518 files changed, 5106 insertions, 3392 deletions

diff --git a/Documentation/devicetree/bindings/interrupt-controller/snps,archs-idu-intc.txt b/Documentation/devicetree/bindings/interrupt-controller/snps,archs-idu-intc.txt
index 0dcb7c7d3e40..944657684d73 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/snps,archs-idu-intc.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/snps,archs-idu-intc.txt
@@ -15,6 +15,9 @@ Properties:
   Second cell specifies the irq distribution mode to cores
      0=Round Robin; 1=cpu0, 2=cpu1, 4=cpu2, 8=cpu3
 
+  The second cell in interrupts property is deprecated and may be ignored by
+  the kernel.
+
   intc accessed via the special ARC AUX register interface, hence "reg" property
   is not specified.
 
diff --git a/Documentation/devicetree/bindings/net/mediatek-net.txt b/Documentation/devicetree/bindings/net/mediatek-net.txt
index c010fafc66a8..c7194e87d5f4 100644
--- a/Documentation/devicetree/bindings/net/mediatek-net.txt
+++ b/Documentation/devicetree/bindings/net/mediatek-net.txt
@@ -7,7 +7,7 @@ have dual GMAC each represented by a child node..
 * Ethernet controller node
 
 Required properties:
-- compatible: Should be "mediatek,mt7623-eth"
+- compatible: Should be "mediatek,mt2701-eth"
 - reg: Address and length of the register set for the device
 - interrupts: Should contain the three frame engines interrupts in numeric
         order. These are fe_int0, fe_int1 and fe_int2.
diff --git a/Documentation/devicetree/bindings/net/phy.txt b/Documentation/devicetree/bindings/net/phy.txt
index ff1bc4b1bb3b..fb5056b22685 100644
--- a/Documentation/devicetree/bindings/net/phy.txt
+++ b/Documentation/devicetree/bindings/net/phy.txt
@@ -19,8 +19,9 @@ Optional Properties:
   specifications. If neither of these are specified, the default is to
   assume clause 22.
 
-  If the phy's identifier is known then the list may contain an entry
-  of the form: "ethernet-phy-idAAAA.BBBB" where
+  If the PHY reports an incorrect ID (or none at all) then the
+  "compatible" list may contain an entry with the correct PHY ID in the
+  form: "ethernet-phy-idAAAA.BBBB" where
      AAAA - The value of the 16 bit Phy Identifier 1 register as
             4 hex digits. This is the chip vendor OUI bits 3:18
      BBBB - The value of the 16 bit Phy Identifier 2 register as
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index 72624a16b792..c94b4675d021 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -212,10 +212,11 @@ asynchronous manner and the value may not be very precise. To see a precise
 snapshot of a moment, you can see /proc/<pid>/smaps file and scan page table.
 It's slow but very precise.
 
-Table 1-2: Contents of the status files (as of 4.1)
+Table 1-2: Contents of the status files (as of 4.8)
 ..............................................................................
  Field                       Content
  Name                        filename of the executable
+ Umask                       file mode creation mask
  State                       state (R is running, S is sleeping, D is sleeping
                              in an uninterruptible wait, Z is zombie,
                              T is traced or stopped)
@@ -226,7 +227,6 @@ Table 1-2: Contents of the status files (as of 4.1)
  TracerPid                   PID of process tracing this process (0 if not)
  Uid                         Real, effective, saved set, and  file system UIDs
  Gid                         Real, effective, saved set, and  file system GIDs
- Umask                       file mode creation mask
  FDSize                      number of file descriptor slots currently allocated
  Groups                      supplementary group list
  NStgid                      descendant namespace thread group ID hierarchy
@@ -236,6 +236,7 @@ Table 1-2: Contents of the status files (as of 4.1)
  VmPeak                      peak virtual memory size
  VmSize                      total program size
  VmLck                       locked memory size
+ VmPin                       pinned memory size
  VmHWM                       peak resident set size ("high water mark")
  VmRSS                       size of memory portions. It contains the three
                              following parts (VmRSS = RssAnon + RssFile + RssShmem)
diff --git a/Documentation/media/uapi/cec/cec-func-close.rst b/Documentation/media/uapi/cec/cec-func-close.rst
index 8267c31b317d..895d9c2d1c04 100644
--- a/Documentation/media/uapi/cec/cec-func-close.rst
+++ b/Documentation/media/uapi/cec/cec-func-close.rst
@@ -33,11 +33,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 Closes the cec device. Resources associated with the file descriptor are
 freed. The device configuration remain unchanged.
 
diff --git a/Documentation/media/uapi/cec/cec-func-ioctl.rst b/Documentation/media/uapi/cec/cec-func-ioctl.rst
index 9e8dbb118d6a..7dcfd178fb24 100644
--- a/Documentation/media/uapi/cec/cec-func-ioctl.rst
+++ b/Documentation/media/uapi/cec/cec-func-ioctl.rst
@@ -39,11 +39,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 The :c:func:`ioctl()` function manipulates cec device parameters. The
 argument ``fd`` must be an open file descriptor.
 
