struct dmi_system_id i8k_blacklist_fan_support_dmi_table[] __initdata = {
                        DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Vostro 3360"),
                },
        },
+        {
+                .ident = "Dell XPS13 9333",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "XPS13 9333"),
+                },
+        },
        { }
 };
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index 155d4d1d1585..f9d1349c3286 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -4175,7 +4175,7 @@ static int nct6775_probe(struct platform_device *pdev)
         * The temperature is already monitored if the respective bit in <mask>
         * is set.
         */
-        for (i = 0; i < 32; i++) {
+        for (i = 0; i < 31; i++) {
                if (!(data->temp_mask & BIT(i + 1)))
                        continue;
                if (!reg_temp_alternate[i])
diff --git a/drivers/hwmon/raspberrypi-hwmon.c b/drivers/hwmon/raspberrypi-hwmon.c
new file mode 100644
index 000000000000..fb4e4a6bb1f6
--- /dev/null
+++ b/drivers/hwmon/raspberrypi-hwmon.c
@@ -0,0 +1,166 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Raspberry Pi voltage sensor driver
+ *
+ * Based on firmware/raspberrypi.c by Noralf Trønnes
+ *
+ * Copyright (C) 2018 Stefan Wahren <stefan.wahren@i2se.com>
+ */
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/hwmon.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/workqueue.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+#define UNDERVOLTAGE_STICKY_BIT BIT(16)
+struct rpi_hwmon_data {
+        struct device *hwmon_dev;
+        struct rpi_firmware *fw;
+        u32 last_throttled;
+        struct delayed_work get_values_poll_work;
+};
+static void rpi_firmware_get_throttled(struct rpi_hwmon_data *data)
+{
+        u32 new_uv, old_uv, value;
+        int ret;
+        /* Request firmware to clear sticky bits */
+        value = 0xffff;
+        ret = rpi_firmware_property(data->fw, RPI_FIRMWARE_GET_THROTTLED,
+                                    &value, sizeof(value));
+        if (ret) {
+                dev_err_once(data->hwmon_dev, "Failed to get throttled (%d)\n",
+                             ret);
+                return;
+        }
+        new_uv = value & UNDERVOLTAGE_STICKY_BIT;
+        old_uv = data->last_throttled & UNDERVOLTAGE_STICKY_BIT;
+        data->last_throttled = value;
+        if (new_uv == old_uv)
+                return;
+        if (new_uv)
+                dev_crit(data->hwmon_dev, "Undervoltage detected!\n");
+        else
+                dev_info(data->hwmon_dev, "Voltage normalised\n");
+        sysfs_notify(&data->hwmon_dev->kobj, NULL, "in0_lcrit_alarm");
+}
+static void get_values_poll(struct work_struct *work)
+{
+        struct rpi_hwmon_data *data;
+        data = container_of(work, struct rpi_hwmon_data,
+                            get_values_poll_work.work);
+        rpi_firmware_get_throttled(data);
+        /*
+         * We can't run faster than the sticky shift (100ms) since we get
+         * flipping in the sticky bits that are cleared.
+         */
+        schedule_delayed_work(&data->get_values_poll_work, 2 * HZ);
+}
+static int rpi_read(struct device *dev, enum hwmon_sensor_types type,
+                    u32 attr, int channel, long *val)
+{
+        struct rpi_hwmon_data *data = dev_get_drvdata(dev);
+        *val = !!(data->last_throttled & UNDERVOLTAGE_STICKY_BIT);
+        return 0;
+}
+static umode_t rpi_is_visible(const void *_data, enum hwmon_sensor_types type,
+                              u32 attr, int channel)
+{
+        return 0444;
+}
+static const u32 rpi_in_config[] = {
+        HWMON_I_LCRIT_ALARM,
+        0
+};
+static const struct hwmon_channel_info rpi_in = {
+        .type = hwmon_in,
+        .config = rpi_in_config,
+};
+static const struct hwmon_channel_info *rpi_info[] = {
+        &rpi_in,
+        NULL
+};
+static const struct hwmon_ops rpi_hwmon_ops = {
+        .is_visible = rpi_is_visible,
+        .read = rpi_read,
+};
+static const struct hwmon_chip_info rpi_chip_info = {
+        .ops = &rpi_hwmon_ops,
+        .info = rpi_info,
+};
+static int rpi_hwmon_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct rpi_hwmon_data *data;
+        int ret;
+        data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+        /* Parent driver assure that firmware is correct */
+        data->fw = dev_get_drvdata(dev->parent);
+        /* Init throttled */
+        ret = rpi_firmware_property(data->fw, RPI_FIRMWARE_GET_THROTTLED,
+                                    &data->last_throttled,
+                                    sizeof(data->last_throttled));
+        data->hwmon_dev = devm_hwmon_device_register_with_info(dev, "rpi_volt",
+                                                               data,
+                                                               &rpi_chip_info,
+                                                               NULL);
+        INIT_DELAYED_WORK(&data->get_values_poll_work, get_values_poll);
+        platform_set_drvdata(pdev, data);
+        if (!PTR_ERR_OR_ZERO(data->hwmon_dev))
+                schedule_delayed_work(&data->get_values_poll_work, 2 * HZ);
+        return PTR_ERR_OR_ZERO(data->hwmon_dev);
+}
+static int rpi_hwmon_remove(struct platform_device *pdev)
+{
+        struct rpi_hwmon_data *data = platform_get_drvdata(pdev);
+        cancel_delayed_work_sync(&data->get_values_poll_work);
+        return 0;
+}
+static struct platform_driver rpi_hwmon_driver = {
+        .probe = rpi_hwmon_probe,
+        .remove = rpi_hwmon_remove,
+        .driver = {
+                .name = "raspberrypi-hwmon",
+        },
+};
+module_platform_driver(rpi_hwmon_driver);
+MODULE_AUTHOR("Stefan Wahren <stefan.wahren@i2se.com>");
+MODULE_DESCRIPTION("Raspberry Pi voltage sensor driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index 4a34f311e1ff..6ec65adaba49 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -647,10 +647,10 @@ static int __i2c_bit_add_bus(struct i2c_adapter *adap,
        if (bit_adap->getscl == NULL)
                adap->quirks = &i2c_bit_quirk_no_clk_stretch;
-        /* Bring bus to a known state. Looks like STOP if bus is not free yet */
+        /*
-        setscl(bit_adap, 1);
+         * We tried forcing SCL/SDA to an initial state here. But that caused a
-        udelay(bit_adap->udelay);
+         * regression, sadly. Check Bugzilla #200045 for details.
-        setsda(bit_adap, 1);
+         */
        ret = add_adapter(adap);
        if (ret < 0)
diff --git a/drivers/i2c/busses/i2c-gpio.c b/drivers/i2c/busses/i2c-gpio.c
index 005e6e0330c2..66f85bbf3591 100644
--- a/drivers/i2c/busses/i2c-gpio.c
+++ b/drivers/i2c/busses/i2c-gpio.c
@@ -279,9 +279,9 @@ static int i2c_gpio_probe(struct platform_device *pdev)
         * required for an I2C bus.
         */
        if (pdata->scl_is_open_drain)
-                gflags = GPIOD_OUT_LOW;
+                gflags = GPIOD_OUT_HIGH;
        else
-                gflags = GPIOD_OUT_LOW_OPEN_DRAIN;
+                gflags = GPIOD_OUT_HIGH_OPEN_DRAIN;
        priv->scl = i2c_gpio_get_desc(dev, "scl", 1, gflags);
        if (IS_ERR(priv->scl))
                return PTR_ERR(priv->scl);
diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c
index f3f683041e7f..51970bae3c4a 100644
--- a/drivers/i2c/i2c-core-smbus.c
+++ b/drivers/i2c/i2c-core-smbus.c
@@ -465,15 +465,18 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
        status = i2c_transfer(adapter, msg, num);
        if (status < 0)
-                return status;
+                goto cleanup;
-        if (status != num)
+        if (status != num) {
-                return -EIO;
+                status = -EIO;
+                goto cleanup;
+        }
+        status = 0;
        /* Check PEC if last message is a read */
        if (i && (msg[num-1].flags & I2C_M_RD)) {
                status = i2c_smbus_check_pec(partial_pec, &msg[num-1]);
                if (status < 0)
-                        return status;
+                        goto cleanup;
        }
        if (read_write == I2C_SMBUS_READ)
@@ -499,12 +502,13 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
                        break;
                }
+cleanup:
        if (msg[0].flags & I2C_M_DMA_SAFE)
                kfree(msg[0].buf);
        if (msg[1].flags & I2C_M_DMA_SAFE)
                kfree(msg[1].buf);
-        return 0;
+        return status;
 }
 /**
diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
index 7e3d82cff3d5..c149c9c360fc 100644
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -1053,7 +1053,7 @@ static irqreturn_t mma8452_interrupt(int irq, void *p)
        if (src < 0)
                return IRQ_NONE;
-        if (!(src & data->chip_info->enabled_events))
+        if (!(src & (data->chip_info->enabled_events | MMA8452_INT_DRDY)))
                return IRQ_NONE;
        if (src & MMA8452_INT_DRDY) {
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index f9c0624505a2..42618fe4f83e 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -959,6 +959,8 @@ int inv_mpu_core_probe(struct regmap *regmap, int irq, const char *name,
        }
        irq_type = irqd_get_trigger_type(desc);
+        if (!irq_type)
+                irq_type = IRQF_TRIGGER_RISING;
        if (irq_type == IRQF_TRIGGER_RISING)
                st->irq_mask = INV_MPU6050_ACTIVE_HIGH;
        else if (irq_type == IRQF_TRIGGER_FALLING)
diff --git a/drivers/iio/light/tsl2772.c b/drivers/iio/light/tsl2772.c
index 34d42a2504c9..df5b2a0da96c 100644
--- a/drivers/iio/light/tsl2772.c
+++ b/drivers/iio/light/tsl2772.c
@@ -582,6 +582,8 @@ static int tsl2772_als_calibrate(struct iio_dev *indio_dev)
                        "%s: failed to get lux\n", __func__);
                return lux_val;
        }
+        if (lux_val == 0)
+                return -ERANGE;
        ret = (chip->settings.als_cal_target * chip->settings.als_gain_trim) /
                        lux_val;
diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
index 5ec3e41b65f2..fe87d27779d9 100644
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -415,10 +415,9 @@ static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2)
        }
        comp_humidity = bmp280_compensate_humidity(data, adc_humidity);
-        *val = comp_humidity;
+        *val = comp_humidity * 1000 / 1024;
-        *val2 = 1024;
-        return IIO_VAL_FRACTIONAL;
+        return IIO_VAL_INT;
 }
 static int bmp280_read_raw(struct iio_dev *indio_dev,
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 3ae2339dd27a..2094d136513d 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -736,10 +736,6 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
        if (ret)
                return ret;
-        if (!file->ucontext &&
-            (command != IB_USER_VERBS_CMD_GET_CONTEXT || extended))
-                return -EINVAL;
        if (extended) {
                if (count < (sizeof(hdr) + sizeof(ex_hdr)))
                        return -EINVAL;
@@ -759,6 +755,16 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                goto out;
        }
+        /*
+         * Must be after the ib_dev check, as once the RCU clears ib_dev ==
+         * NULL means ucontext == NULL
+         */
+        if (!file->ucontext &&
+            (command != IB_USER_VERBS_CMD_GET_CONTEXT || extended)) {
+                ret = -EINVAL;
+                goto out;
+        }
        if (!verify_command_mask(ib_dev, command, extended)) {
                ret = -EOPNOTSUPP;
                goto out;
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 0b56828c1319..9d6beb948535 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1562,11 +1562,12 @@ EXPORT_SYMBOL(ib_destroy_qp);
 /* Completion queues */
-struct ib_cq *ib_create_cq(struct ib_device *device,
+struct ib_cq *__ib_create_cq(struct ib_device *device,
-                           ib_comp_handler comp_handler,
+                             ib_comp_handler comp_handler,
-                           void (*event_handler)(struct ib_event *, void *),
+                             void (*event_handler)(struct ib_event *, void *),
-                           void *cq_context,
+                             void *cq_context,
-                           const struct ib_cq_init_attr *cq_attr)
+                             const struct ib_cq_init_attr *cq_attr,
+                             const char *caller)
 {
        struct ib_cq *cq;
@@ -1580,12 +1581,13 @@ struct ib_cq *ib_create_cq(struct ib_device *device,
                cq->cq_context    = cq_context;
                atomic_set(&cq->usecnt, 0);
                cq->res.type = RDMA_RESTRACK_CQ;
+                cq->res.kern_name = caller;
                rdma_restrack_add(&cq->res);
        }
        return cq;
 }
-EXPORT_SYMBOL(ib_create_cq);
+EXPORT_SYMBOL(__ib_create_cq);
 int rdma_set_cq_moderation(struct ib_cq *cq, u16 cq_count, u16 cq_period)
 {
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index ed1f253faf97..c7c85c22e4e3 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -486,8 +486,11 @@ int mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags,
        }
        if (flags & IB_MR_REREG_ACCESS) {
-                if (ib_access_writable(mr_access_flags) && !mmr->umem->writable)
+                if (ib_access_writable(mr_access_flags) &&
-                        return -EPERM;
+                    !mmr->umem->writable) {
+                        err = -EPERM;
+                        goto release_mpt_entry;
+                }
                err = mlx4_mr_hw_change_access(dev->dev, *pmpt_entry,
                                               convert_access(mr_access_flags));
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index e52dd21519b4..e3e330f59c2c 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -3199,8 +3199,8 @@ static int flow_counters_set_data(struct ib_counters *ibcounters,
        if (!mcounters->hw_cntrs_hndl) {
                mcounters->hw_cntrs_hndl = mlx5_fc_create(
                        to_mdev(ibcounters->device)->mdev, false);
-                if (!mcounters->hw_cntrs_hndl) {
+                if (IS_ERR(mcounters->hw_cntrs_hndl)) {
-                        ret = -ENOMEM;
+                        ret = PTR_ERR(mcounters->hw_cntrs_hndl);
                        goto free;
                }
                hw_hndl = true;
@@ -3546,29 +3546,35 @@ static struct ib_flow *mlx5_ib_create_flow(struct ib_qp *qp,
                        return ERR_PTR(-ENOMEM);
                err = ib_copy_from_udata(ucmd, udata, required_ucmd_sz);
-                if (err) {
+                if (err)
-                        kfree(ucmd);
+                        goto free_ucmd;
-                        return ERR_PTR(err);
-                }
        }
-        if (flow_attr->priority > MLX5_IB_FLOW_LAST_PRIO)
+        if (flow_attr->priority > MLX5_IB_FLOW_LAST_PRIO) {
-                return ERR_PTR(-ENOMEM);
+                err = -ENOMEM;
+                goto free_ucmd;
+        }
        if (domain != IB_FLOW_DOMAIN_USER ||
            flow_attr->port > dev->num_ports ||
            (flow_attr->flags & ~(IB_FLOW_ATTR_FLAGS_DONT_TRAP |
-                                  IB_FLOW_ATTR_FLAGS_EGRESS)))
+                                  IB_FLOW_ATTR_FLAGS_EGRESS))) {
-                return ERR_PTR(-EINVAL);
+                err = -EINVAL;
+                goto free_ucmd;
+        }
        if (is_egress &&
            (flow_attr->type == IB_FLOW_ATTR_ALL_DEFAULT ||
-             flow_attr->type == IB_FLOW_ATTR_MC_DEFAULT))
+             flow_attr->type == IB_FLOW_ATTR_MC_DEFAULT)) {
-                return ERR_PTR(-EINVAL);
+                err = -EINVAL;
+                goto free_ucmd;
+        }
        dst = kzalloc(sizeof(*dst), GFP_KERNEL);
-        if (!dst)
+        if (!dst) {
-                return ERR_PTR(-ENOMEM);
+                err = -ENOMEM;
+                goto free_ucmd;
+        }
        mutex_lock(&dev->flow_db->lock);
@@ -3637,8 +3643,8 @@ destroy_ft:
 unlock:
        mutex_unlock(&dev->flow_db->lock);
        kfree(dst);
+free_ucmd:
        kfree(ucmd);
-        kfree(handler);
        return ERR_PTR(err);
 }
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index f7ac8fc9b531..f07b8df96f43 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -1957,6 +1957,9 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
        }
        if (attr_mask & (IB_QP_AV | IB_QP_PATH_MTU)) {
+                if (rdma_protocol_iwarp(&dev->ibdev, 1))
+                        return -EINVAL;
                if (attr_mask & IB_QP_PATH_MTU) {
                        if (attr->path_mtu < IB_MTU_256 ||
                            attr->path_mtu > IB_MTU_4096) {
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index f30eeba3f772..8be27238a86e 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -645,6 +645,9 @@ next_wqe:
                } else {
                        goto exit;
                }
+                if ((wqe->wr.send_flags & IB_SEND_SIGNALED) ||
+                    qp->sq_sig_type == IB_SIGNAL_ALL_WR)
+                        rxe_run_task(&qp->comp.task, 1);
                qp->req.wqe_index = next_index(qp->sq.queue,
                                                qp->req.wqe_index);
                goto next_wqe;
@@ -709,6 +712,7 @@ next_wqe:
        if (fill_packet(qp, wqe, &pkt, skb, payload)) {
                pr_debug("qp#%d Error during fill packet\n", qp_num(qp));
+                kfree_skb(skb);
                goto err;
        }
@@ -740,7 +744,6 @@ next_wqe:
        goto next_wqe;
 err:
-        kfree_skb(skb);
        wqe->status = IB_WC_LOC_PROT_ERR;
        wqe->state = wqe_state_error;
        __rxe_do_task(&qp->comp.task);
diff --git a/drivers/input/input-mt.c b/drivers/input/input-mt.c
index cf30523c6ef6..6c7326c93721 100644
--- a/drivers/input/input-mt.c
+++ b/drivers/input/input-mt.c
@@ -131,8 +131,10 @@ EXPORT_SYMBOL(input_mt_destroy_slots);
 * inactive, or if the tool type is changed, a new tracking id is
 * assigned to the slot. The tool type is only reported if the
 * corresponding absbit field is set.
+ *
+ * Returns true if contact is active.
 */
-void input_mt_report_slot_state(struct input_dev *dev,
+bool input_mt_report_slot_state(struct input_dev *dev,
                                unsigned int tool_type, bool active)
 {
        struct input_mt *mt = dev->mt;
@@ -140,22 +142,24 @@ void input_mt_report_slot_state(struct input_dev *dev,
        int id;
        if (!mt)
-                return;
+                return false;
        slot = &mt->slots[mt->slot];
        slot->frame = mt->frame;
        if (!active) {
                input_event(dev, EV_ABS, ABS_MT_TRACKING_ID, -1);
-                return;
+                return false;
        }
        id = input_mt_get_value(slot, ABS_MT_TRACKING_ID);
-        if (id < 0 || input_mt_get_value(slot, ABS_MT_TOOL_TYPE) != tool_type)
+        if (id < 0)
                id = input_mt_new_trkid(mt);
        input_event(dev, EV_ABS, ABS_MT_TRACKING_ID, id);
        input_event(dev, EV_ABS, ABS_MT_TOOL_TYPE, tool_type);
+        return true;
 }
 EXPORT_SYMBOL(input_mt_report_slot_state);
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 48e36acbeb49..cd620e009bad 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -125,7 +125,7 @@ static const struct xpad_device {
        u8 mapping;
        u8 xtype;
 } xpad_device[] = {
-        { 0x0079, 0x18d4, "GPD Win 2 Controller", 0, XTYPE_XBOX360 },
+        { 0x0079, 0x18d4, "GPD Win 2 X-Box Controller", 0, XTYPE_XBOX360 },
        { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX },
        { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX },
        { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
diff --git a/drivers/input/keyboard/goldfish_events.c b/drivers/input/keyboard/goldfish_events.c
index f6e643b589b6..e8dae6195b30 100644
--- a/drivers/input/keyboard/goldfish_events.c
+++ b/drivers/input/keyboard/goldfish_events.c
@@ -45,7 +45,7 @@ struct event_dev {
 static irqreturn_t events_interrupt(int irq, void *dev_id)
 {
        struct event_dev *edev = dev_id;
-        unsigned type, code, value;
+        unsigned int type, code, value;
        type = __raw_readl(edev->addr + REG_READ);
        code = __raw_readl(edev->addr + REG_READ);
@@ -57,7 +57,7 @@ static irqreturn_t events_interrupt(int irq, void *dev_id)
 }
 static void events_import_bits(struct event_dev *edev,
-                        unsigned long bits[], unsigned type, size_t count)
+                        unsigned long bits[], unsigned int type, size_t count)
 {
        void __iomem *addr = edev->addr;
        int i, j;
@@ -99,6 +99,7 @@ static void events_import_abs_params(struct event_dev *edev)
                for (j = 0; j < ARRAY_SIZE(val); j++) {
                        int offset = (i * ARRAY_SIZE(val) + j) * sizeof(u32);
                        val[j] = __raw_readl(edev->addr + REG_DATA + offset);
                }
@@ -112,7 +113,7 @@ static int events_probe(struct platform_device *pdev)
        struct input_dev *input_dev;
        struct event_dev *edev;
        struct resource *res;
-        unsigned keymapnamelen;
+        unsigned int keymapnamelen;
        void __iomem *addr;
        int irq;
        int i;
@@ -150,7 +151,7 @@ static int events_probe(struct platform_device *pdev)
        for (i = 0; i < keymapnamelen; i++)
                edev->name[i] = __raw_readb(edev->addr + REG_DATA + i);
-        pr_debug("events_probe() keymap=%s\n", edev->name);
+        pr_debug("%s: keymap=%s\n", __func__, edev->name);
        input_dev->name = edev->name;
        input_dev->id.bustype = BUS_HOST;
diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
index c25606e00693..ca59a2be9bc5 100644
--- a/drivers/input/misc/Kconfig
+++ b/drivers/input/misc/Kconfig
@@ -841,4 +841,14 @@ config INPUT_RAVE_SP_PWRBUTTON
          To compile this driver as a module, choose M here: the
          module will be called rave-sp-pwrbutton.
+config INPUT_SC27XX_VIBRA
+        tristate "Spreadtrum sc27xx vibrator support"
+        depends on MFD_SC27XX_PMIC || COMPILE_TEST
+        select INPUT_FF_MEMLESS
+        help
+          This option enables support for Spreadtrum sc27xx vibrator driver.
+          To compile this driver as a module, choose M here. The module will
+          be called sc27xx_vibra.
 endif
diff --git a/drivers/input/misc/Makefile b/drivers/input/misc/Makefile
index 72cde28649e2..9d0f9d1ff68f 100644
--- a/drivers/input/misc/Makefile
+++ b/drivers/input/misc/Makefile
@@ -66,6 +66,7 @@ obj-$(CONFIG_INPUT_RETU_PWRBUTTON)	+= retu-pwrbutton.o
 obj-$(CONFIG_INPUT_AXP20X_PEK)          += axp20x-pek.o
 obj-$(CONFIG_INPUT_GPIO_ROTARY_ENCODER) += rotary_encoder.o
 obj-$(CONFIG_INPUT_RK805_PWRKEY)        += rk805-pwrkey.o
+obj-$(CONFIG_INPUT_SC27XX_VIBRA)        += sc27xx-vibra.o
 obj-$(CONFIG_INPUT_SGI_BTNS)            += sgi_btns.o
 obj-$(CONFIG_INPUT_SIRFSOC_ONKEY)       += sirfsoc-onkey.o
 obj-$(CONFIG_INPUT_SOC_BUTTON_ARRAY)    += soc_button_array.o
diff --git a/drivers/input/misc/sc27xx-vibra.c b/drivers/input/misc/sc27xx-vibra.c
new file mode 100644
index 000000000000..295251abbdac
--- /dev/null
+++ b/drivers/input/misc/sc27xx-vibra.c
@@ -0,0 +1,154 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2018 Spreadtrum Communications Inc.
+ */
+#include <linux/module.h>
+#include <linux/of_address.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+#include <linux/input.h>
+#include <linux/workqueue.h>
+#define CUR_DRV_CAL_SEL         GENMASK(13, 12)
+#define SLP_LDOVIBR_PD_EN       BIT(9)
+#define LDO_VIBR_PD             BIT(8)
+struct vibra_info {
+        struct input_dev        *input_dev;
+        struct work_struct      play_work;
+        struct regmap           *regmap;
+        u32                     base;
+        u32                     strength;
+        bool                    enabled;
+};
+static void sc27xx_vibra_set(struct vibra_info *info, bool on)
+{
+        if (on) {
+                regmap_update_bits(info->regmap, info->base, LDO_VIBR_PD, 0);
+                regmap_update_bits(info->regmap, info->base,
+                                   SLP_LDOVIBR_PD_EN, 0);
+                info->enabled = true;
+        } else {
+                regmap_update_bits(info->regmap, info->base, LDO_VIBR_PD,
+                                   LDO_VIBR_PD);
+                regmap_update_bits(info->regmap, info->base,
+                                   SLP_LDOVIBR_PD_EN, SLP_LDOVIBR_PD_EN);
+                info->enabled = false;
+        }
+}
+static int sc27xx_vibra_hw_init(struct vibra_info *info)
+{
+        return regmap_update_bits(info->regmap, info->base, CUR_DRV_CAL_SEL, 0);
+}
+static void sc27xx_vibra_play_work(struct work_struct *work)
+{
+        struct vibra_info *info = container_of(work, struct vibra_info,
+                                               play_work);
+        if (info->strength && !info->enabled)
+                sc27xx_vibra_set(info, true);
+        else if (info->strength == 0 && info->enabled)
+                sc27xx_vibra_set(info, false);
+}
+static int sc27xx_vibra_play(struct input_dev *input, void *data,
+                             struct ff_effect *effect)
+{
+        struct vibra_info *info = input_get_drvdata(input);
+        info->strength = effect->u.rumble.weak_magnitude;
+        schedule_work(&info->play_work);
+        return 0;
+}
+static void sc27xx_vibra_close(struct input_dev *input)
+{
+        struct vibra_info *info = input_get_drvdata(input);
+        cancel_work_sync(&info->play_work);
+        if (info->enabled)
+                sc27xx_vibra_set(info, false);
+}
+static int sc27xx_vibra_probe(struct platform_device *pdev)
+{
+        struct vibra_info *info;
+        int error;
+        info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
+        if (!info)
+                return -ENOMEM;
+        info->regmap = dev_get_regmap(pdev->dev.parent, NULL);
+        if (!info->regmap) {
+                dev_err(&pdev->dev, "failed to get vibrator regmap.\n");
+                return -ENODEV;
+        }
+        error = device_property_read_u32(&pdev->dev, "reg", &info->base);
+        if (error) {
+                dev_err(&pdev->dev, "failed to get vibrator base address.\n");
+                return error;
+        }
+        info->input_dev = devm_input_allocate_device(&pdev->dev);
+        if (!info->input_dev) {
+                dev_err(&pdev->dev, "failed to allocate input device.\n");
+                return -ENOMEM;
+        }
+        info->input_dev->name = "sc27xx:vibrator";
+        info->input_dev->id.version = 0;
+        info->input_dev->close = sc27xx_vibra_close;
+        input_set_drvdata(info->input_dev, info);
+        input_set_capability(info->input_dev, EV_FF, FF_RUMBLE);
+        INIT_WORK(&info->play_work, sc27xx_vibra_play_work);
+        info->enabled = false;
+        error = sc27xx_vibra_hw_init(info);
+        if (error) {
+                dev_err(&pdev->dev, "failed to initialize the vibrator.\n");
+                return error;
+        }
+        error = input_ff_create_memless(info->input_dev, NULL,
+                                        sc27xx_vibra_play);
+        if (error) {
+                dev_err(&pdev->dev, "failed to register vibrator to FF.\n");
+                return error;
+        }
+        error = input_register_device(info->input_dev);
+        if (error) {
+                dev_err(&pdev->dev, "failed to register input device.\n");
+                return error;
+        }
+        return 0;
+}
+static const struct of_device_id sc27xx_vibra_of_match[] = {
+        { .compatible = "sprd,sc2731-vibrator", },
+        {}
+};
+MODULE_DEVICE_TABLE(of, sc27xx_vibra_of_match);
+static struct platform_driver sc27xx_vibra_driver = {
+        .driver = {
+                .name = "sc27xx-vibrator",
+                .of_match_table = sc27xx_vibra_of_match,
+        },
+        .probe = sc27xx_vibra_probe,
+};
+module_platform_driver(sc27xx_vibra_driver);
+MODULE_DESCRIPTION("Spreadtrum SC27xx Vibrator Driver");
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Xiaotong Lu <xiaotong.lu@spreadtrum.com>");
diff --git a/drivers/input/mouse/elan_i2c.h b/drivers/input/mouse/elan_i2c.h
index 599544c1a91c..243e0fa6e3e3 100644
--- a/drivers/input/mouse/elan_i2c.h
+++ b/drivers/input/mouse/elan_i2c.h
@@ -27,6 +27,8 @@
 #define ETP_DISABLE_POWER       0x0001
 #define ETP_PRESSURE_OFFSET     25
+#define ETP_CALIBRATE_MAX_LEN   3
 /* IAP Firmware handling */
 #define ETP_PRODUCT_ID_FORMAT_STRING    "%d.0"
 #define ETP_FW_NAME             "elan_i2c_" ETP_PRODUCT_ID_FORMAT_STRING ".bin"
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 8ff75114e762..1f9cd7d8b7ad 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -613,7 +613,7 @@ static ssize_t calibrate_store(struct device *dev,
        int tries = 20;
        int retval;
        int error;
-        u8 val[3];
+        u8 val[ETP_CALIBRATE_MAX_LEN];
        retval = mutex_lock_interruptible(&data->sysfs_mutex);
        if (retval)
@@ -1345,6 +1345,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
        { "ELAN060C", 0 },
        { "ELAN0611", 0 },
        { "ELAN0612", 0 },
+        { "ELAN0618", 0 },
        { "ELAN1000", 0 },
        { }
 };
diff --git a/drivers/input/mouse/elan_i2c_smbus.c b/drivers/input/mouse/elan_i2c_smbus.c
index cfcb32559925..c060d270bc4d 100644
--- a/drivers/input/mouse/elan_i2c_smbus.c
+++ b/drivers/input/mouse/elan_i2c_smbus.c
@@ -56,7 +56,7 @@
 static int elan_smbus_initialize(struct i2c_client *client)
 {
        u8 check[ETP_SMBUS_HELLOPACKET_LEN] = { 0x55, 0x55, 0x55, 0x55, 0x55 };
-        u8 values[ETP_SMBUS_HELLOPACKET_LEN] = { 0, 0, 0, 0, 0 };
+        u8 values[I2C_SMBUS_BLOCK_MAX] = {0};
        int len, error;
        /* Get hello packet */
@@ -117,12 +117,16 @@ static int elan_smbus_calibrate(struct i2c_client *client)
 static int elan_smbus_calibrate_result(struct i2c_client *client, u8 *val)
 {
        int error;
+        u8 buf[I2C_SMBUS_BLOCK_MAX] = {0};
+        BUILD_BUG_ON(ETP_CALIBRATE_MAX_LEN > sizeof(buf));
        error = i2c_smbus_read_block_data(client,
-                                          ETP_SMBUS_CALIBRATE_QUERY, val);
+                                          ETP_SMBUS_CALIBRATE_QUERY, buf);
        if (error < 0)
                return error;
+        memcpy(val, buf, ETP_CALIBRATE_MAX_LEN);
        return 0;
 }
@@ -472,6 +476,8 @@ static int elan_smbus_get_report(struct i2c_client *client, u8 *report)
 {
        int len;
+        BUILD_BUG_ON(I2C_SMBUS_BLOCK_MAX > ETP_SMBUS_REPORT_LEN);
        len = i2c_smbus_read_block_data(client,
                                        ETP_SMBUS_PACKET_QUERY,
                                        &report[ETP_SMBUS_REPORT_OFFSET]);
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index fb4d902c4403..dd85b16dc6f8 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -799,7 +799,7 @@ static int elantech_packet_check_v4(struct psmouse *psmouse)
        else if (ic_version == 7 && etd->info.samples[1] == 0x2A)
                sanity_check = ((packet[3] & 0x1c) == 0x10);
        else
-                sanity_check = ((packet[0] & 0x0c) == 0x04 &&
+                sanity_check = ((packet[0] & 0x08) == 0x00 &&
                                (packet[3] & 0x1c) == 0x10);
        if (!sanity_check)
@@ -1175,6 +1175,12 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = {
        { }
 };
+static const char * const middle_button_pnp_ids[] = {
+        "LEN2131", /* ThinkPad P52 w/ NFC */
+        "LEN2132", /* ThinkPad P52 */
+        NULL
+};
 /*
 * Set the appropriate event bits for the input subsystem
 */
@@ -1194,7 +1200,8 @@ static int elantech_set_input_params(struct psmouse *psmouse)
        __clear_bit(EV_REL, dev->evbit);
        __set_bit(BTN_LEFT, dev->keybit);
-        if (dmi_check_system(elantech_dmi_has_middle_button))
+        if (dmi_check_system(elantech_dmi_has_middle_button) ||
+                        psmouse_matches_pnp_id(psmouse, middle_button_pnp_ids))
                __set_bit(BTN_MIDDLE, dev->keybit);
        __set_bit(BTN_RIGHT, dev->keybit);
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 5ff5b1952be0..d3ff1fc09af7 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -192,8 +192,8 @@ psmouse_ret_t psmouse_process_byte(struct psmouse *psmouse)
                        else
                                input_report_rel(dev, REL_WHEEL, -wheel);
-                        input_report_key(dev, BTN_SIDE,  BIT(4));
+                        input_report_key(dev, BTN_SIDE,  packet[3] & BIT(4));
-                        input_report_key(dev, BTN_EXTRA, BIT(5));
+                        input_report_key(dev, BTN_EXTRA, packet[3] & BIT(5));
                        break;
                }
                break;
@@ -203,13 +203,13 @@ psmouse_ret_t psmouse_process_byte(struct psmouse *psmouse)
                input_report_rel(dev, REL_WHEEL, -(s8) packet[3]);
                /* Extra buttons on Genius NewNet 3D */
-                input_report_key(dev, BTN_SIDE,  BIT(6));
+                input_report_key(dev, BTN_SIDE,  packet[0] & BIT(6));
-                input_report_key(dev, BTN_EXTRA, BIT(7));
+                input_report_key(dev, BTN_EXTRA, packet[0] & BIT(7));
                break;
        case PSMOUSE_THINKPS:
                /* Extra button on ThinkingMouse */
-                input_report_key(dev, BTN_EXTRA, BIT(3));
+                input_report_key(dev, BTN_EXTRA, packet[0] & BIT(3));
                /*
                 * Without this bit of weirdness moving up gives wildly
@@ -223,7 +223,7 @@ psmouse_ret_t psmouse_process_byte(struct psmouse *psmouse)
                 * Cortron PS2 Trackball reports SIDE button in the
                 * 4th bit of the first byte.
                 */
-                input_report_key(dev, BTN_SIDE, BIT(3));
+                input_report_key(dev, BTN_SIDE, packet[0] & BIT(3));
                packet[0] |= BIT(3);
                break;
diff --git a/drivers/input/rmi4/Kconfig b/drivers/input/rmi4/Kconfig
index 7172b88cd064..fad2eae4a118 100644
--- a/drivers/input/rmi4/Kconfig
+++ b/drivers/input/rmi4/Kconfig
@@ -3,6 +3,7 @@
 #
 config RMI4_CORE
        tristate "Synaptics RMI4 bus support"
+        select IRQ_DOMAIN
        help
          Say Y here if you want to support the Synaptics RMI4 bus.  This is
          required for all RMI4 device support.
diff --git a/drivers/input/rmi4/rmi_2d_sensor.c b/drivers/input/rmi4/rmi_2d_sensor.c
index 8bb866c7b985..8eeffa066022 100644
--- a/drivers/input/rmi4/rmi_2d_sensor.c
+++ b/drivers/input/rmi4/rmi_2d_sensor.c
@@ -32,15 +32,15 @@ void rmi_2d_sensor_abs_process(struct rmi_2d_sensor *sensor,
        if (obj->type == RMI_2D_OBJECT_NONE)
                return;
-        if (axis_align->swap_axes)
-                swap(obj->x, obj->y);
        if (axis_align->flip_x)
                obj->x = sensor->max_x - obj->x;
        if (axis_align->flip_y)
                obj->y = sensor->max_y - obj->y;
+        if (axis_align->swap_axes)
+                swap(obj->x, obj->y);
        /*
         * Here checking if X offset or y offset are specified is
         * redundant. We just add the offsets or clip the values.
@@ -120,15 +120,15 @@ void rmi_2d_sensor_rel_report(struct rmi_2d_sensor *sensor, int x, int y)
        x = min(RMI_2D_REL_POS_MAX, max(RMI_2D_REL_POS_MIN, (int)x));
        y = min(RMI_2D_REL_POS_MAX, max(RMI_2D_REL_POS_MIN, (int)y));
-        if (axis_align->swap_axes)
-                swap(x, y);
        if (axis_align->flip_x)
                x = min(RMI_2D_REL_POS_MAX, -x);
        if (axis_align->flip_y)
                y = min(RMI_2D_REL_POS_MAX, -y);
+        if (axis_align->swap_axes)
+                swap(x, y);
        if (x || y) {
                input_report_rel(sensor->input, REL_X, x);
                input_report_rel(sensor->input, REL_Y, y);
@@ -141,17 +141,10 @@ static void rmi_2d_sensor_set_input_params(struct rmi_2d_sensor *sensor)
        struct input_dev *input = sensor->input;
        int res_x;
        int res_y;
+        int max_x, max_y;
        int input_flags = 0;
        if (sensor->report_abs) {
-                if (sensor->axis_align.swap_axes) {
-                        swap(sensor->max_x, sensor->max_y);
-                        swap(sensor->axis_align.clip_x_low,
-                             sensor->axis_align.clip_y_low);
-                        swap(sensor->axis_align.clip_x_high,
-                             sensor->axis_align.clip_y_high);
-                }
                sensor->min_x = sensor->axis_align.clip_x_low;
                if (sensor->axis_align.clip_x_high)
                        sensor->max_x = min(sensor->max_x,
@@ -163,14 +156,19 @@ static void rmi_2d_sensor_set_input_params(struct rmi_2d_sensor *sensor)
                                sensor->axis_align.clip_y_high);
                set_bit(EV_ABS, input->evbit);
-                input_set_abs_params(input, ABS_MT_POSITION_X, 0, sensor->max_x,
-                                        0, 0);
+                max_x = sensor->max_x;
-                input_set_abs_params(input, ABS_MT_POSITION_Y, 0, sensor->max_y,
+                max_y = sensor->max_y;
-                                        0, 0);
+                if (sensor->axis_align.swap_axes)
+                        swap(max_x, max_y);
+                input_set_abs_params(input, ABS_MT_POSITION_X, 0, max_x, 0, 0);
+                input_set_abs_params(input, ABS_MT_POSITION_Y, 0, max_y, 0, 0);
                if (sensor->x_mm && sensor->y_mm) {
                        res_x = (sensor->max_x - sensor->min_x) / sensor->x_mm;
                        res_y = (sensor->max_y - sensor->min_y) / sensor->y_mm;
+                        if (sensor->axis_align.swap_axes)
+                                swap(res_x, res_y);
                        input_abs_set_res(input, ABS_X, res_x);
                        input_abs_set_res(input, ABS_Y, res_y);
diff --git a/drivers/input/rmi4/rmi_bus.c b/drivers/input/rmi4/rmi_bus.c
index c5fa53adba8d..bd0d5ff01b08 100644
--- a/drivers/input/rmi4/rmi_bus.c
+++ b/drivers/input/rmi4/rmi_bus.c
@@ -9,6 +9,8 @@
 #include <linux/kernel.h>
 #include <linux/device.h>
+#include <linux/irq.h>
+#include <linux/irqdomain.h>
 #include <linux/list.h>
 #include <linux/pm.h>
 #include <linux/rmi.h>
@@ -167,6 +169,39 @@ static inline void rmi_function_of_probe(struct rmi_function *fn)
 {}
 #endif
+static struct irq_chip rmi_irq_chip = {
+        .name = "rmi4",
+};
+static int rmi_create_function_irq(struct rmi_function *fn,
+                                   struct rmi_function_handler *handler)
+{
+        struct rmi_driver_data *drvdata = dev_get_drvdata(&fn->rmi_dev->dev);
+        int i, error;
+        for (i = 0; i < fn->num_of_irqs; i++) {
+                set_bit(fn->irq_pos + i, fn->irq_mask);
+                fn->irq[i] = irq_create_mapping(drvdata->irqdomain,
+                                                fn->irq_pos + i);
+                irq_set_chip_data(fn->irq[i], fn);
+                irq_set_chip_and_handler(fn->irq[i], &rmi_irq_chip,
+                                         handle_simple_irq);
+                irq_set_nested_thread(fn->irq[i], 1);
+                error = devm_request_threaded_irq(&fn->dev, fn->irq[i], NULL,
+                                        handler->attention, IRQF_ONESHOT,
+                                        dev_name(&fn->dev), fn);
+                if (error) {
+                        dev_err(&fn->dev, "Error %d registering IRQ\n", error);
+                        return error;
+                }
+        }
+        return 0;
+}
 static int rmi_function_probe(struct device *dev)
 {
        struct rmi_function *fn = to_rmi_function(dev);
@@ -178,7 +213,14 @@ static int rmi_function_probe(struct device *dev)
        if (handler->probe) {
                error = handler->probe(fn);
-                return error;
+                if (error)
+                        return error;
+        }
+        if (fn->num_of_irqs && handler->attention) {
+                error = rmi_create_function_irq(fn, handler);
+                if (error)
+                        return error;
        }
        return 0;
@@ -230,12 +272,18 @@ err_put_device:
 void rmi_unregister_function(struct rmi_function *fn)
 {
+        int i;
        rmi_dbg(RMI_DEBUG_CORE, &fn->dev, "Unregistering F%02X.\n",
                        fn->fd.function_number);
        device_del(&fn->dev);
        of_node_put(fn->dev.of_node);
        put_device(&fn->dev);
+        for (i = 0; i < fn->num_of_irqs; i++)
+                irq_dispose_mapping(fn->irq[i]);
 }
 /**
diff --git a/drivers/input/rmi4/rmi_bus.h b/drivers/input/rmi4/rmi_bus.h
index b7625a9ac66a..96383eab41ba 100644
--- a/drivers/input/rmi4/rmi_bus.h
+++ b/drivers/input/rmi4/rmi_bus.h
@@ -14,6 +14,12 @@
 struct rmi_device;
+/*
+ * The interrupt source count in the function descriptor can represent up to
+ * 6 interrupt sources in the normal manner.
+ */
+#define RMI_FN_MAX_IRQS 6
 /**
 * struct rmi_function - represents the implementation of an RMI4
 * function for a particular device (basically, a driver for that RMI4 function)
@@ -26,6 +32,7 @@ struct rmi_device;
 * @irq_pos: The position in the irq bitfield this function holds
 * @irq_mask: For convenience, can be used to mask IRQ bits off during ATTN
 * interrupt handling.
+ * @irqs: assigned virq numbers (up to num_of_irqs)
 *
 * @node: entry in device's list of functions
 */
@@ -36,6 +43,7 @@ struct rmi_function {
        struct list_head node;
        unsigned int num_of_irqs;
+        int irq[RMI_FN_MAX_IRQS];
        unsigned int irq_pos;
        unsigned long irq_mask[];
 };
@@ -76,7 +84,7 @@ struct rmi_function_handler {
        void (*remove)(struct rmi_function *fn);
        int (*config)(struct rmi_function *fn);
        int (*reset)(struct rmi_function *fn);
-        int (*attention)(struct rmi_function *fn, unsigned long *irq_bits);
+        irqreturn_t (*attention)(int irq, void *ctx);
        int (*suspend)(struct rmi_function *fn);
        int (*resume)(struct rmi_function *fn);
 };
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 7d29053dfb0f..fc3ab93b7aea 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -21,6 +21,7 @@
 #include <linux/pm.h>
 #include <linux/slab.h>
 #include <linux/of.h>
+#include <linux/irqdomain.h>
 #include <uapi/linux/input.h>
 #include <linux/rmi.h>
 #include "rmi_bus.h"
@@ -127,28 +128,11 @@ static int rmi_driver_process_config_requests(struct rmi_device *rmi_dev)
        return 0;
 }
-static void process_one_interrupt(struct rmi_driver_data *data,
-                                  struct rmi_function *fn)
-{
-        struct rmi_function_handler *fh;
-        if (!fn || !fn->dev.driver)
-                return;
-        fh = to_rmi_function_handler(fn->dev.driver);
-        if (fh->attention) {
-                bitmap_and(data->fn_irq_bits, data->irq_status, fn->irq_mask,
-                                data->irq_count);
-                if (!bitmap_empty(data->fn_irq_bits, data->irq_count))
-                        fh->attention(fn, data->fn_irq_bits);
-        }
-}
 static int rmi_process_interrupt_requests(struct rmi_device *rmi_dev)
 {
        struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
        struct device *dev = &rmi_dev->dev;
-        struct rmi_function *entry;
+        int i;
        int error;
        if (!data)
@@ -173,16 +157,8 @@ static int rmi_process_interrupt_requests(struct rmi_device *rmi_dev)
         */
        mutex_unlock(&data->irq_mutex);
-        /*
+        for_each_set_bit(i, data->irq_status, data->irq_count)
-         * It would be nice to be able to use irq_chip to handle these
+                handle_nested_irq(irq_find_mapping(data->irqdomain, i));
-         * nested IRQs.  Unfortunately, most of the current customers for
-         * this driver are using older kernels (3.0.x) that don't support
-         * the features required for that.  Once they've shifted to more
-         * recent kernels (say, 3.3 and higher), this should be switched to
-         * use irq_chip.
-         */
-        list_for_each_entry(entry, &data->function_list, node)
-                process_one_interrupt(data, entry);
        if (data->input)
                input_sync(data->input);
@@ -1001,9 +977,13 @@ EXPORT_SYMBOL_GPL(rmi_driver_resume);
 static int rmi_driver_remove(struct device *dev)
 {
        struct rmi_device *rmi_dev = to_rmi_device(dev);
+        struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
        rmi_disable_irq(rmi_dev, false);
+        irq_domain_remove(data->irqdomain);
+        data->irqdomain = NULL;
        rmi_f34_remove_sysfs(rmi_dev);
        rmi_free_function_list(rmi_dev);
@@ -1035,7 +1015,8 @@ int rmi_probe_interrupts(struct rmi_driver_data *data)
 {
        struct rmi_device *rmi_dev = data->rmi_dev;
        struct device *dev = &rmi_dev->dev;
-        int irq_count;
+        struct fwnode_handle *fwnode = rmi_dev->xport->dev->fwnode;
+        int irq_count = 0;
        size_t size;
        int retval;
@@ -1046,7 +1027,6 @@ int rmi_probe_interrupts(struct rmi_driver_data *data)
         * being accessed.
         */
        rmi_dbg(RMI_DEBUG_CORE, dev, "%s: Counting IRQs.\n", __func__);
-        irq_count = 0;
        data->bootloader_mode = false;
        retval = rmi_scan_pdt(rmi_dev, &irq_count, rmi_count_irqs);
@@ -1058,6 +1038,15 @@ int rmi_probe_interrupts(struct rmi_driver_data *data)
        if (data->bootloader_mode)
                dev_warn(dev, "Device in bootloader mode.\n");
+        /* Allocate and register a linear revmap irq_domain */
+        data->irqdomain = irq_domain_create_linear(fwnode, irq_count,
+                                                   &irq_domain_simple_ops,
+                                                   data);
+        if (!data->irqdomain) {
+                dev_err(&rmi_dev->dev, "Failed to create IRQ domain\n");
+                return -ENOMEM;
+        }
        data->irq_count = irq_count;
        data->num_of_irq_regs = (data->irq_count + 7) / 8;
@@ -1080,10 +1069,9 @@ int rmi_init_functions(struct rmi_driver_data *data)
 {
        struct rmi_device *rmi_dev = data->rmi_dev;
        struct device *dev = &rmi_dev->dev;
-        int irq_count;
+        int irq_count = 0;
        int retval;
-        irq_count = 0;
        rmi_dbg(RMI_DEBUG_CORE, dev, "%s: Creating functions.\n", __func__);
        retval = rmi_scan_pdt(rmi_dev, &irq_count, rmi_create_function);
        if (retval < 0) {
diff --git a/drivers/input/rmi4/rmi_f01.c b/drivers/input/rmi4/rmi_f01.c
index 8a07ae147df6..4edaa14fe878 100644
--- a/drivers/input/rmi4/rmi_f01.c
+++ b/drivers/input/rmi4/rmi_f01.c
@@ -681,9 +681,9 @@ static int rmi_f01_resume(struct rmi_function *fn)
        return 0;
 }
-static int rmi_f01_attention(struct rmi_function *fn,
+static irqreturn_t rmi_f01_attention(int irq, void *ctx)
-                             unsigned long *irq_bits)
 {
+        struct rmi_function *fn = ctx;
        struct rmi_device *rmi_dev = fn->rmi_dev;
        int error;
        u8 device_status;
@@ -692,7 +692,7 @@ static int rmi_f01_attention(struct rmi_function *fn,
        if (error) {
                dev_err(&fn->dev,
                        "Failed to read device status: %d.\n", error);
-                return error;
+                return IRQ_RETVAL(error);
        }
        if (RMI_F01_STATUS_BOOTLOADER(device_status))
@@ -704,11 +704,11 @@ static int rmi_f01_attention(struct rmi_function *fn,
                error = rmi_dev->driver->reset_handler(rmi_dev);
                if (error) {
                        dev_err(&fn->dev, "Device reset failed: %d\n", error);
-                        return error;
+                        return IRQ_RETVAL(error);
                }
        }
-        return 0;
+        return IRQ_HANDLED;
 }
 struct rmi_function_handler rmi_f01_handler = {
diff --git a/drivers/input/rmi4/rmi_f03.c b/drivers/input/rmi4/rmi_f03.c
index 88822196d6b7..aaa1edc95522 100644
--- a/drivers/input/rmi4/rmi_f03.c
+++ b/drivers/input/rmi4/rmi_f03.c
@@ -244,8 +244,9 @@ static int rmi_f03_config(struct rmi_function *fn)
        return 0;
 }
-static int rmi_f03_attention(struct rmi_function *fn, unsigned long *irq_bits)
+static irqreturn_t rmi_f03_attention(int irq, void *ctx)
 {
+        struct rmi_function *fn = ctx;
        struct rmi_device *rmi_dev = fn->rmi_dev;
        struct rmi_driver_data *drvdata = dev_get_drvdata(&rmi_dev->dev);
        struct f03_data *f03 = dev_get_drvdata(&fn->dev);
@@ -262,7 +263,7 @@ static int rmi_f03_attention(struct rmi_function *fn, unsigned long *irq_bits)
                /* First grab the data passed by the transport device */
                if (drvdata->attn_data.size < ob_len) {
                        dev_warn(&fn->dev, "F03 interrupted, but data is missing!\n");
-                        return 0;
+                        return IRQ_HANDLED;
                }
                memcpy(obs, drvdata->attn_data.data, ob_len);
@@ -277,7 +278,7 @@ static int rmi_f03_attention(struct rmi_function *fn, unsigned long *irq_bits)
                                "%s: Failed to read F03 output buffers: %d\n",
                                __func__, error);
                        serio_interrupt(f03->serio, 0, SERIO_TIMEOUT);
-                        return error;
+                        return IRQ_RETVAL(error);
                }
        }
@@ -303,7 +304,7 @@ static int rmi_f03_attention(struct rmi_function *fn, unsigned long *irq_bits)
                serio_interrupt(f03->serio, ob_data, serio_flags);
        }
-        return 0;
+        return IRQ_HANDLED;
 }
 static void rmi_f03_remove(struct rmi_function *fn)
diff --git a/drivers/input/rmi4/rmi_f11.c b/drivers/input/rmi4/rmi_f11.c
index 12a233251793..df64d6aed4f7 100644
--- a/drivers/input/rmi4/rmi_f11.c
+++ b/drivers/input/rmi4/rmi_f11.c
@@ -570,9 +570,7 @@ static inline u8 rmi_f11_parse_finger_state(const u8 *f_state, u8 n_finger)
 }
 static void rmi_f11_finger_handler(struct f11_data *f11,
-                                   struct rmi_2d_sensor *sensor,
+                                   struct rmi_2d_sensor *sensor, int size)
-                                   unsigned long *irq_bits, int num_irq_regs,
-                                   int size)
 {
        const u8 *f_state = f11->data.f_state;
        u8 finger_state;
@@ -581,12 +579,7 @@ static void rmi_f11_finger_handler(struct f11_data *f11,
        int rel_fingers;
        int abs_size = sensor->nbr_fingers * RMI_F11_ABS_BYTES;
-        int abs_bits = bitmap_and(f11->result_bits, irq_bits, f11->abs_mask,
+        if (sensor->report_abs) {
-                                  num_irq_regs * 8);
-        int rel_bits = bitmap_and(f11->result_bits, irq_bits, f11->rel_mask,
-                                  num_irq_regs * 8);
-        if (abs_bits) {
                if (abs_size > size)
                        abs_fingers = size / RMI_F11_ABS_BYTES;
                else
@@ -604,19 +597,7 @@ static void rmi_f11_finger_handler(struct f11_data *f11,
                        rmi_f11_abs_pos_process(f11, sensor, &sensor->objs[i],
                                                        finger_state, i);
                }
-        }
-        if (rel_bits) {
-                if ((abs_size + sensor->nbr_fingers * RMI_F11_REL_BYTES) > size)
-                        rel_fingers = (size - abs_size) / RMI_F11_REL_BYTES;
-                else
-                        rel_fingers = sensor->nbr_fingers;
-                for (i = 0; i < rel_fingers; i++)
-                        rmi_f11_rel_pos_report(f11, i);
-        }
-        if (abs_bits) {
                /*
                 * the absolute part is made in 2 parts to allow the kernel
                 * tracking to take place.
@@ -638,7 +619,16 @@ static void rmi_f11_finger_handler(struct f11_data *f11,
                }
                input_mt_sync_frame(sensor->input);
+        } else if (sensor->report_rel) {
+                if ((abs_size + sensor->nbr_fingers * RMI_F11_REL_BYTES) > size)
+                        rel_fingers = (size - abs_size) / RMI_F11_REL_BYTES;
+                else
+                        rel_fingers = sensor->nbr_fingers;
+                for (i = 0; i < rel_fingers; i++)
+                        rmi_f11_rel_pos_report(f11, i);
        }
 }
 static int f11_2d_construct_data(struct f11_data *f11)
@@ -1276,8 +1266,9 @@ static int rmi_f11_config(struct rmi_function *fn)
        return 0;
 }
-static int rmi_f11_attention(struct rmi_function *fn, unsigned long *irq_bits)
+static irqreturn_t rmi_f11_attention(int irq, void *ctx)
 {
+        struct rmi_function *fn = ctx;
        struct rmi_device *rmi_dev = fn->rmi_dev;
        struct rmi_driver_data *drvdata = dev_get_drvdata(&rmi_dev->dev);
        struct f11_data *f11 = dev_get_drvdata(&fn->dev);
@@ -1303,13 +1294,12 @@ static int rmi_f11_attention(struct rmi_function *fn, unsigned long *irq_bits)
                                data_base_addr, f11->sensor.data_pkt,
                                f11->sensor.pkt_size);
                if (error < 0)
-                        return error;
+                        return IRQ_RETVAL(error);
        }
-        rmi_f11_finger_handler(f11, &f11->sensor, irq_bits,
+        rmi_f11_finger_handler(f11, &f11->sensor, valid_bytes);
-                                drvdata->num_of_irq_regs, valid_bytes);
-        return 0;
+        return IRQ_HANDLED;
 }
 static int rmi_f11_resume(struct rmi_function *fn)
diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
index a3d1aa88f2a9..5c7f48915779 100644
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -197,10 +197,10 @@ static void rmi_f12_process_objects(struct f12_data *f12, u8 *data1, int size)
                rmi_2d_sensor_abs_report(sensor, &sensor->objs[i], i);
 }
-static int rmi_f12_attention(struct rmi_function *fn,
+static irqreturn_t rmi_f12_attention(int irq, void *ctx)
-                             unsigned long *irq_nr_regs)
 {
        int retval;
+        struct rmi_function *fn = ctx;
        struct rmi_device *rmi_dev = fn->rmi_dev;
        struct rmi_driver_data *drvdata = dev_get_drvdata(&rmi_dev->dev);
        struct f12_data *f12 = dev_get_drvdata(&fn->dev);
@@ -222,7 +222,7 @@ static int rmi_f12_attention(struct rmi_function *fn,
                if (retval < 0) {
                        dev_err(&fn->dev, "Failed to read object data. Code: %d.\n",
                                retval);
-                        return retval;
+                        return IRQ_RETVAL(retval);
                }
        }
@@ -232,7 +232,7 @@ static int rmi_f12_attention(struct rmi_function *fn,
        input_mt_sync_frame(sensor->input);
-        return 0;
+        return IRQ_HANDLED;
 }
 static int rmi_f12_write_control_regs(struct rmi_function *fn)
diff --git a/drivers/input/rmi4/rmi_f30.c b/drivers/input/rmi4/rmi_f30.c
index 82e0f0d43d55..5e3ed5ac0c3e 100644
--- a/drivers/input/rmi4/rmi_f30.c
+++ b/drivers/input/rmi4/rmi_f30.c
@@ -122,8 +122,9 @@ static void rmi_f30_report_button(struct rmi_function *fn,
        }
 }
-static int rmi_f30_attention(struct rmi_function *fn, unsigned long *irq_bits)
+static irqreturn_t rmi_f30_attention(int irq, void *ctx)
 {
+        struct rmi_function *fn = ctx;
        struct f30_data *f30 = dev_get_drvdata(&fn->dev);
        struct rmi_driver_data *drvdata = dev_get_drvdata(&fn->rmi_dev->dev);
        int error;
@@ -134,7 +135,7 @@ static int rmi_f30_attention(struct rmi_function *fn, unsigned long *irq_bits)
                if (drvdata->attn_data.size < f30->register_count) {
                        dev_warn(&fn->dev,
                                 "F30 interrupted, but data is missing\n");
-                        return 0;
+                        return IRQ_HANDLED;
                }
                memcpy(f30->data_regs, drvdata->attn_data.data,
                        f30->register_count);
@@ -147,7 +148,7 @@ static int rmi_f30_attention(struct rmi_function *fn, unsigned long *irq_bits)
                        dev_err(&fn->dev,
                                "%s: Failed to read F30 data registers: %d\n",
                                __func__, error);
-                        return error;
+                        return IRQ_RETVAL(error);
                }
        }
@@ -159,7 +160,7 @@ static int rmi_f30_attention(struct rmi_function *fn, unsigned long *irq_bits)
                        rmi_f03_commit_buttons(f30->f03);
        }
-        return 0;
+        return IRQ_HANDLED;
 }
 static int rmi_f30_config(struct rmi_function *fn)
diff --git a/drivers/input/rmi4/rmi_f34.c b/drivers/input/rmi4/rmi_f34.c
index f1f5ac539d5d..87a7d4ba382d 100644
--- a/drivers/input/rmi4/rmi_f34.c
+++ b/drivers/input/rmi4/rmi_f34.c
@@ -100,8 +100,9 @@ static int rmi_f34_command(struct f34_data *f34, u8 command,
        return 0;
 }
-static int rmi_f34_attention(struct rmi_function *fn, unsigned long *irq_bits)
+static irqreturn_t rmi_f34_attention(int irq, void *ctx)
 {
+        struct rmi_function *fn = ctx;
        struct f34_data *f34 = dev_get_drvdata(&fn->dev);
        int ret;
        u8 status;
@@ -126,7 +127,7 @@ static int rmi_f34_attention(struct rmi_function *fn, unsigned long *irq_bits)
                        complete(&f34->v7.cmd_done);
        }
-        return 0;
+        return IRQ_HANDLED;
 }
 static int rmi_f34_write_blocks(struct f34_data *f34, const void *data,
diff --git a/drivers/input/rmi4/rmi_f54.c b/drivers/input/rmi4/rmi_f54.c
index e8a59d164019..a6f515bcab22 100644
--- a/drivers/input/rmi4/rmi_f54.c
+++ b/drivers/input/rmi4/rmi_f54.c
@@ -610,11 +610,6 @@ error:
        mutex_unlock(&f54->data_mutex);
 }
-static int rmi_f54_attention(struct rmi_function *fn, unsigned long *irqbits)
-{
-        return 0;
-}
 static int rmi_f54_config(struct rmi_function *fn)
 {
        struct rmi_driver *drv = fn->rmi_dev->driver;
@@ -756,6 +751,5 @@ struct rmi_function_handler rmi_f54_handler = {
        .func = 0x54,
        .probe = rmi_f54_probe,
        .config = rmi_f54_config,
-        .attention = rmi_f54_attention,
        .remove = rmi_f54_remove,
 };
diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c
index ff7043f74a3d..d196ac3d8b8c 100644
--- a/drivers/input/touchscreen/silead.c
+++ b/drivers/input/touchscreen/silead.c
@@ -603,6 +603,7 @@ static const struct acpi_device_id silead_ts_acpi_match[] = {
        { "GSL3692", 0 },
        { "MSSL1680", 0 },
        { "MSSL0001", 0 },
+        { "MSSL0002", 0 },
        { }
 };
 MODULE_DEVICE_TABLE(acpi, silead_ts_acpi_match);
diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
index 0f52d44b3f69..f5fe0100f9ff 100644
--- a/drivers/irqchip/irq-gic-v2m.c
+++ b/drivers/irqchip/irq-gic-v2m.c
@@ -199,7 +199,7 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
 fail:
        irq_domain_free_irqs_parent(domain, virq, nr_irqs);
-        gicv2m_unalloc_msi(v2m, hwirq, get_count_order(nr_irqs));
+        gicv2m_unalloc_msi(v2m, hwirq, nr_irqs);
        return err;
 }
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 5377d7e2afba..d7842d312d3e 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -182,6 +182,22 @@ static struct its_collection *dev_event_to_col(struct its_device *its_dev,
        return its->collections + its_dev->event_map.col_map[event];
 }
+static struct its_collection *valid_col(struct its_collection *col)
+{
+        if (WARN_ON_ONCE(col->target_address & GENMASK_ULL(0, 15)))
+                return NULL;
+        return col;
+}
+static struct its_vpe *valid_vpe(struct its_node *its, struct its_vpe *vpe)
+{
+        if (valid_col(its->collections + vpe->col_idx))
+                return vpe;
+        return NULL;
+}
 /*
 * ITS command descriptors - parameters to be encoded in a command
 * block.
@@ -439,7 +455,7 @@ static struct its_collection *its_build_mapti_cmd(struct its_node *its,
        its_fixup_cmd(cmd);
-        return col;
+        return valid_col(col);
 }
 static struct its_collection *its_build_movi_cmd(struct its_node *its,
@@ -458,7 +474,7 @@ static struct its_collection *its_build_movi_cmd(struct its_node *its,
        its_fixup_cmd(cmd);
-        return col;
+        return valid_col(col);
 }
 static struct its_collection *its_build_discard_cmd(struct its_node *its,
@@ -476,7 +492,7 @@ static struct its_collection *its_build_discard_cmd(struct its_node *its,
        its_fixup_cmd(cmd);
-        return col;
+        return valid_col(col);
 }
 static struct its_collection *its_build_inv_cmd(struct its_node *its,
@@ -494,7 +510,7 @@ static struct its_collection *its_build_inv_cmd(struct its_node *its,
        its_fixup_cmd(cmd);
-        return col;
+        return valid_col(col);
 }
 static struct its_collection *its_build_int_cmd(struct its_node *its,
@@ -512,7 +528,7 @@ static struct its_collection *its_build_int_cmd(struct its_node *its,
        its_fixup_cmd(cmd);
-        return col;
+        return valid_col(col);
 }
 static struct its_collection *its_build_clear_cmd(struct its_node *its,
@@ -530,7 +546,7 @@ static struct its_collection *its_build_clear_cmd(struct its_node *its,
        its_fixup_cmd(cmd);
-        return col;
+        return valid_col(col);
 }
 static struct its_collection *its_build_invall_cmd(struct its_node *its,
@@ -554,7 +570,7 @@ static struct its_vpe *its_build_vinvall_cmd(struct its_node *its,
        its_fixup_cmd(cmd);
-        return desc->its_vinvall_cmd.vpe;
+        return valid_vpe(its, desc->its_vinvall_cmd.vpe);
 }
 static struct its_vpe *its_build_vmapp_cmd(struct its_node *its,
@@ -576,7 +592,7 @@ static struct its_vpe *its_build_vmapp_cmd(struct its_node *its,
        its_fixup_cmd(cmd);
-        return desc->its_vmapp_cmd.vpe;
+        return valid_vpe(its, desc->its_vmapp_cmd.vpe);
 }
 static struct its_vpe *its_build_vmapti_cmd(struct its_node *its,
@@ -599,7 +615,7 @@ static struct its_vpe *its_build_vmapti_cmd(struct its_node *its,
        its_fixup_cmd(cmd);
-        return desc->its_vmapti_cmd.vpe;
+        return valid_vpe(its, desc->its_vmapti_cmd.vpe);
 }
 static struct its_vpe *its_build_vmovi_cmd(struct its_node *its,
@@ -622,7 +638,7 @@ static struct its_vpe *its_build_vmovi_cmd(struct its_node *its,
        its_fixup_cmd(cmd);
-        return desc->its_vmovi_cmd.vpe;
+        return valid_vpe(its, desc->its_vmovi_cmd.vpe);
 }
 static struct its_vpe *its_build_vmovp_cmd(struct its_node *its,
@@ -640,7 +656,7 @@ static struct its_vpe *its_build_vmovp_cmd(struct its_node *its,
        its_fixup_cmd(cmd);
-        return desc->its_vmovp_cmd.vpe;
+        return valid_vpe(its, desc->its_vmovp_cmd.vpe);
 }
 static u64 its_cmd_ptr_to_offset(struct its_node *its,
@@ -1824,11 +1840,16 @@ static int its_alloc_tables(struct its_node *its)
 static int its_alloc_collections(struct its_node *its)
 {
+        int i;
        its->collections = kcalloc(nr_cpu_ids, sizeof(*its->collections),
                                   GFP_KERNEL);
        if (!its->collections)
                return -ENOMEM;
+        for (i = 0; i < nr_cpu_ids; i++)
+                its->collections[i].target_address = ~0ULL;
        return 0;
 }
@@ -2310,7 +2331,14 @@ static int its_irq_domain_activate(struct irq_domain *domain,
                cpu_mask = cpumask_of_node(its_dev->its->numa_node);
        /* Bind the LPI to the first possible CPU */
-        cpu = cpumask_first(cpu_mask);
+        cpu = cpumask_first_and(cpu_mask, cpu_online_mask);
+        if (cpu >= nr_cpu_ids) {
+                if (its_dev->its->flags & ITS_FLAGS_WORKAROUND_CAVIUM_23144)
+                        return -EINVAL;
+                cpu = cpumask_first(cpu_online_mask);
+        }
        its_dev->event_map.col_map[event] = cpu;
        irq_data_update_effective_affinity(d, cpumask_of(cpu));
@@ -3399,6 +3427,16 @@ static int redist_disable_lpis(void)
        u64 timeout = USEC_PER_SEC;
        u64 val;
+        /*
+         * If coming via a CPU hotplug event, we don't need to disable
+         * LPIs before trying to re-enable them. They are already
+         * configured and all is well in the world. Detect this case
+         * by checking the allocation of the pending table for the
+         * current CPU.
+         */
+        if (gic_data_rdist()->pend_page)
+                return 0;
        if (!gic_rdists_supports_plpis()) {
                pr_info("CPU%d: LPIs not supported\n", smp_processor_id());
                return -ENXIO;
diff --git a/drivers/irqchip/irq-ls-scfg-msi.c b/drivers/irqchip/irq-ls-scfg-msi.c
index 1ec3bfe56693..c671b3212010 100644
--- a/drivers/irqchip/irq-ls-scfg-msi.c
+++ b/drivers/irqchip/irq-ls-scfg-msi.c
@@ -93,8 +93,12 @@ static void ls_scfg_msi_compose_msg(struct irq_data *data, struct msi_msg *msg)
        msg->address_lo = lower_32_bits(msi_data->msiir_addr);
        msg->data = data->hwirq;
-        if (msi_affinity_flag)
+        if (msi_affinity_flag) {
-                msg->data |= cpumask_first(data->common->affinity);
+                const struct cpumask *mask;
+                mask = irq_data_get_effective_affinity_mask(data);
+                msg->data |= cpumask_first(mask);
+        }
        iommu_dma_map_msi_msg(data->irq, msg);
 }
@@ -121,7 +125,7 @@ static int ls_scfg_msi_set_affinity(struct irq_data *irq_data,
                return -EINVAL;
        }
-        cpumask_copy(irq_data->common->affinity, mask);
+        irq_data_update_effective_affinity(irq_data, cpumask_of(cpu));
        return IRQ_SET_MASK_OK;
 }
diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index 98f90aadd141..18c0a1281914 100644
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -588,7 +588,7 @@ static const struct proto_ops data_sock_ops = {
        .getname        = data_sock_getname,
        .sendmsg        = mISDN_sock_sendmsg,
        .recvmsg        = mISDN_sock_recvmsg,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
        .setsockopt     = data_sock_setsockopt,
diff --git a/drivers/lightnvm/Kconfig b/drivers/lightnvm/Kconfig
index 10c08982185a..9c03f35d9df1 100644
--- a/drivers/lightnvm/Kconfig
+++ b/drivers/lightnvm/Kconfig
@@ -4,7 +4,7 @@
 menuconfig NVM
        bool "Open-Channel SSD target support"
-        depends on BLOCK && HAS_DMA && PCI
+        depends on BLOCK && PCI
        select BLK_DEV_NVME
        help
          Say Y here to get to enable Open-channel SSDs.
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index ab13fcec3fca..75df4c9d8b54 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -588,7 +588,7 @@ static const char *raid10_md_layout_to_format(int layout)
 }
 /* Return md raid10 algorithm for @name */
-static const int raid10_name_to_format(const char *name)
+static int raid10_name_to_format(const char *name)
 {
        if (!strcasecmp(name, "near"))
                return ALGORITHM_RAID10_NEAR;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 938766794c2e..3d0e2c198f06 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -885,9 +885,7 @@ EXPORT_SYMBOL_GPL(dm_table_set_type);
 static int device_supports_dax(struct dm_target *ti, struct dm_dev *dev,
                               sector_t start, sector_t len, void *data)
 {
-        struct request_queue *q = bdev_get_queue(dev->bdev);
+        return bdev_dax_supported(dev->bdev, PAGE_SIZE);
-        return q && blk_queue_dax(q);
 }
 static bool dm_table_supports_dax(struct dm_table *t)
@@ -1907,6 +1905,9 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
        if (dm_table_supports_dax(t))
                blk_queue_flag_set(QUEUE_FLAG_DAX, q);
+        else
+                blk_queue_flag_clear(QUEUE_FLAG_DAX, q);
        if (dm_table_supports_dax_write_cache(t))
                dax_write_cache(t->md->dax_dev, true);
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 36ef284ad086..72142021b5c9 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -776,7 +776,6 @@ static int __write_changed_details(struct dm_pool_metadata *pmd)
 static int __commit_transaction(struct dm_pool_metadata *pmd)
 {
        int r;
-        size_t metadata_len, data_len;
        struct thin_disk_superblock *disk_super;
        struct dm_block *sblock;
@@ -797,14 +796,6 @@ static int __commit_transaction(struct dm_pool_metadata *pmd)
        if (r < 0)
                return r;
-        r = dm_sm_root_size(pmd->metadata_sm, &metadata_len);
-        if (r < 0)
-                return r;
-        r = dm_sm_root_size(pmd->data_sm, &data_len);
-        if (r < 0)
-                return r;
        r = save_sm_roots(pmd);
        if (r < 0)
                return r;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 7945238df1c0..b900723bbd0f 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1386,6 +1386,8 @@ static void schedule_external_copy(struct thin_c *tc, dm_block_t virt_block,
 static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
+static void requeue_bios(struct pool *pool);
 static void check_for_space(struct pool *pool)
 {
        int r;
@@ -1398,8 +1400,10 @@ static void check_for_space(struct pool *pool)
        if (r)
                return;
-        if (nr_free)
+        if (nr_free) {
                set_pool_mode(pool, PM_WRITE);
+                requeue_bios(pool);
+        }
 }
 /*
@@ -1476,7 +1480,10 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
        r = dm_pool_alloc_data_block(pool->pmd, result);
        if (r) {
-                metadata_operation_failed(pool, "dm_pool_alloc_data_block", r);
+                if (r == -ENOSPC)
+                        set_pool_mode(pool, PM_OUT_OF_DATA_SPACE);
+                else
+                        metadata_operation_failed(pool, "dm_pool_alloc_data_block", r);
                return r;
        }
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 5961c7794ef3..07ea6a48aac6 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -259,7 +259,7 @@ static int persistent_memory_claim(struct dm_writecache *wc)
        if (da != p) {
                long i;
                wc->memory_map = NULL;
-                pages = kvmalloc(p * sizeof(struct page *), GFP_KERNEL);
+                pages = kvmalloc_array(p, sizeof(struct page *), GFP_KERNEL);
                if (!pages) {
                        r = -ENOMEM;
                        goto err2;
@@ -859,7 +859,7 @@ static int writecache_alloc_entries(struct dm_writecache *wc)
        if (wc->entries)
                return 0;
-        wc->entries = vmalloc(sizeof(struct wc_entry) * wc->n_blocks);
+        wc->entries = vmalloc(array_size(sizeof(struct wc_entry), wc->n_blocks));
        if (!wc->entries)
                return -ENOMEM;
        for (b = 0; b < wc->n_blocks; b++) {
@@ -1481,9 +1481,9 @@ static void __writecache_writeback_pmem(struct dm_writecache *wc, struct writeba
                wb->bio.bi_iter.bi_sector = read_original_sector(wc, e);
                wb->page_offset = PAGE_SIZE;
                if (max_pages <= WB_LIST_INLINE ||
-                    unlikely(!(wb->wc_list = kmalloc(max_pages * sizeof(struct wc_entry *),
+                    unlikely(!(wb->wc_list = kmalloc_array(max_pages, sizeof(struct wc_entry *),
-                                                     GFP_NOIO | __GFP_NORETRY |
+                                                           GFP_NOIO | __GFP_NORETRY |
-                                                     __GFP_NOMEMALLOC | __GFP_NOWARN)))) {
+                                                           __GFP_NOMEMALLOC | __GFP_NOWARN)))) {
                        wb->wc_list = wb->wc_list_inline;
                        max_pages = WB_LIST_INLINE;
                }
diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
index 3c0e45f4dcf5..a44183ff4be0 100644
--- a/drivers/md/dm-zoned-target.c
+++ b/drivers/md/dm-zoned-target.c
@@ -787,7 +787,7 @@ static int dmz_ctr(struct dm_target *ti, unsigned int argc, char **argv)
        /* Chunk BIO work */
        mutex_init(&dmz->chunk_lock);
-        INIT_RADIX_TREE(&dmz->chunk_rxtree, GFP_KERNEL);
+        INIT_RADIX_TREE(&dmz->chunk_rxtree, GFP_NOIO);
        dmz->chunk_wq = alloc_workqueue("dmz_cwq_%s", WQ_MEM_RECLAIM | WQ_UNBOUND,
                                        0, dev->name);
        if (!dmz->chunk_wq) {
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index e65429a29c06..b0dd7027848b 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1056,8 +1056,7 @@ static long dm_dax_direct_access(struct dax_device *dax_dev, pgoff_t pgoff,
        if (len < 1)
                goto out;
        nr_pages = min(len, nr_pages);
-        if (ti->type->direct_access)
+        ret = ti->type->direct_access(ti, pgoff, nr_pages, kaddr, pfn);
-                ret = ti->type->direct_access(ti, pgoff, nr_pages, kaddr, pfn);
 out:
        dm_put_live_table(md, srcu_idx);
@@ -1606,10 +1605,9 @@ static blk_qc_t __split_and_process_bio(struct mapped_device *md,
                                 * the usage of io->orig_bio in dm_remap_zone_report()
                                 * won't be affected by this reassignment.
                                 */
-                                struct bio *b = bio_clone_bioset(bio, GFP_NOIO,
+                                struct bio *b = bio_split(bio, bio_sectors(bio) - ci.sector_count,
-                                                                 &md->queue->bio_split);
+                                                          GFP_NOIO, &md->queue->bio_split);
                                ci.io->orig_bio = b;
-                                bio_advance(bio, (bio_sectors(bio) - ci.sector_count) << 9);
                                bio_chain(b, bio);
                                ret = generic_make_request(bio);
                                break;
diff --git a/drivers/memory/ti-emif-pm.c b/drivers/memory/ti-emif-pm.c
index 632651f4b6e8..2250d03ea17f 100644
--- a/drivers/memory/ti-emif-pm.c
+++ b/drivers/memory/ti-emif-pm.c
@@ -249,6 +249,34 @@ static const struct of_device_id ti_emif_of_match[] = {
 };
 MODULE_DEVICE_TABLE(of, ti_emif_of_match);
+#ifdef CONFIG_PM_SLEEP
+static int ti_emif_resume(struct device *dev)
+{
+        unsigned long tmp =
+                        __raw_readl((void *)emif_instance->ti_emif_sram_virt);
+        /*
+         * Check to see if what we are copying is already present in the
+         * first byte at the destination, only copy if it is not which
+         * indicates we have lost context and sram no longer contains
+         * the PM code
+         */
+        if (tmp != ti_emif_sram)
+                ti_emif_push_sram(dev, emif_instance);
+        return 0;
+}
+static int ti_emif_suspend(struct device *dev)
+{
+        /*
+         * The contents will be present in DDR hence no need to
+         * explicitly save
+         */
+        return 0;
+}
+#endif /* CONFIG_PM_SLEEP */
 static int ti_emif_probe(struct platform_device *pdev)
 {
        int ret;
@@ -308,12 +336,17 @@ static int ti_emif_remove(struct platform_device *pdev)
        return 0;
 }
+static const struct dev_pm_ops ti_emif_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(ti_emif_suspend, ti_emif_resume)
+};
 static struct platform_driver ti_emif_driver = {
        .probe = ti_emif_probe,
        .remove = ti_emif_remove,
        .driver = {
                .name = KBUILD_MODNAME,
                .of_match_table = of_match_ptr(ti_emif_of_match),
+                .pm = &ti_emif_pm_ops,
        },
 };
 module_platform_driver(ti_emif_driver);
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index a0c655628d6d..1b64ac8c5bc8 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -2526,7 +2526,7 @@ static int cfi_atmel_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
 struct ppb_lock {
        struct flchip *chip;
-        loff_t offset;
+        unsigned long adr;
        int locked;
 };
@@ -2544,8 +2544,9 @@ static int __maybe_unused do_ppb_xxlock(struct map_info *map,
        unsigned long timeo;
        int ret;
+        adr += chip->start;
        mutex_lock(&chip->mutex);
-        ret = get_chip(map, chip, adr + chip->start, FL_LOCKING);
+        ret = get_chip(map, chip, adr, FL_LOCKING);
        if (ret) {
                mutex_unlock(&chip->mutex);
                return ret;
@@ -2563,8 +2564,8 @@ static int __maybe_unused do_ppb_xxlock(struct map_info *map,
        if (thunk == DO_XXLOCK_ONEBLOCK_LOCK) {
                chip->state = FL_LOCKING;
-                map_write(map, CMD(0xA0), chip->start + adr);
+                map_write(map, CMD(0xA0), adr);
-                map_write(map, CMD(0x00), chip->start + adr);
+                map_write(map, CMD(0x00), adr);
        } else if (thunk == DO_XXLOCK_ONEBLOCK_UNLOCK) {
                /*
                 * Unlocking of one specific sector is not supported, so we
@@ -2602,7 +2603,7 @@ static int __maybe_unused do_ppb_xxlock(struct map_info *map,
        map_write(map, CMD(0x00), chip->start);
        chip->state = FL_READY;
-        put_chip(map, chip, adr + chip->start);
+        put_chip(map, chip, adr);
        mutex_unlock(&chip->mutex);
        return ret;
@@ -2659,9 +2660,9 @@ static int __maybe_unused cfi_ppb_unlock(struct mtd_info *mtd, loff_t ofs,
                 * sectors shall be unlocked, so lets keep their locking
                 * status at "unlocked" (locked=0) for the final re-locking.
                 */
-                if ((adr < ofs) || (adr >= (ofs + len))) {
+                if ((offset < ofs) || (offset >= (ofs + len))) {
                        sect[sectors].chip = &cfi->chips[chipnum];
-                        sect[sectors].offset = offset;
+                        sect[sectors].adr = adr;
                        sect[sectors].locked = do_ppb_xxlock(
                                map, &cfi->chips[chipnum], adr, 0,
                                DO_XXLOCK_ONEBLOCK_GETLOCK);
@@ -2675,6 +2676,8 @@ static int __maybe_unused cfi_ppb_unlock(struct mtd_info *mtd, loff_t ofs,
                        i++;
                if (adr >> cfi->chipshift) {
+                        if (offset >= (ofs + len))
+                                break;
                        adr = 0;
                        chipnum++;
@@ -2705,7 +2708,7 @@ static int __maybe_unused cfi_ppb_unlock(struct mtd_info *mtd, loff_t ofs,
         */
        for (i = 0; i < sectors; i++) {
                if (sect[i].locked)
-                        do_ppb_xxlock(map, sect[i].chip, sect[i].offset, 0,
+                        do_ppb_xxlock(map, sect[i].chip, sect[i].adr, 0,
                                      DO_XXLOCK_ONEBLOCK_LOCK);
        }
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index 3a6f450d1093..53febe8a68c3 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -733,8 +733,8 @@ static struct flash_info dataflash_data[] = {
        { "AT45DB642x",  0x1f2800, 8192, 1056, 11, SUP_POW2PS},
        { "at45db642d",  0x1f2800, 8192, 1024, 10, SUP_POW2PS | IS_POW2PS},
-        { "AT45DB641E",  0x1f28000100, 32768, 264, 9, SUP_EXTID | SUP_POW2PS},
+        { "AT45DB641E",  0x1f28000100ULL, 32768, 264, 9, SUP_EXTID | SUP_POW2PS},
-        { "at45db641e",  0x1f28000100, 32768, 256, 8, SUP_EXTID | SUP_POW2PS | IS_POW2PS},
+        { "at45db641e",  0x1f28000100ULL, 32768, 256, 8, SUP_EXTID | SUP_POW2PS | IS_POW2PS},
 };
 static struct flash_info *jedec_lookup(struct spi_device *spi,
diff --git a/drivers/mtd/nand/raw/denali_dt.c b/drivers/mtd/nand/raw/denali_dt.c
index cfd33e6ca77f..5869e90cc14b 100644
--- a/drivers/mtd/nand/raw/denali_dt.c
+++ b/drivers/mtd/nand/raw/denali_dt.c
@@ -123,7 +123,11 @@ static int denali_dt_probe(struct platform_device *pdev)
        if (ret)
                return ret;
-        denali->clk_x_rate = clk_get_rate(dt->clk);
+        /*
+         * Hardcode the clock rate for the backward compatibility.
+         * This works for both SOCFPGA and UniPhier.
+         */
+        denali->clk_x_rate = 200000000;
        ret = denali_init(denali);
        if (ret)
diff --git a/drivers/mtd/nand/raw/mxc_nand.c b/drivers/mtd/nand/raw/mxc_nand.c
index 45786e707b7b..26cef218bb43 100644
--- a/drivers/mtd/nand/raw/mxc_nand.c
+++ b/drivers/mtd/nand/raw/mxc_nand.c
@@ -48,7 +48,7 @@
 #define NFC_V1_V2_CONFIG                (host->regs + 0x0a)
 #define NFC_V1_V2_ECC_STATUS_RESULT     (host->regs + 0x0c)
 #define NFC_V1_V2_RSLTMAIN_AREA         (host->regs + 0x0e)
-#define NFC_V1_V2_RSLTSPARE_AREA        (host->regs + 0x10)
+#define NFC_V21_RSLTSPARE_AREA          (host->regs + 0x10)
 #define NFC_V1_V2_WRPROT                (host->regs + 0x12)
 #define NFC_V1_UNLOCKSTART_BLKADDR      (host->regs + 0x14)
 #define NFC_V1_UNLOCKEND_BLKADDR        (host->regs + 0x16)
@@ -1274,6 +1274,9 @@ static void preset_v2(struct mtd_info *mtd)
        writew(config1, NFC_V1_V2_CONFIG1);
        /* preset operation */
+        /* spare area size in 16-bit half-words */
+        writew(mtd->oobsize / 2, NFC_V21_RSLTSPARE_AREA);
        /* Unlock the internal RAM Buffer */
        writew(0x2, NFC_V1_V2_CONFIG);
diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
index 10c4f9919850..b01d15ec4c56 100644
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -440,7 +440,7 @@ static int nand_block_bad(struct mtd_info *mtd, loff_t ofs)
        for (; page < page_end; page++) {
                res = chip->ecc.read_oob(mtd, chip, page);
-                if (res)
+                if (res < 0)
                        return res;
                bad = chip->oob_poi[chip->badblockpos];
diff --git a/drivers/mtd/nand/raw/nand_macronix.c b/drivers/mtd/nand/raw/nand_macronix.c
index 7ed1f87e742a..49c546c97c6f 100644
--- a/drivers/mtd/nand/raw/nand_macronix.c
+++ b/drivers/mtd/nand/raw/nand_macronix.c
@@ -17,23 +17,47 @@
 #include <linux/mtd/rawnand.h>
+/*
+ * Macronix AC series does not support using SET/GET_FEATURES to change
+ * the timings unlike what is declared in the parameter page. Unflag
+ * this feature to avoid unnecessary downturns.
+ */
+static void macronix_nand_fix_broken_get_timings(struct nand_chip *chip)
+{
+        unsigned int i;
+        static const char * const broken_get_timings[] = {
+                "MX30LF1G18AC",
+                "MX30LF1G28AC",
+                "MX30LF2G18AC",
+                "MX30LF2G28AC",
+                "MX30LF4G18AC",
+                "MX30LF4G28AC",
+                "MX60LF8G18AC",
+        };
+        if (!chip->parameters.supports_set_get_features)
+                return;
+        for (i = 0; i < ARRAY_SIZE(broken_get_timings); i++) {
+                if (!strcmp(broken_get_timings[i], chip->parameters.model))
+                        break;
+        }
+        if (i == ARRAY_SIZE(broken_get_timings))
+                return;
+        bitmap_clear(chip->parameters.get_feature_list,
+                     ONFI_FEATURE_ADDR_TIMING_MODE, 1);
+        bitmap_clear(chip->parameters.set_feature_list,
+                     ONFI_FEATURE_ADDR_TIMING_MODE, 1);
+}
 static int macronix_nand_init(struct nand_chip *chip)
 {
        if (nand_is_slc(chip))
                chip->bbt_options |= NAND_BBT_SCAN2NDPAGE;
-        /*
+        macronix_nand_fix_broken_get_timings(chip);
-         * MX30LF2G18AC chip does not support using SET/GET_FEATURES to change
-         * the timings unlike what is declared in the parameter page. Unflag
-         * this feature to avoid unnecessary downturns.
-         */
-        if (chip->parameters.supports_set_get_features &&
-            !strcmp("MX30LF2G18AC", chip->parameters.model)) {
-                bitmap_clear(chip->parameters.get_feature_list,
-                             ONFI_FEATURE_ADDR_TIMING_MODE, 1);
-                bitmap_clear(chip->parameters.set_feature_list,
-                             ONFI_FEATURE_ADDR_TIMING_MODE, 1);
-        }
        return 0;
 }
diff --git a/drivers/mtd/nand/raw/nand_micron.c b/drivers/mtd/nand/raw/nand_micron.c
index 0af45b134c0c..5ec4c90a637d 100644
--- a/drivers/mtd/nand/raw/nand_micron.c
+++ b/drivers/mtd/nand/raw/nand_micron.c
@@ -66,7 +66,9 @@ static int micron_nand_onfi_init(struct nand_chip *chip)
        if (p->supports_set_get_features) {
                set_bit(ONFI_FEATURE_ADDR_READ_RETRY, p->set_feature_list);
+                set_bit(ONFI_FEATURE_ON_DIE_ECC, p->set_feature_list);
                set_bit(ONFI_FEATURE_ADDR_READ_RETRY, p->get_feature_list);
+                set_bit(ONFI_FEATURE_ON_DIE_ECC, p->get_feature_list);
        }
        return 0;
diff --git a/drivers/net/ethernet/amd/Kconfig b/drivers/net/ethernet/amd/Kconfig
index d5c15e8bb3de..f273af136fc7 100644
--- a/drivers/net/ethernet/amd/Kconfig
+++ b/drivers/net/ethernet/amd/Kconfig
@@ -173,7 +173,7 @@ config SUNLANCE
 config AMD_XGBE
        tristate "AMD 10GbE Ethernet driver"
-        depends on ((OF_NET && OF_ADDRESS) || ACPI || PCI) && HAS_IOMEM && HAS_DMA
+        depends on ((OF_NET && OF_ADDRESS) || ACPI || PCI) && HAS_IOMEM
        depends on X86 || ARM64 || COMPILE_TEST
        select BITREVERSE
        select CRC32
diff --git a/drivers/net/ethernet/apm/xgene-v2/Kconfig b/drivers/net/ethernet/apm/xgene-v2/Kconfig
index 1205861b6318..eedd3f3dd22e 100644
--- a/drivers/net/ethernet/apm/xgene-v2/Kconfig
+++ b/drivers/net/ethernet/apm/xgene-v2/Kconfig
@@ -1,6 +1,5 @@
 config NET_XGENE_V2
        tristate "APM X-Gene SoC Ethernet-v2 Driver"
-        depends on HAS_DMA
        depends on ARCH_XGENE || COMPILE_TEST
        help
          This is the Ethernet driver for the on-chip ethernet interface
diff --git a/drivers/net/ethernet/apm/xgene/Kconfig b/drivers/net/ethernet/apm/xgene/Kconfig
index afccb033177b..e4e33c900b57 100644
--- a/drivers/net/ethernet/apm/xgene/Kconfig
+++ b/drivers/net/ethernet/apm/xgene/Kconfig
@@ -1,6 +1,5 @@
 config NET_XGENE
        tristate "APM X-Gene SoC Ethernet Driver"
-        depends on HAS_DMA
        depends on ARCH_XGENE || COMPILE_TEST
        select PHYLIB
        select MDIO_XGENE
diff --git a/drivers/net/ethernet/arc/Kconfig b/drivers/net/ethernet/arc/Kconfig
index e743ddf46343..5d0ab8e74b68 100644
--- a/drivers/net/ethernet/arc/Kconfig
+++ b/drivers/net/ethernet/arc/Kconfig
@@ -24,7 +24,8 @@ config ARC_EMAC_CORE
 config ARC_EMAC
        tristate "ARC EMAC support"
        select ARC_EMAC_CORE
-        depends on OF_IRQ && OF_NET && HAS_DMA && (ARC || COMPILE_TEST)
+        depends on OF_IRQ && OF_NET
+        depends on ARC || COMPILE_TEST
        ---help---
          On some legacy ARC (Synopsys) FPGA boards such as ARCAngel4/ML50x
          non-standard on-chip ethernet device ARC EMAC 10/100 is used.
@@ -33,7 +34,8 @@ config ARC_EMAC
 config EMAC_ROCKCHIP
        tristate "Rockchip EMAC support"
        select ARC_EMAC_CORE
-        depends on OF_IRQ && OF_NET && REGULATOR && HAS_DMA && (ARCH_ROCKCHIP || COMPILE_TEST)
+        depends on OF_IRQ && OF_NET && REGULATOR
+        depends on ARCH_ROCKCHIP || COMPILE_TEST
        ---help---
          Support for Rockchip RK3036/RK3066/RK3188 EMAC ethernet controllers.
          This selects Rockchip SoC glue layer support for the
diff --git a/drivers/net/ethernet/broadcom/Kconfig b/drivers/net/ethernet/broadcom/Kconfig
index af75156919ed..4c3bfde6e8de 100644
--- a/drivers/net/ethernet/broadcom/Kconfig
+++ b/drivers/net/ethernet/broadcom/Kconfig
@@ -157,7 +157,6 @@ config BGMAC
 config BGMAC_BCMA
        tristate "Broadcom iProc GBit BCMA support"
        depends on BCMA && BCMA_HOST_SOC
-        depends on HAS_DMA
        depends on BCM47XX || ARCH_BCM_5301X || COMPILE_TEST
        select BGMAC
        select PHYLIB
@@ -170,7 +169,6 @@ config BGMAC_BCMA
 config BGMAC_PLATFORM
        tristate "Broadcom iProc GBit platform support"
-        depends on HAS_DMA
        depends on ARCH_BCM_IPROC || COMPILE_TEST
        depends on OF
        select BGMAC
diff --git a/drivers/net/ethernet/cadence/macb_ptp.c b/drivers/net/ethernet/cadence/macb_ptp.c
index 2220c771092b..678835136bf8 100644
--- a/drivers/net/ethernet/cadence/macb_ptp.c
+++ b/drivers/net/ethernet/cadence/macb_ptp.c
@@ -170,10 +170,7 @@ static int gem_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
        if (delta > TSU_NSEC_MAX_VAL) {
                gem_tsu_get_time(&bp->ptp_clock_info, &now);
-                if (sign)
+                now = timespec64_add(now, then);
-                        now = timespec64_sub(now, then);
-                else
-                        now = timespec64_add(now, then);
                gem_tsu_set_time(&bp->ptp_clock_info,
                                 (const struct timespec64 *)&now);
diff --git a/drivers/net/ethernet/calxeda/Kconfig b/drivers/net/ethernet/calxeda/Kconfig
index 07d2201530d2..9fdd496b90ff 100644
--- a/drivers/net/ethernet/calxeda/Kconfig
+++ b/drivers/net/ethernet/calxeda/Kconfig
@@ -1,6 +1,6 @@
 config NET_CALXEDA_XGMAC
        tristate "Calxeda 1G/10G XGMAC Ethernet driver"
-        depends on HAS_IOMEM && HAS_DMA
+        depends on HAS_IOMEM
        depends on ARCH_HIGHBANK || COMPILE_TEST
        select CRC32
        help
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index dd04a2f89ce6..bc03c175a3cd 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -263,7 +263,7 @@ static void dcb_tx_queue_prio_enable(struct net_device *dev, int enable)
                                "Can't %s DCB Priority on port %d, TX Queue %d: err=%d\n",
                                enable ? "set" : "unset", pi->port_id, i, -err);
                else
-                        txq->dcb_prio = value;
+                        txq->dcb_prio = enable ? value : 0;
        }
 }
diff --git a/drivers/net/ethernet/cisco/enic/enic_clsf.c b/drivers/net/ethernet/cisco/enic/enic_clsf.c
index 973c1fb70d09..99038dfc7fbe 100644
--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c
+++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c
@@ -79,7 +79,6 @@ void enic_rfs_flw_tbl_init(struct enic *enic)
        enic->rfs_h.max = enic->config.num_arfs;
        enic->rfs_h.free = enic->rfs_h.max;
        enic->rfs_h.toclean = 0;
-        enic_rfs_timer_start(enic);
 }
 void enic_rfs_flw_tbl_free(struct enic *enic)
@@ -88,7 +87,6 @@ void enic_rfs_flw_tbl_free(struct enic *enic)
        enic_rfs_timer_stop(enic);
        spin_lock_bh(&enic->rfs_h.lock);
-        enic->rfs_h.free = 0;
        for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) {
                struct hlist_head *hhead;
                struct hlist_node *tmp;
@@ -99,6 +97,7 @@ void enic_rfs_flw_tbl_free(struct enic *enic)
                        enic_delfltr(enic, n->fltr_id);
                        hlist_del(&n->node);
                        kfree(n);
+                        enic->rfs_h.free++;
                }
        }
        spin_unlock_bh(&enic->rfs_h.lock);
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 30d2eaa18c04..90c645b8538e 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1920,7 +1920,7 @@ static int enic_open(struct net_device *netdev)
 {
        struct enic *enic = netdev_priv(netdev);
        unsigned int i;
-        int err;
+        int err, ret;
        err = enic_request_intr(enic);
        if (err) {
@@ -1971,16 +1971,15 @@ static int enic_open(struct net_device *netdev)
                vnic_intr_unmask(&enic->intr[i]);
        enic_notify_timer_start(enic);
-        enic_rfs_flw_tbl_init(enic);
+        enic_rfs_timer_start(enic);
        return 0;
 err_out_free_rq:
        for (i = 0; i < enic->rq_count; i++) {
-                err = vnic_rq_disable(&enic->rq[i]);
+                ret = vnic_rq_disable(&enic->rq[i]);
-                if (err)
+                if (!ret)
-                        return err;
+                        vnic_rq_clean(&enic->rq[i], enic_free_rq_buf);
-                vnic_rq_clean(&enic->rq[i], enic_free_rq_buf);
        }
        enic_dev_notify_unset(enic);
 err_out_free_intr:
@@ -2904,6 +2903,7 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        timer_setup(&enic->notify_timer, enic_notify_timer, 0);
+        enic_rfs_flw_tbl_init(enic);
        enic_set_rx_coal_setting(enic);
        INIT_WORK(&enic->reset, enic_reset);
        INIT_WORK(&enic->tx_hang_reset, enic_tx_hang_reset);
diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
index 78db8e62a83f..ed6c76d20b45 100644
--- a/drivers/net/ethernet/faraday/ftgmac100.c
+++ b/drivers/net/ethernet/faraday/ftgmac100.c
@@ -1735,8 +1735,8 @@ static void ftgmac100_ncsi_handler(struct ncsi_dev *nd)
        if (unlikely(nd->state != ncsi_dev_state_functional))
                return;
-        netdev_info(nd->dev, "NCSI interface %s\n",
+        netdev_dbg(nd->dev, "NCSI interface %s\n",
-                    nd->link_up ? "up" : "down");
+                   nd->link_up ? "up" : "down");
 }
 static void ftgmac100_setup_clk(struct ftgmac100 *priv)
diff --git a/drivers/net/ethernet/hisilicon/Kconfig b/drivers/net/ethernet/hisilicon/Kconfig
index 8bcf470ff5f3..fb1a7251f45d 100644
--- a/drivers/net/ethernet/hisilicon/Kconfig
+++ b/drivers/net/ethernet/hisilicon/Kconfig
@@ -5,7 +5,7 @@
 config NET_VENDOR_HISILICON
        bool "Hisilicon devices"
        default y
-        depends on (OF || ACPI) && HAS_DMA
+        depends on OF || ACPI
        depends on ARM || ARM64 || COMPILE_TEST
        ---help---
          If you have a network (Ethernet) card belonging to this class, say Y.
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 8ffb7454e67c..ed6dbcfd4e96 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -2103,9 +2103,8 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
        unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
 #else
        unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
-                                SKB_DATA_ALIGN(I40E_SKB_PAD +
+                                SKB_DATA_ALIGN(xdp->data_end -
-                                               (xdp->data_end -
+                                               xdp->data_hard_start);
-                                                xdp->data_hard_start));
 #endif
        struct sk_buff *skb;
@@ -2124,7 +2123,7 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
                return NULL;
        /* update pointers within the skb to store the data */
-        skb_reserve(skb, I40E_SKB_PAD + (xdp->data - xdp->data_hard_start));
+        skb_reserve(skb, xdp->data - xdp->data_hard_start);
        __skb_put(skb, xdp->data_end - xdp->data);
        if (metasize)
                skb_metadata_set(skb, metasize);
diff --git a/drivers/net/ethernet/marvell/Kconfig b/drivers/net/ethernet/marvell/Kconfig
index cc2f7701e71e..f33fd22b351c 100644
--- a/drivers/net/ethernet/marvell/Kconfig
+++ b/drivers/net/ethernet/marvell/Kconfig
@@ -18,8 +18,8 @@ if NET_VENDOR_MARVELL
 config MV643XX_ETH
        tristate "Marvell Discovery (643XX) and Orion ethernet support"
-        depends on (MV64X60 || PPC32 || PLAT_ORION || COMPILE_TEST) && INET
+        depends on MV64X60 || PPC32 || PLAT_ORION || COMPILE_TEST
-        depends on HAS_DMA
+        depends on INET
        select PHYLIB
        select MVMDIO
        ---help---
@@ -58,7 +58,6 @@ config MVNETA_BM_ENABLE
 config MVNETA
        tristate "Marvell Armada 370/38x/XP/37xx network interface support"
        depends on ARCH_MVEBU || COMPILE_TEST
-        depends on HAS_DMA
        select MVMDIO
        select PHYLINK
        ---help---
@@ -84,7 +83,6 @@ config MVNETA_BM
 config MVPP2
        tristate "Marvell Armada 375/7K/8K network interface support"
        depends on ARCH_MVEBU || COMPILE_TEST
-        depends on HAS_DMA
        select MVMDIO
        select PHYLINK
        ---help---
@@ -93,7 +91,7 @@ config MVPP2
 config PXA168_ETH
        tristate "Marvell pxa168 ethernet support"
-        depends on HAS_IOMEM && HAS_DMA
+        depends on HAS_IOMEM
        depends on CPU_PXA168 || ARCH_BERLIN || COMPILE_TEST
        select PHYLIB
        ---help---
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 17a904cc6a5e..0ad2f3f7da85 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1932,7 +1932,7 @@ static int mvneta_rx_swbm(struct mvneta_port *pp, int rx_todo,
                rx_bytes = rx_desc->data_size - (ETH_FCS_LEN + MVNETA_MH_SIZE);
                index = rx_desc - rxq->descs;
                data = rxq->buf_virt_addr[index];
-                phys_addr = rx_desc->buf_phys_addr;
+                phys_addr = rx_desc->buf_phys_addr - pp->rx_offset_correction;
                if (!mvneta_rxq_desc_is_first_last(rx_status) ||
                    (rx_status & MVNETA_RXD_ERR_SUMMARY)) {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/Kconfig b/drivers/net/ethernet/mellanox/mlxsw/Kconfig
index f4d9c9975ac3..82827a8d3d67 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlxsw/Kconfig
@@ -30,7 +30,7 @@ config MLXSW_CORE_THERMAL
 config MLXSW_PCI
        tristate "PCI bus implementation for Mellanox Technologies Switch ASICs"
-        depends on PCI && HAS_DMA && HAS_IOMEM && MLXSW_CORE
+        depends on PCI && HAS_IOMEM && MLXSW_CORE
        default m
        ---help---
          This is PCI bus implementation for Mellanox Technologies Switch ASICs.
diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index fb2c8f8071e6..776a8a9be8e3 100644
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -344,10 +344,9 @@ static int ocelot_port_stop(struct net_device *dev)
 static int ocelot_gen_ifh(u32 *ifh, struct frame_info *info)
 {
        ifh[0] = IFH_INJ_BYPASS;
-        ifh[1] = (0xff00 & info->port) >> 8;
+        ifh[1] = (0xf00 & info->port) >> 8;
        ifh[2] = (0xff & info->port) << 24;
-        ifh[3] = IFH_INJ_POP_CNT_DISABLE | (info->cpuq << 20) |
+        ifh[3] = (info->tag_type << 16) | info->vid;
-                 (info->tag_type << 16) | info->vid;
        return 0;
 }
@@ -370,11 +369,13 @@ static int ocelot_port_xmit(struct sk_buff *skb, struct net_device *dev)
                         QS_INJ_CTRL_SOF, QS_INJ_CTRL, grp);
        info.port = BIT(port->chip_port);
-        info.cpuq = 0xff;
+        info.tag_type = IFH_TAG_TYPE_C;
+        info.vid = skb_vlan_tag_get(skb);
        ocelot_gen_ifh(ifh, &info);
        for (i = 0; i < IFH_LEN; i++)
-                ocelot_write_rix(ocelot, ifh[i], QS_INJ_WR, grp);
+                ocelot_write_rix(ocelot, (__force u32)cpu_to_be32(ifh[i]),
+                                 QS_INJ_WR, grp);
        count = (skb->len + 3) / 4;
        last = skb->len % 4;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index 8f31406ec894..f0b01385d5cb 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -255,9 +255,8 @@ qed_dcbx_get_app_protocol_type(struct qed_hwfn *p_hwfn,
                *type = DCBX_PROTOCOL_ROCE_V2;
        } else {
                *type = DCBX_MAX_PROTOCOL_TYPE;
-                DP_ERR(p_hwfn,
+                DP_ERR(p_hwfn, "No action required, App TLV entry = 0x%x\n",
-                       "No action required, App TLV id = 0x%x app_prio_bitmap = 0x%x\n",
+                       app_prio_bitmap);
-                       id, app_prio_bitmap);
                return false;
        }
@@ -1479,8 +1478,8 @@ static u8 qed_dcbnl_getcap(struct qed_dev *cdev, int capid, u8 *cap)
                *cap = 0x80;
                break;
        case DCB_CAP_ATTR_DCBX:
-                *cap = (DCB_CAP_DCBX_LLD_MANAGED | DCB_CAP_DCBX_VER_CEE |
+                *cap = (DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_VER_IEEE |
-                        DCB_CAP_DCBX_VER_IEEE | DCB_CAP_DCBX_STATIC);
+                        DCB_CAP_DCBX_STATIC);
                break;
        default:
                *cap = false;
@@ -1548,8 +1547,6 @@ static u8 qed_dcbnl_getdcbx(struct qed_dev *cdev)
        if (!dcbx_info)
                return 0;
-        if (dcbx_info->operational.enabled)
-                mode |= DCB_CAP_DCBX_LLD_MANAGED;
        if (dcbx_info->operational.ieee)
                mode |= DCB_CAP_DCBX_VER_IEEE;
        if (dcbx_info->operational.cee)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index c97ebd681c47..012973d75ad0 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -201,8 +201,9 @@ void qed_ll2b_complete_rx_packet(void *cxt, struct qed_ll2_comp_rx_data *data)
        skb = build_skb(buffer->data, 0);
        if (!skb) {
-                rc = -ENOMEM;
+                DP_INFO(cdev, "Failed to build SKB\n");
-                goto out_post;
+                kfree(buffer->data);
+                goto out_post1;
        }
        data->u.placement_offset += NET_SKB_PAD;
@@ -224,8 +225,14 @@ void qed_ll2b_complete_rx_packet(void *cxt, struct qed_ll2_comp_rx_data *data)
                cdev->ll2->cbs->rx_cb(cdev->ll2->cb_cookie, skb,
                                      data->opaque_data_0,
                                      data->opaque_data_1);
+        } else {
+                DP_VERBOSE(p_hwfn, (NETIF_MSG_RX_STATUS | NETIF_MSG_PKTDATA |
+                                    QED_MSG_LL2 | QED_MSG_STORAGE),
+                           "Dropping the packet\n");
+                kfree(buffer->data);
        }
+out_post1:
        /* Update Buffer information and update FW producer */
        buffer->data = new_data;
        buffer->phys_addr = new_phys_addr;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index b04d57ca5176..5c10fd7210c3 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -567,8 +567,16 @@ static irqreturn_t qed_single_int(int irq, void *dev_instance)
                /* Fastpath interrupts */
                for (j = 0; j < 64; j++) {
                        if ((0x2ULL << j) & status) {
-                                hwfn->simd_proto_handler[j].func(
+                                struct qed_simd_fp_handler *p_handler =
-                                        hwfn->simd_proto_handler[j].token);
+                                        &hwfn->simd_proto_handler[j];
+                                if (p_handler->func)
+                                        p_handler->func(p_handler->token);
+                                else
+                                        DP_NOTICE(hwfn,
+                                                  "Not calling fastpath handler as it is NULL [handler #%d, status 0x%llx]\n",
+                                                  j, status);
                                status &= ~(0x2ULL << j);
                                rc = IRQ_HANDLED;
                        }
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 75dfac0248f4..f4cae2be0fda 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -7148,7 +7148,7 @@ static void rtl8169_netpoll(struct net_device *dev)
 {
        struct rtl8169_private *tp = netdev_priv(dev);
-        rtl8169_interrupt(pci_irq_vector(tp->pci_dev, 0), dev);
+        rtl8169_interrupt(pci_irq_vector(tp->pci_dev, 0), tp);
 }
 #endif
diff --git a/drivers/net/ethernet/renesas/Kconfig b/drivers/net/ethernet/renesas/Kconfig
index 27be51f0a421..f3f7477043ce 100644
--- a/drivers/net/ethernet/renesas/Kconfig
+++ b/drivers/net/ethernet/renesas/Kconfig
@@ -17,7 +17,6 @@ if NET_VENDOR_RENESAS
 config SH_ETH
        tristate "Renesas SuperH Ethernet support"
-        depends on HAS_DMA
        depends on ARCH_RENESAS || SUPERH || COMPILE_TEST
        select CRC32
        select MII
@@ -31,7 +30,6 @@ config SH_ETH
 config RAVB
        tristate "Renesas Ethernet AVB support"
-        depends on HAS_DMA
        depends on ARCH_RENESAS || COMPILE_TEST
        select CRC32
        select MII
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index ad4a354ce570..570ec72266f3 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -3180,6 +3180,7 @@ bool efx_rps_check_rule(struct efx_arfs_rule *rule, unsigned int filter_idx,
        return true;
 }
+static
 struct hlist_head *efx_rps_hash_bucket(struct efx_nic *efx,
                                       const struct efx_filter_spec *spec)
 {
diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index cb5b0f58c395..edf20361ea5f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -111,7 +111,7 @@ config DWMAC_ROCKCHIP
 config DWMAC_SOCFPGA
        tristate "SOCFPGA dwmac support"
        default ARCH_SOCFPGA
-        depends on OF && (ARCH_SOCFPGA || COMPILE_TEST)
+        depends on OF && (ARCH_SOCFPGA || ARCH_STRATIX10 || COMPILE_TEST)
        select MFD_SYSCON
        help
          Support for ethernet controller on Altera SOCFPGA
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
index 6e359572b9f0..5b3b06a0a3bf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
@@ -55,6 +55,7 @@ struct socfpga_dwmac {
        struct  device *dev;
        struct regmap *sys_mgr_base_addr;
        struct reset_control *stmmac_rst;
+        struct reset_control *stmmac_ocp_rst;
        void __iomem *splitter_base;
        bool f2h_ptp_ref_clk;
        struct tse_pcs pcs;
@@ -262,8 +263,8 @@ static int socfpga_dwmac_set_phy_mode(struct socfpga_dwmac *dwmac)
                val = SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII;
        /* Assert reset to the enet controller before changing the phy mode */
-        if (dwmac->stmmac_rst)
+        reset_control_assert(dwmac->stmmac_ocp_rst);
-                reset_control_assert(dwmac->stmmac_rst);
+        reset_control_assert(dwmac->stmmac_rst);
        regmap_read(sys_mgr_base_addr, reg_offset, &ctrl);
        ctrl &= ~(SYSMGR_EMACGRP_CTRL_PHYSEL_MASK << reg_shift);
@@ -288,8 +289,8 @@ static int socfpga_dwmac_set_phy_mode(struct socfpga_dwmac *dwmac)
        /* Deassert reset for the phy configuration to be sampled by
         * the enet controller, and operation to start in requested mode
         */
-        if (dwmac->stmmac_rst)
+        reset_control_deassert(dwmac->stmmac_ocp_rst);
-                reset_control_deassert(dwmac->stmmac_rst);
+        reset_control_deassert(dwmac->stmmac_rst);
        if (phymode == PHY_INTERFACE_MODE_SGMII) {
                if (tse_pcs_init(dwmac->pcs.tse_pcs_base, &dwmac->pcs) != 0) {
                        dev_err(dwmac->dev, "Unable to initialize TSE PCS");
@@ -324,6 +325,15 @@ static int socfpga_dwmac_probe(struct platform_device *pdev)
                goto err_remove_config_dt;
        }
+        dwmac->stmmac_ocp_rst = devm_reset_control_get_optional(dev, "stmmaceth-ocp");
+        if (IS_ERR(dwmac->stmmac_ocp_rst)) {
+                ret = PTR_ERR(dwmac->stmmac_ocp_rst);
+                dev_err(dev, "error getting reset control of ocp %d\n", ret);
+                goto err_remove_config_dt;
+        }
+        reset_control_deassert(dwmac->stmmac_ocp_rst);
        ret = socfpga_dwmac_parse_data(dwmac, dev);
        if (ret) {
                dev_err(dev, "Unable to parse OF data\n");
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index e79b0d7b388a..cba46b62a1cd 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -928,6 +928,7 @@ static void stmmac_check_pcs_mode(struct stmmac_priv *priv)
 static int stmmac_init_phy(struct net_device *dev)
 {
        struct stmmac_priv *priv = netdev_priv(dev);
+        u32 tx_cnt = priv->plat->tx_queues_to_use;
        struct phy_device *phydev;
        char phy_id_fmt[MII_BUS_ID_SIZE + 3];
        char bus_id[MII_BUS_ID_SIZE];
@@ -969,6 +970,15 @@ static int stmmac_init_phy(struct net_device *dev)
                                         SUPPORTED_1000baseT_Full);
        /*
+         * Half-duplex mode not supported with multiqueue
+         * half-duplex can only works with single queue
+         */
+        if (tx_cnt > 1)
+                phydev->supported &= ~(SUPPORTED_1000baseT_Half |
+                                       SUPPORTED_100baseT_Half |
+                                       SUPPORTED_10baseT_Half);
+        /*
         * Broken HW is sometimes missing the pull-up resistor on the
         * MDIO line, which results in reads to non-existent devices returning
         * 0 rather than 0xffff. Catch this here and treat 0 as a non-existent
diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c
index 7a16d40a72d1..b9221fc1674d 100644
--- a/drivers/net/ethernet/sun/sungem.c
+++ b/drivers/net/ethernet/sun/sungem.c
@@ -60,8 +60,7 @@
 #include <linux/sungem_phy.h>
 #include "sungem.h"
-/* Stripping FCS is causing problems, disabled for now */
+#define STRIP_FCS
-#undef STRIP_FCS
 #define DEFAULT_MSG     (NETIF_MSG_DRV          | \
                         NETIF_MSG_PROBE        | \
@@ -435,7 +434,7 @@ static int gem_rxmac_reset(struct gem *gp)
        writel(desc_dma & 0xffffffff, gp->regs + RXDMA_DBLOW);
        writel(RX_RING_SIZE - 4, gp->regs + RXDMA_KICK);
        val = (RXDMA_CFG_BASE | (RX_OFFSET << 10) |
-               ((14 / 2) << 13) | RXDMA_CFG_FTHRESH_128);
+               (ETH_HLEN << 13) | RXDMA_CFG_FTHRESH_128);
        writel(val, gp->regs + RXDMA_CFG);
        if (readl(gp->regs + GREG_BIFCFG) & GREG_BIFCFG_M66EN)
                writel(((5 & RXDMA_BLANK_IPKTS) |
@@ -760,7 +759,6 @@ static int gem_rx(struct gem *gp, int work_to_do)
        struct net_device *dev = gp->dev;
        int entry, drops, work_done = 0;
        u32 done;
-        __sum16 csum;
        if (netif_msg_rx_status(gp))
                printk(KERN_DEBUG "%s: rx interrupt, done: %d, rx_new: %d\n",
@@ -855,9 +853,13 @@ static int gem_rx(struct gem *gp, int work_to_do)
                        skb = copy_skb;
                }
-                csum = (__force __sum16)htons((status & RXDCTRL_TCPCSUM) ^ 0xffff);
+                if (likely(dev->features & NETIF_F_RXCSUM)) {
-                skb->csum = csum_unfold(csum);
+                        __sum16 csum;
-                skb->ip_summed = CHECKSUM_COMPLETE;
+                        csum = (__force __sum16)htons((status & RXDCTRL_TCPCSUM) ^ 0xffff);
+                        skb->csum = csum_unfold(csum);
+                        skb->ip_summed = CHECKSUM_COMPLETE;
+                }
                skb->protocol = eth_type_trans(skb, gp->dev);
                napi_gro_receive(&gp->napi, skb);
@@ -1761,7 +1763,7 @@ static void gem_init_dma(struct gem *gp)
        writel(0, gp->regs + TXDMA_KICK);
        val = (RXDMA_CFG_BASE | (RX_OFFSET << 10) |
-               ((14 / 2) << 13) | RXDMA_CFG_FTHRESH_128);
+               (ETH_HLEN << 13) | RXDMA_CFG_FTHRESH_128);
        writel(val, gp->regs + RXDMA_CFG);
        writel(desc_dma >> 32, gp->regs + RXDMA_DBHI);
@@ -2985,8 +2987,8 @@ static int gem_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        pci_set_drvdata(pdev, dev);
        /* We can do scatter/gather and HW checksum */
-        dev->hw_features = NETIF_F_SG | NETIF_F_HW_CSUM;
+        dev->hw_features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_RXCSUM;
-        dev->features |= dev->hw_features | NETIF_F_RXCSUM;
+        dev->features = dev->hw_features;
        if (pci_using_dac)
                dev->features |= NETIF_F_HIGHDMA;
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index cdbddf16dd29..4f1267477aa4 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -205,7 +205,7 @@ static void cpdma_desc_pool_destroy(struct cpdma_ctlr *ctlr)
 * devices (e.g. cpsw switches) use plain old memory.  Descriptor pools
 * abstract out these details
 */
-int cpdma_desc_pool_create(struct cpdma_ctlr *ctlr)
+static int cpdma_desc_pool_create(struct cpdma_ctlr *ctlr)
 {
        struct cpdma_params *cpdma_params = &ctlr->params;
        struct cpdma_desc_pool *pool;
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 06d7c9e4dcda..f270beebb428 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1385,6 +1385,15 @@ static int emac_devioctl(struct net_device *ndev, struct ifreq *ifrq, int cmd)
                return -EOPNOTSUPP;
 }
+static int match_first_device(struct device *dev, void *data)
+{
+        if (dev->parent && dev->parent->of_node)
+                return of_device_is_compatible(dev->parent->of_node,
+                                               "ti,davinci_mdio");
+        return !strncmp(dev_name(dev), "davinci_mdio", 12);
+}
 /**
 * emac_dev_open - EMAC device open
 * @ndev: The DaVinci EMAC network adapter
@@ -1484,8 +1493,14 @@ static int emac_dev_open(struct net_device *ndev)
        /* use the first phy on the bus if pdata did not give us a phy id */
        if (!phydev && !priv->phy_id) {
-                phy = bus_find_device_by_name(&mdio_bus_type, NULL,
+                /* NOTE: we can't use bus_find_device_by_name() here because
-                                              "davinci_mdio");
+                 * the device name is not guaranteed to be 'davinci_mdio'. On
+                 * some systems it can be 'davinci_mdio.0' so we need to use
+                 * strncmp() against the first part of the string to correctly
+                 * match it.
+                 */
+                phy = bus_find_device(&mdio_bus_type, NULL, NULL,
+                                      match_first_device);
                if (phy) {
                        priv->phy_id = dev_name(phy);
                        if (!priv->phy_id || !*priv->phy_id)
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index f347fd9c5b28..777fa59f5e0c 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -89,10 +89,6 @@
 static const char banner[] __initconst = KERN_INFO \
        "AX.25: bpqether driver version 004\n";
-static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
-static char bpq_eth_addr[6];
 static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
 static int bpq_device_event(struct notifier_block *, unsigned long, void *);
@@ -501,8 +497,8 @@ static int bpq_new_device(struct net_device *edev)
        bpq->ethdev = edev;
        bpq->axdev = ndev;
-        memcpy(bpq->dest_addr, bcast_addr, sizeof(bpq_eth_addr));
+        eth_broadcast_addr(bpq->dest_addr);
-        memcpy(bpq->acpt_addr, bcast_addr, sizeof(bpq_eth_addr));
+        eth_broadcast_addr(bpq->acpt_addr);
        err = register_netdevice(ndev);
        if (err)
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 4377c26f714d..23c1d6600241 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -594,7 +594,8 @@ int ipvlan_link_new(struct net *src_net, struct net_device *dev,
        ipvlan->phy_dev = phy_dev;
        ipvlan->dev = dev;
        ipvlan->sfeatures = IPVLAN_FEATURES;
-        ipvlan_adjust_mtu(ipvlan, phy_dev);
+        if (!tb[IFLA_MTU])
+                ipvlan_adjust_mtu(ipvlan, phy_dev);
        INIT_LIST_HEAD(&ipvlan->addrs);
        spin_lock_init(&ipvlan->addrs_lock);
@@ -693,6 +694,7 @@ void ipvlan_link_setup(struct net_device *dev)
 {
        ether_setup(dev);
+        dev->max_mtu = ETH_MAX_MTU;
        dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
        dev->priv_flags |= IFF_UNICAST_FLT | IFF_NO_QUEUE;
        dev->netdev_ops = &ipvlan_netdev_ops;
diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c
index 83f7420ddea5..4f390fa557e4 100644
--- a/drivers/net/net_failover.c
+++ b/drivers/net/net_failover.c
@@ -527,7 +527,7 @@ static int net_failover_slave_register(struct net_device *slave_dev,
        netif_addr_lock_bh(failover_dev);
        dev_uc_sync_multiple(slave_dev, failover_dev);
-        dev_uc_sync_multiple(slave_dev, failover_dev);
+        dev_mc_sync_multiple(slave_dev, failover_dev);
        netif_addr_unlock_bh(failover_dev);
        err = vlan_vids_add_by_dev(slave_dev, failover_dev);
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index de51e8f70f44..ce61231e96ea 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -1107,7 +1107,7 @@ static const struct proto_ops pppoe_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = pppoe_getname,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
        .setsockopt     = sock_no_setsockopt,
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index b0e8b9613054..1eaec648bd1f 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -967,8 +967,7 @@ void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf)
        atomic_set(&ctx->stop, 1);
-        if (hrtimer_active(&ctx->tx_timer))
+        hrtimer_cancel(&ctx->tx_timer);
-                hrtimer_cancel(&ctx->tx_timer);
        tasklet_kill(&ctx->bh);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 8e8b51f171f4..8fac8e132c5b 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1246,6 +1246,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x413c, 0x81b3, 8)},    /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
        {QMI_FIXED_INTF(0x413c, 0x81b6, 8)},    /* Dell Wireless 5811e */
        {QMI_FIXED_INTF(0x413c, 0x81b6, 10)},   /* Dell Wireless 5811e */
+        {QMI_FIXED_INTF(0x413c, 0x81d7, 1)},    /* Dell Wireless 5821e */
        {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},    /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
        {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)},    /* HP lt4120 Snapdragon X5 LTE */
        {QMI_FIXED_INTF(0x22de, 0x9061, 3)},    /* WeTelecom WPD-600N */
diff --git a/drivers/net/wireless/broadcom/brcm80211/Kconfig b/drivers/net/wireless/broadcom/brcm80211/Kconfig
index 9d99eb42d917..6acba67bca07 100644
--- a/drivers/net/wireless/broadcom/brcm80211/Kconfig
+++ b/drivers/net/wireless/broadcom/brcm80211/Kconfig
@@ -60,7 +60,6 @@ config BRCMFMAC_PCIE
        bool "PCIE bus interface support for FullMAC driver"
        depends on BRCMFMAC
        depends on PCI
-        depends on HAS_DMA
        select BRCMFMAC_PROTO_MSGBUF
        select FW_LOADER
        ---help---
diff --git a/drivers/net/wireless/quantenna/qtnfmac/Kconfig b/drivers/net/wireless/quantenna/qtnfmac/Kconfig
index 025fa6018550..8d1492a90bd1 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/Kconfig
+++ b/drivers/net/wireless/quantenna/qtnfmac/Kconfig
@@ -7,7 +7,7 @@ config QTNFMAC
 config QTNFMAC_PEARL_PCIE
        tristate "Quantenna QSR10g PCIe support"
        default n
-        depends on HAS_DMA && PCI && CFG80211
+        depends on PCI && CFG80211
        select QTNFMAC
        select FW_LOADER
        select CRC32
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 922ce0abf5cf..a57daecf1d57 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1810,7 +1810,7 @@ static int talk_to_netback(struct xenbus_device *dev,
        err = xen_net_read_mac(dev, info->netdev->dev_addr);
        if (err) {
                xenbus_dev_fatal(dev, err, "parsing %s/mac", dev->nodename);
-                goto out;
+                goto out_unlocked;
        }
        rtnl_lock();
@@ -1925,6 +1925,7 @@ abort_transaction_no_dev_fatal:
        xennet_destroy_queues(info);
 out:
        rtnl_unlock();
+out_unlocked:
        device_unregister(&dev->dev);
        return err;
 }
@@ -1950,10 +1951,6 @@ static int xennet_connect(struct net_device *dev)
        /* talk_to_netback() sets the correct number of queues */
        num_queues = dev->real_num_tx_queues;
-        rtnl_lock();
-        netdev_update_features(dev);
-        rtnl_unlock();
        if (dev->reg_state == NETREG_UNINITIALIZED) {
                err = register_netdev(dev);
                if (err) {
@@ -1963,6 +1960,10 @@ static int xennet_connect(struct net_device *dev)
                }
        }
+        rtnl_lock();
+        netdev_update_features(dev);
+        rtnl_unlock();
        /*
         * All public and private state should now be sane.  Get
         * ready to start sending and receiving packets and give the driver
diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c
index d5553c47014f..5d823e965883 100644
--- a/drivers/nfc/pn533/usb.c
+++ b/drivers/nfc/pn533/usb.c
@@ -74,7 +74,7 @@ static void pn533_recv_response(struct urb *urb)
        struct sk_buff *skb = NULL;
        if (!urb->status) {
-                skb = alloc_skb(urb->actual_length, GFP_KERNEL);
+                skb = alloc_skb(urb->actual_length, GFP_ATOMIC);
                if (!skb) {
                        nfc_err(&phy->udev->dev, "failed to alloc memory\n");
                } else {
@@ -186,7 +186,7 @@ static int pn533_usb_send_frame(struct pn533 *dev,
        if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
                /* request for response for sent packet directly */
-                rc = pn533_submit_urb_for_response(phy, GFP_ATOMIC);
+                rc = pn533_submit_urb_for_response(phy, GFP_KERNEL);
                if (rc)
                        goto error;
        } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 68940356cad3..8b1fd7f1a224 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -414,7 +414,8 @@ static int pmem_attach_disk(struct device *dev,
        blk_queue_logical_block_size(q, pmem_sector_size(ndns));
        blk_queue_max_hw_sectors(q, UINT_MAX);
        blk_queue_flag_set(QUEUE_FLAG_NONROT, q);
-        blk_queue_flag_set(QUEUE_FLAG_DAX, q);
+        if (pmem->pfn_flags & PFN_MAP)
+                blk_queue_flag_set(QUEUE_FLAG_DAX, q);
        q->queuedata = pmem;
        disk = alloc_disk_node(0, nid);
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 21710a7460c8..46df030b2c3f 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1808,6 +1808,7 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,
                u32 max_segments =
                        (ctrl->max_hw_sectors / (ctrl->page_size >> 9)) + 1;
+                max_segments = min_not_zero(max_segments, ctrl->max_segments);
                blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors);
                blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX));
        }
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index b528a2f5826c..41d45a1b5c62 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2790,6 +2790,9 @@ nvme_fc_delete_association(struct nvme_fc_ctrl *ctrl)
        /* re-enable the admin_q so anything new can fast fail */
        blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
+        /* resume the io queues so that things will fast fail */
+        nvme_start_queues(&ctrl->ctrl);
        nvme_fc_ctlr_inactive_on_rport(ctrl);
 }
@@ -2804,9 +2807,6 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nctrl)
         * waiting for io to terminate
         */
        nvme_fc_delete_association(ctrl);
-        /* resume the io queues so that things will fast fail */
-        nvme_start_queues(nctrl);
 }
 static void
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 231807cbc849..0c4a33df3b2f 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -170,6 +170,7 @@ struct nvme_ctrl {
        u64 cap;
        u32 page_size;
        u32 max_hw_sectors;
+        u32 max_segments;
        u16 oncs;
        u16 oacs;
        u16 nssa;
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index fc33804662e7..ba943f211687 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -38,6 +38,13 @@
 #define SGES_PER_PAGE   (PAGE_SIZE / sizeof(struct nvme_sgl_desc))
+/*
+ * These can be higher, but we need to ensure that any command doesn't
+ * require an sg allocation that needs more than a page of data.
+ */
+#define NVME_MAX_KB_SZ  4096
+#define NVME_MAX_SEGS   127
 static int use_threaded_interrupts;
 module_param(use_threaded_interrupts, int, 0);
@@ -100,6 +107,8 @@ struct nvme_dev {
        struct nvme_ctrl ctrl;
        struct completion ioq_wait;
+        mempool_t *iod_mempool;
        /* shadow doorbell buffer support: */
        u32 *dbbuf_dbs;
        dma_addr_t dbbuf_dbs_dma_addr;
@@ -477,10 +486,7 @@ static blk_status_t nvme_init_iod(struct request *rq, struct nvme_dev *dev)
        iod->use_sgl = nvme_pci_use_sgls(dev, rq);
        if (nseg > NVME_INT_PAGES || size > NVME_INT_BYTES(dev)) {
-                size_t alloc_size = nvme_pci_iod_alloc_size(dev, size, nseg,
+                iod->sg = mempool_alloc(dev->iod_mempool, GFP_ATOMIC);
-                                iod->use_sgl);
-                iod->sg = kmalloc(alloc_size, GFP_ATOMIC);
                if (!iod->sg)
                        return BLK_STS_RESOURCE;
        } else {
@@ -526,7 +532,7 @@ static void nvme_free_iod(struct nvme_dev *dev, struct request *req)
        }
        if (iod->sg != iod->inline_sg)
-                kfree(iod->sg);
+                mempool_free(iod->sg, dev->iod_mempool);
 }
 #ifdef CONFIG_BLK_DEV_INTEGRITY
@@ -2280,6 +2286,7 @@ static void nvme_pci_free_ctrl(struct nvme_ctrl *ctrl)
                blk_put_queue(dev->ctrl.admin_q);
        kfree(dev->queues);
        free_opal_dev(dev->ctrl.opal_dev);
+        mempool_destroy(dev->iod_mempool);
        kfree(dev);
 }
@@ -2289,6 +2296,7 @@ static void nvme_remove_dead_ctrl(struct nvme_dev *dev, int status)
        nvme_get_ctrl(&dev->ctrl);
        nvme_dev_disable(dev, false);
+        nvme_kill_queues(&dev->ctrl);
        if (!queue_work(nvme_wq, &dev->remove_work))
                nvme_put_ctrl(&dev->ctrl);
 }
@@ -2333,6 +2341,13 @@ static void nvme_reset_work(struct work_struct *work)
        if (result)
                goto out;
+        /*
+         * Limit the max command size to prevent iod->sg allocations going
+         * over a single page.
+         */
+        dev->ctrl.max_hw_sectors = NVME_MAX_KB_SZ << 1;
+        dev->ctrl.max_segments = NVME_MAX_SEGS;
        result = nvme_init_identify(&dev->ctrl);
        if (result)
                goto out;
@@ -2405,7 +2420,6 @@ static void nvme_remove_dead_ctrl_work(struct work_struct *work)
        struct nvme_dev *dev = container_of(work, struct nvme_dev, remove_work);
        struct pci_dev *pdev = to_pci_dev(dev->dev);
-        nvme_kill_queues(&dev->ctrl);
        if (pci_get_drvdata(pdev))
                device_release_driver(&pdev->dev);
        nvme_put_ctrl(&dev->ctrl);
@@ -2509,6 +2523,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        int node, result = -ENOMEM;
        struct nvme_dev *dev;
        unsigned long quirks = id->driver_data;
+        size_t alloc_size;
        node = dev_to_node(&pdev->dev);
        if (node == NUMA_NO_NODE)
@@ -2546,6 +2561,23 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        if (result)
                goto release_pools;
+        /*
+         * Double check that our mempool alloc size will cover the biggest
+         * command we support.
+         */
+        alloc_size = nvme_pci_iod_alloc_size(dev, NVME_MAX_KB_SZ,
+                                                NVME_MAX_SEGS, true);
+        WARN_ON_ONCE(alloc_size > PAGE_SIZE);
+        dev->iod_mempool = mempool_create_node(1, mempool_kmalloc,
+                                                mempool_kfree,
+                                                (void *) alloc_size,
+                                                GFP_KERNEL, node);
+        if (!dev->iod_mempool) {
+                result = -ENOMEM;
+                goto release_pools;
+        }
        dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
        nvme_get_ctrl(&dev->ctrl);
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index c9424da0d23e..518c5b09038c 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -560,12 +560,6 @@ static void nvme_rdma_free_queue(struct nvme_rdma_queue *queue)
        if (!test_and_clear_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
                return;
-        if (nvme_rdma_queue_idx(queue) == 0) {
-                nvme_rdma_free_qe(queue->device->dev,
-                        &queue->ctrl->async_event_sqe,
-                        sizeof(struct nvme_command), DMA_TO_DEVICE);
-        }
        nvme_rdma_destroy_queue_ib(queue);
        rdma_destroy_id(queue->cm_id);
 }
@@ -698,7 +692,7 @@ static struct blk_mq_tag_set *nvme_rdma_alloc_tagset(struct nvme_ctrl *nctrl,
                set = &ctrl->tag_set;
                memset(set, 0, sizeof(*set));
                set->ops = &nvme_rdma_mq_ops;
-                set->queue_depth = nctrl->opts->queue_size;
+                set->queue_depth = nctrl->sqsize + 1;
                set->reserved_tags = 1; /* fabric connect */
                set->numa_node = NUMA_NO_NODE;
                set->flags = BLK_MQ_F_SHOULD_MERGE;
@@ -734,11 +728,15 @@ out:
 static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl,
                bool remove)
 {
-        nvme_rdma_stop_queue(&ctrl->queues[0]);
        if (remove) {
                blk_cleanup_queue(ctrl->ctrl.admin_q);
                nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset);
        }
+        if (ctrl->async_event_sqe.data) {
+                nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
+                                sizeof(struct nvme_command), DMA_TO_DEVICE);
+                ctrl->async_event_sqe.data = NULL;
+        }
        nvme_rdma_free_queue(&ctrl->queues[0]);
 }
@@ -755,11 +753,16 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl,
        ctrl->max_fr_pages = nvme_rdma_get_max_fr_pages(ctrl->device->dev);
+        error = nvme_rdma_alloc_qe(ctrl->device->dev, &ctrl->async_event_sqe,
+                        sizeof(struct nvme_command), DMA_TO_DEVICE);
+        if (error)
+                goto out_free_queue;
        if (new) {
                ctrl->ctrl.admin_tagset = nvme_rdma_alloc_tagset(&ctrl->ctrl, true);
                if (IS_ERR(ctrl->ctrl.admin_tagset)) {
                        error = PTR_ERR(ctrl->ctrl.admin_tagset);
-                        goto out_free_queue;
+                        goto out_free_async_qe;
                }
                ctrl->ctrl.admin_q = blk_mq_init_queue(&ctrl->admin_tag_set);
@@ -795,12 +798,6 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl,
        if (error)
                goto out_stop_queue;
-        error = nvme_rdma_alloc_qe(ctrl->queues[0].device->dev,
-                        &ctrl->async_event_sqe, sizeof(struct nvme_command),
-                        DMA_TO_DEVICE);
-        if (error)
-                goto out_stop_queue;
        return 0;
 out_stop_queue:
@@ -811,6 +808,9 @@ out_cleanup_queue:
 out_free_tagset:
        if (new)
                nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset);
+out_free_async_qe:
+        nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
+                sizeof(struct nvme_command), DMA_TO_DEVICE);
 out_free_queue:
        nvme_rdma_free_queue(&ctrl->queues[0]);
        return error;
@@ -819,7 +819,6 @@ out_free_queue:
 static void nvme_rdma_destroy_io_queues(struct nvme_rdma_ctrl *ctrl,
                bool remove)
 {
-        nvme_rdma_stop_io_queues(ctrl);
        if (remove) {
                blk_cleanup_queue(ctrl->ctrl.connect_q);
                nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset);
@@ -888,9 +887,9 @@ static void nvme_rdma_free_ctrl(struct nvme_ctrl *nctrl)
        list_del(&ctrl->list);
        mutex_unlock(&nvme_rdma_ctrl_mutex);
-        kfree(ctrl->queues);
        nvmf_free_options(nctrl->opts);
 free_ctrl:
+        kfree(ctrl->queues);
        kfree(ctrl);
 }
@@ -949,6 +948,7 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
        return;
 destroy_admin:
+        nvme_rdma_stop_queue(&ctrl->queues[0]);
        nvme_rdma_destroy_admin_queue(ctrl, false);
 requeue:
        dev_info(ctrl->ctrl.device, "Failed reconnect attempt %d\n",
@@ -965,12 +965,14 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
        if (ctrl->ctrl.queue_count > 1) {
                nvme_stop_queues(&ctrl->ctrl);
+                nvme_rdma_stop_io_queues(ctrl);
                blk_mq_tagset_busy_iter(&ctrl->tag_set,
                                        nvme_cancel_request, &ctrl->ctrl);
                nvme_rdma_destroy_io_queues(ctrl, false);
        }
        blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
+        nvme_rdma_stop_queue(&ctrl->queues[0]);
        blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
                                nvme_cancel_request, &ctrl->ctrl);
        nvme_rdma_destroy_admin_queue(ctrl, false);
@@ -1736,6 +1738,7 @@ static void nvme_rdma_shutdown_ctrl(struct nvme_rdma_ctrl *ctrl, bool shutdown)
 {
        if (ctrl->ctrl.queue_count > 1) {
                nvme_stop_queues(&ctrl->ctrl);
+                nvme_rdma_stop_io_queues(ctrl);
                blk_mq_tagset_busy_iter(&ctrl->tag_set,
                                        nvme_cancel_request, &ctrl->ctrl);
                nvme_rdma_destroy_io_queues(ctrl, shutdown);
@@ -1747,6 +1750,7 @@ static void nvme_rdma_shutdown_ctrl(struct nvme_rdma_ctrl *ctrl, bool shutdown)
                nvme_disable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap);
        blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
+        nvme_rdma_stop_queue(&ctrl->queues[0]);
        blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
                                nvme_cancel_request, &ctrl->ctrl);
        blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
@@ -1932,11 +1936,6 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
                goto out_free_ctrl;
        }
-        ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_rdma_ctrl_ops,
-                                0 /* no quirks, we're perfect! */);
-        if (ret)
-                goto out_free_ctrl;
        INIT_DELAYED_WORK(&ctrl->reconnect_work,
                        nvme_rdma_reconnect_ctrl_work);
        INIT_WORK(&ctrl->err_work, nvme_rdma_error_recovery_work);
@@ -1950,14 +1949,19 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
        ctrl->queues = kcalloc(ctrl->ctrl.queue_count, sizeof(*ctrl->queues),
                                GFP_KERNEL);
        if (!ctrl->queues)
-                goto out_uninit_ctrl;
+                goto out_free_ctrl;
+        ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_rdma_ctrl_ops,
+                                0 /* no quirks, we're perfect! */);
+        if (ret)
+                goto out_kfree_queues;
        changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING);
        WARN_ON_ONCE(!changed);
        ret = nvme_rdma_configure_admin_queue(ctrl, true);
        if (ret)
-                goto out_kfree_queues;
+                goto out_uninit_ctrl;
        /* sanity check icdoff */
        if (ctrl->ctrl.icdoff) {
@@ -1974,20 +1978,19 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
                goto out_remove_admin_queue;
        }
-        if (opts->queue_size > ctrl->ctrl.maxcmd) {
+        /* only warn if argument is too large here, will clamp later */
-                /* warn if maxcmd is lower than queue_size */
-                dev_warn(ctrl->ctrl.device,
-                        "queue_size %zu > ctrl maxcmd %u, clamping down\n",
-                        opts->queue_size, ctrl->ctrl.maxcmd);
-                opts->queue_size = ctrl->ctrl.maxcmd;
-        }
        if (opts->queue_size > ctrl->ctrl.sqsize + 1) {
-                /* warn if sqsize is lower than queue_size */
                dev_warn(ctrl->ctrl.device,
                        "queue_size %zu > ctrl sqsize %u, clamping down\n",
                        opts->queue_size, ctrl->ctrl.sqsize + 1);
-                opts->queue_size = ctrl->ctrl.sqsize + 1;
+        }
+        /* warn if maxcmd is lower than sqsize+1 */
+        if (ctrl->ctrl.sqsize + 1 > ctrl->ctrl.maxcmd) {
+                dev_warn(ctrl->ctrl.device,
+                        "sqsize %u > ctrl maxcmd %u, clamping down\n",
+                        ctrl->ctrl.sqsize + 1, ctrl->ctrl.maxcmd);
+                ctrl->ctrl.sqsize = ctrl->ctrl.maxcmd - 1;
        }
        if (opts->nr_io_queues) {
@@ -2013,15 +2016,16 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
        return &ctrl->ctrl;
 out_remove_admin_queue:
+        nvme_rdma_stop_queue(&ctrl->queues[0]);
        nvme_rdma_destroy_admin_queue(ctrl, true);
-out_kfree_queues:
-        kfree(ctrl->queues);
 out_uninit_ctrl:
        nvme_uninit_ctrl(&ctrl->ctrl);
        nvme_put_ctrl(&ctrl->ctrl);
        if (ret > 0)
                ret = -EIO;
        return ERR_PTR(ret);
+out_kfree_queues:
+        kfree(ctrl->queues);
 out_free_ctrl:
        kfree(ctrl);
        return ERR_PTR(ret);
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index a03da764ecae..74d4b785d2da 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -686,6 +686,14 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl)
        }
        ctrl->csts = NVME_CSTS_RDY;
+        /*
+         * Controllers that are not yet enabled should not really enforce the
+         * keep alive timeout, but we still want to track a timeout and cleanup
+         * in case a host died before it enabled the controller.  Hence, simply
+         * reset the keep alive timer when the controller is enabled.
+         */
+        mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
 }
 static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl)
diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index ab2f3fead6b1..31ff03dbeb83 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -598,7 +598,7 @@ static int _generic_set_opp_regulator(const struct opp_table *opp_table,
        }
        /* Scaling up? Scale voltage before frequency */
-        if (freq > old_freq) {
+        if (freq >= old_freq) {
                ret = _set_opp_voltage(dev, reg, new_supply);
                if (ret)
                        goto restore_voltage;
diff --git a/drivers/pci/Makefile b/drivers/pci/Makefile
index 535201984b8b..1b2cfe51e8d7 100644
--- a/drivers/pci/Makefile
+++ b/drivers/pci/Makefile
@@ -28,10 +28,10 @@ obj-$(CONFIG_PCI_PF_STUB)	+= pci-pf-stub.o
 obj-$(CONFIG_PCI_ECAM)          += ecam.o
 obj-$(CONFIG_XEN_PCIDEV_FRONTEND) += xen-pcifront.o
-obj-y                           += controller/
-obj-y                           += switch/
 # Endpoint library must be initialized before its users
 obj-$(CONFIG_PCI_ENDPOINT)      += endpoint/
+obj-y                           += controller/
+obj-y                           += switch/
 ccflags-$(CONFIG_PCI_DEBUG) := -DDEBUG
diff --git a/drivers/pci/controller/Kconfig b/drivers/pci/controller/Kconfig
index 18fa09b3ac8f..cc9fa02d32a0 100644
--- a/drivers/pci/controller/Kconfig
+++ b/drivers/pci/controller/Kconfig
@@ -96,7 +96,6 @@ config PCI_HOST_GENERIC
        depends on OF
        select PCI_HOST_COMMON
        select IRQ_DOMAIN
-        select PCI_DOMAINS
        help
          Say Y here if you want to support a simple generic PCI host
          controller, such as the one emulated by kvmtool.
@@ -138,7 +137,6 @@ config PCI_VERSATILE
 config PCIE_IPROC
        tristate
-        select PCI_DOMAINS
        help
          This enables the iProc PCIe core controller support for Broadcom's
          iProc family of SoCs. An appropriate bus interface driver needs
@@ -176,7 +174,6 @@ config PCIE_IPROC_MSI
 config PCIE_ALTERA
        bool "Altera PCIe controller"
        depends on ARM || NIOS2 || COMPILE_TEST
-        select PCI_DOMAINS
        help
          Say Y here if you want to enable PCIe controller support on Altera
          FPGA.
diff --git a/drivers/pci/hotplug/acpi_pcihp.c b/drivers/pci/hotplug/acpi_pcihp.c
index 3979f89b250a..5bd6c1573295 100644
--- a/drivers/pci/hotplug/acpi_pcihp.c
+++ b/drivers/pci/hotplug/acpi_pcihp.c
@@ -7,7 +7,6 @@
 * All rights reserved.
 *
 * Send feedback to <kristen.c.accardi@intel.com>
- *
 */
 #include <linux/module.h>
@@ -87,8 +86,17 @@ int acpi_get_hp_hw_control_from_firmware(struct pci_dev *pdev)
                return 0;
        /* If _OSC exists, we should not evaluate OSHP */
+        /*
+         * If there's no ACPI host bridge (i.e., ACPI support is compiled
+         * into the kernel but the hardware platform doesn't support ACPI),
+         * there's nothing to do here.
+         */
        host = pci_find_host_bridge(pdev->bus);
        root = acpi_pci_find_root(ACPI_HANDLE(&host->dev));
+        if (!root)
+                return 0;
        if (root->osc_support_set)
                goto no_control;
diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c
index 6bdb1dad805f..0e31f1392a53 100644
--- a/drivers/perf/xgene_pmu.c
+++ b/drivers/perf/xgene_pmu.c
@@ -1463,7 +1463,7 @@ static char *xgene_pmu_dev_name(struct device *dev, u32 type, int id)
        case PMU_TYPE_IOB:
                return devm_kasprintf(dev, GFP_KERNEL, "iob%d", id);
        case PMU_TYPE_IOB_SLOW:
-                return devm_kasprintf(dev, GFP_KERNEL, "iob-slow%d", id);
+                return devm_kasprintf(dev, GFP_KERNEL, "iob_slow%d", id);
        case PMU_TYPE_MCB:
                return devm_kasprintf(dev, GFP_KERNEL, "mcb%d", id);
        case PMU_TYPE_MC:
diff --git a/drivers/pinctrl/actions/pinctrl-owl.c b/drivers/pinctrl/actions/pinctrl-owl.c
index 76243caa08c6..b5c880b50bb3 100644
--- a/drivers/pinctrl/actions/pinctrl-owl.c
+++ b/drivers/pinctrl/actions/pinctrl-owl.c
@@ -333,7 +333,7 @@ static int owl_pin_config_set(struct pinctrl_dev *pctrldev,
        unsigned long flags;
        unsigned int param;
        u32 reg, bit, width, arg;
-        int ret, i;
+        int ret = 0, i;
        info = &pctrl->soc->padinfo[pin];
diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c
index b601039d6c69..c4aa411f5935 100644
--- a/drivers/pinctrl/devicetree.c
+++ b/drivers/pinctrl/devicetree.c
@@ -101,10 +101,11 @@ struct pinctrl_dev *of_pinctrl_get(struct device_node *np)
 }
 static int dt_to_map_one_config(struct pinctrl *p,
-                                struct pinctrl_dev *pctldev,
+                                struct pinctrl_dev *hog_pctldev,
                                const char *statename,
                                struct device_node *np_config)
 {
+        struct pinctrl_dev *pctldev = NULL;
        struct device_node *np_pctldev;
        const struct pinctrl_ops *ops;
        int ret;
@@ -123,8 +124,10 @@ static int dt_to_map_one_config(struct pinctrl *p,
                        return -EPROBE_DEFER;
                }
                /* If we're creating a hog we can use the passed pctldev */
-                if (pctldev && (np_pctldev == p->dev->of_node))
+                if (hog_pctldev && (np_pctldev == p->dev->of_node)) {
+                        pctldev = hog_pctldev;
                        break;
+                }
                pctldev = get_pinctrl_dev_from_of_node(np_pctldev);
                if (pctldev)
                        break;
diff --git a/drivers/pinctrl/mediatek/pinctrl-mt7622.c b/drivers/pinctrl/mediatek/pinctrl-mt7622.c
index ad6da1184c9f..e3f1ab2290fc 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mt7622.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mt7622.c
@@ -1459,6 +1459,9 @@ static int mtk_gpio_to_irq(struct gpio_chip *chip, unsigned int offset)
        struct mtk_pinctrl *hw = gpiochip_get_data(chip);
        unsigned long eint_n;
+        if (!hw->eint)
+                return -ENOTSUPP;
        eint_n = offset;
        return mtk_eint_find_irq(hw->eint, eint_n);
@@ -1471,7 +1474,8 @@ static int mtk_gpio_set_config(struct gpio_chip *chip, unsigned int offset,
        unsigned long eint_n;
        u32 debounce;
-        if (pinconf_to_config_param(config) != PIN_CONFIG_INPUT_DEBOUNCE)
+        if (!hw->eint ||
+            pinconf_to_config_param(config) != PIN_CONFIG_INPUT_DEBOUNCE)
                return -ENOTSUPP;
        debounce = pinconf_to_config_argument(config);
diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
index b3799695d8db..16ff56f93501 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
@@ -1000,11 +1000,6 @@ static int mtk_eint_init(struct mtk_pinctrl *pctl, struct platform_device *pdev)
                return -ENOMEM;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                dev_err(&pdev->dev, "Unable to get eint resource\n");
-                return -ENODEV;
-        }
        pctl->eint->base = devm_ioremap_resource(&pdev->dev, res);
        if (IS_ERR(pctl->eint->base))
                return PTR_ERR(pctl->eint->base);
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index b3153c095199..e5647dac0818 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1590,8 +1590,11 @@ static int pcs_save_context(struct pcs_device *pcs)
        mux_bytes = pcs->width / BITS_PER_BYTE;
-        if (!pcs->saved_vals)
+        if (!pcs->saved_vals) {
                pcs->saved_vals = devm_kzalloc(pcs->dev, pcs->size, GFP_ATOMIC);
+                if (!pcs->saved_vals)
+                        return -ENOMEM;
+        }
        switch (pcs->width) {
        case 64:
@@ -1651,8 +1654,13 @@ static int pinctrl_single_suspend(struct platform_device *pdev,
        if (!pcs)
                return -EINVAL;
-        if (pcs->flags & PCS_CONTEXT_LOSS_OFF)
+        if (pcs->flags & PCS_CONTEXT_LOSS_OFF) {
-                pcs_save_context(pcs);
+                int ret;
+                ret = pcs_save_context(pcs);
+                if (ret < 0)
+                        return ret;
+        }
        return pinctrl_force_sleep(pcs->pctl);
 }
diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index 767c485af59b..547dbdac9d54 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -221,7 +221,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
                }
                pct = &sysoff->ts[0];
                for (i = 0; i < sysoff->n_samples; i++) {
-                        getnstimeofday64(&ts);
+                        ktime_get_real_ts64(&ts);
                        pct->sec = ts.tv_sec;
                        pct->nsec = ts.tv_nsec;
                        pct++;
@@ -230,7 +230,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
                        pct->nsec = ts.tv_nsec;
                        pct++;
                }
-                getnstimeofday64(&ts);
+                ktime_get_real_ts64(&ts);
                pct->sec = ts.tv_sec;
                pct->nsec = ts.tv_nsec;
                if (copy_to_user((void __user *)arg, sysoff, sizeof(*sysoff)))
diff --git a/drivers/ptp/ptp_qoriq.c b/drivers/ptp/ptp_qoriq.c
index 1468a1642b49..e8652c148c52 100644
--- a/drivers/ptp/ptp_qoriq.c
+++ b/drivers/ptp/ptp_qoriq.c
@@ -374,7 +374,7 @@ static int qoriq_ptp_probe(struct platform_device *dev)
                pr_err("ioremap ptp registers failed\n");
                goto no_ioremap;
        }
-        getnstimeofday64(&now);
+        ktime_get_real_ts64(&now);
        ptp_qoriq_settime(&qoriq_ptp->caps, &now);
        tmr_ctrl =
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 73cce3ecb97f..d3a38c421503 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1222,80 +1222,37 @@ static void dasd_hosts_init(struct dentry *base_dentry,
                device->hosts_dentry = pde;
 }
-/*
+struct dasd_ccw_req *dasd_smalloc_request(int magic, int cplength, int datasize,
- * Allocate memory for a channel program with 'cplength' channel
+                                          struct dasd_device *device,
- * command words and 'datasize' additional space. There are two
+                                          struct dasd_ccw_req *cqr)
- * variantes: 1) dasd_kmalloc_request uses kmalloc to get the needed
- * memory and 2) dasd_smalloc_request uses the static ccw memory
- * that gets allocated for each device.
- */
-struct dasd_ccw_req *dasd_kmalloc_request(int magic, int cplength,
-                                          int datasize,
-                                          struct dasd_device *device)
-{
-        struct dasd_ccw_req *cqr;
-        /* Sanity checks */
-        BUG_ON(datasize > PAGE_SIZE ||
-             (cplength*sizeof(struct ccw1)) > PAGE_SIZE);
-        cqr = kzalloc(sizeof(struct dasd_ccw_req), GFP_ATOMIC);
-        if (cqr == NULL)
-                return ERR_PTR(-ENOMEM);
-        cqr->cpaddr = NULL;
-        if (cplength > 0) {
-                cqr->cpaddr = kcalloc(cplength, sizeof(struct ccw1),
-                                      GFP_ATOMIC | GFP_DMA);
-                if (cqr->cpaddr == NULL) {
-                        kfree(cqr);
-                        return ERR_PTR(-ENOMEM);
-                }
-        }
-        cqr->data = NULL;
-        if (datasize > 0) {
-                cqr->data = kzalloc(datasize, GFP_ATOMIC | GFP_DMA);
-                if (cqr->data == NULL) {
-                        kfree(cqr->cpaddr);
-                        kfree(cqr);
-                        return ERR_PTR(-ENOMEM);
-                }
-        }
-        cqr->magic =  magic;
-        set_bit(DASD_CQR_FLAGS_USE_ERP, &cqr->flags);
-        dasd_get_device(device);
-        return cqr;
-}
-EXPORT_SYMBOL(dasd_kmalloc_request);
-struct dasd_ccw_req *dasd_smalloc_request(int magic, int cplength,
-                                          int datasize,
-                                          struct dasd_device *device)
 {
        unsigned long flags;
-        struct dasd_ccw_req *cqr;
+        char *data, *chunk;
-        char *data;
+        int size = 0;
-        int size;
-        size = (sizeof(struct dasd_ccw_req) + 7L) & -8L;
        if (cplength > 0)
                size += cplength * sizeof(struct ccw1);
        if (datasize > 0)
                size += datasize;
+        if (!cqr)
+                size += (sizeof(*cqr) + 7L) & -8L;
        spin_lock_irqsave(&device->mem_lock, flags);
-        cqr = (struct dasd_ccw_req *)
+        data = chunk = dasd_alloc_chunk(&device->ccw_chunks, size);
-                dasd_alloc_chunk(&device->ccw_chunks, size);
        spin_unlock_irqrestore(&device->mem_lock, flags);
-        if (cqr == NULL)
+        if (!chunk)
                return ERR_PTR(-ENOMEM);
-        memset(cqr, 0, sizeof(struct dasd_ccw_req));
+        if (!cqr) {
-        data = (char *) cqr + ((sizeof(struct dasd_ccw_req) + 7L) & -8L);
+                cqr = (void *) data;
-        cqr->cpaddr = NULL;
+                data += (sizeof(*cqr) + 7L) & -8L;
+        }
+        memset(cqr, 0, sizeof(*cqr));
+        cqr->mem_chunk = chunk;
        if (cplength > 0) {
-                cqr->cpaddr = (struct ccw1 *) data;
+                cqr->cpaddr = data;
-                data += cplength*sizeof(struct ccw1);
+                data += cplength * sizeof(struct ccw1);
-                memset(cqr->cpaddr, 0, cplength*sizeof(struct ccw1));
+                memset(cqr->cpaddr, 0, cplength * sizeof(struct ccw1));
        }
-        cqr->data = NULL;
        if (datasize > 0) {
                cqr->data = data;
                memset(cqr->data, 0, datasize);
@@ -1307,33 +1264,12 @@ struct dasd_ccw_req *dasd_smalloc_request(int magic, int cplength,
 }
 EXPORT_SYMBOL(dasd_smalloc_request);
-/*
- * Free memory of a channel program. This function needs to free all the
- * idal lists that might have been created by dasd_set_cda and the
- * struct dasd_ccw_req itself.
- */
-void dasd_kfree_request(struct dasd_ccw_req *cqr, struct dasd_device *device)
-{
-        struct ccw1 *ccw;
-        /* Clear any idals used for the request. */
-        ccw = cqr->cpaddr;
-        do {
-                clear_normalized_cda(ccw);
-        } while (ccw++->flags & (CCW_FLAG_CC | CCW_FLAG_DC));
-        kfree(cqr->cpaddr);
-        kfree(cqr->data);
-        kfree(cqr);
-        dasd_put_device(device);
-}
-EXPORT_SYMBOL(dasd_kfree_request);
 void dasd_sfree_request(struct dasd_ccw_req *cqr, struct dasd_device *device)
 {
        unsigned long flags;
        spin_lock_irqsave(&device->mem_lock, flags);
-        dasd_free_chunk(&device->ccw_chunks, cqr);
+        dasd_free_chunk(&device->ccw_chunks, cqr->mem_chunk);
        spin_unlock_irqrestore(&device->mem_lock, flags);
        dasd_put_device(device);
 }
@@ -1885,6 +1821,33 @@ static void __dasd_device_process_ccw_queue(struct dasd_device *device,
        }
 }
+static void __dasd_process_cqr(struct dasd_device *device,
+                               struct dasd_ccw_req *cqr)
+{
+        char errorstring[ERRORLENGTH];
+        switch (cqr->status) {
+        case DASD_CQR_SUCCESS:
+                cqr->status = DASD_CQR_DONE;
+                break;
+        case DASD_CQR_ERROR:
+                cqr->status = DASD_CQR_NEED_ERP;
+                break;
+        case DASD_CQR_CLEARED:
+                cqr->status = DASD_CQR_TERMINATED;
+                break;
+        default:
+                /* internal error 12 - wrong cqr status*/
+                snprintf(errorstring, ERRORLENGTH, "12 %p %x02", cqr, cqr->status);
+                dev_err(&device->cdev->dev,
+                        "An error occurred in the DASD device driver, "
+                        "reason=%s\n", errorstring);
+                BUG();
+        }
+        if (cqr->callback)
+                cqr->callback(cqr, cqr->callback_data);
+}
 /*
 * the cqrs from the final queue are returned to the upper layer
 * by setting a dasd_block state and calling the callback function
@@ -1895,40 +1858,18 @@ static void __dasd_device_process_final_queue(struct dasd_device *device,
        struct list_head *l, *n;
        struct dasd_ccw_req *cqr;
        struct dasd_block *block;
-        void (*callback)(struct dasd_ccw_req *, void *data);
-        void *callback_data;
-        char errorstring[ERRORLENGTH];
        list_for_each_safe(l, n, final_queue) {
                cqr = list_entry(l, struct dasd_ccw_req, devlist);
                list_del_init(&cqr->devlist);
                block = cqr->block;
-                callback = cqr->callback;
+                if (!block) {
-                callback_data = cqr->callback_data;
+                        __dasd_process_cqr(device, cqr);
-                if (block)
+                } else {
                        spin_lock_bh(&block->queue_lock);
-                switch (cqr->status) {
+                        __dasd_process_cqr(device, cqr);
-                case DASD_CQR_SUCCESS:
-                        cqr->status = DASD_CQR_DONE;
-                        break;
-                case DASD_CQR_ERROR:
-                        cqr->status = DASD_CQR_NEED_ERP;
-                        break;
-                case DASD_CQR_CLEARED:
-                        cqr->status = DASD_CQR_TERMINATED;
-                        break;
-                default:
-                        /* internal error 12 - wrong cqr status*/
-                        snprintf(errorstring, ERRORLENGTH, "12 %p %x02", cqr, cqr->status);
-                        dev_err(&device->cdev->dev,
-                                "An error occurred in the DASD device driver, "
-                                "reason=%s\n", errorstring);
-                        BUG();
-                }
-                if (cqr->callback != NULL)
-                        (callback)(cqr, callback_data);
-                if (block)
                        spin_unlock_bh(&block->queue_lock);
+                }
        }
 }
@@ -3041,7 +2982,6 @@ static blk_status_t do_dasd_request(struct blk_mq_hw_ctx *hctx,
        cqr->callback_data = req;
        cqr->status = DASD_CQR_FILLED;
        cqr->dq = dq;
-        *((struct dasd_ccw_req **) blk_mq_rq_to_pdu(req)) = cqr;
        blk_mq_start_request(req);
        spin_lock(&block->queue_lock);
@@ -3072,7 +3012,7 @@ enum blk_eh_timer_return dasd_times_out(struct request *req, bool reserved)
        unsigned long flags;
        int rc = 0;
-        cqr = *((struct dasd_ccw_req **) blk_mq_rq_to_pdu(req));
+        cqr = blk_mq_rq_to_pdu(req);
        if (!cqr)
                return BLK_EH_DONE;
@@ -3174,7 +3114,7 @@ static int dasd_alloc_queue(struct dasd_block *block)
        int rc;
        block->tag_set.ops = &dasd_mq_ops;
-        block->tag_set.cmd_size = sizeof(struct dasd_ccw_req *);
+        block->tag_set.cmd_size = sizeof(struct dasd_ccw_req);
        block->tag_set.nr_hw_queues = DASD_NR_HW_QUEUES;
        block->tag_set.queue_depth = DASD_MAX_LCU_DEV * DASD_REQ_PER_DEV;
        block->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
@@ -4038,7 +3978,8 @@ static struct dasd_ccw_req *dasd_generic_build_rdc(struct dasd_device *device,
        struct ccw1 *ccw;
        unsigned long *idaw;
-        cqr = dasd_smalloc_request(magic, 1 /* RDC */, rdc_buffer_size, device);
+        cqr = dasd_smalloc_request(magic, 1 /* RDC */, rdc_buffer_size, device,
+                                   NULL);
        if (IS_ERR(cqr)) {
                /* internal error 13 - Allocating the RDC request failed*/
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 5e963fe0e38d..e36a114354fc 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -407,9 +407,9 @@ static int read_unit_address_configuration(struct dasd_device *device,
        int rc;
        unsigned long flags;
-        cqr = dasd_kmalloc_request(DASD_ECKD_MAGIC, 1 /* PSF */ + 1 /* RSSD */,
+        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1 /* PSF */ + 1 /* RSSD */,
                                   (sizeof(struct dasd_psf_prssd_data)),
-                                   device);
+                                   device, NULL);
        if (IS_ERR(cqr))
                return PTR_ERR(cqr);
        cqr->startdev = device;
@@ -457,7 +457,7 @@ static int read_unit_address_configuration(struct dasd_device *device,
                lcu->flags |= NEED_UAC_UPDATE;
                spin_unlock_irqrestore(&lcu->lock, flags);
        }
-        dasd_kfree_request(cqr, cqr->memdev);
+        dasd_sfree_request(cqr, cqr->memdev);
        return rc;
 }
diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
index 131f1989f6f3..e1fe02477ea8 100644
--- a/drivers/s390/block/dasd_diag.c
+++ b/drivers/s390/block/dasd_diag.c
@@ -536,7 +536,8 @@ static struct dasd_ccw_req *dasd_diag_build_cp(struct dasd_device *memdev,
        /* Build the request */
        datasize = sizeof(struct dasd_diag_req) +
                count*sizeof(struct dasd_diag_bio);
-        cqr = dasd_smalloc_request(DASD_DIAG_MAGIC, 0, datasize, memdev);
+        cqr = dasd_smalloc_request(DASD_DIAG_MAGIC, 0, datasize, memdev,
+                                   blk_mq_rq_to_pdu(req));
        if (IS_ERR(cqr))
                return cqr;
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index be208e7adcb4..bbf95b78ef5d 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -886,7 +886,7 @@ static int dasd_eckd_read_conf_lpm(struct dasd_device *device,
        }
        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1 /* RCD */,
                                   0, /* use rcd_buf as data ara */
-                                   device);
+                                   device, NULL);
        if (IS_ERR(cqr)) {
                DBF_DEV_EVENT(DBF_WARNING, device, "%s",
                              "Could not allocate RCD request");
@@ -1442,7 +1442,7 @@ static int dasd_eckd_read_features(struct dasd_device *device)
        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1 /* PSF */ + 1 /* RSSD */,
                                   (sizeof(struct dasd_psf_prssd_data) +
                                    sizeof(struct dasd_rssd_features)),
-                                   device);
+                                   device, NULL);
        if (IS_ERR(cqr)) {
                DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s", "Could not "
                                "allocate initialization request");
@@ -1504,7 +1504,7 @@ static struct dasd_ccw_req *dasd_eckd_build_psf_ssc(struct dasd_device *device,
        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1 /* PSF */ ,
                                  sizeof(struct dasd_psf_ssc_data),
-                                  device);
+                                   device, NULL);
        if (IS_ERR(cqr)) {
                DBF_DEV_EVENT(DBF_WARNING, device, "%s",
@@ -1815,7 +1815,8 @@ dasd_eckd_analysis_ccw(struct dasd_device *device)
        cplength = 8;
        datasize = sizeof(struct DE_eckd_data) + 2*sizeof(struct LO_eckd_data);
-        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, cplength, datasize, device);
+        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, cplength, datasize, device,
+                                   NULL);
        if (IS_ERR(cqr))
                return cqr;
        ccw = cqr->cpaddr;
@@ -2092,7 +2093,8 @@ dasd_eckd_build_check_tcw(struct dasd_device *base, struct format_data_t *fdata,
         */
        itcw_size = itcw_calc_size(0, count, 0);
-        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 0, itcw_size, startdev);
+        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 0, itcw_size, startdev,
+                                   NULL);
        if (IS_ERR(cqr))
                return cqr;
@@ -2186,7 +2188,7 @@ dasd_eckd_build_check(struct dasd_device *base, struct format_data_t *fdata,
        cplength += count;
        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, cplength, datasize,
-                                  startdev);
+                                   startdev, NULL);
        if (IS_ERR(cqr))
                return cqr;
@@ -2332,7 +2334,7 @@ dasd_eckd_build_format(struct dasd_device *base,
        }
        /* Allocate the format ccw request. */
        fcp = dasd_smalloc_request(DASD_ECKD_MAGIC, cplength,
-                                   datasize, startdev);
+                                   datasize, startdev, NULL);
        if (IS_ERR(fcp))
                return fcp;
@@ -3103,7 +3105,7 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_cmd_single(
        }
        /* Allocate the ccw request. */
        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, cplength, datasize,
-                                   startdev);
+                                   startdev, blk_mq_rq_to_pdu(req));
        if (IS_ERR(cqr))
                return cqr;
        ccw = cqr->cpaddr;
@@ -3262,7 +3264,7 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_cmd_track(
        /* Allocate the ccw request. */
        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, cplength, datasize,
-                                   startdev);
+                                   startdev, blk_mq_rq_to_pdu(req));
        if (IS_ERR(cqr))
                return cqr;
        ccw = cqr->cpaddr;
@@ -3595,7 +3597,8 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_tpm_track(
        /* Allocate the ccw request. */
        itcw_size = itcw_calc_size(0, ctidaw, 0);
-        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 0, itcw_size, startdev);
+        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 0, itcw_size, startdev,
+                                   blk_mq_rq_to_pdu(req));
        if (IS_ERR(cqr))
                return cqr;
@@ -3862,7 +3865,7 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_raw(struct dasd_device *startdev,
        /* Allocate the ccw request. */
        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, cplength,
-                                   datasize, startdev);
+                                   datasize, startdev, blk_mq_rq_to_pdu(req));
        if (IS_ERR(cqr))
                return cqr;
@@ -4102,7 +4105,7 @@ dasd_eckd_release(struct dasd_device *device)
                return -EACCES;
        useglobal = 0;
-        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1, 32, device);
+        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1, 32, device, NULL);
        if (IS_ERR(cqr)) {
                mutex_lock(&dasd_reserve_mutex);
                useglobal = 1;
@@ -4157,7 +4160,7 @@ dasd_eckd_reserve(struct dasd_device *device)
                return -EACCES;
        useglobal = 0;
-        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1, 32, device);
+        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1, 32, device, NULL);
        if (IS_ERR(cqr)) {
                mutex_lock(&dasd_reserve_mutex);
                useglobal = 1;
@@ -4211,7 +4214,7 @@ dasd_eckd_steal_lock(struct dasd_device *device)
                return -EACCES;
        useglobal = 0;
-        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1, 32, device);
+        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1, 32, device, NULL);
        if (IS_ERR(cqr)) {
                mutex_lock(&dasd_reserve_mutex);
                useglobal = 1;
@@ -4271,7 +4274,8 @@ static int dasd_eckd_snid(struct dasd_device *device,
        useglobal = 0;
        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1,
-                                   sizeof(struct dasd_snid_data), device);
+                                   sizeof(struct dasd_snid_data), device,
+                                   NULL);
        if (IS_ERR(cqr)) {
                mutex_lock(&dasd_reserve_mutex);
                useglobal = 1;
@@ -4331,7 +4335,7 @@ dasd_eckd_performance(struct dasd_device *device, void __user *argp)
        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1 /* PSF */  + 1 /* RSSD */,
                                   (sizeof(struct dasd_psf_prssd_data) +
                                    sizeof(struct dasd_rssd_perf_stats_t)),
-                                   device);
+                                   device, NULL);
        if (IS_ERR(cqr)) {
                DBF_DEV_EVENT(DBF_WARNING, device, "%s",
                            "Could not allocate initialization request");
@@ -4477,7 +4481,7 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp)
        psf1 = psf_data[1];
        /* setup CCWs for PSF + RSSD */
-        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 2 , 0, device);
+        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 2, 0, device, NULL);
        if (IS_ERR(cqr)) {
                DBF_DEV_EVENT(DBF_WARNING, device, "%s",
                        "Could not allocate initialization request");
@@ -5037,7 +5041,7 @@ static int dasd_eckd_read_message_buffer(struct dasd_device *device,
        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1 /* PSF */ + 1 /* RSSD */,
                                   (sizeof(struct dasd_psf_prssd_data) +
                                    sizeof(struct dasd_rssd_messages)),
-                                   device);
+                                   device, NULL);
        if (IS_ERR(cqr)) {
                DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s",
                                "Could not allocate read message buffer request");
@@ -5126,7 +5130,7 @@ static int dasd_eckd_query_host_access(struct dasd_device *device,
        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1 /* PSF */ + 1 /* RSSD */,
                                   sizeof(struct dasd_psf_prssd_data) + 1,
-                                   device);
+                                   device, NULL);
        if (IS_ERR(cqr)) {
                DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s",
                                "Could not allocate read message buffer request");
@@ -5284,8 +5288,8 @@ dasd_eckd_psf_cuir_response(struct dasd_device *device, int response,
        int rc;
        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1 /* PSF */ ,
-                                  sizeof(struct dasd_psf_cuir_response),
+                                   sizeof(struct dasd_psf_cuir_response),
-                                  device);
+                                   device, NULL);
        if (IS_ERR(cqr)) {
                DBF_DEV_EVENT(DBF_WARNING, device, "%s",
diff --git a/drivers/s390/block/dasd_eer.c b/drivers/s390/block/dasd_eer.c
index 0af8c5295b65..6ef8714dc693 100644
--- a/drivers/s390/block/dasd_eer.c
+++ b/drivers/s390/block/dasd_eer.c
@@ -447,7 +447,7 @@ static void dasd_eer_snss_cb(struct dasd_ccw_req *cqr, void *data)
                 * is a new ccw in device->eer_cqr. Free the "old"
                 * snss request now.
                 */
-                dasd_kfree_request(cqr, device);
+                dasd_sfree_request(cqr, device);
 }
 /*
@@ -472,8 +472,8 @@ int dasd_eer_enable(struct dasd_device *device)
        if (rc)
                goto out;
-        cqr = dasd_kmalloc_request(DASD_ECKD_MAGIC, 1 /* SNSS */,
+        cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1 /* SNSS */,
-                                   SNSS_DATA_SIZE, device);
+                                   SNSS_DATA_SIZE, device, NULL);
        if (IS_ERR(cqr)) {
                rc = -ENOMEM;
                cqr = NULL;
@@ -505,7 +505,7 @@ out:
        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
        if (cqr)
-                dasd_kfree_request(cqr, device);
+                dasd_sfree_request(cqr, device);
        return rc;
 }
@@ -528,7 +528,7 @@ void dasd_eer_disable(struct dasd_device *device)
        in_use = test_and_clear_bit(DASD_FLAG_EER_IN_USE, &device->flags);
        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
        if (cqr && !in_use)
-                dasd_kfree_request(cqr, device);
+                dasd_sfree_request(cqr, device);
 }
 /*
diff --git a/drivers/s390/block/dasd_fba.c b/drivers/s390/block/dasd_fba.c
index a6b132f7e869..56007a3e7f11 100644
--- a/drivers/s390/block/dasd_fba.c
+++ b/drivers/s390/block/dasd_fba.c
@@ -356,7 +356,8 @@ static struct dasd_ccw_req *dasd_fba_build_cp_discard(
        datasize = sizeof(struct DE_fba_data) +
                nr_ccws * (sizeof(struct LO_fba_data) + sizeof(struct ccw1));
-        cqr = dasd_smalloc_request(DASD_FBA_MAGIC, cplength, datasize, memdev);
+        cqr = dasd_smalloc_request(DASD_FBA_MAGIC, cplength, datasize, memdev,
+                                   blk_mq_rq_to_pdu(req));
        if (IS_ERR(cqr))
                return cqr;
@@ -490,7 +491,8 @@ static struct dasd_ccw_req *dasd_fba_build_cp_regular(
                datasize += (count - 1)*sizeof(struct LO_fba_data);
        }
        /* Allocate the ccw request. */
-        cqr = dasd_smalloc_request(DASD_FBA_MAGIC, cplength, datasize, memdev);
+        cqr = dasd_smalloc_request(DASD_FBA_MAGIC, cplength, datasize, memdev,
+                                   blk_mq_rq_to_pdu(req));
        if (IS_ERR(cqr))
                return cqr;
        ccw = cqr->cpaddr;
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index 96709b1a7bf8..976b6bd4fb05 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -158,40 +158,33 @@ do { \
 struct dasd_ccw_req {
        unsigned int magic;             /* Eye catcher */
+        int intrc;                      /* internal error, e.g. from start_IO */
        struct list_head devlist;       /* for dasd_device request queue */
        struct list_head blocklist;     /* for dasd_block request queue */
-        /* Where to execute what... */
        struct dasd_block *block;       /* the originating block device */
        struct dasd_device *memdev;     /* the device used to allocate this */
        struct dasd_device *startdev;   /* device the request is started on */
        struct dasd_device *basedev;    /* base device if no block->base */
        void *cpaddr;                   /* address of ccw or tcw */
+        short retries;                  /* A retry counter */
        unsigned char cpmode;           /* 0 = cmd mode, 1 = itcw */
        char status;                    /* status of this request */
-        short retries;                  /* A retry counter */
+        char lpm;                       /* logical path mask */
        unsigned long flags;            /* flags of this request */
        struct dasd_queue *dq;
-        /* ... and how */
        unsigned long starttime;        /* jiffies time of request start */
        unsigned long expires;          /* expiration period in jiffies */
-        char lpm;                       /* logical path mask */
        void *data;                     /* pointer to data area */
-        /* these are important for recovering erroneous requests          */
-        int intrc;                      /* internal error, e.g. from start_IO */
        struct irb irb;                 /* device status in case of an error */
        struct dasd_ccw_req *refers;    /* ERP-chain queueing. */
        void *function;                 /* originating ERP action */
+        void *mem_chunk;
-        /* these are for statistics only */
        unsigned long buildclk;         /* TOD-clock of request generation */
        unsigned long startclk;         /* TOD-clock of request start */
        unsigned long stopclk;          /* TOD-clock of request interrupt */
        unsigned long endclk;           /* TOD-clock of request termination */
-        /* Callback that is called after reaching final status. */
        void (*callback)(struct dasd_ccw_req *, void *data);
        void *callback_data;
 };
@@ -714,19 +707,10 @@ extern const struct block_device_operations dasd_device_operations;
 extern struct kmem_cache *dasd_page_cache;
 struct dasd_ccw_req *
-dasd_kmalloc_request(int , int, int, struct dasd_device *);
+dasd_smalloc_request(int, int, int, struct dasd_device *, struct dasd_ccw_req *);
-struct dasd_ccw_req *
-dasd_smalloc_request(int , int, int, struct dasd_device *);
-void dasd_kfree_request(struct dasd_ccw_req *, struct dasd_device *);
 void dasd_sfree_request(struct dasd_ccw_req *, struct dasd_device *);
 void dasd_wakeup_cb(struct dasd_ccw_req *, void *);
-static inline int
-dasd_kmalloc_set_cda(struct ccw1 *ccw, void *cda, struct dasd_device *device)
-{
-        return set_normalized_cda(ccw, cda);
-}
 struct dasd_device *dasd_alloc_device(void);
 void dasd_free_device(struct dasd_device *);
diff --git a/drivers/s390/cio/Makefile b/drivers/s390/cio/Makefile
index a070ef0efe65..f230516abb96 100644
--- a/drivers/s390/cio/Makefile
+++ b/drivers/s390/cio/Makefile
@@ -5,6 +5,7 @@
 # The following is required for define_trace.h to find ./trace.h
 CFLAGS_trace.o := -I$(src)
+CFLAGS_vfio_ccw_fsm.o := -I$(src)
 obj-y += airq.o blacklist.o chsc.o cio.o css.o chp.o idset.o isc.o \
        fcx.o itcw.o crw.o ccwreq.o trace.o ioasm.o
diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
index dce92b2a895d..dbe7c7ac9ac8 100644
--- a/drivers/s390/cio/vfio_ccw_cp.c
+++ b/drivers/s390/cio/vfio_ccw_cp.c
@@ -23,9 +23,13 @@
 #define CCWCHAIN_LEN_MAX        256
 struct pfn_array {
+        /* Starting guest physical I/O address. */
        unsigned long           pa_iova;
+        /* Array that stores PFNs of the pages need to pin. */
        unsigned long           *pa_iova_pfn;
+        /* Array that receives PFNs of the pages pinned. */
        unsigned long           *pa_pfn;
+        /* Number of pages pinned from @pa_iova. */
        int                     pa_nr;
 };
@@ -46,70 +50,33 @@ struct ccwchain {
 };
 /*
- * pfn_array_pin() - pin user pages in memory
+ * pfn_array_alloc_pin() - alloc memory for PFNs, then pin user pages in memory
 * @pa: pfn_array on which to perform the operation
 * @mdev: the mediated device to perform pin/unpin operations
+ * @iova: target guest physical address
+ * @len: number of bytes that should be pinned from @iova
 *
- * Attempt to pin user pages in memory.
+ * Attempt to allocate memory for PFNs, and pin user pages in memory.
 *
 * Usage of pfn_array:
- * @pa->pa_iova     starting guest physical I/O address. Assigned by caller.
+ * We expect (pa_nr == 0) and (pa_iova_pfn == NULL), any field in
- * @pa->pa_iova_pfn array that stores PFNs of the pages need to pin. Allocated
+ * this structure will be filled in by this function.
- *                  by caller.
- * @pa->pa_pfn      array that receives PFNs of the pages pinned. Allocated by
- *                  caller.
- * @pa->pa_nr       number of pages from @pa->pa_iova to pin. Assigned by
- *                  caller.
- *                  number of pages pinned. Assigned by callee.
 *
 * Returns:
 *   Number of pages pinned on success.
- *   If @pa->pa_nr is 0 or negative, returns 0.
+ *   If @pa->pa_nr is not 0, or @pa->pa_iova_pfn is not NULL initially,
+ *   returns -EINVAL.
 *   If no pages were pinned, returns -errno.
 */
-static int pfn_array_pin(struct pfn_array *pa, struct device *mdev)
-{
-        int i, ret;
-        if (pa->pa_nr <= 0) {
-                pa->pa_nr = 0;
-                return 0;
-        }
-        pa->pa_iova_pfn[0] = pa->pa_iova >> PAGE_SHIFT;
-        for (i = 1; i < pa->pa_nr; i++)
-                pa->pa_iova_pfn[i] = pa->pa_iova_pfn[i - 1] + 1;
-        ret = vfio_pin_pages(mdev, pa->pa_iova_pfn, pa->pa_nr,
-                             IOMMU_READ | IOMMU_WRITE, pa->pa_pfn);
-        if (ret > 0 && ret != pa->pa_nr) {
-                vfio_unpin_pages(mdev, pa->pa_iova_pfn, ret);
-                pa->pa_nr = 0;
-                return 0;
-        }
-        return ret;
-}
-/* Unpin the pages before releasing the memory. */
-static void pfn_array_unpin_free(struct pfn_array *pa, struct device *mdev)
-{
-        vfio_unpin_pages(mdev, pa->pa_iova_pfn, pa->pa_nr);
-        pa->pa_nr = 0;
-        kfree(pa->pa_iova_pfn);
-}
-/* Alloc memory for PFNs, then pin pages with them. */
 static int pfn_array_alloc_pin(struct pfn_array *pa, struct device *mdev,
                               u64 iova, unsigned int len)
 {
-        int ret = 0;
+        int i, ret = 0;
        if (!len)
                return 0;
-        if (pa->pa_nr)
+        if (pa->pa_nr || pa->pa_iova_pfn)
                return -EINVAL;
        pa->pa_iova = iova;
@@ -126,18 +93,39 @@ static int pfn_array_alloc_pin(struct pfn_array *pa, struct device *mdev,
                return -ENOMEM;
        pa->pa_pfn = pa->pa_iova_pfn + pa->pa_nr;
-        ret = pfn_array_pin(pa, mdev);
+        pa->pa_iova_pfn[0] = pa->pa_iova >> PAGE_SHIFT;
+        for (i = 1; i < pa->pa_nr; i++)
+                pa->pa_iova_pfn[i] = pa->pa_iova_pfn[i - 1] + 1;
-        if (ret > 0)
+        ret = vfio_pin_pages(mdev, pa->pa_iova_pfn, pa->pa_nr,
-                return ret;
+                             IOMMU_READ | IOMMU_WRITE, pa->pa_pfn);
-        else if (!ret)
+        if (ret < 0) {
+                goto err_out;
+        } else if (ret > 0 && ret != pa->pa_nr) {
+                vfio_unpin_pages(mdev, pa->pa_iova_pfn, ret);
                ret = -EINVAL;
+                goto err_out;
+        }
+        return ret;
+err_out:
+        pa->pa_nr = 0;
        kfree(pa->pa_iova_pfn);
+        pa->pa_iova_pfn = NULL;
        return ret;
 }
+/* Unpin the pages before releasing the memory. */
+static void pfn_array_unpin_free(struct pfn_array *pa, struct device *mdev)
+{
+        vfio_unpin_pages(mdev, pa->pa_iova_pfn, pa->pa_nr);
+        pa->pa_nr = 0;
+        kfree(pa->pa_iova_pfn);
+}
 static int pfn_array_table_init(struct pfn_array_table *pat, int nr)
 {
        pat->pat_pa = kcalloc(nr, sizeof(*pat->pat_pa), GFP_KERNEL);
@@ -365,6 +353,9 @@ static void cp_unpin_free(struct channel_program *cp)
 * This is the chain length not considering any TICs.
 * You need to do a new round for each TIC target.
 *
+ * The program is also validated for absence of not yet supported
+ * indirect data addressing scenarios.
+ *
 * Returns: the length of the ccw chain or -errno.
 */
 static int ccwchain_calc_length(u64 iova, struct channel_program *cp)
@@ -391,6 +382,14 @@ static int ccwchain_calc_length(u64 iova, struct channel_program *cp)
        do {
                cnt++;
+                /*
+                 * As we don't want to fail direct addressing even if the
+                 * orb specified one of the unsupported formats, we defer
+                 * checking for IDAWs in unsupported formats to here.
+                 */
+                if ((!cp->orb.cmd.c64 || cp->orb.cmd.i2k) && ccw_is_idal(ccw))
+                        return -EOPNOTSUPP;
                if ((!ccw_is_chain(ccw)) && (!ccw_is_tic(ccw)))
                        break;
@@ -503,7 +502,7 @@ static int ccwchain_fetch_direct(struct ccwchain *chain,
        struct ccw1 *ccw;
        struct pfn_array_table *pat;
        unsigned long *idaws;
-        int idaw_nr;
+        int ret;
        ccw = chain->ch_ccw + idx;
@@ -523,18 +522,19 @@ static int ccwchain_fetch_direct(struct ccwchain *chain,
         * needed when translating a direct ccw to a idal ccw.
         */
        pat = chain->ch_pat + idx;
-        if (pfn_array_table_init(pat, 1))
+        ret = pfn_array_table_init(pat, 1);
-                return -ENOMEM;
+        if (ret)
-        idaw_nr = pfn_array_alloc_pin(pat->pat_pa, cp->mdev,
+                goto out_init;
-                                      ccw->cda, ccw->count);
-        if (idaw_nr < 0)
+        ret = pfn_array_alloc_pin(pat->pat_pa, cp->mdev, ccw->cda, ccw->count);
-                return idaw_nr;
+        if (ret < 0)
+                goto out_init;
        /* Translate this direct ccw to a idal ccw. */
-        idaws = kcalloc(idaw_nr, sizeof(*idaws), GFP_DMA | GFP_KERNEL);
+        idaws = kcalloc(ret, sizeof(*idaws), GFP_DMA | GFP_KERNEL);
        if (!idaws) {
-                pfn_array_table_unpin_free(pat, cp->mdev);
+                ret = -ENOMEM;
-                return -ENOMEM;
+                goto out_unpin;
        }
        ccw->cda = (__u32) virt_to_phys(idaws);
        ccw->flags |= CCW_FLAG_IDA;
@@ -542,6 +542,12 @@ static int ccwchain_fetch_direct(struct ccwchain *chain,
        pfn_array_table_idal_create_words(pat, idaws);
        return 0;
+out_unpin:
+        pfn_array_table_unpin_free(pat, cp->mdev);
+out_init:
+        ccw->cda = 0;
+        return ret;
 }
 static int ccwchain_fetch_idal(struct ccwchain *chain,
@@ -571,7 +577,7 @@ static int ccwchain_fetch_idal(struct ccwchain *chain,
        pat = chain->ch_pat + idx;
        ret = pfn_array_table_init(pat, idaw_nr);
        if (ret)
-                return ret;
+                goto out_init;
        /* Translate idal ccw to use new allocated idaws. */
        idaws = kzalloc(idaw_len, GFP_DMA | GFP_KERNEL);
@@ -603,6 +609,8 @@ out_free_idaws:
        kfree(idaws);
 out_unpin:
        pfn_array_table_unpin_free(pat, cp->mdev);
+out_init:
+        ccw->cda = 0;
        return ret;
 }
@@ -656,10 +664,8 @@ int cp_init(struct channel_program *cp, struct device *mdev, union orb *orb)
        /*
         * XXX:
         * Only support prefetch enable mode now.
-         * Only support 64bit addressing idal.
-         * Only support 4k IDAW.
         */
-        if (!orb->cmd.pfch || !orb->cmd.c64 || orb->cmd.i2k)
+        if (!orb->cmd.pfch)
                return -EOPNOTSUPP;
        INIT_LIST_HEAD(&cp->ccwchain_list);
@@ -688,6 +694,10 @@ int cp_init(struct channel_program *cp, struct device *mdev, union orb *orb)
        ret = ccwchain_loop_tic(chain, cp);
        if (ret)
                cp_unpin_free(cp);
+        /* It is safe to force: if not set but idals used
+         * ccwchain_calc_length returns an error.
+         */
+        cp->orb.cmd.c64 = 1;
        return ret;
 }
diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
index ea6a2d0b2894..770fa9cfc310 100644
--- a/drivers/s390/cio/vfio_ccw_drv.c
+++ b/drivers/s390/cio/vfio_ccw_drv.c
@@ -177,6 +177,7 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process)
 {
        struct vfio_ccw_private *private = dev_get_drvdata(&sch->dev);
        unsigned long flags;
+        int rc = -EAGAIN;
        spin_lock_irqsave(sch->lock, flags);
        if (!device_is_registered(&sch->dev))
@@ -187,6 +188,7 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process)
        if (cio_update_schib(sch)) {
                vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER);
+                rc = 0;
                goto out_unlock;
        }
@@ -195,11 +197,12 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process)
                private->state = private->mdev ? VFIO_CCW_STATE_IDLE :
                                 VFIO_CCW_STATE_STANDBY;
        }
+        rc = 0;
 out_unlock:
        spin_unlock_irqrestore(sch->lock, flags);
-        return 0;
+        return rc;
 }
 static struct css_device_id vfio_ccw_sch_ids[] = {
diff --git a/drivers/s390/cio/vfio_ccw_fsm.c b/drivers/s390/cio/vfio_ccw_fsm.c
index 3c800642134e..797a82731159 100644
--- a/drivers/s390/cio/vfio_ccw_fsm.c
+++ b/drivers/s390/cio/vfio_ccw_fsm.c
@@ -13,6 +13,9 @@
 #include "ioasm.h"
 #include "vfio_ccw_private.h"
+#define CREATE_TRACE_POINTS
+#include "vfio_ccw_trace.h"
 static int fsm_io_helper(struct vfio_ccw_private *private)
 {
        struct subchannel *sch;
@@ -110,6 +113,10 @@ static void fsm_disabled_irq(struct vfio_ccw_private *private,
         */
        cio_disable_subchannel(sch);
 }
+inline struct subchannel_id get_schid(struct vfio_ccw_private *p)
+{
+        return p->sch->schid;
+}
 /*
 * Deal with the ccw command request from the userspace.
@@ -121,6 +128,7 @@ static void fsm_io_request(struct vfio_ccw_private *private,
        union scsw *scsw = &private->scsw;
        struct ccw_io_region *io_region = &private->io_region;
        struct mdev_device *mdev = private->mdev;
+        char *errstr = "request";
        private->state = VFIO_CCW_STATE_BOXED;
@@ -132,15 +140,19 @@ static void fsm_io_request(struct vfio_ccw_private *private,
                /* Don't try to build a cp if transport mode is specified. */
                if (orb->tm.b) {
                        io_region->ret_code = -EOPNOTSUPP;
+                        errstr = "transport mode";
                        goto err_out;
                }
                io_region->ret_code = cp_init(&private->cp, mdev_dev(mdev),
                                              orb);
-                if (io_region->ret_code)
+                if (io_region->ret_code) {
+                        errstr = "cp init";
                        goto err_out;
+                }
                io_region->ret_code = cp_prefetch(&private->cp);
                if (io_region->ret_code) {
+                        errstr = "cp prefetch";
                        cp_free(&private->cp);
                        goto err_out;
                }
@@ -148,6 +160,7 @@ static void fsm_io_request(struct vfio_ccw_private *private,
                /* Start channel program and wait for I/O interrupt. */
                io_region->ret_code = fsm_io_helper(private);
                if (io_region->ret_code) {
+                        errstr = "cp fsm_io_helper";
                        cp_free(&private->cp);
                        goto err_out;
                }
@@ -164,6 +177,8 @@ static void fsm_io_request(struct vfio_ccw_private *private,
 err_out:
        private->state = VFIO_CCW_STATE_IDLE;
+        trace_vfio_ccw_io_fctl(scsw->cmd.fctl, get_schid(private),
+                               io_region->ret_code, errstr);
 }
 /*
diff --git a/drivers/s390/cio/vfio_ccw_trace.h b/drivers/s390/cio/vfio_ccw_trace.h
new file mode 100644
index 000000000000..b1da53ddec1f
--- /dev/null
+++ b/drivers/s390/cio/vfio_ccw_trace.h
@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: GPL-2.0
+ * Tracepoints for vfio_ccw driver
+ *
+ * Copyright IBM Corp. 2018
+ *
+ * Author(s): Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com>
+ *            Halil Pasic <pasic@linux.vnet.ibm.com>
+ */
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM vfio_ccw
+#if !defined(_VFIO_CCW_TRACE_) || defined(TRACE_HEADER_MULTI_READ)
+#define _VFIO_CCW_TRACE_
+#include <linux/tracepoint.h>
+TRACE_EVENT(vfio_ccw_io_fctl,
+        TP_PROTO(int fctl, struct subchannel_id schid, int errno, char *errstr),
+        TP_ARGS(fctl, schid, errno, errstr),
+        TP_STRUCT__entry(
+                __field(int, fctl)
+                __field_struct(struct subchannel_id, schid)
+                __field(int, errno)
+                __field(char*, errstr)
+        ),
+        TP_fast_assign(
+                __entry->fctl = fctl;
+                __entry->schid = schid;
+                __entry->errno = errno;
+                __entry->errstr = errstr;
+        ),
+        TP_printk("schid=%x.%x.%04x fctl=%x errno=%d info=%s",
+                  __entry->schid.cssid,
+                  __entry->schid.ssid,
+                  __entry->schid.sch_no,
+                  __entry->fctl,
+                  __entry->errno,
+                  __entry->errstr)
+);
+#endif /* _VFIO_CCW_TRACE_ */
+/* This part must be outside protection */
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE vfio_ccw_trace
+#include <trace/define_trace.h>
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 0a9b8b387bd2..02d65dce74e5 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -760,7 +760,6 @@ static void ipr_mask_and_clear_interrupts(struct ipr_ioa_cfg *ioa_cfg,
                ioa_cfg->hrrq[i].allow_interrupts = 0;
                spin_unlock(&ioa_cfg->hrrq[i]._lock);
        }
-        wmb();
        /* Set interrupt mask to stop all new interrupts */
        if (ioa_cfg->sis64)
@@ -8403,7 +8402,6 @@ static int ipr_reset_enable_ioa(struct ipr_cmnd *ipr_cmd)
                ioa_cfg->hrrq[i].allow_interrupts = 1;
                spin_unlock(&ioa_cfg->hrrq[i]._lock);
        }
-        wmb();
        if (ioa_cfg->sis64) {
                /* Set the adapter to the correct endian mode. */
                writel(IPR_ENDIAN_SWAP_KEY, ioa_cfg->regs.endian_swap_reg);
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 0fea2e2326be..1027b0cb7fa3 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -1224,7 +1224,6 @@ static void qla24xx_chk_fcp_state(struct fc_port *sess)
 void qlt_schedule_sess_for_deletion(struct fc_port *sess)
 {
        struct qla_tgt *tgt = sess->tgt;
-        struct qla_hw_data *ha = sess->vha->hw;
        unsigned long flags;
        if (sess->disc_state == DSC_DELETE_PEND)
@@ -1241,16 +1240,16 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess)
                        return;
        }
-        spin_lock_irqsave(&ha->tgt.sess_lock, flags);
        if (sess->deleted == QLA_SESS_DELETED)
                sess->logout_on_delete = 0;
+        spin_lock_irqsave(&sess->vha->work_lock, flags);
        if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
-                spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
+                spin_unlock_irqrestore(&sess->vha->work_lock, flags);
                return;
        }
        sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
-        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
+        spin_unlock_irqrestore(&sess->vha->work_lock, flags);
        sess->disc_state = DSC_DELETE_PEND;
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 24d7496cd9e2..364e71861bfd 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -5507,9 +5507,9 @@ static void __exit scsi_debug_exit(void)
        int k = sdebug_add_host;
        stop_all_queued();
-        free_all_queued();
        for (; k; k--)
                sdebug_remove_adapter();
+        free_all_queued();
        driver_unregister(&sdebug_driverfs_driver);
        bus_unregister(&pseudo_lld_bus);
        root_device_unregister(pseudo_primary);
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 1da3d71e9f61..13948102ca29 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3592,7 +3592,7 @@ fc_bsg_job_timeout(struct request *req)
        /* the blk_end_sync_io() doesn't check the error */
        if (inflight)
-                blk_mq_complete_request(req);
+                __blk_complete_request(req);
        return BLK_EH_DONE;
 }
diff --git a/drivers/scsi/xen-scsifront.c b/drivers/scsi/xen-scsifront.c
index 36f59a1be7e9..61389bdc7926 100644
--- a/drivers/scsi/xen-scsifront.c
+++ b/drivers/scsi/xen-scsifront.c
@@ -654,10 +654,17 @@ static int scsifront_dev_reset_handler(struct scsi_cmnd *sc)
 static int scsifront_sdev_configure(struct scsi_device *sdev)
 {
        struct vscsifrnt_info *info = shost_priv(sdev->host);
+        int err;
-        if (info && current == info->curr)
+        if (info && current == info->curr) {
-                xenbus_printf(XBT_NIL, info->dev->nodename,
+                err = xenbus_printf(XBT_NIL, info->dev->nodename,
                              info->dev_state_path, "%d", XenbusStateConnected);
+                if (err) {
+                        xenbus_dev_error(info->dev, err,
+                                "%s: writing dev_state_path", __func__);
+                        return err;
+                }
+        }
        return 0;
 }
@@ -665,10 +672,15 @@ static int scsifront_sdev_configure(struct scsi_device *sdev)
 static void scsifront_sdev_destroy(struct scsi_device *sdev)
 {
        struct vscsifrnt_info *info = shost_priv(sdev->host);
+        int err;
-        if (info && current == info->curr)
+        if (info && current == info->curr) {
-                xenbus_printf(XBT_NIL, info->dev->nodename,
+                err = xenbus_printf(XBT_NIL, info->dev->nodename,
                              info->dev_state_path, "%d", XenbusStateClosed);
+                if (err)
+                        xenbus_dev_error(info->dev, err,
+                                "%s: writing dev_state_path", __func__);
+        }
 }
 static struct scsi_host_template scsifront_sht = {
@@ -1003,9 +1015,12 @@ static void scsifront_do_lun_hotplug(struct vscsifrnt_info *info, int op)
                        if (scsi_add_device(info->host, chn, tgt, lun)) {
                                dev_err(&dev->dev, "scsi_add_device\n");
-                                xenbus_printf(XBT_NIL, dev->nodename,
+                                err = xenbus_printf(XBT_NIL, dev->nodename,
                                              info->dev_state_path,
                                              "%d", XenbusStateClosed);
+                                if (err)
+                                        xenbus_dev_error(dev, err,
+                                                "%s: writing dev_state_path", __func__);
                        }
                        break;
                case VSCSIFRONT_OP_DEL_LUN:
@@ -1019,10 +1034,14 @@ static void scsifront_do_lun_hotplug(struct vscsifrnt_info *info, int op)
                        }
                        break;
                case VSCSIFRONT_OP_READD_LUN:
-                        if (device_state == XenbusStateConnected)
+                        if (device_state == XenbusStateConnected) {
-                                xenbus_printf(XBT_NIL, dev->nodename,
+                                err = xenbus_printf(XBT_NIL, dev->nodename,
                                              info->dev_state_path,
                                              "%d", XenbusStateConnected);
+                                if (err)
+                                        xenbus_dev_error(dev, err,
+                                                "%s: writing dev_state_path", __func__);
+                        }
                        break;
                default:
                        break;
diff --git a/drivers/soc/bcm/brcmstb/pm/pm-arm.c b/drivers/soc/bcm/brcmstb/pm/pm-arm.c
index dcf8c8065508..a5577dd5eb08 100644
--- a/drivers/soc/bcm/brcmstb/pm/pm-arm.c
+++ b/drivers/soc/bcm/brcmstb/pm/pm-arm.c
@@ -628,10 +628,26 @@ static const struct of_device_id ddr_shimphy_dt_ids[] = {
 static const struct of_device_id brcmstb_memc_of_match[] = {
        {
+                .compatible = "brcm,brcmstb-memc-ddr-rev-b.2.1",
+                .data = &ddr_seq,
+        },
+        {
                .compatible = "brcm,brcmstb-memc-ddr-rev-b.2.2",
                .data = &ddr_seq_b22,
        },
        {
+                .compatible = "brcm,brcmstb-memc-ddr-rev-b.2.3",
+                .data = &ddr_seq_b22,
+        },
+        {
+                .compatible = "brcm,brcmstb-memc-ddr-rev-b.3.0",
+                .data = &ddr_seq_b22,
+        },
+        {
+                .compatible = "brcm,brcmstb-memc-ddr-rev-b.3.1",
+                .data = &ddr_seq_b22,
+        },
+        {
                .compatible = "brcm,brcmstb-memc-ddr",
                .data = &ddr_seq,
        },
diff --git a/drivers/soc/imx/gpcv2.c b/drivers/soc/imx/gpcv2.c
index f4e3bd40c72e..6ef18cf8f243 100644
--- a/drivers/soc/imx/gpcv2.c
+++ b/drivers/soc/imx/gpcv2.c
@@ -39,10 +39,15 @@
 #define GPC_M4_PU_PDN_FLG               0x1bc
+/*
-#define PGC_MIPI                        4
+ * The PGC offset values in Reference Manual
-#define PGC_PCIE                        5
+ * (Rev. 1, 01/2018 and the older ones) GPC chapter's
-#define PGC_USB_HSIC                    8
+ * GPC_PGC memory map are incorrect, below offset
+ * values are from design RTL.
+ */
+#define PGC_MIPI                        16
+#define PGC_PCIE                        17
+#define PGC_USB_HSIC                    20
 #define GPC_PGC_CTRL(n)                 (0x800 + (n) * 0x40)
 #define GPC_PGC_SR(n)                   (GPC_PGC_CTRL(n) + 0xc)
diff --git a/drivers/soc/qcom/Kconfig b/drivers/soc/qcom/Kconfig
index 9dc02f390ba3..5856e792d09c 100644
--- a/drivers/soc/qcom/Kconfig
+++ b/drivers/soc/qcom/Kconfig
@@ -5,7 +5,8 @@ menu "Qualcomm SoC drivers"
 config QCOM_COMMAND_DB
        bool "Qualcomm Command DB"
-        depends on (ARCH_QCOM && OF) || COMPILE_TEST
+        depends on ARCH_QCOM || COMPILE_TEST
+        depends on OF_RESERVED_MEM
        help
          Command DB queries shared memory by key string for shared system
          resources. Platform drivers that require to set state of a shared
diff --git a/drivers/soc/renesas/rcar-sysc.c b/drivers/soc/renesas/rcar-sysc.c
index 95120acc4d80..50d03d8b4f9a 100644
--- a/drivers/soc/renesas/rcar-sysc.c
+++ b/drivers/soc/renesas/rcar-sysc.c
@@ -194,11 +194,12 @@ static int rcar_sysc_pd_power_on(struct generic_pm_domain *genpd)
 static bool has_cpg_mstp;
-static void __init rcar_sysc_pd_setup(struct rcar_sysc_pd *pd)
+static int __init rcar_sysc_pd_setup(struct rcar_sysc_pd *pd)
 {
        struct generic_pm_domain *genpd = &pd->genpd;
        const char *name = pd->genpd.name;
        struct dev_power_governor *gov = &simple_qos_governor;
+        int error;
        if (pd->flags & PD_CPU) {
                /*
@@ -251,7 +252,11 @@ static void __init rcar_sysc_pd_setup(struct rcar_sysc_pd *pd)
        rcar_sysc_power_up(&pd->ch);
 finalize:
-        pm_genpd_init(genpd, gov, false);
+        error = pm_genpd_init(genpd, gov, false);
+        if (error)
+                pr_err("Failed to init PM domain %s: %d\n", name, error);
+        return error;
 }
 static const struct of_device_id rcar_sysc_matches[] __initconst = {
@@ -375,6 +380,9 @@ static int __init rcar_sysc_pd_init(void)
        pr_debug("%pOF: syscier = 0x%08x\n", np, syscier);
        iowrite32(syscier, base + SYSCIER);
+        /*
+         * First, create all PM domains
+         */
        for (i = 0; i < info->num_areas; i++) {
                const struct rcar_sysc_area *area = &info->areas[i];
                struct rcar_sysc_pd *pd;
@@ -397,14 +405,29 @@ static int __init rcar_sysc_pd_init(void)
                pd->ch.isr_bit = area->isr_bit;
                pd->flags = area->flags;
-                rcar_sysc_pd_setup(pd);
+                error = rcar_sysc_pd_setup(pd);
-                if (area->parent >= 0)
+                if (error)
-                        pm_genpd_add_subdomain(domains->domains[area->parent],
+                        goto out_put;
-                                               &pd->genpd);
                domains->domains[area->isr_bit] = &pd->genpd;
        }
+        /*
+         * Second, link all PM domains to their parents
+         */
+        for (i = 0; i < info->num_areas; i++) {
+                const struct rcar_sysc_area *area = &info->areas[i];
+                if (!area->name || area->parent < 0)
+                        continue;
+                error = pm_genpd_add_subdomain(domains->domains[area->parent],
+                                               domains->domains[area->isr_bit]);
+                if (error)
+                        pr_warn("Failed to add PM subdomain %s to parent %u\n",
+                                area->name, area->parent);
+        }
        error = of_genpd_add_provider_onecell(np, &domains->onecell_data);
 out_put:
diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c
index 369aef5e7228..f5cb8c0af09f 100644
--- a/drivers/soc/ti/wkup_m3_ipc.c
+++ b/drivers/soc/ti/wkup_m3_ipc.c
@@ -46,6 +46,7 @@
 #define M3_BASELINE_VERSION             0x191
 #define M3_STATUS_RESP_MASK             (0xffff << 16)
 #define M3_FW_VERSION_MASK              0xffff
+#define M3_WAKE_SRC_MASK                0xff
 #define M3_STATE_UNKNOWN                0
 #define M3_STATE_RESET                  1
@@ -55,6 +56,23 @@
 static struct wkup_m3_ipc *m3_ipc_state;
+static const struct wkup_m3_wakeup_src wakeups[] = {
+        {.irq_nr = 35,  .src = "USB0_PHY"},
+        {.irq_nr = 36,  .src = "USB1_PHY"},
+        {.irq_nr = 40,  .src = "I2C0"},
+        {.irq_nr = 41,  .src = "RTC Timer"},
+        {.irq_nr = 42,  .src = "RTC Alarm"},
+        {.irq_nr = 43,  .src = "Timer0"},
+        {.irq_nr = 44,  .src = "Timer1"},
+        {.irq_nr = 45,  .src = "UART"},
+        {.irq_nr = 46,  .src = "GPIO0"},
+        {.irq_nr = 48,  .src = "MPU_WAKE"},
+        {.irq_nr = 49,  .src = "WDT0"},
+        {.irq_nr = 50,  .src = "WDT1"},
+        {.irq_nr = 51,  .src = "ADC_TSC"},
+        {.irq_nr = 0,   .src = "Unknown"},
+};
 static void am33xx_txev_eoi(struct wkup_m3_ipc *m3_ipc)
 {
        writel(AM33XX_M3_TXEV_ACK,
@@ -329,12 +347,45 @@ static int wkup_m3_finish_low_power(struct wkup_m3_ipc *m3_ipc)
        return 0;
 }
+/**
+ * wkup_m3_request_wake_src - Get the wakeup source info passed from wkup_m3
+ * @m3_ipc: Pointer to wkup_m3_ipc context
+ */
+static const char *wkup_m3_request_wake_src(struct wkup_m3_ipc *m3_ipc)
+{
+        unsigned int wakeup_src_idx;
+        int j, val;
+        val = wkup_m3_ctrl_ipc_read(m3_ipc, 6);
+        wakeup_src_idx = val & M3_WAKE_SRC_MASK;
+        for (j = 0; j < ARRAY_SIZE(wakeups) - 1; j++) {
+                if (wakeups[j].irq_nr == wakeup_src_idx)
+                        return wakeups[j].src;
+        }
+        return wakeups[j].src;
+}
+/**
+ * wkup_m3_set_rtc_only - Set the rtc_only flag
+ * @wkup_m3_wakeup: struct wkup_m3_wakeup_src * gets assigned the
+ *                  wakeup src value
+ */
+static void wkup_m3_set_rtc_only(struct wkup_m3_ipc *m3_ipc)
+{
+        if (m3_ipc_state)
+                m3_ipc_state->is_rtc_only = true;
+}
 static struct wkup_m3_ipc_ops ipc_ops = {
        .set_mem_type = wkup_m3_set_mem_type,
        .set_resume_address = wkup_m3_set_resume_address,
        .prepare_low_power = wkup_m3_prepare_low_power,
        .finish_low_power = wkup_m3_finish_low_power,
        .request_pm_status = wkup_m3_request_pm_status,
+        .request_wake_src = wkup_m3_request_wake_src,
+        .set_rtc_only = wkup_m3_set_rtc_only,
 };
 /**
@@ -484,6 +535,30 @@ static int wkup_m3_ipc_remove(struct platform_device *pdev)
        return 0;
 }
+static int __maybe_unused wkup_m3_ipc_suspend(struct device *dev)
+{
+        /*
+         * Nothing needs to be done on suspend even with rtc_only flag set
+         */
+        return 0;
+}
+static int __maybe_unused wkup_m3_ipc_resume(struct device *dev)
+{
+        if (m3_ipc_state->is_rtc_only) {
+                rproc_shutdown(m3_ipc_state->rproc);
+                rproc_boot(m3_ipc_state->rproc);
+        }
+        m3_ipc_state->is_rtc_only = false;
+        return 0;
+}
+static const struct dev_pm_ops wkup_m3_ipc_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(wkup_m3_ipc_suspend, wkup_m3_ipc_resume)
+};
 static const struct of_device_id wkup_m3_ipc_of_match[] = {
        { .compatible = "ti,am3352-wkup-m3-ipc", },
        { .compatible = "ti,am4372-wkup-m3-ipc", },
@@ -497,6 +572,7 @@ static struct platform_driver wkup_m3_ipc_driver = {
        .driver = {
                .name = "wkup_m3_ipc",
                .of_match_table = wkup_m3_ipc_of_match,
+                .pm = &wkup_m3_ipc_pm_ops,
        },
 };
diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c
index e8c440329708..31db510018a9 100644
--- a/drivers/staging/android/ion/ion_heap.c
+++ b/drivers/staging/android/ion/ion_heap.c
@@ -30,7 +30,7 @@ void *ion_heap_map_kernel(struct ion_heap *heap,
        struct page **tmp = pages;
        if (!pages)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        if (buffer->flags & ION_FLAG_CACHED)
                pgprot = PAGE_KERNEL;
diff --git a/drivers/staging/comedi/drivers/quatech_daqp_cs.c b/drivers/staging/comedi/drivers/quatech_daqp_cs.c
index ea194aa01a64..257b0daff01f 100644
--- a/drivers/staging/comedi/drivers/quatech_daqp_cs.c
+++ b/drivers/staging/comedi/drivers/quatech_daqp_cs.c
@@ -642,7 +642,7 @@ static int daqp_ao_insn_write(struct comedi_device *dev,
        /* Make sure D/A update mode is direct update */
        outb(0, dev->iobase + DAQP_AUX_REG);
-        for (i = 0; i > insn->n; i++) {
+        for (i = 0; i < insn->n; i++) {
                unsigned int val = data[i];
                int ret;
diff --git a/drivers/staging/typec/Kconfig b/drivers/staging/typec/Kconfig
index 3aa981fbc8f5..e45ed08a5166 100644
--- a/drivers/staging/typec/Kconfig
+++ b/drivers/staging/typec/Kconfig
@@ -11,6 +11,7 @@ config TYPEC_TCPCI
 config TYPEC_RT1711H
        tristate "Richtek RT1711H Type-C chip driver"
+        depends on I2C
        select TYPEC_TCPCI
        help
          Richtek RT1711H Type-C chip driver that works with
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 7f96dfa32b9c..d8dc3d22051f 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -656,7 +656,7 @@ static void scatter_data_area(struct tcmu_dev *udev,
 }
 static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
-                             bool bidi)
+                             bool bidi, uint32_t read_len)
 {
        struct se_cmd *se_cmd = cmd->se_cmd;
        int i, dbi;
@@ -689,7 +689,7 @@ static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
        for_each_sg(data_sg, sg, data_nents, i) {
                int sg_remaining = sg->length;
                to = kmap_atomic(sg_page(sg)) + sg->offset;
-                while (sg_remaining > 0) {
+                while (sg_remaining > 0 && read_len > 0) {
                        if (block_remaining == 0) {
                                if (from)
                                        kunmap_atomic(from);
@@ -701,6 +701,8 @@ static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
                        }
                        copy_bytes = min_t(size_t, sg_remaining,
                                        block_remaining);
+                        if (read_len < copy_bytes)
+                                copy_bytes = read_len;
                        offset = DATA_BLOCK_SIZE - block_remaining;
                        tcmu_flush_dcache_range(from, copy_bytes);
                        memcpy(to + sg->length - sg_remaining, from + offset,
@@ -708,8 +710,11 @@ static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
                        sg_remaining -= copy_bytes;
                        block_remaining -= copy_bytes;
+                        read_len -= copy_bytes;
                }
                kunmap_atomic(to - sg->offset);
+                if (read_len == 0)
+                        break;
        }
        if (from)
                kunmap_atomic(from);
@@ -1042,6 +1047,8 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
 {
        struct se_cmd *se_cmd = cmd->se_cmd;
        struct tcmu_dev *udev = cmd->tcmu_dev;
+        bool read_len_valid = false;
+        uint32_t read_len = se_cmd->data_length;
        /*
         * cmd has been completed already from timeout, just reclaim
@@ -1056,13 +1063,28 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
                pr_warn("TCMU: Userspace set UNKNOWN_OP flag on se_cmd %p\n",
                        cmd->se_cmd);
                entry->rsp.scsi_status = SAM_STAT_CHECK_CONDITION;
-        } else if (entry->rsp.scsi_status == SAM_STAT_CHECK_CONDITION) {
+                goto done;
+        }
+        if (se_cmd->data_direction == DMA_FROM_DEVICE &&
+            (entry->hdr.uflags & TCMU_UFLAG_READ_LEN) && entry->rsp.read_len) {
+                read_len_valid = true;
+                if (entry->rsp.read_len < read_len)
+                        read_len = entry->rsp.read_len;
+        }
+        if (entry->rsp.scsi_status == SAM_STAT_CHECK_CONDITION) {
                transport_copy_sense_to_cmd(se_cmd, entry->rsp.sense_buffer);
-        } else if (se_cmd->se_cmd_flags & SCF_BIDI) {
+                if (!read_len_valid )
+                        goto done;
+                else
+                        se_cmd->se_cmd_flags |= SCF_TREAT_READ_AS_NORMAL;
+        }
+        if (se_cmd->se_cmd_flags & SCF_BIDI) {
                /* Get Data-In buffer before clean up */
-                gather_data_area(udev, cmd, true);
+                gather_data_area(udev, cmd, true, read_len);
        } else if (se_cmd->data_direction == DMA_FROM_DEVICE) {
-                gather_data_area(udev, cmd, false);
+                gather_data_area(udev, cmd, false, read_len);
        } else if (se_cmd->data_direction == DMA_TO_DEVICE) {
                /* TODO: */
        } else if (se_cmd->data_direction != DMA_NONE) {
@@ -1070,7 +1092,13 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
                        se_cmd->data_direction);
        }
-        target_complete_cmd(cmd->se_cmd, entry->rsp.scsi_status);
+done:
+        if (read_len_valid) {
+                pr_debug("read_len = %d\n", read_len);
+                target_complete_cmd_with_length(cmd->se_cmd,
+                                        entry->rsp.scsi_status, read_len);
+        } else
+                target_complete_cmd(cmd->se_cmd, entry->rsp.scsi_status);
 out:
        cmd->se_cmd = NULL;
@@ -1740,7 +1768,7 @@ static int tcmu_configure_device(struct se_device *dev)
        /* Initialise the mailbox of the ring buffer */
        mb = udev->mb_addr;
        mb->version = TCMU_MAILBOX_VERSION;
-        mb->flags = TCMU_MAILBOX_FLAG_CAP_OOOC;
+        mb->flags = TCMU_MAILBOX_FLAG_CAP_OOOC | TCMU_MAILBOX_FLAG_CAP_READ_LEN;
        mb->cmdr_off = CMDR_OFF;
        mb->cmdr_size = udev->cmdr_size;
diff --git a/drivers/tee/optee/Kconfig b/drivers/tee/optee/Kconfig
index 0126de898036..3c59e19029be 100644
--- a/drivers/tee/optee/Kconfig
+++ b/drivers/tee/optee/Kconfig
@@ -5,3 +5,11 @@ config OPTEE
        help
          This implements the OP-TEE Trusted Execution Environment (TEE)
          driver.
+config OPTEE_SHM_NUM_PRIV_PAGES
+        int "Private Shared Memory Pages"
+        default 1
+        depends on OPTEE
+        help
+          This sets the number of private shared memory pages to be
+          used by OP-TEE TEE driver.
diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
index e5fd5ed217da..e1aafe842d66 100644
--- a/drivers/tee/optee/core.c
+++ b/drivers/tee/optee/core.c
@@ -32,7 +32,7 @@
 #define DRIVER_NAME "optee"
-#define OPTEE_SHM_NUM_PRIV_PAGES        1
+#define OPTEE_SHM_NUM_PRIV_PAGES        CONFIG_OPTEE_SHM_NUM_PRIV_PAGES
 /**
 * optee_from_msg_param() - convert from OPTEE_MSG parameters to
diff --git a/drivers/tee/optee/rpc.c b/drivers/tee/optee/rpc.c
index 41aea12e2bcc..b45c73dd37a5 100644
--- a/drivers/tee/optee/rpc.c
+++ b/drivers/tee/optee/rpc.c
@@ -48,7 +48,7 @@ static void handle_rpc_func_cmd_get_time(struct optee_msg_arg *arg)
                        OPTEE_MSG_ATTR_TYPE_VALUE_OUTPUT)
                goto bad;
-        getnstimeofday64(&ts);
+        ktime_get_real_ts64(&ts);
        arg->params[0].u.value.a = ts.tv_sec;
        arg->params[0].u.value.b = ts.tv_nsec;
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index cbe98bc2b998..431742201709 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -124,6 +124,8 @@ struct n_tty_data {
        struct mutex output_lock;
 };
+#define MASK(x) ((x) & (N_TTY_BUF_SIZE - 1))
 static inline size_t read_cnt(struct n_tty_data *ldata)
 {
        return ldata->read_head - ldata->read_tail;
@@ -141,6 +143,7 @@ static inline unsigned char *read_buf_addr(struct n_tty_data *ldata, size_t i)
 static inline unsigned char echo_buf(struct n_tty_data *ldata, size_t i)
 {
+        smp_rmb(); /* Matches smp_wmb() in add_echo_byte(). */
        return ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
 }
@@ -316,9 +319,7 @@ static inline void put_tty_queue(unsigned char c, struct n_tty_data *ldata)
 static void reset_buffer_flags(struct n_tty_data *ldata)
 {
        ldata->read_head = ldata->canon_head = ldata->read_tail = 0;
-        ldata->echo_head = ldata->echo_tail = ldata->echo_commit = 0;
        ldata->commit_head = 0;
-        ldata->echo_mark = 0;
        ldata->line_start = 0;
        ldata->erasing = 0;
@@ -617,13 +618,20 @@ static size_t __process_echoes(struct tty_struct *tty)
        old_space = space = tty_write_room(tty);
        tail = ldata->echo_tail;
-        while (ldata->echo_commit != tail) {
+        while (MASK(ldata->echo_commit) != MASK(tail)) {
                c = echo_buf(ldata, tail);
                if (c == ECHO_OP_START) {
                        unsigned char op;
                        int no_space_left = 0;
                        /*
+                         * Since add_echo_byte() is called without holding
+                         * output_lock, we might see only portion of multi-byte
+                         * operation.
+                         */
+                        if (MASK(ldata->echo_commit) == MASK(tail + 1))
+                                goto not_yet_stored;
+                        /*
                         * If the buffer byte is the start of a multi-byte
                         * operation, get the next byte, which is either the
                         * op code or a control character value.
@@ -634,6 +642,8 @@ static size_t __process_echoes(struct tty_struct *tty)
                                unsigned int num_chars, num_bs;
                        case ECHO_OP_ERASE_TAB:
+                                if (MASK(ldata->echo_commit) == MASK(tail + 2))
+                                        goto not_yet_stored;
                                num_chars = echo_buf(ldata, tail + 2);
                                /*
@@ -728,7 +738,8 @@ static size_t __process_echoes(struct tty_struct *tty)
        /* If the echo buffer is nearly full (so that the possibility exists
         * of echo overrun before the next commit), then discard enough
         * data at the tail to prevent a subsequent overrun */
-        while (ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
+        while (ldata->echo_commit > tail &&
+               ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
                if (echo_buf(ldata, tail) == ECHO_OP_START) {
                        if (echo_buf(ldata, tail + 1) == ECHO_OP_ERASE_TAB)
                                tail += 3;
@@ -738,6 +749,7 @@ static size_t __process_echoes(struct tty_struct *tty)
                        tail++;
        }
+ not_yet_stored:
        ldata->echo_tail = tail;
        return old_space - space;
 }
@@ -748,6 +760,7 @@ static void commit_echoes(struct tty_struct *tty)
        size_t nr, old, echoed;
        size_t head;
+        mutex_lock(&ldata->output_lock);
        head = ldata->echo_head;
        ldata->echo_mark = head;
        old = ldata->echo_commit - ldata->echo_tail;
@@ -756,10 +769,12 @@ static void commit_echoes(struct tty_struct *tty)
         * is over the threshold (and try again each time another
         * block is accumulated) */
        nr = head - ldata->echo_tail;
-        if (nr < ECHO_COMMIT_WATERMARK || (nr % ECHO_BLOCK > old % ECHO_BLOCK))
+        if (nr < ECHO_COMMIT_WATERMARK ||
+            (nr % ECHO_BLOCK > old % ECHO_BLOCK)) {
+                mutex_unlock(&ldata->output_lock);
                return;
+        }
-        mutex_lock(&ldata->output_lock);
        ldata->echo_commit = head;
        echoed = __process_echoes(tty);
        mutex_unlock(&ldata->output_lock);
@@ -810,7 +825,9 @@ static void flush_echoes(struct tty_struct *tty)
 static inline void add_echo_byte(unsigned char c, struct n_tty_data *ldata)
 {
-        *echo_buf_addr(ldata, ldata->echo_head++) = c;
+        *echo_buf_addr(ldata, ldata->echo_head) = c;
+        smp_wmb(); /* Matches smp_rmb() in echo_buf(). */
+        ldata->echo_head++;
 }
 /**
@@ -978,14 +995,15 @@ static void eraser(unsigned char c, struct tty_struct *tty)
        }
        seen_alnums = 0;
-        while (ldata->read_head != ldata->canon_head) {
+        while (MASK(ldata->read_head) != MASK(ldata->canon_head)) {
                head = ldata->read_head;
                /* erase a single possibly multibyte character */
                do {
                        head--;
                        c = read_buf(ldata, head);
-                } while (is_continuation(c, tty) && head != ldata->canon_head);
+                } while (is_continuation(c, tty) &&
+                         MASK(head) != MASK(ldata->canon_head));
                /* do not partially erase */
                if (is_continuation(c, tty))
@@ -1027,7 +1045,7 @@ static void eraser(unsigned char c, struct tty_struct *tty)
                                 * This info is used to go back the correct
                                 * number of columns.
                                 */
-                                while (tail != ldata->canon_head) {
+                                while (MASK(tail) != MASK(ldata->canon_head)) {
                                        tail--;
                                        c = read_buf(ldata, tail);
                                        if (c == '\t') {
@@ -1302,7 +1320,7 @@ n_tty_receive_char_special(struct tty_struct *tty, unsigned char c)
                        finish_erasing(ldata);
                        echo_char(c, tty);
                        echo_char_raw('\n', ldata);
-                        while (tail != ldata->read_head) {
+                        while (MASK(tail) != MASK(ldata->read_head)) {
                                echo_char(read_buf(ldata, tail), tty);
                                tail++;
                        }
@@ -1878,30 +1896,21 @@ static int n_tty_open(struct tty_struct *tty)
        struct n_tty_data *ldata;
        /* Currently a malloc failure here can panic */
-        ldata = vmalloc(sizeof(*ldata));
+        ldata = vzalloc(sizeof(*ldata));
        if (!ldata)
-                goto err;
+                return -ENOMEM;
        ldata->overrun_time = jiffies;
        mutex_init(&ldata->atomic_read_lock);
        mutex_init(&ldata->output_lock);
        tty->disc_data = ldata;
-        reset_buffer_flags(tty->disc_data);
-        ldata->column = 0;
-        ldata->canon_column = 0;
-        ldata->num_overrun = 0;
-        ldata->no_room = 0;
-        ldata->lnext = 0;
        tty->closing = 0;
        /* indicate buffer work may resume */
        clear_bit(TTY_LDISC_HALTED, &tty->flags);
        n_tty_set_termios(tty, NULL);
        tty_unthrottle(tty);
        return 0;
-err:
-        return -ENOMEM;
 }
 static inline int input_available_p(struct tty_struct *tty, int poll)
@@ -2411,7 +2420,7 @@ static unsigned long inq_canon(struct n_tty_data *ldata)
        tail = ldata->read_tail;
        nr = head - tail;
        /* Skip EOF-chars.. */
-        while (head != tail) {
+        while (MASK(head) != MASK(tail)) {
                if (test_bit(tail & (N_TTY_BUF_SIZE - 1), ldata->read_flags) &&
                    read_buf(ldata, tail) == __DISABLED_CHAR)
                        nr--;
diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c
index df93b727e984..9e59f4788589 100644
--- a/drivers/tty/serdev/core.c
+++ b/drivers/tty/serdev/core.c
@@ -617,6 +617,7 @@ EXPORT_SYMBOL_GPL(__serdev_device_driver_register);
 static void __exit serdev_exit(void)
 {
        bus_unregister(&serdev_bus_type);
+        ida_destroy(&ctrl_ida);
 }
 module_exit(serdev_exit);
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 3296a05cda2d..f80a300b5d68 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -3339,9 +3339,7 @@ static const struct pci_device_id blacklist[] = {
        /* multi-io cards handled by parport_serial */
        { PCI_DEVICE(0x4348, 0x7053), }, /* WCH CH353 2S1P */
        { PCI_DEVICE(0x4348, 0x5053), }, /* WCH CH353 1S1P */
-        { PCI_DEVICE(0x4348, 0x7173), }, /* WCH CH355 4S */
        { PCI_DEVICE(0x1c00, 0x3250), }, /* WCH CH382 2S1P */
-        { PCI_DEVICE(0x1c00, 0x3470), }, /* WCH CH384 4S */
        /* Moxa Smartio MUE boards handled by 8250_moxa */
        { PCI_VDEVICE(MOXA, 0x1024), },
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 1eb1a376a041..15eb6c829d39 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -784,7 +784,7 @@ int vc_allocate(unsigned int currcons)	/* return 0 on success */
        if (!*vc->vc_uni_pagedir_loc)
                con_set_default_unimap(vc);
-        vc->vc_screenbuf = kmalloc(vc->vc_screenbuf_size, GFP_KERNEL);
+        vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_KERNEL);
        if (!vc->vc_screenbuf)
                goto err_free;
@@ -871,7 +871,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
        if (new_screen_size > (4 << 20))
                return -EINVAL;
-        newscreen = kmalloc(new_screen_size, GFP_USER);
+        newscreen = kzalloc(new_screen_size, GFP_USER);
        if (!newscreen)
                return -ENOMEM;
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index af45aa3222b5..4638d9b066be 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -124,8 +124,11 @@ static int host_start(struct ci_hdrc *ci)
        hcd->power_budget = ci->platdata->power_budget;
        hcd->tpl_support = ci->platdata->tpl_support;
-        if (ci->phy || ci->usb_phy)
+        if (ci->phy || ci->usb_phy) {
                hcd->skip_phy_initialization = 1;
+                if (ci->usb_phy)
+                        hcd->usb_phy = ci->usb_phy;
+        }
        ehci = hcd_to_ehci(hcd);
        ehci->caps = ci->hw_bank.cap;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 7b366a6c0b49..998b32d0167e 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1758,6 +1758,9 @@ static const struct usb_device_id acm_ids[] = {
        { USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */
        .driver_info = SINGLE_RX_URB,
        },
+        { USB_DEVICE(0x1965, 0x0018), /* Uniden UBC125XLT */
+        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+        },
        { USB_DEVICE(0x22b8, 0x7000), /* Motorola Q Phone */
        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
        },
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index 4a56ac772a3c..71b3b08ad516 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -1004,6 +1004,7 @@ struct dwc2_hregs_backup {
 * @frame_list_sz:      Frame list size
 * @desc_gen_cache:     Kmem cache for generic descriptors
 * @desc_hsisoc_cache:  Kmem cache for hs isochronous descriptors
+ * @unaligned_cache:    Kmem cache for DMA mode to handle non-aligned buf
 *
 * These are for peripheral mode:
 *
@@ -1177,6 +1178,8 @@ struct dwc2_hsotg {
        u32 frame_list_sz;
        struct kmem_cache *desc_gen_cache;
        struct kmem_cache *desc_hsisoc_cache;
+        struct kmem_cache *unaligned_cache;
+#define DWC2_KMEM_UNALIGNED_BUF_SIZE 1024
 #endif /* CONFIG_USB_DWC2_HOST || CONFIG_USB_DWC2_DUAL_ROLE */
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index f0d9ccf1d665..a0f82cca2d9a 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -812,6 +812,7 @@ static int dwc2_gadget_fill_isoc_desc(struct dwc2_hsotg_ep *hs_ep,
        u32 index;
        u32 maxsize = 0;
        u32 mask = 0;
+        u8 pid = 0;
        maxsize = dwc2_gadget_get_desc_params(hs_ep, &mask);
@@ -840,7 +841,11 @@ static int dwc2_gadget_fill_isoc_desc(struct dwc2_hsotg_ep *hs_ep,
                         ((len << DEV_DMA_NBYTES_SHIFT) & mask));
        if (hs_ep->dir_in) {
-                desc->status |= ((hs_ep->mc << DEV_DMA_ISOC_PID_SHIFT) &
+                if (len)
+                        pid = DIV_ROUND_UP(len, hs_ep->ep.maxpacket);
+                else
+                        pid = 1;
+                desc->status |= ((pid << DEV_DMA_ISOC_PID_SHIFT) &
                                 DEV_DMA_ISOC_PID_MASK) |
                                ((len % hs_ep->ep.maxpacket) ?
                                 DEV_DMA_SHORT : 0) |
@@ -884,6 +889,7 @@ static void dwc2_gadget_start_isoc_ddma(struct dwc2_hsotg_ep *hs_ep)
        struct dwc2_dma_desc *desc;
        if (list_empty(&hs_ep->queue)) {
+                hs_ep->target_frame = TARGET_FRAME_INITIAL;
                dev_dbg(hsotg->dev, "%s: No requests in queue\n", __func__);
                return;
        }
@@ -2755,8 +2761,6 @@ static void dwc2_gadget_handle_out_token_ep_disabled(struct dwc2_hsotg_ep *ep)
         */
        tmp = dwc2_hsotg_read_frameno(hsotg);
-        dwc2_hsotg_complete_request(hsotg, ep, get_ep_head(ep), 0);
        if (using_desc_dma(hsotg)) {
                if (ep->target_frame == TARGET_FRAME_INITIAL) {
                        /* Start first ISO Out */
@@ -2817,9 +2821,6 @@ static void dwc2_gadget_handle_nak(struct dwc2_hsotg_ep *hs_ep)
                tmp = dwc2_hsotg_read_frameno(hsotg);
                if (using_desc_dma(hsotg)) {
-                        dwc2_hsotg_complete_request(hsotg, hs_ep,
-                                                    get_ep_head(hs_ep), 0);
                        hs_ep->target_frame = tmp;
                        dwc2_gadget_incr_frame_num(hs_ep);
                        dwc2_gadget_start_isoc_ddma(hs_ep);
@@ -4739,9 +4740,11 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg)
        }
        ret = usb_add_gadget_udc(dev, &hsotg->gadget);
-        if (ret)
+        if (ret) {
+                dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep,
+                                           hsotg->ctrl_req);
                return ret;
+        }
        dwc2_hsotg_dump(hsotg);
        return 0;
@@ -4755,6 +4758,7 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg)
 int dwc2_hsotg_remove(struct dwc2_hsotg *hsotg)
 {
        usb_del_gadget_udc(&hsotg->gadget);
+        dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, hsotg->ctrl_req);
        return 0;
 }
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index edaf0b6af4f0..b1104be3429c 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -1567,11 +1567,20 @@ static void dwc2_hc_start_transfer(struct dwc2_hsotg *hsotg,
        }
        if (hsotg->params.host_dma) {
-                dwc2_writel((u32)chan->xfer_dma,
+                dma_addr_t dma_addr;
-                            hsotg->regs + HCDMA(chan->hc_num));
+                if (chan->align_buf) {
+                        if (dbg_hc(chan))
+                                dev_vdbg(hsotg->dev, "align_buf\n");
+                        dma_addr = chan->align_buf;
+                } else {
+                        dma_addr = chan->xfer_dma;
+                }
+                dwc2_writel((u32)dma_addr, hsotg->regs + HCDMA(chan->hc_num));
                if (dbg_hc(chan))
                        dev_vdbg(hsotg->dev, "Wrote %08lx to HCDMA(%d)\n",
-                                 (unsigned long)chan->xfer_dma, chan->hc_num);
+                                 (unsigned long)dma_addr, chan->hc_num);
        }
        /* Start the split */
@@ -2625,6 +2634,35 @@ static void dwc2_hc_init_xfer(struct dwc2_hsotg *hsotg,
        }
 }
+static int dwc2_alloc_split_dma_aligned_buf(struct dwc2_hsotg *hsotg,
+                                            struct dwc2_qh *qh,
+                                            struct dwc2_host_chan *chan)
+{
+        if (!hsotg->unaligned_cache ||
+            chan->max_packet > DWC2_KMEM_UNALIGNED_BUF_SIZE)
+                return -ENOMEM;
+        if (!qh->dw_align_buf) {
+                qh->dw_align_buf = kmem_cache_alloc(hsotg->unaligned_cache,
+                                                    GFP_ATOMIC | GFP_DMA);
+                if (!qh->dw_align_buf)
+                        return -ENOMEM;
+        }
+        qh->dw_align_buf_dma = dma_map_single(hsotg->dev, qh->dw_align_buf,
+                                              DWC2_KMEM_UNALIGNED_BUF_SIZE,
+                                              DMA_FROM_DEVICE);
+        if (dma_mapping_error(hsotg->dev, qh->dw_align_buf_dma)) {
+                dev_err(hsotg->dev, "can't map align_buf\n");
+                chan->align_buf = 0;
+                return -EINVAL;
+        }
+        chan->align_buf = qh->dw_align_buf_dma;
+        return 0;
+}
 #define DWC2_USB_DMA_ALIGN 4
 struct dma_aligned_buffer {
@@ -2802,6 +2840,32 @@ static int dwc2_assign_and_init_hc(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh)
        /* Set the transfer attributes */
        dwc2_hc_init_xfer(hsotg, chan, qtd);
+        /* For non-dword aligned buffers */
+        if (hsotg->params.host_dma && qh->do_split &&
+            chan->ep_is_in && (chan->xfer_dma & 0x3)) {
+                dev_vdbg(hsotg->dev, "Non-aligned buffer\n");
+                if (dwc2_alloc_split_dma_aligned_buf(hsotg, qh, chan)) {
+                        dev_err(hsotg->dev,
+                                "Failed to allocate memory to handle non-aligned buffer\n");
+                        /* Add channel back to free list */
+                        chan->align_buf = 0;
+                        chan->multi_count = 0;
+                        list_add_tail(&chan->hc_list_entry,
+                                      &hsotg->free_hc_list);
+                        qtd->in_process = 0;
+                        qh->channel = NULL;
+                        return -ENOMEM;
+                }
+        } else {
+                /*
+                 * We assume that DMA is always aligned in non-split
+                 * case or split out case. Warn if not.
+                 */
+                WARN_ON_ONCE(hsotg->params.host_dma &&
+                             (chan->xfer_dma & 0x3));
+                chan->align_buf = 0;
+        }
        if (chan->ep_type == USB_ENDPOINT_XFER_INT ||
            chan->ep_type == USB_ENDPOINT_XFER_ISOC)
                /*
@@ -5246,6 +5310,19 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg)
                }
        }
+        if (hsotg->params.host_dma) {
+                /*
+                 * Create kmem caches to handle non-aligned buffer
+                 * in Buffer DMA mode.
+                 */
+                hsotg->unaligned_cache = kmem_cache_create("dwc2-unaligned-dma",
+                                                DWC2_KMEM_UNALIGNED_BUF_SIZE, 4,
+                                                SLAB_CACHE_DMA, NULL);
+                if (!hsotg->unaligned_cache)
+                        dev_err(hsotg->dev,
+                                "unable to create dwc2 unaligned cache\n");
+        }
        hsotg->otg_port = 1;
        hsotg->frame_list = NULL;
        hsotg->frame_list_dma = 0;
@@ -5280,8 +5357,9 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg)
        return 0;
 error4:
-        kmem_cache_destroy(hsotg->desc_gen_cache);
+        kmem_cache_destroy(hsotg->unaligned_cache);
        kmem_cache_destroy(hsotg->desc_hsisoc_cache);
+        kmem_cache_destroy(hsotg->desc_gen_cache);
 error3:
        dwc2_hcd_release(hsotg);
 error2:
@@ -5322,8 +5400,9 @@ void dwc2_hcd_remove(struct dwc2_hsotg *hsotg)
        usb_remove_hcd(hcd);
        hsotg->priv = NULL;
-        kmem_cache_destroy(hsotg->desc_gen_cache);
+        kmem_cache_destroy(hsotg->unaligned_cache);
        kmem_cache_destroy(hsotg->desc_hsisoc_cache);
+        kmem_cache_destroy(hsotg->desc_gen_cache);
        dwc2_hcd_release(hsotg);
        usb_put_hcd(hcd);
@@ -5435,7 +5514,7 @@ int dwc2_host_enter_hibernation(struct dwc2_hsotg *hsotg)
        dwc2_writel(hprt0, hsotg->regs + HPRT0);
        /* Wait for the HPRT0.PrtSusp register field to be set */
-        if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 300))
+        if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 3000))
                dev_warn(hsotg->dev, "Suspend wasn't generated\n");
        /*
@@ -5616,6 +5695,8 @@ int dwc2_host_exit_hibernation(struct dwc2_hsotg *hsotg, int rem_wakeup,
                return ret;
        }
+        dwc2_hcd_rem_wakeup(hsotg);
        hsotg->hibernated = 0;
        hsotg->bus_suspended = 0;
        hsotg->lx_state = DWC2_L0;
diff --git a/drivers/usb/dwc2/hcd.h b/drivers/usb/dwc2/hcd.h
index 7db1ee7e7a77..5502a501f516 100644
--- a/drivers/usb/dwc2/hcd.h
+++ b/drivers/usb/dwc2/hcd.h
@@ -76,6 +76,8 @@ struct dwc2_qh;
 *                      (micro)frame
 * @xfer_buf:           Pointer to current transfer buffer position
 * @xfer_dma:           DMA address of xfer_buf
+ * @align_buf:          In Buffer DMA mode this will be used if xfer_buf is not
+ *                      DWORD aligned
 * @xfer_len:           Total number of bytes to transfer
 * @xfer_count:         Number of bytes transferred so far
 * @start_pkt_count:    Packet count at start of transfer
@@ -133,6 +135,7 @@ struct dwc2_host_chan {
        u8 *xfer_buf;
        dma_addr_t xfer_dma;
+        dma_addr_t align_buf;
        u32 xfer_len;
        u32 xfer_count;
        u16 start_pkt_count;
@@ -302,6 +305,9 @@ struct dwc2_hs_transfer_time {
 *                           speed.  Note that this is in "schedule slice" which
 *                           is tightly packed.
 * @ntd:                Actual number of transfer descriptors in a list
+ * @dw_align_buf:       Used instead of original buffer if its physical address
+ *                      is not dword-aligned
+ * @dw_align_buf_dma:   DMA address for dw_align_buf
 * @qtd_list:           List of QTDs for this QH
 * @channel:            Host channel currently processing transfers for this QH
 * @qh_list_entry:      Entry for QH in either the periodic or non-periodic
@@ -350,6 +356,8 @@ struct dwc2_qh {
        struct dwc2_hs_transfer_time hs_transfers[DWC2_HS_SCHEDULE_UFRAMES];
        u32 ls_start_schedule_slice;
        u16 ntd;
+        u8 *dw_align_buf;
+        dma_addr_t dw_align_buf_dma;
        struct list_head qtd_list;
        struct dwc2_host_chan *channel;
        struct list_head qh_list_entry;
diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index fbea5e3fb947..ed7f05cf4906 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -942,14 +942,21 @@ static int dwc2_xfercomp_isoc_split_in(struct dwc2_hsotg *hsotg,
        frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
        len = dwc2_get_actual_xfer_length(hsotg, chan, chnum, qtd,
                                          DWC2_HC_XFER_COMPLETE, NULL);
-        if (!len) {
+        if (!len && !qtd->isoc_split_offset) {
                qtd->complete_split = 0;
-                qtd->isoc_split_offset = 0;
                return 0;
        }
        frame_desc->actual_length += len;
+        if (chan->align_buf) {
+                dev_vdbg(hsotg->dev, "non-aligned buffer\n");
+                dma_unmap_single(hsotg->dev, chan->qh->dw_align_buf_dma,
+                                 DWC2_KMEM_UNALIGNED_BUF_SIZE, DMA_FROM_DEVICE);
+                memcpy(qtd->urb->buf + (chan->xfer_dma - qtd->urb->dma),
+                       chan->qh->dw_align_buf, len);
+        }
        qtd->isoc_split_offset += len;
        hctsiz = dwc2_readl(hsotg->regs + HCTSIZ(chnum));
diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c
index d7c3d6c776d8..301ced1618f8 100644
--- a/drivers/usb/dwc2/hcd_queue.c
+++ b/drivers/usb/dwc2/hcd_queue.c
@@ -383,7 +383,7 @@ static unsigned long *dwc2_get_ls_map(struct dwc2_hsotg *hsotg,
        /* Get the map and adjust if this is a multi_tt hub */
        map = qh->dwc_tt->periodic_bitmaps;
        if (qh->dwc_tt->usb_tt->multi)
-                map += DWC2_ELEMENTS_PER_LS_BITMAP * qh->ttport;
+                map += DWC2_ELEMENTS_PER_LS_BITMAP * (qh->ttport - 1);
        return map;
 }
@@ -1696,6 +1696,9 @@ void dwc2_hcd_qh_free(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh)
        if (qh->desc_list)
                dwc2_hcd_qh_free_ddma(hsotg, qh);
+        else if (hsotg->unaligned_cache && qh->dw_align_buf)
+                kmem_cache_free(hsotg->unaligned_cache, qh->dw_align_buf);
        kfree(qh);
 }
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index ea91310113b9..103807587dc6 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1272,7 +1272,6 @@ static int dwc3_probe(struct platform_device *pdev)
        if (!dwc->clks)
                return -ENOMEM;
-        dwc->num_clks = ARRAY_SIZE(dwc3_core_clks);
        dwc->dev = dev;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -1307,15 +1306,19 @@ static int dwc3_probe(struct platform_device *pdev)
        if (IS_ERR(dwc->reset))
                return PTR_ERR(dwc->reset);
-        ret = clk_bulk_get(dev, dwc->num_clks, dwc->clks);
+        if (dev->of_node) {
-        if (ret == -EPROBE_DEFER)
+                dwc->num_clks = ARRAY_SIZE(dwc3_core_clks);
-                return ret;
-        /*
+                ret = clk_bulk_get(dev, dwc->num_clks, dwc->clks);
-         * Clocks are optional, but new DT platforms should support all clocks
+                if (ret == -EPROBE_DEFER)
-         * as required by the DT-binding.
+                        return ret;
-         */
+                /*
-        if (ret)
+                 * Clocks are optional, but new DT platforms should support all
-                dwc->num_clks = 0;
+                 * clocks as required by the DT-binding.
+                 */
+                if (ret)
+                        dwc->num_clks = 0;
+        }
        ret = reset_control_deassert(dwc->reset);
        if (ret)
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index 6b3ccd542bd7..dbeff5e6ad14 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -165,8 +165,9 @@ static int dwc3_of_simple_remove(struct platform_device *pdev)
        reset_control_put(simple->resets);
-        pm_runtime_put_sync(dev);
        pm_runtime_disable(dev);
+        pm_runtime_put_noidle(dev);
+        pm_runtime_set_suspended(dev);
        return 0;
 }
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index c961a94d136b..f57e7c94b8e5 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -34,6 +34,7 @@
 #define PCI_DEVICE_ID_INTEL_GLK                 0x31aa
 #define PCI_DEVICE_ID_INTEL_CNPLP               0x9dee
 #define PCI_DEVICE_ID_INTEL_CNPH                0xa36e
+#define PCI_DEVICE_ID_INTEL_ICLLP               0x34ee
 #define PCI_INTEL_BXT_DSM_GUID          "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
 #define PCI_INTEL_BXT_FUNC_PMU_PWR      4
@@ -289,6 +290,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_GLK), },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPLP), },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPH), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICLLP), },
        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
        {  }    /* Terminating Entry */
 };
diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
index b0e67ab2f98c..a6d0203e40b6 100644
--- a/drivers/usb/dwc3/dwc3-qcom.c
+++ b/drivers/usb/dwc3/dwc3-qcom.c
@@ -490,6 +490,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
        qcom->dwc3 = of_find_device_by_node(dwc3_np);
        if (!qcom->dwc3) {
                dev_err(&pdev->dev, "failed to get dwc3 platform device\n");
+                ret = -ENODEV;
                goto depopulate;
        }
@@ -547,8 +548,7 @@ static int dwc3_qcom_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
+static int __maybe_unused dwc3_qcom_pm_suspend(struct device *dev)
-static int dwc3_qcom_pm_suspend(struct device *dev)
 {
        struct dwc3_qcom *qcom = dev_get_drvdata(dev);
        int ret = 0;
@@ -560,7 +560,7 @@ static int dwc3_qcom_pm_suspend(struct device *dev)
        return ret;
 }
-static int dwc3_qcom_pm_resume(struct device *dev)
+static int __maybe_unused dwc3_qcom_pm_resume(struct device *dev)
 {
        struct dwc3_qcom *qcom = dev_get_drvdata(dev);
        int ret;
@@ -571,23 +571,20 @@ static int dwc3_qcom_pm_resume(struct device *dev)
        return ret;
 }
-#endif
-#ifdef CONFIG_PM
+static int __maybe_unused dwc3_qcom_runtime_suspend(struct device *dev)
-static int dwc3_qcom_runtime_suspend(struct device *dev)
 {
        struct dwc3_qcom *qcom = dev_get_drvdata(dev);
        return dwc3_qcom_suspend(qcom);
 }
-static int dwc3_qcom_runtime_resume(struct device *dev)
+static int __maybe_unused dwc3_qcom_runtime_resume(struct device *dev)
 {
        struct dwc3_qcom *qcom = dev_get_drvdata(dev);
        return dwc3_qcom_resume(qcom);
 }
-#endif
 static const struct dev_pm_ops dwc3_qcom_dev_pm_ops = {
        SET_SYSTEM_SLEEP_PM_OPS(dwc3_qcom_pm_suspend, dwc3_qcom_pm_resume)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index f242c2bcea81..d2fa071c21b1 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1719,6 +1719,8 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                 */
                if (w_value && !f->get_alt)
                        break;
+                spin_lock(&cdev->lock);
                value = f->set_alt(f, w_index, w_value);
                if (value == USB_GADGET_DELAYED_STATUS) {
                        DBG(cdev,
@@ -1728,6 +1730,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                        DBG(cdev, "delayed_status count %d\n",
                                        cdev->delayed_status);
                }
+                spin_unlock(&cdev->lock);
                break;
        case USB_REQ_GET_INTERFACE:
                if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index dce9d12c7981..33e2030503fa 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -215,6 +215,7 @@ struct ffs_io_data {
        struct mm_struct *mm;
        struct work_struct work;
+        struct work_struct cancellation_work;
        struct usb_ep *ep;
        struct usb_request *req;
@@ -1072,22 +1073,31 @@ ffs_epfile_open(struct inode *inode, struct file *file)
        return 0;
 }
+static void ffs_aio_cancel_worker(struct work_struct *work)
+{
+        struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
+                                                   cancellation_work);
+        ENTER();
+        usb_ep_dequeue(io_data->ep, io_data->req);
+}
 static int ffs_aio_cancel(struct kiocb *kiocb)
 {
        struct ffs_io_data *io_data = kiocb->private;
-        struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
+        struct ffs_data *ffs = io_data->ffs;
        int value;
        ENTER();
-        spin_lock_irq(&epfile->ffs->eps_lock);
+        if (likely(io_data && io_data->ep && io_data->req)) {
+                INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker);
-        if (likely(io_data && io_data->ep && io_data->req))
+                queue_work(ffs->io_completion_wq, &io_data->cancellation_work);
-                value = usb_ep_dequeue(io_data->ep, io_data->req);
+                value = -EINPROGRESS;
-        else
+        } else {
                value = -EINVAL;
+        }
-        spin_unlock_irq(&epfile->ffs->eps_lock);
        return value;
 }
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index acbd3d7b8828..8a62eee9eee1 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -886,12 +886,12 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
        dev = xhci->devs[slot_id];
-        trace_xhci_free_virt_device(dev);
        xhci->dcbaa->dev_context_ptrs[slot_id] = 0;
        if (!dev)
                return;
+        trace_xhci_free_virt_device(dev);
        if (dev->tt_info)
                old_active_eps = dev->tt_info->active_eps;
diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
index a8c1d073cba0..4b463e5202a4 100644
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -481,7 +481,7 @@ static void tegra_xusb_mbox_handle(struct tegra_xusb *tegra,
        unsigned long mask;
        unsigned int port;
        bool idle, enable;
-        int err;
+        int err = 0;
        memset(&rsp, 0, sizeof(rsp));
@@ -1223,10 +1223,10 @@ disable_rpm:
        pm_runtime_disable(&pdev->dev);
        usb_put_hcd(tegra->hcd);
 disable_xusbc:
-        if (!&pdev->dev.pm_domain)
+        if (!pdev->dev.pm_domain)
                tegra_powergate_power_off(TEGRA_POWERGATE_XUSBC);
 disable_xusba:
-        if (!&pdev->dev.pm_domain)
+        if (!pdev->dev.pm_domain)
                tegra_powergate_power_off(TEGRA_POWERGATE_XUSBA);
 put_padctl:
        tegra_xusb_padctl_put(tegra->padctl);
diff --git a/drivers/usb/host/xhci-trace.h b/drivers/usb/host/xhci-trace.h
index 410544ffe78f..88b427434bd8 100644
--- a/drivers/usb/host/xhci-trace.h
+++ b/drivers/usb/host/xhci-trace.h
@@ -171,6 +171,37 @@ DEFINE_EVENT(xhci_log_trb, xhci_dbc_gadget_ep_queue,
        TP_ARGS(ring, trb)
 );
+DECLARE_EVENT_CLASS(xhci_log_free_virt_dev,
+        TP_PROTO(struct xhci_virt_device *vdev),
+        TP_ARGS(vdev),
+        TP_STRUCT__entry(
+                __field(void *, vdev)
+                __field(unsigned long long, out_ctx)
+                __field(unsigned long long, in_ctx)
+                __field(u8, fake_port)
+                __field(u8, real_port)
+                __field(u16, current_mel)
+        ),
+        TP_fast_assign(
+                __entry->vdev = vdev;
+                __entry->in_ctx = (unsigned long long) vdev->in_ctx->dma;
+                __entry->out_ctx = (unsigned long long) vdev->out_ctx->dma;
+                __entry->fake_port = (u8) vdev->fake_port;
+                __entry->real_port = (u8) vdev->real_port;
+                __entry->current_mel = (u16) vdev->current_mel;
+                ),
+        TP_printk("vdev %p ctx %llx | %llx fake_port %d real_port %d current_mel %d",
+                __entry->vdev, __entry->in_ctx, __entry->out_ctx,
+                __entry->fake_port, __entry->real_port, __entry->current_mel
+        )
+);
+DEFINE_EVENT(xhci_log_free_virt_dev, xhci_free_virt_device,
+        TP_PROTO(struct xhci_virt_device *vdev),
+        TP_ARGS(vdev)
+);
 DECLARE_EVENT_CLASS(xhci_log_virt_dev,
        TP_PROTO(struct xhci_virt_device *vdev),
        TP_ARGS(vdev),
@@ -208,11 +239,6 @@ DEFINE_EVENT(xhci_log_virt_dev, xhci_alloc_virt_device,
        TP_ARGS(vdev)
 );
-DEFINE_EVENT(xhci_log_virt_dev, xhci_free_virt_device,
-        TP_PROTO(struct xhci_virt_device *vdev),
-        TP_ARGS(vdev)
-);
 DEFINE_EVENT(xhci_log_virt_dev, xhci_setup_device,
        TP_PROTO(struct xhci_virt_device *vdev),
        TP_ARGS(vdev)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 8c8da2d657fa..2f4850f25e82 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -908,6 +908,41 @@ static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
        spin_unlock_irqrestore(&xhci->lock, flags);
 }
+static bool xhci_pending_portevent(struct xhci_hcd *xhci)
+{
+        struct xhci_port        **ports;
+        int                     port_index;
+        u32                     status;
+        u32                     portsc;
+        status = readl(&xhci->op_regs->status);
+        if (status & STS_EINT)
+                return true;
+        /*
+         * Checking STS_EINT is not enough as there is a lag between a change
+         * bit being set and the Port Status Change Event that it generated
+         * being written to the Event Ring. See note in xhci 1.1 section 4.19.2.
+         */
+        port_index = xhci->usb2_rhub.num_ports;
+        ports = xhci->usb2_rhub.ports;
+        while (port_index--) {
+                portsc = readl(ports[port_index]->addr);
+                if (portsc & PORT_CHANGE_MASK ||
+                    (portsc & PORT_PLS_MASK) == XDEV_RESUME)
+                        return true;
+        }
+        port_index = xhci->usb3_rhub.num_ports;
+        ports = xhci->usb3_rhub.ports;
+        while (port_index--) {
+                portsc = readl(ports[port_index]->addr);
+                if (portsc & PORT_CHANGE_MASK ||
+                    (portsc & PORT_PLS_MASK) == XDEV_RESUME)
+                        return true;
+        }
+        return false;
+}
 /*
 * Stop HC (not bus-specific)
 *
@@ -1009,7 +1044,7 @@ EXPORT_SYMBOL_GPL(xhci_suspend);
 */
 int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 {
-        u32                     command, temp = 0, status;
+        u32                     command, temp = 0;
        struct usb_hcd          *hcd = xhci_to_hcd(xhci);
        struct usb_hcd          *secondary_hcd;
        int                     retval = 0;
@@ -1043,8 +1078,13 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                command = readl(&xhci->op_regs->command);
                command |= CMD_CRS;
                writel(command, &xhci->op_regs->command);
+                /*
+                 * Some controllers take up to 55+ ms to complete the controller
+                 * restore so setting the timeout to 100ms. Xhci specification
+                 * doesn't mention any timeout value.
+                 */
                if (xhci_handshake(&xhci->op_regs->status,
-                              STS_RESTORE, 0, 10 * 1000)) {
+                              STS_RESTORE, 0, 100 * 1000)) {
                        xhci_warn(xhci, "WARN: xHC restore state timeout\n");
                        spin_unlock_irq(&xhci->lock);
                        return -ETIMEDOUT;
@@ -1134,8 +1174,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 done:
        if (retval == 0) {
                /* Resume root hubs only when have pending events. */
-                status = readl(&xhci->op_regs->status);
+                if (xhci_pending_portevent(xhci)) {
-                if (status & STS_EINT) {
                        usb_hcd_resume_root_hub(xhci->shared_hcd);
                        usb_hcd_resume_root_hub(hcd);
                }
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 939e2f86b595..841e89ffe2e9 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -382,6 +382,10 @@ struct xhci_op_regs {
 #define PORT_PLC        (1 << 22)
 /* port configure error change - port failed to configure its link partner */
 #define PORT_CEC        (1 << 23)
+#define PORT_CHANGE_MASK        (PORT_CSC | PORT_PEC | PORT_WRC | PORT_OCC | \
+                                 PORT_RC | PORT_PLC | PORT_CEC)
 /* Cold Attach Status - xHC can set this bit to report device attached during
 * Sx state. Warm port reset should be perfomed to clear this bit and move port
 * to connected state.
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index eb6c26cbe579..ee0cc1d90b51 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -95,6 +95,9 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */
        { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */
        { USB_DEVICE(0x10C4, 0x815F) }, /* Timewave HamLinkUSB */
+        { USB_DEVICE(0x10C4, 0x817C) }, /* CESINEL MEDCAL N Power Quality Monitor */
+        { USB_DEVICE(0x10C4, 0x817D) }, /* CESINEL MEDCAL NT Power Quality Monitor */
+        { USB_DEVICE(0x10C4, 0x817E) }, /* CESINEL MEDCAL S Power Quality Monitor */
        { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */
        { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */
        { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */
@@ -112,6 +115,9 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */
        { USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */
        { USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */
+        { USB_DEVICE(0x10C4, 0x82EF) }, /* CESINEL FALCO 6105 AC Power Supply */
+        { USB_DEVICE(0x10C4, 0x82F1) }, /* CESINEL MEDCAL EFD Earth Fault Detector */
+        { USB_DEVICE(0x10C4, 0x82F2) }, /* CESINEL MEDCAL ST Network Analyzer */
        { USB_DEVICE(0x10C4, 0x82F4) }, /* Starizona MicroTouch */
        { USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */
        { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
@@ -124,7 +130,9 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */
        { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
        { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */
+        { USB_DEVICE(0x10C4, 0x851E) }, /* CESINEL MEDCAL PT Network Analyzer */
        { USB_DEVICE(0x10C4, 0x85A7) }, /* LifeScan OneTouch Verio IQ */
+        { USB_DEVICE(0x10C4, 0x85B8) }, /* CESINEL ReCon T Energy Logger */
        { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
        { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */
        { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
@@ -134,17 +142,23 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */
        { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
        { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+        { USB_DEVICE(0x10C4, 0x88FB) }, /* CESINEL MEDCAL STII Network Analyzer */
+        { USB_DEVICE(0x10C4, 0x8938) }, /* CESINEL MEDCAL S II Network Analyzer */
        { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
        { USB_DEVICE(0x10C4, 0x8962) }, /* Brim Brothers charging dock */
        { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
        { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
+        { USB_DEVICE(0x10C4, 0x89A4) }, /* CESINEL FTBC Flexible Thyristor Bridge Controller */
        { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
        { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
        { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */
        { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+        { USB_DEVICE(0x10C4, 0xEA63) }, /* Silicon Labs Windows Update (CP2101-4/CP2102N) */
        { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */
+        { USB_DEVICE(0x10C4, 0xEA7A) }, /* Silicon Labs Windows Update (CP2105) */
+        { USB_DEVICE(0x10C4, 0xEA7B) }, /* Silicon Labs Windows Update (CP2108) */
        { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */
        { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */
        { USB_DEVICE(0x10C4, 0xF003) }, /* Elan Digital Systems USBpulse100 */
diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index 8a201dd53d36..d961f1ec0e08 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -418,17 +418,18 @@ static void _tcpm_log(struct tcpm_port *port, const char *fmt, va_list args)
        u64 ts_nsec = local_clock();
        unsigned long rem_nsec;
+        mutex_lock(&port->logbuffer_lock);
        if (!port->logbuffer[port->logbuffer_head]) {
                port->logbuffer[port->logbuffer_head] =
                                kzalloc(LOG_BUFFER_ENTRY_SIZE, GFP_KERNEL);
-                if (!port->logbuffer[port->logbuffer_head])
+                if (!port->logbuffer[port->logbuffer_head]) {
+                        mutex_unlock(&port->logbuffer_lock);
                        return;
+                }
        }
        vsnprintf(tmpbuffer, sizeof(tmpbuffer), fmt, args);
-        mutex_lock(&port->logbuffer_lock);
        if (tcpm_log_full(port)) {
                port->logbuffer_head = max(port->logbuffer_head - 1, 0);
                strcpy(tmpbuffer, "overflow");
@@ -3043,7 +3044,8 @@ static void run_state_machine(struct tcpm_port *port)
                    tcpm_port_is_sink(port) &&
                    time_is_after_jiffies(port->delayed_runtime)) {
                        tcpm_set_state(port, SNK_DISCOVERY,
-                                       port->delayed_runtime - jiffies);
+                                       jiffies_to_msecs(port->delayed_runtime -
+                                                        jiffies));
                        break;
                }
                tcpm_set_state(port, unattached_state(port), 0);
diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index bd5cca5632b3..8d0a6fe748bd 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -350,6 +350,19 @@ static void ucsi_connector_change(struct work_struct *work)
        }
        if (con->status.change & UCSI_CONSTAT_CONNECT_CHANGE) {
+                typec_set_pwr_role(con->port, con->status.pwr_dir);
+                switch (con->status.partner_type) {
+                case UCSI_CONSTAT_PARTNER_TYPE_UFP:
+                        typec_set_data_role(con->port, TYPEC_HOST);
+                        break;
+                case UCSI_CONSTAT_PARTNER_TYPE_DFP:
+                        typec_set_data_role(con->port, TYPEC_DEVICE);
+                        break;
+                default:
+                        break;
+                }
                if (con->status.connected)
                        ucsi_register_partner(con);
                else
diff --git a/drivers/usb/typec/ucsi/ucsi_acpi.c b/drivers/usb/typec/ucsi/ucsi_acpi.c
index 44eb4e1ea817..a18112a83fae 100644
--- a/drivers/usb/typec/ucsi/ucsi_acpi.c
+++ b/drivers/usb/typec/ucsi/ucsi_acpi.c
@@ -79,6 +79,11 @@ static int ucsi_acpi_probe(struct platform_device *pdev)
                return -ENODEV;
        }
+        /* This will make sure we can use ioremap_nocache() */
+        status = acpi_release_memory(ACPI_HANDLE(&pdev->dev), res, 1);
+        if (ACPI_FAILURE(status))
+                return -ENOMEM;
        /*
         * NOTE: The memory region for the data structures is used also in an
         * operation region, which means ACPI has already reserved it. Therefore
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 686dc670fd29..29756d88799b 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -1226,7 +1226,8 @@ err_used:
        if (ubufs)
                vhost_net_ubuf_put_wait_and_free(ubufs);
 err_ubufs:
-        sockfd_put(sock);
+        if (sock)
+                sockfd_put(sock);
 err_vq:
        mutex_unlock(&vq->mutex);
 err:
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index 451e833f5931..48b154276179 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -41,4 +41,4 @@ obj-$(CONFIG_XEN_PVCALLS_FRONTEND)	+= pvcalls-front.o
 xen-evtchn-y                            := evtchn.o
 xen-gntdev-y                            := gntdev.o
 xen-gntalloc-y                          := gntalloc.o
-xen-privcmd-y                           := privcmd.o
+xen-privcmd-y                           := privcmd.o privcmd-buf.o
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 762378f1811c..08e4af04d6f2 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -628,8 +628,6 @@ static void __unbind_from_irq(unsigned int irq)
                xen_irq_info_cleanup(info);
        }
-        BUG_ON(info_for_irq(irq)->type == IRQT_UNBOUND);
        xen_free_irq(irq);
 }
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 2473b0a9e6e4..ba9f3eec2bd0 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -799,7 +799,7 @@ int gnttab_alloc_pages(int nr_pages, struct page **pages)
        return 0;
 }
-EXPORT_SYMBOL(gnttab_alloc_pages);
+EXPORT_SYMBOL_GPL(gnttab_alloc_pages);
 /**
 * gnttab_free_pages - free pages allocated by gnttab_alloc_pages()
@@ -820,7 +820,7 @@ void gnttab_free_pages(int nr_pages, struct page **pages)
        }
        free_xenballooned_pages(nr_pages, pages);
 }
-EXPORT_SYMBOL(gnttab_free_pages);
+EXPORT_SYMBOL_GPL(gnttab_free_pages);
 /* Handling of paged out grant targets (GNTST_eagain) */
 #define MAX_DELAY 256
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index 8835065029d3..c93d8ef8df34 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -289,8 +289,15 @@ static void sysrq_handler(struct xenbus_watch *watch, const char *path,
                return;
        }
-        if (sysrq_key != '\0')
+        if (sysrq_key != '\0') {
-                xenbus_printf(xbt, "control", "sysrq", "%c", '\0');
+                err = xenbus_printf(xbt, "control", "sysrq", "%c", '\0');
+                if (err) {
+                        pr_err("%s: Error %d writing sysrq in control/sysrq\n",
+                               __func__, err);
+                        xenbus_transaction_end(xbt, 1);
+                        return;
+                }
+        }
        err = xenbus_transaction_end(xbt, 0);
        if (err == -EAGAIN)
@@ -342,7 +349,12 @@ static int setup_shutdown_watcher(void)
                        continue;
                snprintf(node, FEATURE_PATH_SIZE, "feature-%s",
                         shutdown_handlers[idx].command);
-                xenbus_printf(XBT_NIL, "control", node, "%u", 1);
+                err = xenbus_printf(XBT_NIL, "control", node, "%u", 1);
+                if (err) {
+                        pr_err("%s: Error %d writing %s\n", __func__,
+                                err, node);
+                        return err;
+                }
        }
        return 0;
diff --git a/drivers/xen/privcmd-buf.c b/drivers/xen/privcmd-buf.c
new file mode 100644
index 000000000000..df1ed37c3269
--- /dev/null
+++ b/drivers/xen/privcmd-buf.c
@@ -0,0 +1,210 @@
+// SPDX-License-Identifier: GPL-2.0 OR MIT
+/******************************************************************************
+ * privcmd-buf.c
+ *
+ * Mmap of hypercall buffers.
+ *
+ * Copyright (c) 2018 Juergen Gross
+ */
+#define pr_fmt(fmt) "xen:" KBUILD_MODNAME ": " fmt
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/list.h>
+#include <linux/miscdevice.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include "privcmd.h"
+MODULE_LICENSE("GPL");
+static unsigned int limit = 64;
+module_param(limit, uint, 0644);
+MODULE_PARM_DESC(limit, "Maximum number of pages that may be allocated by "
+                        "the privcmd-buf device per open file");
+struct privcmd_buf_private {
+        struct mutex lock;
+        struct list_head list;
+        unsigned int allocated;
+};
+struct privcmd_buf_vma_private {
+        struct privcmd_buf_private *file_priv;
+        struct list_head list;
+        unsigned int users;
+        unsigned int n_pages;
+        struct page *pages[];
+};
+static int privcmd_buf_open(struct inode *ino, struct file *file)
+{
+        struct privcmd_buf_private *file_priv;
+        file_priv = kzalloc(sizeof(*file_priv), GFP_KERNEL);
+        if (!file_priv)
+                return -ENOMEM;
+        mutex_init(&file_priv->lock);
+        INIT_LIST_HEAD(&file_priv->list);
+        file->private_data = file_priv;
+        return 0;
+}
+static void privcmd_buf_vmapriv_free(struct privcmd_buf_vma_private *vma_priv)
+{
+        unsigned int i;
+        vma_priv->file_priv->allocated -= vma_priv->n_pages;
+        list_del(&vma_priv->list);
+        for (i = 0; i < vma_priv->n_pages; i++)
+                if (vma_priv->pages[i])
+                        __free_page(vma_priv->pages[i]);
+        kfree(vma_priv);
+}
+static int privcmd_buf_release(struct inode *ino, struct file *file)
+{
+        struct privcmd_buf_private *file_priv = file->private_data;
+        struct privcmd_buf_vma_private *vma_priv;
+        mutex_lock(&file_priv->lock);
+        while (!list_empty(&file_priv->list)) {
+                vma_priv = list_first_entry(&file_priv->list,
+                                            struct privcmd_buf_vma_private,
+                                            list);
+                privcmd_buf_vmapriv_free(vma_priv);
+        }
+        mutex_unlock(&file_priv->lock);
+        kfree(file_priv);
+        return 0;
+}
+static void privcmd_buf_vma_open(struct vm_area_struct *vma)
+{
+        struct privcmd_buf_vma_private *vma_priv = vma->vm_private_data;
+        if (!vma_priv)
+                return;
+        mutex_lock(&vma_priv->file_priv->lock);
+        vma_priv->users++;
+        mutex_unlock(&vma_priv->file_priv->lock);
+}
+static void privcmd_buf_vma_close(struct vm_area_struct *vma)
+{
+        struct privcmd_buf_vma_private *vma_priv = vma->vm_private_data;
+        struct privcmd_buf_private *file_priv;
+        if (!vma_priv)
+                return;
+        file_priv = vma_priv->file_priv;
+        mutex_lock(&file_priv->lock);
+        vma_priv->users--;
+        if (!vma_priv->users)
+                privcmd_buf_vmapriv_free(vma_priv);
+        mutex_unlock(&file_priv->lock);
+}
+static vm_fault_t privcmd_buf_vma_fault(struct vm_fault *vmf)
+{
+        pr_debug("fault: vma=%p %lx-%lx, pgoff=%lx, uv=%p\n",
+                 vmf->vma, vmf->vma->vm_start, vmf->vma->vm_end,
+                 vmf->pgoff, (void *)vmf->address);
+        return VM_FAULT_SIGBUS;
+}
+static const struct vm_operations_struct privcmd_buf_vm_ops = {
+        .open = privcmd_buf_vma_open,
+        .close = privcmd_buf_vma_close,
+        .fault = privcmd_buf_vma_fault,
+};
+static int privcmd_buf_mmap(struct file *file, struct vm_area_struct *vma)
+{
+        struct privcmd_buf_private *file_priv = file->private_data;
+        struct privcmd_buf_vma_private *vma_priv;
+        unsigned long count = vma_pages(vma);
+        unsigned int i;
+        int ret = 0;
+        if (!(vma->vm_flags & VM_SHARED) || count > limit ||
+            file_priv->allocated + count > limit)
+                return -EINVAL;
+        vma_priv = kzalloc(sizeof(*vma_priv) + count * sizeof(void *),
+                           GFP_KERNEL);
+        if (!vma_priv)
+                return -ENOMEM;
+        vma_priv->n_pages = count;
+        count = 0;
+        for (i = 0; i < vma_priv->n_pages; i++) {
+                vma_priv->pages[i] = alloc_page(GFP_KERNEL | __GFP_ZERO);
+                if (!vma_priv->pages[i])
+                        break;
+                count++;
+        }
+        mutex_lock(&file_priv->lock);
+        file_priv->allocated += count;
+        vma_priv->file_priv = file_priv;
+        vma_priv->users = 1;
+        vma->vm_flags |= VM_IO | VM_DONTEXPAND;
+        vma->vm_ops = &privcmd_buf_vm_ops;
+        vma->vm_private_data = vma_priv;
+        list_add(&vma_priv->list, &file_priv->list);
+        if (vma_priv->n_pages != count)
+                ret = -ENOMEM;
+        else
+                for (i = 0; i < vma_priv->n_pages; i++) {
+                        ret = vm_insert_page(vma, vma->vm_start + i * PAGE_SIZE,
+                                             vma_priv->pages[i]);
+                        if (ret)
+                                break;
+                }
+        if (ret)
+                privcmd_buf_vmapriv_free(vma_priv);
+        mutex_unlock(&file_priv->lock);
+        return ret;
+}
+const struct file_operations xen_privcmdbuf_fops = {
+        .owner = THIS_MODULE,
+        .open = privcmd_buf_open,
+        .release = privcmd_buf_release,
+        .mmap = privcmd_buf_mmap,
+};
+EXPORT_SYMBOL_GPL(xen_privcmdbuf_fops);
+struct miscdevice xen_privcmdbuf_dev = {
+        .minor = MISC_DYNAMIC_MINOR,
+        .name = "xen/hypercall",
+        .fops = &xen_privcmdbuf_fops,
+};
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 8ae0349d9f0a..7e6e682104dc 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -1007,12 +1007,21 @@ static int __init privcmd_init(void)
                pr_err("Could not register Xen privcmd device\n");
                return err;
        }
+        err = misc_register(&xen_privcmdbuf_dev);
+        if (err != 0) {
+                pr_err("Could not register Xen hypercall-buf device\n");
+                misc_deregister(&privcmd_dev);
+                return err;
+        }
        return 0;
 }
 static void __exit privcmd_exit(void)
 {
        misc_deregister(&privcmd_dev);
+        misc_deregister(&xen_privcmdbuf_dev);
 }
 module_init(privcmd_init);
diff --git a/drivers/xen/privcmd.h b/drivers/xen/privcmd.h
index 14facaeed36f..0dd9f8f67ee3 100644
--- a/drivers/xen/privcmd.h
+++ b/drivers/xen/privcmd.h
@@ -1,3 +1,6 @@
 #include <linux/fs.h>
 extern const struct file_operations xen_privcmd_fops;
+extern const struct file_operations xen_privcmdbuf_fops;
+extern struct miscdevice xen_privcmdbuf_dev;
diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
index 7bc88fd43cfc..e2f3e8b0fba9 100644
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -1012,6 +1012,7 @@ static void scsiback_do_add_lun(struct vscsibk_info *info, const char *state,
 {
        struct v2p_entry *entry;
        unsigned long flags;
+        int err;
        if (try) {
                spin_lock_irqsave(&info->v2p_lock, flags);
@@ -1027,8 +1028,11 @@ static void scsiback_do_add_lun(struct vscsibk_info *info, const char *state,
                        scsiback_del_translation_entry(info, vir);
                }
        } else if (!try) {
-                xenbus_printf(XBT_NIL, info->dev->nodename, state,
+                err = xenbus_printf(XBT_NIL, info->dev->nodename, state,
                              "%d", XenbusStateClosed);
+                if (err)
+                        xenbus_dev_error(info->dev, err,
+                                "%s: writing %s", __func__, state);
        }
 }
@@ -1067,8 +1071,11 @@ static void scsiback_do_1lun_hotplug(struct vscsibk_info *info, int op,
        snprintf(str, sizeof(str), "vscsi-devs/%s/p-dev", ent);
        val = xenbus_read(XBT_NIL, dev->nodename, str, NULL);
        if (IS_ERR(val)) {
-                xenbus_printf(XBT_NIL, dev->nodename, state,
+                err = xenbus_printf(XBT_NIL, dev->nodename, state,
                              "%d", XenbusStateClosed);
+                if (err)
+                        xenbus_dev_error(info->dev, err,
+                                "%s: writing %s", __func__, state);
                return;
        }
        strlcpy(phy, val, VSCSI_NAMELEN);
@@ -1079,8 +1086,11 @@ static void scsiback_do_1lun_hotplug(struct vscsibk_info *info, int op,
        err = xenbus_scanf(XBT_NIL, dev->nodename, str, "%u:%u:%u:%u",
                           &vir.hst, &vir.chn, &vir.tgt, &vir.lun);
        if (XENBUS_EXIST_ERR(err)) {
-                xenbus_printf(XBT_NIL, dev->nodename, state,
+                err = xenbus_printf(XBT_NIL, dev->nodename, state,
                              "%d", XenbusStateClosed);
+                if (err)
+                        xenbus_dev_error(info->dev, err,
+                                "%s: writing %s", __func__, state);
                return;
        }
diff --git a/fs/aio.c b/fs/aio.c
index e1d20124ec0e..210df9da1283 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -5,7 +5,6 @@
 *      Implements an efficient asynchronous io interface.
 *
 *      Copyright 2000, 2001, 2002 Red Hat, Inc.  All Rights Reserved.
- *      Copyright 2018 Christoph Hellwig.
 *
 *      See ../COPYING for licensing terms.
 */
@@ -165,22 +164,10 @@ struct fsync_iocb {
        bool                    datasync;
 };
-struct poll_iocb {
-        struct file             *file;
-        __poll_t                events;
-        struct wait_queue_head  *head;
-        union {
-                struct wait_queue_entry wait;
-                struct work_struct      work;
-        };
-};
 struct aio_kiocb {
        union {
                struct kiocb            rw;
                struct fsync_iocb       fsync;
-                struct poll_iocb        poll;
        };
        struct kioctx           *ki_ctx;
@@ -1590,6 +1577,7 @@ static int aio_fsync(struct fsync_iocb *req, struct iocb *iocb, bool datasync)
        if (unlikely(iocb->aio_buf || iocb->aio_offset || iocb->aio_nbytes ||
                        iocb->aio_rw_flags))
                return -EINVAL;
        req->file = fget(iocb->aio_fildes);
        if (unlikely(!req->file))
                return -EBADF;
@@ -1604,137 +1592,6 @@ static int aio_fsync(struct fsync_iocb *req, struct iocb *iocb, bool datasync)
        return 0;
 }
-/* need to use list_del_init so we can check if item was present */
-static inline bool __aio_poll_remove(struct poll_iocb *req)
-{
-        if (list_empty(&req->wait.entry))
-                return false;
-        list_del_init(&req->wait.entry);
-        return true;
-}
-static inline void __aio_poll_complete(struct aio_kiocb *iocb, __poll_t mask)
-{
-        fput(iocb->poll.file);
-        aio_complete(iocb, mangle_poll(mask), 0);
-}
-static void aio_poll_work(struct work_struct *work)
-{
-        struct aio_kiocb *iocb = container_of(work, struct aio_kiocb, poll.work);
-        if (!list_empty_careful(&iocb->ki_list))
-                aio_remove_iocb(iocb);
-        __aio_poll_complete(iocb, iocb->poll.events);
-}
-static int aio_poll_cancel(struct kiocb *iocb)
-{
-        struct aio_kiocb *aiocb = container_of(iocb, struct aio_kiocb, rw);
-        struct poll_iocb *req = &aiocb->poll;
-        struct wait_queue_head *head = req->head;
-        bool found = false;
-        spin_lock(&head->lock);
-        found = __aio_poll_remove(req);
-        spin_unlock(&head->lock);
-        if (found) {
-                req->events = 0;
-                INIT_WORK(&req->work, aio_poll_work);
-                schedule_work(&req->work);
-        }
-        return 0;
-}
-static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
-                void *key)
-{
-        struct poll_iocb *req = container_of(wait, struct poll_iocb, wait);
-        struct aio_kiocb *iocb = container_of(req, struct aio_kiocb, poll);
-        struct file *file = req->file;
-        __poll_t mask = key_to_poll(key);
-        assert_spin_locked(&req->head->lock);
-        /* for instances that support it check for an event match first: */
-        if (mask && !(mask & req->events))
-                return 0;
-        mask = file->f_op->poll_mask(file, req->events) & req->events;
-        if (!mask)
-                return 0;
-        __aio_poll_remove(req);
-        /*
-         * Try completing without a context switch if we can acquire ctx_lock
-         * without spinning.  Otherwise we need to defer to a workqueue to
-         * avoid a deadlock due to the lock order.
-         */
-        if (spin_trylock(&iocb->ki_ctx->ctx_lock)) {
-                list_del_init(&iocb->ki_list);
-                spin_unlock(&iocb->ki_ctx->ctx_lock);
-                __aio_poll_complete(iocb, mask);
-        } else {
-                req->events = mask;
-                INIT_WORK(&req->work, aio_poll_work);
-                schedule_work(&req->work);
-        }
-        return 1;
-}
-static ssize_t aio_poll(struct aio_kiocb *aiocb, struct iocb *iocb)
-{
-        struct kioctx *ctx = aiocb->ki_ctx;
-        struct poll_iocb *req = &aiocb->poll;
-        __poll_t mask;
-        /* reject any unknown events outside the normal event mask. */
-        if ((u16)iocb->aio_buf != iocb->aio_buf)
-                return -EINVAL;
-        /* reject fields that are not defined for poll */
-        if (iocb->aio_offset || iocb->aio_nbytes || iocb->aio_rw_flags)
-                return -EINVAL;
-        req->events = demangle_poll(iocb->aio_buf) | EPOLLERR | EPOLLHUP;
-        req->file = fget(iocb->aio_fildes);
-        if (unlikely(!req->file))
-                return -EBADF;
-        if (!file_has_poll_mask(req->file))
-                goto out_fail;
-        req->head = req->file->f_op->get_poll_head(req->file, req->events);
-        if (!req->head)
-                goto out_fail;
-        if (IS_ERR(req->head)) {
-                mask = EPOLLERR;
-                goto done;
-        }
-        init_waitqueue_func_entry(&req->wait, aio_poll_wake);
-        aiocb->ki_cancel = aio_poll_cancel;
-        spin_lock_irq(&ctx->ctx_lock);
-        spin_lock(&req->head->lock);
-        mask = req->file->f_op->poll_mask(req->file, req->events) & req->events;
-        if (!mask) {
-                __add_wait_queue(req->head, &req->wait);
-                list_add_tail(&aiocb->ki_list, &ctx->active_reqs);
-        }
-        spin_unlock(&req->head->lock);
-        spin_unlock_irq(&ctx->ctx_lock);
-done:
-        if (mask)
-                __aio_poll_complete(aiocb, mask);
-        return 0;
-out_fail:
-        fput(req->file);
-        return -EINVAL; /* same as no support for IOCB_CMD_POLL */
-}
 static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
                         bool compat)
 {
@@ -1808,9 +1665,6 @@ static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
        case IOCB_CMD_FDSYNC:
                ret = aio_fsync(&req->fsync, &iocb, true);
                break;
-        case IOCB_CMD_POLL:
-                ret = aio_poll(req, &iocb);
-                break;
        default:
                pr_debug("invalid aio operation %d\n", iocb.aio_lio_opcode);
                ret = -EINVAL;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index cce6087d6880..e55843f536bc 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4542,8 +4542,11 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                        offset_in_extent = em_start - em->start;
                em_end = extent_map_end(em);
                em_len = em_end - em_start;
-                disko = em->block_start + offset_in_extent;
                flags = 0;
+                if (em->block_start < EXTENT_MAP_LAST_BYTE)
+                        disko = em->block_start + offset_in_extent;
+                else
+                        disko = 0;
                /*
                 * bump off for our next call to get_extent
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index e9482f0db9d0..eba61bcb9bb3 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9005,13 +9005,14 @@ again:
        unlock_extent_cached(io_tree, page_start, page_end, &cached_state);
-out_unlock:
        if (!ret2) {
                btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE, true);
                sb_end_pagefault(inode->i_sb);
                extent_changeset_free(data_reserved);
                return VM_FAULT_LOCKED;
        }
+out_unlock:
        unlock_page(page);
 out:
        btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE, (ret != 0));
@@ -9443,6 +9444,7 @@ static int btrfs_rename_exchange(struct inode *old_dir,
        u64 new_idx = 0;
        u64 root_objectid;
        int ret;
+        int ret2;
        bool root_log_pinned = false;
        bool dest_log_pinned = false;
@@ -9639,7 +9641,8 @@ out_fail:
                        dest_log_pinned = false;
                }
        }
-        ret = btrfs_end_transaction(trans);
+        ret2 = btrfs_end_transaction(trans);
+        ret = ret ? ret : ret2;
 out_notrans:
        if (new_ino == BTRFS_FIRST_FREE_OBJECTID)
                up_read(&fs_info->subvol_sem);
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index c2837a32d689..43ecbe620dea 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3577,7 +3577,7 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen,
                ret = btrfs_extent_same_range(src, loff, BTRFS_MAX_DEDUPE_LEN,
                                              dst, dst_loff, &cmp);
                if (ret)
-                        goto out_unlock;
+                        goto out_free;
                loff += BTRFS_MAX_DEDUPE_LEN;
                dst_loff += BTRFS_MAX_DEDUPE_LEN;
@@ -3587,16 +3587,16 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen,
                ret = btrfs_extent_same_range(src, loff, tail_len, dst,
                                              dst_loff, &cmp);
+out_free:
+        kvfree(cmp.src_pages);
+        kvfree(cmp.dst_pages);
 out_unlock:
        if (same_inode)
                inode_unlock(src);
        else
                btrfs_double_inode_unlock(src, dst);
-out_free:
-        kvfree(cmp.src_pages);
-        kvfree(cmp.dst_pages);
        return ret;
 }
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 1874a6d2e6f5..c25dc47210a3 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2680,8 +2680,10 @@ out:
                free_extent_buffer(scratch_leaf);
        }
-        if (done && !ret)
+        if (done && !ret) {
                ret = 1;
+                fs_info->qgroup_rescan_progress.objectid = (u64)-1;
+        }
        return ret;
 }
@@ -2784,13 +2786,20 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid,
        if (!init_flags) {
                /* we're resuming qgroup rescan at mount time */
-                if (!(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN))
+                if (!(fs_info->qgroup_flags &
+                      BTRFS_QGROUP_STATUS_FLAG_RESCAN)) {
                        btrfs_warn(fs_info,
                        "qgroup rescan init failed, qgroup is not enabled");
-                else if (!(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_ON))
+                        ret = -EINVAL;
+                } else if (!(fs_info->qgroup_flags &
+                             BTRFS_QGROUP_STATUS_FLAG_ON)) {
                        btrfs_warn(fs_info,
                        "qgroup rescan init failed, qgroup rescan is not queued");
-                return -EINVAL;
+                        ret = -EINVAL;
+                }
+                if (ret)
+                        return ret;
        }
        mutex_lock(&fs_info->qgroup_rescan_lock);
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index ee764ac352ab..a866be999216 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1135,6 +1135,7 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in)
        if (IS_ERR(realdn)) {
                pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n",
                       PTR_ERR(realdn), dn, in, ceph_vinop(in));
+                dput(dn);
                dn = realdn; /* note realdn contains the error */
                goto out;
        } else if (realdn) {
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 116146022aa1..bfe999505815 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -126,6 +126,25 @@ static void cifs_debug_tcon(struct seq_file *m, struct cifs_tcon *tcon)
        seq_putc(m, '\n');
 }
+static void
+cifs_dump_iface(struct seq_file *m, struct cifs_server_iface *iface)
+{
+        struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
+        struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
+        seq_printf(m, "\t\tSpeed: %zu bps\n", iface->speed);
+        seq_puts(m, "\t\tCapabilities: ");
+        if (iface->rdma_capable)
+                seq_puts(m, "rdma ");
+        if (iface->rss_capable)
+                seq_puts(m, "rss ");
+        seq_putc(m, '\n');
+        if (iface->sockaddr.ss_family == AF_INET)
+                seq_printf(m, "\t\tIPv4: %pI4\n", &ipv4->sin_addr);
+        else if (iface->sockaddr.ss_family == AF_INET6)
+                seq_printf(m, "\t\tIPv6: %pI6\n", &ipv6->sin6_addr);
+}
 static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
 {
        struct list_head *tmp1, *tmp2, *tmp3;
@@ -312,6 +331,16 @@ skip_rdma:
                                              mid_entry->mid);
                        }
                        spin_unlock(&GlobalMid_Lock);
+                        spin_lock(&ses->iface_lock);
+                        if (ses->iface_count)
+                                seq_printf(m, "\n\tServer interfaces: %zu\n",
+                                           ses->iface_count);
+                        for (j = 0; j < ses->iface_count; j++) {
+                                seq_printf(m, "\t%d)\n", j);
+                                cifs_dump_iface(m, &ses->iface_list[j]);
+                        }
+                        spin_unlock(&ses->iface_lock);
                }
        }
        spin_unlock(&cifs_tcp_ses_lock);
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 937251cc61c0..ee2a8ec70056 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -37,7 +37,6 @@
 #include <crypto/aead.h>
 int __cifs_calc_signature(struct smb_rqst *rqst,
-                        int start,
                        struct TCP_Server_Info *server, char *signature,
                        struct shash_desc *shash)
 {
@@ -45,16 +44,27 @@ int __cifs_calc_signature(struct smb_rqst *rqst,
        int rc;
        struct kvec *iov = rqst->rq_iov;
        int n_vec = rqst->rq_nvec;
+        int is_smb2 = server->vals->header_preamble_size == 0;
-        for (i = start; i < n_vec; i++) {
+        /* iov[0] is actual data and not the rfc1002 length for SMB2+ */
+        if (is_smb2) {
+                if (iov[0].iov_len <= 4)
+                        return -EIO;
+                i = 0;
+        } else {
+                if (n_vec < 2 || iov[0].iov_len != 4)
+                        return -EIO;
+                i = 1; /* skip rfc1002 length */
+        }
+        for (; i < n_vec; i++) {
                if (iov[i].iov_len == 0)
                        continue;
                if (iov[i].iov_base == NULL) {
                        cifs_dbg(VFS, "null iovec entry\n");
                        return -EIO;
                }
-                if (i == 1 && iov[1].iov_len <= 4)
-                        break; /* nothing to sign or corrupt header */
                rc = crypto_shash_update(shash,
                                         iov[i].iov_base, iov[i].iov_len);
                if (rc) {
@@ -118,7 +128,7 @@ static int cifs_calc_signature(struct smb_rqst *rqst,
                return rc;
        }
-        return __cifs_calc_signature(rqst, 1, server, signature,
+        return __cifs_calc_signature(rqst, server, signature,
                                     &server->secmech.sdescmd5->shash);
 }
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 1efa2e65bc1a..bd78da59a4fd 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -33,6 +33,9 @@
 #define CIFS_MAGIC_NUMBER 0xFF534D42      /* the first four bytes of SMB PDUs */
+#define CIFS_PORT 445
+#define RFC1001_PORT 139
 /*
 * The sizes of various internal tables and strings
 */
@@ -312,6 +315,10 @@ struct smb_version_operations {
        /* send echo request */
        int (*echo)(struct TCP_Server_Info *);
        /* create directory */
+        int (*posix_mkdir)(const unsigned int xid, struct inode *inode,
+                        umode_t mode, struct cifs_tcon *tcon,
+                        const char *full_path,
+                        struct cifs_sb_info *cifs_sb);
        int (*mkdir)(const unsigned int, struct cifs_tcon *, const char *,
                     struct cifs_sb_info *);
        /* set info on created directory */
@@ -838,6 +845,13 @@ static inline void cifs_set_net_ns(struct TCP_Server_Info *srv, struct net *net)
 #endif
+struct cifs_server_iface {
+        size_t speed;
+        unsigned int rdma_capable : 1;
+        unsigned int rss_capable : 1;
+        struct sockaddr_storage sockaddr;
+};
 /*
 * Session structure.  One of these for each uid session with a particular host
 */
@@ -875,6 +889,20 @@ struct cifs_ses {
 #ifdef CONFIG_CIFS_SMB311
        __u8 preauth_sha_hash[SMB2_PREAUTH_HASH_SIZE];
 #endif /* 3.1.1 */
+        /*
+         * Network interfaces available on the server this session is
+         * connected to.
+         *
+         * Other channels can be opened by connecting and binding this
+         * session to interfaces from this list.
+         *
+         * iface_lock should be taken when accessing any of these fields
+         */
+        spinlock_t iface_lock;
+        struct cifs_server_iface *iface_list;
+        size_t iface_count;
+        unsigned long iface_last_update; /* jiffies */
 };
 static inline bool
@@ -883,6 +911,14 @@ cap_unix(struct cifs_ses *ses)
        return ses->server->vals->cap_unix & ses->capabilities;
 }
+struct cached_fid {
+        bool is_valid:1;        /* Do we have a useable root fid */
+        struct cifs_fid *fid;
+        struct mutex fid_mutex;
+        struct cifs_tcon *tcon;
+        struct work_struct lease_break;
+};
 /*
 * there is one of these for each connection to a resource on a particular
 * session
@@ -987,9 +1023,7 @@ struct cifs_tcon {
        struct fscache_cookie *fscache; /* cookie for share */
 #endif
        struct list_head pending_opens; /* list of incomplete opens */
-        bool valid_root_fid:1;  /* Do we have a useable root fid */
+        struct cached_fid crfid; /* Cached root fid */
-        struct mutex prfid_mutex; /* prevents reopen race after dead ses*/
-        struct cifs_fid *prfid; /* handle to the directory at top of share */
        /* BB add field for back pointer to sb struct(s)? */
 };
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 4e0d183c3d10..03018be17283 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -112,10 +112,6 @@ extern int SendReceive2(const unsigned int /* xid */ , struct cifs_ses *,
                        struct kvec *, int /* nvec to send */,
                        int * /* type of buf returned */, const int flags,
                        struct kvec * /* resp vec */);
-extern int smb2_send_recv(const unsigned int xid, struct cifs_ses *pses,
-                          struct kvec *pkvec, int nvec_to_send,
-                          int *pbuftype, const int flags,
-                          struct kvec *presp);
 extern int SendReceiveBlockingLock(const unsigned int xid,
                        struct cifs_tcon *ptcon,
                        struct smb_hdr *in_buf ,
@@ -544,7 +540,7 @@ int cifs_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon,
                           struct cifs_sb_info *cifs_sb,
                           const unsigned char *path, char *pbuf,
                           unsigned int *pbytes_written);
-int __cifs_calc_signature(struct smb_rqst *rqst, int start,
+int __cifs_calc_signature(struct smb_rqst *rqst,
                        struct TCP_Server_Info *server, char *signature,
                        struct shash_desc *shash);
 enum securityEnum cifs_select_sectype(struct TCP_Server_Info *,
@@ -552,6 +548,7 @@ enum securityEnum cifs_select_sectype(struct TCP_Server_Info *,
 struct cifs_aio_ctx *cifs_aio_ctx_alloc(void);
 void cifs_aio_ctx_release(struct kref *refcount);
 int setup_aio_ctx_iter(struct cifs_aio_ctx *ctx, struct iov_iter *iter, int rw);
+void smb2_cached_lease_break(struct work_struct *work);
 int cifs_alloc_hash(const char *name, struct crypto_shash **shash,
                    struct sdesc **sdesc);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 42329b25877d..d352da325de3 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -107,10 +107,10 @@ cifs_mark_open_files_invalid(struct cifs_tcon *tcon)
        }
        spin_unlock(&tcon->open_file_lock);
-        mutex_lock(&tcon->prfid_mutex);
+        mutex_lock(&tcon->crfid.fid_mutex);
-        tcon->valid_root_fid = false;
+        tcon->crfid.is_valid = false;
-        memset(tcon->prfid, 0, sizeof(struct cifs_fid));
+        memset(tcon->crfid.fid, 0, sizeof(struct cifs_fid));
-        mutex_unlock(&tcon->prfid_mutex);
+        mutex_unlock(&tcon->crfid.fid_mutex);
        /*
         * BB Add call to invalidate_inodes(sb) for all superblocks mounted
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 96645a7d8f27..a57da1b88bdf 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -57,9 +57,6 @@
 #include "smb2proto.h"
 #include "smbdirect.h"
-#define CIFS_PORT 445
-#define RFC1001_PORT 139
 extern mempool_t *cifs_req_poolp;
 extern bool disable_legacy_dialects;
@@ -3029,8 +3026,11 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
 #ifdef CONFIG_CIFS_SMB311
        if ((volume_info->linux_ext) && (ses->server->posix_ext_supported)) {
-                if (ses->server->vals->protocol_id == SMB311_PROT_ID)
+                if (ses->server->vals->protocol_id == SMB311_PROT_ID) {
                        tcon->posix_extensions = true;
+                        printk_once(KERN_WARNING
+                                "SMB3.11 POSIX Extensions are experimental\n");
+                }
        }
 #endif /* 311 */
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index f4697f548a39..a2cfb33e85c1 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1575,6 +1575,17 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, umode_t mode)
                goto mkdir_out;
        }
+        server = tcon->ses->server;
+#ifdef CONFIG_CIFS_SMB311
+        if ((server->ops->posix_mkdir) && (tcon->posix_extensions)) {
+                rc = server->ops->posix_mkdir(xid, inode, mode, tcon, full_path,
+                                              cifs_sb);
+                d_drop(direntry); /* for time being always refresh inode info */
+                goto mkdir_out;
+        }
+#endif /* SMB311 */
        if (cap_unix(tcon->ses) && (CIFS_UNIX_POSIX_PATH_OPS_CAP &
                                le64_to_cpu(tcon->fsUnixInfo.Capability))) {
                rc = cifs_posix_mkdir(inode, direntry, mode, full_path, cifs_sb,
@@ -1583,8 +1594,6 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, umode_t mode)
                        goto mkdir_out;
        }
-        server = tcon->ses->server;
        if (!server->ops->mkdir) {
                rc = -ENOSYS;
                goto mkdir_out;
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index af29ade195c0..53e8362cbc4a 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -82,6 +82,7 @@ sesInfoAlloc(void)
                INIT_LIST_HEAD(&ret_buf->smb_ses_list);
                INIT_LIST_HEAD(&ret_buf->tcon_list);
                mutex_init(&ret_buf->session_mutex);
+                spin_lock_init(&ret_buf->iface_lock);
        }
        return ret_buf;
 }
@@ -102,6 +103,7 @@ sesInfoFree(struct cifs_ses *buf_to_free)
        kfree(buf_to_free->user_name);
        kfree(buf_to_free->domainName);
        kzfree(buf_to_free->auth_key.response);
+        kfree(buf_to_free->iface_list);
        kzfree(buf_to_free);
 }
@@ -117,8 +119,9 @@ tconInfoAlloc(void)
                INIT_LIST_HEAD(&ret_buf->openFileList);
                INIT_LIST_HEAD(&ret_buf->tcon_list);
                spin_lock_init(&ret_buf->open_file_lock);
-                mutex_init(&ret_buf->prfid_mutex);
+                mutex_init(&ret_buf->crfid.fid_mutex);
-                ret_buf->prfid = kzalloc(sizeof(struct cifs_fid), GFP_KERNEL);
+                ret_buf->crfid.fid = kzalloc(sizeof(struct cifs_fid),
+                                             GFP_KERNEL);
 #ifdef CONFIG_CIFS_STATS
                spin_lock_init(&ret_buf->stat_lock);
 #endif
@@ -136,7 +139,7 @@ tconInfoFree(struct cifs_tcon *buf_to_free)
        atomic_dec(&tconInfoAllocCount);
        kfree(buf_to_free->nativeFileSystem);
        kzfree(buf_to_free->password);
-        kfree(buf_to_free->prfid);
+        kfree(buf_to_free->crfid.fid);
        kfree(buf_to_free);
 }
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index e2bec47c6845..3ff7cec2da81 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -454,7 +454,8 @@ cifs_convert_path_to_utf16(const char *from, struct cifs_sb_info *cifs_sb)
 #ifdef CONFIG_CIFS_SMB311
        /* SMB311 POSIX extensions paths do not include leading slash */
        else if (cifs_sb_master_tlink(cifs_sb) &&
-                 cifs_sb_master_tcon(cifs_sb)->posix_extensions) {
+                 cifs_sb_master_tcon(cifs_sb)->posix_extensions &&
+                 (from[0] == '/')) {
                start_of_path = from + 1;
        }
 #endif /* 311 */
@@ -492,10 +493,11 @@ cifs_ses_oplock_break(struct work_struct *work)
 {
        struct smb2_lease_break_work *lw = container_of(work,
                                struct smb2_lease_break_work, lease_break);
-        int rc;
+        int rc = 0;
        rc = SMB2_lease_break(0, tlink_tcon(lw->tlink), lw->lease_key,
                              lw->lease_state);
        cifs_dbg(FYI, "Lease release rc %d\n", rc);
        cifs_put_tlink(lw->tlink);
        kfree(lw);
@@ -561,6 +563,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
                open->oplock = lease_state;
        }
        return found;
 }
@@ -603,6 +606,18 @@ smb2_is_valid_lease_break(char *buffer)
                                        return true;
                                }
                                spin_unlock(&tcon->open_file_lock);
+                                if (tcon->crfid.is_valid &&
+                                    !memcmp(rsp->LeaseKey,
+                                            tcon->crfid.fid->lease_key,
+                                            SMB2_LEASE_KEY_SIZE)) {
+                                        INIT_WORK(&tcon->crfid.lease_break,
+                                                  smb2_cached_lease_break);
+                                        queue_work(cifsiod_wq,
+                                                   &tcon->crfid.lease_break);
+                                        spin_unlock(&cifs_tcp_ses_lock);
+                                        return true;
+                                }
                        }
                }
        }
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index b15f5957d645..0356b5559c71 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -294,34 +294,191 @@ smb2_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *volume_info)
        return rsize;
 }
-#ifdef CONFIG_CIFS_STATS2
+static int
+parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+                        size_t buf_len,
+                        struct cifs_server_iface **iface_list,
+                        size_t *iface_count)
+{
+        struct network_interface_info_ioctl_rsp *p;
+        struct sockaddr_in *addr4;
+        struct sockaddr_in6 *addr6;
+        struct iface_info_ipv4 *p4;
+        struct iface_info_ipv6 *p6;
+        struct cifs_server_iface *info;
+        ssize_t bytes_left;
+        size_t next = 0;
+        int nb_iface = 0;
+        int rc = 0;
+        *iface_list = NULL;
+        *iface_count = 0;
+        /*
+         * Fist pass: count and sanity check
+         */
+        bytes_left = buf_len;
+        p = buf;
+        while (bytes_left >= sizeof(*p)) {
+                nb_iface++;
+                next = le32_to_cpu(p->Next);
+                if (!next) {
+                        bytes_left -= sizeof(*p);
+                        break;
+                }
+                p = (struct network_interface_info_ioctl_rsp *)((u8 *)p+next);
+                bytes_left -= next;
+        }
+        if (!nb_iface) {
+                cifs_dbg(VFS, "%s: malformed interface info\n", __func__);
+                rc = -EINVAL;
+                goto out;
+        }
+        if (bytes_left || p->Next)
+                cifs_dbg(VFS, "%s: incomplete interface info\n", __func__);
+        /*
+         * Second pass: extract info to internal structure
+         */
+        *iface_list = kcalloc(nb_iface, sizeof(**iface_list), GFP_KERNEL);
+        if (!*iface_list) {
+                rc = -ENOMEM;
+                goto out;
+        }
+        info = *iface_list;
+        bytes_left = buf_len;
+        p = buf;
+        while (bytes_left >= sizeof(*p)) {
+                info->speed = le64_to_cpu(p->LinkSpeed);
+                info->rdma_capable = le32_to_cpu(p->Capability & RDMA_CAPABLE);
+                info->rss_capable = le32_to_cpu(p->Capability & RSS_CAPABLE);
+                cifs_dbg(FYI, "%s: adding iface %zu\n", __func__, *iface_count);
+                cifs_dbg(FYI, "%s: speed %zu bps\n", __func__, info->speed);
+                cifs_dbg(FYI, "%s: capabilities 0x%08x\n", __func__,
+                         le32_to_cpu(p->Capability));
+                switch (p->Family) {
+                /*
+                 * The kernel and wire socket structures have the same
+                 * layout and use network byte order but make the
+                 * conversion explicit in case either one changes.
+                 */
+                case INTERNETWORK:
+                        addr4 = (struct sockaddr_in *)&info->sockaddr;
+                        p4 = (struct iface_info_ipv4 *)p->Buffer;
+                        addr4->sin_family = AF_INET;
+                        memcpy(&addr4->sin_addr, &p4->IPv4Address, 4);
+                        /* [MS-SMB2] 2.2.32.5.1.1 Clients MUST ignore these */
+                        addr4->sin_port = cpu_to_be16(CIFS_PORT);
+                        cifs_dbg(FYI, "%s: ipv4 %pI4\n", __func__,
+                                 &addr4->sin_addr);
+                        break;
+                case INTERNETWORKV6:
+                        addr6 = (struct sockaddr_in6 *)&info->sockaddr;
+                        p6 = (struct iface_info_ipv6 *)p->Buffer;
+                        addr6->sin6_family = AF_INET6;
+                        memcpy(&addr6->sin6_addr, &p6->IPv6Address, 16);
+                        /* [MS-SMB2] 2.2.32.5.1.2 Clients MUST ignore these */
+                        addr6->sin6_flowinfo = 0;
+                        addr6->sin6_scope_id = 0;
+                        addr6->sin6_port = cpu_to_be16(CIFS_PORT);
+                        cifs_dbg(FYI, "%s: ipv6 %pI6\n", __func__,
+                                 &addr6->sin6_addr);
+                        break;
+                default:
+                        cifs_dbg(VFS,
+                                 "%s: skipping unsupported socket family\n",
+                                 __func__);
+                        goto next_iface;
+                }
+                (*iface_count)++;
+                info++;
+next_iface:
+                next = le32_to_cpu(p->Next);
+                if (!next)
+                        break;
+                p = (struct network_interface_info_ioctl_rsp *)((u8 *)p+next);
+                bytes_left -= next;
+        }
+        if (!*iface_count) {
+                rc = -EINVAL;
+                goto out;
+        }
+out:
+        if (rc) {
+                kfree(*iface_list);
+                *iface_count = 0;
+                *iface_list = NULL;
+        }
+        return rc;
+}
 static int
 SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon)
 {
        int rc;
        unsigned int ret_data_len = 0;
-        struct network_interface_info_ioctl_rsp *out_buf;
+        struct network_interface_info_ioctl_rsp *out_buf = NULL;
+        struct cifs_server_iface *iface_list;
+        size_t iface_count;
+        struct cifs_ses *ses = tcon->ses;
        rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
                        FSCTL_QUERY_NETWORK_INTERFACE_INFO, true /* is_fsctl */,
                        NULL /* no data input */, 0 /* no data input */,
                        (char **)&out_buf, &ret_data_len);
-        if (rc != 0)
+        if (rc != 0) {
                cifs_dbg(VFS, "error %d on ioctl to get interface list\n", rc);
-        else if (ret_data_len < sizeof(struct network_interface_info_ioctl_rsp)) {
+                goto out;
-                cifs_dbg(VFS, "server returned bad net interface info buf\n");
-                rc = -EINVAL;
-        } else {
-                /* Dump info on first interface */
-                cifs_dbg(FYI, "Adapter Capability 0x%x\t",
-                        le32_to_cpu(out_buf->Capability));
-                cifs_dbg(FYI, "Link Speed %lld\n",
-                        le64_to_cpu(out_buf->LinkSpeed));
        }
+        rc = parse_server_interfaces(out_buf, ret_data_len,
+                                     &iface_list, &iface_count);
+        if (rc)
+                goto out;
+        spin_lock(&ses->iface_lock);
+        kfree(ses->iface_list);
+        ses->iface_list = iface_list;
+        ses->iface_count = iface_count;
+        ses->iface_last_update = jiffies;
+        spin_unlock(&ses->iface_lock);
+out:
        kfree(out_buf);
        return rc;
 }
-#endif /* STATS2 */
+void
+smb2_cached_lease_break(struct work_struct *work)
+{
+        struct cached_fid *cfid = container_of(work,
+                                struct cached_fid, lease_break);
+        mutex_lock(&cfid->fid_mutex);
+        if (cfid->is_valid) {
+                cifs_dbg(FYI, "clear cached root file handle\n");
+                SMB2_close(0, cfid->tcon, cfid->fid->persistent_fid,
+                           cfid->fid->volatile_fid);
+                cfid->is_valid = false;
+        }
+        mutex_unlock(&cfid->fid_mutex);
+}
 /*
 * Open the directory at the root of a share
@@ -331,13 +488,13 @@ int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid)
        struct cifs_open_parms oparams;
        int rc;
        __le16 srch_path = 0; /* Null - since an open of top of share */
-        u8 oplock = SMB2_OPLOCK_LEVEL_NONE;
+        u8 oplock = SMB2_OPLOCK_LEVEL_II;
-        mutex_lock(&tcon->prfid_mutex);
+        mutex_lock(&tcon->crfid.fid_mutex);
-        if (tcon->valid_root_fid) {
+        if (tcon->crfid.is_valid) {
                cifs_dbg(FYI, "found a cached root file handle\n");
-                memcpy(pfid, tcon->prfid, sizeof(struct cifs_fid));
+                memcpy(pfid, tcon->crfid.fid, sizeof(struct cifs_fid));
-                mutex_unlock(&tcon->prfid_mutex);
+                mutex_unlock(&tcon->crfid.fid_mutex);
                return 0;
        }
@@ -350,10 +507,11 @@ int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid)
        rc = SMB2_open(xid, &oparams, &srch_path, &oplock, NULL, NULL, NULL);
        if (rc == 0) {
-                memcpy(tcon->prfid, pfid, sizeof(struct cifs_fid));
+                memcpy(tcon->crfid.fid, pfid, sizeof(struct cifs_fid));
-                tcon->valid_root_fid = true;
+                tcon->crfid.tcon = tcon;
+                tcon->crfid.is_valid = true;
        }
-        mutex_unlock(&tcon->prfid_mutex);
+        mutex_unlock(&tcon->crfid.fid_mutex);
        return rc;
 }
@@ -383,9 +541,7 @@ smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon)
        if (rc)
                return;
-#ifdef CONFIG_CIFS_STATS2
        SMB3_request_interfaces(xid, tcon);
-#endif /* STATS2 */
        SMB2_QFS_attr(xid, tcon, fid.persistent_fid, fid.volatile_fid,
                        FS_ATTRIBUTE_INFORMATION);
@@ -436,7 +592,7 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon,
        struct cifs_open_parms oparms;
        struct cifs_fid fid;
-        if ((*full_path == 0) && tcon->valid_root_fid)
+        if ((*full_path == 0) && tcon->crfid.is_valid)
                return 0;
        utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb);
@@ -2151,7 +2307,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
                   struct smb_rqst *old_rq)
 {
        struct smb2_sync_hdr *shdr =
-                        (struct smb2_sync_hdr *)old_rq->rq_iov[1].iov_base;
+                        (struct smb2_sync_hdr *)old_rq->rq_iov[0].iov_base;
        memset(tr_hdr, 0, sizeof(struct smb2_transform_hdr));
        tr_hdr->ProtocolId = SMB2_TRANSFORM_PROTO_NUM;
@@ -2171,14 +2327,13 @@ static inline void smb2_sg_set_buf(struct scatterlist *sg, const void *buf,
 }
 /* Assumes:
- * rqst->rq_iov[0]  is rfc1002 length
+ * rqst->rq_iov[0]  is transform header
- * rqst->rq_iov[1]  is tranform header
+ * rqst->rq_iov[1+] data to be encrypted/decrypted
- * rqst->rq_iov[2+] data to be encrypted/decrypted
 */
 static struct scatterlist *
 init_sg(struct smb_rqst *rqst, u8 *sign)
 {
-        unsigned int sg_len = rqst->rq_nvec + rqst->rq_npages;
+        unsigned int sg_len = rqst->rq_nvec + rqst->rq_npages + 1;
        unsigned int assoc_data_len = sizeof(struct smb2_transform_hdr) - 20;
        struct scatterlist *sg;
        unsigned int i;
@@ -2189,10 +2344,10 @@ init_sg(struct smb_rqst *rqst, u8 *sign)
                return NULL;
        sg_init_table(sg, sg_len);
-        smb2_sg_set_buf(&sg[0], rqst->rq_iov[1].iov_base + 20, assoc_data_len);
+        smb2_sg_set_buf(&sg[0], rqst->rq_iov[0].iov_base + 20, assoc_data_len);
-        for (i = 1; i < rqst->rq_nvec - 1; i++)
+        for (i = 1; i < rqst->rq_nvec; i++)
-                smb2_sg_set_buf(&sg[i], rqst->rq_iov[i+1].iov_base,
+                smb2_sg_set_buf(&sg[i], rqst->rq_iov[i].iov_base,
-                                                rqst->rq_iov[i+1].iov_len);
+                                                rqst->rq_iov[i].iov_len);
        for (j = 0; i < sg_len - 1; i++, j++) {
                unsigned int len, offset;
@@ -2224,18 +2379,17 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key)
        return 1;
 }
 /*
- * Encrypt or decrypt @rqst message. @rqst has the following format:
+ * Encrypt or decrypt @rqst message. @rqst[0] has the following format:
- * iov[0] - rfc1002 length
+ * iov[0]   - transform header (associate data),
- * iov[1] - transform header (associate data),
+ * iov[1-N] - SMB2 header and pages - data to encrypt.
- * iov[2-N] and pages - data to encrypt.
+ * On success return encrypted data in iov[1-N] and pages, leave iov[0]
- * On success return encrypted data in iov[2-N] and pages, leave iov[0-1]
 * untouched.
 */
 static int
 crypt_message(struct TCP_Server_Info *server, struct smb_rqst *rqst, int enc)
 {
        struct smb2_transform_hdr *tr_hdr =
-                        (struct smb2_transform_hdr *)rqst->rq_iov[1].iov_base;
+                        (struct smb2_transform_hdr *)rqst->rq_iov[0].iov_base;
        unsigned int assoc_data_len = sizeof(struct smb2_transform_hdr) - 20;
        int rc = 0;
        struct scatterlist *sg;
@@ -2323,10 +2477,6 @@ free_req:
        return rc;
 }
-/*
- * This is called from smb_send_rqst. At this point we have the rfc1002
- * header as the first element in the vector.
- */
 static int
 smb3_init_transform_rq(struct TCP_Server_Info *server, struct smb_rqst *new_rq,
                       struct smb_rqst *old_rq)
@@ -2335,7 +2485,7 @@ smb3_init_transform_rq(struct TCP_Server_Info *server, struct smb_rqst *new_rq,
        struct page **pages;
        struct smb2_transform_hdr *tr_hdr;
        unsigned int npages = old_rq->rq_npages;
-        unsigned int orig_len = get_rfc1002_length(old_rq->rq_iov[0].iov_base);
+        unsigned int orig_len;
        int i;
        int rc = -ENOMEM;
@@ -2355,18 +2505,14 @@ smb3_init_transform_rq(struct TCP_Server_Info *server, struct smb_rqst *new_rq,
                        goto err_free_pages;
        }
-        /* Make space for one extra iov to hold the transform header */
        iov = kmalloc_array(old_rq->rq_nvec + 1, sizeof(struct kvec),
                            GFP_KERNEL);
        if (!iov)
                goto err_free_pages;
-        /* copy all iovs from the old except the 1st one (rfc1002 length) */
+        /* copy all iovs from the old */
-        memcpy(&iov[2], &old_rq->rq_iov[1],
+        memcpy(&iov[1], &old_rq->rq_iov[0],
-                                sizeof(struct kvec) * (old_rq->rq_nvec - 1));
+                                sizeof(struct kvec) * old_rq->rq_nvec);
-        /* copy the rfc1002 iov */
-        iov[0].iov_base = old_rq->rq_iov[0].iov_base;
-        iov[0].iov_len  = old_rq->rq_iov[0].iov_len;
        new_rq->rq_iov = iov;
        new_rq->rq_nvec = old_rq->rq_nvec + 1;
@@ -2375,14 +2521,12 @@ smb3_init_transform_rq(struct TCP_Server_Info *server, struct smb_rqst *new_rq,
        if (!tr_hdr)
                goto err_free_iov;
+        orig_len = smb2_rqst_len(old_rq, false);
        /* fill the 2nd iov with a transform header */
        fill_transform_hdr(tr_hdr, orig_len, old_rq);
-        new_rq->rq_iov[1].iov_base = tr_hdr;
+        new_rq->rq_iov[0].iov_base = tr_hdr;
-        new_rq->rq_iov[1].iov_len = sizeof(struct smb2_transform_hdr);
+        new_rq->rq_iov[0].iov_len = sizeof(struct smb2_transform_hdr);
-        /* Update rfc1002 header */
-        inc_rfc1001_len(new_rq->rq_iov[0].iov_base,
-                        sizeof(struct smb2_transform_hdr));
        /* copy pages form the old */
        for (i = 0; i < npages; i++) {
@@ -2426,7 +2570,7 @@ smb3_free_transform_rq(struct smb_rqst *rqst)
                put_page(rqst->rq_pages[i]);
        kfree(rqst->rq_pages);
        /* free transform header */
-        kfree(rqst->rq_iov[1].iov_base);
+        kfree(rqst->rq_iov[0].iov_base);
        kfree(rqst->rq_iov);
 }
@@ -2443,19 +2587,17 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf,
                 unsigned int buf_data_size, struct page **pages,
                 unsigned int npages, unsigned int page_data_size)
 {
-        struct kvec iov[3];
+        struct kvec iov[2];
        struct smb_rqst rqst = {NULL};
        int rc;
-        iov[0].iov_base = NULL;
+        iov[0].iov_base = buf;
-        iov[0].iov_len = 0;
+        iov[0].iov_len = sizeof(struct smb2_transform_hdr);
-        iov[1].iov_base = buf;
+        iov[1].iov_base = buf + sizeof(struct smb2_transform_hdr);
-        iov[1].iov_len = sizeof(struct smb2_transform_hdr);
+        iov[1].iov_len = buf_data_size;
-        iov[2].iov_base = buf + sizeof(struct smb2_transform_hdr);
-        iov[2].iov_len = buf_data_size;
        rqst.rq_iov = iov;
-        rqst.rq_nvec = 3;
+        rqst.rq_nvec = 2;
        rqst.rq_pages = pages;
        rqst.rq_npages = npages;
        rqst.rq_pagesz = PAGE_SIZE;
@@ -2467,7 +2609,7 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf,
        if (rc)
                return rc;
-        memmove(buf, iov[2].iov_base, buf_data_size);
+        memmove(buf, iov[1].iov_base, buf_data_size);
        server->total_read = buf_data_size + page_data_size;
@@ -3170,6 +3312,7 @@ struct smb_version_operations smb311_operations = {
        .set_compression = smb2_set_compression,
        .mkdir = smb2_mkdir,
        .mkdir_setinfo = smb2_mkdir_setinfo,
+        .posix_mkdir = smb311_posix_mkdir,
        .rmdir = smb2_rmdir,
        .unlink = smb2_unlink,
        .rename = smb2_rename_path,
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index af032e1a3eac..810b85787c91 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -602,6 +602,7 @@ static void assemble_neg_contexts(struct smb2_negotiate_req *req,
 int
 SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
 {
+        struct smb_rqst rqst;
        struct smb2_negotiate_req *req;
        struct smb2_negotiate_rsp *rsp;
        struct kvec iov[1];
@@ -673,7 +674,11 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
        iov[0].iov_base = (char *)req;
        iov[0].iov_len = total_len;
-        rc = smb2_send_recv(xid, ses, iov, 1, &resp_buftype, flags, &rsp_iov);
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = 1;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
        cifs_small_buf_release(req);
        rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base;
        /*
@@ -990,8 +995,9 @@ SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data)
        req->PreviousSessionId = sess_data->previous_session;
        req->Flags = 0; /* MBZ */
-        /* to enable echos and oplocks */
-        req->sync_hdr.CreditRequest = cpu_to_le16(3);
+        /* enough to enable echos and oplocks and one max size write */
+        req->sync_hdr.CreditRequest = cpu_to_le16(130);
        /* only one of SMB2 signing flags may be set in SMB2 request */
        if (server->sign)
@@ -1027,6 +1033,7 @@ static int
 SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data)
 {
        int rc;
+        struct smb_rqst rqst;
        struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base;
        struct kvec rsp_iov = { NULL, 0 };
@@ -1035,10 +1042,13 @@ SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data)
                cpu_to_le16(sizeof(struct smb2_sess_setup_req) - 1 /* pad */);
        req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len);
-        /* BB add code to build os and lm fields */
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = sess_data->iov;
+        rqst.rq_nvec = 2;
-        rc = smb2_send_recv(sess_data->xid, sess_data->ses,
+        /* BB add code to build os and lm fields */
-                            sess_data->iov, 2,
+        rc = cifs_send_recv(sess_data->xid, sess_data->ses,
+                            &rqst,
                            &sess_data->buf0_type,
                            CIFS_LOG_ERROR | CIFS_NEG_OP, &rsp_iov);
        cifs_small_buf_release(sess_data->iov[0].iov_base);
@@ -1376,6 +1386,7 @@ out:
 int
 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
 {
+        struct smb_rqst rqst;
        struct smb2_logoff_req *req; /* response is also trivial struct */
        int rc = 0;
        struct TCP_Server_Info *server;
@@ -1413,7 +1424,11 @@ SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
        iov[0].iov_base = (char *)req;
        iov[0].iov_len = total_len;
-        rc = smb2_send_recv(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov);
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = 1;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);
        cifs_small_buf_release(req);
        /*
         * No tcon so can't do
@@ -1443,6 +1458,7 @@ int
 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
          struct cifs_tcon *tcon, const struct nls_table *cp)
 {
+        struct smb_rqst rqst;
        struct smb2_tree_connect_req *req;
        struct smb2_tree_connect_rsp *rsp = NULL;
        struct kvec iov[2];
@@ -1499,7 +1515,11 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
            !smb3_encryption_required(tcon))
                req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
-        rc = smb2_send_recv(xid, ses, iov, 2, &resp_buftype, flags, &rsp_iov);
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = 2;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
        cifs_small_buf_release(req);
        rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base;
@@ -1563,6 +1583,7 @@ tcon_error_exit:
 int
 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon)
 {
+        struct smb_rqst rqst;
        struct smb2_tree_disconnect_req *req; /* response is trivial */
        int rc = 0;
        struct cifs_ses *ses = tcon->ses;
@@ -1593,7 +1614,11 @@ SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon)
        iov[0].iov_base = (char *)req;
        iov[0].iov_len = total_len;
-        rc = smb2_send_recv(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov);
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = 1;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);
        cifs_small_buf_release(req);
        if (rc)
                cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE);
@@ -1886,11 +1911,165 @@ alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len,
        return 0;
 }
+#ifdef CONFIG_CIFS_SMB311
+int smb311_posix_mkdir(const unsigned int xid, struct inode *inode,
+                               umode_t mode, struct cifs_tcon *tcon,
+                               const char *full_path,
+                               struct cifs_sb_info *cifs_sb)
+{
+        struct smb_rqst rqst;
+        struct smb2_create_req *req;
+        struct smb2_create_rsp *rsp;
+        struct TCP_Server_Info *server;
+        struct cifs_ses *ses = tcon->ses;
+        struct kvec iov[3]; /* make sure at least one for each open context */
+        struct kvec rsp_iov = {NULL, 0};
+        int resp_buftype;
+        int uni_path_len;
+        __le16 *copy_path = NULL;
+        int copy_size;
+        int rc = 0;
+        unsigned int n_iov = 2;
+        __u32 file_attributes = 0;
+        char *pc_buf = NULL;
+        int flags = 0;
+        unsigned int total_len;
+        __le16 *path = cifs_convert_path_to_utf16(full_path, cifs_sb);
+        if (!path)
+                return -ENOMEM;
+        cifs_dbg(FYI, "mkdir\n");
+        if (ses && (ses->server))
+                server = ses->server;
+        else
+                return -EIO;
+        rc = smb2_plain_req_init(SMB2_CREATE, tcon, (void **) &req, &total_len);
+        if (rc)
+                return rc;
+        if (smb3_encryption_required(tcon))
+                flags |= CIFS_TRANSFORM_REQ;
+        req->ImpersonationLevel = IL_IMPERSONATION;
+        req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES);
+        /* File attributes ignored on open (used in create though) */
+        req->FileAttributes = cpu_to_le32(file_attributes);
+        req->ShareAccess = FILE_SHARE_ALL_LE;
+        req->CreateDisposition = cpu_to_le32(FILE_CREATE);
+        req->CreateOptions = cpu_to_le32(CREATE_NOT_FILE);
+        iov[0].iov_base = (char *)req;
+        /* -1 since last byte is buf[0] which is sent below (path) */
+        iov[0].iov_len = total_len - 1;
+        req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req));
+        /* [MS-SMB2] 2.2.13 NameOffset:
+         * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of
+         * the SMB2 header, the file name includes a prefix that will
+         * be processed during DFS name normalization as specified in
+         * section 3.3.5.9. Otherwise, the file name is relative to
+         * the share that is identified by the TreeId in the SMB2
+         * header.
+         */
+        if (tcon->share_flags & SHI1005_FLAGS_DFS) {
+                int name_len;
+                req->sync_hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS;
+                rc = alloc_path_with_tree_prefix(&copy_path, &copy_size,
+                                                 &name_len,
+                                                 tcon->treeName, path);
+                if (rc) {
+                        cifs_small_buf_release(req);
+                        return rc;
+                }
+                req->NameLength = cpu_to_le16(name_len * 2);
+                uni_path_len = copy_size;
+                path = copy_path;
+        } else {
+                uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2;
+                /* MUST set path len (NameLength) to 0 opening root of share */
+                req->NameLength = cpu_to_le16(uni_path_len - 2);
+                if (uni_path_len % 8 != 0) {
+                        copy_size = roundup(uni_path_len, 8);
+                        copy_path = kzalloc(copy_size, GFP_KERNEL);
+                        if (!copy_path) {
+                                cifs_small_buf_release(req);
+                                return -ENOMEM;
+                        }
+                        memcpy((char *)copy_path, (const char *)path,
+                               uni_path_len);
+                        uni_path_len = copy_size;
+                        path = copy_path;
+                }
+        }
+        iov[1].iov_len = uni_path_len;
+        iov[1].iov_base = path;
+        req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE;
+        if (tcon->posix_extensions) {
+                if (n_iov > 2) {
+                        struct create_context *ccontext =
+                            (struct create_context *)iov[n_iov-1].iov_base;
+                        ccontext->Next =
+                                cpu_to_le32(iov[n_iov-1].iov_len);
+                }
+                rc = add_posix_context(iov, &n_iov, mode);
+                if (rc) {
+                        cifs_small_buf_release(req);
+                        kfree(copy_path);
+                        return rc;
+                }
+                pc_buf = iov[n_iov-1].iov_base;
+        }
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = n_iov;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
+                            &rsp_iov);
+        cifs_small_buf_release(req);
+        rsp = (struct smb2_create_rsp *)rsp_iov.iov_base;
+        if (rc != 0) {
+                cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
+                trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid,
+                                    CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES, rc);
+                goto smb311_mkdir_exit;
+        } else
+                trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid,
+                                     ses->Suid, CREATE_NOT_FILE,
+                                     FILE_WRITE_ATTRIBUTES);
+        SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId);
+        /* Eventually save off posix specific response info and timestaps */
+smb311_mkdir_exit:
+        kfree(copy_path);
+        kfree(pc_buf);
+        free_rsp_buf(resp_buftype, rsp);
+        return rc;
+}
+#endif /* SMB311 */
 int
 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
          __u8 *oplock, struct smb2_file_all_info *buf,
          struct kvec *err_iov, int *buftype)
 {
+        struct smb_rqst rqst;
        struct smb2_create_req *req;
        struct smb2_create_rsp *rsp;
        struct TCP_Server_Info *server;
@@ -2043,7 +2222,11 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
        }
 #endif /* SMB311 */
-        rc = smb2_send_recv(xid, ses, iov, n_iov, &resp_buftype, flags,
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = n_iov;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
                            &rsp_iov);
        cifs_small_buf_release(req);
        rsp = (struct smb2_create_rsp *)rsp_iov.iov_base;
@@ -2099,6 +2282,7 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
           char *in_data, u32 indatalen,
           char **out_data, u32 *plen /* returned data len */)
 {
+        struct smb_rqst rqst;
        struct smb2_ioctl_req *req;
        struct smb2_ioctl_rsp *rsp;
        struct cifs_ses *ses;
@@ -2189,7 +2373,11 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
        if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO)
                req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
-        rc = smb2_send_recv(xid, ses, iov, n_iov, &resp_buftype, flags,
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = n_iov;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
                            &rsp_iov);
        cifs_small_buf_release(req);
        rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base;
@@ -2274,6 +2462,7 @@ int
 SMB2_close_flags(const unsigned int xid, struct cifs_tcon *tcon,
                 u64 persistent_fid, u64 volatile_fid, int flags)
 {
+        struct smb_rqst rqst;
        struct smb2_close_req *req;
        struct smb2_close_rsp *rsp;
        struct cifs_ses *ses = tcon->ses;
@@ -2301,7 +2490,11 @@ SMB2_close_flags(const unsigned int xid, struct cifs_tcon *tcon,
        iov[0].iov_base = (char *)req;
        iov[0].iov_len = total_len;
-        rc = smb2_send_recv(xid, ses, iov, 1, &resp_buftype, flags, &rsp_iov);
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = 1;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
        cifs_small_buf_release(req);
        rsp = (struct smb2_close_rsp *)rsp_iov.iov_base;
@@ -2387,6 +2580,7 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
           u32 additional_info, size_t output_len, size_t min_len, void **data,
                u32 *dlen)
 {
+        struct smb_rqst rqst;
        struct smb2_query_info_req *req;
        struct smb2_query_info_rsp *rsp = NULL;
        struct kvec iov[2];
@@ -2427,7 +2621,11 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
        /* 1 for Buffer */
        iov[0].iov_len = total_len - 1;
-        rc = smb2_send_recv(xid, ses, iov, 1, &resp_buftype, flags, &rsp_iov);
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = 1;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
        cifs_small_buf_release(req);
        rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
@@ -2594,11 +2792,10 @@ SMB2_echo(struct TCP_Server_Info *server)
 {
        struct smb2_echo_req *req;
        int rc = 0;
-        struct kvec iov[2];
+        struct kvec iov[1];
        struct smb_rqst rqst = { .rq_iov = iov,
-                                 .rq_nvec = 2 };
+                                 .rq_nvec = 1 };
        unsigned int total_len;
-        __be32 rfc1002_marker;
        cifs_dbg(FYI, "In echo request\n");
@@ -2614,11 +2811,8 @@ SMB2_echo(struct TCP_Server_Info *server)
        req->sync_hdr.CreditRequest = cpu_to_le16(1);
-        iov[0].iov_len = 4;
+        iov[0].iov_len = total_len;
-        rfc1002_marker = cpu_to_be32(total_len);
+        iov[0].iov_base = (char *)req;
-        iov[0].iov_base = &rfc1002_marker;
-        iov[1].iov_len = total_len;
-        iov[1].iov_base = (char *)req;
        rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL,
                             server, CIFS_ECHO_OP);
@@ -2633,6 +2827,7 @@ int
 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
           u64 volatile_fid)
 {
+        struct smb_rqst rqst;
        struct smb2_flush_req *req;
        struct cifs_ses *ses = tcon->ses;
        struct kvec iov[1];
@@ -2660,7 +2855,11 @@ SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
        iov[0].iov_base = (char *)req;
        iov[0].iov_len = total_len;
-        rc = smb2_send_recv(xid, ses, iov, 1, &resp_buftype, flags, &rsp_iov);
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = 1;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
        cifs_small_buf_release(req);
        if (rc != 0) {
@@ -2848,10 +3047,9 @@ smb2_async_readv(struct cifs_readdata *rdata)
        struct smb2_sync_hdr *shdr;
        struct cifs_io_parms io_parms;
        struct smb_rqst rqst = { .rq_iov = rdata->iov,
-                                 .rq_nvec = 2 };
+                                 .rq_nvec = 1 };
        struct TCP_Server_Info *server;
        unsigned int total_len;
-        __be32 req_len;
        cifs_dbg(FYI, "%s: offset=%llu bytes=%u\n",
                 __func__, rdata->offset, rdata->bytes);
@@ -2882,12 +3080,8 @@ smb2_async_readv(struct cifs_readdata *rdata)
        if (smb3_encryption_required(io_parms.tcon))
                flags |= CIFS_TRANSFORM_REQ;
-        req_len = cpu_to_be32(total_len);
+        rdata->iov[0].iov_base = buf;
+        rdata->iov[0].iov_len = total_len;
-        rdata->iov[0].iov_base = &req_len;
-        rdata->iov[0].iov_len = sizeof(__be32);
-        rdata->iov[1].iov_base = buf;
-        rdata->iov[1].iov_len = total_len;
        shdr = (struct smb2_sync_hdr *)buf;
@@ -2926,6 +3120,7 @@ int
 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
          unsigned int *nbytes, char **buf, int *buf_type)
 {
+        struct smb_rqst rqst;
        int resp_buftype, rc = -EACCES;
        struct smb2_read_plain_req *req = NULL;
        struct smb2_read_rsp *rsp = NULL;
@@ -2946,7 +3141,11 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
        iov[0].iov_base = (char *)req;
        iov[0].iov_len = total_len;
-        rc = smb2_send_recv(xid, ses, iov, 1, &resp_buftype, flags, &rsp_iov);
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = 1;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
        cifs_small_buf_release(req);
        rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
@@ -3062,10 +3261,9 @@ smb2_async_writev(struct cifs_writedata *wdata,
        struct smb2_sync_hdr *shdr;
        struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
        struct TCP_Server_Info *server = tcon->ses->server;
-        struct kvec iov[2];
+        struct kvec iov[1];
        struct smb_rqst rqst = { };
        unsigned int total_len;
-        __be32 rfc1002_marker;
        rc = smb2_plain_req_init(SMB2_WRITE, tcon, (void **) &req, &total_len);
        if (rc) {
@@ -3137,15 +3335,11 @@ smb2_async_writev(struct cifs_writedata *wdata,
                v1->length = cpu_to_le32(wdata->mr->mr->length);
        }
 #endif
-        /* 4 for rfc1002 length field and 1 for Buffer */
+        iov[0].iov_len = total_len - 1;
-        iov[0].iov_len = 4;
+        iov[0].iov_base = (char *)req;
-        rfc1002_marker = cpu_to_be32(total_len - 1 + wdata->bytes);
-        iov[0].iov_base = &rfc1002_marker;
-        iov[1].iov_len = total_len - 1;
-        iov[1].iov_base = (char *)req;
        rqst.rq_iov = iov;
-        rqst.rq_nvec = 2;
+        rqst.rq_nvec = 1;
        rqst.rq_pages = wdata->pages;
        rqst.rq_offset = wdata->page_offset;
        rqst.rq_npages = wdata->nr_pages;
@@ -3153,7 +3347,7 @@ smb2_async_writev(struct cifs_writedata *wdata,
        rqst.rq_tailsz = wdata->tailsz;
 #ifdef CONFIG_CIFS_SMB_DIRECT
        if (wdata->mr) {
-                iov[1].iov_len += sizeof(struct smbd_buffer_descriptor_v1);
+                iov[0].iov_len += sizeof(struct smbd_buffer_descriptor_v1);
                rqst.rq_npages = 0;
        }
 #endif
@@ -3210,6 +3404,7 @@ int
 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
           unsigned int *nbytes, struct kvec *iov, int n_vec)
 {
+        struct smb_rqst rqst;
        int rc = 0;
        struct smb2_write_req *req = NULL;
        struct smb2_write_rsp *rsp = NULL;
@@ -3251,7 +3446,11 @@ SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
        /* 1 for Buffer */
        iov[0].iov_len = total_len - 1;
-        rc = smb2_send_recv(xid, io_parms->tcon->ses, iov, n_vec + 1,
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = n_vec + 1;
+        rc = cifs_send_recv(xid, io_parms->tcon->ses, &rqst,
                            &resp_buftype, flags, &rsp_iov);
        cifs_small_buf_release(req);
        rsp = (struct smb2_write_rsp *)rsp_iov.iov_base;
@@ -3323,6 +3522,7 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
                     u64 persistent_fid, u64 volatile_fid, int index,
                     struct cifs_search_info *srch_inf)
 {
+        struct smb_rqst rqst;
        struct smb2_query_directory_req *req;
        struct smb2_query_directory_rsp *rsp = NULL;
        struct kvec iov[2];
@@ -3395,7 +3595,11 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
        iov[1].iov_base = (char *)(req->Buffer);
        iov[1].iov_len = len;
-        rc = smb2_send_recv(xid, ses, iov, 2, &resp_buftype, flags, &rsp_iov);
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = 2;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
        cifs_small_buf_release(req);
        rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base;
@@ -3454,6 +3658,7 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
               u8 info_type, u32 additional_info, unsigned int num,
                void **data, unsigned int *size)
 {
+        struct smb_rqst rqst;
        struct smb2_set_info_req *req;
        struct smb2_set_info_rsp *rsp = NULL;
        struct kvec *iov;
@@ -3509,7 +3714,11 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
                iov[i].iov_len = size[i];
        }
-        rc = smb2_send_recv(xid, ses, iov, num, &resp_buftype, flags,
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = num;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
                            &rsp_iov);
        cifs_small_buf_release(req);
        rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base;
@@ -3664,6 +3873,7 @@ SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
                  const u64 persistent_fid, const u64 volatile_fid,
                  __u8 oplock_level)
 {
+        struct smb_rqst rqst;
        int rc;
        struct smb2_oplock_break *req = NULL;
        struct cifs_ses *ses = tcon->ses;
@@ -3692,7 +3902,11 @@ SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
        iov[0].iov_base = (char *)req;
        iov[0].iov_len = total_len;
-        rc = smb2_send_recv(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov);
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = 1;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);
        cifs_small_buf_release(req);
        if (rc) {
@@ -3755,6 +3969,7 @@ int
 SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
              u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata)
 {
+        struct smb_rqst rqst;
        struct smb2_query_info_rsp *rsp = NULL;
        struct kvec iov;
        struct kvec rsp_iov;
@@ -3773,7 +3988,11 @@ SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
        if (smb3_encryption_required(tcon))
                flags |= CIFS_TRANSFORM_REQ;
-        rc = smb2_send_recv(xid, ses, &iov, 1, &resp_buftype, flags, &rsp_iov);
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = &iov;
+        rqst.rq_nvec = 1;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
        cifs_small_buf_release(iov.iov_base);
        if (rc) {
                cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
@@ -3798,6 +4017,7 @@ int
 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon,
              u64 persistent_fid, u64 volatile_fid, int level)
 {
+        struct smb_rqst rqst;
        struct smb2_query_info_rsp *rsp = NULL;
        struct kvec iov;
        struct kvec rsp_iov;
@@ -3829,7 +4049,11 @@ SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon,
        if (smb3_encryption_required(tcon))
                flags |= CIFS_TRANSFORM_REQ;
-        rc = smb2_send_recv(xid, ses, &iov, 1, &resp_buftype, flags, &rsp_iov);
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = &iov;
+        rqst.rq_nvec = 1;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
        cifs_small_buf_release(iov.iov_base);
        if (rc) {
                cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
@@ -3868,6 +4092,7 @@ smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
           const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
           const __u32 num_lock, struct smb2_lock_element *buf)
 {
+        struct smb_rqst rqst;
        int rc = 0;
        struct smb2_lock_req *req = NULL;
        struct kvec iov[2];
@@ -3900,7 +4125,12 @@ smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
        iov[1].iov_len = count;
        cifs_stats_inc(&tcon->stats.cifs_stats.num_locks);
-        rc = smb2_send_recv(xid, tcon->ses, iov, 2, &resp_buf_type, flags,
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = 2;
+        rc = cifs_send_recv(xid, tcon->ses, &rqst, &resp_buf_type, flags,
                            &rsp_iov);
        cifs_small_buf_release(req);
        if (rc) {
@@ -3934,6 +4164,7 @@ int
 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
                 __u8 *lease_key, const __le32 lease_state)
 {
+        struct smb_rqst rqst;
        int rc;
        struct smb2_lease_ack *req = NULL;
        struct cifs_ses *ses = tcon->ses;
@@ -3964,7 +4195,11 @@ SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
        iov[0].iov_base = (char *)req;
        iov[0].iov_len = total_len;
-        rc = smb2_send_recv(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov);
+        memset(&rqst, 0, sizeof(struct smb_rqst));
+        rqst.rq_iov = iov;
+        rqst.rq_nvec = 1;
+        rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);
        cifs_small_buf_release(req);
        if (rc) {
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index a345560001ce..824dddeee3f2 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -851,8 +851,11 @@ struct validate_negotiate_info_rsp {
        __le16 Dialect; /* Dialect in use for the connection */
 } __packed;
-#define RSS_CAPABLE     0x00000001
+#define RSS_CAPABLE     cpu_to_le32(0x00000001)
-#define RDMA_CAPABLE    0x00000002
+#define RDMA_CAPABLE    cpu_to_le32(0x00000002)
+#define INTERNETWORK    cpu_to_le16(0x0002)
+#define INTERNETWORKV6  cpu_to_le16(0x0017)
 struct network_interface_info_ioctl_rsp {
        __le32 Next; /* next interface. zero if this is last one */
@@ -860,7 +863,21 @@ struct network_interface_info_ioctl_rsp {
        __le32 Capability; /* RSS or RDMA Capable */
        __le32 Reserved;
        __le64 LinkSpeed;
-        char    SockAddr_Storage[128];
+        __le16 Family;
+        __u8 Buffer[126];
+} __packed;
+struct iface_info_ipv4 {
+        __be16 Port;
+        __be32 IPv4Address;
+        __be64 Reserved;
+} __packed;
+struct iface_info_ipv6 {
+        __be16 Port;
+        __be32 FlowInfo;
+        __u8   IPv6Address[16];
+        __be32 ScopeId;
 } __packed;
 #define NO_FILE_ID 0xFFFFFFFFFFFFFFFFULL /* general ioctls to srv not to file */
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index c84020057bd8..3ae208ac2a77 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -79,6 +79,10 @@ extern int smb2_set_path_size(const unsigned int xid, struct cifs_tcon *tcon,
                              struct cifs_sb_info *cifs_sb, bool set_alloc);
 extern int smb2_set_file_info(struct inode *inode, const char *full_path,
                              FILE_BASIC_INFO *buf, const unsigned int xid);
+extern int smb311_posix_mkdir(const unsigned int xid, struct inode *inode,
+                               umode_t mode, struct cifs_tcon *tcon,
+                               const char *full_path,
+                               struct cifs_sb_info *cifs_sb);
 extern int smb2_mkdir(const unsigned int xid, struct cifs_tcon *tcon,
                      const char *name, struct cifs_sb_info *cifs_sb);
 extern void smb2_mkdir_setinfo(struct inode *inode, const char *full_path,
@@ -109,6 +113,8 @@ extern int smb2_unlock_range(struct cifsFileInfo *cfile,
 extern int smb2_push_mandatory_locks(struct cifsFileInfo *cfile);
 extern void smb2_reconnect_server(struct work_struct *work);
 extern int smb3_crypto_aead_allocate(struct TCP_Server_Info *server);
+extern unsigned long
+smb2_rqst_len(struct smb_rqst *rqst, bool skip_rfc1002_marker);
 /*
 * SMB2 Worker functions - most of protocol specific implementation details
diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c
index 349d5ccf854c..51b9437c3c7b 100644
--- a/fs/cifs/smb2transport.c
+++ b/fs/cifs/smb2transport.c
@@ -171,9 +171,7 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
        unsigned char smb2_signature[SMB2_HMACSHA256_SIZE];
        unsigned char *sigptr = smb2_signature;
        struct kvec *iov = rqst->rq_iov;
-        int iov_hdr_index = rqst->rq_nvec > 1 ? 1 : 0;
+        struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)iov[0].iov_base;
-        struct smb2_sync_hdr *shdr =
-                (struct smb2_sync_hdr *)iov[iov_hdr_index].iov_base;
        struct cifs_ses *ses;
        ses = smb2_find_smb_ses(server, shdr->SessionId);
@@ -204,7 +202,7 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
                return rc;
        }
-        rc = __cifs_calc_signature(rqst, iov_hdr_index,  server, sigptr,
+        rc = __cifs_calc_signature(rqst, server, sigptr,
                &server->secmech.sdeschmacsha256->shash);
        if (!rc)
@@ -414,9 +412,7 @@ smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
        unsigned char smb3_signature[SMB2_CMACAES_SIZE];
        unsigned char *sigptr = smb3_signature;
        struct kvec *iov = rqst->rq_iov;
-        int iov_hdr_index = rqst->rq_nvec > 1 ? 1 : 0;
+        struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)iov[0].iov_base;
-        struct smb2_sync_hdr *shdr =
-                (struct smb2_sync_hdr *)iov[iov_hdr_index].iov_base;
        struct cifs_ses *ses;
        ses = smb2_find_smb_ses(server, shdr->SessionId);
@@ -447,7 +443,7 @@ smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
                return rc;
        }
-        rc = __cifs_calc_signature(rqst, iov_hdr_index, server, sigptr,
+        rc = __cifs_calc_signature(rqst, server, sigptr,
                                   &server->secmech.sdesccmacaes->shash);
        if (!rc)
@@ -462,7 +458,7 @@ smb2_sign_rqst(struct smb_rqst *rqst, struct TCP_Server_Info *server)
 {
        int rc = 0;
        struct smb2_sync_hdr *shdr =
-                        (struct smb2_sync_hdr *)rqst->rq_iov[1].iov_base;
+                        (struct smb2_sync_hdr *)rqst->rq_iov[0].iov_base;
        if (!(shdr->Flags & SMB2_FLAGS_SIGNED) ||
            server->tcpStatus == CifsNeedNegotiate)
@@ -635,7 +631,7 @@ smb2_setup_request(struct cifs_ses *ses, struct smb_rqst *rqst)
 {
        int rc;
        struct smb2_sync_hdr *shdr =
-                        (struct smb2_sync_hdr *)rqst->rq_iov[1].iov_base;
+                        (struct smb2_sync_hdr *)rqst->rq_iov[0].iov_base;
        struct mid_q_entry *mid;
        smb2_seq_num_into_buf(ses->server, shdr);
@@ -656,7 +652,7 @@ smb2_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst)
 {
        int rc;
        struct smb2_sync_hdr *shdr =
-                        (struct smb2_sync_hdr *)rqst->rq_iov[1].iov_base;
+                        (struct smb2_sync_hdr *)rqst->rq_iov[0].iov_base;
        struct mid_q_entry *mid;
        smb2_seq_num_into_buf(server, shdr);
diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
index e459c97151b3..6fd94d9ffac2 100644
--- a/fs/cifs/smbdirect.c
+++ b/fs/cifs/smbdirect.c
@@ -18,6 +18,7 @@
 #include "smbdirect.h"
 #include "cifs_debug.h"
 #include "cifsproto.h"
+#include "smb2proto.h"
 static struct smbd_response *get_empty_queue_buffer(
                struct smbd_connection *info);
@@ -2087,7 +2088,7 @@ int smbd_send(struct smbd_connection *info, struct smb_rqst *rqst)
        struct kvec vec;
        int nvecs;
        int size;
-        unsigned int buflen = 0, remaining_data_length;
+        unsigned int buflen, remaining_data_length;
        int start, i, j;
        int max_iov_size =
                info->max_send_size - sizeof(struct smbd_data_transfer);
@@ -2111,25 +2112,13 @@ int smbd_send(struct smbd_connection *info, struct smb_rqst *rqst)
                log_write(ERR, "expected the pdu length in 1st iov, but got %zu\n", rqst->rq_iov[0].iov_len);
                return -EINVAL;
        }
-        iov = &rqst->rq_iov[1];
-        /* total up iov array first */
-        for (i = 0; i < rqst->rq_nvec-1; i++) {
-                buflen += iov[i].iov_len;
-        }
        /*
         * Add in the page array if there is one. The caller needs to set
         * rq_tailsz to PAGE_SIZE when the buffer has multiple pages and
         * ends at page boundary
         */
-        if (rqst->rq_npages) {
+        buflen = smb2_rqst_len(rqst, true);
-                if (rqst->rq_npages == 1)
-                        buflen += rqst->rq_tailsz;
-                else
-                        buflen += rqst->rq_pagesz * (rqst->rq_npages - 1) -
-                                        rqst->rq_offset + rqst->rq_tailsz;
-        }
        if (buflen + sizeof(struct smbd_data_transfer) >
                info->max_fragmented_send_size) {
@@ -2139,6 +2128,8 @@ int smbd_send(struct smbd_connection *info, struct smb_rqst *rqst)
                goto done;
        }
+        iov = &rqst->rq_iov[1];
        cifs_dbg(FYI, "Sending smb (RDMA): smb_len=%u\n", buflen);
        for (i = 0; i < rqst->rq_nvec-1; i++)
                dump_smb(iov[i].iov_base, iov[i].iov_len);
diff --git a/fs/cifs/trace.h b/fs/cifs/trace.h
index 61e74d455d90..67e413f6ee4d 100644
--- a/fs/cifs/trace.h
+++ b/fs/cifs/trace.h
@@ -378,7 +378,7 @@ DEFINE_EVENT(smb3_open_err_class, smb3_##name,    \
        TP_ARGS(xid, tid, sesid, create_options, desired_access, rc))
 DEFINE_SMB3_OPEN_ERR_EVENT(open_err);
+DEFINE_SMB3_OPEN_ERR_EVENT(posix_mkdir_err);
 DECLARE_EVENT_CLASS(smb3_open_done_class,
        TP_PROTO(unsigned int xid,
@@ -420,6 +420,7 @@ DEFINE_EVENT(smb3_open_done_class, smb3_##name,  \
        TP_ARGS(xid, fid, tid, sesid, create_options, desired_access))
 DEFINE_SMB3_OPEN_DONE_EVENT(open_done);
+DEFINE_SMB3_OPEN_DONE_EVENT(posix_mkdir_done);
 #endif /* _CIFS_TRACE_H */
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 1f1a68f89110..fb57dfbfb749 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -201,15 +201,24 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,
        return 0;
 }
-static unsigned long
+unsigned long
-rqst_len(struct smb_rqst *rqst)
+smb2_rqst_len(struct smb_rqst *rqst, bool skip_rfc1002_marker)
 {
        unsigned int i;
-        struct kvec *iov = rqst->rq_iov;
+        struct kvec *iov;
+        int nvec;
        unsigned long buflen = 0;
+        if (skip_rfc1002_marker && rqst->rq_iov[0].iov_len == 4) {
+                iov = &rqst->rq_iov[1];
+                nvec = rqst->rq_nvec - 1;
+        } else {
+                iov = rqst->rq_iov;
+                nvec = rqst->rq_nvec;
+        }
        /* total up iov array first */
-        for (i = 0; i < rqst->rq_nvec; i++)
+        for (i = 0; i < nvec; i++)
                buflen += iov[i].iov_len;
        /*
@@ -236,18 +245,20 @@ rqst_len(struct smb_rqst *rqst)
 }
 static int
-__smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
+__smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
+                struct smb_rqst *rqst)
 {
-        int rc;
+        int rc = 0;
-        struct kvec *iov = rqst->rq_iov;
+        struct kvec *iov;
-        int n_vec = rqst->rq_nvec;
+        int n_vec;
-        unsigned int smb_buf_length = get_rfc1002_length(iov[0].iov_base);
+        unsigned int send_length = 0;
-        unsigned long send_length;
+        unsigned int i, j;
-        unsigned int i;
        size_t total_len = 0, sent, size;
        struct socket *ssocket = server->ssocket;
        struct msghdr smb_msg;
        int val = 1;
+        __be32 rfc1002_marker;
        if (cifs_rdma_enabled(server) && server->smbd_conn) {
                rc = smbd_send(server->smbd_conn, rqst);
                goto smbd_done;
@@ -255,51 +266,67 @@ __smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
        if (ssocket == NULL)
                return -ENOTSOCK;
-        /* sanity check send length */
-        send_length = rqst_len(rqst);
-        if (send_length != smb_buf_length + 4) {
-                WARN(1, "Send length mismatch(send_length=%lu smb_buf_length=%u)\n",
-                        send_length, smb_buf_length);
-                return -EIO;
-        }
-        if (n_vec < 2)
-                return -EIO;
-        cifs_dbg(FYI, "Sending smb: smb_len=%u\n", smb_buf_length);
-        dump_smb(iov[0].iov_base, iov[0].iov_len);
-        dump_smb(iov[1].iov_base, iov[1].iov_len);
        /* cork the socket */
        kernel_setsockopt(ssocket, SOL_TCP, TCP_CORK,
                                (char *)&val, sizeof(val));
-        size = 0;
+        for (j = 0; j < num_rqst; j++)
-        for (i = 0; i < n_vec; i++)
+                send_length += smb2_rqst_len(&rqst[j], true);
-                size += iov[i].iov_len;
+        rfc1002_marker = cpu_to_be32(send_length);
-        iov_iter_kvec(&smb_msg.msg_iter, WRITE | ITER_KVEC, iov, n_vec, size);
+        /* Generate a rfc1002 marker for SMB2+ */
+        if (server->vals->header_preamble_size == 0) {
+                struct kvec hiov = {
+                        .iov_base = &rfc1002_marker,
+                        .iov_len  = 4
+                };
+                iov_iter_kvec(&smb_msg.msg_iter, WRITE | ITER_KVEC, &hiov,
+                              1, 4);
+                rc = smb_send_kvec(server, &smb_msg, &sent);
+                if (rc < 0)
+                        goto uncork;
-        rc = smb_send_kvec(server, &smb_msg, &sent);
+                total_len += sent;
-        if (rc < 0)
+                send_length += 4;
-                goto uncork;
+        }
-        total_len += sent;
+        cifs_dbg(FYI, "Sending smb: smb_len=%u\n", send_length);
-        /* now walk the page array and send each page in it */
+        for (j = 0; j < num_rqst; j++) {
-        for (i = 0; i < rqst->rq_npages; i++) {
+                iov = rqst[j].rq_iov;
-                struct bio_vec bvec;
+                n_vec = rqst[j].rq_nvec;
-                bvec.bv_page = rqst->rq_pages[i];
+                size = 0;
-                rqst_page_get_length(rqst, i, &bvec.bv_len, &bvec.bv_offset);
+                for (i = 0; i < n_vec; i++) {
+                        dump_smb(iov[i].iov_base, iov[i].iov_len);
+                        size += iov[i].iov_len;
+                }
+                iov_iter_kvec(&smb_msg.msg_iter, WRITE | ITER_KVEC,
+                              iov, n_vec, size);
-                iov_iter_bvec(&smb_msg.msg_iter, WRITE | ITER_BVEC,
-                              &bvec, 1, bvec.bv_len);
                rc = smb_send_kvec(server, &smb_msg, &sent);
                if (rc < 0)
-                        break;
+                        goto uncork;
                total_len += sent;
+                /* now walk the page array and send each page in it */
+                for (i = 0; i < rqst[j].rq_npages; i++) {
+                        struct bio_vec bvec;
+                        bvec.bv_page = rqst[j].rq_pages[i];
+                        rqst_page_get_length(&rqst[j], i, &bvec.bv_len,
+                                             &bvec.bv_offset);
+                        iov_iter_bvec(&smb_msg.msg_iter, WRITE | ITER_BVEC,
+                                      &bvec, 1, bvec.bv_len);
+                        rc = smb_send_kvec(server, &smb_msg, &sent);
+                        if (rc < 0)
+                                break;
+                        total_len += sent;
+                }
        }
 uncork:
@@ -308,9 +335,9 @@ uncork:
        kernel_setsockopt(ssocket, SOL_TCP, TCP_CORK,
                                (char *)&val, sizeof(val));
-        if ((total_len > 0) && (total_len != smb_buf_length + 4)) {
+        if ((total_len > 0) && (total_len != send_length)) {
                cifs_dbg(FYI, "partial send (wanted=%u sent=%zu): terminating session\n",
-                         smb_buf_length + 4, total_len);
+                         send_length, total_len);
                /*
                 * If we have only sent part of an SMB then the next SMB could
                 * be taken as the remainder of this one. We need to kill the
@@ -335,7 +362,7 @@ smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst, int flags)
        int rc;
        if (!(flags & CIFS_TRANSFORM_REQ))
-                return __smb_send_rqst(server, rqst);
+                return __smb_send_rqst(server, 1, rqst);
        if (!server->ops->init_transform_rq ||
            !server->ops->free_transform_rq) {
@@ -347,7 +374,7 @@ smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst, int flags)
        if (rc)
                return rc;
-        rc = __smb_send_rqst(server, &cur_rqst);
+        rc = __smb_send_rqst(server, 1, &cur_rqst);
        server->ops->free_transform_rq(&cur_rqst);
        return rc;
 }
@@ -365,7 +392,7 @@ smb_send(struct TCP_Server_Info *server, struct smb_hdr *smb_buffer,
        iov[1].iov_base = (char *)smb_buffer + 4;
        iov[1].iov_len = smb_buf_length;
-        return __smb_send_rqst(server, &rqst);
+        return __smb_send_rqst(server, 1, &rqst);
 }
 static int
@@ -730,7 +757,6 @@ cifs_send_recv(const unsigned int xid, struct cifs_ses *ses,
         * to the same server. We may make this configurable later or
         * use ses->maxReq.
         */
        rc = wait_for_free_request(ses->server, timeout, optype);
        if (rc)
                return rc;
@@ -766,8 +792,8 @@ cifs_send_recv(const unsigned int xid, struct cifs_ses *ses,
 #ifdef CONFIG_CIFS_SMB311
        if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP))
-                smb311_update_preauth_hash(ses, rqst->rq_iov+1,
+                smb311_update_preauth_hash(ses, rqst->rq_iov,
-                                           rqst->rq_nvec-1);
+                                           rqst->rq_nvec);
 #endif
        if (timeout == CIFS_ASYNC_OP)
@@ -812,8 +838,8 @@ cifs_send_recv(const unsigned int xid, struct cifs_ses *ses,
 #ifdef CONFIG_CIFS_SMB311
        if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) {
                struct kvec iov = {
-                        .iov_base = buf,
+                        .iov_base = resp_iov->iov_base,
-                        .iov_len = midQ->resp_buf_size
+                        .iov_len = resp_iov->iov_len
                };
                smb311_update_preauth_hash(ses, &iov, 1);
        }
@@ -872,49 +898,6 @@ SendReceive2(const unsigned int xid, struct cifs_ses *ses,
        return rc;
 }
-/* Like SendReceive2 but iov[0] does not contain an rfc1002 header */
-int
-smb2_send_recv(const unsigned int xid, struct cifs_ses *ses,
-               struct kvec *iov, int n_vec, int *resp_buf_type /* ret */,
-               const int flags, struct kvec *resp_iov)
-{
-        struct smb_rqst rqst;
-        struct kvec s_iov[CIFS_MAX_IOV_SIZE], *new_iov;
-        int rc;
-        int i;
-        __u32 count;
-        __be32 rfc1002_marker;
-        if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
-                new_iov = kmalloc_array(n_vec + 1, sizeof(struct kvec),
-                                        GFP_KERNEL);
-                if (!new_iov)
-                        return -ENOMEM;
-        } else
-                new_iov = s_iov;
-        /* 1st iov is an RFC1002 Session Message length */
-        memcpy(new_iov + 1, iov, (sizeof(struct kvec) * n_vec));
-        count = 0;
-        for (i = 1; i < n_vec + 1; i++)
-                count += new_iov[i].iov_len;
-        rfc1002_marker = cpu_to_be32(count);
-        new_iov[0].iov_base = &rfc1002_marker;
-        new_iov[0].iov_len = 4;
-        memset(&rqst, 0, sizeof(struct smb_rqst));
-        rqst.rq_iov = new_iov;
-        rqst.rq_nvec = n_vec + 1;
-        rc = cifs_send_recv(xid, ses, &rqst, resp_buf_type, flags, resp_iov);
-        if (n_vec + 1 > CIFS_MAX_IOV_SIZE)
-                kfree(new_iov);
-        return rc;
-}
 int
 SendReceive(const unsigned int xid, struct cifs_ses *ses,
            struct smb_hdr *in_buf, struct smb_hdr *out_buf,
diff --git a/fs/eventfd.c b/fs/eventfd.c
index ceb1031f1cac..08d3bd602f73 100644
--- a/fs/eventfd.c
+++ b/fs/eventfd.c
@@ -101,20 +101,14 @@ static int eventfd_release(struct inode *inode, struct file *file)
        return 0;
 }
-static struct wait_queue_head *
+static __poll_t eventfd_poll(struct file *file, poll_table *wait)
-eventfd_get_poll_head(struct file *file, __poll_t events)
-{
-        struct eventfd_ctx *ctx = file->private_data;
-        return &ctx->wqh;
-}
-static __poll_t eventfd_poll_mask(struct file *file, __poll_t eventmask)
 {
        struct eventfd_ctx *ctx = file->private_data;
        __poll_t events = 0;
        u64 count;
+        poll_wait(file, &ctx->wqh, wait);
        /*
         * All writes to ctx->count occur within ctx->wqh.lock.  This read
         * can be done outside ctx->wqh.lock because we know that poll_wait
@@ -156,11 +150,11 @@ static __poll_t eventfd_poll_mask(struct file *file, __poll_t eventmask)
        count = READ_ONCE(ctx->count);
        if (count > 0)
-                events |= (EPOLLIN & eventmask);
+                events |= EPOLLIN;
        if (count == ULLONG_MAX)
                events |= EPOLLERR;
        if (ULLONG_MAX - 1 > count)
-                events |= (EPOLLOUT & eventmask);
+                events |= EPOLLOUT;
        return events;
 }
@@ -311,8 +305,7 @@ static const struct file_operations eventfd_fops = {
        .show_fdinfo    = eventfd_show_fdinfo,
 #endif
        .release        = eventfd_release,
-        .get_poll_head  = eventfd_get_poll_head,
+        .poll           = eventfd_poll,
-        .poll_mask      = eventfd_poll_mask,
        .read           = eventfd_read,
        .write          = eventfd_write,
        .llseek         = noop_llseek,
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index ea4436f409fb..67db22fe99c5 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -922,18 +922,14 @@ static __poll_t ep_read_events_proc(struct eventpoll *ep, struct list_head *head
        return 0;
 }
-static struct wait_queue_head *ep_eventpoll_get_poll_head(struct file *file,
+static __poll_t ep_eventpoll_poll(struct file *file, poll_table *wait)
-                __poll_t eventmask)
-{
-        struct eventpoll *ep = file->private_data;
-        return &ep->poll_wait;
-}
-static __poll_t ep_eventpoll_poll_mask(struct file *file, __poll_t eventmask)
 {
        struct eventpoll *ep = file->private_data;
        int depth = 0;
+        /* Insert inside our poll wait queue */
+        poll_wait(file, &ep->poll_wait, wait);
        /*
         * Proceed to find out if wanted events are really available inside
         * the ready list.
@@ -972,8 +968,7 @@ static const struct file_operations eventpoll_fops = {
        .show_fdinfo    = ep_show_fdinfo,
 #endif
        .release        = ep_eventpoll_release,
-        .get_poll_head  = ep_eventpoll_get_poll_head,
+        .poll           = ep_eventpoll_poll,
-        .poll_mask      = ep_eventpoll_poll_mask,
        .llseek         = noop_llseek,
 };
diff --git a/fs/ext2/ext2.h b/fs/ext2/ext2.h
index cc40802ddfa8..00e759f05161 100644
--- a/fs/ext2/ext2.h
+++ b/fs/ext2/ext2.h
@@ -748,7 +748,6 @@ extern void ext2_free_blocks (struct inode *, unsigned long,
                              unsigned long);
 extern unsigned long ext2_count_free_blocks (struct super_block *);
 extern unsigned long ext2_count_dirs (struct super_block *);
-extern void ext2_check_blocks_bitmap (struct super_block *);
 extern struct ext2_group_desc * ext2_get_group_desc(struct super_block * sb,
                                                    unsigned int block_group,
                                                    struct buffer_head ** bh);
@@ -771,7 +770,6 @@ extern void ext2_set_link(struct inode *, struct ext2_dir_entry_2 *, struct page
 extern struct inode * ext2_new_inode (struct inode *, umode_t, const struct qstr *);
 extern void ext2_free_inode (struct inode *);
 extern unsigned long ext2_count_free_inodes (struct super_block *);
-extern void ext2_check_inodes_bitmap (struct super_block *);
 extern unsigned long ext2_count_free (struct buffer_head *, unsigned);
 /* inode.c */
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 25ab1274090f..8ff53f8da3bc 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -557,6 +557,9 @@ static int parse_options(char *options, struct super_block *sb,
                        set_opt (opts->s_mount_opt, NO_UID32);
                        break;
                case Opt_nocheck:
+                        ext2_msg(sb, KERN_WARNING,
+                                "Option nocheck/check=none is deprecated and"
+                                " will be removed in June 2020.");
                        clear_opt (opts->s_mount_opt, CHECK);
                        break;
                case Opt_debug:
@@ -1335,9 +1338,6 @@ static int ext2_remount (struct super_block * sb, int * flags, char * data)
        new_opts.s_resgid = sbi->s_resgid;
        spin_unlock(&sbi->s_lock);
-        /*
-         * Allow the "check" option to be passed as a remount option.
-         */
        if (!parse_options(data, sb, &new_opts))
                return -EINVAL;
diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c
index c60f3d32ee91..a6797986b625 100644
--- a/fs/jfs/xattr.c
+++ b/fs/jfs/xattr.c
@@ -491,15 +491,17 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size)
        if (size > PSIZE) {
                /*
                 * To keep the rest of the code simple.  Allocate a
-                 * contiguous buffer to work with
+                 * contiguous buffer to work with. Make the buffer large
+                 * enough to make use of the whole extent.
                 */
-                ea_buf->xattr = kmalloc(size, GFP_KERNEL);
+                ea_buf->max_size = (size + sb->s_blocksize - 1) &
+                    ~(sb->s_blocksize - 1);
+                ea_buf->xattr = kmalloc(ea_buf->max_size, GFP_KERNEL);
                if (ea_buf->xattr == NULL)
                        return -ENOMEM;
                ea_buf->flag = EA_MALLOC;
-                ea_buf->max_size = (size + sb->s_blocksize - 1) &
-                    ~(sb->s_blocksize - 1);
                if (ea_size == 0)
                        return 0;
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index bbd0465535eb..f033f3a69a3b 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -883,8 +883,10 @@ struct inode *nfs_delegation_find_inode(struct nfs_client *clp,
        rcu_read_lock();
        list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
                res = nfs_delegation_find_inode_server(server, fhandle);
-                if (res != ERR_PTR(-ENOENT))
+                if (res != ERR_PTR(-ENOENT)) {
+                        rcu_read_unlock();
                        return res;
+                }
        }
        rcu_read_unlock();
        return ERR_PTR(-ENOENT);
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index d4a07acad598..8f003792ccde 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1243,17 +1243,18 @@ static int ff_layout_read_done_cb(struct rpc_task *task,
                                           hdr->ds_clp, hdr->lseg,
                                           hdr->pgio_mirror_idx);
+        clear_bit(NFS_IOHDR_RESEND_PNFS, &hdr->flags);
+        clear_bit(NFS_IOHDR_RESEND_MDS, &hdr->flags);
        switch (err) {
        case -NFS4ERR_RESET_TO_PNFS:
                if (ff_layout_choose_best_ds_for_read(hdr->lseg,
                                        hdr->pgio_mirror_idx + 1,
                                        &hdr->pgio_mirror_idx))
                        goto out_eagain;
-                ff_layout_read_record_layoutstats_done(task, hdr);
+                set_bit(NFS_IOHDR_RESEND_PNFS, &hdr->flags);
-                pnfs_read_resend_pnfs(hdr);
                return task->tk_status;
        case -NFS4ERR_RESET_TO_MDS:
-                ff_layout_reset_read(hdr);
+                set_bit(NFS_IOHDR_RESEND_MDS, &hdr->flags);
                return task->tk_status;
        case -EAGAIN:
                goto out_eagain;
@@ -1403,6 +1404,10 @@ static void ff_layout_read_release(void *data)
        struct nfs_pgio_header *hdr = data;
        ff_layout_read_record_layoutstats_done(&hdr->task, hdr);
+        if (test_bit(NFS_IOHDR_RESEND_PNFS, &hdr->flags))
+                pnfs_read_resend_pnfs(hdr);
+        else if (test_bit(NFS_IOHDR_RESEND_MDS, &hdr->flags))
+                ff_layout_reset_read(hdr);
        pnfs_generic_rw_release(data);
 }
@@ -1423,12 +1428,14 @@ static int ff_layout_write_done_cb(struct rpc_task *task,
                                           hdr->ds_clp, hdr->lseg,
                                           hdr->pgio_mirror_idx);
+        clear_bit(NFS_IOHDR_RESEND_PNFS, &hdr->flags);
+        clear_bit(NFS_IOHDR_RESEND_MDS, &hdr->flags);
        switch (err) {
        case -NFS4ERR_RESET_TO_PNFS:
-                ff_layout_reset_write(hdr, true);
+                set_bit(NFS_IOHDR_RESEND_PNFS, &hdr->flags);
                return task->tk_status;
        case -NFS4ERR_RESET_TO_MDS:
-                ff_layout_reset_write(hdr, false);
+                set_bit(NFS_IOHDR_RESEND_MDS, &hdr->flags);
                return task->tk_status;
        case -EAGAIN:
                return -EAGAIN;
@@ -1575,6 +1582,10 @@ static void ff_layout_write_release(void *data)
        struct nfs_pgio_header *hdr = data;
        ff_layout_write_record_layoutstats_done(&hdr->task, hdr);
+        if (test_bit(NFS_IOHDR_RESEND_PNFS, &hdr->flags))
+                ff_layout_reset_write(hdr, true);
+        else if (test_bit(NFS_IOHDR_RESEND_MDS, &hdr->flags))
+                ff_layout_reset_write(hdr, false);
        pnfs_generic_rw_release(data);
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ed45090e4df6..6dd146885da9 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3294,6 +3294,7 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
        struct nfs4_closedata *calldata = data;
        struct nfs4_state *state = calldata->state;
        struct inode *inode = calldata->inode;
+        struct pnfs_layout_hdr *lo;
        bool is_rdonly, is_wronly, is_rdwr;
        int call_close = 0;
@@ -3337,6 +3338,12 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
                goto out_wait;
        }
+        lo = calldata->arg.lr_args ? calldata->arg.lr_args->layout : NULL;
+        if (lo && !pnfs_layout_is_valid(lo)) {
+                calldata->arg.lr_args = NULL;
+                calldata->res.lr_res = NULL;
+        }
        if (calldata->arg.fmode == 0)
                task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_CLOSE];
@@ -5972,12 +5979,19 @@ static void nfs4_delegreturn_release(void *calldata)
 static void nfs4_delegreturn_prepare(struct rpc_task *task, void *data)
 {
        struct nfs4_delegreturndata *d_data;
+        struct pnfs_layout_hdr *lo;
        d_data = (struct nfs4_delegreturndata *)data;
        if (!d_data->lr.roc && nfs4_wait_on_layoutreturn(d_data->inode, task))
                return;
+        lo = d_data->args.lr_args ? d_data->args.lr_args->layout : NULL;
+        if (lo && !pnfs_layout_is_valid(lo)) {
+                d_data->args.lr_args = NULL;
+                d_data->res.lr_res = NULL;
+        }
        nfs4_setup_sequence(d_data->res.server->nfs_client,
                        &d_data->args.seq_args,
                        &d_data->res.seq_res,
@@ -8650,6 +8664,8 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
        dprintk("--> %s tk_status => %d\n", __func__, -task->tk_status);
+        nfs4_sequence_free_slot(&lgp->res.seq_res);
        switch (nfs4err) {
        case 0:
                goto out;
@@ -8714,7 +8730,6 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
                goto out;
        }
-        nfs4_sequence_free_slot(&lgp->res.seq_res);
        err = nfs4_handle_exception(server, nfs4err, exception);
        if (!status) {
                if (exception->retry)
@@ -8786,20 +8801,22 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, long *timeout)
        if (IS_ERR(task))
                return ERR_CAST(task);
        status = rpc_wait_for_completion_task(task);
-        if (status == 0) {
+        if (status != 0)
+                goto out;
+        /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
+        if (task->tk_status < 0 || lgp->res.layoutp->len == 0) {
                status = nfs4_layoutget_handle_exception(task, lgp, &exception);
                *timeout = exception.timeout;
-        }
+        } else
+                lseg = pnfs_layout_process(lgp);
+out:
        trace_nfs4_layoutget(lgp->args.ctx,
                        &lgp->args.range,
                        &lgp->res.range,
                        &lgp->res.stateid,
                        status);
-        /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
-        if (status == 0 && lgp->res.layoutp->len)
-                lseg = pnfs_layout_process(lgp);
        rpc_put_task(task);
        dprintk("<-- %s status=%d\n", __func__, status);
        if (status)
@@ -8817,6 +8834,8 @@ nfs4_layoutreturn_prepare(struct rpc_task *task, void *calldata)
                        &lrp->args.seq_args,
                        &lrp->res.seq_res,
                        task);
+        if (!pnfs_layout_is_valid(lrp->args.layout))
+                rpc_exit(task, 0);
 }
 static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata)
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index a8f5e6b16749..3fe81424337d 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -801,6 +801,11 @@ static inline void nfs4_lgopen_release(struct nfs4_layoutget *lgp)
 {
 }
+static inline bool pnfs_layout_is_valid(const struct pnfs_layout_hdr *lo)
+{
+        return false;
+}
 #endif /* CONFIG_NFS_V4_1 */
 #if IS_ENABLED(CONFIG_NFS_V4_2)
diff --git a/fs/pipe.c b/fs/pipe.c
index bb0840e234f3..39d6f431da83 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -509,22 +509,19 @@ static long pipe_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
        }
 }
-static struct wait_queue_head *
-pipe_get_poll_head(struct file *filp, __poll_t events)
-{
-        struct pipe_inode_info *pipe = filp->private_data;
-        return &pipe->wait;
-}
 /* No kernel lock held - fine */
-static __poll_t pipe_poll_mask(struct file *filp, __poll_t events)
+static __poll_t
+pipe_poll(struct file *filp, poll_table *wait)
 {
+        __poll_t mask;
        struct pipe_inode_info *pipe = filp->private_data;
-        int nrbufs = pipe->nrbufs;
+        int nrbufs;
-        __poll_t mask = 0;
+        poll_wait(filp, &pipe->wait, wait);
        /* Reading only -- no need for acquiring the semaphore.  */
+        nrbufs = pipe->nrbufs;
+        mask = 0;
        if (filp->f_mode & FMODE_READ) {
                mask = (nrbufs > 0) ? EPOLLIN | EPOLLRDNORM : 0;
                if (!pipe->writers && filp->f_version != pipe->w_counter)
@@ -1023,8 +1020,7 @@ const struct file_operations pipefifo_fops = {
        .llseek         = no_llseek,
        .read_iter      = pipe_read,
        .write_iter     = pipe_write,
-        .get_poll_head  = pipe_get_poll_head,
+        .poll           = pipe_poll,
-        .poll_mask      = pipe_poll_mask,
        .unlocked_ioctl = pipe_ioctl,
        .release        = pipe_release,
        .fasync         = pipe_fasync,
diff --git a/fs/proc/base.c b/fs/proc/base.c
index b6572944efc3..aaffc0c30216 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -235,6 +235,10 @@ static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
        if (env_start != arg_end || env_start >= env_end)
                env_start = env_end = arg_end;
+        /* .. and limit it to a maximum of one page of slop */
+        if (env_end >= arg_end + PAGE_SIZE)
+                env_end = arg_end + PAGE_SIZE - 1;
        /* We're not going to care if "*ppos" has high bits set */
        pos = arg_start + *ppos;
@@ -254,10 +258,19 @@ static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
        while (count) {
                int got;
                size_t size = min_t(size_t, PAGE_SIZE, count);
+                long offset;
-                got = access_remote_vm(mm, pos, page, size, FOLL_ANON);
+                /*
-                if (got <= 0)
+                 * Are we already starting past the official end?
+                 * We always include the last byte that is *supposed*
+                 * to be NUL
+                 */
+                offset = (pos >= arg_end) ? pos - arg_end + 1 : 0;
+                got = access_remote_vm(mm, pos - offset, page, size + offset, FOLL_ANON);
+                if (got <= offset)
                        break;
+                got -= offset;
                /* Don't walk past a NUL character once you hit arg_end */
                if (pos + got >= arg_end) {
@@ -276,12 +289,17 @@ static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
                                n = arg_end - pos - 1;
                        /* Cut off at first NUL after 'n' */
-                        got = n + strnlen(page+n, got-n);
+                        got = n + strnlen(page+n, offset+got-n);
-                        if (!got)
+                        if (got < offset)
                                break;
+                        got -= offset;
+                        /* Include the NUL if it existed */
+                        if (got < size)
+                                got++;
                }
-                got -= copy_to_user(buf, page, got);
+                got -= copy_to_user(buf, page+offset, got);
                if (unlikely(!got)) {
                        if (!len)
                                len = -EFAULT;
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 6ac1c92997ea..bb1c1625b158 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -564,11 +564,20 @@ static int proc_seq_open(struct inode *inode, struct file *file)
        return seq_open(file, de->seq_ops);
 }
+static int proc_seq_release(struct inode *inode, struct file *file)
+{
+        struct proc_dir_entry *de = PDE(inode);
+        if (de->state_size)
+                return seq_release_private(inode, file);
+        return seq_release(inode, file);
+}
 static const struct file_operations proc_seq_fops = {
        .open           = proc_seq_open,
        .read           = seq_read,
        .llseek         = seq_lseek,
-        .release        = seq_release,
+        .release        = proc_seq_release,
 };
 struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode,
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index d88231e3b2be..fc20e06c56ba 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -711,21 +711,18 @@ EXPORT_SYMBOL(dquot_quota_sync);
 static unsigned long
 dqcache_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
 {
-        struct list_head *head;
        struct dquot *dquot;
        unsigned long freed = 0;
        spin_lock(&dq_list_lock);
-        head = free_dquots.prev;
+        while (!list_empty(&free_dquots) && sc->nr_to_scan) {
-        while (head != &free_dquots && sc->nr_to_scan) {
+                dquot = list_first_entry(&free_dquots, struct dquot, dq_free);
-                dquot = list_entry(head, struct dquot, dq_free);
                remove_dquot_hash(dquot);
                remove_free_dquot(dquot);
                remove_inuse(dquot);
                do_destroy_dquot(dquot);
                sc->nr_to_scan--;
                freed++;
-                head = free_dquots.prev;
        }
        spin_unlock(&dq_list_lock);
        return freed;
diff --git a/fs/select.c b/fs/select.c
index 317891ff8165..4a6b6e4b21cb 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -34,29 +34,6 @@
 #include <linux/uaccess.h>
-__poll_t vfs_poll(struct file *file, struct poll_table_struct *pt)
-{
-        if (file->f_op->poll) {
-                return file->f_op->poll(file, pt);
-        } else if (file_has_poll_mask(file)) {
-                unsigned int events = poll_requested_events(pt);
-                struct wait_queue_head *head;
-                if (pt && pt->_qproc) {
-                        head = file->f_op->get_poll_head(file, events);
-                        if (!head)
-                                return DEFAULT_POLLMASK;
-                        if (IS_ERR(head))
-                                return EPOLLERR;
-                        pt->_qproc(file, head, pt);
-                }
-                return file->f_op->poll_mask(file, events);
-        } else {
-                return DEFAULT_POLLMASK;
-        }
-}
-EXPORT_SYMBOL_GPL(vfs_poll);
 /*
 * Estimate expected accuracy in ns from a timeval.
diff --git a/fs/timerfd.c b/fs/timerfd.c
index d84a2bee4f82..cdad49da3ff7 100644
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -226,20 +226,21 @@ static int timerfd_release(struct inode *inode, struct file *file)
        kfree_rcu(ctx, rcu);
        return 0;
 }
-        
-static struct wait_queue_head *timerfd_get_poll_head(struct file *file,
+static __poll_t timerfd_poll(struct file *file, poll_table *wait)
-                __poll_t eventmask)
 {
        struct timerfd_ctx *ctx = file->private_data;
+        __poll_t events = 0;
+        unsigned long flags;
-        return &ctx->wqh;
+        poll_wait(file, &ctx->wqh, wait);
-}
-static __poll_t timerfd_poll_mask(struct file *file, __poll_t eventmask)
+        spin_lock_irqsave(&ctx->wqh.lock, flags);
-{
+        if (ctx->ticks)
-        struct timerfd_ctx *ctx = file->private_data;
+                events |= EPOLLIN;
+        spin_unlock_irqrestore(&ctx->wqh.lock, flags);
-        return ctx->ticks ? EPOLLIN : 0;
+        return events;
 }
 static ssize_t timerfd_read(struct file *file, char __user *buf, size_t count,
@@ -363,8 +364,7 @@ static long timerfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg
 static const struct file_operations timerfd_fops = {
        .release        = timerfd_release,
-        .get_poll_head  = timerfd_get_poll_head,
+        .poll           = timerfd_poll,
-        .poll_mask      = timerfd_poll_mask,
        .read           = timerfd_read,
        .llseek         = noop_llseek,
        .show_fdinfo    = timerfd_show,
diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
index 1b961b1d9699..fcda0fc97b90 100644
--- a/fs/udf/balloc.c
+++ b/fs/udf/balloc.c
@@ -533,8 +533,7 @@ static int udf_table_prealloc_blocks(struct super_block *sb,
                        udf_write_aext(table, &epos, &eloc,
                                        (etype << 30) | elen, 1);
                } else
-                        udf_delete_aext(table, epos, eloc,
+                        udf_delete_aext(table, epos);
-                                        (etype << 30) | elen);
        } else {
                alloc_count = 0;
        }
@@ -630,7 +629,7 @@ static udf_pblk_t udf_table_new_block(struct super_block *sb,
        if (goal_elen)
                udf_write_aext(table, &goal_epos, &goal_eloc, goal_elen, 1);
        else
-                udf_delete_aext(table, goal_epos, goal_eloc, goal_elen);
+                udf_delete_aext(table, goal_epos);
        brelse(goal_epos.bh);
        udf_add_free_space(sb, partition, -1);
diff --git a/fs/udf/directory.c b/fs/udf/directory.c
index 0a98a2369738..d9523013096f 100644
--- a/fs/udf/directory.c
+++ b/fs/udf/directory.c
@@ -141,10 +141,7 @@ struct fileIdentDesc *udf_fileident_read(struct inode *dir, loff_t *nf_pos,
                               fibh->ebh->b_data,
                               sizeof(struct fileIdentDesc) + fibh->soffset);
-                        fi_len = (sizeof(struct fileIdentDesc) +
+                        fi_len = udf_dir_entry_len(cfi);
-                                  cfi->lengthFileIdent +
-                                  le16_to_cpu(cfi->lengthOfImpUse) + 3) & ~3;
                        *nf_pos += fi_len - (fibh->eoffset - fibh->soffset);
                        fibh->eoffset = fibh->soffset + fi_len;
                } else {
@@ -152,6 +149,9 @@ struct fileIdentDesc *udf_fileident_read(struct inode *dir, loff_t *nf_pos,
                               sizeof(struct fileIdentDesc));
                }
        }
+        /* Got last entry outside of dir size - fs is corrupted! */
+        if (*nf_pos > dir->i_size)
+                return NULL;
        return fi;
 }
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 7f39d17352c9..9915a58fbabd 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1147,8 +1147,7 @@ static void udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr
        if (startnum > endnum) {
                for (i = 0; i < (startnum - endnum); i++)
-                        udf_delete_aext(inode, *epos, laarr[i].extLocation,
+                        udf_delete_aext(inode, *epos);
-                                        laarr[i].extLength);
        } else if (startnum < endnum) {
                for (i = 0; i < (endnum - startnum); i++) {
                        udf_insert_aext(inode, *epos, laarr[i].extLocation,
@@ -2176,14 +2175,15 @@ static int8_t udf_insert_aext(struct inode *inode, struct extent_position epos,
        return (nelen >> 30);
 }
-int8_t udf_delete_aext(struct inode *inode, struct extent_position epos,
+int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
-                       struct kernel_lb_addr eloc, uint32_t elen)
 {
        struct extent_position oepos;
        int adsize;
        int8_t etype;
        struct allocExtDesc *aed;
        struct udf_inode_info *iinfo;
+        struct kernel_lb_addr eloc;
+        uint32_t elen;
        if (epos.bh) {
                get_bh(epos.bh);
diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index c586026508db..06f37ddd2997 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -351,8 +351,6 @@ static struct fileIdentDesc *udf_add_entry(struct inode *dir,
        loff_t f_pos;
        loff_t size = udf_ext0_offset(dir) + dir->i_size;
        int nfidlen;
-        uint8_t lfi;
-        uint16_t liu;
        udf_pblk_t block;
        struct kernel_lb_addr eloc;
        uint32_t elen = 0;
@@ -383,7 +381,7 @@ static struct fileIdentDesc *udf_add_entry(struct inode *dir,
                namelen = 0;
        }
-        nfidlen = (sizeof(struct fileIdentDesc) + namelen + 3) & ~3;
+        nfidlen = ALIGN(sizeof(struct fileIdentDesc) + namelen, UDF_NAME_PAD);
        f_pos = udf_ext0_offset(dir);
@@ -424,12 +422,8 @@ static struct fileIdentDesc *udf_add_entry(struct inode *dir,
                        goto out_err;
                }
-                liu = le16_to_cpu(cfi->lengthOfImpUse);
-                lfi = cfi->lengthFileIdent;
                if ((cfi->fileCharacteristics & FID_FILE_CHAR_DELETED) != 0) {
-                        if (((sizeof(struct fileIdentDesc) +
+                        if (udf_dir_entry_len(cfi) == nfidlen) {
-                                        liu + lfi + 3) & ~3) == nfidlen) {
                                cfi->descTag.tagSerialNum = cpu_to_le16(1);
                                cfi->fileVersionNum = cpu_to_le16(1);
                                cfi->fileCharacteristics = 0;
@@ -1201,9 +1195,7 @@ static int udf_rename(struct inode *old_dir, struct dentry *old_dentry,
        if (dir_fi) {
                dir_fi->icb.extLocation = cpu_to_lelb(UDF_I(new_dir)->i_location);
-                udf_update_tag((char *)dir_fi,
+                udf_update_tag((char *)dir_fi, udf_dir_entry_len(dir_fi));
-                                (sizeof(struct fileIdentDesc) +
-                                le16_to_cpu(dir_fi->lengthOfImpUse) + 3) & ~3);
                if (old_iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB)
                        mark_inode_dirty(old_inode);
                else
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index bae311b59400..84c47dde4d26 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -132,6 +132,12 @@ struct inode *udf_find_metadata_inode_efe(struct super_block *sb,
 extern int udf_write_fi(struct inode *inode, struct fileIdentDesc *,
                        struct fileIdentDesc *, struct udf_fileident_bh *,
                        uint8_t *, uint8_t *);
+static inline unsigned int udf_dir_entry_len(struct fileIdentDesc *cfi)
+{
+        return ALIGN(sizeof(struct fileIdentDesc) +
+                le16_to_cpu(cfi->lengthOfImpUse) + cfi->lengthFileIdent,
+                UDF_NAME_PAD);
+}
 /* file.c */
 extern long udf_ioctl(struct file *, unsigned int, unsigned long);
@@ -167,8 +173,7 @@ extern int udf_add_aext(struct inode *, struct extent_position *,
                        struct kernel_lb_addr *, uint32_t, int);
 extern void udf_write_aext(struct inode *, struct extent_position *,
                           struct kernel_lb_addr *, uint32_t, int);
-extern int8_t udf_delete_aext(struct inode *, struct extent_position,
+extern int8_t udf_delete_aext(struct inode *, struct extent_position);
-                              struct kernel_lb_addr, uint32_t);
 extern int8_t udf_next_aext(struct inode *, struct extent_position *,
                            struct kernel_lb_addr *, uint32_t *, int);
 extern int8_t udf_current_aext(struct inode *, struct extent_position *,
diff --git a/fs/xfs/libxfs/xfs_ag_resv.c b/fs/xfs/libxfs/xfs_ag_resv.c
index 84db76e0e3e3..fecd187fcf2c 100644
--- a/fs/xfs/libxfs/xfs_ag_resv.c
+++ b/fs/xfs/libxfs/xfs_ag_resv.c
@@ -157,6 +157,7 @@ __xfs_ag_resv_free(
        error = xfs_mod_fdblocks(pag->pag_mount, oldresv, true);
        resv->ar_reserved = 0;
        resv->ar_asked = 0;
+        resv->ar_orig_reserved = 0;
        if (error)
                trace_xfs_ag_resv_free_error(pag->pag_mount, pag->pag_agno,
@@ -189,13 +190,34 @@ __xfs_ag_resv_init(
        struct xfs_mount                *mp = pag->pag_mount;
        struct xfs_ag_resv              *resv;
        int                             error;
-        xfs_extlen_t                    reserved;
+        xfs_extlen_t                    hidden_space;
        if (used > ask)
                ask = used;
-        reserved = ask - used;
-        error = xfs_mod_fdblocks(mp, -(int64_t)reserved, true);
+        switch (type) {
+        case XFS_AG_RESV_RMAPBT:
+                /*
+                 * Space taken by the rmapbt is not subtracted from fdblocks
+                 * because the rmapbt lives in the free space.  Here we must
+                 * subtract the entire reservation from fdblocks so that we
+                 * always have blocks available for rmapbt expansion.
+                 */
+                hidden_space = ask;
+                break;
+        case XFS_AG_RESV_METADATA:
+                /*
+                 * Space taken by all other metadata btrees are accounted
+                 * on-disk as used space.  We therefore only hide the space
+                 * that is reserved but not used by the trees.
+                 */
+                hidden_space = ask - used;
+                break;
+        default:
+                ASSERT(0);
+                return -EINVAL;
+        }
+        error = xfs_mod_fdblocks(mp, -(int64_t)hidden_space, true);
        if (error) {
                trace_xfs_ag_resv_init_error(pag->pag_mount, pag->pag_agno,
                                error, _RET_IP_);
@@ -216,7 +238,8 @@ __xfs_ag_resv_init(
        resv = xfs_perag_resv(pag, type);
        resv->ar_asked = ask;
-        resv->ar_reserved = resv->ar_orig_reserved = reserved;
+        resv->ar_orig_reserved = hidden_space;
+        resv->ar_reserved = ask - used;
        trace_xfs_ag_resv_init(pag, type, ask);
        return 0;
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 01628f0c9a0c..7205268b30bc 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -5780,6 +5780,32 @@ del_cursor:
        return error;
 }
+/* Make sure we won't be right-shifting an extent past the maximum bound. */
+int
+xfs_bmap_can_insert_extents(
+        struct xfs_inode        *ip,
+        xfs_fileoff_t           off,
+        xfs_fileoff_t           shift)
+{
+        struct xfs_bmbt_irec    got;
+        int                     is_empty;
+        int                     error = 0;
+        ASSERT(xfs_isilocked(ip, XFS_IOLOCK_EXCL));
+        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+                return -EIO;
+        xfs_ilock(ip, XFS_ILOCK_EXCL);
+        error = xfs_bmap_last_extent(NULL, ip, XFS_DATA_FORK, &got, &is_empty);
+        if (!error && !is_empty && got.br_startoff >= off &&
+            ((got.br_startoff + shift) & BMBT_STARTOFF_MASK) < got.br_startoff)
+                error = -EINVAL;
+        xfs_iunlock(ip, XFS_ILOCK_EXCL);
+        return error;
+}
 int
 xfs_bmap_insert_extents(
        struct xfs_trans        *tp,
diff --git a/fs/xfs/libxfs/xfs_bmap.h b/fs/xfs/libxfs/xfs_bmap.h
index 99dddbd0fcc6..9b49ddf99c41 100644
--- a/fs/xfs/libxfs/xfs_bmap.h
+++ b/fs/xfs/libxfs/xfs_bmap.h
@@ -227,6 +227,8 @@ int	xfs_bmap_collapse_extents(struct xfs_trans *tp, struct xfs_inode *ip,
                xfs_fileoff_t *next_fsb, xfs_fileoff_t offset_shift_fsb,
                bool *done, xfs_fsblock_t *firstblock,
                struct xfs_defer_ops *dfops);
+int     xfs_bmap_can_insert_extents(struct xfs_inode *ip, xfs_fileoff_t off,
+                xfs_fileoff_t shift);
 int     xfs_bmap_insert_extents(struct xfs_trans *tp, struct xfs_inode *ip,
                xfs_fileoff_t *next_fsb, xfs_fileoff_t offset_shift_fsb,
                bool *done, xfs_fileoff_t stop_fsb, xfs_fsblock_t *firstblock,
diff --git a/fs/xfs/libxfs/xfs_format.h b/fs/xfs/libxfs/xfs_format.h
index 1c5a8aaf2bfc..059bc44c27e8 100644
--- a/fs/xfs/libxfs/xfs_format.h
+++ b/fs/xfs/libxfs/xfs_format.h
@@ -962,6 +962,9 @@ typedef enum xfs_dinode_fmt {
                XFS_DFORK_DSIZE(dip, mp) : \
                XFS_DFORK_ASIZE(dip, mp))
+#define XFS_DFORK_MAXEXT(dip, mp, w) \
+        (XFS_DFORK_SIZE(dip, mp, w) / sizeof(struct xfs_bmbt_rec))
 /*
 * Return pointers to the data or attribute forks.
 */
@@ -1526,6 +1529,8 @@ typedef struct xfs_bmdr_block {
 #define BMBT_STARTBLOCK_BITLEN  52
 #define BMBT_BLOCKCOUNT_BITLEN  21
+#define BMBT_STARTOFF_MASK      ((1ULL << BMBT_STARTOFF_BITLEN) - 1)
 typedef struct xfs_bmbt_rec {
        __be64                  l0, l1;
 } xfs_bmbt_rec_t;
diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
index d38d724534c4..33dc34655ac3 100644
--- a/fs/xfs/libxfs/xfs_inode_buf.c
+++ b/fs/xfs/libxfs/xfs_inode_buf.c
@@ -374,6 +374,47 @@ xfs_log_dinode_to_disk(
        }
 }
+static xfs_failaddr_t
+xfs_dinode_verify_fork(
+        struct xfs_dinode       *dip,
+        struct xfs_mount        *mp,
+        int                     whichfork)
+{
+        uint32_t                di_nextents = XFS_DFORK_NEXTENTS(dip, whichfork);
+        switch (XFS_DFORK_FORMAT(dip, whichfork)) {
+        case XFS_DINODE_FMT_LOCAL:
+                /*
+                 * no local regular files yet
+                 */
+                if (whichfork == XFS_DATA_FORK) {
+                        if (S_ISREG(be16_to_cpu(dip->di_mode)))
+                                return __this_address;
+                        if (be64_to_cpu(dip->di_size) >
+                                        XFS_DFORK_SIZE(dip, mp, whichfork))
+                                return __this_address;
+                }
+                if (di_nextents)
+                        return __this_address;
+                break;
+        case XFS_DINODE_FMT_EXTENTS:
+                if (di_nextents > XFS_DFORK_MAXEXT(dip, mp, whichfork))
+                        return __this_address;
+                break;
+        case XFS_DINODE_FMT_BTREE:
+                if (whichfork == XFS_ATTR_FORK) {
+                        if (di_nextents > MAXAEXTNUM)
+                                return __this_address;
+                } else if (di_nextents > MAXEXTNUM) {
+                        return __this_address;
+                }
+                break;
+        default:
+                return __this_address;
+        }
+        return NULL;
+}
 xfs_failaddr_t
 xfs_dinode_verify(
        struct xfs_mount        *mp,
@@ -441,24 +482,9 @@ xfs_dinode_verify(
        case S_IFREG:
        case S_IFLNK:
        case S_IFDIR:
-                switch (dip->di_format) {
+                fa = xfs_dinode_verify_fork(dip, mp, XFS_DATA_FORK);
-                case XFS_DINODE_FMT_LOCAL:
+                if (fa)
-                        /*
+                        return fa;
-                         * no local regular files yet
-                         */
-                        if (S_ISREG(mode))
-                                return __this_address;
-                        if (di_size > XFS_DFORK_DSIZE(dip, mp))
-                                return __this_address;
-                        if (dip->di_nextents)
-                                return __this_address;
-                        /* fall through */
-                case XFS_DINODE_FMT_EXTENTS:
-                case XFS_DINODE_FMT_BTREE:
-                        break;
-                default:
-                        return __this_address;
-                }
                break;
        case 0:
                /* Uninitialized inode ok. */
@@ -468,17 +494,9 @@ xfs_dinode_verify(
        }
        if (XFS_DFORK_Q(dip)) {
-                switch (dip->di_aformat) {
+                fa = xfs_dinode_verify_fork(dip, mp, XFS_ATTR_FORK);
-                case XFS_DINODE_FMT_LOCAL:
+                if (fa)
-                        if (dip->di_anextents)
+                        return fa;
-                                return __this_address;
-                /* fall through */
-                case XFS_DINODE_FMT_EXTENTS:
-                case XFS_DINODE_FMT_BTREE:
-                        break;
-                default:
-                        return __this_address;
-                }
        } else {
                /*
                 * If there is no fork offset, this may be a freshly-made inode
diff --git a/fs/xfs/libxfs/xfs_rtbitmap.c b/fs/xfs/libxfs/xfs_rtbitmap.c
index 65fc4ed2e9a1..b228c821bae6 100644
--- a/fs/xfs/libxfs/xfs_rtbitmap.c
+++ b/fs/xfs/libxfs/xfs_rtbitmap.c
@@ -1029,8 +1029,8 @@ xfs_rtalloc_query_range(
        if (low_rec->ar_startext >= mp->m_sb.sb_rextents ||
            low_rec->ar_startext == high_rec->ar_startext)
                return 0;
-        if (high_rec->ar_startext >= mp->m_sb.sb_rextents)
+        if (high_rec->ar_startext > mp->m_sb.sb_rextents)
-                high_rec->ar_startext = mp->m_sb.sb_rextents - 1;
+                high_rec->ar_startext = mp->m_sb.sb_rextents;
        /* Iterate the bitmap, looking for discrepancies. */
        rtstart = low_rec->ar_startext;
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index c35009a86699..83b1e8c6c18f 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -685,12 +685,10 @@ out_unlock_iolock:
 }
 /*
- * dead simple method of punching delalyed allocation blocks from a range in
+ * Dead simple method of punching delalyed allocation blocks from a range in
- * the inode. Walks a block at a time so will be slow, but is only executed in
+ * the inode.  This will always punch out both the start and end blocks, even
- * rare error cases so the overhead is not critical. This will always punch out
+ * if the ranges only partially overlap them, so it is up to the caller to
- * both the start and end blocks, even if the ranges only partially overlap
+ * ensure that partial blocks are not passed in.
- * them, so it is up to the caller to ensure that partial blocks are not
- * passed in.
 */
 int
 xfs_bmap_punch_delalloc_range(
@@ -698,63 +696,44 @@ xfs_bmap_punch_delalloc_range(
        xfs_fileoff_t           start_fsb,
        xfs_fileoff_t           length)
 {
-        xfs_fileoff_t           remaining = length;
+        struct xfs_ifork        *ifp = &ip->i_df;
+        xfs_fileoff_t           end_fsb = start_fsb + length;
+        struct xfs_bmbt_irec    got, del;
+        struct xfs_iext_cursor  icur;
        int                     error = 0;
        ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
-        do {
+        if (!(ifp->if_flags & XFS_IFEXTENTS)) {
-                int             done;
+                error = xfs_iread_extents(NULL, ip, XFS_DATA_FORK);
-                xfs_bmbt_irec_t imap;
+                if (error)
-                int             nimaps = 1;
+                        return error;
-                xfs_fsblock_t   firstblock;
+        }
-                struct xfs_defer_ops dfops;
-                /*
+        if (!xfs_iext_lookup_extent_before(ip, ifp, &end_fsb, &icur, &got))
-                 * Map the range first and check that it is a delalloc extent
+                return 0;
-                 * before trying to unmap the range. Otherwise we will be
-                 * trying to remove a real extent (which requires a
-                 * transaction) or a hole, which is probably a bad idea...
-                 */
-                error = xfs_bmapi_read(ip, start_fsb, 1, &imap, &nimaps,
-                                       XFS_BMAPI_ENTIRE);
-                if (error) {
+        while (got.br_startoff + got.br_blockcount > start_fsb) {
-                        /* something screwed, just bail */
+                del = got;
-                        if (!XFS_FORCED_SHUTDOWN(ip->i_mount)) {
+                xfs_trim_extent(&del, start_fsb, length);
-                                xfs_alert(ip->i_mount,
-                        "Failed delalloc mapping lookup ino %lld fsb %lld.",
-                                                ip->i_ino, start_fsb);
-                        }
-                        break;
-                }
-                if (!nimaps) {
-                        /* nothing there */
-                        goto next_block;
-                }
-                if (imap.br_startblock != DELAYSTARTBLOCK) {
-                        /* been converted, ignore */
-                        goto next_block;
-                }
-                WARN_ON(imap.br_blockcount == 0);
                /*
-                 * Note: while we initialise the firstblock/dfops pair, they
+                 * A delete can push the cursor forward. Step back to the
-                 * should never be used because blocks should never be
+                 * previous extent on non-delalloc or extents outside the
-                 * allocated or freed for a delalloc extent and hence we need
+                 * target range.
-                 * don't cancel or finish them after the xfs_bunmapi() call.
                 */
-                xfs_defer_init(&dfops, &firstblock);
+                if (!del.br_blockcount ||
-                error = xfs_bunmapi(NULL, ip, start_fsb, 1, 0, 1, &firstblock,
+                    !isnullstartblock(del.br_startblock)) {
-                                        &dfops, &done);
+                        if (!xfs_iext_prev_extent(ifp, &icur, &got))
-                if (error)
+                                break;
-                        break;
+                        continue;
+                }
-                ASSERT(!xfs_defer_has_unfinished_work(&dfops));
+                error = xfs_bmap_del_extent_delay(ip, XFS_DATA_FORK, &icur,
-next_block:
+                                                  &got, &del);
-                start_fsb++;
+                if (error || !xfs_iext_get_extent(ifp, &icur, &got))
-                remaining--;
+                        break;
-        } while(remaining > 0);
+        }
        return error;
 }
@@ -1208,7 +1187,22 @@ xfs_free_file_space(
                return 0;
        if (offset + len > XFS_ISIZE(ip))
                len = XFS_ISIZE(ip) - offset;
-        return iomap_zero_range(VFS_I(ip), offset, len, NULL, &xfs_iomap_ops);
+        error = iomap_zero_range(VFS_I(ip), offset, len, NULL, &xfs_iomap_ops);
+        if (error)
+                return error;
+        /*
+         * If we zeroed right up to EOF and EOF straddles a page boundary we
+         * must make sure that the post-EOF area is also zeroed because the
+         * page could be mmap'd and iomap_zero_range doesn't do that for us.
+         * Writeback of the eof page will do this, albeit clumsily.
+         */
+        if (offset + len >= XFS_ISIZE(ip) && ((offset + len) & PAGE_MASK)) {
+                error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
+                                (offset + len) & ~PAGE_MASK, LLONG_MAX);
+        }
+        return error;
 }
 /*
@@ -1404,6 +1398,10 @@ xfs_insert_file_space(
        trace_xfs_insert_file_space(ip);
+        error = xfs_bmap_can_insert_extents(ip, stop_fsb, shift_fsb);
+        if (error)
+                return error;
        error = xfs_prepare_shift(ip, offset);
        if (error)
                return error;
diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c
index c34fa9c342f2..c7157bc48bd1 100644
--- a/fs/xfs/xfs_fsmap.c
+++ b/fs/xfs/xfs_fsmap.c
@@ -513,8 +513,8 @@ xfs_getfsmap_rtdev_rtbitmap_query(
        struct xfs_trans                *tp,
        struct xfs_getfsmap_info        *info)
 {
-        struct xfs_rtalloc_rec          alow;
+        struct xfs_rtalloc_rec          alow = { 0 };
-        struct xfs_rtalloc_rec          ahigh;
+        struct xfs_rtalloc_rec          ahigh = { 0 };
        int                             error;
        xfs_ilock(tp->t_mountp->m_rbmip, XFS_ILOCK_SHARED);
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index a7afcad6b711..3f2bd6032cf8 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -387,7 +387,7 @@ xfs_reserve_blocks(
        do {
                free = percpu_counter_sum(&mp->m_fdblocks) -
                                                mp->m_alloc_set_aside;
-                if (!free)
+                if (free <= 0)
                        break;
                delta = request - mp->m_resblks;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 7a96c4e0ab5c..5df4de666cc1 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -3236,7 +3236,6 @@ xfs_iflush_cluster(
        struct xfs_inode        *cip;
        int                     nr_found;
        int                     clcount = 0;
-        int                     bufwasdelwri;
        int                     i;
        pag = xfs_perag_get(mp, XFS_INO_TO_AGNO(mp, ip->i_ino));
@@ -3360,37 +3359,22 @@ cluster_corrupt_out:
         * inode buffer and shut down the filesystem.
         */
        rcu_read_unlock();
-        /*
-         * Clean up the buffer.  If it was delwri, just release it --
-         * brelse can handle it with no problems.  If not, shut down the
-         * filesystem before releasing the buffer.
-         */
-        bufwasdelwri = (bp->b_flags & _XBF_DELWRI_Q);
-        if (bufwasdelwri)
-                xfs_buf_relse(bp);
        xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
-        if (!bufwasdelwri) {
-                /*
-                 * Just like incore_relse: if we have b_iodone functions,
-                 * mark the buffer as an error and call them.  Otherwise
-                 * mark it as stale and brelse.
-                 */
-                if (bp->b_iodone) {
-                        bp->b_flags &= ~XBF_DONE;
-                        xfs_buf_stale(bp);
-                        xfs_buf_ioerror(bp, -EIO);
-                        xfs_buf_ioend(bp);
-                } else {
-                        xfs_buf_stale(bp);
-                        xfs_buf_relse(bp);
-                }
-        }
        /*
-         * Unlocks the flush lock
+         * We'll always have an inode attached to the buffer for completion
+         * process by the time we are called from xfs_iflush(). Hence we have
+         * always need to do IO completion processing to abort the inodes
+         * attached to the buffer.  handle them just like the shutdown case in
+         * xfs_buf_submit().
         */
+        ASSERT(bp->b_iodone);
+        bp->b_flags &= ~XBF_DONE;
+        xfs_buf_stale(bp);
+        xfs_buf_ioerror(bp, -EIO);
+        xfs_buf_ioend(bp);
+        /* abort the corrupt inode, as it was not attached to the buffer */
        xfs_iflush_abort(cip, false);
        kmem_free(cilist);
        xfs_perag_put(pag);
@@ -3486,12 +3470,17 @@ xfs_iflush(
                xfs_log_force(mp, 0);
        /*
-         * inode clustering:
+         * inode clustering: try to gather other inodes into this write
-         * see if other inodes can be gathered into this write
+         *
+         * Note: Any error during clustering will result in the filesystem
+         * being shut down and completion callbacks run on the cluster buffer.
+         * As we have already flushed and attached this inode to the buffer,
+         * it has already been aborted and released by xfs_iflush_cluster() and
+         * so we have no further error handling to do here.
         */
        error = xfs_iflush_cluster(ip, bp);
        if (error)
-                goto cluster_corrupt_out;
+                return error;
        *bpp = bp;
        return 0;
@@ -3500,12 +3489,8 @@ corrupt_out:
        if (bp)
                xfs_buf_relse(bp);
        xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
-cluster_corrupt_out:
-        error = -EFSCORRUPTED;
 abort_out:
-        /*
+        /* abort the corrupt inode, as it was not attached to the buffer */
-         * Unlocks the flush lock
-         */
        xfs_iflush_abort(ip, false);
        return error;
 }
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 49f5492eed3b..55876dd02f0c 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -963,12 +963,13 @@ xfs_ilock_for_iomap(
        unsigned                *lockmode)
 {
        unsigned                mode = XFS_ILOCK_SHARED;
+        bool                    is_write = flags & (IOMAP_WRITE | IOMAP_ZERO);
        /*
         * COW writes may allocate delalloc space or convert unwritten COW
         * extents, so we need to make sure to take the lock exclusively here.
         */
-        if (xfs_is_reflink_inode(ip) && (flags & (IOMAP_WRITE | IOMAP_ZERO))) {
+        if (xfs_is_reflink_inode(ip) && is_write) {
                /*
                 * FIXME: It could still overwrite on unshared extents and not
                 * need allocation.
@@ -989,6 +990,7 @@ xfs_ilock_for_iomap(
                mode = XFS_ILOCK_EXCL;
        }
+relock:
        if (flags & IOMAP_NOWAIT) {
                if (!xfs_ilock_nowait(ip, mode))
                        return -EAGAIN;
@@ -996,6 +998,17 @@ xfs_ilock_for_iomap(
                xfs_ilock(ip, mode);
        }
+        /*
+         * The reflink iflag could have changed since the earlier unlocked
+         * check, so if we got ILOCK_SHARED for a write and but we're now a
+         * reflink inode we have to switch to ILOCK_EXCL and relock.
+         */
+        if (mode == XFS_ILOCK_SHARED && is_write && xfs_is_reflink_inode(ip)) {
+                xfs_iunlock(ip, mode);
+                mode = XFS_ILOCK_EXCL;
+                goto relock;
+        }
        *lockmode = mode;
        return 0;
 }
diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
index e040af120b69..524f543c5b82 100644
--- a/fs/xfs/xfs_trans.c
+++ b/fs/xfs/xfs_trans.c
@@ -258,7 +258,12 @@ xfs_trans_alloc(
        if (!(flags & XFS_TRANS_NO_WRITECOUNT))
                sb_start_intwrite(mp->m_super);
-        WARN_ON(mp->m_super->s_writers.frozen == SB_FREEZE_COMPLETE);
+        /*
+         * Zero-reservation ("empty") transactions can't modify anything, so
+         * they're allowed to run while we're frozen.
+         */
+        WARN_ON(resp->tr_logres > 0 &&
+                mp->m_super->s_writers.frozen == SB_FREEZE_COMPLETE);
        atomic_inc(&mp->m_active_trans);
        tp = kmem_zone_zalloc(xfs_trans_zone,
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index 40a916efd7c0..1194a4c78d55 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -309,7 +309,7 @@ static inline void acpi_processor_ppc_exit(void)
 {
        return;
 }
-static inline int acpi_processor_ppc_has_changed(struct acpi_processor *pr,
+static inline void acpi_processor_ppc_has_changed(struct acpi_processor *pr,
                                                                int event_flag)
 {
        static unsigned int printout = 1;
@@ -320,7 +320,6 @@ static inline int acpi_processor_ppc_has_changed(struct acpi_processor *pr,
                       "Consider compiling CPUfreq support into your kernel.\n");
                printout = 0;
        }
-        return 0;
 }
 static inline int acpi_processor_get_bios_limit(int cpu, unsigned int *limit)
 {
diff --git a/include/asm-generic/qspinlock_types.h b/include/asm-generic/qspinlock_types.h
index 0763f065b975..d10f1e7d6ba8 100644
--- a/include/asm-generic/qspinlock_types.h
+++ b/include/asm-generic/qspinlock_types.h
@@ -63,7 +63,7 @@ typedef struct qspinlock {
 /*
 * Initializier
 */
-#define __ARCH_SPIN_LOCK_UNLOCKED       { .val = ATOMIC_INIT(0) }
+#define __ARCH_SPIN_LOCK_UNLOCKED       { { .val = ATOMIC_INIT(0) } }
 /*
 * Bitfields in the atomic value:
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index cc414db9da0a..482461d8931d 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -245,7 +245,8 @@ ssize_t af_alg_sendpage(struct socket *sock, struct page *page,
                        int offset, size_t size, int flags);
 void af_alg_free_resources(struct af_alg_async_req *areq);
 void af_alg_async_cb(struct crypto_async_request *_req, int err);
-__poll_t af_alg_poll_mask(struct socket *sock, __poll_t events);
+__poll_t af_alg_poll(struct file *file, struct socket *sock,
+                         poll_table *wait);
 struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk,
                                           unsigned int areqlen);
 int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags,
diff --git a/include/dt-bindings/bus/ti-sysc.h b/include/dt-bindings/bus/ti-sysc.h
index 2c005376ac0e..7138384e2ef9 100644
--- a/include/dt-bindings/bus/ti-sysc.h
+++ b/include/dt-bindings/bus/ti-sysc.h
@@ -15,6 +15,8 @@
 /* SmartReflex sysc found on 36xx and later */
 #define SYSC_OMAP3_SR_ENAWAKEUP         (1 << 26)
+#define SYSC_DRA7_MCAN_ENAWAKEUP        (1 << 4)
 /* SYSCONFIG STANDBYMODE/MIDLEMODE/SIDLEMODE supported by hardware */
 #define SYSC_IDLE_FORCE                 0
 #define SYSC_IDLE_NO                    1
diff --git a/include/dt-bindings/clock/dra7.h b/include/dt-bindings/clock/dra7.h
index 5e1061b15aed..d7549c57cac3 100644
--- a/include/dt-bindings/clock/dra7.h
+++ b/include/dt-bindings/clock/dra7.h
@@ -168,5 +168,6 @@
 #define DRA7_COUNTER_32K_CLKCTRL        DRA7_CLKCTRL_INDEX(0x50)
 #define DRA7_UART10_CLKCTRL     DRA7_CLKCTRL_INDEX(0x80)
 #define DRA7_DCAN1_CLKCTRL      DRA7_CLKCTRL_INDEX(0x88)
+#define DRA7_ADC_CLKCTRL        DRA7_CLKCTRL_INDEX(0xa0)
 #endif
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 4b35a66383f9..e54f40974eb0 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -443,6 +443,9 @@ int acpi_check_resource_conflict(const struct resource *res);
 int acpi_check_region(resource_size_t start, resource_size_t n,
                      const char *name);
+acpi_status acpi_release_memory(acpi_handle handle, struct resource *res,
+                                u32 level);
 int acpi_resources_are_enforced(void);
 #ifdef CONFIG_HIBERNATION
diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
index 0c27515d2cf6..8124815eb121 100644
--- a/include/linux/atmdev.h
+++ b/include/linux/atmdev.h
@@ -214,6 +214,7 @@ struct atmphy_ops {
 struct atm_skb_data {
        struct atm_vcc  *vcc;           /* ATM VCC */
        unsigned long   atm_options;    /* ATM layer options */
+        unsigned int    acct_truesize;  /* truesize accounted to vcc */
 };
 #define VCC_HTABLE_SIZE 32
@@ -241,6 +242,20 @@ void vcc_insert_socket(struct sock *sk);
 void atm_dev_release_vccs(struct atm_dev *dev);
+static inline void atm_account_tx(struct atm_vcc *vcc, struct sk_buff *skb)
+{
+        /*
+         * Because ATM skbs may not belong to a sock (and we don't
+         * necessarily want to), skb->truesize may be adjusted,
+         * escaping the hack in pskb_expand_head() which avoids
+         * doing so for some cases. So stash the value of truesize
+         * at the time we accounted it, and atm_pop_raw() can use
+         * that value later, in case it changes.
+         */
+        refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
+        ATM_SKB(skb)->acct_truesize = skb->truesize;
+        ATM_SKB(skb)->atm_options = vcc->atm_options;
+}
 static inline void atm_force_charge(struct atm_vcc *vcc,int truesize)
 {
diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h
index 0bd432a4d7bd..24251762c20c 100644
--- a/include/linux/backing-dev-defs.h
+++ b/include/linux/backing-dev-defs.h
@@ -22,7 +22,6 @@ struct dentry;
 */
 enum wb_state {
        WB_registered,          /* bdi_register() was done */
-        WB_shutting_down,       /* wb_shutdown() in progress */
        WB_writeback_running,   /* Writeback is in progress */
        WB_has_dirty_io,        /* Dirty inodes on ->b_{dirty|io|more_io} */
        WB_start_all,           /* nr_pages == 0 (all) work pending */
@@ -189,6 +188,7 @@ struct backing_dev_info {
 #ifdef CONFIG_CGROUP_WRITEBACK
        struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */
        struct rb_root cgwb_congested_tree; /* their congested states */
+        struct mutex cgwb_release_mutex;  /* protect shutdown of wb structs */
 #else
        struct bdi_writeback_congested *wb_congested;
 #endif
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 9154570edf29..79226ca8f80f 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1119,8 +1119,8 @@ static inline unsigned int blk_max_size_offset(struct request_queue *q,
        if (!q->limits.chunk_sectors)
                return q->limits.max_sectors;
-        return q->limits.chunk_sectors -
+        return min(q->limits.max_sectors, (unsigned int)(q->limits.chunk_sectors -
-                        (offset & (q->limits.chunk_sectors - 1));
+                        (offset & (q->limits.chunk_sectors - 1))));
 }
 static inline unsigned int blk_rq_get_max_sectors(struct request *rq,
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 995c3b1e59bf..7df32a3200f7 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -488,12 +488,15 @@ void bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth);
 /* Map specifics */
 struct xdp_buff;
+struct sk_buff;
 struct bpf_dtab_netdev *__dev_map_lookup_elem(struct bpf_map *map, u32 key);
 void __dev_map_insert_ctx(struct bpf_map *map, u32 index);
 void __dev_map_flush(struct bpf_map *map);
 int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_buff *xdp,
                    struct net_device *dev_rx);
+int dev_map_generic_redirect(struct bpf_dtab_netdev *dst, struct sk_buff *skb,
+                             struct bpf_prog *xdp_prog);
 struct bpf_cpu_map_entry *__cpu_map_lookup_elem(struct bpf_map *map, u32 key);
 void __cpu_map_insert_ctx(struct bpf_map *map, u32 index);
@@ -586,6 +589,15 @@ int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_buff *xdp,
        return 0;
 }
+struct sk_buff;
+static inline int dev_map_generic_redirect(struct bpf_dtab_netdev *dst,
+                                           struct sk_buff *skb,
+                                           struct bpf_prog *xdp_prog)
+{
+        return 0;
+}
 static inline
 struct bpf_cpu_map_entry *__cpu_map_lookup_elem(struct bpf_map *map, u32 key)
 {
diff --git a/include/linux/compat.h b/include/linux/compat.h
index b1a5562b3215..c68acc47da57 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -72,6 +72,9 @@
 */
 #ifndef COMPAT_SYSCALL_DEFINEx
 #define COMPAT_SYSCALL_DEFINEx(x, name, ...)                                    \
+        __diag_push();                                                          \
+        __diag_ignore(GCC, 8, "-Wattribute-alias",                              \
+                      "Type aliasing is used to sanitize syscall arguments");\
        asmlinkage long compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__));       \
        asmlinkage long compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))        \
                __attribute__((alias(__stringify(__se_compat_sys##name))));     \
@@ -80,8 +83,11 @@
        asmlinkage long __se_compat_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__));  \
        asmlinkage long __se_compat_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__))   \
        {                                                                       \
-                return __do_compat_sys##name(__MAP(x,__SC_DELOUSE,__VA_ARGS__));\
+                long ret = __do_compat_sys##name(__MAP(x,__SC_DELOUSE,__VA_ARGS__));\
+                __MAP(x,__SC_TEST,__VA_ARGS__);                                 \
+                return ret;                                                     \
        }                                                                       \
+        __diag_pop();                                                           \
        static inline long __do_compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))
 #endif /* COMPAT_SYSCALL_DEFINEx */
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index f1a7492a5cc8..fd282c7d3e5e 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -347,3 +347,28 @@
 #if GCC_VERSION >= 50100
 #define COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW 1
 #endif
+/*
+ * Turn individual warnings and errors on and off locally, depending
+ * on version.
+ */
+#define __diag_GCC(version, severity, s) \
+        __diag_GCC_ ## version(__diag_GCC_ ## severity s)
+/* Severity used in pragma directives */
+#define __diag_GCC_ignore       ignored
+#define __diag_GCC_warn         warning
+#define __diag_GCC_error        error
+/* Compilers before gcc-4.6 do not understand "#pragma GCC diagnostic push" */
+#if GCC_VERSION >= 40600
+#define __diag_str1(s)          #s
+#define __diag_str(s)           __diag_str1(s)
+#define __diag(s)               _Pragma(__diag_str(GCC diagnostic s))
+#endif
+#if GCC_VERSION >= 80000
+#define __diag_GCC_8(s)         __diag(s)
+#else
+#define __diag_GCC_8(s)
+#endif
diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index 6b79a9bba9a7..a8ba6b04152c 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -271,4 +271,22 @@ struct ftrace_likely_data {
 # define __native_word(t) (sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long))
 #endif
+#ifndef __diag
+#define __diag(string)
+#endif
+#ifndef __diag_GCC
+#define __diag_GCC(version, severity, string)
+#endif
+#define __diag_push()   __diag(push)
+#define __diag_pop()    __diag(pop)
+#define __diag_ignore(compiler, version, option, comment) \
+        __diag_ ## compiler(version, ignore, option)
+#define __diag_warn(compiler, version, option, comment) \
+        __diag_ ## compiler(version, warn, option)
+#define __diag_error(compiler, version, option, comment) \
+        __diag_ ## compiler(version, error, option)
 #endif /* __LINUX_COMPILER_TYPES_H */
diff --git a/include/linux/dax.h b/include/linux/dax.h
index 3855e3800f48..deb0f663252f 100644
--- a/include/linux/dax.h
+++ b/include/linux/dax.h
@@ -135,7 +135,7 @@ void dax_flush(struct dax_device *dax_dev, void *addr, size_t size);
 ssize_t dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
                const struct iomap_ops *ops);
-int dax_iomap_fault(struct vm_fault *vmf, enum page_entry_size pe_size,
+vm_fault_t dax_iomap_fault(struct vm_fault *vmf, enum page_entry_size pe_size,
                    pfn_t *pfnp, int *errp, const struct iomap_ops *ops);
 vm_fault_t dax_finish_sync_fault(struct vm_fault *vmf,
                enum page_entry_size pe_size, pfn_t pfn);
diff --git a/include/linux/dma-contiguous.h b/include/linux/dma-contiguous.h
index b67bf6ac907d..3c5a4cb3eb95 100644
--- a/include/linux/dma-contiguous.h
+++ b/include/linux/dma-contiguous.h
@@ -48,7 +48,7 @@
 *   CMA should not be used by the device drivers directly. It is
 *   only a helper framework for dma-mapping subsystem.
 *
- *   For more information, see kernel-docs in drivers/base/dma-contiguous.c
+ *   For more information, see kernel-docs in kernel/dma/contiguous.c
 */
 #ifdef __KERNEL__
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 45fc0f5000d8..20f2659dd829 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -19,6 +19,7 @@
 #include <linux/cryptohash.h>
 #include <linux/set_memory.h>
 #include <linux/kallsyms.h>
+#include <linux/if_vlan.h>
 #include <net/sch_generic.h>
@@ -469,8 +470,11 @@ struct sock_fprog_kern {
 };
 struct bpf_binary_header {
-        unsigned int pages;
+        u16 pages;
-        u8 image[];
+        u16 locked:1;
+        /* Some arches need word alignment for their instructions */
+        u8 image[] __aligned(4);
 };
 struct bpf_prog {
@@ -671,15 +675,18 @@ bpf_ctx_narrow_access_ok(u32 off, u32 size, u32 size_default)
 #define bpf_classic_proglen(fprog) (fprog->len * sizeof(fprog->filter[0]))
-#ifdef CONFIG_ARCH_HAS_SET_MEMORY
 static inline void bpf_prog_lock_ro(struct bpf_prog *fp)
 {
+#ifdef CONFIG_ARCH_HAS_SET_MEMORY
        fp->locked = 1;
-        WARN_ON_ONCE(set_memory_ro((unsigned long)fp, fp->pages));
+        if (set_memory_ro((unsigned long)fp, fp->pages))
+                fp->locked = 0;
+#endif
 }
 static inline void bpf_prog_unlock_ro(struct bpf_prog *fp)
 {
+#ifdef CONFIG_ARCH_HAS_SET_MEMORY
        if (fp->locked) {
                WARN_ON_ONCE(set_memory_rw((unsigned long)fp, fp->pages));
                /* In case set_memory_rw() fails, we want to be the first
@@ -687,34 +694,30 @@ static inline void bpf_prog_unlock_ro(struct bpf_prog *fp)
                 */
                fp->locked = 0;
        }
+#endif
 }
 static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
 {
-        WARN_ON_ONCE(set_memory_ro((unsigned long)hdr, hdr->pages));
+#ifdef CONFIG_ARCH_HAS_SET_MEMORY
-}
+        hdr->locked = 1;
+        if (set_memory_ro((unsigned long)hdr, hdr->pages))
-static inline void bpf_jit_binary_unlock_ro(struct bpf_binary_header *hdr)
+                hdr->locked = 0;
-{
+#endif
-        WARN_ON_ONCE(set_memory_rw((unsigned long)hdr, hdr->pages));
-}
-#else
-static inline void bpf_prog_lock_ro(struct bpf_prog *fp)
-{
-}
-static inline void bpf_prog_unlock_ro(struct bpf_prog *fp)
-{
-}
-static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
-{
 }
 static inline void bpf_jit_binary_unlock_ro(struct bpf_binary_header *hdr)
 {
+#ifdef CONFIG_ARCH_HAS_SET_MEMORY
+        if (hdr->locked) {
+                WARN_ON_ONCE(set_memory_rw((unsigned long)hdr, hdr->pages));
+                /* In case set_memory_rw() fails, we want to be the first
+                 * to crash here instead of some random place later on.
+                 */
+                hdr->locked = 0;
+        }
+#endif
 }
-#endif /* CONFIG_ARCH_HAS_SET_MEMORY */
 static inline struct bpf_binary_header *
 bpf_jit_binary_hdr(const struct bpf_prog *fp)
@@ -725,6 +728,22 @@ bpf_jit_binary_hdr(const struct bpf_prog *fp)
        return (void *)addr;
 }
+#ifdef CONFIG_ARCH_HAS_SET_MEMORY
+static inline int bpf_prog_check_pages_ro_single(const struct bpf_prog *fp)
+{
+        if (!fp->locked)
+                return -ENOLCK;
+        if (fp->jited) {
+                const struct bpf_binary_header *hdr = bpf_jit_binary_hdr(fp);
+                if (!hdr->locked)
+                        return -ENOLCK;
+        }
+        return 0;
+}
+#endif
 int sk_filter_trim_cap(struct sock *sk, struct sk_buff *skb, unsigned int cap);
 static inline int sk_filter(struct sock *sk, struct sk_buff *skb)
 {
@@ -786,6 +805,21 @@ static inline bool bpf_dump_raw_ok(void)
 struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
                                       const struct bpf_insn *patch, u32 len);
+static inline int __xdp_generic_ok_fwd_dev(struct sk_buff *skb,
+                                           struct net_device *fwd)
+{
+        unsigned int len;
+        if (unlikely(!(fwd->flags & IFF_UP)))
+                return -ENETDOWN;
+        len = fwd->mtu + fwd->hard_header_len + VLAN_HLEN;
+        if (skb->len > len)
+                return -EMSGSIZE;
+        return 0;
+}
 /* The pair of xdp_do_redirect and xdp_do_flush_map MUST be called in the
 * same cpu context. Further for best results no more than a single map
 * for the do_redirect/do_flush pair should be used. This limitation is
@@ -961,6 +995,9 @@ static inline void bpf_prog_kallsyms_del(struct bpf_prog *fp)
 }
 #endif /* CONFIG_BPF_JIT */
+void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp);
+void bpf_prog_kallsyms_del_all(struct bpf_prog *fp);
 #define BPF_ANC         BIT(15)
 static inline bool bpf_needs_clear_a(const struct sock_filter *first)
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 5c91108846db..d78d146a98da 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1720,8 +1720,6 @@ struct file_operations {
        int (*iterate) (struct file *, struct dir_context *);
        int (*iterate_shared) (struct file *, struct dir_context *);
        __poll_t (*poll) (struct file *, struct poll_table_struct *);
-        struct wait_queue_head * (*get_poll_head)(struct file *, __poll_t);
-        __poll_t (*poll_mask) (struct file *, __poll_t);
        long (*unlocked_ioctl) (struct file *, unsigned int, unsigned long);
        long (*compat_ioctl) (struct file *, unsigned int, unsigned long);
        int (*mmap) (struct file *, struct vm_area_struct *);
diff --git a/include/linux/iio/buffer-dma.h b/include/linux/iio/buffer-dma.h
index 767467d886de..67c75372b691 100644
--- a/include/linux/iio/buffer-dma.h
+++ b/include/linux/iio/buffer-dma.h
@@ -141,7 +141,7 @@ int iio_dma_buffer_read(struct iio_buffer *buffer, size_t n,
        char __user *user_buffer);
 size_t iio_dma_buffer_data_available(struct iio_buffer *buffer);
 int iio_dma_buffer_set_bytes_per_datum(struct iio_buffer *buffer, size_t bpd);
-int iio_dma_buffer_set_length(struct iio_buffer *buffer, int length);
+int iio_dma_buffer_set_length(struct iio_buffer *buffer, unsigned int length);
 int iio_dma_buffer_request_update(struct iio_buffer *buffer);
 int iio_dma_buffer_init(struct iio_dma_buffer_queue *queue,
diff --git a/include/linux/input/mt.h b/include/linux/input/mt.h
index d7188de4db96..3f4bf60b0bb5 100644
--- a/include/linux/input/mt.h
+++ b/include/linux/input/mt.h
@@ -100,7 +100,7 @@ static inline bool input_is_mt_axis(int axis)
        return axis == ABS_MT_SLOT || input_is_mt_value(axis);
 }
-void input_mt_report_slot_state(struct input_dev *dev,
+bool input_mt_report_slot_state(struct input_dev *dev,
                                unsigned int tool_type, bool active);
 void input_mt_report_finger_count(struct input_dev *dev, int count);
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 4bd2f34947f4..201de12a9957 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -503,6 +503,7 @@ struct irq_chip {
 * IRQCHIP_SKIP_SET_WAKE:       Skip chip.irq_set_wake(), for this irq chip
 * IRQCHIP_ONESHOT_SAFE:        One shot does not require mask/unmask
 * IRQCHIP_EOI_THREADED:        Chip requires eoi() on unmask in threaded mode
+ * IRQCHIP_SUPPORTS_LEVEL_MSI   Chip can provide two doorbells for Level MSIs
 */
 enum {
        IRQCHIP_SET_TYPE_MASKED         = (1 <<  0),
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index 25b33b664537..dd1e40ddac7d 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -145,11 +145,6 @@ static inline void *irq_desc_get_handler_data(struct irq_desc *desc)
        return desc->irq_common_data.handler_data;
 }
-static inline struct msi_desc *irq_desc_get_msi_desc(struct irq_desc *desc)
-{
-        return desc->irq_common_data.msi_desc;
-}
 /*
 * Architectures call this to let the generic IRQ layer
 * handle an interrupt.
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index d23123238534..941dc0a5a877 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -666,7 +666,7 @@ do {									\
 * your code. (Extra memory is used for special buffers that are
 * allocated when trace_printk() is used.)
 *
- * A little optization trick is done here. If there's only one
+ * A little optimization trick is done here. If there's only one
 * argument, there's no need to scan the string for printf formats.
 * The trace_puts() will suffice. But how can we take advantage of
 * using trace_puts() when trace_printk() has only one argument?
diff --git a/include/linux/memory.h b/include/linux/memory.h
index 31ca3e28b0eb..a6ddefc60517 100644
--- a/include/linux/memory.h
+++ b/include/linux/memory.h
@@ -38,6 +38,7 @@ struct memory_block {
 int arch_get_memory_phys_device(unsigned long start_pfn);
 unsigned long memory_block_size_bytes(void);
+int set_memory_block_size_order(unsigned int order);
 /* These states are exposed to userspace as text strings in sysfs */
 #define MEM_ONLINE              (1<<0) /* exposed to userspace */
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index 2014bd19f28e..96a71a648eed 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -501,6 +501,7 @@ enum dmi_field {
        DMI_PRODUCT_VERSION,
        DMI_PRODUCT_SERIAL,
        DMI_PRODUCT_UUID,
+        DMI_PRODUCT_SKU,
        DMI_PRODUCT_FAMILY,
        DMI_BOARD_VENDOR,
        DMI_BOARD_NAME,
diff --git a/include/linux/net.h b/include/linux/net.h
index 08b6eb964dd6..6554d3ba4396 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -147,7 +147,6 @@ struct proto_ops {
        int             (*getname)   (struct socket *sock,
                                      struct sockaddr *addr,
                                      int peer);
-        __poll_t        (*poll_mask) (struct socket *sock, __poll_t events);
        __poll_t        (*poll)      (struct file *file, struct socket *sock,
                                      struct poll_table_struct *wait);
        int             (*ioctl)     (struct socket *sock, unsigned int cmd,
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 9dee3c23895d..712eed156d09 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1438,6 +1438,8 @@ enum {
        NFS_IOHDR_EOF,
        NFS_IOHDR_REDO,
        NFS_IOHDR_STAT,
+        NFS_IOHDR_RESEND_PNFS,
+        NFS_IOHDR_RESEND_MDS,
 };
 struct nfs_io_completion;
diff --git a/include/linux/platform_data/ti-sysc.h b/include/linux/platform_data/ti-sysc.h
index 990aad477458..2efa3470a451 100644
--- a/include/linux/platform_data/ti-sysc.h
+++ b/include/linux/platform_data/ti-sysc.h
@@ -14,6 +14,7 @@ enum ti_sysc_module_type {
        TI_SYSC_OMAP4_SR,
        TI_SYSC_OMAP4_MCASP,
        TI_SYSC_OMAP4_USB_HOST_FS,
+        TI_SYSC_DRA7_MCAN,
 };
 struct ti_sysc_cookie {
diff --git a/include/linux/pm_domain.h b/include/linux/pm_domain.h
index 9206a4fef9ac..cb8d84090cfb 100644
--- a/include/linux/pm_domain.h
+++ b/include/linux/pm_domain.h
@@ -234,7 +234,7 @@ struct generic_pm_domain *of_genpd_remove_last(struct device_node *np);
 int of_genpd_parse_idle_states(struct device_node *dn,
                               struct genpd_power_state **states, int *n);
 unsigned int of_genpd_opp_to_performance_state(struct device *dev,
-                                struct device_node *opp_node);
+                                struct device_node *np);
 int genpd_dev_pm_attach(struct device *dev);
 struct device *genpd_dev_pm_attach_by_id(struct device *dev,
@@ -274,9 +274,9 @@ static inline int of_genpd_parse_idle_states(struct device_node *dn,
 static inline unsigned int
 of_genpd_opp_to_performance_state(struct device *dev,
-                                  struct device_node *opp_node)
+                                  struct device_node *np)
 {
-        return -ENODEV;
+        return 0;
 }
 static inline int genpd_dev_pm_attach(struct device *dev)
diff --git a/include/linux/poll.h b/include/linux/poll.h
index fdf86b4cbc71..7e0fdcf905d2 100644
--- a/include/linux/poll.h
+++ b/include/linux/poll.h
@@ -74,18 +74,18 @@ static inline void init_poll_funcptr(poll_table *pt, poll_queue_proc qproc)
        pt->_key   = ~(__poll_t)0; /* all events enabled */
 }
-static inline bool file_has_poll_mask(struct file *file)
+static inline bool file_can_poll(struct file *file)
 {
-        return file->f_op->get_poll_head && file->f_op->poll_mask;
+        return file->f_op->poll;
 }
-static inline bool file_can_poll(struct file *file)
+static inline __poll_t vfs_poll(struct file *file, struct poll_table_struct *pt)
 {
-        return file->f_op->poll || file_has_poll_mask(file);
+        if (unlikely(!file->f_op->poll))
+                return DEFAULT_POLLMASK;
+        return file->f_op->poll(file, pt);
 }
-__poll_t vfs_poll(struct file *file, struct poll_table_struct *pt);
 struct poll_table_entry {
        struct file *filp;
        __poll_t key;
diff --git a/include/linux/refcount.h b/include/linux/refcount.h
index 4193c41e383a..a685da2c4522 100644
--- a/include/linux/refcount.h
+++ b/include/linux/refcount.h
@@ -98,5 +98,7 @@ extern __must_check bool refcount_dec_if_one(refcount_t *r);
 extern __must_check bool refcount_dec_not_one(refcount_t *r);
 extern __must_check bool refcount_dec_and_mutex_lock(refcount_t *r, struct mutex *lock);
 extern __must_check bool refcount_dec_and_lock(refcount_t *r, spinlock_t *lock);
+extern __must_check bool refcount_dec_and_lock_irqsave(refcount_t *r,
+                                                       spinlock_t *lock,
+                                                       unsigned long *flags);
 #endif /* _LINUX_REFCOUNT_H */
diff --git a/include/linux/rmi.h b/include/linux/rmi.h
index 64125443f8a6..5ef5c7c412a7 100644
--- a/include/linux/rmi.h
+++ b/include/linux/rmi.h
@@ -354,6 +354,8 @@ struct rmi_driver_data {
        struct mutex irq_mutex;
        struct input_dev *input;
+        struct irq_domain *irqdomain;
        u8 pdt_props;
        u8 num_rx_electrodes;
diff --git a/include/linux/scatterlist.h b/include/linux/scatterlist.h
index 51f52020ad5f..093aa57120b0 100644
--- a/include/linux/scatterlist.h
+++ b/include/linux/scatterlist.h
@@ -9,9 +9,6 @@
 #include <asm/io.h>
 struct scatterlist {
-#ifdef CONFIG_DEBUG_SG
-        unsigned long   sg_magic;
-#endif
        unsigned long   page_link;
        unsigned int    offset;
        unsigned int    length;
@@ -64,7 +61,6 @@ struct sg_table {
 *
 */
-#define SG_MAGIC        0x87654321
 #define SG_CHAIN        0x01UL
 #define SG_END          0x02UL
@@ -98,7 +94,6 @@ static inline void sg_assign_page(struct scatterlist *sg, struct page *page)
         */
        BUG_ON((unsigned long) page & (SG_CHAIN | SG_END));
 #ifdef CONFIG_DEBUG_SG
-        BUG_ON(sg->sg_magic != SG_MAGIC);
        BUG_ON(sg_is_chain(sg));
 #endif
        sg->page_link = page_link | (unsigned long) page;
@@ -129,7 +124,6 @@ static inline void sg_set_page(struct scatterlist *sg, struct page *page,
 static inline struct page *sg_page(struct scatterlist *sg)
 {
 #ifdef CONFIG_DEBUG_SG
-        BUG_ON(sg->sg_magic != SG_MAGIC);
        BUG_ON(sg_is_chain(sg));
 #endif
        return (struct page *)((sg)->page_link & ~(SG_CHAIN | SG_END));
@@ -195,9 +189,6 @@ static inline void sg_chain(struct scatterlist *prv, unsigned int prv_nents,
 **/
 static inline void sg_mark_end(struct scatterlist *sg)
 {
-#ifdef CONFIG_DEBUG_SG
-        BUG_ON(sg->sg_magic != SG_MAGIC);
-#endif
        /*
         * Set termination bit, clear potential chain bit
         */
@@ -215,9 +206,6 @@ static inline void sg_mark_end(struct scatterlist *sg)
 **/
 static inline void sg_unmark_end(struct scatterlist *sg)
 {
-#ifdef CONFIG_DEBUG_SG
-        BUG_ON(sg->sg_magic != SG_MAGIC);
-#endif
        sg->page_link &= ~SG_END;
 }
@@ -260,12 +248,6 @@ static inline void *sg_virt(struct scatterlist *sg)
 static inline void sg_init_marker(struct scatterlist *sgl,
                                  unsigned int nents)
 {
-#ifdef CONFIG_DEBUG_SG
-        unsigned int i;
-        for (i = 0; i < nents; i++)
-                sgl[i].sg_magic = SG_MAGIC;
-#endif
        sg_mark_end(&sgl[nents - 1]);
 }
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 87bf02d93a27..9256118bd40c 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1799,20 +1799,22 @@ static inline void rseq_set_notify_resume(struct task_struct *t)
                set_tsk_thread_flag(t, TIF_NOTIFY_RESUME);
 }
-void __rseq_handle_notify_resume(struct pt_regs *regs);
+void __rseq_handle_notify_resume(struct ksignal *sig, struct pt_regs *regs);
-static inline void rseq_handle_notify_resume(struct pt_regs *regs)
+static inline void rseq_handle_notify_resume(struct ksignal *ksig,
+                                             struct pt_regs *regs)
 {
        if (current->rseq)
-                __rseq_handle_notify_resume(regs);
+                __rseq_handle_notify_resume(ksig, regs);
 }
-static inline void rseq_signal_deliver(struct pt_regs *regs)
+static inline void rseq_signal_deliver(struct ksignal *ksig,
+                                       struct pt_regs *regs)
 {
        preempt_disable();
        __set_bit(RSEQ_EVENT_SIGNAL_BIT, &current->rseq_event_mask);
        preempt_enable();
-        rseq_handle_notify_resume(regs);
+        rseq_handle_notify_resume(ksig, regs);
 }
 /* rseq_preempt() requires preemption to be disabled. */
@@ -1831,9 +1833,7 @@ static inline void rseq_migrate(struct task_struct *t)
 /*
 * If parent process has a registered restartable sequences area, the
- * child inherits. Only applies when forking a process, not a thread. In
+ * child inherits. Only applies when forking a process, not a thread.
- * case a parent fork() in the middle of a restartable sequence, set the
- * resume notifier to force the child to retry.
 */
 static inline void rseq_fork(struct task_struct *t, unsigned long clone_flags)
 {
@@ -1847,7 +1847,6 @@ static inline void rseq_fork(struct task_struct *t, unsigned long clone_flags)
                t->rseq_len = current->rseq_len;
                t->rseq_sig = current->rseq_sig;
                t->rseq_event_mask = current->rseq_event_mask;
-                rseq_preempt(t);
        }
 }
@@ -1864,10 +1863,12 @@ static inline void rseq_execve(struct task_struct *t)
 static inline void rseq_set_notify_resume(struct task_struct *t)
 {
 }
-static inline void rseq_handle_notify_resume(struct pt_regs *regs)
+static inline void rseq_handle_notify_resume(struct ksignal *ksig,
+                                             struct pt_regs *regs)
 {
 }
-static inline void rseq_signal_deliver(struct pt_regs *regs)
+static inline void rseq_signal_deliver(struct ksignal *ksig,
+                                       struct pt_regs *regs)
 {
 }
 static inline void rseq_preempt(struct task_struct *t)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index c86885954994..164cdedf6012 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3252,7 +3252,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
                                    int *peeked, int *off, int *err);
 struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags, int noblock,
                                  int *err);
-__poll_t datagram_poll_mask(struct socket *sock, __poll_t events);
+__poll_t datagram_poll(struct file *file, struct socket *sock,
+                           struct poll_table_struct *wait);
 int skb_copy_datagram_iter(const struct sk_buff *from, int offset,
                           struct iov_iter *to, int size);
 static inline int skb_copy_datagram_msg(const struct sk_buff *from, int offset,
diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
index 09fa2c6f0e68..3a1a1dbc6f49 100644
--- a/include/linux/slub_def.h
+++ b/include/linux/slub_def.h
@@ -155,8 +155,12 @@ struct kmem_cache {
 #ifdef CONFIG_SYSFS
 #define SLAB_SUPPORTS_SYSFS
+void sysfs_slab_unlink(struct kmem_cache *);
 void sysfs_slab_release(struct kmem_cache *);
 #else
+static inline void sysfs_slab_unlink(struct kmem_cache *s)
+{
+}
 static inline void sysfs_slab_release(struct kmem_cache *s)
 {
 }
diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h
index 1e8a46435838..fd57888d4942 100644
--- a/include/linux/spinlock.h
+++ b/include/linux/spinlock.h
@@ -427,6 +427,11 @@ extern int _atomic_dec_and_lock(atomic_t *atomic, spinlock_t *lock);
 #define atomic_dec_and_lock(atomic, lock) \
                __cond_lock(lock, _atomic_dec_and_lock(atomic, lock))
+extern int _atomic_dec_and_lock_irqsave(atomic_t *atomic, spinlock_t *lock,
+                                        unsigned long *flags);
+#define atomic_dec_and_lock_irqsave(atomic, lock, flags) \
+                __cond_lock(lock, _atomic_dec_and_lock_irqsave(atomic, lock, &(flags)))
 int alloc_bucket_spinlocks(spinlock_t **locks, unsigned int *lock_mask,
                           size_t max_size, unsigned int cpu_mult,
                           gfp_t gfp);
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 73810808cdf2..a368a68cb667 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -231,6 +231,9 @@ static inline int is_syscall_trace_event(struct trace_event_call *tp_event)
 */
 #ifndef __SYSCALL_DEFINEx
 #define __SYSCALL_DEFINEx(x, name, ...)                                 \
+        __diag_push();                                                  \
+        __diag_ignore(GCC, 8, "-Wattribute-alias",                      \
+                      "Type aliasing is used to sanitize syscall arguments");\
        asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))       \
                __attribute__((alias(__stringify(__se_sys##name))));    \
        ALLOW_ERROR_INJECTION(sys##name, ERRNO);                        \
@@ -243,6 +246,7 @@ static inline int is_syscall_trace_event(struct trace_event_call *tp_event)
                __PROTECT(x, ret,__MAP(x,__SC_ARGS,__VA_ARGS__));       \
                return ret;                                             \
        }                                                               \
+        __diag_pop();                                                   \
        static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))
 #endif /* __SYSCALL_DEFINEx */
diff --git a/include/linux/wkup_m3_ipc.h b/include/linux/wkup_m3_ipc.h
index d6ba7d39a62f..e497e621dbb7 100644
--- a/include/linux/wkup_m3_ipc.h
+++ b/include/linux/wkup_m3_ipc.h
@@ -40,6 +40,12 @@ struct wkup_m3_ipc {
        struct mbox_chan *mbox;
        struct wkup_m3_ipc_ops *ops;
+        int is_rtc_only;
+};
+struct wkup_m3_wakeup_src {
+        int irq_nr;
+        char src[10];
 };
 struct wkup_m3_ipc_ops {
@@ -48,8 +54,11 @@ struct wkup_m3_ipc_ops {
        int (*prepare_low_power)(struct wkup_m3_ipc *m3_ipc, int state);
        int (*finish_low_power)(struct wkup_m3_ipc *m3_ipc);
        int (*request_pm_status)(struct wkup_m3_ipc *m3_ipc);
+        const char *(*request_wake_src)(struct wkup_m3_ipc *m3_ipc);
+        void (*set_rtc_only)(struct wkup_m3_ipc *m3_ipc);
 };
 struct wkup_m3_ipc *wkup_m3_ipc_get(void);
 void wkup_m3_ipc_put(struct wkup_m3_ipc *m3_ipc);
+void wkup_m3_set_rtc_only_mode(void);
 #endif /* _LINUX_WKUP_M3_IPC_H */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 53ce8176c313..ec9d6bc65855 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -271,7 +271,7 @@ int  bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                     int flags);
 int  bt_sock_stream_recvmsg(struct socket *sock, struct msghdr *msg,
                            size_t len, int flags);
-__poll_t bt_sock_poll_mask(struct socket *sock, __poll_t events);
+__poll_t bt_sock_poll(struct file *file, struct socket *sock, poll_table *wait);
 int  bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int  bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo);
 int  bt_sock_wait_ready(struct sock *sk, unsigned long flags);
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 5cba71d2dc44..71b9043aa0e7 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -170,6 +170,7 @@ struct fib6_info {
                                        unused:3;
        struct fib6_nh                  fib6_nh;
+        struct rcu_head                 rcu;
 };
 struct rt6_info {
@@ -273,7 +274,7 @@ static inline void ip6_rt_put(struct rt6_info *rt)
 }
 struct fib6_info *fib6_info_alloc(gfp_t gfp_flags);
-void fib6_info_destroy(struct fib6_info *f6i);
+void fib6_info_destroy_rcu(struct rcu_head *head);
 static inline void fib6_info_hold(struct fib6_info *f6i)
 {
@@ -283,7 +284,7 @@ static inline void fib6_info_hold(struct fib6_info *f6i)
 static inline void fib6_info_release(struct fib6_info *f6i)
 {
        if (f6i && atomic_dec_and_test(&f6i->fib6_ref))
-                fib6_info_destroy(f6i);
+                call_rcu(&f6i->rcu, fib6_info_destroy_rcu);
 }
 enum fib6_walk_state {
diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
index b0eaeb02d46d..f4c21b5a1242 100644
--- a/include/net/iucv/af_iucv.h
+++ b/include/net/iucv/af_iucv.h
@@ -153,6 +153,8 @@ struct iucv_sock_list {
        atomic_t          autobind_name;
 };
+__poll_t iucv_sock_poll(struct file *file, struct socket *sock,
+                            poll_table *wait);
 void iucv_sock_link(struct iucv_sock_list *l, struct sock *s);
 void iucv_sock_unlink(struct iucv_sock_list *l, struct sock *s);
 void iucv_accept_enqueue(struct sock *parent, struct sock *sk);
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 30b3e2fe240a..8c2caa370e0f 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -109,7 +109,8 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb);
 int sctp_inet_listen(struct socket *sock, int backlog);
 void sctp_write_space(struct sock *sk);
 void sctp_data_ready(struct sock *sk);
-__poll_t sctp_poll_mask(struct socket *sock, __poll_t events);
+__poll_t sctp_poll(struct file *file, struct socket *sock,
+                poll_table *wait);
 void sctp_sock_rfree(struct sk_buff *skb);
 void sctp_copy_sock(struct sock *newsk, struct sock *sk,
                    struct sctp_association *asoc);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 0448e7c5d2b4..800582b5dd54 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -388,7 +388,8 @@ bool tcp_peer_is_proven(struct request_sock *req, struct dst_entry *dst);
 void tcp_close(struct sock *sk, long timeout);
 void tcp_init_sock(struct sock *sk);
 void tcp_init_transfer(struct sock *sk, int bpf_op);
-__poll_t tcp_poll_mask(struct socket *sock, __poll_t events);
+__poll_t tcp_poll(struct file *file, struct socket *sock,
+                      struct poll_table_struct *wait);
 int tcp_getsockopt(struct sock *sk, int level, int optname,
                   char __user *optval, int __user *optlen);
 int tcp_setsockopt(struct sock *sk, int level, int optname,
diff --git a/include/net/tls.h b/include/net/tls.h
index 7f84ea3e217c..70c273777fe9 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -109,7 +109,8 @@ struct tls_sw_context_rx {
        struct strparser strp;
        void (*saved_data_ready)(struct sock *sk);
-        __poll_t (*sk_poll_mask)(struct socket *sock, __poll_t events);
+        unsigned int (*sk_poll)(struct file *file, struct socket *sock,
+                                struct poll_table_struct *wait);
        struct sk_buff *recv_pkt;
        u8 control;
        bool decrypted;
@@ -224,7 +225,8 @@ void tls_sw_free_resources_tx(struct sock *sk);
 void tls_sw_free_resources_rx(struct sock *sk);
 int tls_sw_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                   int nonblock, int flags, int *addr_len);
-__poll_t tls_sw_poll_mask(struct socket *sock, __poll_t events);
+unsigned int tls_sw_poll(struct file *file, struct socket *sock,
+                         struct poll_table_struct *wait);
 ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,
                           struct pipe_inode_info *pipe,
                           size_t len, unsigned int flags);
diff --git a/include/net/udp.h b/include/net/udp.h
index b1ea8b0f5e6a..81afdacd4fff 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -285,7 +285,7 @@ int udp_init_sock(struct sock *sk);
 int udp_pre_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len);
 int __udp_disconnect(struct sock *sk, int flags);
 int udp_disconnect(struct sock *sk, int flags);
-__poll_t udp_poll_mask(struct socket *sock, __poll_t events);
+__poll_t udp_poll(struct file *file, struct socket *sock, poll_table *wait);
 struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
                                       netdev_features_t features,
                                       bool is_ipv6);
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 4c6241bc2039..6c003995347a 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -3391,11 +3391,14 @@ int ib_process_cq_direct(struct ib_cq *cq, int budget);
 *
 * Users can examine the cq structure to determine the actual CQ size.
 */
-struct ib_cq *ib_create_cq(struct ib_device *device,
+struct ib_cq *__ib_create_cq(struct ib_device *device,
-                           ib_comp_handler comp_handler,
+                             ib_comp_handler comp_handler,
-                           void (*event_handler)(struct ib_event *, void *),
+                             void (*event_handler)(struct ib_event *, void *),
-                           void *cq_context,
+                             void *cq_context,
-                           const struct ib_cq_init_attr *cq_attr);
+                             const struct ib_cq_init_attr *cq_attr,
+                             const char *caller);
+#define ib_create_cq(device, cmp_hndlr, evt_hndlr, cq_ctxt, cq_attr) \
+        __ib_create_cq((device), (cmp_hndlr), (evt_hndlr), (cq_ctxt), (cq_attr), KBUILD_MODNAME)
 /**
 * ib_resize_cq - Modifies the capacity of the CQ.
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 8ee8991aa099..c4a5c9e9fb47 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -75,6 +75,7 @@ enum rpi_firmware_property_tag {
        RPI_FIRMWARE_GET_EDID_BLOCK =                         0x00030020,
        RPI_FIRMWARE_GET_CUSTOMER_OTP =                       0x00030021,
        RPI_FIRMWARE_GET_DOMAIN_STATE =                       0x00030030,
+        RPI_FIRMWARE_GET_THROTTLED =                          0x00030046,
        RPI_FIRMWARE_SET_CLOCK_STATE =                        0x00038001,
        RPI_FIRMWARE_SET_CLOCK_RATE =                         0x00038002,
        RPI_FIRMWARE_SET_VOLTAGE =                            0x00038003,
diff --git a/include/uapi/linux/aio_abi.h b/include/uapi/linux/aio_abi.h
index d00221345c19..3c5038b587ba 100644
--- a/include/uapi/linux/aio_abi.h
+++ b/include/uapi/linux/aio_abi.h
@@ -39,8 +39,10 @@ enum {
        IOCB_CMD_PWRITE = 1,
        IOCB_CMD_FSYNC = 2,
        IOCB_CMD_FDSYNC = 3,
-        /* 4 was the experimental IOCB_CMD_PREADX */
+        /* These two are experimental.
-        IOCB_CMD_POLL = 5,
+         * IOCB_CMD_PREADX = 4,
+         * IOCB_CMD_POLL = 5,
+         */
        IOCB_CMD_NOOP = 6,
        IOCB_CMD_PREADV = 7,
        IOCB_CMD_PWRITEV = 8,
diff --git a/include/uapi/linux/nbd.h b/include/uapi/linux/nbd.h
index 85a3fb65e40a..20d6cc91435d 100644
--- a/include/uapi/linux/nbd.h
+++ b/include/uapi/linux/nbd.h
@@ -53,6 +53,9 @@ enum {
 /* These are client behavior specific flags. */
 #define NBD_CFLAG_DESTROY_ON_DISCONNECT (1 << 0) /* delete the nbd device on
                                                    disconnect. */
+#define NBD_CFLAG_DISCONNECT_ON_CLOSE (1 << 1) /* disconnect the nbd device on
+                                                *  close by last opener.
+                                                */
 /* userspace doesn't need the nbd_device structure */
diff --git a/include/uapi/linux/target_core_user.h b/include/uapi/linux/target_core_user.h
index 6e299349b158..b7b57967d90f 100644
--- a/include/uapi/linux/target_core_user.h
+++ b/include/uapi/linux/target_core_user.h
@@ -44,6 +44,7 @@
 #define TCMU_MAILBOX_VERSION 2
 #define ALIGN_SIZE 64 /* Should be enough for most CPUs */
 #define TCMU_MAILBOX_FLAG_CAP_OOOC (1 << 0) /* Out-of-order completions */
+#define TCMU_MAILBOX_FLAG_CAP_READ_LEN (1 << 1) /* Read data length */
 struct tcmu_mailbox {
        __u16 version;
@@ -71,6 +72,7 @@ struct tcmu_cmd_entry_hdr {
        __u16 cmd_id;
        __u8 kflags;
 #define TCMU_UFLAG_UNKNOWN_OP 0x1
+#define TCMU_UFLAG_READ_LEN   0x2
        __u8 uflags;
 } __packed;
@@ -119,7 +121,7 @@ struct tcmu_cmd_entry {
                        __u8 scsi_status;
                        __u8 __pad1;
                        __u16 __pad2;
-                        __u32 __pad3;
+                        __u32 read_len;
                        char sense_buffer[TCMU_SENSE_BUFFERSIZE];
                } rsp;
        };
diff --git a/include/xen/xen.h b/include/xen/xen.h
index 9d4340c907d1..1e1d9bd0bd37 100644
--- a/include/xen/xen.h
+++ b/include/xen/xen.h
@@ -25,12 +25,16 @@ extern bool xen_pvh;
 #define xen_hvm_domain()        (xen_domain_type == XEN_HVM_DOMAIN)
 #define xen_pvh_domain()        (xen_pvh)
+#include <linux/types.h>
+extern uint32_t xen_start_flags;
 #ifdef CONFIG_XEN_DOM0
 #include <xen/interface/xen.h>
 #include <asm/xen/hypervisor.h>
 #define xen_initial_domain()    (xen_domain() && \
-                                 xen_start_info && xen_start_info->flags & SIF_INITDOMAIN)
+                                 (xen_start_flags & SIF_INITDOMAIN))
 #else  /* !CONFIG_XEN_DOM0 */
 #define xen_initial_domain()    (0)
 #endif  /* CONFIG_XEN_DOM0 */
diff --git a/init/Kconfig b/init/Kconfig
index 5a52f07259a2..041f3a022122 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1051,10 +1051,9 @@ config LD_DEAD_CODE_DATA_ELIMINATION
        depends on HAVE_LD_DEAD_CODE_DATA_ELIMINATION
        depends on EXPERT
        help
-          Select this if the architecture wants to do dead code and
+          Enable this if you want to do dead code and data elimination with
-          data elimination with the linker by compiling with
+          the linker by compiling with -ffunction-sections -fdata-sections,
-          -ffunction-sections -fdata-sections, and linking with
+          and linking with --gc-sections.
-          --gc-sections.
          This can reduce on disk and in-memory size of the kernel
          code and static data, particularly for small configs and
@@ -1719,10 +1718,6 @@ source "arch/Kconfig"
 endmenu         # General setup
-config HAVE_GENERIC_DMA_COHERENT
-        bool
-        default n
 config RT_MUTEXES
        bool
diff --git a/kernel/Makefile b/kernel/Makefile
index d2001624fe7a..04bc07c2b42a 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -41,6 +41,7 @@ obj-y += printk/
 obj-y += irq/
 obj-y += rcu/
 obj-y += livepatch/
+obj-y += dma/
 obj-$(CONFIG_CHECKPOINT_RESTORE) += kcmp.o
 obj-$(CONFIG_FREEZER) += freezer.o
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 9f1493705f40..a9e6c04d0f4a 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -350,6 +350,20 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
        return prog_adj;
 }
+void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp)
+{
+        int i;
+        for (i = 0; i < fp->aux->func_cnt; i++)
+                bpf_prog_kallsyms_del(fp->aux->func[i]);
+}
+void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
+{
+        bpf_prog_kallsyms_del_subprogs(fp);
+        bpf_prog_kallsyms_del(fp);
+}
 #ifdef CONFIG_BPF_JIT
 /* All BPF JIT sysctl knobs here. */
 int bpf_jit_enable   __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON);
@@ -584,6 +598,8 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,
        bpf_fill_ill_insns(hdr, size);
        hdr->pages = size / PAGE_SIZE;
+        hdr->locked = 0;
        hole = min_t(unsigned int, size - (proglen + sizeof(*hdr)),
                     PAGE_SIZE - sizeof(*hdr));
        start = (get_random_int() % hole) & ~(alignment - 1);
@@ -1434,6 +1450,33 @@ static int bpf_check_tail_call(const struct bpf_prog *fp)
        return 0;
 }
+static int bpf_prog_check_pages_ro_locked(const struct bpf_prog *fp)
+{
+#ifdef CONFIG_ARCH_HAS_SET_MEMORY
+        int i, err;
+        for (i = 0; i < fp->aux->func_cnt; i++) {
+                err = bpf_prog_check_pages_ro_single(fp->aux->func[i]);
+                if (err)
+                        return err;
+        }
+        return bpf_prog_check_pages_ro_single(fp);
+#endif
+        return 0;
+}
+static void bpf_prog_select_func(struct bpf_prog *fp)
+{
+#ifndef CONFIG_BPF_JIT_ALWAYS_ON
+        u32 stack_depth = max_t(u32, fp->aux->stack_depth, 1);
+        fp->bpf_func = interpreters[(round_up(stack_depth, 32) / 32) - 1];
+#else
+        fp->bpf_func = __bpf_prog_ret0_warn;
+#endif
+}
 /**
 *      bpf_prog_select_runtime - select exec runtime for BPF program
 *      @fp: bpf_prog populated with internal BPF program
@@ -1444,13 +1487,13 @@ static int bpf_check_tail_call(const struct bpf_prog *fp)
 */
 struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err)
 {
-#ifndef CONFIG_BPF_JIT_ALWAYS_ON
+        /* In case of BPF to BPF calls, verifier did all the prep
-        u32 stack_depth = max_t(u32, fp->aux->stack_depth, 1);
+         * work with regards to JITing, etc.
+         */
+        if (fp->bpf_func)
+                goto finalize;
-        fp->bpf_func = interpreters[(round_up(stack_depth, 32) / 32) - 1];
+        bpf_prog_select_func(fp);
-#else
-        fp->bpf_func = __bpf_prog_ret0_warn;
-#endif
        /* eBPF JITs can rewrite the program in case constant
         * blinding is active. However, in case of error during
@@ -1471,6 +1514,8 @@ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err)
                if (*err)
                        return fp;
        }
+finalize:
        bpf_prog_lock_ro(fp);
        /* The tail call compatibility check can only be done at
@@ -1479,7 +1524,17 @@ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err)
         * all eBPF JITs might immediately support all features.
         */
        *err = bpf_check_tail_call(fp);
+        if (*err)
+                return fp;
+        /* Checkpoint: at this point onwards any cBPF -> eBPF or
+         * native eBPF program is read-only. If we failed to change
+         * the page attributes (e.g. allocation failure from
+         * splitting large pages), then reject the whole program
+         * in order to guarantee not ending up with any W+X pages
+         * from BPF side in kernel.
+         */
+        *err = bpf_prog_check_pages_ro_locked(fp);
        return fp;
 }
 EXPORT_SYMBOL_GPL(bpf_prog_select_runtime);
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index a7cc7b3494a9..642c97f6d1b8 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -345,6 +345,20 @@ int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_buff *xdp,
        return bq_enqueue(dst, xdpf, dev_rx);
 }
+int dev_map_generic_redirect(struct bpf_dtab_netdev *dst, struct sk_buff *skb,
+                             struct bpf_prog *xdp_prog)
+{
+        int err;
+        err = __xdp_generic_ok_fwd_dev(skb, dst->dev);
+        if (unlikely(err))
+                return err;
+        skb->dev = dst->dev;
+        generic_xdp_tx(skb, xdp_prog);
+        return 0;
+}
 static void *dev_map_lookup_elem(struct bpf_map *map, void *key)
 {
        struct bpf_dtab_netdev *obj = __dev_map_lookup_elem(map, *(u32 *)key);
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 0fa20624707f..35dc466641f2 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1034,14 +1034,9 @@ static void __bpf_prog_put_rcu(struct rcu_head *rcu)
 static void __bpf_prog_put(struct bpf_prog *prog, bool do_idr_lock)
 {
        if (atomic_dec_and_test(&prog->aux->refcnt)) {
-                int i;
                /* bpf_prog_free_id() must be called first */
                bpf_prog_free_id(prog, do_idr_lock);
+                bpf_prog_kallsyms_del_all(prog);
-                for (i = 0; i < prog->aux->func_cnt; i++)
-                        bpf_prog_kallsyms_del(prog->aux->func[i]);
-                bpf_prog_kallsyms_del(prog);
                call_rcu(&prog->aux->rcu, __bpf_prog_put_rcu);
        }
@@ -1358,9 +1353,7 @@ static int bpf_prog_load(union bpf_attr *attr)
        if (err < 0)
                goto free_used_maps;
-        /* eBPF program is ready to be JITed */
+        prog = bpf_prog_select_runtime(prog, &err);
-        if (!prog->bpf_func)
-                prog = bpf_prog_select_runtime(prog, &err);
        if (err < 0)
                goto free_used_maps;
@@ -1384,6 +1377,7 @@ static int bpf_prog_load(union bpf_attr *attr)
        return err;
 free_used_maps:
+        bpf_prog_kallsyms_del_subprogs(prog);
        free_used_maps(prog->aux);
 free_prog:
        bpf_prog_uncharge_memlock(prog);
diff --git a/kernel/dma/Kconfig b/kernel/dma/Kconfig
new file mode 100644
index 000000000000..9bd54304446f
--- /dev/null
+++ b/kernel/dma/Kconfig
@@ -0,0 +1,50 @@
+config HAS_DMA
+        bool
+        depends on !NO_DMA
+        default y
+config NEED_SG_DMA_LENGTH
+        bool
+config NEED_DMA_MAP_STATE
+        bool
+config ARCH_DMA_ADDR_T_64BIT
+        def_bool 64BIT || PHYS_ADDR_T_64BIT
+config HAVE_GENERIC_DMA_COHERENT
+        bool
+config ARCH_HAS_SYNC_DMA_FOR_DEVICE
+        bool
+config ARCH_HAS_SYNC_DMA_FOR_CPU
+        bool
+        select NEED_DMA_MAP_STATE
+config DMA_DIRECT_OPS
+        bool
+        depends on HAS_DMA
+config DMA_NONCOHERENT_OPS
+        bool
+        depends on HAS_DMA
+        select DMA_DIRECT_OPS
+config DMA_NONCOHERENT_MMAP
+        bool
+        depends on DMA_NONCOHERENT_OPS
+config DMA_NONCOHERENT_CACHE_SYNC
+        bool
+        depends on DMA_NONCOHERENT_OPS
+config DMA_VIRT_OPS
+        bool
+        depends on HAS_DMA
+config SWIOTLB
+        bool
+        select DMA_DIRECT_OPS
+        select NEED_DMA_MAP_STATE
diff --git a/kernel/dma/Makefile b/kernel/dma/Makefile
new file mode 100644
index 000000000000..6de44e4eb454
--- /dev/null
+++ b/kernel/dma/Makefile
@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: GPL-2.0
+obj-$(CONFIG_HAS_DMA)                   += mapping.o
+obj-$(CONFIG_DMA_CMA)                   += contiguous.o
+obj-$(CONFIG_HAVE_GENERIC_DMA_COHERENT) += coherent.o
+obj-$(CONFIG_DMA_DIRECT_OPS)            += direct.o
+obj-$(CONFIG_DMA_NONCOHERENT_OPS)       += noncoherent.o
+obj-$(CONFIG_DMA_VIRT_OPS)              += virt.o
+obj-$(CONFIG_DMA_API_DEBUG)             += debug.o
+obj-$(CONFIG_SWIOTLB)                   += swiotlb.o
diff --git a/drivers/base/dma-coherent.c b/kernel/dma/coherent.c
index 597d40893862..597d40893862 100644
--- a/drivers/base/dma-coherent.c
+++ b/kernel/dma/coherent.c
diff --git a/drivers/base/dma-contiguous.c b/kernel/dma/contiguous.c
index d987dcd1bd56..d987dcd1bd56 100644
--- a/drivers/base/dma-contiguous.c
+++ b/kernel/dma/contiguous.c
diff --git a/lib/dma-debug.c b/kernel/dma/debug.c
index c007d25bee09..c007d25bee09 100644
--- a/lib/dma-debug.c
+++ b/kernel/dma/debug.c
diff --git a/lib/dma-direct.c b/kernel/dma/direct.c
index 8be8106270c2..8be8106270c2 100644
--- a/lib/dma-direct.c
+++ b/kernel/dma/direct.c
diff --git a/drivers/base/dma-mapping.c b/kernel/dma/mapping.c
index f831a582209c..d2a92ddaac4d 100644
--- a/drivers/base/dma-mapping.c
+++ b/kernel/dma/mapping.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * drivers/base/dma-mapping.c - arch-independent dma-mapping routines
+ * arch-independent dma-mapping routines
 *
 * Copyright (c) 2006  SUSE Linux Products GmbH
 * Copyright (c) 2006  Tejun Heo <teheo@suse.de>
diff --git a/lib/dma-noncoherent.c b/kernel/dma/noncoherent.c
index 79e9a757387f..79e9a757387f 100644
--- a/lib/dma-noncoherent.c
+++ b/kernel/dma/noncoherent.c
diff --git a/lib/swiotlb.c b/kernel/dma/swiotlb.c
index 04b68d9dffac..904541055792 100644
--- a/lib/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -1085,3 +1085,4 @@ const struct dma_map_ops swiotlb_dma_ops = {
        .unmap_page             = swiotlb_unmap_page,
        .dma_supported          = dma_direct_supported,
 };
+EXPORT_SYMBOL(swiotlb_dma_ops);
diff --git a/lib/dma-virt.c b/kernel/dma/virt.c
index 8e61a02ef9ca..631ddec4b60a 100644
--- a/lib/dma-virt.c
+++ b/kernel/dma/virt.c
@@ -1,7 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- *      lib/dma-virt.c
- *
 * DMA operations that map to virtual addresses without flushing memory.
 */
 #include <linux/export.h>
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 80cca2b30c4f..8f0434a9951a 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6482,7 +6482,7 @@ void perf_prepare_sample(struct perf_event_header *header,
                data->phys_addr = perf_virt_to_phys(data->addr);
 }
-static void __always_inline
+static __always_inline void
 __perf_event_output(struct perf_event *event,
                    struct perf_sample_data *data,
                    struct pt_regs *regs,
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 045a37e9ddee..5d3cf407e374 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -103,7 +103,7 @@ out:
        preempt_enable();
 }
-static bool __always_inline
+static __always_inline bool
 ring_buffer_has_space(unsigned long head, unsigned long tail,
                      unsigned long data_size, unsigned int size,
                      bool backward)
@@ -114,7 +114,7 @@ ring_buffer_has_space(unsigned long head, unsigned long tail,
                return CIRC_SPACE(tail, head, data_size) >= size;
 }
-static int __always_inline
+static __always_inline int
 __perf_output_begin(struct perf_output_handle *handle,
                    struct perf_event *event, unsigned int size,
                    bool backward)
@@ -414,7 +414,7 @@ err:
 }
 EXPORT_SYMBOL_GPL(perf_aux_output_begin);
-static bool __always_inline rb_need_aux_wakeup(struct ring_buffer *rb)
+static __always_inline bool rb_need_aux_wakeup(struct ring_buffer *rb)
 {
        if (rb->aux_overwrite)
                return false;
diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c
index 4dadeb3d6666..6f636136cccc 100644
--- a/kernel/irq/debugfs.c
+++ b/kernel/irq/debugfs.c
@@ -55,6 +55,7 @@ static const struct irq_bit_descr irqchip_flags[] = {
        BIT_MASK_DESCR(IRQCHIP_SKIP_SET_WAKE),
        BIT_MASK_DESCR(IRQCHIP_ONESHOT_SAFE),
        BIT_MASK_DESCR(IRQCHIP_EOI_THREADED),
+        BIT_MASK_DESCR(IRQCHIP_SUPPORTS_LEVEL_MSI),
 };
 static void
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index edcac5de7ebc..5fa4d3138bf1 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -1265,11 +1265,11 @@ unsigned long lockdep_count_forward_deps(struct lock_class *class)
        this.parent = NULL;
        this.class = class;
-        local_irq_save(flags);
+        raw_local_irq_save(flags);
        arch_spin_lock(&lockdep_lock);
        ret = __lockdep_count_forward_deps(&this);
        arch_spin_unlock(&lockdep_lock);
-        local_irq_restore(flags);
+        raw_local_irq_restore(flags);
        return ret;
 }
@@ -1292,11 +1292,11 @@ unsigned long lockdep_count_backward_deps(struct lock_class *class)
        this.parent = NULL;
        this.class = class;
-        local_irq_save(flags);
+        raw_local_irq_save(flags);
        arch_spin_lock(&lockdep_lock);
        ret = __lockdep_count_backward_deps(&this);
        arch_spin_unlock(&lockdep_lock);
-        local_irq_restore(flags);
+        raw_local_irq_restore(flags);
        return ret;
 }
@@ -4411,7 +4411,7 @@ void debug_check_no_locks_freed(const void *mem_from, unsigned long mem_len)
        if (unlikely(!debug_locks))
                return;
-        local_irq_save(flags);
+        raw_local_irq_save(flags);
        for (i = 0; i < curr->lockdep_depth; i++) {
                hlock = curr->held_locks + i;
@@ -4422,7 +4422,7 @@ void debug_check_no_locks_freed(const void *mem_from, unsigned long mem_len)
                print_freed_lock_bug(curr, mem_from, mem_from + mem_len, hlock);
                break;
        }
-        local_irq_restore(flags);
+        raw_local_irq_restore(flags);
 }
 EXPORT_SYMBOL_GPL(debug_check_no_locks_freed);
diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c
index bc1e507be9ff..776308d2fa9e 100644
--- a/kernel/locking/rwsem.c
+++ b/kernel/locking/rwsem.c
@@ -181,6 +181,7 @@ void down_read_non_owner(struct rw_semaphore *sem)
        might_sleep();
        __down_read(sem);
+        rwsem_set_reader_owned(sem);
 }
 EXPORT_SYMBOL(down_read_non_owner);
diff --git a/kernel/rseq.c b/kernel/rseq.c
index ae306f90c514..22b6acf1ad63 100644
--- a/kernel/rseq.c
+++ b/kernel/rseq.c
@@ -251,10 +251,10 @@ static int rseq_ip_fixup(struct pt_regs *regs)
 * respect to other threads scheduled on the same CPU, and with respect
 * to signal handlers.
 */
-void __rseq_handle_notify_resume(struct pt_regs *regs)
+void __rseq_handle_notify_resume(struct ksignal *ksig, struct pt_regs *regs)
 {
        struct task_struct *t = current;
-        int ret;
+        int ret, sig;
        if (unlikely(t->flags & PF_EXITING))
                return;
@@ -268,7 +268,8 @@ void __rseq_handle_notify_resume(struct pt_regs *regs)
        return;
 error:
-        force_sig(SIGSEGV, t);
+        sig = ksig ? ksig->sig : 0;
+        force_sigsegv(sig, t);
 }
 #ifdef CONFIG_DEBUG_RSEQ
diff --git a/kernel/softirq.c b/kernel/softirq.c
index de2f57fddc04..900dcfee542c 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -139,9 +139,13 @@ static void __local_bh_enable(unsigned int cnt)
 {
        lockdep_assert_irqs_disabled();
+        if (preempt_count() == cnt)
+                trace_preempt_on(CALLER_ADDR0, get_lock_parent_ip());
        if (softirq_count() == (cnt & SOFTIRQ_MASK))
                trace_softirqs_on(_RET_IP_);
-        preempt_count_sub(cnt);
+        __preempt_count_sub(cnt);
 }
 /*
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index 055a4a728c00..3e93c54bd3a1 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -1659,7 +1659,7 @@ EXPORT_SYMBOL_GPL(hrtimer_init_sleeper);
 int nanosleep_copyout(struct restart_block *restart, struct timespec64 *ts)
 {
        switch(restart->nanosleep.type) {
-#ifdef CONFIG_COMPAT
+#ifdef CONFIG_COMPAT_32BIT_TIME
        case TT_COMPAT:
                if (compat_put_timespec64(ts, restart->nanosleep.compat_rmtp))
                        return -EFAULT;
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 5a6251ac6f7a..9cdf54b04ca8 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -604,7 +604,6 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags,
        /*
         * Disarm any old timer after extracting its expiry time.
         */
-        lockdep_assert_irqs_disabled();
        ret = 0;
        old_incr = timer->it.cpu.incr;
@@ -1049,7 +1048,6 @@ static void posix_cpu_timer_rearm(struct k_itimer *timer)
        /*
         * Now re-arm for the new expiry time.
         */
-        lockdep_assert_irqs_disabled();
        arm_timer(timer);
 unlock:
        unlock_task_sighand(p, &flags);
diff --git a/kernel/time/time.c b/kernel/time/time.c
index 6fa99213fc72..2b41e8e2d31d 100644
--- a/kernel/time/time.c
+++ b/kernel/time/time.c
@@ -28,6 +28,7 @@
 */
 #include <linux/export.h>
+#include <linux/kernel.h>
 #include <linux/timex.h>
 #include <linux/capability.h>
 #include <linux/timekeeper_internal.h>
@@ -314,9 +315,10 @@ unsigned int jiffies_to_msecs(const unsigned long j)
        return (j + (HZ / MSEC_PER_SEC) - 1)/(HZ / MSEC_PER_SEC);
 #else
 # if BITS_PER_LONG == 32
-        return (HZ_TO_MSEC_MUL32 * j) >> HZ_TO_MSEC_SHR32;
+        return (HZ_TO_MSEC_MUL32 * j + (1ULL << HZ_TO_MSEC_SHR32) - 1) >>
+               HZ_TO_MSEC_SHR32;
 # else
-        return (j * HZ_TO_MSEC_NUM) / HZ_TO_MSEC_DEN;
+        return DIV_ROUND_UP(j * HZ_TO_MSEC_NUM, HZ_TO_MSEC_DEN);
 # endif
 #endif
 }
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c9336e98ac59..a0079b4c7a49 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1360,8 +1360,6 @@ __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
 void
 update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
 {
-        struct ring_buffer *buf;
        if (tr->stop_count)
                return;
@@ -1375,9 +1373,7 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
        arch_spin_lock(&tr->max_lock);
-        buf = tr->trace_buffer.buffer;
+        swap(tr->trace_buffer.buffer, tr->max_buffer.buffer);
-        tr->trace_buffer.buffer = tr->max_buffer.buffer;
-        tr->max_buffer.buffer = buf;
        __update_max_tr(tr, tsk, cpu);
        arch_spin_unlock(&tr->max_lock);
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index e1c818dbc0d7..0dceb77d1d42 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -78,7 +78,8 @@ static const char * ops[] = { OPS };
        C(TOO_MANY_PREDS,       "Too many terms in predicate expression"), \
        C(INVALID_FILTER,       "Meaningless filter expression"),       \
        C(IP_FIELD_ONLY,        "Only 'ip' field is supported for function trace"), \
-        C(INVALID_VALUE,        "Invalid value (did you forget quotes)?"),
+        C(INVALID_VALUE,        "Invalid value (did you forget quotes)?"), \
+        C(NO_FILTER,            "No filter found"),
 #undef C
 #define C(a, b)         FILT_ERR_##a
@@ -550,6 +551,13 @@ predicate_parse(const char *str, int nr_parens, int nr_preds,
                goto out_free;
        }
+        if (!N) {
+                /* No program? */
+                ret = -EINVAL;
+                parse_error(pe, FILT_ERR_NO_FILTER, ptr - str);
+                goto out_free;
+        }
        prog[N].pred = NULL;                                    /* #13 */
        prog[N].target = 1;             /* TRUE */
        prog[N+1].pred = NULL;
diff --git a/lib/Kconfig b/lib/Kconfig
index e34b04b56057..706836ec314d 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -420,60 +420,15 @@ config HAS_IOPORT_MAP
        depends on HAS_IOMEM && !NO_IOPORT_MAP
        default y
-config HAS_DMA
+source "kernel/dma/Kconfig"
-        bool
-        depends on !NO_DMA
-        default y
 config SGL_ALLOC
        bool
        default n
-config NEED_SG_DMA_LENGTH
-        bool
-config NEED_DMA_MAP_STATE
-        bool
-config ARCH_DMA_ADDR_T_64BIT
-        def_bool 64BIT || PHYS_ADDR_T_64BIT
 config IOMMU_HELPER
        bool
-config ARCH_HAS_SYNC_DMA_FOR_DEVICE
-        bool
-config ARCH_HAS_SYNC_DMA_FOR_CPU
-        bool
-        select NEED_DMA_MAP_STATE
-config DMA_DIRECT_OPS
-        bool
-        depends on HAS_DMA
-config DMA_NONCOHERENT_OPS
-        bool
-        depends on HAS_DMA
-        select DMA_DIRECT_OPS
-config DMA_NONCOHERENT_MMAP
-        bool
-        depends on DMA_NONCOHERENT_OPS
-config DMA_NONCOHERENT_CACHE_SYNC
-        bool
-        depends on DMA_NONCOHERENT_OPS
-config DMA_VIRT_OPS
-        bool
-        depends on HAS_DMA
-config SWIOTLB
-        bool
-        select DMA_DIRECT_OPS
-        select NEED_DMA_MAP_STATE
 config CHECK_SIGNATURE
        bool
diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
index 3d35d062970d..c253c1b46c6b 100644
--- a/lib/Kconfig.kasan
+++ b/lib/Kconfig.kasan
@@ -6,6 +6,7 @@ if HAVE_ARCH_KASAN
 config KASAN
        bool "KASan: runtime memory debugger"
        depends on SLUB || (SLAB && !DEBUG_SLAB)
+        select SLUB_DEBUG if SLUB
        select CONSTRUCTORS
        select STACKDEPOT
        help
diff --git a/lib/Makefile b/lib/Makefile
index 956b320292fe..90dc5520b784 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -23,15 +23,12 @@ lib-y := ctype.o string.o vsprintf.o cmdline.o \
         sha1.o chacha20.o irq_regs.o argv_split.o \
         flex_proportions.o ratelimit.o show_mem.o \
         is_single_threaded.o plist.o decompress.o kobject_uevent.o \
-         earlycpio.o seq_buf.o siphash.o \
+         earlycpio.o seq_buf.o siphash.o dec_and_lock.o \
         nmi_backtrace.o nodemask.o win_minmax.o
 lib-$(CONFIG_PRINTK) += dump_stack.o
 lib-$(CONFIG_MMU) += ioremap.o
 lib-$(CONFIG_SMP) += cpumask.o
-lib-$(CONFIG_DMA_DIRECT_OPS) += dma-direct.o
-lib-$(CONFIG_DMA_NONCOHERENT_OPS) += dma-noncoherent.o
-lib-$(CONFIG_DMA_VIRT_OPS) += dma-virt.o
 lib-y   += kobject.o klist.o
 obj-y   += lockref.o
@@ -98,10 +95,6 @@ obj-$(CONFIG_DEBUG_PREEMPT) += smp_processor_id.o
 obj-$(CONFIG_DEBUG_LIST) += list_debug.o
 obj-$(CONFIG_DEBUG_OBJECTS) += debugobjects.o
-ifneq ($(CONFIG_HAVE_DEC_LOCK),y)
-  lib-y += dec_and_lock.o
-endif
 obj-$(CONFIG_BITREVERSE) += bitrev.o
 obj-$(CONFIG_RATIONAL)  += rational.o
 obj-$(CONFIG_CRC_CCITT) += crc-ccitt.o
@@ -148,7 +141,6 @@ obj-$(CONFIG_SMP) += percpu_counter.o
 obj-$(CONFIG_AUDIT_GENERIC) += audit.o
 obj-$(CONFIG_AUDIT_COMPAT_GENERIC) += compat_audit.o
-obj-$(CONFIG_SWIOTLB) += swiotlb.o
 obj-$(CONFIG_IOMMU_HELPER) += iommu-helper.o
 obj-$(CONFIG_FAULT_INJECTION) += fault-inject.o
 obj-$(CONFIG_NOTIFIER_ERROR_INJECTION) += notifier-error-inject.o
@@ -169,8 +161,6 @@ obj-$(CONFIG_NLATTR) += nlattr.o
 obj-$(CONFIG_LRU_CACHE) += lru_cache.o
-obj-$(CONFIG_DMA_API_DEBUG) += dma-debug.o
 obj-$(CONFIG_GENERIC_CSUM) += checksum.o
 obj-$(CONFIG_GENERIC_ATOMIC64) += atomic64.o
diff --git a/lib/dec_and_lock.c b/lib/dec_and_lock.c
index 347fa7ac2e8a..9555b68bb774 100644
--- a/lib/dec_and_lock.c
+++ b/lib/dec_and_lock.c
@@ -33,3 +33,19 @@ int _atomic_dec_and_lock(atomic_t *atomic, spinlock_t *lock)
 }
 EXPORT_SYMBOL(_atomic_dec_and_lock);
+int _atomic_dec_and_lock_irqsave(atomic_t *atomic, spinlock_t *lock,
+                                 unsigned long *flags)
+{
+        /* Subtract 1 from counter unless that drops it to 0 (ie. it was 1) */
+        if (atomic_add_unless(atomic, -1, 1))
+                return 0;
+        /* Otherwise do it the slow way */
+        spin_lock_irqsave(lock, *flags);
+        if (atomic_dec_and_test(atomic))
+                return 1;
+        spin_unlock_irqrestore(lock, *flags);
+        return 0;
+}
+EXPORT_SYMBOL(_atomic_dec_and_lock_irqsave);
diff --git a/lib/percpu_ida.c b/lib/percpu_ida.c
index 9bbd9c5d375a..beb14839b41a 100644
--- a/lib/percpu_ida.c
+++ b/lib/percpu_ida.c
@@ -141,7 +141,7 @@ int percpu_ida_alloc(struct percpu_ida *pool, int state)
        spin_lock_irqsave(&tags->lock, flags);
        /* Fastpath */
-        if (likely(tags->nr_free >= 0)) {
+        if (likely(tags->nr_free)) {
                tag = tags->freelist[--tags->nr_free];
                spin_unlock_irqrestore(&tags->lock, flags);
                return tag;
diff --git a/lib/refcount.c b/lib/refcount.c
index 0eb48353abe3..d3b81cefce91 100644
--- a/lib/refcount.c
+++ b/lib/refcount.c
@@ -350,3 +350,31 @@ bool refcount_dec_and_lock(refcount_t *r, spinlock_t *lock)
 }
 EXPORT_SYMBOL(refcount_dec_and_lock);
+/**
+ * refcount_dec_and_lock_irqsave - return holding spinlock with disabled
+ *                                 interrupts if able to decrement refcount to 0
+ * @r: the refcount
+ * @lock: the spinlock to be locked
+ * @flags: saved IRQ-flags if the is acquired
+ *
+ * Same as refcount_dec_and_lock() above except that the spinlock is acquired
+ * with disabled interupts.
+ *
+ * Return: true and hold spinlock if able to decrement refcount to 0, false
+ *         otherwise
+ */
+bool refcount_dec_and_lock_irqsave(refcount_t *r, spinlock_t *lock,
+                                   unsigned long *flags)
+{
+        if (refcount_dec_not_one(r))
+                return false;
+        spin_lock_irqsave(lock, *flags);
+        if (!refcount_dec_and_test(r)) {
+                spin_unlock_irqrestore(lock, *flags);
+                return false;
+        }
+        return true;
+}
+EXPORT_SYMBOL(refcount_dec_and_lock_irqsave);
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index 1642fd507a96..7c6096a71704 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -24,9 +24,6 @@
 **/
 struct scatterlist *sg_next(struct scatterlist *sg)
 {
-#ifdef CONFIG_DEBUG_SG
-        BUG_ON(sg->sg_magic != SG_MAGIC);
-#endif
        if (sg_is_last(sg))
                return NULL;
@@ -111,10 +108,7 @@ struct scatterlist *sg_last(struct scatterlist *sgl, unsigned int nents)
        for_each_sg(sgl, sg, nents, i)
                ret = sg;
-#ifdef CONFIG_DEBUG_SG
-        BUG_ON(sgl[0].sg_magic != SG_MAGIC);
        BUG_ON(!sg_is_last(ret));
-#endif
        return ret;
 }
 EXPORT_SYMBOL(sg_last);
diff --git a/lib/test_printf.c b/lib/test_printf.c
index b2aa8f514844..cea592f402ed 100644
--- a/lib/test_printf.c
+++ b/lib/test_printf.c
@@ -260,13 +260,6 @@ plain(void)
 {
        int err;
-        /*
-         * Make sure crng is ready. Otherwise we get "(ptrval)" instead
-         * of a hashed address when printing '%p' in plain_hash() and
-         * plain_format().
-         */
-        wait_for_random_bytes();
        err = plain_hash();
        if (err) {
                pr_warn("plain 'p' does not appear to be hashed\n");
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 347cc834c04a..2e5d3df0853d 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -359,15 +359,8 @@ static void wb_shutdown(struct bdi_writeback *wb)
        spin_lock_bh(&wb->work_lock);
        if (!test_and_clear_bit(WB_registered, &wb->state)) {
                spin_unlock_bh(&wb->work_lock);
-                /*
-                 * Wait for wb shutdown to finish if someone else is just
-                 * running wb_shutdown(). Otherwise we could proceed to wb /
-                 * bdi destruction before wb_shutdown() is finished.
-                 */
-                wait_on_bit(&wb->state, WB_shutting_down, TASK_UNINTERRUPTIBLE);
                return;
        }
-        set_bit(WB_shutting_down, &wb->state);
        spin_unlock_bh(&wb->work_lock);
        cgwb_remove_from_bdi_list(wb);
@@ -379,12 +372,6 @@ static void wb_shutdown(struct bdi_writeback *wb)
        mod_delayed_work(bdi_wq, &wb->dwork, 0);
        flush_delayed_work(&wb->dwork);
        WARN_ON(!list_empty(&wb->work_list));
-        /*
-         * Make sure bit gets cleared after shutdown is finished. Matches with
-         * the barrier provided by test_and_clear_bit() above.
-         */
-        smp_wmb();
-        clear_and_wake_up_bit(WB_shutting_down, &wb->state);
 }
 static void wb_exit(struct bdi_writeback *wb)
@@ -508,10 +495,12 @@ static void cgwb_release_workfn(struct work_struct *work)
        struct bdi_writeback *wb = container_of(work, struct bdi_writeback,
                                                release_work);
+        mutex_lock(&wb->bdi->cgwb_release_mutex);
        wb_shutdown(wb);
        css_put(wb->memcg_css);
        css_put(wb->blkcg_css);
+        mutex_unlock(&wb->bdi->cgwb_release_mutex);
        fprop_local_destroy_percpu(&wb->memcg_completions);
        percpu_ref_exit(&wb->refcnt);
@@ -697,6 +686,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi)
        INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC);
        bdi->cgwb_congested_tree = RB_ROOT;
+        mutex_init(&bdi->cgwb_release_mutex);
        ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL);
        if (!ret) {
@@ -717,7 +707,10 @@ static void cgwb_bdi_unregister(struct backing_dev_info *bdi)
        spin_lock_irq(&cgwb_lock);
        radix_tree_for_each_slot(slot, &bdi->cgwb_tree, &iter, 0)
                cgwb_kill(*slot);
+        spin_unlock_irq(&cgwb_lock);
+        mutex_lock(&bdi->cgwb_release_mutex);
+        spin_lock_irq(&cgwb_lock);
        while (!list_empty(&bdi->wb_list)) {
                wb = list_first_entry(&bdi->wb_list, struct bdi_writeback,
                                      bdi_node);
@@ -726,6 +719,7 @@ static void cgwb_bdi_unregister(struct backing_dev_info *bdi)
                spin_lock_irq(&cgwb_lock);
        }
        spin_unlock_irq(&cgwb_lock);
+        mutex_unlock(&bdi->cgwb_release_mutex);
 }
 /**
diff --git a/mm/memblock.c b/mm/memblock.c
index cc16d70b8333..03d48d8835ba 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -20,7 +20,6 @@
 #include <linux/kmemleak.h>
 #include <linux/seq_file.h>
 #include <linux/memblock.h>
-#include <linux/bootmem.h>
 #include <asm/sections.h>
 #include <linux/io.h>
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 890b1f04a03a..2296caf87bfb 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -567,10 +567,14 @@ static int shutdown_cache(struct kmem_cache *s)
        list_del(&s->list);
        if (s->flags & SLAB_TYPESAFE_BY_RCU) {
+#ifdef SLAB_SUPPORTS_SYSFS
+                sysfs_slab_unlink(s);
+#endif
                list_add_tail(&s->list, &slab_caches_to_rcu_destroy);
                schedule_work(&slab_caches_to_rcu_destroy_work);
        } else {
 #ifdef SLAB_SUPPORTS_SYSFS
+                sysfs_slab_unlink(s);
                sysfs_slab_release(s);
 #else
                slab_kmem_cache_release(s);
diff --git a/mm/slub.c b/mm/slub.c
index a3b8467c14af..51258eff4178 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5667,7 +5667,6 @@ static void sysfs_slab_remove_workfn(struct work_struct *work)
        kset_unregister(s->memcg_kset);
 #endif
        kobject_uevent(&s->kobj, KOBJ_REMOVE);
-        kobject_del(&s->kobj);
 out:
        kobject_put(&s->kobj);
 }
@@ -5752,6 +5751,12 @@ static void sysfs_slab_remove(struct kmem_cache *s)
        schedule_work(&s->kobj_remove_work);
 }
+void sysfs_slab_unlink(struct kmem_cache *s)
+{
+        if (slab_state >= FULL)
+                kobject_del(&s->kobj);
+}
 void sysfs_slab_release(struct kmem_cache *s)
 {
        if (slab_state >= FULL)
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 75eda9c2b260..8ba0870ecddd 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1796,11 +1796,9 @@ static void vmstat_update(struct work_struct *w)
                 * to occur in the future. Keep on running the
                 * update worker thread.
                 */
-                preempt_disable();
                queue_delayed_work_on(smp_processor_id(), mm_percpu_wq,
                                this_cpu_ptr(&vmstat_work),
                                round_jiffies_relative(sysctl_stat_interval));
-                preempt_enable();
        }
 }
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 55fdba05d7d9..9b6bc5abe946 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1869,7 +1869,7 @@ static const struct proto_ops atalk_dgram_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = atalk_getname,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .ioctl          = atalk_ioctl,
 #ifdef CONFIG_COMPAT
        .compat_ioctl   = atalk_compat_ioctl,
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 36b3adacc0dd..10462de734ea 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -252,8 +252,7 @@ static int br2684_xmit_vcc(struct sk_buff *skb, struct net_device *dev,
        ATM_SKB(skb)->vcc = atmvcc = brvcc->atmvcc;
        pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, atmvcc, atmvcc->dev);
-        refcount_add(skb->truesize, &sk_atm(atmvcc)->sk_wmem_alloc);
+        atm_account_tx(atmvcc, skb);
-        ATM_SKB(skb)->atm_options = atmvcc->atm_options;
        dev->stats.tx_packets++;
        dev->stats.tx_bytes += skb->len;
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 66caa48a27c2..d795b9c5aea4 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -381,8 +381,7 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
                memcpy(here, llc_oui, sizeof(llc_oui));
                ((__be16 *) here)[3] = skb->protocol;
        }
-        refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
+        atm_account_tx(vcc, skb);
-        ATM_SKB(skb)->atm_options = vcc->atm_options;
        entry->vccs->last_use = jiffies;
        pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, vcc, vcc->dev);
        old = xchg(&entry->vccs->xoff, 1);      /* assume XOFF ... */
diff --git a/net/atm/common.c b/net/atm/common.c
index 1f2af59935db..a7a68e509628 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -630,10 +630,9 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size)
                goto out;
        }
        pr_debug("%d += %d\n", sk_wmem_alloc_get(sk), skb->truesize);
-        refcount_add(skb->truesize, &sk->sk_wmem_alloc);
+        atm_account_tx(vcc, skb);
        skb->dev = NULL; /* for paths shared with net_device interfaces */
-        ATM_SKB(skb)->atm_options = vcc->atm_options;
        if (!copy_from_iter_full(skb_put(skb, size), size, &m->msg_iter)) {
                kfree_skb(skb);
                error = -EFAULT;
@@ -648,11 +647,16 @@ out:
        return error;
 }
-__poll_t vcc_poll_mask(struct socket *sock, __poll_t events)
+__poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
        struct sock *sk = sock->sk;
-        struct atm_vcc *vcc = ATM_SD(sock);
+        struct atm_vcc *vcc;
-        __poll_t mask = 0;
+        __poll_t mask;
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
+        vcc = ATM_SD(sock);
        /* exceptional events */
        if (sk->sk_err)
diff --git a/net/atm/common.h b/net/atm/common.h
index 526796ad230f..5850649068bb 100644
--- a/net/atm/common.h
+++ b/net/atm/common.h
@@ -17,7 +17,7 @@ int vcc_connect(struct socket *sock, int itf, short vpi, int vci);
 int vcc_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
                int flags);
 int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len);
-__poll_t vcc_poll_mask(struct socket *sock, __poll_t events);
+__poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait);
 int vcc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int vcc_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int vcc_setsockopt(struct socket *sock, int level, int optname,
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 5a95fcf6f9b6..d7f5cf5b7594 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -182,9 +182,8 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb)
        struct net_device *dev = skb->dev;
        ATM_SKB(skb)->vcc = vcc;
-        ATM_SKB(skb)->atm_options = vcc->atm_options;
+        atm_account_tx(vcc, skb);
-        refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
        if (vcc->send(vcc, skb) < 0) {
                dev->stats.tx_dropped++;
                return;
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 75620c2f2617..24b53c4c39c6 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -555,8 +555,7 @@ static int send_via_shortcut(struct sk_buff *skb, struct mpoa_client *mpc)
                                        sizeof(struct llc_snap_hdr));
        }
-        refcount_add(skb->truesize, &sk_atm(entry->shortcut)->sk_wmem_alloc);
+        atm_account_tx(entry->shortcut, skb);
-        ATM_SKB(skb)->atm_options = entry->shortcut->atm_options;
        entry->shortcut->send(entry->shortcut, skb);
        entry->packets_fwded++;
        mpc->in_ops->put(entry);
diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index 21d9d341a619..af8c4b38b746 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c
@@ -350,8 +350,7 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
                return 1;
        }
-        refcount_add(skb->truesize, &sk_atm(ATM_SKB(skb)->vcc)->sk_wmem_alloc);
+        atm_account_tx(vcc, skb);
-        ATM_SKB(skb)->atm_options = ATM_SKB(skb)->vcc->atm_options;
        pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n",
                 skb, ATM_SKB(skb)->vcc, ATM_SKB(skb)->vcc->dev);
        ret = ATM_SKB(skb)->vcc->send(ATM_SKB(skb)->vcc, skb)
diff --git a/net/atm/pvc.c b/net/atm/pvc.c
index 9f75092fe778..2cb10af16afc 100644
--- a/net/atm/pvc.c
+++ b/net/atm/pvc.c
@@ -113,7 +113,7 @@ static const struct proto_ops pvc_proto_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       sock_no_accept,
        .getname =      pvc_getname,
-        .poll_mask =    vcc_poll_mask,
+        .poll =         vcc_poll,
        .ioctl =        vcc_ioctl,
 #ifdef CONFIG_COMPAT
        .compat_ioctl = vcc_compat_ioctl,
diff --git a/net/atm/raw.c b/net/atm/raw.c
index ee10e8d46185..b3ba44aab0ee 100644
--- a/net/atm/raw.c
+++ b/net/atm/raw.c
@@ -35,8 +35,8 @@ static void atm_pop_raw(struct atm_vcc *vcc, struct sk_buff *skb)
        struct sock *sk = sk_atm(vcc);
        pr_debug("(%d) %d -= %d\n",
-                 vcc->vci, sk_wmem_alloc_get(sk), skb->truesize);
+                 vcc->vci, sk_wmem_alloc_get(sk), ATM_SKB(skb)->acct_truesize);
-        WARN_ON(refcount_sub_and_test(skb->truesize, &sk->sk_wmem_alloc));
+        WARN_ON(refcount_sub_and_test(ATM_SKB(skb)->acct_truesize, &sk->sk_wmem_alloc));
        dev_kfree_skb_any(skb);
        sk->sk_write_space(sk);
 }
diff --git a/net/atm/svc.c b/net/atm/svc.c
index 53f4ad7087b1..2f91b766ac42 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -636,7 +636,7 @@ static const struct proto_ops svc_proto_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       svc_accept,
        .getname =      svc_getname,
-        .poll_mask =    vcc_poll_mask,
+        .poll =         vcc_poll,
        .ioctl =        svc_ioctl,
 #ifdef CONFIG_COMPAT
        .compat_ioctl = svc_compat_ioctl,
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index d1d2442ce573..c603d33d5410 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1941,7 +1941,7 @@ static const struct proto_ops ax25_proto_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = ax25_accept,
        .getname        = ax25_getname,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .ioctl          = ax25_ioctl,
        .listen         = ax25_listen,
        .shutdown       = ax25_shutdown,
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 510ab4f55df5..3264e1873219 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -437,13 +437,16 @@ static inline __poll_t bt_accept_poll(struct sock *parent)
        return 0;
 }
-__poll_t bt_sock_poll_mask(struct socket *sock, __poll_t events)
+__poll_t bt_sock_poll(struct file *file, struct socket *sock,
+                          poll_table *wait)
 {
        struct sock *sk = sock->sk;
        __poll_t mask = 0;
        BT_DBG("sock %p, sk %p", sock, sk);
+        poll_wait(file, sk_sleep(sk), wait);
        if (sk->sk_state == BT_LISTEN)
                return bt_accept_poll(sk);
@@ -475,7 +478,7 @@ __poll_t bt_sock_poll_mask(struct socket *sock, __poll_t events)
        return mask;
 }
-EXPORT_SYMBOL(bt_sock_poll_mask);
+EXPORT_SYMBOL(bt_sock_poll);
 int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index d6c099861538..1506e1632394 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1975,7 +1975,7 @@ static const struct proto_ops hci_sock_ops = {
        .sendmsg        = hci_sock_sendmsg,
        .recvmsg        = hci_sock_recvmsg,
        .ioctl          = hci_sock_ioctl,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
        .setsockopt     = hci_sock_setsockopt,
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 742a190034e6..686bdc6b35b0 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1653,7 +1653,7 @@ static const struct proto_ops l2cap_sock_ops = {
        .getname        = l2cap_sock_getname,
        .sendmsg        = l2cap_sock_sendmsg,
        .recvmsg        = l2cap_sock_recvmsg,
-        .poll_mask      = bt_sock_poll_mask,
+        .poll           = bt_sock_poll,
        .ioctl          = bt_sock_ioctl,
        .mmap           = sock_no_mmap,
        .socketpair     = sock_no_socketpair,
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 1cf57622473a..d606e9212291 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -1049,7 +1049,7 @@ static const struct proto_ops rfcomm_sock_ops = {
        .setsockopt     = rfcomm_sock_setsockopt,
        .getsockopt     = rfcomm_sock_getsockopt,
        .ioctl          = rfcomm_sock_ioctl,
-        .poll_mask      = bt_sock_poll_mask,
+        .poll           = bt_sock_poll,
        .socketpair     = sock_no_socketpair,
        .mmap           = sock_no_mmap
 };
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index d60dbc61d170..413b8ee49fec 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -1197,7 +1197,7 @@ static const struct proto_ops sco_sock_ops = {
        .getname        = sco_sock_getname,
        .sendmsg        = sco_sock_sendmsg,
        .recvmsg        = sco_sock_recvmsg,
-        .poll_mask      = bt_sock_poll_mask,
+        .poll           = bt_sock_poll,
        .ioctl          = bt_sock_ioctl,
        .mmap           = sock_no_mmap,
        .socketpair     = sock_no_socketpair,
diff --git a/net/bpfilter/.gitignore b/net/bpfilter/.gitignore
new file mode 100644
index 000000000000..e97084e3eea2
--- /dev/null
+++ b/net/bpfilter/.gitignore
@@ -0,0 +1 @@
+bpfilter_umh
diff --git a/net/bpfilter/Makefile b/net/bpfilter/Makefile
index e0bbe7583e58..051dc18b8ccb 100644
--- a/net/bpfilter/Makefile
+++ b/net/bpfilter/Makefile
@@ -21,8 +21,10 @@ endif
 # which bpfilter_kern.c passes further into umh blob loader at run-time
 quiet_cmd_copy_umh = GEN $@
      cmd_copy_umh = echo ':' > $(obj)/.bpfilter_umh.o.cmd; \
-      $(OBJCOPY) -I binary -O `$(OBJDUMP) -f $<|grep format|cut -d' ' -f8` \
+      $(OBJCOPY) -I binary \
-      -B `$(OBJDUMP) -f $<|grep architecture|cut -d, -f1|cut -d' ' -f2` \
+          `LC_ALL=C $(OBJDUMP) -f net/bpfilter/bpfilter_umh \
+          |awk -F' |,' '/file format/{print "-O",$$NF} \
+          /^architecture:/{print "-B",$$2}'` \
      --rename-section .data=.init.rodata $< $@
 $(obj)/bpfilter_umh.o: $(obj)/bpfilter_umh
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index c7991867d622..a6fb1b3bcad9 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -934,11 +934,15 @@ static int caif_release(struct socket *sock)
 }
 /* Copied from af_unix.c:unix_poll(), added CAIF tx_flow handling */
-static __poll_t caif_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t caif_poll(struct file *file,
+                              struct socket *sock, poll_table *wait)
 {
        struct sock *sk = sock->sk;
+        __poll_t mask;
        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
-        __poll_t mask = 0;
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
        /* exceptional events? */
        if (sk->sk_err)
@@ -972,7 +976,7 @@ static const struct proto_ops caif_seqpacket_ops = {
        .socketpair = sock_no_socketpair,
        .accept = sock_no_accept,
        .getname = sock_no_getname,
-        .poll_mask = caif_poll_mask,
+        .poll = caif_poll,
        .ioctl = sock_no_ioctl,
        .listen = sock_no_listen,
        .shutdown = sock_no_shutdown,
@@ -993,7 +997,7 @@ static const struct proto_ops caif_stream_ops = {
        .socketpair = sock_no_socketpair,
        .accept = sock_no_accept,
        .getname = sock_no_getname,
-        .poll_mask = caif_poll_mask,
+        .poll = caif_poll,
        .ioctl = sock_no_ioctl,
        .listen = sock_no_listen,
        .shutdown = sock_no_shutdown,
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 9393f25df08d..0af8f0db892a 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1660,7 +1660,7 @@ static const struct proto_ops bcm_ops = {
        .socketpair    = sock_no_socketpair,
        .accept        = sock_no_accept,
        .getname       = sock_no_getname,
-        .poll_mask     = datagram_poll_mask,
+        .poll          = datagram_poll,
        .ioctl         = can_ioctl,     /* use can_ioctl() from af_can.c */
        .listen        = sock_no_listen,
        .shutdown      = sock_no_shutdown,
diff --git a/net/can/raw.c b/net/can/raw.c
index fd7e2f49ea6a..1051eee82581 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -843,7 +843,7 @@ static const struct proto_ops raw_ops = {
        .socketpair    = sock_no_socketpair,
        .accept        = sock_no_accept,
        .getname       = raw_getname,
-        .poll_mask     = datagram_poll_mask,
+        .poll          = datagram_poll,
        .ioctl         = can_ioctl,     /* use can_ioctl() from af_can.c */
        .listen        = sock_no_listen,
        .shutdown      = sock_no_shutdown,
diff --git a/net/core/datagram.c b/net/core/datagram.c
index f19bf3dc2bd6..9938952c5c78 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -819,8 +819,9 @@ EXPORT_SYMBOL(skb_copy_and_csum_datagram_msg);
 /**
 *      datagram_poll - generic datagram poll
+ *      @file: file struct
 *      @sock: socket
- *      @events to wait for
+ *      @wait: poll table
 *
 *      Datagram poll: Again totally generic. This also handles
 *      sequenced packet sockets providing the socket receive queue
@@ -830,10 +831,14 @@ EXPORT_SYMBOL(skb_copy_and_csum_datagram_msg);
 *      and you use a different write policy from sock_writeable()
 *      then please supply your own write_space callback.
 */
-__poll_t datagram_poll_mask(struct socket *sock, __poll_t events)
+__poll_t datagram_poll(struct file *file, struct socket *sock,
+                           poll_table *wait)
 {
        struct sock *sk = sock->sk;
-        __poll_t mask = 0;
+        __poll_t mask;
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
        /* exceptional events? */
        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
@@ -866,4 +871,4 @@ __poll_t datagram_poll_mask(struct socket *sock, __poll_t events)
        return mask;
 }
-EXPORT_SYMBOL(datagram_poll_mask);
+EXPORT_SYMBOL(datagram_poll);
diff --git a/net/core/dev.c b/net/core/dev.c
index 57b7bab5f70b..a5aa1c7444e6 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8643,7 +8643,8 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
                /* We get here if we can't use the current device name */
                if (!pat)
                        goto out;
-                if (dev_get_valid_name(net, dev, pat) < 0)
+                err = dev_get_valid_name(net, dev, pat);
+                if (err < 0)
                        goto out;
        }
@@ -8655,7 +8656,6 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
        dev_close(dev);
        /* And unlink it from device chain */
-        err = -ENODEV;
        unlist_netdevice(dev);
        synchronize_net();
diff --git a/net/core/filter.c b/net/core/filter.c
index 3d9ba7e5965a..e7f12e9f598c 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3214,20 +3214,6 @@ err:
 }
 EXPORT_SYMBOL_GPL(xdp_do_redirect);
-static int __xdp_generic_ok_fwd_dev(struct sk_buff *skb, struct net_device *fwd)
-{
-        unsigned int len;
-        if (unlikely(!(fwd->flags & IFF_UP)))
-                return -ENETDOWN;
-        len = fwd->mtu + fwd->hard_header_len + VLAN_HLEN;
-        if (skb->len > len)
-                return -EMSGSIZE;
-        return 0;
-}
 static int xdp_do_generic_redirect_map(struct net_device *dev,
                                       struct sk_buff *skb,
                                       struct xdp_buff *xdp,
@@ -3256,10 +3242,11 @@ static int xdp_do_generic_redirect_map(struct net_device *dev,
        }
        if (map->map_type == BPF_MAP_TYPE_DEVMAP) {
-                if (unlikely((err = __xdp_generic_ok_fwd_dev(skb, fwd))))
+                struct bpf_dtab_netdev *dst = fwd;
+                err = dev_map_generic_redirect(dst, skb, xdp_prog);
+                if (unlikely(err))
                        goto err;
-                skb->dev = fwd;
-                generic_xdp_tx(skb, xdp_prog);
        } else if (map->map_type == BPF_MAP_TYPE_XSKMAP) {
                struct xdp_sock *xs = fwd;
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 8b5ba6dffac7..12877a1514e7 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -600,7 +600,7 @@ static void ccid3_hc_rx_send_feedback(struct sock *sk,
 {
        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
        struct dccp_sock *dp = dccp_sk(sk);
-        ktime_t now = ktime_get_real();
+        ktime_t now = ktime_get();
        s64 delta = 0;
        switch (fbtype) {
@@ -625,15 +625,14 @@ static void ccid3_hc_rx_send_feedback(struct sock *sk,
        case CCID3_FBACK_PERIODIC:
                delta = ktime_us_delta(now, hc->rx_tstamp_last_feedback);
                if (delta <= 0)
-                        DCCP_BUG("delta (%ld) <= 0", (long)delta);
+                        delta = 1;
-                else
+                hc->rx_x_recv = scaled_div32(hc->rx_bytes_recv, delta);
-                        hc->rx_x_recv = scaled_div32(hc->rx_bytes_recv, delta);
                break;
        default:
                return;
        }
-        ccid3_pr_debug("Interval %ldusec, X_recv=%u, 1/p=%u\n", (long)delta,
+        ccid3_pr_debug("Interval %lldusec, X_recv=%u, 1/p=%u\n", delta,
                       hc->rx_x_recv, hc->rx_pinv);
        hc->rx_tstamp_last_feedback = now;
@@ -680,7 +679,8 @@ static int ccid3_hc_rx_insert_options(struct sock *sk, struct sk_buff *skb)
 static u32 ccid3_first_li(struct sock *sk)
 {
        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
-        u32 x_recv, p, delta;
+        u32 x_recv, p;
+        s64 delta;
        u64 fval;
        if (hc->rx_rtt == 0) {
@@ -688,7 +688,9 @@ static u32 ccid3_first_li(struct sock *sk)
                hc->rx_rtt = DCCP_FALLBACK_RTT;
        }
-        delta  = ktime_to_us(net_timedelta(hc->rx_tstamp_last_feedback));
+        delta = ktime_us_delta(ktime_get(), hc->rx_tstamp_last_feedback);
+        if (delta <= 0)
+                delta = 1;
        x_recv = scaled_div32(hc->rx_bytes_recv, delta);
        if (x_recv == 0) {              /* would also trigger divide-by-zero */
                DCCP_WARN("X_recv==0\n");
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index 0ea2ee56ac1b..f91e3816806b 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -316,7 +316,8 @@ int dccp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
                 int flags, int *addr_len);
 void dccp_shutdown(struct sock *sk, int how);
 int inet_dccp_listen(struct socket *sock, int backlog);
-__poll_t dccp_poll_mask(struct socket *sock, __poll_t events);
+__poll_t dccp_poll(struct file *file, struct socket *sock,
+                       poll_table *wait);
 int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len);
 void dccp_req_err(struct sock *sk, u64 seq);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index a9e478cd3787..b08feb219b44 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -984,7 +984,7 @@ static const struct proto_ops inet_dccp_ops = {
        .accept            = inet_accept,
        .getname           = inet_getname,
        /* FIXME: work on tcp_poll to rename it to inet_csk_poll */
-        .poll_mask         = dccp_poll_mask,
+        .poll              = dccp_poll,
        .ioctl             = inet_ioctl,
        /* FIXME: work on inet_listen to rename it to sock_common_listen */
        .listen            = inet_dccp_listen,
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 17fc4e0166ba..6344f1b18a6a 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -1070,7 +1070,7 @@ static const struct proto_ops inet6_dccp_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = inet_accept,
        .getname           = inet6_getname,
-        .poll_mask         = dccp_poll_mask,
+        .poll              = dccp_poll,
        .ioctl             = inet6_ioctl,
        .listen            = inet_dccp_listen,
        .shutdown          = inet_shutdown,
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index ca21c1c76da0..0d56e36a6db7 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -312,11 +312,20 @@ int dccp_disconnect(struct sock *sk, int flags)
 EXPORT_SYMBOL_GPL(dccp_disconnect);
-__poll_t dccp_poll_mask(struct socket *sock, __poll_t events)
+/*
+ *      Wait for a DCCP event.
+ *
+ *      Note that we don't need to lock the socket, as the upper poll layers
+ *      take care of normal races (between the test and the event) and we don't
+ *      go look at any of the socket buffers directly.
+ */
+__poll_t dccp_poll(struct file *file, struct socket *sock,
+                       poll_table *wait)
 {
        __poll_t mask;
        struct sock *sk = sock->sk;
+        sock_poll_wait(file, sk_sleep(sk), wait);
        if (sk->sk_state == DCCP_LISTEN)
                return inet_csk_listen_poll(sk);
@@ -358,7 +367,7 @@ __poll_t dccp_poll_mask(struct socket *sock, __poll_t events)
        return mask;
 }
-EXPORT_SYMBOL_GPL(dccp_poll_mask);
+EXPORT_SYMBOL_GPL(dccp_poll);
 int dccp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 {
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 9a686d890bfa..7d6ff983ba2c 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1207,11 +1207,11 @@ static int dn_getname(struct socket *sock, struct sockaddr *uaddr,int peer)
 }
-static __poll_t dn_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t dn_poll(struct file *file, struct socket *sock, poll_table  *wait)
 {
        struct sock *sk = sock->sk;
        struct dn_scp *scp = DN_SK(sk);
-        __poll_t mask = datagram_poll_mask(sock, events);
+        __poll_t mask = datagram_poll(file, sock, wait);
        if (!skb_queue_empty(&scp->other_receive_queue))
                mask |= EPOLLRDBAND;
@@ -2331,7 +2331,7 @@ static const struct proto_ops dn_proto_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       dn_accept,
        .getname =      dn_getname,
-        .poll_mask =    dn_poll_mask,
+        .poll =         dn_poll,
        .ioctl =        dn_ioctl,
        .listen =       dn_listen,
        .shutdown =     dn_shutdown,
diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
index a0768d2759b8..a60658c85a9a 100644
--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -423,7 +423,7 @@ static const struct proto_ops ieee802154_raw_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = sock_no_accept,
        .getname           = sock_no_getname,
-        .poll_mask         = datagram_poll_mask,
+        .poll              = datagram_poll,
        .ioctl             = ieee802154_sock_ioctl,
        .listen            = sock_no_listen,
        .shutdown          = sock_no_shutdown,
@@ -969,7 +969,7 @@ static const struct proto_ops ieee802154_dgram_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = sock_no_accept,
        .getname           = sock_no_getname,
-        .poll_mask         = datagram_poll_mask,
+        .poll              = datagram_poll,
        .ioctl             = ieee802154_sock_ioctl,
        .listen            = sock_no_listen,
        .shutdown          = sock_no_shutdown,
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 15e125558c76..b403499fdabe 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -986,7 +986,7 @@ const struct proto_ops inet_stream_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = inet_accept,
        .getname           = inet_getname,
-        .poll_mask         = tcp_poll_mask,
+        .poll              = tcp_poll,
        .ioctl             = inet_ioctl,
        .listen            = inet_listen,
        .shutdown          = inet_shutdown,
@@ -1021,7 +1021,7 @@ const struct proto_ops inet_dgram_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = sock_no_accept,
        .getname           = inet_getname,
-        .poll_mask         = udp_poll_mask,
+        .poll              = udp_poll,
        .ioctl             = inet_ioctl,
        .listen            = sock_no_listen,
        .shutdown          = inet_shutdown,
@@ -1042,7 +1042,7 @@ EXPORT_SYMBOL(inet_dgram_ops);
 /*
 * For SOCK_RAW sockets; should be the same as inet_dgram_ops but without
- * udp_poll_mask
+ * udp_poll
 */
 static const struct proto_ops inet_sockraw_ops = {
        .family            = PF_INET,
@@ -1053,7 +1053,7 @@ static const struct proto_ops inet_sockraw_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = sock_no_accept,
        .getname           = inet_getname,
-        .poll_mask         = datagram_poll_mask,
+        .poll              = datagram_poll,
        .ioctl             = inet_ioctl,
        .listen            = sock_no_listen,
        .shutdown          = inet_shutdown,
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 31ff46daae97..3647167c8fa3 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -243,9 +243,9 @@ static inline int compute_score(struct sock *sk, struct net *net,
                        bool dev_match = (sk->sk_bound_dev_if == dif ||
                                          sk->sk_bound_dev_if == sdif);
-                        if (exact_dif && !dev_match)
+                        if (!dev_match)
                                return -1;
-                        if (sk->sk_bound_dev_if && dev_match)
+                        if (sk->sk_bound_dev_if)
                                score += 4;
                }
                if (sk->sk_incoming_cpu == raw_smp_processor_id())
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index af5a830ff6ad..b3308e9d9762 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1145,7 +1145,8 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
        cork->fragsize = ip_sk_use_pmtu(sk) ?
                         dst_mtu(&rt->dst) : rt->dst.dev->mtu;
-        cork->gso_size = sk->sk_type == SOCK_DGRAM ? ipc->gso_size : 0;
+        cork->gso_size = sk->sk_type == SOCK_DGRAM &&
+                         sk->sk_protocol == IPPROTO_UDP ? ipc->gso_size : 0;
        cork->dst = &rt->dst;
        cork->length = 0;
        cork->ttl = ipc->ttl;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 141acd92e58a..e7b53d2a971f 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -494,21 +494,32 @@ static inline bool tcp_stream_is_readable(const struct tcp_sock *tp,
 }
 /*
- * Socket is not locked. We are protected from async events by poll logic and
+ *      Wait for a TCP event.
- * correct handling of state changes made by other threads is impossible in
+ *
- * any case.
+ *      Note that we don't need to lock the socket, as the upper poll layers
+ *      take care of normal races (between the test and the event) and we don't
+ *      go look at any of the socket buffers directly.
 */
-__poll_t tcp_poll_mask(struct socket *sock, __poll_t events)
+__poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
+        __poll_t mask;
        struct sock *sk = sock->sk;
        const struct tcp_sock *tp = tcp_sk(sk);
-        __poll_t mask = 0;
        int state;
+        sock_poll_wait(file, sk_sleep(sk), wait);
        state = inet_sk_state_load(sk);
        if (state == TCP_LISTEN)
                return inet_csk_listen_poll(sk);
+        /* Socket is not locked. We are protected from async events
+         * by poll logic and correct handling of state changes
+         * made by other threads is impossible in any case.
+         */
+        mask = 0;
        /*
         * EPOLLHUP is certainly not done right. But poll() doesn't
         * have a notion of HUP in just one direction, and for a
@@ -589,7 +600,7 @@ __poll_t tcp_poll_mask(struct socket *sock, __poll_t events)
        return mask;
 }
-EXPORT_SYMBOL(tcp_poll_mask);
+EXPORT_SYMBOL(tcp_poll);
 int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 9bb27df4dac5..24e116ddae79 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2591,7 +2591,7 @@ int compat_udp_getsockopt(struct sock *sk, int level, int optname,
 *      udp_poll - wait for a UDP event.
 *      @file - file struct
 *      @sock - socket
- *      @events - events to wait for
+ *      @wait - poll table
 *
 *      This is same as datagram poll, except for the special case of
 *      blocking sockets. If application is using a blocking fd
@@ -2600,23 +2600,23 @@ int compat_udp_getsockopt(struct sock *sk, int level, int optname,
 *      but then block when reading it. Add special case code
 *      to work around these arguably broken applications.
 */
-__poll_t udp_poll_mask(struct socket *sock, __poll_t events)
+__poll_t udp_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
-        __poll_t mask = datagram_poll_mask(sock, events);
+        __poll_t mask = datagram_poll(file, sock, wait);
        struct sock *sk = sock->sk;
        if (!skb_queue_empty(&udp_sk(sk)->reader_queue))
                mask |= EPOLLIN | EPOLLRDNORM;
        /* Check for false positives due to checksum errors */
-        if ((mask & EPOLLRDNORM) && !(sock->file->f_flags & O_NONBLOCK) &&
+        if ((mask & EPOLLRDNORM) && !(file->f_flags & O_NONBLOCK) &&
            !(sk->sk_shutdown & RCV_SHUTDOWN) && first_packet_length(sk) == -1)
                mask &= ~(EPOLLIN | EPOLLRDNORM);
        return mask;
 }
-EXPORT_SYMBOL(udp_poll_mask);
+EXPORT_SYMBOL(udp_poll);
 int udp_abort(struct sock *sk, int err)
 {
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 74f2a261e8df..9ed0eae91758 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -570,7 +570,7 @@ const struct proto_ops inet6_stream_ops = {
        .socketpair        = sock_no_socketpair,        /* a do nothing */
        .accept            = inet_accept,               /* ok           */
        .getname           = inet6_getname,
-        .poll_mask         = tcp_poll_mask,             /* ok           */
+        .poll              = tcp_poll,                  /* ok           */
        .ioctl             = inet6_ioctl,               /* must change  */
        .listen            = inet_listen,               /* ok           */
        .shutdown          = inet_shutdown,             /* ok           */
@@ -603,7 +603,7 @@ const struct proto_ops inet6_dgram_ops = {
        .socketpair        = sock_no_socketpair,        /* a do nothing */
        .accept            = sock_no_accept,            /* a do nothing */
        .getname           = inet6_getname,
-        .poll_mask         = udp_poll_mask,             /* ok           */
+        .poll              = udp_poll,                  /* ok           */
        .ioctl             = inet6_ioctl,               /* must change  */
        .listen            = sock_no_listen,            /* ok           */
        .shutdown          = inet_shutdown,             /* ok           */
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 2febe26de6a1..595ad408dba0 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -113,9 +113,9 @@ static inline int compute_score(struct sock *sk, struct net *net,
                        bool dev_match = (sk->sk_bound_dev_if == dif ||
                                          sk->sk_bound_dev_if == sdif);
-                        if (exact_dif && !dev_match)
+                        if (!dev_match)
                                return -1;
-                        if (sk->sk_bound_dev_if && dev_match)
+                        if (sk->sk_bound_dev_if)
                                score++;
                }
                if (sk->sk_incoming_cpu == raw_smp_processor_id())
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 39d1d487eca2..1fb2f3118d60 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -167,8 +167,9 @@ struct fib6_info *fib6_info_alloc(gfp_t gfp_flags)
        return f6i;
 }
-void fib6_info_destroy(struct fib6_info *f6i)
+void fib6_info_destroy_rcu(struct rcu_head *head)
 {
+        struct fib6_info *f6i = container_of(head, struct fib6_info, rcu);
        struct rt6_exception_bucket *bucket;
        struct dst_metrics *m;
@@ -206,7 +207,7 @@ void fib6_info_destroy(struct fib6_info *f6i)
        kfree(f6i);
 }
-EXPORT_SYMBOL_GPL(fib6_info_destroy);
+EXPORT_SYMBOL_GPL(fib6_info_destroy_rcu);
 static struct fib6_node *node_alloc(struct net *net)
 {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 021e5aef6ba3..a14fb4fcdf18 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1219,7 +1219,8 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
        if (mtu < IPV6_MIN_MTU)
                return -EINVAL;
        cork->base.fragsize = mtu;
-        cork->base.gso_size = sk->sk_type == SOCK_DGRAM ? ipc6->gso_size : 0;
+        cork->base.gso_size = sk->sk_type == SOCK_DGRAM &&
+                              sk->sk_protocol == IPPROTO_UDP ? ipc6->gso_size : 0;
        if (dst_allfrag(xfrm_dst_path(&rt->dst)))
                cork->base.flags |= IPCORK_ALLFRAG;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 975021df7c1c..c0c74088f2af 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2082,7 +2082,8 @@ void ipv6_mc_dad_complete(struct inet6_dev *idev)
                mld_send_initial_cr(idev);
                idev->mc_dad_count--;
                if (idev->mc_dad_count)
-                        mld_dad_start_timer(idev, idev->mc_maxdelay);
+                        mld_dad_start_timer(idev,
+                                            unsolicited_report_interval(idev));
        }
 }
@@ -2094,7 +2095,8 @@ static void mld_dad_timer_expire(struct timer_list *t)
        if (idev->mc_dad_count) {
                idev->mc_dad_count--;
                if (idev->mc_dad_count)
-                        mld_dad_start_timer(idev, idev->mc_maxdelay);
+                        mld_dad_start_timer(idev,
+                                            unsolicited_report_interval(idev));
        }
        in6_dev_put(idev);
 }
@@ -2452,7 +2454,8 @@ static void mld_ifc_timer_expire(struct timer_list *t)
        if (idev->mc_ifc_count) {
                idev->mc_ifc_count--;
                if (idev->mc_ifc_count)
-                        mld_ifc_start_timer(idev, idev->mc_maxdelay);
+                        mld_ifc_start_timer(idev,
+                                            unsolicited_report_interval(idev));
        }
        in6_dev_put(idev);
 }
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index ce6f0d15b5dd..afc307c89d1a 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1334,7 +1334,7 @@ void raw6_proc_exit(void)
 }
 #endif  /* CONFIG_PROC_FS */
-/* Same as inet6_dgram_ops, sans udp_poll_mask.  */
+/* Same as inet6_dgram_ops, sans udp_poll.  */
 const struct proto_ops inet6_sockraw_ops = {
        .family            = PF_INET6,
        .owner             = THIS_MODULE,
@@ -1344,7 +1344,7 @@ const struct proto_ops inet6_sockraw_ops = {
        .socketpair        = sock_no_socketpair,        /* a do nothing */
        .accept            = sock_no_accept,            /* a do nothing */
        .getname           = inet6_getname,
-        .poll_mask         = datagram_poll_mask,        /* ok           */
+        .poll              = datagram_poll,             /* ok           */
        .ioctl             = inet6_ioctl,               /* must change  */
        .listen            = sock_no_listen,            /* ok           */
        .shutdown          = inet_shutdown,             /* ok           */
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 68e86257a549..893a022f9620 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1488,11 +1488,14 @@ static inline __poll_t iucv_accept_poll(struct sock *parent)
        return 0;
 }
-static __poll_t iucv_sock_poll_mask(struct socket *sock, __poll_t events)
+__poll_t iucv_sock_poll(struct file *file, struct socket *sock,
+                            poll_table *wait)
 {
        struct sock *sk = sock->sk;
        __poll_t mask = 0;
+        sock_poll_wait(file, sk_sleep(sk), wait);
        if (sk->sk_state == IUCV_LISTEN)
                return iucv_accept_poll(sk);
@@ -2385,7 +2388,7 @@ static const struct proto_ops iucv_sock_ops = {
        .getname        = iucv_sock_getname,
        .sendmsg        = iucv_sock_sendmsg,
        .recvmsg        = iucv_sock_recvmsg,
-        .poll_mask      = iucv_sock_poll_mask,
+        .poll           = iucv_sock_poll,
        .ioctl          = sock_no_ioctl,
        .mmap           = sock_no_mmap,
        .socketpair     = sock_no_socketpair,
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 84b7d5c6fec8..d3601d421571 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1336,9 +1336,9 @@ static void init_kcm_sock(struct kcm_sock *kcm, struct kcm_mux *mux)
        struct list_head *head;
        int index = 0;
-        /* For SOCK_SEQPACKET sock type, datagram_poll_mask checks the sk_state,
+        /* For SOCK_SEQPACKET sock type, datagram_poll checks the sk_state, so
-         * so  we set sk_state, otherwise epoll_wait always returns right away
+         * we set sk_state, otherwise epoll_wait always returns right away with
-         * with EPOLLHUP
+         * EPOLLHUP
         */
        kcm->sk.sk_state = TCP_ESTABLISHED;
@@ -1903,7 +1903,7 @@ static const struct proto_ops kcm_dgram_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       sock_no_accept,
        .getname =      sock_no_getname,
-        .poll_mask =    datagram_poll_mask,
+        .poll =         datagram_poll,
        .ioctl =        kcm_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     sock_no_shutdown,
@@ -1924,7 +1924,7 @@ static const struct proto_ops kcm_seqpacket_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       sock_no_accept,
        .getname =      sock_no_getname,
-        .poll_mask =    datagram_poll_mask,
+        .poll =         datagram_poll,
        .ioctl =        kcm_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     sock_no_shutdown,
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 8bdc1cbe490a..5e1d2946ffbf 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3751,7 +3751,7 @@ static const struct proto_ops pfkey_ops = {
        /* Now the operations that really occur. */
        .release        =       pfkey_release,
-        .poll_mask      =       datagram_poll_mask,
+        .poll           =       datagram_poll,
        .sendmsg        =       pfkey_sendmsg,
        .recvmsg        =       pfkey_recvmsg,
 };
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 181073bf6925..a9c05b2bc1b0 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -613,7 +613,7 @@ static const struct proto_ops l2tp_ip_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = sock_no_accept,
        .getname           = l2tp_ip_getname,
-        .poll_mask         = datagram_poll_mask,
+        .poll              = datagram_poll,
        .ioctl             = inet_ioctl,
        .listen            = sock_no_listen,
        .shutdown          = inet_shutdown,
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 336e4c00abbc..957369192ca1 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -754,7 +754,7 @@ static const struct proto_ops l2tp_ip6_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = sock_no_accept,
        .getname           = l2tp_ip6_getname,
-        .poll_mask         = datagram_poll_mask,
+        .poll              = datagram_poll,
        .ioctl             = inet6_ioctl,
        .listen            = sock_no_listen,
        .shutdown          = inet_shutdown,
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 55188382845c..e398797878a9 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1818,7 +1818,7 @@ static const struct proto_ops pppol2tp_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = pppol2tp_getname,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
        .setsockopt     = pppol2tp_setsockopt,
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 804de8490186..1beeea9549fa 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -1192,7 +1192,7 @@ static const struct proto_ops llc_ui_ops = {
        .socketpair  = sock_no_socketpair,
        .accept      = llc_ui_accept,
        .getname     = llc_ui_getname,
-        .poll_mask   = datagram_poll_mask,
+        .poll        = datagram_poll,
        .ioctl       = llc_ui_ioctl,
        .listen      = llc_ui_listen,
        .shutdown    = llc_ui_shutdown,
diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c
index e7b05de1e6d1..25e483e8278b 100644
--- a/net/ncsi/ncsi-aen.c
+++ b/net/ncsi/ncsi-aen.c
@@ -73,8 +73,8 @@ static int ncsi_aen_handler_lsc(struct ncsi_dev_priv *ndp,
        ncm->data[2] = data;
        ncm->data[4] = ntohl(lsc->oem_status);
-        netdev_info(ndp->ndev.dev, "NCSI: LSC AEN - channel %u state %s\n",
+        netdev_dbg(ndp->ndev.dev, "NCSI: LSC AEN - channel %u state %s\n",
-                    nc->id, data & 0x1 ? "up" : "down");
+                   nc->id, data & 0x1 ? "up" : "down");
        chained = !list_empty(&nc->link);
        state = nc->state;
@@ -148,9 +148,9 @@ static int ncsi_aen_handler_hncdsc(struct ncsi_dev_priv *ndp,
        hncdsc = (struct ncsi_aen_hncdsc_pkt *)h;
        ncm->data[3] = ntohl(hncdsc->status);
        spin_unlock_irqrestore(&nc->lock, flags);
-        netdev_printk(KERN_DEBUG, ndp->ndev.dev,
+        netdev_dbg(ndp->ndev.dev,
-                      "NCSI: host driver %srunning on channel %u\n",
+                   "NCSI: host driver %srunning on channel %u\n",
-                      ncm->data[3] & 0x1 ? "" : "not ", nc->id);
+                   ncm->data[3] & 0x1 ? "" : "not ", nc->id);
        return 0;
 }
diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
index 5561e221b71f..091284760d21 100644
--- a/net/ncsi/ncsi-manage.c
+++ b/net/ncsi/ncsi-manage.c
@@ -788,8 +788,8 @@ static void ncsi_configure_channel(struct ncsi_dev_priv *ndp)
                }
                break;
        case ncsi_dev_state_config_done:
-                netdev_printk(KERN_DEBUG, ndp->ndev.dev,
+                netdev_dbg(ndp->ndev.dev, "NCSI: channel %u config done\n",
-                              "NCSI: channel %u config done\n", nc->id);
+                           nc->id);
                spin_lock_irqsave(&nc->lock, flags);
                if (nc->reconfigure_needed) {
                        /* This channel's configuration has been updated
@@ -804,8 +804,7 @@ static void ncsi_configure_channel(struct ncsi_dev_priv *ndp)
                        list_add_tail_rcu(&nc->link, &ndp->channel_queue);
                        spin_unlock_irqrestore(&ndp->lock, flags);
-                        netdev_printk(KERN_DEBUG, dev,
+                        netdev_dbg(dev, "Dirty NCSI channel state reset\n");
-                                      "Dirty NCSI channel state reset\n");
                        ncsi_process_next_channel(ndp);
                        break;
                }
@@ -816,9 +815,9 @@ static void ncsi_configure_channel(struct ncsi_dev_priv *ndp)
                } else {
                        hot_nc = NULL;
                        nc->state = NCSI_CHANNEL_INACTIVE;
-                        netdev_warn(ndp->ndev.dev,
+                        netdev_dbg(ndp->ndev.dev,
-                                    "NCSI: channel %u link down after config\n",
+                                   "NCSI: channel %u link down after config\n",
-                                    nc->id);
+                                   nc->id);
                }
                spin_unlock_irqrestore(&nc->lock, flags);
@@ -908,9 +907,9 @@ static int ncsi_choose_active_channel(struct ncsi_dev_priv *ndp)
        }
        ncm = &found->modes[NCSI_MODE_LINK];
-        netdev_printk(KERN_DEBUG, ndp->ndev.dev,
+        netdev_dbg(ndp->ndev.dev,
-                      "NCSI: Channel %u added to queue (link %s)\n",
+                   "NCSI: Channel %u added to queue (link %s)\n",
-                      found->id, ncm->data[2] & 0x1 ? "up" : "down");
+                   found->id, ncm->data[2] & 0x1 ? "up" : "down");
 out:
        spin_lock_irqsave(&ndp->lock, flags);
@@ -1199,14 +1198,14 @@ int ncsi_process_next_channel(struct ncsi_dev_priv *ndp)
        switch (old_state) {
        case NCSI_CHANNEL_INACTIVE:
                ndp->ndev.state = ncsi_dev_state_config;
-                netdev_info(ndp->ndev.dev, "NCSI: configuring channel %u\n",
+                netdev_dbg(ndp->ndev.dev, "NCSI: configuring channel %u\n",
-                            nc->id);
+                           nc->id);
                ncsi_configure_channel(ndp);
                break;
        case NCSI_CHANNEL_ACTIVE:
                ndp->ndev.state = ncsi_dev_state_suspend;
-                netdev_info(ndp->ndev.dev, "NCSI: suspending channel %u\n",
+                netdev_dbg(ndp->ndev.dev, "NCSI: suspending channel %u\n",
-                            nc->id);
+                           nc->id);
                ncsi_suspend_channel(ndp);
                break;
        default:
@@ -1226,8 +1225,6 @@ out:
                return ncsi_choose_active_channel(ndp);
        }
-        netdev_printk(KERN_DEBUG, ndp->ndev.dev,
-                      "NCSI: No more channels to process\n");
        ncsi_report_link(ndp, false);
        return -ENODEV;
 }
@@ -1318,9 +1315,9 @@ static int ncsi_kick_channels(struct ncsi_dev_priv *ndp)
                                if ((ndp->ndev.state & 0xff00) ==
                                                ncsi_dev_state_config ||
                                                !list_empty(&nc->link)) {
-                                        netdev_printk(KERN_DEBUG, nd->dev,
+                                        netdev_dbg(nd->dev,
-                                                      "NCSI: channel %p marked dirty\n",
+                                                   "NCSI: channel %p marked dirty\n",
-                                                      nc);
+                                                   nc);
                                        nc->reconfigure_needed = true;
                                }
                                spin_unlock_irqrestore(&nc->lock, flags);
@@ -1338,8 +1335,7 @@ static int ncsi_kick_channels(struct ncsi_dev_priv *ndp)
                        list_add_tail_rcu(&nc->link, &ndp->channel_queue);
                        spin_unlock_irqrestore(&ndp->lock, flags);
-                        netdev_printk(KERN_DEBUG, nd->dev,
+                        netdev_dbg(nd->dev, "NCSI: kicked channel %p\n", nc);
-                                      "NCSI: kicked channel %p\n", nc);
                        n++;
                }
        }
@@ -1370,8 +1366,8 @@ int ncsi_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
        list_for_each_entry_rcu(vlan, &ndp->vlan_vids, list) {
                n_vids++;
                if (vlan->vid == vid) {
-                        netdev_printk(KERN_DEBUG, dev,
+                        netdev_dbg(dev, "NCSI: vid %u already registered\n",
-                                      "NCSI: vid %u already registered\n", vid);
+                                   vid);
                        return 0;
                }
        }
@@ -1390,7 +1386,7 @@ int ncsi_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
        vlan->vid = vid;
        list_add_rcu(&vlan->list, &ndp->vlan_vids);
-        netdev_printk(KERN_DEBUG, dev, "NCSI: Added new vid %u\n", vid);
+        netdev_dbg(dev, "NCSI: Added new vid %u\n", vid);
        found = ncsi_kick_channels(ndp) != 0;
@@ -1419,8 +1415,7 @@ int ncsi_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid)
        /* Remove the VLAN id from our internal list */
        list_for_each_entry_safe(vlan, tmp, &ndp->vlan_vids, list)
                if (vlan->vid == vid) {
-                        netdev_printk(KERN_DEBUG, dev,
+                        netdev_dbg(dev, "NCSI: vid %u found, removing\n", vid);
-                                      "NCSI: vid %u found, removing\n", vid);
                        list_del_rcu(&vlan->list);
                        found = true;
                        kfree(vlan);
@@ -1547,7 +1542,7 @@ void ncsi_stop_dev(struct ncsi_dev *nd)
                }
        }
-        netdev_printk(KERN_DEBUG, ndp->ndev.dev, "NCSI: Stopping device\n");
+        netdev_dbg(ndp->ndev.dev, "NCSI: Stopping device\n");
        ncsi_report_link(ndp, true);
 }
 EXPORT_SYMBOL_GPL(ncsi_stop_dev);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 1189b84413d5..393573a99a5a 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2658,7 +2658,7 @@ static const struct proto_ops netlink_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       sock_no_accept,
        .getname =      netlink_getname,
-        .poll_mask =    datagram_poll_mask,
+        .poll =         datagram_poll,
        .ioctl =        netlink_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     sock_no_shutdown,
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 93fbcafbf388..03f37c4e64fe 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1355,7 +1355,7 @@ static const struct proto_ops nr_proto_ops = {
        .socketpair     =       sock_no_socketpair,
        .accept         =       nr_accept,
        .getname        =       nr_getname,
-        .poll_mask      =       datagram_poll_mask,
+        .poll           =       datagram_poll,
        .ioctl          =       nr_ioctl,
        .listen         =       nr_listen,
        .shutdown       =       sock_no_shutdown,
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index ab5bb14b49af..ea0c0c6f1874 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -548,13 +548,16 @@ static inline __poll_t llcp_accept_poll(struct sock *parent)
        return 0;
 }
-static __poll_t llcp_sock_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t llcp_sock_poll(struct file *file, struct socket *sock,
+                                   poll_table *wait)
 {
        struct sock *sk = sock->sk;
        __poll_t mask = 0;
        pr_debug("%p\n", sk);
+        sock_poll_wait(file, sk_sleep(sk), wait);
        if (sk->sk_state == LLCP_LISTEN)
                return llcp_accept_poll(sk);
@@ -896,7 +899,7 @@ static const struct proto_ops llcp_sock_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = llcp_sock_accept,
        .getname        = llcp_sock_getname,
-        .poll_mask      = llcp_sock_poll_mask,
+        .poll           = llcp_sock_poll,
        .ioctl          = sock_no_ioctl,
        .listen         = llcp_sock_listen,
        .shutdown       = sock_no_shutdown,
@@ -916,7 +919,7 @@ static const struct proto_ops llcp_rawsock_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = llcp_sock_getname,
-        .poll_mask      = llcp_sock_poll_mask,
+        .poll           = llcp_sock_poll,
        .ioctl          = sock_no_ioctl,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index 60c322531c49..e2188deb08dc 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -284,7 +284,7 @@ static const struct proto_ops rawsock_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = sock_no_getname,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .ioctl          = sock_no_ioctl,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
@@ -304,7 +304,7 @@ static const struct proto_ops rawsock_raw_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = sock_no_getname,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .ioctl          = sock_no_ioctl,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 50809748c127..57634bc3da74 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2262,6 +2262,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
                if (po->stats.stats1.tp_drops)
                        status |= TP_STATUS_LOSING;
        }
+        if (do_vnet &&
+            virtio_net_hdr_from_skb(skb, h.raw + macoff -
+                                    sizeof(struct virtio_net_hdr),
+                                    vio_le(), true, 0))
+                goto drop_n_account;
        po->stats.stats1.tp_packets++;
        if (copy_skb) {
                status |= TP_STATUS_COPY;
@@ -2269,15 +2276,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
        }
        spin_unlock(&sk->sk_receive_queue.lock);
-        if (do_vnet) {
-                if (virtio_net_hdr_from_skb(skb, h.raw + macoff -
-                                            sizeof(struct virtio_net_hdr),
-                                            vio_le(), true, 0)) {
-                        spin_lock(&sk->sk_receive_queue.lock);
-                        goto drop_n_account;
-                }
-        }
        skb_copy_bits(skb, 0, h.raw + macoff, snaplen);
        if (!(ts_status = tpacket_get_timestamp(skb, &ts, po->tp_tstamp)))
@@ -4078,11 +4076,12 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
        return 0;
 }
-static __poll_t packet_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t packet_poll(struct file *file, struct socket *sock,
+                                poll_table *wait)
 {
        struct sock *sk = sock->sk;
        struct packet_sock *po = pkt_sk(sk);
-        __poll_t mask = datagram_poll_mask(sock, events);
+        __poll_t mask = datagram_poll(file, sock, wait);
        spin_lock_bh(&sk->sk_receive_queue.lock);
        if (po->rx_ring.pg_vec) {
@@ -4424,7 +4423,7 @@ static const struct proto_ops packet_ops_spkt = {
        .socketpair =   sock_no_socketpair,
        .accept =       sock_no_accept,
        .getname =      packet_getname_spkt,
-        .poll_mask =    datagram_poll_mask,
+        .poll =         datagram_poll,
        .ioctl =        packet_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     sock_no_shutdown,
@@ -4445,7 +4444,7 @@ static const struct proto_ops packet_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       sock_no_accept,
        .getname =      packet_getname,
-        .poll_mask =    packet_poll_mask,
+        .poll =         packet_poll,
        .ioctl =        packet_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     sock_no_shutdown,
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index c295c4e20f01..30187990257f 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -340,12 +340,15 @@ static int pn_socket_getname(struct socket *sock, struct sockaddr *addr,
        return sizeof(struct sockaddr_pn);
 }
-static __poll_t pn_socket_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t pn_socket_poll(struct file *file, struct socket *sock,
+                                        poll_table *wait)
 {
        struct sock *sk = sock->sk;
        struct pep_sock *pn = pep_sk(sk);
        __poll_t mask = 0;
+        poll_wait(file, sk_sleep(sk), wait);
        if (sk->sk_state == TCP_CLOSE)
                return EPOLLERR;
        if (!skb_queue_empty(&sk->sk_receive_queue))
@@ -445,7 +448,7 @@ const struct proto_ops phonet_dgram_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = pn_socket_getname,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .ioctl          = pn_socket_ioctl,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
@@ -470,7 +473,7 @@ const struct proto_ops phonet_stream_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = pn_socket_accept,
        .getname        = pn_socket_getname,
-        .poll_mask      = pn_socket_poll_mask,
+        .poll           = pn_socket_poll,
        .ioctl          = pn_socket_ioctl,
        .listen         = pn_socket_listen,
        .shutdown       = sock_no_shutdown,
diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index 1b5025ea5b04..2aa07b547b16 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -1023,7 +1023,7 @@ static const struct proto_ops qrtr_proto_ops = {
        .recvmsg        = qrtr_recvmsg,
        .getname        = qrtr_getname,
        .ioctl          = qrtr_ioctl,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .shutdown       = sock_no_shutdown,
        .setsockopt     = sock_no_setsockopt,
        .getsockopt     = sock_no_getsockopt,
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index ebe42e7eb456..d00a0ef39a56 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1470,7 +1470,7 @@ static const struct proto_ops rose_proto_ops = {
        .socketpair     =       sock_no_socketpair,
        .accept         =       rose_accept,
        .getname        =       rose_getname,
-        .poll_mask      =       datagram_poll_mask,
+        .poll           =       datagram_poll,
        .ioctl          =       rose_ioctl,
        .listen         =       rose_listen,
        .shutdown       =       sock_no_shutdown,
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 3b1ac93efee2..2b463047dd7b 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -734,11 +734,15 @@ static int rxrpc_getsockopt(struct socket *sock, int level, int optname,
 /*
 * permit an RxRPC socket to be polled
 */
-static __poll_t rxrpc_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t rxrpc_poll(struct file *file, struct socket *sock,
+                               poll_table *wait)
 {
        struct sock *sk = sock->sk;
        struct rxrpc_sock *rx = rxrpc_sk(sk);
-        __poll_t mask = 0;
+        __poll_t mask;
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
        /* the socket is readable if there are any messages waiting on the Rx
         * queue */
@@ -945,7 +949,7 @@ static const struct proto_ops rxrpc_rpc_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = sock_no_getname,
-        .poll_mask      = rxrpc_poll_mask,
+        .poll           = rxrpc_poll,
        .ioctl          = sock_no_ioctl,
        .listen         = rxrpc_listen,
        .shutdown       = rxrpc_shutdown,
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 8527cfdc446d..20d7d36b2fc9 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -415,7 +415,8 @@ static void tcf_ife_cleanup(struct tc_action *a)
        spin_unlock_bh(&ife->tcf_lock);
        p = rcu_dereference_protected(ife->params, 1);
-        kfree_rcu(p, rcu);
+        if (p)
+                kfree_rcu(p, rcu);
 }
 /* under ife->tcf_lock for existing action */
@@ -516,8 +517,6 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
                        saddr = nla_data(tb[TCA_IFE_SMAC]);
        }
-        ife->tcf_action = parm->action;
        if (parm->flags & IFE_ENCODE) {
                if (daddr)
                        ether_addr_copy(p->eth_dst, daddr);
@@ -543,10 +542,8 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
                                       NULL, NULL);
                if (err) {
 metadata_parse_err:
-                        if (exists)
-                                tcf_idr_release(*a, bind);
                        if (ret == ACT_P_CREATED)
-                                _tcf_ife_cleanup(*a);
+                                tcf_idr_release(*a, bind);
                        if (exists)
                                spin_unlock_bh(&ife->tcf_lock);
@@ -567,7 +564,7 @@ metadata_parse_err:
                err = use_all_metadata(ife);
                if (err) {
                        if (ret == ACT_P_CREATED)
-                                _tcf_ife_cleanup(*a);
+                                tcf_idr_release(*a, bind);
                        if (exists)
                                spin_unlock_bh(&ife->tcf_lock);
@@ -576,6 +573,7 @@ metadata_parse_err:
                }
        }
+        ife->tcf_action = parm->action;
        if (exists)
                spin_unlock_bh(&ife->tcf_lock);
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 2b5be42a9f1c..9e8b26a80fb3 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -66,7 +66,7 @@ struct fl_flow_mask {
        struct rhashtable_params filter_ht_params;
        struct flow_dissector dissector;
        struct list_head filters;
-        struct rcu_head rcu;
+        struct rcu_work rwork;
        struct list_head list;
 };
@@ -203,6 +203,20 @@ static int fl_init(struct tcf_proto *tp)
        return rhashtable_init(&head->ht, &mask_ht_params);
 }
+static void fl_mask_free(struct fl_flow_mask *mask)
+{
+        rhashtable_destroy(&mask->ht);
+        kfree(mask);
+}
+static void fl_mask_free_work(struct work_struct *work)
+{
+        struct fl_flow_mask *mask = container_of(to_rcu_work(work),
+                                                 struct fl_flow_mask, rwork);
+        fl_mask_free(mask);
+}
 static bool fl_mask_put(struct cls_fl_head *head, struct fl_flow_mask *mask,
                        bool async)
 {
@@ -210,12 +224,11 @@ static bool fl_mask_put(struct cls_fl_head *head, struct fl_flow_mask *mask,
                return false;
        rhashtable_remove_fast(&head->ht, &mask->ht_node, mask_ht_params);
-        rhashtable_destroy(&mask->ht);
        list_del_rcu(&mask->list);
        if (async)
-                kfree_rcu(mask, rcu);
+                tcf_queue_work(&mask->rwork, fl_mask_free_work);
        else
-                kfree(mask);
+                fl_mask_free(mask);
        return true;
 }
diff --git a/net/sched/sch_blackhole.c b/net/sched/sch_blackhole.c
index c98a61e980ba..9c4c2bb547d7 100644
--- a/net/sched/sch_blackhole.c
+++ b/net/sched/sch_blackhole.c
@@ -21,7 +21,7 @@ static int blackhole_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                             struct sk_buff **to_free)
 {
        qdisc_drop(skb, sch, to_free);
-        return NET_XMIT_SUCCESS;
+        return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
 }
 static struct sk_buff *blackhole_dequeue(struct Qdisc *sch)
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 3ae9877ea205..3278a76f6861 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1385,8 +1385,8 @@ hfsc_schedule_watchdog(struct Qdisc *sch)
                if (next_time == 0 || next_time > q->root.cl_cfmin)
                        next_time = q->root.cl_cfmin;
        }
-        WARN_ON(next_time == 0);
+        if (next_time)
-        qdisc_watchdog_schedule(&q->watchdog, next_time);
+                qdisc_watchdog_schedule(&q->watchdog, next_time);
 }
 static int
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 79daa98208c3..bfb9f812e2ef 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -237,7 +237,9 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
        /* Account for a different sized first fragment */
        if (msg_len >= first_len) {
                msg->can_delay = 0;
-                SCTP_INC_STATS(sock_net(asoc->base.sk), SCTP_MIB_FRAGUSRMSGS);
+                if (msg_len > first_len)
+                        SCTP_INC_STATS(sock_net(asoc->base.sk),
+                                       SCTP_MIB_FRAGUSRMSGS);
        } else {
                /* Which may be the only one... */
                first_len = msg_len;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 7339918a805d..0cd2e764f47f 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -1010,7 +1010,7 @@ static const struct proto_ops inet6_seqpacket_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = inet_accept,
        .getname           = sctp_getname,
-        .poll_mask         = sctp_poll_mask,
+        .poll              = sctp_poll,
        .ioctl             = inet6_ioctl,
        .listen            = sctp_inet_listen,
        .shutdown          = inet_shutdown,
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 5dffbc493008..67f73d3a1356 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1016,7 +1016,7 @@ static const struct proto_ops inet_seqpacket_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = inet_accept,
        .getname           = inet_getname,      /* Semantics are different.  */
-        .poll_mask         = sctp_poll_mask,
+        .poll              = sctp_poll,
        .ioctl             = inet_ioctl,
        .listen            = sctp_inet_listen,
        .shutdown          = inet_shutdown,     /* Looks harmless.  */
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index d20f7addee19..ce620e878538 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -7717,12 +7717,14 @@ out:
 * here, again, by modeling the current TCP/UDP code.  We don't have
 * a good way to test with it yet.
 */
-__poll_t sctp_poll_mask(struct socket *sock, __poll_t events)
+__poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
        struct sock *sk = sock->sk;
        struct sctp_sock *sp = sctp_sk(sk);
        __poll_t mask;
+        poll_wait(file, sk_sleep(sk), wait);
        sock_rps_record_flow(sk);
        /* A TCP-style listening socket becomes readable when the accept queue
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index da7f02edcd37..973b4471b532 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1273,7 +1273,8 @@ static __poll_t smc_accept_poll(struct sock *parent)
        return mask;
 }
-static __poll_t smc_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t smc_poll(struct file *file, struct socket *sock,
+                             poll_table *wait)
 {
        struct sock *sk = sock->sk;
        __poll_t mask = 0;
@@ -1289,7 +1290,7 @@ static __poll_t smc_poll_mask(struct socket *sock, __poll_t events)
        if ((sk->sk_state == SMC_INIT) || smc->use_fallback) {
                /* delegate to CLC child sock */
                release_sock(sk);
-                mask = smc->clcsock->ops->poll_mask(smc->clcsock, events);
+                mask = smc->clcsock->ops->poll(file, smc->clcsock, wait);
                lock_sock(sk);
                sk->sk_err = smc->clcsock->sk->sk_err;
                if (sk->sk_err) {
@@ -1307,6 +1308,11 @@ static __poll_t smc_poll_mask(struct socket *sock, __poll_t events)
                        }
                }
        } else {
+                if (sk->sk_state != SMC_CLOSED) {
+                        release_sock(sk);
+                        sock_poll_wait(file, sk_sleep(sk), wait);
+                        lock_sock(sk);
+                }
                if (sk->sk_err)
                        mask |= EPOLLERR;
                if ((sk->sk_shutdown == SHUTDOWN_MASK) ||
@@ -1619,7 +1625,7 @@ static const struct proto_ops smc_sock_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = smc_accept,
        .getname        = smc_getname,
-        .poll_mask      = smc_poll_mask,
+        .poll           = smc_poll,
        .ioctl          = smc_ioctl,
        .listen         = smc_listen,
        .shutdown       = smc_shutdown,
diff --git a/net/socket.c b/net/socket.c
index 8a109012608a..85633622c94d 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -117,10 +117,8 @@ static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
 static int sock_mmap(struct file *file, struct vm_area_struct *vma);
 static int sock_close(struct inode *inode, struct file *file);
-static struct wait_queue_head *sock_get_poll_head(struct file *file,
+static __poll_t sock_poll(struct file *file,
-                __poll_t events);
+                              struct poll_table_struct *wait);
-static __poll_t sock_poll_mask(struct file *file, __poll_t);
-static __poll_t sock_poll(struct file *file, struct poll_table_struct *wait);
 static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 #ifdef CONFIG_COMPAT
 static long compat_sock_ioctl(struct file *file,
@@ -143,8 +141,6 @@ static const struct file_operations socket_file_ops = {
        .llseek =       no_llseek,
        .read_iter =    sock_read_iter,
        .write_iter =   sock_write_iter,
-        .get_poll_head = sock_get_poll_head,
-        .poll_mask =    sock_poll_mask,
        .poll =         sock_poll,
        .unlocked_ioctl = sock_ioctl,
 #ifdef CONFIG_COMPAT
@@ -1130,48 +1126,16 @@ out_release:
 }
 EXPORT_SYMBOL(sock_create_lite);
-static struct wait_queue_head *sock_get_poll_head(struct file *file,
-                __poll_t events)
-{
-        struct socket *sock = file->private_data;
-        if (!sock->ops->poll_mask)
-                return NULL;
-        sock_poll_busy_loop(sock, events);
-        return sk_sleep(sock->sk);
-}
-static __poll_t sock_poll_mask(struct file *file, __poll_t events)
-{
-        struct socket *sock = file->private_data;
-        /*
-         * We need to be sure we are in sync with the socket flags modification.
-         *
-         * This memory barrier is paired in the wq_has_sleeper.
-         */
-        smp_mb();
-        /* this socket can poll_ll so tell the system call */
-        return sock->ops->poll_mask(sock, events) |
-                (sk_can_busy_loop(sock->sk) ? POLL_BUSY_LOOP : 0);
-}
 /* No kernel lock held - perfect */
 static __poll_t sock_poll(struct file *file, poll_table *wait)
 {
        struct socket *sock = file->private_data;
-        __poll_t events = poll_requested_events(wait), mask = 0;
+        __poll_t events = poll_requested_events(wait);
-        if (sock->ops->poll) {
-                sock_poll_busy_loop(sock, events);
-                mask = sock->ops->poll(file, sock, wait);
-        } else if (sock->ops->poll_mask) {
-                sock_poll_wait(file, sock_get_poll_head(file, events), wait);
-                mask = sock->ops->poll_mask(sock, events);
-        }
-        return mask | sock_poll_busy_flag(sock);
+        sock_poll_busy_loop(sock, events);
+        if (!sock->ops->poll)
+                return 0;
+        return sock->ops->poll(file, sock, wait) | sock_poll_busy_flag(sock);
 }
 static int sock_mmap(struct file *file, struct vm_area_struct *vma)
diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index 1a9695183599..373836615c57 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -392,7 +392,7 @@ static int strp_read_sock(struct strparser *strp)
 /* Lower sock lock held */
 void strp_data_ready(struct strparser *strp)
 {
-        if (unlikely(strp->stopped))
+        if (unlikely(strp->stopped) || strp->paused)
                return;
        /* This check is needed to synchronize with do_strp_work.
@@ -407,9 +407,6 @@ void strp_data_ready(struct strparser *strp)
                return;
        }
-        if (strp->paused)
-                return;
        if (strp->need_bytes) {
                if (strp_peek_len(strp) < strp->need_bytes)
                        return;
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 3c85af058227..3fabf9f6a0f9 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -987,8 +987,6 @@ bool xprt_prepare_transmit(struct rpc_task *task)
                task->tk_status = -EAGAIN;
                goto out_unlock;
        }
-        if (!bc_prealloc(req) && !req->rq_xmit_bytes_sent)
-                req->rq_xid = xprt_alloc_xid(xprt);
        ret = true;
 out_unlock:
        spin_unlock_bh(&xprt->transport_lock);
@@ -1298,7 +1296,12 @@ void xprt_retry_reserve(struct rpc_task *task)
 static inline __be32 xprt_alloc_xid(struct rpc_xprt *xprt)
 {
-        return (__force __be32)xprt->xid++;
+        __be32 xid;
+        spin_lock(&xprt->reserve_lock);
+        xid = (__force __be32)xprt->xid++;
+        spin_unlock(&xprt->reserve_lock);
+        return xid;
 }
 static inline void xprt_init_xid(struct rpc_xprt *xprt)
@@ -1316,6 +1319,7 @@ void xprt_request_init(struct rpc_task *task)
        req->rq_task    = task;
        req->rq_xprt    = xprt;
        req->rq_buffer  = NULL;
+        req->rq_xid     = xprt_alloc_xid(xprt);
        req->rq_connect_cookie = xprt->connect_cookie - 1;
        req->rq_bytes_sent = 0;
        req->rq_snd_buf.len = 0;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 14a5d055717d..930852c54d7a 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -692,9 +692,10 @@ static int tipc_getname(struct socket *sock, struct sockaddr *uaddr,
 }
 /**
- * tipc_poll - read pollmask
+ * tipc_poll - read and possibly block on pollmask
 * @file: file structure associated with the socket
 * @sock: socket for which to calculate the poll bits
+ * @wait: ???
 *
 * Returns pollmask value
 *
@@ -708,12 +709,15 @@ static int tipc_getname(struct socket *sock, struct sockaddr *uaddr,
 * imply that the operation will succeed, merely that it should be performed
 * and will not block.
 */
-static __poll_t tipc_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t tipc_poll(struct file *file, struct socket *sock,
+                              poll_table *wait)
 {
        struct sock *sk = sock->sk;
        struct tipc_sock *tsk = tipc_sk(sk);
        __poll_t revents = 0;
+        sock_poll_wait(file, sk_sleep(sk), wait);
        if (sk->sk_shutdown & RCV_SHUTDOWN)
                revents |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
        if (sk->sk_shutdown == SHUTDOWN_MASK)
@@ -3033,7 +3037,7 @@ static const struct proto_ops msg_ops = {
        .socketpair     = tipc_socketpair,
        .accept         = sock_no_accept,
        .getname        = tipc_getname,
-        .poll_mask      = tipc_poll_mask,
+        .poll           = tipc_poll,
        .ioctl          = tipc_ioctl,
        .listen         = sock_no_listen,
        .shutdown       = tipc_shutdown,
@@ -3054,7 +3058,7 @@ static const struct proto_ops packet_ops = {
        .socketpair     = tipc_socketpair,
        .accept         = tipc_accept,
        .getname        = tipc_getname,
-        .poll_mask      = tipc_poll_mask,
+        .poll           = tipc_poll,
        .ioctl          = tipc_ioctl,
        .listen         = tipc_listen,
        .shutdown       = tipc_shutdown,
@@ -3075,7 +3079,7 @@ static const struct proto_ops stream_ops = {
        .socketpair     = tipc_socketpair,
        .accept         = tipc_accept,
        .getname        = tipc_getname,
-        .poll_mask      = tipc_poll_mask,
+        .poll           = tipc_poll,
        .ioctl          = tipc_ioctl,
        .listen         = tipc_listen,
        .shutdown       = tipc_shutdown,
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index a127d61e8af9..301f22430469 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -712,7 +712,7 @@ static int __init tls_register(void)
        build_protos(tls_prots[TLSV4], &tcp_prot);
        tls_sw_proto_ops = inet_stream_ops;
-        tls_sw_proto_ops.poll_mask = tls_sw_poll_mask;
+        tls_sw_proto_ops.poll = tls_sw_poll;
        tls_sw_proto_ops.splice_read = tls_sw_splice_read;
 #ifdef CONFIG_TLS_DEVICE
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index f127fac88acf..d2380548f8f6 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -919,22 +919,23 @@ splice_read_end:
        return copied ? : err;
 }
-__poll_t tls_sw_poll_mask(struct socket *sock, __poll_t events)
+unsigned int tls_sw_poll(struct file *file, struct socket *sock,
+                         struct poll_table_struct *wait)
 {
+        unsigned int ret;
        struct sock *sk = sock->sk;
        struct tls_context *tls_ctx = tls_get_ctx(sk);
        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
-        __poll_t mask;
-        /* Grab EPOLLOUT and EPOLLHUP from the underlying socket */
+        /* Grab POLLOUT and POLLHUP from the underlying socket */
-        mask = ctx->sk_poll_mask(sock, events);
+        ret = ctx->sk_poll(file, sock, wait);
-        /* Clear EPOLLIN bits, and set based on recv_pkt */
+        /* Clear POLLIN bits, and set based on recv_pkt */
-        mask &= ~(EPOLLIN | EPOLLRDNORM);
+        ret &= ~(POLLIN | POLLRDNORM);
        if (ctx->recv_pkt)
-                mask |= EPOLLIN | EPOLLRDNORM;
+                ret |= POLLIN | POLLRDNORM;
-        return mask;
+        return ret;
 }
 static int tls_read_size(struct strparser *strp, struct sk_buff *skb)
@@ -1191,7 +1192,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
                sk->sk_data_ready = tls_data_ready;
                write_unlock_bh(&sk->sk_callback_lock);
-                sw_ctx_rx->sk_poll_mask = sk->sk_socket->ops->poll_mask;
+                sw_ctx_rx->sk_poll = sk->sk_socket->ops->poll;
                strp_check_rcv(&sw_ctx_rx->strp);
        }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 95b02a71fd47..e5473c03d667 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -638,8 +638,9 @@ static int unix_stream_connect(struct socket *, struct sockaddr *,
 static int unix_socketpair(struct socket *, struct socket *);
 static int unix_accept(struct socket *, struct socket *, int, bool);
 static int unix_getname(struct socket *, struct sockaddr *, int);
-static __poll_t unix_poll_mask(struct socket *, __poll_t);
+static __poll_t unix_poll(struct file *, struct socket *, poll_table *);
-static __poll_t unix_dgram_poll_mask(struct socket *, __poll_t);
+static __poll_t unix_dgram_poll(struct file *, struct socket *,
+                                    poll_table *);
 static int unix_ioctl(struct socket *, unsigned int, unsigned long);
 static int unix_shutdown(struct socket *, int);
 static int unix_stream_sendmsg(struct socket *, struct msghdr *, size_t);
@@ -680,7 +681,7 @@ static const struct proto_ops unix_stream_ops = {
        .socketpair =   unix_socketpair,
        .accept =       unix_accept,
        .getname =      unix_getname,
-        .poll_mask =    unix_poll_mask,
+        .poll =         unix_poll,
        .ioctl =        unix_ioctl,
        .listen =       unix_listen,
        .shutdown =     unix_shutdown,
@@ -703,7 +704,7 @@ static const struct proto_ops unix_dgram_ops = {
        .socketpair =   unix_socketpair,
        .accept =       sock_no_accept,
        .getname =      unix_getname,
-        .poll_mask =    unix_dgram_poll_mask,
+        .poll =         unix_dgram_poll,
        .ioctl =        unix_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     unix_shutdown,
@@ -725,7 +726,7 @@ static const struct proto_ops unix_seqpacket_ops = {
        .socketpair =   unix_socketpair,
        .accept =       unix_accept,
        .getname =      unix_getname,
-        .poll_mask =    unix_dgram_poll_mask,
+        .poll =         unix_dgram_poll,
        .ioctl =        unix_ioctl,
        .listen =       unix_listen,
        .shutdown =     unix_shutdown,
@@ -2629,10 +2630,13 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
        return err;
 }
-static __poll_t unix_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
        struct sock *sk = sock->sk;
-        __poll_t mask = 0;
+        __poll_t mask;
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
        /* exceptional events? */
        if (sk->sk_err)
@@ -2661,11 +2665,15 @@ static __poll_t unix_poll_mask(struct socket *sock, __poll_t events)
        return mask;
 }
-static __poll_t unix_dgram_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
+                                    poll_table *wait)
 {
        struct sock *sk = sock->sk, *other;
-        int writable;
+        unsigned int writable;
-        __poll_t mask = 0;
+        __poll_t mask;
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
        /* exceptional events? */
        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
@@ -2691,7 +2699,7 @@ static __poll_t unix_dgram_poll_mask(struct socket *sock, __poll_t events)
        }
        /* No write status requested, avoid expensive OUT tests. */
-        if (!(events & (EPOLLWRBAND|EPOLLWRNORM|EPOLLOUT)))
+        if (!(poll_requested_events(wait) & (EPOLLWRBAND|EPOLLWRNORM|EPOLLOUT)))
                return mask;
        writable = unix_writable(sk);
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index bb5d5fa68c35..c1076c19b858 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -850,11 +850,18 @@ static int vsock_shutdown(struct socket *sock, int mode)
        return err;
 }
-static __poll_t vsock_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t vsock_poll(struct file *file, struct socket *sock,
+                               poll_table *wait)
 {
-        struct sock *sk = sock->sk;
+        struct sock *sk;
-        struct vsock_sock *vsk = vsock_sk(sk);
+        __poll_t mask;
-        __poll_t mask = 0;
+        struct vsock_sock *vsk;
+        sk = sock->sk;
+        vsk = vsock_sk(sk);
+        poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
        if (sk->sk_err)
                /* Signify that there has been an error on this socket. */
@@ -1084,7 +1091,7 @@ static const struct proto_ops vsock_dgram_ops = {
        .socketpair = sock_no_socketpair,
        .accept = sock_no_accept,
        .getname = vsock_getname,
-        .poll_mask = vsock_poll_mask,
+        .poll = vsock_poll,
        .ioctl = sock_no_ioctl,
        .listen = sock_no_listen,
        .shutdown = vsock_shutdown,
@@ -1842,7 +1849,7 @@ static const struct proto_ops vsock_stream_ops = {
        .socketpair = sock_no_socketpair,
        .accept = vsock_accept,
        .getname = vsock_getname,
-        .poll_mask = vsock_poll_mask,
+        .poll = vsock_poll,
        .ioctl = sock_no_ioctl,
        .listen = vsock_listen,
        .shutdown = vsock_shutdown,
diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
index 8e03bd3f3668..5d3cce9e8744 100644
--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
@@ -201,7 +201,7 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt)
                return -ENODEV;
        }
-        if (le32_to_cpu(pkt->hdr.dst_cid) == vsock->guest_cid)
+        if (le64_to_cpu(pkt->hdr.dst_cid) == vsock->guest_cid)
                return virtio_transport_send_pkt_loopback(vsock, pkt);
        if (pkt->reply)
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index f93365ae0fdd..d49aa79b7997 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1750,7 +1750,7 @@ static const struct proto_ops x25_proto_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       x25_accept,
        .getname =      x25_getname,
-        .poll_mask =    datagram_poll_mask,
+        .poll =         datagram_poll,
        .ioctl =        x25_ioctl,
 #ifdef CONFIG_COMPAT
        .compat_ioctl = compat_x25_ioctl,
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 36919a254ba3..59fb7d3c36a3 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -118,6 +118,9 @@ int xsk_generic_rcv(struct xdp_sock *xs, struct xdp_buff *xdp)
        u64 addr;
        int err;
+        if (xs->dev != xdp->rxq->dev || xs->queue_id != xdp->rxq->queue_index)
+                return -EINVAL;
        if (!xskq_peek_addr(xs->umem->fq, &addr) ||
            len > xs->umem->chunk_size_nohr) {
                xs->rx_dropped++;
@@ -300,9 +303,10 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
        return (xs->zc) ? xsk_zc_xmit(sk) : xsk_generic_xmit(sk, m, total_len);
 }
-static __poll_t xsk_poll_mask(struct socket *sock, __poll_t events)
+static unsigned int xsk_poll(struct file *file, struct socket *sock,
+                             struct poll_table_struct *wait)
 {
-        __poll_t mask = datagram_poll_mask(sock, events);
+        unsigned int mask = datagram_poll(file, sock, wait);
        struct sock *sk = sock->sk;
        struct xdp_sock *xs = xdp_sk(sk);
@@ -693,7 +697,7 @@ static const struct proto_ops xsk_proto_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = sock_no_getname,
-        .poll_mask      = xsk_poll_mask,
+        .poll           = xsk_poll,
        .ioctl          = sock_no_ioctl,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 34d9e9ce97c2..e7889f486ca1 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -239,6 +239,7 @@ cmd_record_mcount =						\
             "$(CC_FLAGS_FTRACE)" ]; then                       \
                $(sub_cmd_record_mcount)                        \
        fi;
+endif # -record-mcount
 endif # CONFIG_FTRACE_MCOUNT_RECORD
 ifdef CONFIG_STACK_VALIDATION
@@ -263,7 +264,6 @@ ifneq ($(RETPOLINE_CFLAGS),)
  objtool_args += --retpoline
 endif
 endif
-endif
 ifdef CONFIG_MODVERSIONS
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index e3b7362b0ee4..a9c05506e325 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -2606,12 +2606,6 @@ sub process {
                             "A patch subject line should describe the change not the tool that found it\n" . $herecurr);
                }
-# Check for old stable address
-                if ($line =~ /^\s*cc:\s*.*<?\bstable\@kernel\.org\b>?.*$/i) {
-                        ERROR("STABLE_ADDRESS",
-                              "The 'stable' address should be 'stable\@vger.kernel.org'\n" . $herecurr);
-                }
 # Check for unwanted Gerrit info
                if ($in_commit_log && $line =~ /^\s*change-id:/i) {
                        ERROR("GERRIT_CHANGE_ID",
diff --git a/scripts/gcc-x86_64-has-stack-protector.sh b/scripts/gcc-x86_64-has-stack-protector.sh
index 3755af0cd9f7..75e4e22b986a 100755
--- a/scripts/gcc-x86_64-has-stack-protector.sh
+++ b/scripts/gcc-x86_64-has-stack-protector.sh
@@ -1,4 +1,4 @@
 #!/bin/sh
 # SPDX-License-Identifier: GPL-2.0
-echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fno-PIE -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
+echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -m64 -O0 -mcmodel=kernel -fno-PIE -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
diff --git a/scripts/kconfig/expr.h b/scripts/kconfig/expr.h
index 94a383b21df6..f63b41b0dd49 100644
--- a/scripts/kconfig/expr.h
+++ b/scripts/kconfig/expr.h
@@ -171,6 +171,9 @@ struct symbol {
 * config BAZ
 *         int "BAZ Value"
 *         range 1..255
+ *
+ * Please, also check zconf.y:print_symbol() when modifying the
+ * list of property types!
 */
 enum prop_type {
        P_UNKNOWN,
diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
index 65da87fce907..5ca2df790d3c 100644
--- a/scripts/kconfig/preprocess.c
+++ b/scripts/kconfig/preprocess.c
@@ -156,7 +156,7 @@ static char *do_shell(int argc, char *argv[])
                nread--;
        /* remove trailing new lines */
-        while (buf[nread - 1] == '\n')
+        while (nread > 0 && buf[nread - 1] == '\n')
                nread--;
        buf[nread] = 0;
diff --git a/scripts/kconfig/zconf.y b/scripts/kconfig/zconf.y
index 6f9b0aa32a82..4b68272ebdb9 100644
--- a/scripts/kconfig/zconf.y
+++ b/scripts/kconfig/zconf.y
@@ -31,7 +31,7 @@ struct symbol *symbol_hash[SYMBOL_HASHSIZE];
 static struct menu *current_menu, *current_entry;
 %}
-%expect 32
+%expect 31
 %union
 {
@@ -337,7 +337,7 @@ choice_block:
 /* if entry */
-if_entry: T_IF expr nl
+if_entry: T_IF expr T_EOL
 {
        printd(DEBUG_PARSE, "%s:%d:if\n", zconf_curname(), zconf_lineno());
        menu_add_entry(NULL);
@@ -717,6 +717,10 @@ static void print_symbol(FILE *out, struct menu *menu)
                        print_quoted_string(out, prop->text);
                        fputc('\n', out);
                        break;
+                case P_SYMBOL:
+                        fputs( "  symbol ", out);
+                        fprintf(out, "%s\n", prop->sym->name);
+                        break;
                default:
                        fprintf(out, "  unknown prop %d!\n", prop->type);
                        break;
diff --git a/security/keys/dh.c b/security/keys/dh.c
index f7403821db7f..b203f7758f97 100644
--- a/security/keys/dh.c
+++ b/security/keys/dh.c
@@ -142,6 +142,8 @@ static void kdf_dealloc(struct kdf_sdesc *sdesc)
 * The src pointer is defined as Z || other info where Z is the shared secret
 * from DH and other info is an arbitrary string (see SP800-56A section
 * 5.8.1.2).
+ *
+ * 'dlen' must be a multiple of the digest size.
 */
 static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,
                   u8 *dst, unsigned int dlen, unsigned int zlen)
@@ -205,8 +207,8 @@ static int keyctl_dh_compute_kdf(struct kdf_sdesc *sdesc,
 {
        uint8_t *outbuf = NULL;
        int ret;
-        size_t outbuf_len = round_up(buflen,
+        size_t outbuf_len = roundup(buflen,
-                                     crypto_shash_digestsize(sdesc->shash.tfm));
+                                    crypto_shash_digestsize(sdesc->shash.tfm));
        outbuf = kmalloc(outbuf_len, GFP_KERNEL);
        if (!outbuf) {
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index f3d374d2ca04..79d3709b0671 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -441,22 +441,16 @@ static int sel_release_policy(struct inode *inode, struct file *filp)
 static ssize_t sel_read_policy(struct file *filp, char __user *buf,
                               size_t count, loff_t *ppos)
 {
-        struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
        struct policy_load_memory *plm = filp->private_data;
        int ret;
-        mutex_lock(&fsi->mutex);
        ret = avc_has_perm(&selinux_state,
                           current_sid(), SECINITSID_SECURITY,
                          SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL);
        if (ret)
-                goto out;
+                return ret;
-        ret = simple_read_from_buffer(buf, count, ppos, plm->data, plm->len);
+        return simple_read_from_buffer(buf, count, ppos, plm->data, plm->len);
-out:
-        mutex_unlock(&fsi->mutex);
-        return ret;
 }
 static vm_fault_t sel_mmap_policy_fault(struct vm_fault *vmf)
@@ -1188,25 +1182,29 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf,
        ret = -EINVAL;
        if (index >= fsi->bool_num || strcmp(name,
                                             fsi->bool_pending_names[index]))
-                goto out;
+                goto out_unlock;
        ret = -ENOMEM;
        page = (char *)get_zeroed_page(GFP_KERNEL);
        if (!page)
-                goto out;
+                goto out_unlock;
        cur_enforcing = security_get_bool_value(fsi->state, index);
        if (cur_enforcing < 0) {
                ret = cur_enforcing;
-                goto out;
+                goto out_unlock;
        }
        length = scnprintf(page, PAGE_SIZE, "%d %d", cur_enforcing,
                          fsi->bool_pending_values[index]);
-        ret = simple_read_from_buffer(buf, count, ppos, page, length);
-out:
        mutex_unlock(&fsi->mutex);
+        ret = simple_read_from_buffer(buf, count, ppos, page, length);
+out_free:
        free_page((unsigned long)page);
        return ret;
+out_unlock:
+        mutex_unlock(&fsi->mutex);
+        goto out_free;
 }
 static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
@@ -1219,6 +1217,17 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
        unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK;
        const char *name = filep->f_path.dentry->d_name.name;
+        if (count >= PAGE_SIZE)
+                return -ENOMEM;
+        /* No partial writes. */
+        if (*ppos != 0)
+                return -EINVAL;
+        page = memdup_user_nul(buf, count);
+        if (IS_ERR(page))
+                return PTR_ERR(page);
        mutex_lock(&fsi->mutex);
        length = avc_has_perm(&selinux_state,
@@ -1233,22 +1242,6 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
                                             fsi->bool_pending_names[index]))
                goto out;
-        length = -ENOMEM;
-        if (count >= PAGE_SIZE)
-                goto out;
-        /* No partial writes. */
-        length = -EINVAL;
-        if (*ppos != 0)
-                goto out;
-        page = memdup_user_nul(buf, count);
-        if (IS_ERR(page)) {
-                length = PTR_ERR(page);
-                page = NULL;
-                goto out;
-        }
        length = -EINVAL;
        if (sscanf(page, "%d", &new_value) != 1)
                goto out;
@@ -1280,6 +1273,17 @@ static ssize_t sel_commit_bools_write(struct file *filep,
        ssize_t length;
        int new_value;
+        if (count >= PAGE_SIZE)
+                return -ENOMEM;
+        /* No partial writes. */
+        if (*ppos != 0)
+                return -EINVAL;
+        page = memdup_user_nul(buf, count);
+        if (IS_ERR(page))
+                return PTR_ERR(page);
        mutex_lock(&fsi->mutex);
        length = avc_has_perm(&selinux_state,
@@ -1289,22 +1293,6 @@ static ssize_t sel_commit_bools_write(struct file *filep,
        if (length)
                goto out;
-        length = -ENOMEM;
-        if (count >= PAGE_SIZE)
-                goto out;
-        /* No partial writes. */
-        length = -EINVAL;
-        if (*ppos != 0)
-                goto out;
-        page = memdup_user_nul(buf, count);
-        if (IS_ERR(page)) {
-                length = PTR_ERR(page);
-                page = NULL;
-                goto out;
-        }
        length = -EINVAL;
        if (sscanf(page, "%d", &new_value) != 1)
                goto out;
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 7ad226018f51..19de675d4504 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -2296,6 +2296,7 @@ static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
        struct smack_known *skp = smk_of_task_struct(p);
        isp->smk_inode = skp;
+        isp->smk_flags |= SMK_INODE_INSTANT;
 }
 /*
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 61a07fe34cd2..56ca78423040 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -2004,7 +2004,8 @@ static int snd_seq_ioctl_query_next_client(struct snd_seq_client *client,
        struct snd_seq_client *cptr = NULL;
        /* search for next client */
-        info->client++;
+        if (info->client < INT_MAX)
+                info->client++;
        if (info->client < 0)
                info->client = 0;
        for (; info->client < SNDRV_SEQ_MAX_CLIENTS; info->client++) {
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 665089c45560..b6f076bbc72d 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1520,7 +1520,7 @@ static int snd_timer_user_next_device(struct snd_timer_id __user *_tid)
                                } else {
                                        if (id.subdevice < 0)
                                                id.subdevice = 0;
-                                        else
+                                        else if (id.subdevice < INT_MAX)
                                                id.subdevice++;
                                }
                        }
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index d91c87e41756..20a171ac4bb2 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -2899,8 +2899,9 @@ static int hda_codec_runtime_suspend(struct device *dev)
        list_for_each_entry(pcm, &codec->pcm_list_head, list)
                snd_pcm_suspend_all(pcm->pcm);
        state = hda_call_codec_suspend(codec);
-        if (codec_has_clkstop(codec) && codec_has_epss(codec) &&
+        if (codec->link_down_at_suspend ||
-            (state & AC_PWRST_CLK_STOP_OK))
+            (codec_has_clkstop(codec) && codec_has_epss(codec) &&
+             (state & AC_PWRST_CLK_STOP_OK)))
                snd_hdac_codec_link_down(&codec->core);
        snd_hdac_link_power(&codec->core, false);
        return 0;
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index 681c360f29f9..a8b1b31f161c 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -258,6 +258,7 @@ struct hda_codec {
        unsigned int power_save_node:1; /* advanced PM for each widget */
        unsigned int auto_runtime_pm:1; /* enable automatic codec runtime pm */
        unsigned int force_pin_prefix:1; /* Add location prefix */
+        unsigned int link_down_at_suspend:1; /* link down at runtime suspend */
 #ifdef CONFIG_PM
        unsigned long power_on_acct;
        unsigned long power_off_acct;
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 04e949aa01ad..4ff5320378e2 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -991,6 +991,7 @@ struct ca0132_spec {
 enum {
        QUIRK_NONE,
        QUIRK_ALIENWARE,
+        QUIRK_ALIENWARE_M17XR4,
        QUIRK_SBZ,
        QUIRK_R3DI,
 };
@@ -1040,6 +1041,7 @@ static const struct hda_pintbl r3di_pincfgs[] = {
 };
 static const struct snd_pci_quirk ca0132_quirks[] = {
+        SND_PCI_QUIRK(0x1028, 0x057b, "Alienware M17x R4", QUIRK_ALIENWARE_M17XR4),
        SND_PCI_QUIRK(0x1028, 0x0685, "Alienware 15 2015", QUIRK_ALIENWARE),
        SND_PCI_QUIRK(0x1028, 0x0688, "Alienware 17 2015", QUIRK_ALIENWARE),
        SND_PCI_QUIRK(0x1028, 0x0708, "Alienware 15 R2 2016", QUIRK_ALIENWARE),
@@ -5663,7 +5665,7 @@ static const char * const ca0132_alt_slave_pfxs[] = {
 * I think this has to do with the pin for rear surround being 0x11,
 * and the center/lfe being 0x10. Usually the pin order is the opposite.
 */
-const struct snd_pcm_chmap_elem ca0132_alt_chmaps[] = {
+static const struct snd_pcm_chmap_elem ca0132_alt_chmaps[] = {
        { .channels = 2,
          .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR } },
        { .channels = 4,
@@ -5966,7 +5968,7 @@ static int ca0132_build_pcms(struct hda_codec *codec)
        info->stream[SNDRV_PCM_STREAM_CAPTURE].nid = spec->adcs[0];
        /* With the DSP enabled, desktops don't use this ADC. */
-        if (spec->use_alt_functions) {
+        if (!spec->use_alt_functions) {
                info = snd_hda_codec_pcm_new(codec, "CA0132 Analog Mic-In2");
                if (!info)
                        return -ENOMEM;
@@ -6130,7 +6132,10 @@ static void ca0132_init_dmic(struct hda_codec *codec)
         * Bit   6: set to select Data2, clear for Data1
         * Bit   7: set to enable DMic, clear for AMic
         */
-        val = 0x23;
+        if (spec->quirk == QUIRK_ALIENWARE_M17XR4)
+                val = 0x33;
+        else
+                val = 0x23;
        /* keep a copy of dmic ctl val for enable/disable dmic purpuse */
        spec->dmic_ctl = val;
        snd_hda_codec_write(codec, spec->input_pins[0], 0,
@@ -7223,7 +7228,7 @@ static int ca0132_init(struct hda_codec *codec)
        snd_hda_sequence_write(codec, spec->base_init_verbs);
-        if (spec->quirk != QUIRK_NONE)
+        if (spec->use_alt_functions)
                ca0132_alt_init(codec);
        ca0132_download_dsp(codec);
@@ -7237,8 +7242,9 @@ static int ca0132_init(struct hda_codec *codec)
        case QUIRK_R3DI:
                r3di_setup_defaults(codec);
                break;
-        case QUIRK_NONE:
+        case QUIRK_SBZ:
-        case QUIRK_ALIENWARE:
+                break;
+        default:
                ca0132_setup_defaults(codec);
                ca0132_init_analog_mic2(codec);
                ca0132_init_dmic(codec);
@@ -7343,7 +7349,6 @@ static const struct hda_codec_ops ca0132_patch_ops = {
 static void ca0132_config(struct hda_codec *codec)
 {
        struct ca0132_spec *spec = codec->spec;
-        struct auto_pin_cfg *cfg = &spec->autocfg;
        spec->dacs[0] = 0x2;
        spec->dacs[1] = 0x3;
@@ -7405,12 +7410,7 @@ static void ca0132_config(struct hda_codec *codec)
                /* SPDIF I/O */
                spec->dig_out = 0x05;
                spec->multiout.dig_out_nid = spec->dig_out;
-                cfg->dig_out_pins[0] = 0x0c;
-                cfg->dig_outs = 1;
-                cfg->dig_out_type[0] = HDA_PCM_TYPE_SPDIF;
                spec->dig_in = 0x09;
-                cfg->dig_in_pin = 0x0e;
-                cfg->dig_in_type = HDA_PCM_TYPE_SPDIF;
                break;
        case QUIRK_R3DI:
                codec_dbg(codec, "%s: QUIRK_R3DI applied.\n", __func__);
@@ -7438,9 +7438,6 @@ static void ca0132_config(struct hda_codec *codec)
                /* SPDIF I/O */
                spec->dig_out = 0x05;
                spec->multiout.dig_out_nid = spec->dig_out;
-                cfg->dig_out_pins[0] = 0x0c;
-                cfg->dig_outs = 1;
-                cfg->dig_out_type[0] = HDA_PCM_TYPE_SPDIF;
                break;
        default:
                spec->num_outputs = 2;
@@ -7463,12 +7460,7 @@ static void ca0132_config(struct hda_codec *codec)
                /* SPDIF I/O */
                spec->dig_out = 0x05;
                spec->multiout.dig_out_nid = spec->dig_out;
-                cfg->dig_out_pins[0] = 0x0c;
-                cfg->dig_outs = 1;
-                cfg->dig_out_type[0] = HDA_PCM_TYPE_SPDIF;
                spec->dig_in = 0x09;
-                cfg->dig_in_pin = 0x0e;
-                cfg->dig_in_type = HDA_PCM_TYPE_SPDIF;
                break;
        }
 }
@@ -7476,7 +7468,7 @@ static void ca0132_config(struct hda_codec *codec)
 static int ca0132_prepare_verbs(struct hda_codec *codec)
 {
 /* Verbs + terminator (an empty element) */
-#define NUM_SPEC_VERBS 4
+#define NUM_SPEC_VERBS 2
        struct ca0132_spec *spec = codec->spec;
        spec->chip_init_verbs = ca0132_init_verbs0;
@@ -7488,34 +7480,24 @@ static int ca0132_prepare_verbs(struct hda_codec *codec)
        if (!spec->spec_init_verbs)
                return -ENOMEM;
-        /* HP jack autodetection */
-        spec->spec_init_verbs[0].nid = spec->unsol_tag_hp;
-        spec->spec_init_verbs[0].param = AC_VERB_SET_UNSOLICITED_ENABLE;
-        spec->spec_init_verbs[0].verb = AC_USRSP_EN | spec->unsol_tag_hp;
-        /* MIC1 jack autodetection */
-        spec->spec_init_verbs[1].nid = spec->unsol_tag_amic1;
-        spec->spec_init_verbs[1].param = AC_VERB_SET_UNSOLICITED_ENABLE;
-        spec->spec_init_verbs[1].verb = AC_USRSP_EN | spec->unsol_tag_amic1;
        /* config EAPD */
-        spec->spec_init_verbs[2].nid = 0x0b;
+        spec->spec_init_verbs[0].nid = 0x0b;
-        spec->spec_init_verbs[2].param = 0x78D;
+        spec->spec_init_verbs[0].param = 0x78D;
-        spec->spec_init_verbs[2].verb = 0x00;
+        spec->spec_init_verbs[0].verb = 0x00;
        /* Previously commented configuration */
        /*
-        spec->spec_init_verbs[3].nid = 0x0b;
+        spec->spec_init_verbs[2].nid = 0x0b;
-        spec->spec_init_verbs[3].param = AC_VERB_SET_EAPD_BTLENABLE;
+        spec->spec_init_verbs[2].param = AC_VERB_SET_EAPD_BTLENABLE;
+        spec->spec_init_verbs[2].verb = 0x02;
+        spec->spec_init_verbs[3].nid = 0x10;
+        spec->spec_init_verbs[3].param = 0x78D;
        spec->spec_init_verbs[3].verb = 0x02;
        spec->spec_init_verbs[4].nid = 0x10;
-        spec->spec_init_verbs[4].param = 0x78D;
+        spec->spec_init_verbs[4].param = AC_VERB_SET_EAPD_BTLENABLE;
        spec->spec_init_verbs[4].verb = 0x02;
-        spec->spec_init_verbs[5].nid = 0x10;
-        spec->spec_init_verbs[5].param = AC_VERB_SET_EAPD_BTLENABLE;
-        spec->spec_init_verbs[5].verb = 0x02;
        */
        /* Terminator: spec->spec_init_verbs[NUM_SPEC_VERBS-1] */
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 8840daf9c6a3..98e1c411c56a 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -3741,6 +3741,11 @@ static int patch_atihdmi(struct hda_codec *codec)
        spec->chmap.channels_max = max(spec->chmap.channels_max, 8u);
+        /* AMD GPUs have neither EPSS nor CLKSTOP bits, hence preventing
+         * the link-down as is.  Tell the core to allow it.
+         */
+        codec->link_down_at_suspend = 1;
        return 0;
 }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index e9bd33ea538f..5ad6c7e5f92e 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2545,6 +2545,7 @@ static const struct snd_pci_quirk alc262_fixup_tbl[] = {
        SND_PCI_QUIRK(0x10cf, 0x1397, "Fujitsu Lifebook S7110", ALC262_FIXUP_FSC_S7110),
        SND_PCI_QUIRK(0x10cf, 0x142d, "Fujitsu Lifebook E8410", ALC262_FIXUP_BENQ),
        SND_PCI_QUIRK(0x10f1, 0x2915, "Tyan Thunder n6650W", ALC262_FIXUP_TYAN),
+        SND_PCI_QUIRK(0x1734, 0x1141, "FSC ESPRIMO U9210", ALC262_FIXUP_FSC_H270),
        SND_PCI_QUIRK(0x1734, 0x1147, "FSC Celsius H270", ALC262_FIXUP_FSC_H270),
        SND_PCI_QUIRK(0x17aa, 0x384e, "Lenovo 3000", ALC262_FIXUP_LENOVO_3000),
        SND_PCI_QUIRK(0x17ff, 0x0560, "Benq ED8", ALC262_FIXUP_BENQ),
@@ -4995,7 +4996,6 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec,
        struct alc_spec *spec = codec->spec;
        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
-                spec->shutup = alc_no_shutup; /* reduce click noise */
                spec->reboot_notify = alc_d3_at_reboot; /* reduce noise */
                spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
                codec->power_save_node = 0; /* avoid click noises */
@@ -5394,6 +5394,13 @@ static void alc274_fixup_bind_dacs(struct hda_codec *codec,
 /* for hda_fixup_thinkpad_acpi() */
 #include "thinkpad_helper.c"
+static void alc_fixup_thinkpad_acpi(struct hda_codec *codec,
+                                    const struct hda_fixup *fix, int action)
+{
+        alc_fixup_no_shutup(codec, fix, action); /* reduce click noise */
+        hda_fixup_thinkpad_acpi(codec, fix, action);
+}
 /* for dell wmi mic mute led */
 #include "dell_wmi_helper.c"
@@ -5946,7 +5953,7 @@ static const struct hda_fixup alc269_fixups[] = {
        },
        [ALC269_FIXUP_THINKPAD_ACPI] = {
                .type = HDA_FIXUP_FUNC,
-                .v.func = hda_fixup_thinkpad_acpi,
+                .v.func = alc_fixup_thinkpad_acpi,
                .chained = true,
                .chain_id = ALC269_FIXUP_SKU_IGNORE,
        },
@@ -6603,8 +6610,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
        SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
        SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+        SND_PCI_QUIRK(0x17aa, 0x312a, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
        SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
-        SND_PCI_QUIRK(0x17aa, 0x3138, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+        SND_PCI_QUIRK(0x17aa, 0x3136, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
        SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
        SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
        SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
@@ -6782,6 +6790,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                {0x14, 0x90170110},
                {0x19, 0x02a11030},
                {0x21, 0x02211020}),
+        SND_HDA_PIN_QUIRK(0x10ec0235, 0x17aa, "Lenovo", ALC294_FIXUP_LENOVO_MIC_LOCATION,
+                {0x14, 0x90170110},
+                {0x19, 0x02a11030},
+                {0x1a, 0x02a11040},
+                {0x1b, 0x01014020},
+                {0x21, 0x0221101f}),
        SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                {0x12, 0x90a60140},
                {0x14, 0x90170110},
diff --git a/sound/pci/lx6464es/lx6464es.c b/sound/pci/lx6464es/lx6464es.c
index 6c85f13ab23f..54f6252faca6 100644
--- a/sound/pci/lx6464es/lx6464es.c
+++ b/sound/pci/lx6464es/lx6464es.c
@@ -1018,6 +1018,7 @@ static int snd_lx6464es_create(struct snd_card *card,
        chip->port_dsp_bar = pci_ioremap_bar(pci, 2);
        if (!chip->port_dsp_bar) {
                dev_err(card->dev, "cannot remap PCI memory region\n");
+                err = -ENOMEM;
                goto remap_pci_failed;
        }
diff --git a/tools/arch/arm/include/uapi/asm/kvm.h b/tools/arch/arm/include/uapi/asm/kvm.h
index caae4843cb70..16e006f708ca 100644
--- a/tools/arch/arm/include/uapi/asm/kvm.h
+++ b/tools/arch/arm/include/uapi/asm/kvm.h
@@ -91,6 +91,7 @@ struct kvm_regs {
 #define KVM_VGIC_V3_ADDR_TYPE_DIST      2
 #define KVM_VGIC_V3_ADDR_TYPE_REDIST    3
 #define KVM_VGIC_ITS_ADDR_TYPE          4
+#define KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION     5
 #define KVM_VGIC_V3_DIST_SIZE           SZ_64K
 #define KVM_VGIC_V3_REDIST_SIZE         (2 * SZ_64K)
diff --git a/tools/arch/arm64/include/uapi/asm/kvm.h b/tools/arch/arm64/include/uapi/asm/kvm.h
index 04b3256f8e6d..4e76630dd655 100644
--- a/tools/arch/arm64/include/uapi/asm/kvm.h
+++ b/tools/arch/arm64/include/uapi/asm/kvm.h
@@ -91,6 +91,7 @@ struct kvm_regs {
 #define KVM_VGIC_V3_ADDR_TYPE_DIST      2
 #define KVM_VGIC_V3_ADDR_TYPE_REDIST    3
 #define KVM_VGIC_ITS_ADDR_TYPE          4
+#define KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION     5
 #define KVM_VGIC_V3_DIST_SIZE           SZ_64K
 #define KVM_VGIC_V3_REDIST_SIZE         (2 * SZ_64K)
diff --git a/tools/arch/powerpc/include/uapi/asm/kvm.h b/tools/arch/powerpc/include/uapi/asm/kvm.h
index 833ed9a16adf..1b32b56a03d3 100644
--- a/tools/arch/powerpc/include/uapi/asm/kvm.h
+++ b/tools/arch/powerpc/include/uapi/asm/kvm.h
@@ -633,6 +633,7 @@ struct kvm_ppc_cpu_char {
 #define KVM_REG_PPC_PSSCR       (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbd)
 #define KVM_REG_PPC_DEC_EXPIRY  (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbe)
+#define KVM_REG_PPC_ONLINE      (KVM_REG_PPC | KVM_REG_SIZE_U32 | 0xbf)
 /* Transactional Memory checkpointed state:
 * This is all GPRs, all VSX regs and a subset of SPRs
diff --git a/tools/arch/powerpc/include/uapi/asm/unistd.h b/tools/arch/powerpc/include/uapi/asm/unistd.h
index 389c36fd8299..ac5ba55066dd 100644
--- a/tools/arch/powerpc/include/uapi/asm/unistd.h
+++ b/tools/arch/powerpc/include/uapi/asm/unistd.h
@@ -398,5 +398,6 @@
 #define __NR_pkey_alloc         384
 #define __NR_pkey_free          385
 #define __NR_pkey_mprotect      386
+#define __NR_rseq               387
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index fb00a2fca990..5701f5cecd31 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -282,7 +282,9 @@
 #define X86_FEATURE_AMD_IBPB            (13*32+12) /* "" Indirect Branch Prediction Barrier */
 #define X86_FEATURE_AMD_IBRS            (13*32+14) /* "" Indirect Branch Restricted Speculation */
 #define X86_FEATURE_AMD_STIBP           (13*32+15) /* "" Single Thread Indirect Branch Predictors */
+#define X86_FEATURE_AMD_SSBD            (13*32+24) /* "" Speculative Store Bypass Disable */
 #define X86_FEATURE_VIRT_SSBD           (13*32+25) /* Virtualized Speculative Store Bypass Disable */
+#define X86_FEATURE_AMD_SSB_NO          (13*32+26) /* "" Speculative Store Bypass is fixed in hardware. */
 /* Thermal and Power Management Leaf, CPUID level 0x00000006 (EAX), word 14 */
 #define X86_FEATURE_DTHERM              (14*32+ 0) /* Digital Thermal Sensor */
diff --git a/tools/bpf/bpftool/perf.c b/tools/bpf/bpftool/perf.c
index ac6b1a12c9b7..b76b77dcfd1f 100644
--- a/tools/bpf/bpftool/perf.c
+++ b/tools/bpf/bpftool/perf.c
@@ -29,9 +29,10 @@ static bool has_perf_query_support(void)
        if (perf_query_supported)
                goto out;
-        fd = open(bin_name, O_RDONLY);
+        fd = open("/", O_RDONLY);
        if (fd < 0) {
-                p_err("perf_query_support: %s", strerror(errno));
+                p_err("perf_query_support: cannot open directory \"/\" (%s)",
+                      strerror(errno));
                goto out;
        }
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index a4f435203fef..05f42a46d6ed 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -90,7 +90,9 @@ static void print_boot_time(__u64 nsecs, char *buf, unsigned int size)
        }
        wallclock_secs = (real_time_ts.tv_sec - boot_time_ts.tv_sec) +
-                nsecs / 1000000000;
+                (real_time_ts.tv_nsec - boot_time_ts.tv_nsec + nsecs) /
+                1000000000;
        if (!localtime_r(&wallclock_secs, &load_tm)) {
                snprintf(buf, size, "%llu", nsecs / 1000000000);
diff --git a/tools/include/uapi/drm/drm.h b/tools/include/uapi/drm/drm.h
index 6fdff5945c8a..9c660e1688ab 100644
--- a/tools/include/uapi/drm/drm.h
+++ b/tools/include/uapi/drm/drm.h
@@ -680,6 +680,13 @@ struct drm_get_cap {
 */
 #define DRM_CLIENT_CAP_ATOMIC   3
+/**
+ * DRM_CLIENT_CAP_ASPECT_RATIO
+ *
+ * If set to 1, the DRM core will provide aspect ratio information in modes.
+ */
+#define DRM_CLIENT_CAP_ASPECT_RATIO    4
 /** DRM_IOCTL_SET_CLIENT_CAP ioctl argument type */
 struct drm_set_client_cap {
        __u64 capability;
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index e0b06784f227..59b19b6a40d7 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -2630,7 +2630,7 @@ struct bpf_fib_lookup {
        union {
                /* inputs to lookup */
                __u8    tos;            /* AF_INET  */
-                __be32  flowlabel;      /* AF_INET6 */
+                __be32  flowinfo;       /* AF_INET6, flow_label + priority */
                /* output: metric of fib result (IPv4/IPv6 only) */
                __u32   rt_metric;
diff --git a/tools/include/uapi/linux/if_link.h b/tools/include/uapi/linux/if_link.h
index 68699f654118..cf01b6824244 100644
--- a/tools/include/uapi/linux/if_link.h
+++ b/tools/include/uapi/linux/if_link.h
@@ -333,6 +333,7 @@ enum {
        IFLA_BRPORT_BCAST_FLOOD,
        IFLA_BRPORT_GROUP_FWD_MASK,
        IFLA_BRPORT_NEIGH_SUPPRESS,
+        IFLA_BRPORT_ISOLATED,
        __IFLA_BRPORT_MAX
 };
 #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
@@ -516,6 +517,7 @@ enum {
        IFLA_VXLAN_COLLECT_METADATA,
        IFLA_VXLAN_LABEL,
        IFLA_VXLAN_GPE,
+        IFLA_VXLAN_TTL_INHERIT,
        __IFLA_VXLAN_MAX
 };
 #define IFLA_VXLAN_MAX  (__IFLA_VXLAN_MAX - 1)
diff --git a/tools/include/uapi/linux/kvm.h b/tools/include/uapi/linux/kvm.h
index 39e364c70caf..b6270a3b38e9 100644
--- a/tools/include/uapi/linux/kvm.h
+++ b/tools/include/uapi/linux/kvm.h
@@ -948,6 +948,7 @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_S390_BPB 152
 #define KVM_CAP_GET_MSR_FEATURES 153
 #define KVM_CAP_HYPERV_EVENTFD 154
+#define KVM_CAP_HYPERV_TLBFLUSH 155
 #ifdef KVM_CAP_IRQ_ROUTING
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 38047c6aa575..f4a25bd1871f 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -164,6 +164,7 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,
                "lbug_with_loc",
                "fortify_panic",
                "usercopy_abort",
+                "machine_real_restart",
        };
        if (func->bind == STB_WEAK)
diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt
index 5dfe102fb5b5..b10a90b6a718 100644
--- a/tools/perf/Documentation/perf-stat.txt
+++ b/tools/perf/Documentation/perf-stat.txt
@@ -178,6 +178,9 @@ Print count deltas for fixed number of times.
 This option should be used together with "-I" option.
        example: 'perf stat -I 1000 --interval-count 2 -e cycles -a'
+--interval-clear::
+Clear the screen before next interval.
 --timeout msecs::
 Stop the 'perf stat' session and print count deltas after N milliseconds (minimum: 10 ms).
 This option is not supported with the "-I" option.
diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
index 3598b8b75d27..ef5d59a5742e 100644
--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
@@ -243,7 +243,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain)
        u64 ip;
        u64 skip_slot = -1;
-        if (chain->nr < 3)
+        if (!chain || chain->nr < 3)
                return skip_slot;
        ip = chain->ips[2];
diff --git a/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl b/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl
index 4dfe42666d0c..f0b1709a5ffb 100644
--- a/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl
+++ b/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl
@@ -341,6 +341,8 @@
 330     common  pkey_alloc              __x64_sys_pkey_alloc
 331     common  pkey_free               __x64_sys_pkey_free
 332     common  statx                   __x64_sys_statx
+333     common  io_pgetevents           __x64_sys_io_pgetevents
+334     common  rseq                    __x64_sys_rseq
 #
 # x32-specific system call numbers start at 512 to avoid cache impact
diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
index 63eb49082774..44195514b19e 100644
--- a/tools/perf/bench/numa.c
+++ b/tools/perf/bench/numa.c
@@ -1098,7 +1098,7 @@ static void *worker_thread(void *__tdata)
        u8 *global_data;
        u8 *process_data;
        u8 *thread_data;
-        u64 bytes_done;
+        u64 bytes_done, secs;
        long work_done;
        u32 l;
        struct rusage rusage;
@@ -1254,7 +1254,8 @@ static void *worker_thread(void *__tdata)
        timersub(&stop, &start0, &diff);
        td->runtime_ns = diff.tv_sec * NSEC_PER_SEC;
        td->runtime_ns += diff.tv_usec * NSEC_PER_USEC;
-        td->speed_gbs = bytes_done / (td->runtime_ns / NSEC_PER_SEC) / 1e9;
+        secs = td->runtime_ns / NSEC_PER_SEC;
+        td->speed_gbs = secs ? bytes_done / secs / 1e9 : 0;
        getrusage(RUSAGE_THREAD, &rusage);
        td->system_time_ns = rusage.ru_stime.tv_sec * NSEC_PER_SEC;
diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index 5eb22cc56363..8180319285af 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -283,6 +283,15 @@ out_put:
        return ret;
 }
+static int process_feature_event(struct perf_tool *tool,
+                                 union perf_event *event,
+                                 struct perf_session *session)
+{
+        if (event->feat.feat_id < HEADER_LAST_FEATURE)
+                return perf_event__process_feature(tool, event, session);
+        return 0;
+}
 static int hist_entry__tty_annotate(struct hist_entry *he,
                                    struct perf_evsel *evsel,
                                    struct perf_annotate *ann)
@@ -471,7 +480,7 @@ int cmd_annotate(int argc, const char **argv)
                        .attr   = perf_event__process_attr,
                        .build_id = perf_event__process_build_id,
                        .tracing_data   = perf_event__process_tracing_data,
-                        .feature        = perf_event__process_feature,
+                        .feature        = process_feature_event,
                        .ordered_events = true,
                        .ordering_requires_timestamps = true,
                },
diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
index 307b3594525f..6a8738f7ead3 100644
--- a/tools/perf/builtin-c2c.c
+++ b/tools/perf/builtin-c2c.c
@@ -56,16 +56,16 @@ struct c2c_hist_entry {
        struct compute_stats     cstats;
+        unsigned long            paddr;
+        unsigned long            paddr_cnt;
+        bool                     paddr_zero;
+        char                    *nodestr;
        /*
         * must be at the end,
         * because of its callchain dynamic entry
         */
        struct hist_entry       he;
-        unsigned long            paddr;
-        unsigned long            paddr_cnt;
-        bool                     paddr_zero;
-        char                    *nodestr;
 };
 static char const *coalesce_default = "pid,iaddr";
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index cdb5b6949832..c04dc7b53797 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -217,7 +217,8 @@ static int process_feature_event(struct perf_tool *tool,
        }
        /*
-         * All features are received, we can force the
+         * (feat_id = HEADER_LAST_FEATURE) is the end marker which
+         * means all features are received, now we can force the
         * group if needed.
         */
        setup_forced_leader(rep, session->evlist);
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index b3bf35512d21..568ddfac3213 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -180,6 +180,18 @@ static struct {
                                  PERF_OUTPUT_EVNAME | PERF_OUTPUT_TRACE
        },
+        [PERF_TYPE_HW_CACHE] = {
+                .user_set = false,
+                .fields = PERF_OUTPUT_COMM | PERF_OUTPUT_TID |
+                              PERF_OUTPUT_CPU | PERF_OUTPUT_TIME |
+                              PERF_OUTPUT_EVNAME | PERF_OUTPUT_IP |
+                              PERF_OUTPUT_SYM | PERF_OUTPUT_SYMOFFSET |
+                              PERF_OUTPUT_DSO | PERF_OUTPUT_PERIOD,
+                .invalid_fields = PERF_OUTPUT_TRACE | PERF_OUTPUT_BPF_OUTPUT,
+        },
        [PERF_TYPE_RAW] = {
                .user_set = false,
@@ -1822,6 +1834,7 @@ static int process_attr(struct perf_tool *tool, union perf_event *event,
        struct perf_evlist *evlist;
        struct perf_evsel *evsel, *pos;
        int err;
+        static struct perf_evsel_script *es;
        err = perf_event__process_attr(tool, event, pevlist);
        if (err)
@@ -1830,6 +1843,19 @@ static int process_attr(struct perf_tool *tool, union perf_event *event,
        evlist = *pevlist;
        evsel = perf_evlist__last(*pevlist);
+        if (!evsel->priv) {
+                if (scr->per_event_dump) {
+                        evsel->priv = perf_evsel_script__new(evsel,
+                                                scr->session->data);
+                } else {
+                        es = zalloc(sizeof(*es));
+                        if (!es)
+                                return -ENOMEM;
+                        es->fp = stdout;
+                        evsel->priv = es;
+                }
+        }
        if (evsel->attr.type >= PERF_TYPE_MAX &&
            evsel->attr.type != PERF_TYPE_SYNTH)
                return 0;
@@ -3018,6 +3044,15 @@ int process_cpu_map_event(struct perf_tool *tool __maybe_unused,
        return set_maps(script);
 }
+static int process_feature_event(struct perf_tool *tool,
+                                 union perf_event *event,
+                                 struct perf_session *session)
+{
+        if (event->feat.feat_id < HEADER_LAST_FEATURE)
+                return perf_event__process_feature(tool, event, session);
+        return 0;
+}
 #ifdef HAVE_AUXTRACE_SUPPORT
 static int perf_script__process_auxtrace_info(struct perf_tool *tool,
                                              union perf_event *event,
@@ -3062,7 +3097,7 @@ int cmd_script(int argc, const char **argv)
                        .attr            = process_attr,
                        .event_update   = perf_event__process_event_update,
                        .tracing_data    = perf_event__process_tracing_data,
-                        .feature         = perf_event__process_feature,
+                        .feature         = process_feature_event,
                        .build_id        = perf_event__process_build_id,
                        .id_index        = perf_event__process_id_index,
                        .auxtrace_info   = perf_script__process_auxtrace_info,
@@ -3113,8 +3148,9 @@ int cmd_script(int argc, const char **argv)
                     "+field to add and -field to remove."
                     "Valid types: hw,sw,trace,raw,synth. "
                     "Fields: comm,tid,pid,time,cpu,event,trace,ip,sym,dso,"
-                     "addr,symoff,period,iregs,uregs,brstack,brstacksym,flags,"
+                     "addr,symoff,srcline,period,iregs,uregs,brstack,"
-                     "bpf-output,callindent,insn,insnlen,brstackinsn,synth,phys_addr",
+                     "brstacksym,flags,bpf-output,brstackinsn,brstackoff,"
+                     "callindent,insn,insnlen,synth,phys_addr,metric,misc",
                     parse_output_fields),
        OPT_BOOLEAN('a', "all-cpus", &system_wide,
                    "system-wide collection from all CPUs"),
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 096ccb25c11f..22547a490e1f 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -65,6 +65,7 @@
 #include "util/tool.h"
 #include "util/string2.h"
 #include "util/metricgroup.h"
+#include "util/top.h"
 #include "asm/bug.h"
 #include <linux/time64.h>
@@ -144,6 +145,8 @@ static struct target target = {
 typedef int (*aggr_get_id_t)(struct cpu_map *m, int cpu);
+#define METRIC_ONLY_LEN 20
 static int                      run_count                       =  1;
 static bool                     no_inherit                      = false;
 static volatile pid_t           child_pid                       = -1;
@@ -173,6 +176,7 @@ static struct cpu_map		*aggr_map;
 static aggr_get_id_t            aggr_get_id;
 static bool                     append_file;
 static bool                     interval_count;
+static bool                     interval_clear;
 static const char               *output_name;
 static int                      output_fd;
 static int                      print_free_counters_hint;
@@ -180,6 +184,7 @@ static int			print_mixed_hw_group_error;
 static u64                      *walltime_run;
 static bool                     ru_display                      = false;
 static struct rusage            ru_data;
+static unsigned int             metric_only_len                 = METRIC_ONLY_LEN;
 struct perf_stat {
        bool                     record;
@@ -967,8 +972,6 @@ static void print_metric_csv(void *ctx,
        fprintf(out, "%s%s%s%s", csv_sep, vals, csv_sep, unit);
 }
-#define METRIC_ONLY_LEN 20
 /* Filter out some columns that don't work well in metrics only mode */
 static bool valid_only_metric(const char *unit)
@@ -999,22 +1002,20 @@ static void print_metric_only(void *ctx, const char *color, const char *fmt,
 {
        struct outstate *os = ctx;
        FILE *out = os->fh;
-        int n;
+        char buf[1024], str[1024];
-        char buf[1024];
+        unsigned mlen = metric_only_len;
-        unsigned mlen = METRIC_ONLY_LEN;
        if (!valid_only_metric(unit))
                return;
        unit = fixunit(buf, os->evsel, unit);
-        if (color)
-                n = color_fprintf(out, color, fmt, val);
-        else
-                n = fprintf(out, fmt, val);
-        if (n > METRIC_ONLY_LEN)
-                n = METRIC_ONLY_LEN;
        if (mlen < strlen(unit))
                mlen = strlen(unit) + 1;
-        fprintf(out, "%*s", mlen - n, "");
+        if (color)
+                mlen += strlen(color) + sizeof(PERF_COLOR_RESET) - 1;
+        color_snprintf(str, sizeof(str), color ?: "", fmt, val);
+        fprintf(out, "%*s ", mlen, str);
 }
 static void print_metric_only_csv(void *ctx, const char *color __maybe_unused,
@@ -1054,7 +1055,7 @@ static void print_metric_header(void *ctx, const char *color __maybe_unused,
        if (csv_output)
                fprintf(os->fh, "%s%s", unit, csv_sep);
        else
-                fprintf(os->fh, "%-*s ", METRIC_ONLY_LEN, unit);
+                fprintf(os->fh, "%*s ", metric_only_len, unit);
 }
 static void nsec_printout(int id, int nr, struct perf_evsel *evsel, double avg)
@@ -1704,9 +1705,12 @@ static void print_interval(char *prefix, struct timespec *ts)
        FILE *output = stat_config.output;
        static int num_print_interval;
+        if (interval_clear)
+                puts(CONSOLE_CLEAR);
        sprintf(prefix, "%6lu.%09lu%s", ts->tv_sec, ts->tv_nsec, csv_sep);
-        if (num_print_interval == 0 && !csv_output) {
+        if ((num_print_interval == 0 && !csv_output) || interval_clear) {
                switch (stat_config.aggr_mode) {
                case AGGR_SOCKET:
                        fprintf(output, "#           time socket cpus");
@@ -1719,7 +1723,7 @@ static void print_interval(char *prefix, struct timespec *ts)
                                fprintf(output, "             counts %*s events\n", unit_width, "unit");
                        break;
                case AGGR_NONE:
-                        fprintf(output, "#           time CPU");
+                        fprintf(output, "#           time CPU    ");
                        if (!metric_only)
                                fprintf(output, "                counts %*s events\n", unit_width, "unit");
                        break;
@@ -1738,7 +1742,7 @@ static void print_interval(char *prefix, struct timespec *ts)
                }
        }
-        if (num_print_interval == 0 && metric_only)
+        if ((num_print_interval == 0 && metric_only) || interval_clear)
                print_metric_headers(" ", true);
        if (++num_print_interval == 25)
                num_print_interval = 0;
@@ -2057,6 +2061,8 @@ static const struct option stat_options[] = {
                    "(overhead is possible for values <= 100ms)"),
        OPT_INTEGER(0, "interval-count", &stat_config.times,
                    "print counts for fixed number of times"),
+        OPT_BOOLEAN(0, "interval-clear", &interval_clear,
+                    "clear screen in between new interval"),
        OPT_UINTEGER(0, "timeout", &stat_config.timeout,
                    "stop workload and print counts after a timeout period in ms (>= 10ms)"),
        OPT_SET_UINT(0, "per-socket", &stat_config.aggr_mode,
@@ -2436,14 +2442,13 @@ static int add_default_attributes(void)
        (PERF_COUNT_HW_CACHE_OP_PREFETCH        <<  8) |
        (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)                          },
 };
+        struct parse_events_error errinfo;
        /* Set attrs if no event is selected and !null_run: */
        if (null_run)
                return 0;
        if (transaction_run) {
-                struct parse_events_error errinfo;
                if (pmu_have_event("cpu", "cycles-ct") &&
                    pmu_have_event("cpu", "el-start"))
                        err = parse_events(evsel_list, transaction_attrs,
@@ -2454,6 +2459,7 @@ static int add_default_attributes(void)
                                           &errinfo);
                if (err) {
                        fprintf(stderr, "Cannot set up transaction events\n");
+                        parse_events_print_error(&errinfo, transaction_attrs);
                        return -1;
                }
                return 0;
@@ -2479,10 +2485,11 @@ static int add_default_attributes(void)
                    pmu_have_event("msr", "smi")) {
                        if (!force_metric_only)
                                metric_only = true;
-                        err = parse_events(evsel_list, smi_cost_attrs, NULL);
+                        err = parse_events(evsel_list, smi_cost_attrs, &errinfo);
                } else {
                        fprintf(stderr, "To measure SMI cost, it needs "
                                "msr/aperf/, msr/smi/ and cpu/cycles/ support\n");
+                        parse_events_print_error(&errinfo, smi_cost_attrs);
                        return -1;
                }
                if (err) {
@@ -2517,12 +2524,13 @@ static int add_default_attributes(void)
                if (topdown_attrs[0] && str) {
                        if (warn)
                                arch_topdown_group_warn();
-                        err = parse_events(evsel_list, str, NULL);
+                        err = parse_events(evsel_list, str, &errinfo);
                        if (err) {
                                fprintf(stderr,
                                        "Cannot set up top down events %s: %d\n",
                                        str, err);
                                free(str);
+                                parse_events_print_error(&errinfo, str);
                                return -1;
                        }
                } else {
diff --git a/tools/perf/tests/parse-events.c b/tools/perf/tests/parse-events.c
index 7d4077068454..61211918bfba 100644
--- a/tools/perf/tests/parse-events.c
+++ b/tools/perf/tests/parse-events.c
@@ -1309,6 +1309,11 @@ static int test__checkevent_config_cache(struct perf_evlist *evlist)
        return 0;
 }
+static bool test__intel_pt_valid(void)
+{
+        return !!perf_pmu__find("intel_pt");
+}
 static int test__intel_pt(struct perf_evlist *evlist)
 {
        struct perf_evsel *evsel = perf_evlist__first(evlist);
@@ -1375,6 +1380,7 @@ struct evlist_test {
        const char *name;
        __u32 type;
        const int id;
+        bool (*valid)(void);
        int (*check)(struct perf_evlist *evlist);
 };
@@ -1648,6 +1654,7 @@ static struct evlist_test test__events[] = {
        },
        {
                .name  = "intel_pt//u",
+                .valid = test__intel_pt_valid,
                .check = test__intel_pt,
                .id    = 52,
        },
@@ -1686,17 +1693,24 @@ static struct terms_test test__terms[] = {
 static int test_event(struct evlist_test *e)
 {
+        struct parse_events_error err = { .idx = 0, };
        struct perf_evlist *evlist;
        int ret;
+        if (e->valid && !e->valid()) {
+                pr_debug("... SKIP");
+                return 0;
+        }
        evlist = perf_evlist__new();
        if (evlist == NULL)
                return -ENOMEM;
-        ret = parse_events(evlist, e->name, NULL);
+        ret = parse_events(evlist, e->name, &err);
        if (ret) {
-                pr_debug("failed to parse event '%s', err %d\n",
+                pr_debug("failed to parse event '%s', err %d, str '%s'\n",
-                         e->name, ret);
+                         e->name, ret, err.str);
+                parse_events_print_error(&err, e->name);
        } else {
                ret = e->check(evlist);
        }
@@ -1714,10 +1728,11 @@ static int test_events(struct evlist_test *events, unsigned cnt)
        for (i = 0; i < cnt; i++) {
                struct evlist_test *e = &events[i];
-                pr_debug("running test %d '%s'\n", e->id, e->name);
+                pr_debug("running test %d '%s'", e->id, e->name);
                ret1 = test_event(e);
                if (ret1)
                        ret2 = ret1;
+                pr_debug("\n");
        }
        return ret2;
@@ -1799,7 +1814,7 @@ static int test_pmu_events(void)
        }
        while (!ret && (ent = readdir(dir))) {
-                struct evlist_test e;
+                struct evlist_test e = { .id = 0, };
                char name[2 * NAME_MAX + 1 + 12 + 3];
                /* Names containing . are special and cannot be used directly */
diff --git a/tools/perf/tests/topology.c b/tools/perf/tests/topology.c
index 40e30a26b23c..9497d02f69e6 100644
--- a/tools/perf/tests/topology.c
+++ b/tools/perf/tests/topology.c
@@ -45,6 +45,7 @@ static int session_write_header(char *path)
        perf_header__set_feat(&session->header, HEADER_CPU_TOPOLOGY);
        perf_header__set_feat(&session->header, HEADER_NRCPUS);
+        perf_header__set_feat(&session->header, HEADER_ARCH);
        session->header.data_size += DATA_SIZE;
diff --git a/tools/perf/ui/gtk/hists.c b/tools/perf/ui/gtk/hists.c
index b085f1b3e34d..4ab663ec3e5e 100644
--- a/tools/perf/ui/gtk/hists.c
+++ b/tools/perf/ui/gtk/hists.c
@@ -382,7 +382,7 @@ static void perf_gtk__show_hists(GtkWidget *window, struct hists *hists,
                        gtk_tree_store_set(store, &iter, col_idx++, s, -1);
                }
-                if (hists__has_callchains(hists) &&
+                if (hist_entry__has_callchains(h) &&
                    symbol_conf.use_callchain && hists__has(hists, sym)) {
                        if (callchain_param.mode == CHAIN_GRAPH_REL)
                                total = symbol_conf.cumulate_callchain ?
diff --git a/tools/perf/util/c++/clang.cpp b/tools/perf/util/c++/clang.cpp
index bf31ceab33bd..89512504551b 100644
--- a/tools/perf/util/c++/clang.cpp
+++ b/tools/perf/util/c++/clang.cpp
@@ -146,8 +146,15 @@ getBPFObjectFromModule(llvm::Module *Module)
        raw_svector_ostream ostream(*Buffer);
        legacy::PassManager PM;
-        if (TargetMachine->addPassesToEmitFile(PM, ostream,
+        bool NotAdded;
-                                               TargetMachine::CGFT_ObjectFile)) {
+#if CLANG_VERSION_MAJOR < 7
+        NotAdded = TargetMachine->addPassesToEmitFile(PM, ostream,
+                                                      TargetMachine::CGFT_ObjectFile);
+#else
+        NotAdded = TargetMachine->addPassesToEmitFile(PM, ostream, nullptr,
+                                                      TargetMachine::CGFT_ObjectFile);
+#endif
+        if (NotAdded) {
                llvm::errs() << "TargetMachine can't emit a file of this type\n";
                return std::unique_ptr<llvm::SmallVectorImpl<char>>(nullptr);;
        }
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 540cd2dcd3e7..653ff65aa2c3 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -2129,6 +2129,7 @@ static int process_cpu_topology(struct feat_fd *ff, void *data __maybe_unused)
        int cpu_nr = ff->ph->env.nr_cpus_avail;
        u64 size = 0;
        struct perf_header *ph = ff->ph;
+        bool do_core_id_test = true;
        ph->env.cpu = calloc(cpu_nr, sizeof(*ph->env.cpu));
        if (!ph->env.cpu)
@@ -2183,6 +2184,13 @@ static int process_cpu_topology(struct feat_fd *ff, void *data __maybe_unused)
                return 0;
        }
+        /* On s390 the socket_id number is not related to the numbers of cpus.
+         * The socket_id number might be higher than the numbers of cpus.
+         * This depends on the configuration.
+         */
+        if (ph->env.arch && !strncmp(ph->env.arch, "s390", 4))
+                do_core_id_test = false;
        for (i = 0; i < (u32)cpu_nr; i++) {
                if (do_read_u32(ff, &nr))
                        goto free_cpu;
@@ -2192,7 +2200,7 @@ static int process_cpu_topology(struct feat_fd *ff, void *data __maybe_unused)
                if (do_read_u32(ff, &nr))
                        goto free_cpu;
-                if (nr != (u32)-1 && nr > (u32)cpu_nr) {
+                if (do_core_id_test && nr != (u32)-1 && nr > (u32)cpu_nr) {
                        pr_debug("socket_id number is too big."
                                 "You may need to upgrade the perf tool.\n");
                        goto free_cpu;
@@ -3456,7 +3464,7 @@ int perf_event__process_feature(struct perf_tool *tool,
                pr_warning("invalid record type %d in pipe-mode\n", type);
                return 0;
        }
-        if (feat == HEADER_RESERVED || feat > HEADER_LAST_FEATURE) {
+        if (feat == HEADER_RESERVED || feat >= HEADER_LAST_FEATURE) {
                pr_warning("invalid record type %d in pipe-mode\n", type);
                return -1;
        }
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 52e8fda93a47..828cb9794c76 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -370,9 +370,11 @@ void hists__delete_entries(struct hists *hists)
 static int hist_entry__init(struct hist_entry *he,
                            struct hist_entry *template,
-                            bool sample_self)
+                            bool sample_self,
+                            size_t callchain_size)
 {
        *he = *template;
+        he->callchain_size = callchain_size;
        if (symbol_conf.cumulate_callchain) {
                he->stat_acc = malloc(sizeof(he->stat));
@@ -473,7 +475,7 @@ static struct hist_entry *hist_entry__new(struct hist_entry *template,
        he = ops->new(callchain_size);
        if (he) {
-                err = hist_entry__init(he, template, sample_self);
+                err = hist_entry__init(he, template, sample_self, callchain_size);
                if (err) {
                        ops->free(he);
                        he = NULL;
@@ -619,9 +621,11 @@ __hists__add_entry(struct hists *hists,
                .raw_data = sample->raw_data,
                .raw_size = sample->raw_size,
                .ops = ops,
-        };
+        }, *he = hists__findnew_entry(hists, &entry, al, sample_self);
-        return hists__findnew_entry(hists, &entry, al, sample_self);
+        if (!hists->has_callchains && he && he->callchain_size != 0)
+                hists->has_callchains = true;
+        return he;
 }
 struct hist_entry *hists__add_entry(struct hists *hists,
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index 06607c434949..73049f7f0f60 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -85,6 +85,7 @@ struct hists {
        struct events_stats     stats;
        u64                     event_stream;
        u16                     col_len[HISTC_NR_COLS];
+        bool                    has_callchains;
        int                     socket_filter;
        struct perf_hpp_list    *hpp_list;
        struct list_head        hpp_formats;
@@ -222,8 +223,7 @@ static inline struct hists *evsel__hists(struct perf_evsel *evsel)
 static __pure inline bool hists__has_callchains(struct hists *hists)
 {
-        const struct perf_evsel *evsel = hists_to_evsel(hists);
+        return hists->has_callchains;
-        return evsel__has_callchain(evsel);
 }
 int hists__init(void);
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
index ba4c9dd18643..d426761a549d 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
@@ -366,7 +366,7 @@ static int intel_pt_get_cyc(unsigned int byte, const unsigned char *buf,
                if (len < offs)
                        return INTEL_PT_NEED_MORE_BYTES;
                byte = buf[offs++];
-                payload |= (byte >> 1) << shift;
+                payload |= ((uint64_t)byte >> 1) << shift;
        }
        packet->type = INTEL_PT_CYC;
diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y
index 155d2570274f..da8fe57691b8 100644
--- a/tools/perf/util/parse-events.y
+++ b/tools/perf/util/parse-events.y
@@ -227,11 +227,16 @@ event_def: event_pmu |
 event_pmu:
 PE_NAME opt_pmu_config
 {
+        struct parse_events_state *parse_state = _parse_state;
+        struct parse_events_error *error = parse_state->error;
        struct list_head *list, *orig_terms, *terms;
        if (parse_events_copy_term_list($2, &orig_terms))
                YYABORT;
+        if (error)
+                error->idx = @1.first_column;
        ALLOC_LIST(list);
        if (parse_events_add_pmu(_parse_state, list, $1, $2, false, false)) {
                struct perf_pmu *pmu = NULL;
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index d2fb597c9a8c..3ba6a1742f91 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -234,6 +234,74 @@ static int perf_pmu__parse_snapshot(struct perf_pmu_alias *alias,
        return 0;
 }
+static void perf_pmu_assign_str(char *name, const char *field, char **old_str,
+                                char **new_str)
+{
+        if (!*old_str)
+                goto set_new;
+        if (*new_str) { /* Have new string, check with old */
+                if (strcasecmp(*old_str, *new_str))
+                        pr_debug("alias %s differs in field '%s'\n",
+                                 name, field);
+                zfree(old_str);
+        } else          /* Nothing new --> keep old string */
+                return;
+set_new:
+        *old_str = *new_str;
+        *new_str = NULL;
+}
+static void perf_pmu_update_alias(struct perf_pmu_alias *old,
+                                  struct perf_pmu_alias *newalias)
+{
+        perf_pmu_assign_str(old->name, "desc", &old->desc, &newalias->desc);
+        perf_pmu_assign_str(old->name, "long_desc", &old->long_desc,
+                            &newalias->long_desc);
+        perf_pmu_assign_str(old->name, "topic", &old->topic, &newalias->topic);
+        perf_pmu_assign_str(old->name, "metric_expr", &old->metric_expr,
+                            &newalias->metric_expr);
+        perf_pmu_assign_str(old->name, "metric_name", &old->metric_name,
+                            &newalias->metric_name);
+        perf_pmu_assign_str(old->name, "value", &old->str, &newalias->str);
+        old->scale = newalias->scale;
+        old->per_pkg = newalias->per_pkg;
+        old->snapshot = newalias->snapshot;
+        memcpy(old->unit, newalias->unit, sizeof(old->unit));
+}
+/* Delete an alias entry. */
+static void perf_pmu_free_alias(struct perf_pmu_alias *newalias)
+{
+        zfree(&newalias->name);
+        zfree(&newalias->desc);
+        zfree(&newalias->long_desc);
+        zfree(&newalias->topic);
+        zfree(&newalias->str);
+        zfree(&newalias->metric_expr);
+        zfree(&newalias->metric_name);
+        parse_events_terms__purge(&newalias->terms);
+        free(newalias);
+}
+/* Merge an alias, search in alias list. If this name is already
+ * present merge both of them to combine all information.
+ */
+static bool perf_pmu_merge_alias(struct perf_pmu_alias *newalias,
+                                 struct list_head *alist)
+{
+        struct perf_pmu_alias *a;
+        list_for_each_entry(a, alist, list) {
+                if (!strcasecmp(newalias->name, a->name)) {
+                        perf_pmu_update_alias(a, newalias);
+                        perf_pmu_free_alias(newalias);
+                        return true;
+                }
+        }
+        return false;
+}
 static int __perf_pmu__new_alias(struct list_head *list, char *dir, char *name,
                                 char *desc, char *val,
                                 char *long_desc, char *topic,
@@ -241,9 +309,11 @@ static int __perf_pmu__new_alias(struct list_head *list, char *dir, char *name,
                                 char *metric_expr,
                                 char *metric_name)
 {
+        struct parse_events_term *term;
        struct perf_pmu_alias *alias;
        int ret;
        int num;
+        char newval[256];
        alias = malloc(sizeof(*alias));
        if (!alias)
@@ -262,6 +332,27 @@ static int __perf_pmu__new_alias(struct list_head *list, char *dir, char *name,
                return ret;
        }
+        /* Scan event and remove leading zeroes, spaces, newlines, some
+         * platforms have terms specified as
+         * event=0x0091 (read from files ../<PMU>/events/<FILE>
+         * and terms specified as event=0x91 (read from JSON files).
+         *
+         * Rebuild string to make alias->str member comparable.
+         */
+        memset(newval, 0, sizeof(newval));
+        ret = 0;
+        list_for_each_entry(term, &alias->terms, list) {
+                if (ret)
+                        ret += scnprintf(newval + ret, sizeof(newval) - ret,
+                                         ",");
+                if (term->type_val == PARSE_EVENTS__TERM_TYPE_NUM)
+                        ret += scnprintf(newval + ret, sizeof(newval) - ret,
+                                         "%s=%#x", term->config, term->val.num);
+                else if (term->type_val == PARSE_EVENTS__TERM_TYPE_STR)
+                        ret += scnprintf(newval + ret, sizeof(newval) - ret,
+                                         "%s=%s", term->config, term->val.str);
+        }
        alias->name = strdup(name);
        if (dir) {
                /*
@@ -285,9 +376,10 @@ static int __perf_pmu__new_alias(struct list_head *list, char *dir, char *name,
                snprintf(alias->unit, sizeof(alias->unit), "%s", unit);
        }
        alias->per_pkg = perpkg && sscanf(perpkg, "%d", &num) == 1 && num == 1;
-        alias->str = strdup(val);
+        alias->str = strdup(newval);
-        list_add_tail(&alias->list, list);
+        if (!perf_pmu_merge_alias(alias, list))
+                list_add_tail(&alias->list, list);
        return 0;
 }
@@ -303,6 +395,9 @@ static int perf_pmu__new_alias(struct list_head *list, char *dir, char *name, FI
        buf[ret] = 0;
+        /* Remove trailing newline from sysfs file */
+        rtrim(buf);
        return __perf_pmu__new_alias(list, dir, name, NULL, buf, NULL, NULL, NULL,
                                     NULL, NULL, NULL);
 }
diff --git a/tools/perf/util/sort.h b/tools/perf/util/sort.h
index 7cf2d5cc038e..8bf302cafcec 100644
--- a/tools/perf/util/sort.h
+++ b/tools/perf/util/sort.h
@@ -112,6 +112,8 @@ struct hist_entry {
        char                    level;
        u8                      filtered;
+        u16                     callchain_size;
        union {
                /*
                 * Since perf diff only supports the stdio output, TUI
@@ -153,7 +155,7 @@ struct hist_entry {
 static __pure inline bool hist_entry__has_callchains(struct hist_entry *he)
 {
-        return hists__has_callchains(he->hists);
+        return he->callchain_size != 0;
 }
 static inline bool hist_entry__has_pairs(struct hist_entry *he)
diff --git a/tools/power/x86/turbostat/turbostat.8 b/tools/power/x86/turbostat/turbostat.8
index ca9ef7017624..d39e4ff7d0bf 100644
--- a/tools/power/x86/turbostat/turbostat.8
+++ b/tools/power/x86/turbostat/turbostat.8
@@ -56,7 +56,7 @@ name as necessary to disambiguate it from others is necessary.  Note that option
 .PP
 \fB--hide column\fP do not show the specified built-in columns.  May be invoked multiple times, or with a comma-separated list of column names.  Use "--hide sysfs" to hide the sysfs statistics columns as a group.
 .PP
-\fB--enable column\fP show the specified built-in columns, which are otherwise disabled, by default.  Currently the only built-in counters disabled by default are "usec" and "Time_Of_Day_Seconds".
+\fB--enable column\fP show the specified built-in columns, which are otherwise disabled, by default.  Currently the only built-in counters disabled by default are "usec", "Time_Of_Day_Seconds", "APIC" and "X2APIC".
 The column name "all" can be used to enable all disabled-by-default built-in counters.
 .PP
 \fB--show column\fP show only the specified built-in columns.  May be invoked multiple times, or with a comma-separated list of column names.  Use "--show sysfs" to show the sysfs statistics columns as a group.
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index d6cff3070ebd..4d14bbbf9b63 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -109,6 +109,7 @@ unsigned int has_hwp_activity_window;	/* IA32_HWP_REQUEST[bits 41:32] */
 unsigned int has_hwp_epp;               /* IA32_HWP_REQUEST[bits 31:24] */
 unsigned int has_hwp_pkg;               /* IA32_HWP_REQUEST_PKG */
 unsigned int has_misc_feature_control;
+unsigned int first_counter_read = 1;
 #define RAPL_PKG                (1 << 0)
                                        /* 0x610 MSR_PKG_POWER_LIMIT */
@@ -170,6 +171,8 @@ struct thread_data {
        unsigned long long  irq_count;
        unsigned int smi_count;
        unsigned int cpu_id;
+        unsigned int apic_id;
+        unsigned int x2apic_id;
        unsigned int flags;
 #define CPU_IS_FIRST_THREAD_IN_CORE     0x2
 #define CPU_IS_FIRST_CORE_IN_PACKAGE    0x4
@@ -381,19 +384,23 @@ int get_msr(int cpu, off_t offset, unsigned long long *msr)
 }
 /*
- * Each string in this array is compared in --show and --hide cmdline.
+ * This list matches the column headers, except
- * Thus, strings that are proper sub-sets must follow their more specific peers.
+ * 1. built-in only, the sysfs counters are not here -- we learn of those at run-time
+ * 2. Core and CPU are moved to the end, we can't have strings that contain them
+ *    matching on them for --show and --hide.
 */
 struct msr_counter bic[] = {
        { 0x0, "usec" },
        { 0x0, "Time_Of_Day_Seconds" },
        { 0x0, "Package" },
+        { 0x0, "Node" },
        { 0x0, "Avg_MHz" },
+        { 0x0, "Busy%" },
        { 0x0, "Bzy_MHz" },
        { 0x0, "TSC_MHz" },
        { 0x0, "IRQ" },
        { 0x0, "SMI", "", 32, 0, FORMAT_DELTA, NULL},
-        { 0x0, "Busy%" },
+        { 0x0, "sysfs" },
        { 0x0, "CPU%c1" },
        { 0x0, "CPU%c3" },
        { 0x0, "CPU%c6" },
@@ -424,73 +431,73 @@ struct msr_counter bic[] = {
        { 0x0, "Cor_J" },
        { 0x0, "GFX_J" },
        { 0x0, "RAM_J" },
-        { 0x0, "Core" },
-        { 0x0, "CPU" },
        { 0x0, "Mod%c6" },
-        { 0x0, "sysfs" },
        { 0x0, "Totl%C0" },
        { 0x0, "Any%C0" },
        { 0x0, "GFX%C0" },
        { 0x0, "CPUGFX%" },
-        { 0x0, "Node%" },
+        { 0x0, "Core" },
+        { 0x0, "CPU" },
+        { 0x0, "APIC" },
+        { 0x0, "X2APIC" },
 };
 #define MAX_BIC (sizeof(bic) / sizeof(struct msr_counter))
 #define BIC_USEC        (1ULL << 0)
 #define BIC_TOD         (1ULL << 1)
 #define BIC_Package     (1ULL << 2)
-#define BIC_Avg_MHz     (1ULL << 3)
+#define BIC_Node        (1ULL << 3)
-#define BIC_Bzy_MHz     (1ULL << 4)
+#define BIC_Avg_MHz     (1ULL << 4)
-#define BIC_TSC_MHz     (1ULL << 5)
+#define BIC_Busy        (1ULL << 5)
-#define BIC_IRQ         (1ULL << 6)
+#define BIC_Bzy_MHz     (1ULL << 6)
-#define BIC_SMI         (1ULL << 7)
+#define BIC_TSC_MHz     (1ULL << 7)
-#define BIC_Busy        (1ULL << 8)
+#define BIC_IRQ         (1ULL << 8)
-#define BIC_CPU_c1      (1ULL << 9)
+#define BIC_SMI         (1ULL << 9)
-#define BIC_CPU_c3      (1ULL << 10)
+#define BIC_sysfs       (1ULL << 10)
-#define BIC_CPU_c6      (1ULL << 11)
+#define BIC_CPU_c1      (1ULL << 11)
-#define BIC_CPU_c7      (1ULL << 12)
+#define BIC_CPU_c3      (1ULL << 12)
-#define BIC_ThreadC     (1ULL << 13)
+#define BIC_CPU_c6      (1ULL << 13)
-#define BIC_CoreTmp     (1ULL << 14)
+#define BIC_CPU_c7      (1ULL << 14)
-#define BIC_CoreCnt     (1ULL << 15)
+#define BIC_ThreadC     (1ULL << 15)
-#define BIC_PkgTmp      (1ULL << 16)
+#define BIC_CoreTmp     (1ULL << 16)
-#define BIC_GFX_rc6     (1ULL << 17)
+#define BIC_CoreCnt     (1ULL << 17)
-#define BIC_GFXMHz      (1ULL << 18)
+#define BIC_PkgTmp      (1ULL << 18)
-#define BIC_Pkgpc2      (1ULL << 19)
+#define BIC_GFX_rc6     (1ULL << 19)
-#define BIC_Pkgpc3      (1ULL << 20)
+#define BIC_GFXMHz      (1ULL << 20)
-#define BIC_Pkgpc6      (1ULL << 21)
+#define BIC_Pkgpc2      (1ULL << 21)
-#define BIC_Pkgpc7      (1ULL << 22)
+#define BIC_Pkgpc3      (1ULL << 22)
-#define BIC_Pkgpc8      (1ULL << 23)
+#define BIC_Pkgpc6      (1ULL << 23)
-#define BIC_Pkgpc9      (1ULL << 24)
+#define BIC_Pkgpc7      (1ULL << 24)
-#define BIC_Pkgpc10     (1ULL << 25)
+#define BIC_Pkgpc8      (1ULL << 25)
-#define BIC_CPU_LPI     (1ULL << 26)
+#define BIC_Pkgpc9      (1ULL << 26)
-#define BIC_SYS_LPI     (1ULL << 27)
+#define BIC_Pkgpc10     (1ULL << 27)
-#define BIC_PkgWatt     (1ULL << 26)
+#define BIC_CPU_LPI     (1ULL << 28)
-#define BIC_CorWatt     (1ULL << 27)
+#define BIC_SYS_LPI     (1ULL << 29)
-#define BIC_GFXWatt     (1ULL << 28)
+#define BIC_PkgWatt     (1ULL << 30)
-#define BIC_PkgCnt      (1ULL << 29)
+#define BIC_CorWatt     (1ULL << 31)
-#define BIC_RAMWatt     (1ULL << 30)
+#define BIC_GFXWatt     (1ULL << 32)
-#define BIC_PKG__       (1ULL << 31)
+#define BIC_PkgCnt      (1ULL << 33)
-#define BIC_RAM__       (1ULL << 32)
+#define BIC_RAMWatt     (1ULL << 34)
-#define BIC_Pkg_J       (1ULL << 33)
+#define BIC_PKG__       (1ULL << 35)
-#define BIC_Cor_J       (1ULL << 34)
+#define BIC_RAM__       (1ULL << 36)
-#define BIC_GFX_J       (1ULL << 35)
+#define BIC_Pkg_J       (1ULL << 37)
-#define BIC_RAM_J       (1ULL << 36)
+#define BIC_Cor_J       (1ULL << 38)
-#define BIC_Core        (1ULL << 37)
+#define BIC_GFX_J       (1ULL << 39)
-#define BIC_CPU         (1ULL << 38)
+#define BIC_RAM_J       (1ULL << 40)
-#define BIC_Mod_c6      (1ULL << 39)
+#define BIC_Mod_c6      (1ULL << 41)
-#define BIC_sysfs       (1ULL << 40)
+#define BIC_Totl_c0     (1ULL << 42)
-#define BIC_Totl_c0     (1ULL << 41)
+#define BIC_Any_c0      (1ULL << 43)
-#define BIC_Any_c0      (1ULL << 42)
+#define BIC_GFX_c0      (1ULL << 44)
-#define BIC_GFX_c0      (1ULL << 43)
+#define BIC_CPUGFX      (1ULL << 45)
-#define BIC_CPUGFX      (1ULL << 44)
+#define BIC_Core        (1ULL << 46)
-#define BIC_Node        (1ULL << 45)
+#define BIC_CPU         (1ULL << 47)
+#define BIC_APIC        (1ULL << 48)
-#define BIC_DISABLED_BY_DEFAULT (BIC_USEC | BIC_TOD)
+#define BIC_X2APIC      (1ULL << 49)
+#define BIC_DISABLED_BY_DEFAULT (BIC_USEC | BIC_TOD | BIC_APIC | BIC_X2APIC)
 unsigned long long bic_enabled = (0xFFFFFFFFFFFFFFFFULL & ~BIC_DISABLED_BY_DEFAULT);
-unsigned long long bic_present = BIC_USEC | BIC_TOD | BIC_sysfs;
+unsigned long long bic_present = BIC_USEC | BIC_TOD | BIC_sysfs | BIC_APIC | BIC_X2APIC;
 #define DO_BIC(COUNTER_NAME) (bic_enabled & bic_present & COUNTER_NAME)
 #define ENABLE_BIC(COUNTER_NAME) (bic_enabled |= COUNTER_NAME)
@@ -517,17 +524,34 @@ void help(void)
        "when COMMAND completes.\n"
        "If no COMMAND is specified, turbostat wakes every 5-seconds\n"
        "to print statistics, until interrupted.\n"
-        "--add          add a counter\n"
+        "  -a, --add    add a counter\n"
-        "               eg. --add msr0x10,u64,cpu,delta,MY_TSC\n"
+        "                 eg. --add msr0x10,u64,cpu,delta,MY_TSC\n"
-        "--cpu  cpu-set limit output to summary plus cpu-set:\n"
+        "  -c, --cpu    cpu-set limit output to summary plus cpu-set:\n"
-        "               {core | package | j,k,l..m,n-p }\n"
+        "                 {core | package | j,k,l..m,n-p }\n"
-        "--quiet        skip decoding system configuration header\n"
+        "  -d, --debug  displays usec, Time_Of_Day_Seconds and more debugging\n"
-        "--interval sec.subsec  Override default 5-second measurement interval\n"
+        "  -D, --Dump   displays the raw counter values\n"
-        "--help         print this help message\n"
+        "  -e, --enable [all | column]\n"
-        "--list         list column headers only\n"
+        "               shows all or the specified disabled column\n"
-        "--num_iterations num   number of the measurement iterations\n"
+        "  -H, --hide [column|column,column,...]\n"
-        "--out file     create or truncate \"file\" for all output\n"
+        "               hide the specified column(s)\n"
-        "--version      print version information\n"
+        "  -i, --interval sec.subsec\n"
+        "               Override default 5-second measurement interval\n"
+        "  -J, --Joules displays energy in Joules instead of Watts\n"
+        "  -l, --list   list column headers only\n"
+        "  -n, --num_iterations num\n"
+        "               number of the measurement iterations\n"
+        "  -o, --out file\n"
+        "               create or truncate \"file\" for all output\n"
+        "  -q, --quiet  skip decoding system configuration header\n"
+        "  -s, --show [column|column,column,...]\n"
+        "               show only the specified column(s)\n"
+        "  -S, --Summary\n"
+        "               limits output to 1-line system summary per interval\n"
+        "  -T, --TCC temperature\n"
+        "               sets the Thermal Control Circuit temperature in\n"
+        "                 degrees Celsius\n"
+        "  -h, --help   print this help message\n"
+        "  -v, --version        print version information\n"
        "\n"
        "For more help, run \"man turbostat\"\n");
 }
@@ -601,6 +625,10 @@ void print_header(char *delim)
                outp += sprintf(outp, "%sCore", (printed++ ? delim : ""));
        if (DO_BIC(BIC_CPU))
                outp += sprintf(outp, "%sCPU", (printed++ ? delim : ""));
+        if (DO_BIC(BIC_APIC))
+                outp += sprintf(outp, "%sAPIC", (printed++ ? delim : ""));
+        if (DO_BIC(BIC_X2APIC))
+                outp += sprintf(outp, "%sX2APIC", (printed++ ? delim : ""));
        if (DO_BIC(BIC_Avg_MHz))
                outp += sprintf(outp, "%sAvg_MHz", (printed++ ? delim : ""));
        if (DO_BIC(BIC_Busy))
@@ -880,6 +908,10 @@ int format_counters(struct thread_data *t, struct core_data *c,
                        outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
                if (DO_BIC(BIC_CPU))
                        outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
+                if (DO_BIC(BIC_APIC))
+                        outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
+                if (DO_BIC(BIC_X2APIC))
+                        outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
        } else {
                if (DO_BIC(BIC_Package)) {
                        if (p)
@@ -904,6 +936,10 @@ int format_counters(struct thread_data *t, struct core_data *c,
                }
                if (DO_BIC(BIC_CPU))
                        outp += sprintf(outp, "%s%d", (printed++ ? delim : ""), t->cpu_id);
+                if (DO_BIC(BIC_APIC))
+                        outp += sprintf(outp, "%s%d", (printed++ ? delim : ""), t->apic_id);
+                if (DO_BIC(BIC_X2APIC))
+                        outp += sprintf(outp, "%s%d", (printed++ ? delim : ""), t->x2apic_id);
        }
        if (DO_BIC(BIC_Avg_MHz))
@@ -1231,6 +1267,12 @@ delta_thread(struct thread_data *new, struct thread_data *old,
        int i;
        struct msr_counter *mp;
+        /* we run cpuid just the 1st time, copy the results */
+        if (DO_BIC(BIC_APIC))
+                new->apic_id = old->apic_id;
+        if (DO_BIC(BIC_X2APIC))
+                new->x2apic_id = old->x2apic_id;
        /*
         * the timestamps from start of measurement interval are in "old"
         * the timestamp from end of measurement interval are in "new"
@@ -1393,6 +1435,12 @@ int sum_counters(struct thread_data *t, struct core_data *c,
        int i;
        struct msr_counter *mp;
+        /* copy un-changing apic_id's */
+        if (DO_BIC(BIC_APIC))
+                average.threads.apic_id = t->apic_id;
+        if (DO_BIC(BIC_X2APIC))
+                average.threads.x2apic_id = t->x2apic_id;
        /* remember first tv_begin */
        if (average.threads.tv_begin.tv_sec == 0)
                average.threads.tv_begin = t->tv_begin;
@@ -1619,6 +1667,34 @@ int get_mp(int cpu, struct msr_counter *mp, unsigned long long *counterp)
        return 0;
 }
+void get_apic_id(struct thread_data *t)
+{
+        unsigned int eax, ebx, ecx, edx, max_level;
+        eax = ebx = ecx = edx = 0;
+        if (!genuine_intel)
+                return;
+        __cpuid(0, max_level, ebx, ecx, edx);
+        __cpuid(1, eax, ebx, ecx, edx);
+        t->apic_id = (ebx >> 24) & 0xf;
+        if (max_level < 0xb)
+                return;
+        if (!DO_BIC(BIC_X2APIC))
+                return;
+        ecx = 0;
+        __cpuid(0xb, eax, ebx, ecx, edx);
+        t->x2apic_id = edx;
+        if (debug && (t->apic_id != t->x2apic_id))
+                fprintf(stderr, "cpu%d: apic 0x%x x2apic 0x%x\n", t->cpu_id, t->apic_id, t->x2apic_id);
+}
 /*
 * get_counters(...)
 * migrate to cpu
@@ -1632,7 +1708,6 @@ int get_counters(struct thread_data *t, struct core_data *c, struct pkg_data *p)
        struct msr_counter *mp;
        int i;
        gettimeofday(&t->tv_begin, (struct timezone *)NULL);
        if (cpu_migrate(cpu)) {
@@ -1640,6 +1715,8 @@ int get_counters(struct thread_data *t, struct core_data *c, struct pkg_data *p)
                return -1;
        }
+        if (first_counter_read)
+                get_apic_id(t);
 retry:
        t->tsc = rdtsc();       /* we are running on local CPU of interest */
@@ -2432,6 +2509,12 @@ void set_node_data(void)
                if (pni[pkg].count > topo.nodes_per_pkg)
                        topo.nodes_per_pkg = pni[0].count;
+        /* Fake 1 node per pkg for machines that don't
+         * expose nodes and thus avoid -nan results
+         */
+        if (topo.nodes_per_pkg == 0)
+                topo.nodes_per_pkg = 1;
        for (cpu = 0; cpu < topo.num_cpus; cpu++) {
                pkg = cpus[cpu].physical_package_id;
                node = cpus[cpu].physical_node_id;
@@ -2879,6 +2962,7 @@ void do_sleep(void)
        }
 }
 void turbostat_loop()
 {
        int retval;
@@ -2892,6 +2976,7 @@ restart:
        snapshot_proc_sysfs_files();
        retval = for_all_cpus(get_counters, EVEN_COUNTERS);
+        first_counter_read = 0;
        if (retval < -1) {
                exit(retval);
        } else if (retval == -1) {
@@ -4392,7 +4477,7 @@ void process_cpuid()
        if (!quiet) {
                fprintf(outf, "%d CPUID levels; family:model:stepping 0x%x:%x:%x (%d:%d:%d)\n",
                        max_level, family, model, stepping, family, model, stepping);
-                fprintf(outf, "CPUID(1): %s %s %s %s %s %s %s %s %s\n",
+                fprintf(outf, "CPUID(1): %s %s %s %s %s %s %s %s %s %s\n",
                        ecx & (1 << 0) ? "SSE3" : "-",
                        ecx & (1 << 3) ? "MONITOR" : "-",
                        ecx & (1 << 6) ? "SMX" : "-",
@@ -4401,6 +4486,7 @@ void process_cpuid()
                        edx & (1 << 4) ? "TSC" : "-",
                        edx & (1 << 5) ? "MSR" : "-",
                        edx & (1 << 22) ? "ACPI-TM" : "-",
+                        edx & (1 << 28) ? "HT" : "-",
                        edx & (1 << 29) ? "TM" : "-");
        }
@@ -4652,7 +4738,6 @@ void process_cpuid()
        return;
 }
 /*
 * in /dev/cpu/ return success for names that are numbers
 * ie. filter out ".", "..", "microcode".
@@ -4842,6 +4927,13 @@ void init_counter(struct thread_data *thread_base, struct core_data *core_base,
        struct core_data *c;
        struct pkg_data *p;
+        /* Workaround for systems where physical_node_id==-1
+         * and logical_node_id==(-1 - topo.num_cpus)
+         */
+        if (node_id < 0)
+                node_id = 0;
        t = GET_THREAD(thread_base, thread_id, core_id, node_id, pkg_id);
        c = GET_CORE(core_base, core_id, node_id, pkg_id);
        p = GET_PKG(pkg_base, pkg_id);
@@ -4946,6 +5038,7 @@ int fork_it(char **argv)
        snapshot_proc_sysfs_files();
        status = for_all_cpus(get_counters, EVEN_COUNTERS);
+        first_counter_read = 0;
        if (status)
                exit(status);
        /* clear affinity side-effect of get_counters() */
@@ -5009,7 +5102,7 @@ int get_and_dump_counters(void)
 }
 void print_version() {
-        fprintf(outf, "turbostat version 18.06.01"
+        fprintf(outf, "turbostat version 18.06.20"
                " - Len Brown <lenb@kernel.org>\n");
 }
@@ -5381,7 +5474,7 @@ void cmdline(int argc, char **argv)
                        break;
                case 'e':
                        /* --enable specified counter */
-                        bic_enabled |= bic_lookup(optarg, SHOW_LIST);
+                        bic_enabled = bic_enabled | bic_lookup(optarg, SHOW_LIST);
                        break;
                case 'd':
                        debug++;
@@ -5465,7 +5558,6 @@ void cmdline(int argc, char **argv)
 int main(int argc, char **argv)
 {
        outf = stderr;
        cmdline(argc, argv);
        if (!quiet)
diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config
index 1eefe211a4a8..7eb613ffef55 100644
--- a/tools/testing/selftests/bpf/config
+++ b/tools/testing/selftests/bpf/config
@@ -7,3 +7,13 @@ CONFIG_CGROUP_BPF=y
 CONFIG_NETDEVSIM=m
 CONFIG_NET_CLS_ACT=y
 CONFIG_NET_SCH_INGRESS=y
+CONFIG_NET_IPIP=y
+CONFIG_IPV6=y
+CONFIG_NET_IPGRE_DEMUX=y
+CONFIG_NET_IPGRE=y
+CONFIG_IPV6_GRE=y
+CONFIG_CRYPTO_USER_API_HASH=m
+CONFIG_CRYPTO_HMAC=m
+CONFIG_CRYPTO_SHA256=m
+CONFIG_VXLAN=y
+CONFIG_GENEVE=y
diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
index e78aad0a68bb..be800d0e7a84 100755
--- a/tools/testing/selftests/bpf/test_offload.py
+++ b/tools/testing/selftests/bpf/test_offload.py
@@ -163,6 +163,10 @@ def bpftool(args, JSON=True, ns="", fail=True):
 def bpftool_prog_list(expected=None, ns=""):
    _, progs = bpftool("prog show", JSON=True, ns=ns, fail=True)
+    # Remove the base progs
+    for p in base_progs:
+        if p in progs:
+            progs.remove(p)
    if expected is not None:
        if len(progs) != expected:
            fail(True, "%d BPF programs loaded, expected %d" %
@@ -171,6 +175,10 @@ def bpftool_prog_list(expected=None, ns=""):
 def bpftool_map_list(expected=None, ns=""):
    _, maps = bpftool("map show", JSON=True, ns=ns, fail=True)
+    # Remove the base maps
+    for m in base_maps:
+        if m in maps:
+            maps.remove(m)
    if expected is not None:
        if len(maps) != expected:
            fail(True, "%d BPF maps loaded, expected %d" %
@@ -585,8 +593,8 @@ skip(os.getuid() != 0, "test must be run as root")
 # Check tools
 ret, progs = bpftool("prog", fail=False)
 skip(ret != 0, "bpftool not installed")
-# Check no BPF programs are loaded
+base_progs = progs
-skip(len(progs) != 0, "BPF programs already loaded on the system")
+_, base_maps = bpftool("map")
 # Check netdevsim
 ret, out = cmd("modprobe netdevsim", fail=False)
diff --git a/tools/testing/selftests/bpf/test_tunnel.sh b/tools/testing/selftests/bpf/test_tunnel.sh
index aeb2901f21f4..546aee3e9fb4 100755
--- a/tools/testing/selftests/bpf/test_tunnel.sh
+++ b/tools/testing/selftests/bpf/test_tunnel.sh
@@ -608,28 +608,26 @@ setup_xfrm_tunnel()
 test_xfrm_tunnel()
 {
        config_device
-        #tcpdump -nei veth1 ip &
+        > /sys/kernel/debug/tracing/trace
-        output=$(mktemp)
+        setup_xfrm_tunnel
-        cat /sys/kernel/debug/tracing/trace_pipe | tee $output &
-        setup_xfrm_tunnel
        tc qdisc add dev veth1 clsact
        tc filter add dev veth1 proto ip ingress bpf da obj test_tunnel_kern.o \
                sec xfrm_get_state
        ip netns exec at_ns0 ping $PING_ARG 10.1.1.200
        sleep 1
-        grep "reqid 1" $output
+        grep "reqid 1" /sys/kernel/debug/tracing/trace
        check_err $?
-        grep "spi 0x1" $output
+        grep "spi 0x1" /sys/kernel/debug/tracing/trace
        check_err $?
-        grep "remote ip 0xac100164" $output
+        grep "remote ip 0xac100164" /sys/kernel/debug/tracing/trace
        check_err $?
        cleanup
        if [ $ret -ne 0 ]; then
-                echo -e ${RED}"FAIL: xfrm tunnel"${NC}
+                echo -e ${RED}"FAIL: xfrm tunnel"${NC}
-                return 1
+                return 1
-        fi
+        fi
-        echo -e ${GREEN}"PASS: xfrm tunnel"${NC}
+        echo -e ${GREEN}"PASS: xfrm tunnel"${NC}
 }
 attach_bpf()
@@ -657,6 +655,10 @@ cleanup()
        ip link del ip6geneve11 2> /dev/null
        ip link del erspan11 2> /dev/null
        ip link del ip6erspan11 2> /dev/null
+        ip xfrm policy delete dir out src 10.1.1.200/32 dst 10.1.1.100/32 2> /dev/null
+        ip xfrm policy delete dir in src 10.1.1.100/32 dst 10.1.1.200/32 2> /dev/null
+        ip xfrm state delete src 172.16.1.100 dst 172.16.1.200 proto esp spi 0x1 2> /dev/null
+        ip xfrm state delete src 172.16.1.200 dst 172.16.1.100 proto esp spi 0x2 2> /dev/null
 }
 cleanup_exit()
@@ -668,7 +670,7 @@ cleanup_exit()
 check()
 {
-        ip link help $1 2>&1 | grep -q "^Usage:"
+        ip link help 2>&1 | grep -q "\s$1\s"
        if [ $? -ne 0 ];then
                echo "SKIP $1: iproute2 not support"
        cleanup
diff --git a/tools/testing/selftests/net/.gitignore b/tools/testing/selftests/net/.gitignore
index 128e548aa377..1a0ac3a29ec5 100644
--- a/tools/testing/selftests/net/.gitignore
+++ b/tools/testing/selftests/net/.gitignore
@@ -12,3 +12,4 @@ tcp_mmap
 udpgso
 udpgso_bench_rx
 udpgso_bench_tx
+tcp_inq
diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config
index 7ba089b33e8b..cd3a2f1545b5 100644
--- a/tools/testing/selftests/net/config
+++ b/tools/testing/selftests/net/config
@@ -12,3 +12,5 @@ CONFIG_NET_IPVTI=y
 CONFIG_INET6_XFRM_MODE_TUNNEL=y
 CONFIG_IPV6_VTI=y
 CONFIG_DUMMY=y
+CONFIG_BRIDGE=y
+CONFIG_VLAN_8021Q=y
diff --git a/tools/testing/selftests/pstore/pstore_post_reboot_tests b/tools/testing/selftests/pstore/pstore_post_reboot_tests
index 6ccb154cb4aa..22f8df1ad7d4 100755
--- a/tools/testing/selftests/pstore/pstore_post_reboot_tests
+++ b/tools/testing/selftests/pstore/pstore_post_reboot_tests
@@ -7,13 +7,16 @@
 #
 # Released under the terms of the GPL v2.
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
 . ./common_tests
 if [ -e $REBOOT_FLAG  ]; then
    rm $REBOOT_FLAG
 else
    prlog "pstore_crash_test has not been executed yet. we skip further tests."
-    exit 0
+    exit $ksft_skip
 fi
 prlog -n "Mounting pstore filesystem ... "
diff --git a/tools/testing/selftests/rseq/param_test.c b/tools/testing/selftests/rseq/param_test.c
index 6a9f602a8718..615252331813 100644
--- a/tools/testing/selftests/rseq/param_test.c
+++ b/tools/testing/selftests/rseq/param_test.c
@@ -137,6 +137,30 @@ unsigned int yield_mod_cnt, nr_abort;
        "subic. %%" INJECT_ASM_REG ", %%" INJECT_ASM_REG ", 1\n\t" \
        "bne 222b\n\t" \
        "333:\n\t"
+#elif defined(__mips__)
+#define RSEQ_INJECT_INPUT \
+        , [loop_cnt_1]"m"(loop_cnt[1]) \
+        , [loop_cnt_2]"m"(loop_cnt[2]) \
+        , [loop_cnt_3]"m"(loop_cnt[3]) \
+        , [loop_cnt_4]"m"(loop_cnt[4]) \
+        , [loop_cnt_5]"m"(loop_cnt[5]) \
+        , [loop_cnt_6]"m"(loop_cnt[6])
+#define INJECT_ASM_REG  "$5"
+#define RSEQ_INJECT_CLOBBER \
+        , INJECT_ASM_REG
+#define RSEQ_INJECT_ASM(n) \
+        "lw " INJECT_ASM_REG ", %[loop_cnt_" #n "]\n\t" \
+        "beqz " INJECT_ASM_REG ", 333f\n\t" \
+        "222:\n\t" \
+        "addiu " INJECT_ASM_REG ", -1\n\t" \
+        "bnez " INJECT_ASM_REG ", 222b\n\t" \
+        "333:\n\t"
 #else
 #error unsupported target
 #endif
diff --git a/tools/testing/selftests/rseq/rseq-arm.h b/tools/testing/selftests/rseq/rseq-arm.h
index 3b055f9aeaab..3cea19877227 100644
--- a/tools/testing/selftests/rseq/rseq-arm.h
+++ b/tools/testing/selftests/rseq/rseq-arm.h
@@ -57,6 +57,7 @@ do {									\
 #define __RSEQ_ASM_DEFINE_ABORT(table_label, label, teardown,           \
                                abort_label, version, flags,            \
                                start_ip, post_commit_offset, abort_ip) \
+                ".balign 32\n\t"                                        \
                __rseq_str(table_label) ":\n\t"                         \
                ".word " __rseq_str(version) ", " __rseq_str(flags) "\n\t" \
                ".word " __rseq_str(start_ip) ", 0x0, " __rseq_str(post_commit_offset) ", 0x0, " __rseq_str(abort_ip) ", 0x0\n\t" \
diff --git a/tools/testing/selftests/rseq/rseq-mips.h b/tools/testing/selftests/rseq/rseq-mips.h
new file mode 100644
index 000000000000..7f48ecf46994
--- /dev/null
+++ b/tools/testing/selftests/rseq/rseq-mips.h
@@ -0,0 +1,725 @@
+/* SPDX-License-Identifier: LGPL-2.1 OR MIT */
+/*
+ * Author: Paul Burton <paul.burton@mips.com>
+ * (C) Copyright 2018 MIPS Tech LLC
+ *
+ * Based on rseq-arm.h:
+ * (C) Copyright 2016-2018 - Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+ */
+#define RSEQ_SIG        0x53053053
+#define rseq_smp_mb()   __asm__ __volatile__ ("sync" ::: "memory")
+#define rseq_smp_rmb()  rseq_smp_mb()
+#define rseq_smp_wmb()  rseq_smp_mb()
+#define rseq_smp_load_acquire(p)                                        \
+__extension__ ({                                                        \
+        __typeof(*p) ____p1 = RSEQ_READ_ONCE(*p);                       \
+        rseq_smp_mb();                                                  \
+        ____p1;                                                         \
+})
+#define rseq_smp_acquire__after_ctrl_dep()      rseq_smp_rmb()
+#define rseq_smp_store_release(p, v)                                    \
+do {                                                                    \
+        rseq_smp_mb();                                                  \
+        RSEQ_WRITE_ONCE(*p, v);                                         \
+} while (0)
+#ifdef RSEQ_SKIP_FASTPATH
+#include "rseq-skip.h"
+#else /* !RSEQ_SKIP_FASTPATH */
+#if _MIPS_SZLONG == 64
+# define LONG                   ".dword"
+# define LONG_LA                "dla"
+# define LONG_L                 "ld"
+# define LONG_S                 "sd"
+# define LONG_ADDI              "daddiu"
+# define U32_U64_PAD(x)         x
+#elif _MIPS_SZLONG == 32
+# define LONG                   ".word"
+# define LONG_LA                "la"
+# define LONG_L                 "lw"
+# define LONG_S                 "sw"
+# define LONG_ADDI              "addiu"
+# ifdef __BIG_ENDIAN
+#  define U32_U64_PAD(x)        "0x0, " x
+# else
+#  define U32_U64_PAD(x)        x ", 0x0"
+# endif
+#else
+# error unsupported _MIPS_SZLONG
+#endif
+#define __RSEQ_ASM_DEFINE_TABLE(version, flags, start_ip, \
+                                post_commit_offset, abort_ip) \
+                ".pushsection __rseq_table, \"aw\"\n\t" \
+                ".balign 32\n\t" \
+                ".word " __rseq_str(version) ", " __rseq_str(flags) "\n\t" \
+                LONG " " U32_U64_PAD(__rseq_str(start_ip)) "\n\t" \
+                LONG " " U32_U64_PAD(__rseq_str(post_commit_offset)) "\n\t" \
+                LONG " " U32_U64_PAD(__rseq_str(abort_ip)) "\n\t" \
+                ".popsection\n\t"
+#define RSEQ_ASM_DEFINE_TABLE(start_ip, post_commit_ip, abort_ip) \
+        __RSEQ_ASM_DEFINE_TABLE(0x0, 0x0, start_ip, \
+                                (post_commit_ip - start_ip), abort_ip)
+#define RSEQ_ASM_STORE_RSEQ_CS(label, cs_label, rseq_cs) \
+                RSEQ_INJECT_ASM(1) \
+                LONG_LA " $4, " __rseq_str(cs_label) "\n\t" \
+                LONG_S  " $4, %[" __rseq_str(rseq_cs) "]\n\t" \
+                __rseq_str(label) ":\n\t"
+#define RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, label) \
+                RSEQ_INJECT_ASM(2) \
+                "lw  $4, %[" __rseq_str(current_cpu_id) "]\n\t" \
+                "bne $4, %[" __rseq_str(cpu_id) "], " __rseq_str(label) "\n\t"
+#define __RSEQ_ASM_DEFINE_ABORT(table_label, label, teardown, \
+                                abort_label, version, flags, \
+                                start_ip, post_commit_offset, abort_ip) \
+                ".balign 32\n\t" \
+                __rseq_str(table_label) ":\n\t" \
+                ".word " __rseq_str(version) ", " __rseq_str(flags) "\n\t" \
+                LONG " " U32_U64_PAD(__rseq_str(start_ip)) "\n\t" \
+                LONG " " U32_U64_PAD(__rseq_str(post_commit_offset)) "\n\t" \
+                LONG " " U32_U64_PAD(__rseq_str(abort_ip)) "\n\t" \
+                ".word " __rseq_str(RSEQ_SIG) "\n\t" \
+                __rseq_str(label) ":\n\t" \
+                teardown \
+                "b %l[" __rseq_str(abort_label) "]\n\t"
+#define RSEQ_ASM_DEFINE_ABORT(table_label, label, teardown, abort_label, \
+                              start_ip, post_commit_ip, abort_ip) \
+        __RSEQ_ASM_DEFINE_ABORT(table_label, label, teardown, \
+                                abort_label, 0x0, 0x0, start_ip, \
+                                (post_commit_ip - start_ip), abort_ip)
+#define RSEQ_ASM_DEFINE_CMPFAIL(label, teardown, cmpfail_label) \
+                __rseq_str(label) ":\n\t" \
+                teardown \
+                "b %l[" __rseq_str(cmpfail_label) "]\n\t"
+#define rseq_workaround_gcc_asm_size_guess()    __asm__ __volatile__("")
+static inline __attribute__((always_inline))
+int rseq_cmpeqv_storev(intptr_t *v, intptr_t expect, intptr_t newv, int cpu)
+{
+        RSEQ_INJECT_C(9)
+        rseq_workaround_gcc_asm_size_guess();
+        __asm__ __volatile__ goto (
+                RSEQ_ASM_DEFINE_TABLE(1f, 2f, 4f) /* start, commit, abort */
+                /* Start rseq by storing table entry pointer into rseq_cs. */
+                RSEQ_ASM_STORE_RSEQ_CS(1, 3f, rseq_cs)
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, 4f)
+                RSEQ_INJECT_ASM(3)
+                LONG_L " $4, %[v]\n\t"
+                "bne $4, %[expect], %l[cmpfail]\n\t"
+                RSEQ_INJECT_ASM(4)
+#ifdef RSEQ_COMPARE_TWICE
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, %l[error1])
+                LONG_L " $4, %[v]\n\t"
+                "bne $4, %[expect], %l[error2]\n\t"
+#endif
+                /* final store */
+                LONG_S " %[newv], %[v]\n\t"
+                "2:\n\t"
+                RSEQ_INJECT_ASM(5)
+                "b 5f\n\t"
+                RSEQ_ASM_DEFINE_ABORT(3, 4, "", abort, 1b, 2b, 4f)
+                "5:\n\t"
+                : /* gcc asm goto does not allow outputs */
+                : [cpu_id]              "r" (cpu),
+                  [current_cpu_id]      "m" (__rseq_abi.cpu_id),
+                  [rseq_cs]             "m" (__rseq_abi.rseq_cs),
+                  [v]                   "m" (*v),
+                  [expect]              "r" (expect),
+                  [newv]                "r" (newv)
+                  RSEQ_INJECT_INPUT
+                : "$4", "memory"
+                  RSEQ_INJECT_CLOBBER
+                : abort, cmpfail
+#ifdef RSEQ_COMPARE_TWICE
+                  , error1, error2
+#endif
+        );
+        rseq_workaround_gcc_asm_size_guess();
+        return 0;
+abort:
+        rseq_workaround_gcc_asm_size_guess();
+        RSEQ_INJECT_FAILED
+        return -1;
+cmpfail:
+        rseq_workaround_gcc_asm_size_guess();
+        return 1;
+#ifdef RSEQ_COMPARE_TWICE
+error1:
+        rseq_bug("cpu_id comparison failed");
+error2:
+        rseq_bug("expected value comparison failed");
+#endif
+}
+static inline __attribute__((always_inline))
+int rseq_cmpnev_storeoffp_load(intptr_t *v, intptr_t expectnot,
+                               off_t voffp, intptr_t *load, int cpu)
+{
+        RSEQ_INJECT_C(9)
+        rseq_workaround_gcc_asm_size_guess();
+        __asm__ __volatile__ goto (
+                RSEQ_ASM_DEFINE_TABLE(1f, 2f, 4f) /* start, commit, abort */
+                /* Start rseq by storing table entry pointer into rseq_cs. */
+                RSEQ_ASM_STORE_RSEQ_CS(1, 3f, rseq_cs)
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, 4f)
+                RSEQ_INJECT_ASM(3)
+                LONG_L " $4, %[v]\n\t"
+                "beq $4, %[expectnot], %l[cmpfail]\n\t"
+                RSEQ_INJECT_ASM(4)
+#ifdef RSEQ_COMPARE_TWICE
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, %l[error1])
+                LONG_L " $4, %[v]\n\t"
+                "beq $4, %[expectnot], %l[error2]\n\t"
+#endif
+                LONG_S " $4, %[load]\n\t"
+                LONG_ADDI " $4, %[voffp]\n\t"
+                LONG_L " $4, 0($4)\n\t"
+                /* final store */
+                LONG_S " $4, %[v]\n\t"
+                "2:\n\t"
+                RSEQ_INJECT_ASM(5)
+                "b 5f\n\t"
+                RSEQ_ASM_DEFINE_ABORT(3, 4, "", abort, 1b, 2b, 4f)
+                "5:\n\t"
+                : /* gcc asm goto does not allow outputs */
+                : [cpu_id]              "r" (cpu),
+                  [current_cpu_id]      "m" (__rseq_abi.cpu_id),
+                  [rseq_cs]             "m" (__rseq_abi.rseq_cs),
+                  /* final store input */
+                  [v]                   "m" (*v),
+                  [expectnot]           "r" (expectnot),
+                  [voffp]               "Ir" (voffp),
+                  [load]                "m" (*load)
+                  RSEQ_INJECT_INPUT
+                : "$4", "memory"
+                  RSEQ_INJECT_CLOBBER
+                : abort, cmpfail
+#ifdef RSEQ_COMPARE_TWICE
+                  , error1, error2
+#endif
+        );
+        rseq_workaround_gcc_asm_size_guess();
+        return 0;
+abort:
+        rseq_workaround_gcc_asm_size_guess();
+        RSEQ_INJECT_FAILED
+        return -1;
+cmpfail:
+        rseq_workaround_gcc_asm_size_guess();
+        return 1;
+#ifdef RSEQ_COMPARE_TWICE
+error1:
+        rseq_bug("cpu_id comparison failed");
+error2:
+        rseq_bug("expected value comparison failed");
+#endif
+}
+static inline __attribute__((always_inline))
+int rseq_addv(intptr_t *v, intptr_t count, int cpu)
+{
+        RSEQ_INJECT_C(9)
+        rseq_workaround_gcc_asm_size_guess();
+        __asm__ __volatile__ goto (
+                RSEQ_ASM_DEFINE_TABLE(1f, 2f, 4f) /* start, commit, abort */
+                /* Start rseq by storing table entry pointer into rseq_cs. */
+                RSEQ_ASM_STORE_RSEQ_CS(1, 3f, rseq_cs)
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, 4f)
+                RSEQ_INJECT_ASM(3)
+#ifdef RSEQ_COMPARE_TWICE
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, %l[error1])
+#endif
+                LONG_L " $4, %[v]\n\t"
+                LONG_ADDI " $4, %[count]\n\t"
+                /* final store */
+                LONG_S " $4, %[v]\n\t"
+                "2:\n\t"
+                RSEQ_INJECT_ASM(4)
+                "b 5f\n\t"
+                RSEQ_ASM_DEFINE_ABORT(3, 4, "", abort, 1b, 2b, 4f)
+                "5:\n\t"
+                : /* gcc asm goto does not allow outputs */
+                : [cpu_id]              "r" (cpu),
+                  [current_cpu_id]      "m" (__rseq_abi.cpu_id),
+                  [rseq_cs]             "m" (__rseq_abi.rseq_cs),
+                  [v]                   "m" (*v),
+                  [count]               "Ir" (count)
+                  RSEQ_INJECT_INPUT
+                : "$4", "memory"
+                  RSEQ_INJECT_CLOBBER
+                : abort
+#ifdef RSEQ_COMPARE_TWICE
+                  , error1
+#endif
+        );
+        rseq_workaround_gcc_asm_size_guess();
+        return 0;
+abort:
+        rseq_workaround_gcc_asm_size_guess();
+        RSEQ_INJECT_FAILED
+        return -1;
+#ifdef RSEQ_COMPARE_TWICE
+error1:
+        rseq_bug("cpu_id comparison failed");
+#endif
+}
+static inline __attribute__((always_inline))
+int rseq_cmpeqv_trystorev_storev(intptr_t *v, intptr_t expect,
+                                 intptr_t *v2, intptr_t newv2,
+                                 intptr_t newv, int cpu)
+{
+        RSEQ_INJECT_C(9)
+        rseq_workaround_gcc_asm_size_guess();
+        __asm__ __volatile__ goto (
+                RSEQ_ASM_DEFINE_TABLE(1f, 2f, 4f) /* start, commit, abort */
+                /* Start rseq by storing table entry pointer into rseq_cs. */
+                RSEQ_ASM_STORE_RSEQ_CS(1, 3f, rseq_cs)
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, 4f)
+                RSEQ_INJECT_ASM(3)
+                LONG_L " $4, %[v]\n\t"
+                "bne $4, %[expect], %l[cmpfail]\n\t"
+                RSEQ_INJECT_ASM(4)
+#ifdef RSEQ_COMPARE_TWICE
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, %l[error1])
+                LONG_L " $4, %[v]\n\t"
+                "bne $4, %[expect], %l[error2]\n\t"
+#endif
+                /* try store */
+                LONG_S " %[newv2], %[v2]\n\t"
+                RSEQ_INJECT_ASM(5)
+                /* final store */
+                LONG_S " %[newv], %[v]\n\t"
+                "2:\n\t"
+                RSEQ_INJECT_ASM(6)
+                "b 5f\n\t"
+                RSEQ_ASM_DEFINE_ABORT(3, 4, "", abort, 1b, 2b, 4f)
+                "5:\n\t"
+                : /* gcc asm goto does not allow outputs */
+                : [cpu_id]              "r" (cpu),
+                  [current_cpu_id]      "m" (__rseq_abi.cpu_id),
+                  [rseq_cs]             "m" (__rseq_abi.rseq_cs),
+                  /* try store input */
+                  [v2]                  "m" (*v2),
+                  [newv2]               "r" (newv2),
+                  /* final store input */
+                  [v]                   "m" (*v),
+                  [expect]              "r" (expect),
+                  [newv]                "r" (newv)
+                  RSEQ_INJECT_INPUT
+                : "$4", "memory"
+                  RSEQ_INJECT_CLOBBER
+                : abort, cmpfail
+#ifdef RSEQ_COMPARE_TWICE
+                  , error1, error2
+#endif
+        );
+        rseq_workaround_gcc_asm_size_guess();
+        return 0;
+abort:
+        rseq_workaround_gcc_asm_size_guess();
+        RSEQ_INJECT_FAILED
+        return -1;
+cmpfail:
+        rseq_workaround_gcc_asm_size_guess();
+        return 1;
+#ifdef RSEQ_COMPARE_TWICE
+error1:
+        rseq_bug("cpu_id comparison failed");
+error2:
+        rseq_bug("expected value comparison failed");
+#endif
+}
+static inline __attribute__((always_inline))
+int rseq_cmpeqv_trystorev_storev_release(intptr_t *v, intptr_t expect,
+                                         intptr_t *v2, intptr_t newv2,
+                                         intptr_t newv, int cpu)
+{
+        RSEQ_INJECT_C(9)
+        rseq_workaround_gcc_asm_size_guess();
+        __asm__ __volatile__ goto (
+                RSEQ_ASM_DEFINE_TABLE(1f, 2f, 4f) /* start, commit, abort */
+                /* Start rseq by storing table entry pointer into rseq_cs. */
+                RSEQ_ASM_STORE_RSEQ_CS(1, 3f, rseq_cs)
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, 4f)
+                RSEQ_INJECT_ASM(3)
+                LONG_L " $4, %[v]\n\t"
+                "bne $4, %[expect], %l[cmpfail]\n\t"
+                RSEQ_INJECT_ASM(4)
+#ifdef RSEQ_COMPARE_TWICE
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, %l[error1])
+                LONG_L " $4, %[v]\n\t"
+                "bne $4, %[expect], %l[error2]\n\t"
+#endif
+                /* try store */
+                LONG_S " %[newv2], %[v2]\n\t"
+                RSEQ_INJECT_ASM(5)
+                "sync\n\t"      /* full sync provides store-release */
+                /* final store */
+                LONG_S " %[newv], %[v]\n\t"
+                "2:\n\t"
+                RSEQ_INJECT_ASM(6)
+                "b 5f\n\t"
+                RSEQ_ASM_DEFINE_ABORT(3, 4, "", abort, 1b, 2b, 4f)
+                "5:\n\t"
+                : /* gcc asm goto does not allow outputs */
+                : [cpu_id]              "r" (cpu),
+                  [current_cpu_id]      "m" (__rseq_abi.cpu_id),
+                  [rseq_cs]             "m" (__rseq_abi.rseq_cs),
+                  /* try store input */
+                  [v2]                  "m" (*v2),
+                  [newv2]               "r" (newv2),
+                  /* final store input */
+                  [v]                   "m" (*v),
+                  [expect]              "r" (expect),
+                  [newv]                "r" (newv)
+                  RSEQ_INJECT_INPUT
+                : "$4", "memory"
+                  RSEQ_INJECT_CLOBBER
+                : abort, cmpfail
+#ifdef RSEQ_COMPARE_TWICE
+                  , error1, error2
+#endif
+        );
+        rseq_workaround_gcc_asm_size_guess();
+        return 0;
+abort:
+        rseq_workaround_gcc_asm_size_guess();
+        RSEQ_INJECT_FAILED
+        return -1;
+cmpfail:
+        rseq_workaround_gcc_asm_size_guess();
+        return 1;
+#ifdef RSEQ_COMPARE_TWICE
+error1:
+        rseq_bug("cpu_id comparison failed");
+error2:
+        rseq_bug("expected value comparison failed");
+#endif
+}
+static inline __attribute__((always_inline))
+int rseq_cmpeqv_cmpeqv_storev(intptr_t *v, intptr_t expect,
+                              intptr_t *v2, intptr_t expect2,
+                              intptr_t newv, int cpu)
+{
+        RSEQ_INJECT_C(9)
+        rseq_workaround_gcc_asm_size_guess();
+        __asm__ __volatile__ goto (
+                RSEQ_ASM_DEFINE_TABLE(1f, 2f, 4f) /* start, commit, abort */
+                /* Start rseq by storing table entry pointer into rseq_cs. */
+                RSEQ_ASM_STORE_RSEQ_CS(1, 3f, rseq_cs)
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, 4f)
+                RSEQ_INJECT_ASM(3)
+                LONG_L " $4, %[v]\n\t"
+                "bne $4, %[expect], %l[cmpfail]\n\t"
+                RSEQ_INJECT_ASM(4)
+                LONG_L " $4, %[v2]\n\t"
+                "bne $4, %[expect2], %l[cmpfail]\n\t"
+                RSEQ_INJECT_ASM(5)
+#ifdef RSEQ_COMPARE_TWICE
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, %l[error1])
+                LONG_L " $4, %[v]\n\t"
+                "bne $4, %[expect], %l[error2]\n\t"
+                LONG_L " $4, %[v2]\n\t"
+                "bne $4, %[expect2], %l[error3]\n\t"
+#endif
+                /* final store */
+                LONG_S " %[newv], %[v]\n\t"
+                "2:\n\t"
+                RSEQ_INJECT_ASM(6)
+                "b 5f\n\t"
+                RSEQ_ASM_DEFINE_ABORT(3, 4, "", abort, 1b, 2b, 4f)
+                "5:\n\t"
+                : /* gcc asm goto does not allow outputs */
+                : [cpu_id]              "r" (cpu),
+                  [current_cpu_id]      "m" (__rseq_abi.cpu_id),
+                  [rseq_cs]             "m" (__rseq_abi.rseq_cs),
+                  /* cmp2 input */
+                  [v2]                  "m" (*v2),
+                  [expect2]             "r" (expect2),
+                  /* final store input */
+                  [v]                   "m" (*v),
+                  [expect]              "r" (expect),
+                  [newv]                "r" (newv)
+                  RSEQ_INJECT_INPUT
+                : "$4", "memory"
+                  RSEQ_INJECT_CLOBBER
+                : abort, cmpfail
+#ifdef RSEQ_COMPARE_TWICE
+                  , error1, error2, error3
+#endif
+        );
+        rseq_workaround_gcc_asm_size_guess();
+        return 0;
+abort:
+        rseq_workaround_gcc_asm_size_guess();
+        RSEQ_INJECT_FAILED
+        return -1;
+cmpfail:
+        rseq_workaround_gcc_asm_size_guess();
+        return 1;
+#ifdef RSEQ_COMPARE_TWICE
+error1:
+        rseq_bug("cpu_id comparison failed");
+error2:
+        rseq_bug("1st expected value comparison failed");
+error3:
+        rseq_bug("2nd expected value comparison failed");
+#endif
+}
+static inline __attribute__((always_inline))
+int rseq_cmpeqv_trymemcpy_storev(intptr_t *v, intptr_t expect,
+                                 void *dst, void *src, size_t len,
+                                 intptr_t newv, int cpu)
+{
+        uintptr_t rseq_scratch[3];
+        RSEQ_INJECT_C(9)
+        rseq_workaround_gcc_asm_size_guess();
+        __asm__ __volatile__ goto (
+                RSEQ_ASM_DEFINE_TABLE(1f, 2f, 4f) /* start, commit, abort */
+                LONG_S " %[src], %[rseq_scratch0]\n\t"
+                LONG_S "  %[dst], %[rseq_scratch1]\n\t"
+                LONG_S " %[len], %[rseq_scratch2]\n\t"
+                /* Start rseq by storing table entry pointer into rseq_cs. */
+                RSEQ_ASM_STORE_RSEQ_CS(1, 3f, rseq_cs)
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, 4f)
+                RSEQ_INJECT_ASM(3)
+                LONG_L " $4, %[v]\n\t"
+                "bne $4, %[expect], 5f\n\t"
+                RSEQ_INJECT_ASM(4)
+#ifdef RSEQ_COMPARE_TWICE
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, 6f)
+                LONG_L " $4, %[v]\n\t"
+                "bne $4, %[expect], 7f\n\t"
+#endif
+                /* try memcpy */
+                "beqz %[len], 333f\n\t" \
+                "222:\n\t" \
+                "lb   $4, 0(%[src])\n\t" \
+                "sb   $4, 0(%[dst])\n\t" \
+                LONG_ADDI " %[src], 1\n\t" \
+                LONG_ADDI " %[dst], 1\n\t" \
+                LONG_ADDI " %[len], -1\n\t" \
+                "bnez %[len], 222b\n\t" \
+                "333:\n\t" \
+                RSEQ_INJECT_ASM(5)
+                /* final store */
+                LONG_S " %[newv], %[v]\n\t"
+                "2:\n\t"
+                RSEQ_INJECT_ASM(6)
+                /* teardown */
+                LONG_L " %[len], %[rseq_scratch2]\n\t"
+                LONG_L " %[dst], %[rseq_scratch1]\n\t"
+                LONG_L " %[src], %[rseq_scratch0]\n\t"
+                "b 8f\n\t"
+                RSEQ_ASM_DEFINE_ABORT(3, 4,
+                                      /* teardown */
+                                      LONG_L " %[len], %[rseq_scratch2]\n\t"
+                                      LONG_L " %[dst], %[rseq_scratch1]\n\t"
+                                      LONG_L " %[src], %[rseq_scratch0]\n\t",
+                                      abort, 1b, 2b, 4f)
+                RSEQ_ASM_DEFINE_CMPFAIL(5,
+                                        /* teardown */
+                                        LONG_L " %[len], %[rseq_scratch2]\n\t"
+                                        LONG_L " %[dst], %[rseq_scratch1]\n\t"
+                                        LONG_L " %[src], %[rseq_scratch0]\n\t",
+                                        cmpfail)
+#ifdef RSEQ_COMPARE_TWICE
+                RSEQ_ASM_DEFINE_CMPFAIL(6,
+                                        /* teardown */
+                                        LONG_L " %[len], %[rseq_scratch2]\n\t"
+                                        LONG_L " %[dst], %[rseq_scratch1]\n\t"
+                                        LONG_L " %[src], %[rseq_scratch0]\n\t",
+                                        error1)
+                RSEQ_ASM_DEFINE_CMPFAIL(7,
+                                        /* teardown */
+                                        LONG_L " %[len], %[rseq_scratch2]\n\t"
+                                        LONG_L " %[dst], %[rseq_scratch1]\n\t"
+                                        LONG_L " %[src], %[rseq_scratch0]\n\t",
+                                        error2)
+#endif
+                "8:\n\t"
+                : /* gcc asm goto does not allow outputs */
+                : [cpu_id]              "r" (cpu),
+                  [current_cpu_id]      "m" (__rseq_abi.cpu_id),
+                  [rseq_cs]             "m" (__rseq_abi.rseq_cs),
+                  /* final store input */
+                  [v]                   "m" (*v),
+                  [expect]              "r" (expect),
+                  [newv]                "r" (newv),
+                  /* try memcpy input */
+                  [dst]                 "r" (dst),
+                  [src]                 "r" (src),
+                  [len]                 "r" (len),
+                  [rseq_scratch0]       "m" (rseq_scratch[0]),
+                  [rseq_scratch1]       "m" (rseq_scratch[1]),
+                  [rseq_scratch2]       "m" (rseq_scratch[2])
+                  RSEQ_INJECT_INPUT
+                : "$4", "memory"
+                  RSEQ_INJECT_CLOBBER
+                : abort, cmpfail
+#ifdef RSEQ_COMPARE_TWICE
+                  , error1, error2
+#endif
+        );
+        rseq_workaround_gcc_asm_size_guess();
+        return 0;
+abort:
+        rseq_workaround_gcc_asm_size_guess();
+        RSEQ_INJECT_FAILED
+        return -1;
+cmpfail:
+        rseq_workaround_gcc_asm_size_guess();
+        return 1;
+#ifdef RSEQ_COMPARE_TWICE
+error1:
+        rseq_workaround_gcc_asm_size_guess();
+        rseq_bug("cpu_id comparison failed");
+error2:
+        rseq_workaround_gcc_asm_size_guess();
+        rseq_bug("expected value comparison failed");
+#endif
+}
+static inline __attribute__((always_inline))
+int rseq_cmpeqv_trymemcpy_storev_release(intptr_t *v, intptr_t expect,
+                                         void *dst, void *src, size_t len,
+                                         intptr_t newv, int cpu)
+{
+        uintptr_t rseq_scratch[3];
+        RSEQ_INJECT_C(9)
+        rseq_workaround_gcc_asm_size_guess();
+        __asm__ __volatile__ goto (
+                RSEQ_ASM_DEFINE_TABLE(1f, 2f, 4f) /* start, commit, abort */
+                LONG_S " %[src], %[rseq_scratch0]\n\t"
+                LONG_S " %[dst], %[rseq_scratch1]\n\t"
+                LONG_S " %[len], %[rseq_scratch2]\n\t"
+                /* Start rseq by storing table entry pointer into rseq_cs. */
+                RSEQ_ASM_STORE_RSEQ_CS(1, 3f, rseq_cs)
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, 4f)
+                RSEQ_INJECT_ASM(3)
+                LONG_L " $4, %[v]\n\t"
+                "bne $4, %[expect], 5f\n\t"
+                RSEQ_INJECT_ASM(4)
+#ifdef RSEQ_COMPARE_TWICE
+                RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, 6f)
+                LONG_L " $4, %[v]\n\t"
+                "bne $4, %[expect], 7f\n\t"
+#endif
+                /* try memcpy */
+                "beqz %[len], 333f\n\t" \
+                "222:\n\t" \
+                "lb   $4, 0(%[src])\n\t" \
+                "sb   $4, 0(%[dst])\n\t" \
+                LONG_ADDI " %[src], 1\n\t" \
+                LONG_ADDI " %[dst], 1\n\t" \
+                LONG_ADDI " %[len], -1\n\t" \
+                "bnez %[len], 222b\n\t" \
+                "333:\n\t" \
+                RSEQ_INJECT_ASM(5)
+                "sync\n\t"      /* full sync provides store-release */
+                /* final store */
+                LONG_S " %[newv], %[v]\n\t"
+                "2:\n\t"
+                RSEQ_INJECT_ASM(6)
+                /* teardown */
+                LONG_L " %[len], %[rseq_scratch2]\n\t"
+                LONG_L " %[dst], %[rseq_scratch1]\n\t"
+                LONG_L " %[src], %[rseq_scratch0]\n\t"
+                "b 8f\n\t"
+                RSEQ_ASM_DEFINE_ABORT(3, 4,
+                                      /* teardown */
+                                      LONG_L " %[len], %[rseq_scratch2]\n\t"
+                                      LONG_L " %[dst], %[rseq_scratch1]\n\t"
+                                      LONG_L " %[src], %[rseq_scratch0]\n\t",
+                                      abort, 1b, 2b, 4f)
+                RSEQ_ASM_DEFINE_CMPFAIL(5,
+                                        /* teardown */
+                                        LONG_L " %[len], %[rseq_scratch2]\n\t"
+                                        LONG_L " %[dst], %[rseq_scratch1]\n\t"
+                                        LONG_L " %[src], %[rseq_scratch0]\n\t",
+                                        cmpfail)
+#ifdef RSEQ_COMPARE_TWICE
+                RSEQ_ASM_DEFINE_CMPFAIL(6,
+                                        /* teardown */
+                                        LONG_L " %[len], %[rseq_scratch2]\n\t"
+                                        LONG_L " %[dst], %[rseq_scratch1]\n\t"
+                                        LONG_L " %[src], %[rseq_scratch0]\n\t",
+                                        error1)
+                RSEQ_ASM_DEFINE_CMPFAIL(7,
+                                        /* teardown */
+                                        LONG_L " %[len], %[rseq_scratch2]\n\t"
+                                        LONG_L " %[dst], %[rseq_scratch1]\n\t"
+                                        LONG_L " %[src], %[rseq_scratch0]\n\t",
+                                        error2)
+#endif
+                "8:\n\t"
+                : /* gcc asm goto does not allow outputs */
+                : [cpu_id]              "r" (cpu),
+                  [current_cpu_id]      "m" (__rseq_abi.cpu_id),
+                  [rseq_cs]             "m" (__rseq_abi.rseq_cs),
+                  /* final store input */
+                  [v]                   "m" (*v),
+                  [expect]              "r" (expect),
+                  [newv]                "r" (newv),
+                  /* try memcpy input */
+                  [dst]                 "r" (dst),
+                  [src]                 "r" (src),
+                  [len]                 "r" (len),
+                  [rseq_scratch0]       "m" (rseq_scratch[0]),
+                  [rseq_scratch1]       "m" (rseq_scratch[1]),
+                  [rseq_scratch2]       "m" (rseq_scratch[2])
+                  RSEQ_INJECT_INPUT
+                : "$4", "memory"
+                  RSEQ_INJECT_CLOBBER
+                : abort, cmpfail
+#ifdef RSEQ_COMPARE_TWICE
+                  , error1, error2
+#endif
+        );
+        rseq_workaround_gcc_asm_size_guess();
+        return 0;
+abort:
+        rseq_workaround_gcc_asm_size_guess();
+        RSEQ_INJECT_FAILED
+        return -1;
+cmpfail:
+        rseq_workaround_gcc_asm_size_guess();
+        return 1;
+#ifdef RSEQ_COMPARE_TWICE
+error1:
+        rseq_workaround_gcc_asm_size_guess();
+        rseq_bug("cpu_id comparison failed");
+error2:
+        rseq_workaround_gcc_asm_size_guess();
+        rseq_bug("expected value comparison failed");
+#endif
+}
+#endif /* !RSEQ_SKIP_FASTPATH */
diff --git a/tools/testing/selftests/rseq/rseq.h b/tools/testing/selftests/rseq/rseq.h
index 0a808575cbc4..a4684112676c 100644
--- a/tools/testing/selftests/rseq/rseq.h
+++ b/tools/testing/selftests/rseq/rseq.h
@@ -73,6 +73,8 @@ extern __thread volatile struct rseq __rseq_abi;
 #include <rseq-arm.h>
 #elif defined(__PPC__)
 #include <rseq-ppc.h>
+#elif defined(__mips__)
+#include <rseq-mips.h>
 #else
 #error unsupported target
 #endif
diff --git a/tools/testing/selftests/rseq/run_param_test.sh b/tools/testing/selftests/rseq/run_param_test.sh
index 3acd6d75ff9f..3acd6d75ff9f 100644..100755
--- a/tools/testing/selftests/rseq/run_param_test.sh
+++ b/tools/testing/selftests/rseq/run_param_test.sh
diff --git a/tools/testing/selftests/sparc64/Makefile b/tools/testing/selftests/sparc64/Makefile
index 2082eeffd779..a19531dba4dc 100644
--- a/tools/testing/selftests/sparc64/Makefile
+++ b/tools/testing/selftests/sparc64/Makefile
@@ -1,7 +1,18 @@
+# SPDX-License-Identifier: GPL-2.0
+uname_M := $(shell uname -m 2>/dev/null || echo not)
+ARCH ?= $(shell echo $(uname_M) | sed -e s/x86_64/x86/)
+ifneq ($(ARCH),sparc64)
+nothing:
+.PHONY: all clean run_tests install
+.SILENT:
+else
 SUBDIRS := drivers
 TEST_PROGS := run.sh
 .PHONY: all clean
 include ../lib.mk
@@ -18,10 +29,6 @@ all:
                fi \
        done
-override define RUN_TESTS
-        @cd $(OUTPUT); ./run.sh
-endef
 override define INSTALL_RULE
        mkdir -p $(INSTALL_PATH)
        install -t $(INSTALL_PATH) $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES)
@@ -33,10 +40,6 @@ override define INSTALL_RULE
        done;
 endef
-override define EMIT_TESTS
-        echo "./run.sh"
-endef
 override define CLEAN
        @for DIR in $(SUBDIRS); do              \
                BUILD_TARGET=$(OUTPUT)/$$DIR;   \
@@ -44,3 +47,4 @@ override define CLEAN
                make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\
        done
 endef
+endif
diff --git a/tools/testing/selftests/sparc64/drivers/Makefile b/tools/testing/selftests/sparc64/drivers/Makefile
index 6264f40bbdbc..deb0df415565 100644
--- a/tools/testing/selftests/sparc64/drivers/Makefile
+++ b/tools/testing/selftests/sparc64/drivers/Makefile
@@ -1,4 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 INCLUDEDIR := -I.
 CFLAGS := $(CFLAGS) $(INCLUDEDIR) -Wall -O2 -g
diff --git a/tools/testing/selftests/static_keys/test_static_keys.sh b/tools/testing/selftests/static_keys/test_static_keys.sh
index 24cff498b31a..fc9f8cde7d42 100755
--- a/tools/testing/selftests/static_keys/test_static_keys.sh
+++ b/tools/testing/selftests/static_keys/test_static_keys.sh
@@ -2,6 +2,19 @@
 # SPDX-License-Identifier: GPL-2.0
 # Runs static keys kernel module tests
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+if ! /sbin/modprobe -q -n test_static_key_base; then
+        echo "static_key: module test_static_key_base is not found [SKIP]"
+        exit $ksft_skip
+fi
+if ! /sbin/modprobe -q -n test_static_keys; then
+        echo "static_key: module test_static_keys is not found [SKIP]"
+        exit $ksft_skip
+fi
 if /sbin/modprobe -q test_static_key_base; then
        if /sbin/modprobe -q test_static_keys; then
                echo "static_key: ok"
diff --git a/tools/testing/selftests/sync/config b/tools/testing/selftests/sync/config
new file mode 100644
index 000000000000..1ab7e8130db2
--- /dev/null
+++ b/tools/testing/selftests/sync/config
@@ -0,0 +1,4 @@
+CONFIG_STAGING=y
+CONFIG_ANDROID=y
+CONFIG_SYNC=y
+CONFIG_SW_SYNC=y
diff --git a/tools/testing/selftests/sysctl/sysctl.sh b/tools/testing/selftests/sysctl/sysctl.sh
index ec232c3cfcaa..584eb8ea780a 100755
--- a/tools/testing/selftests/sysctl/sysctl.sh
+++ b/tools/testing/selftests/sysctl/sysctl.sh
@@ -14,6 +14,9 @@
 # This performs a series tests against the proc sysctl interface.
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
 TEST_NAME="sysctl"
 TEST_DRIVER="test_${TEST_NAME}"
 TEST_DIR=$(dirname $0)
@@ -41,7 +44,7 @@ test_modprobe()
               echo "$0: $DIR not present" >&2
               echo "You must have the following enabled in your kernel:" >&2
               cat $TEST_DIR/config >&2
-               exit 1
+               exit $ksft_skip
       fi
 }
@@ -98,28 +101,30 @@ test_reqs()
        uid=$(id -u)
        if [ $uid -ne 0 ]; then
                echo $msg must be run as root >&2
-                exit 0
+                exit $ksft_skip
        fi
        if ! which perl 2> /dev/null > /dev/null; then
                echo "$0: You need perl installed"
-                exit 1
+                exit $ksft_skip
        fi
        if ! which getconf 2> /dev/null > /dev/null; then
                echo "$0: You need getconf installed"
-                exit 1
+                exit $ksft_skip
        fi
        if ! which diff 2> /dev/null > /dev/null; then
                echo "$0: You need diff installed"
-                exit 1
+                exit $ksft_skip
        fi
 }
 function load_req_mod()
 {
-        trap "test_modprobe" EXIT
        if [ ! -d $DIR ]; then
+                if ! modprobe -q -n $TEST_DRIVER; then
+                        echo "$0: module $TEST_DRIVER not found [SKIP]"
+                        exit $ksft_skip
+                fi
                modprobe $TEST_DRIVER
                if [ $? -ne 0 ]; then
                        exit
@@ -765,6 +770,7 @@ function parse_args()
 test_reqs
 allow_user_defaults
 check_production_sysctl_writes_strict
+test_modprobe
 load_req_mod
 trap "test_finish" EXIT
diff --git a/tools/testing/selftests/user/test_user_copy.sh b/tools/testing/selftests/user/test_user_copy.sh
index d60506fc77f8..f9b31a57439b 100755
--- a/tools/testing/selftests/user/test_user_copy.sh
+++ b/tools/testing/selftests/user/test_user_copy.sh
@@ -2,6 +2,13 @@
 # SPDX-License-Identifier: GPL-2.0
 # Runs copy_to/from_user infrastructure using test_user_copy kernel module
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+if ! /sbin/modprobe -q -n test_user_copy; then
+        echo "user: module test_user_copy is not found [SKIP]"
+        exit $ksft_skip
+fi
 if /sbin/modprobe -q test_user_copy; then
        /sbin/modprobe -q -r test_user_copy
        echo "user_copy: ok"
diff --git a/tools/testing/selftests/vm/compaction_test.c b/tools/testing/selftests/vm/compaction_test.c
index 1097f04e4d80..bcec71250873 100644
--- a/tools/testing/selftests/vm/compaction_test.c
+++ b/tools/testing/selftests/vm/compaction_test.c
@@ -16,6 +16,8 @@
 #include <unistd.h>
 #include <string.h>
+#include "../kselftest.h"
 #define MAP_SIZE 1048576
 struct map_list {
@@ -169,7 +171,7 @@ int main(int argc, char **argv)
                printf("Either the sysctl compact_unevictable_allowed is not\n"
                       "set to 1 or couldn't read the proc file.\n"
                       "Skipping the test\n");
-                return 0;
+                return KSFT_SKIP;
        }
        lim.rlim_cur = RLIM_INFINITY;
diff --git a/tools/testing/selftests/vm/mlock2-tests.c b/tools/testing/selftests/vm/mlock2-tests.c
index 4997b9222cfa..637b6d0ac0d0 100644
--- a/tools/testing/selftests/vm/mlock2-tests.c
+++ b/tools/testing/selftests/vm/mlock2-tests.c
@@ -9,6 +9,8 @@
 #include <stdbool.h>
 #include "mlock2.h"
+#include "../kselftest.h"
 struct vm_boundaries {
        unsigned long start;
        unsigned long end;
@@ -303,7 +305,7 @@ static int test_mlock_lock()
        if (mlock2_(map, 2 * page_size, 0)) {
                if (errno == ENOSYS) {
                        printf("Cannot call new mlock family, skipping test\n");
-                        _exit(0);
+                        _exit(KSFT_SKIP);
                }
                perror("mlock2(0)");
                goto unmap;
@@ -412,7 +414,7 @@ static int test_mlock_onfault()
        if (mlock2_(map, 2 * page_size, MLOCK_ONFAULT)) {
                if (errno == ENOSYS) {
                        printf("Cannot call new mlock family, skipping test\n");
-                        _exit(0);
+                        _exit(KSFT_SKIP);
                }
                perror("mlock2(MLOCK_ONFAULT)");
                goto unmap;
@@ -425,7 +427,7 @@ static int test_mlock_onfault()
        if (munlock(map, 2 * page_size)) {
                if (errno == ENOSYS) {
                        printf("Cannot call new mlock family, skipping test\n");
-                        _exit(0);
+                        _exit(KSFT_SKIP);
                }
                perror("munlock()");
                goto unmap;
@@ -457,7 +459,7 @@ static int test_lock_onfault_of_present()
        if (mlock2_(map, 2 * page_size, MLOCK_ONFAULT)) {
                if (errno == ENOSYS) {
                        printf("Cannot call new mlock family, skipping test\n");
-                        _exit(0);
+                        _exit(KSFT_SKIP);
                }
                perror("mlock2(MLOCK_ONFAULT)");
                goto unmap;
@@ -583,7 +585,7 @@ static int test_vma_management(bool call_mlock)
        if (call_mlock && mlock2_(map, 3 * page_size, MLOCK_ONFAULT)) {
                if (errno == ENOSYS) {
                        printf("Cannot call new mlock family, skipping test\n");
-                        _exit(0);
+                        _exit(KSFT_SKIP);
                }
                perror("mlock(ONFAULT)\n");
                goto out;
diff --git a/tools/testing/selftests/vm/run_vmtests b/tools/testing/selftests/vm/run_vmtests
index 22d564673830..88cbe5575f0c 100755
--- a/tools/testing/selftests/vm/run_vmtests
+++ b/tools/testing/selftests/vm/run_vmtests
@@ -2,6 +2,9 @@
 # SPDX-License-Identifier: GPL-2.0
 #please run as root
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
 mnt=./huge
 exitcode=0
@@ -36,7 +39,7 @@ if [ -n "$freepgs" ] && [ -n "$hpgsize_KB" ]; then
                echo $(( $lackpgs + $nr_hugepgs )) > /proc/sys/vm/nr_hugepages
                if [ $? -ne 0 ]; then
                        echo "Please run this test as root"
-                        exit 1
+                        exit $ksft_skip
                fi
                while read name size unit; do
                        if [ "$name" = "HugePages_Free:" ]; then
diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c
index de2f9ec8a87f..7b8171e3128a 100644
--- a/tools/testing/selftests/vm/userfaultfd.c
+++ b/tools/testing/selftests/vm/userfaultfd.c
@@ -69,6 +69,8 @@
 #include <setjmp.h>
 #include <stdbool.h>
+#include "../kselftest.h"
 #ifdef __NR_userfaultfd
 static unsigned long nr_cpus, nr_pages, nr_pages_per_cpu, page_size;
@@ -1322,7 +1324,7 @@ int main(int argc, char **argv)
 int main(void)
 {
        printf("skip: Skipping userfaultfd test (missing __NR_userfaultfd)\n");
-        return 0;
+        return KSFT_SKIP;
 }
 #endif /* __NR_userfaultfd */
diff --git a/tools/testing/selftests/x86/sigreturn.c b/tools/testing/selftests/x86/sigreturn.c
index 246145b84a12..4d9dc3f2fd70 100644
--- a/tools/testing/selftests/x86/sigreturn.c
+++ b/tools/testing/selftests/x86/sigreturn.c
@@ -610,21 +610,41 @@ static int test_valid_sigreturn(int cs_bits, bool use_16bit_ss, int force_ss)
         */
        for (int i = 0; i < NGREG; i++) {
                greg_t req = requested_regs[i], res = resulting_regs[i];
                if (i == REG_TRAPNO || i == REG_IP)
                        continue;       /* don't care */
-                if (i == REG_SP) {
-                        printf("\tSP: %llx -> %llx\n", (unsigned long long)req,
-                               (unsigned long long)res);
+                if (i == REG_SP) {
                        /*
-                         * In many circumstances, the high 32 bits of rsp
+                         * If we were using a 16-bit stack segment, then
-                         * are zeroed.  For example, we could be a real
+                         * the kernel is a bit stuck: IRET only restores
-                         * 32-bit program, or we could hit any of a number
+                         * the low 16 bits of ESP/RSP if SS is 16-bit.
-                         * of poorly-documented IRET or segmented ESP
+                         * The kernel uses a hack to restore bits 31:16,
-                         * oddities.  If this happens, it's okay.
+                         * but that hack doesn't help with bits 63:32.
+                         * On Intel CPUs, bits 63:32 end up zeroed, and, on
+                         * AMD CPUs, they leak the high bits of the kernel
+                         * espfix64 stack pointer.  There's very little that
+                         * the kernel can do about it.
+                         *
+                         * Similarly, if we are returning to a 32-bit context,
+                         * the CPU will often lose the high 32 bits of RSP.
                         */
-                        if (res == (req & 0xFFFFFFFF))
-                                continue;  /* OK; not expected to work */
+                        if (res == req)
+                                continue;
+                        if (cs_bits != 64 && ((res ^ req) & 0xFFFFFFFF) == 0) {
+                                printf("[NOTE]\tSP: %llx -> %llx\n",
+                                       (unsigned long long)req,
+                                       (unsigned long long)res);
+                                continue;
+                        }
+                        printf("[FAIL]\tSP mismatch: requested 0x%llx; got 0x%llx\n",
+                               (unsigned long long)requested_regs[i],
+                               (unsigned long long)resulting_regs[i]);
+                        nerrs++;
+                        continue;
                }
                bool ignore_reg = false;
@@ -654,25 +674,18 @@ static int test_valid_sigreturn(int cs_bits, bool use_16bit_ss, int force_ss)
 #endif
                /* Sanity check on the kernel */
-                if (i == REG_CX && requested_regs[i] != resulting_regs[i]) {
+                if (i == REG_CX && req != res) {
                        printf("[FAIL]\tCX (saved SP) mismatch: requested 0x%llx; got 0x%llx\n",
-                               (unsigned long long)requested_regs[i],
+                               (unsigned long long)req,
-                               (unsigned long long)resulting_regs[i]);
+                               (unsigned long long)res);
                        nerrs++;
                        continue;
                }
-                if (requested_regs[i] != resulting_regs[i] && !ignore_reg) {
+                if (req != res && !ignore_reg) {
-                        /*
-                         * SP is particularly interesting here.  The
-                         * usual cause of failures is that we hit the
-                         * nasty IRET case of returning to a 16-bit SS,
-                         * in which case bits 16:31 of the *kernel*
-                         * stack pointer persist in ESP.
-                         */
                        printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n",
-                               i, (unsigned long long)requested_regs[i],
+                               i, (unsigned long long)req,
-                               (unsigned long long)resulting_regs[i]);
+                               (unsigned long long)res);
                        nerrs++;
                }
        }
diff --git a/tools/testing/selftests/zram/zram.sh b/tools/testing/selftests/zram/zram.sh
index 754de7da426a..232e958ec454 100755
--- a/tools/testing/selftests/zram/zram.sh
+++ b/tools/testing/selftests/zram/zram.sh
@@ -2,6 +2,9 @@
 # SPDX-License-Identifier: GPL-2.0
 TCID="zram.sh"
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
 . ./zram_lib.sh
 run_zram () {
@@ -24,5 +27,5 @@ elif [ -b /dev/zram0 ]; then
 else
        echo "$TCID : No zram.ko module or /dev/zram0 device file not found"
        echo "$TCID : CONFIG_ZRAM is not set"
-        exit 1
+        exit $ksft_skip
 fi
diff --git a/tools/testing/selftests/zram/zram_lib.sh b/tools/testing/selftests/zram/zram_lib.sh
index f6a9c73e7a44..9e73a4fb9b0a 100755
--- a/tools/testing/selftests/zram/zram_lib.sh
+++ b/tools/testing/selftests/zram/zram_lib.sh
@@ -18,6 +18,9 @@ MODULE=0
 dev_makeswap=-1
 dev_mounted=-1
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
 trap INT
 check_prereqs()
@@ -27,7 +30,7 @@ check_prereqs()
        if [ $uid -ne 0 ]; then
                echo $msg must be run as root >&2
-                exit 0
+                exit $ksft_skip
        fi
 }
diff --git a/tools/virtio/linux/scatterlist.h b/tools/virtio/linux/scatterlist.h
index 9a45f90e2d08..369ee308b668 100644
--- a/tools/virtio/linux/scatterlist.h
+++ b/tools/virtio/linux/scatterlist.h
@@ -36,7 +36,6 @@ static inline void sg_assign_page(struct scatterlist *sg, struct page *page)
         */
        BUG_ON((unsigned long) page & 0x03);
 #ifdef CONFIG_DEBUG_SG
-        BUG_ON(sg->sg_magic != SG_MAGIC);
        BUG_ON(sg_is_chain(sg));
 #endif
        sg->page_link = page_link | (unsigned long) page;
@@ -67,7 +66,6 @@ static inline void sg_set_page(struct scatterlist *sg, struct page *page,
 static inline struct page *sg_page(struct scatterlist *sg)
 {
 #ifdef CONFIG_DEBUG_SG
-        BUG_ON(sg->sg_magic != SG_MAGIC);
        BUG_ON(sg_is_chain(sg));
 #endif
        return (struct page *)((sg)->page_link & ~0x3);
@@ -116,9 +114,6 @@ static inline void sg_chain(struct scatterlist *prv, unsigned int prv_nents,
 **/
 static inline void sg_mark_end(struct scatterlist *sg)
 {
-#ifdef CONFIG_DEBUG_SG
-        BUG_ON(sg->sg_magic != SG_MAGIC);
-#endif
        /*
         * Set termination bit, clear potential chain bit
         */
@@ -136,17 +131,11 @@ static inline void sg_mark_end(struct scatterlist *sg)
 **/
 static inline void sg_unmark_end(struct scatterlist *sg)
 {
-#ifdef CONFIG_DEBUG_SG
-        BUG_ON(sg->sg_magic != SG_MAGIC);
-#endif
        sg->page_link &= ~0x02;
 }
 static inline struct scatterlist *sg_next(struct scatterlist *sg)
 {
-#ifdef CONFIG_DEBUG_SG
-        BUG_ON(sg->sg_magic != SG_MAGIC);
-#endif
        if (sg_is_last(sg))
                return NULL;
@@ -160,13 +149,6 @@ static inline struct scatterlist *sg_next(struct scatterlist *sg)
 static inline void sg_init_table(struct scatterlist *sgl, unsigned int nents)
 {
        memset(sgl, 0, sizeof(*sgl) * nents);
-#ifdef CONFIG_DEBUG_SG
-        {
-                unsigned int i;
-                for (i = 0; i < nents; i++)
-                        sgl[i].sg_magic = SG_MAGIC;
-        }
-#endif
        sg_mark_end(&sgl[nents - 1]);
 }
diff --git a/virt/kvm/Kconfig b/virt/kvm/Kconfig
index 72143cfaf6ec..ea434ddc8499 100644
--- a/virt/kvm/Kconfig
+++ b/virt/kvm/Kconfig
@@ -47,7 +47,7 @@ config KVM_GENERIC_DIRTYLOG_READ_PROTECT
 config KVM_COMPAT
       def_bool y
-       depends on KVM && COMPAT && !S390
+       depends on KVM && COMPAT && !(S390 || ARM64)
 config HAVE_KVM_IRQ_BYPASS
       bool
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index 8d90de213ce9..1d90d79706bd 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -297,6 +297,8 @@ static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size)
        phys_addr_t next;
        assert_spin_locked(&kvm->mmu_lock);
+        WARN_ON(size & ~PAGE_MASK);
        pgd = kvm->arch.pgd + stage2_pgd_index(addr);
        do {
                /*
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index ff7dc890941a..cdce653e3c47 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -617,11 +617,6 @@ int vgic_v3_probe(const struct gic_kvm_info *info)
                pr_warn("GICV physical address 0x%llx not page aligned\n",
                        (unsigned long long)info->vcpu.start);
                kvm_vgic_global_state.vcpu_base = 0;
-        } else if (!PAGE_ALIGNED(resource_size(&info->vcpu))) {
-                pr_warn("GICV size 0x%llx not a multiple of page size 0x%lx\n",
-                        (unsigned long long)resource_size(&info->vcpu),
-                        PAGE_SIZE);
-                kvm_vgic_global_state.vcpu_base = 0;
        } else {
                kvm_vgic_global_state.vcpu_base = info->vcpu.start;
                kvm_vgic_global_state.can_emulate_gicv2 = true;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index ada21f47f22b..8b47507faab5 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -116,6 +116,11 @@ static long kvm_vcpu_ioctl(struct file *file, unsigned int ioctl,
 #ifdef CONFIG_KVM_COMPAT
 static long kvm_vcpu_compat_ioctl(struct file *file, unsigned int ioctl,
                                  unsigned long arg);
+#define KVM_COMPAT(c)   .compat_ioctl   = (c)
+#else
+static long kvm_no_compat_ioctl(struct file *file, unsigned int ioctl,
+                                unsigned long arg) { return -EINVAL; }
+#define KVM_COMPAT(c)   .compat_ioctl   = kvm_no_compat_ioctl
 #endif
 static int hardware_enable_all(void);
 static void hardware_disable_all(void);
@@ -2396,11 +2401,9 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp)
 static struct file_operations kvm_vcpu_fops = {
        .release        = kvm_vcpu_release,
        .unlocked_ioctl = kvm_vcpu_ioctl,
-#ifdef CONFIG_KVM_COMPAT
-        .compat_ioctl   = kvm_vcpu_compat_ioctl,
-#endif
        .mmap           = kvm_vcpu_mmap,
        .llseek         = noop_llseek,
+        KVM_COMPAT(kvm_vcpu_compat_ioctl),
 };
 /*
@@ -2824,10 +2827,8 @@ static int kvm_device_release(struct inode *inode, struct file *filp)
 static const struct file_operations kvm_device_fops = {
        .unlocked_ioctl = kvm_device_ioctl,
-#ifdef CONFIG_KVM_COMPAT
-        .compat_ioctl = kvm_device_ioctl,
-#endif
        .release = kvm_device_release,
+        KVM_COMPAT(kvm_device_ioctl),
 };
 struct kvm_device *kvm_device_from_filp(struct file *filp)
@@ -3165,10 +3166,8 @@ static long kvm_vm_compat_ioctl(struct file *filp,
 static struct file_operations kvm_vm_fops = {
        .release        = kvm_vm_release,
        .unlocked_ioctl = kvm_vm_ioctl,
-#ifdef CONFIG_KVM_COMPAT
-        .compat_ioctl   = kvm_vm_compat_ioctl,
-#endif
        .llseek         = noop_llseek,
+        KVM_COMPAT(kvm_vm_compat_ioctl),
 };
 static int kvm_dev_ioctl_create_vm(unsigned long type)
@@ -3259,8 +3258,8 @@ out:
 static struct file_operations kvm_chardev_ops = {
        .unlocked_ioctl = kvm_dev_ioctl,
-        .compat_ioctl   = kvm_dev_ioctl,
        .llseek         = noop_llseek,
+        KVM_COMPAT(kvm_dev_ioctl),
 };
 static struct miscdevice kvm_dev = {