diff --git a/Documentation/media/uapi/cec/cec-func-open.rst b/Documentation/media/uapi/cec/cec-func-open.rst
index af3f5b5c24c6..0304388cd159 100644
--- a/Documentation/media/uapi/cec/cec-func-open.rst
+++ b/Documentation/media/uapi/cec/cec-func-open.rst
@@ -46,11 +46,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 To open a cec device applications call :c:func:`open()` with the
 desired device name. The function has no side effects; the device
 configuration remain unchanged.
diff --git a/Documentation/media/uapi/cec/cec-func-poll.rst b/Documentation/media/uapi/cec/cec-func-poll.rst
index cfb73e6027a5..6a863cfda6e0 100644
--- a/Documentation/media/uapi/cec/cec-func-poll.rst
+++ b/Documentation/media/uapi/cec/cec-func-poll.rst
@@ -39,11 +39,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 With the :c:func:`poll()` function applications can wait for CEC
 events.
 
diff --git a/Documentation/media/uapi/cec/cec-intro.rst b/Documentation/media/uapi/cec/cec-intro.rst
index 4a19ea5323a9..07ee2b8f89d6 100644
--- a/Documentation/media/uapi/cec/cec-intro.rst
+++ b/Documentation/media/uapi/cec/cec-intro.rst
@@ -3,11 +3,6 @@
 Introduction
 ============
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 HDMI connectors provide a single pin for use by the Consumer Electronics
 Control protocol. This protocol allows different devices connected by an
 HDMI cable to communicate. The protocol for CEC version 1.4 is defined
@@ -31,3 +26,15 @@ control just the CEC pin.
 Drivers that support CEC will create a CEC device node (/dev/cecX) to
 give userspace access to the CEC adapter. The
 :ref:`CEC_ADAP_G_CAPS` ioctl will tell userspace what it is allowed to do.
+
+In order to check the support and test it, it is suggested to download
+the `v4l-utils <https://git.linuxtv.org/v4l-utils.git/>`_ package. It
+provides three tools to handle CEC:
+
+- cec-ctl: the Swiss army knife of CEC. Allows you to configure, transmit
+  and monitor CEC messages.
+
+- cec-compliance: does a CEC compliance test of a remote CEC device to
+  determine how compliant the CEC implementation is.
+
+- cec-follower: emulates a CEC follower.
diff --git a/Documentation/media/uapi/cec/cec-ioc-adap-g-caps.rst b/Documentation/media/uapi/cec/cec-ioc-adap-g-caps.rst
index 2b0ddb14b280..a0e961f11017 100644
--- a/Documentation/media/uapi/cec/cec-ioc-adap-g-caps.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-adap-g-caps.rst
@@ -29,11 +29,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 All cec devices must support :ref:`ioctl CEC_ADAP_G_CAPS <CEC_ADAP_G_CAPS>`. To query
 device information, applications call the ioctl with a pointer to a
 struct :c:type:`cec_caps`. The driver fills the structure and
diff --git a/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst b/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst
index b878637e91b3..09f09bbe28d4 100644
--- a/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst
@@ -35,11 +35,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 To query the current CEC logical addresses, applications call
 :ref:`ioctl CEC_ADAP_G_LOG_ADDRS <CEC_ADAP_G_LOG_ADDRS>` with a pointer to a
 struct :c:type:`cec_log_addrs` where the driver stores the logical addresses.
diff --git a/Documentation/media/uapi/cec/cec-ioc-adap-g-phys-addr.rst b/Documentation/media/uapi/cec/cec-ioc-adap-g-phys-addr.rst
index 3357deb43c85..a3cdc75cec3e 100644
--- a/Documentation/media/uapi/cec/cec-ioc-adap-g-phys-addr.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-adap-g-phys-addr.rst
@@ -35,11 +35,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 To query the current physical address applications call
 :ref:`ioctl CEC_ADAP_G_PHYS_ADDR <CEC_ADAP_G_PHYS_ADDR>` with a pointer to a __u16 where the
 driver stores the physical address.
diff --git a/Documentation/media/uapi/cec/cec-ioc-dqevent.rst b/Documentation/media/uapi/cec/cec-ioc-dqevent.rst
index e256c6605de7..6e589a1fae17 100644
--- a/Documentation/media/uapi/cec/cec-ioc-dqevent.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-dqevent.rst
@@ -30,11 +30,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 CEC devices can send asynchronous events. These can be retrieved by
 calling :c:func:`CEC_DQEVENT`. If the file descriptor is in
 non-blocking mode and no event is pending, then it will return -1 and
diff --git a/Documentation/media/uapi/cec/cec-ioc-g-mode.rst b/Documentation/media/uapi/cec/cec-ioc-g-mode.rst
index 4f5818b9d277..e4ded9df0a84 100644
--- a/Documentation/media/uapi/cec/cec-ioc-g-mode.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-g-mode.rst
@@ -31,11 +31,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 By default any filehandle can use :ref:`CEC_TRANSMIT`, but in order to prevent
 applications from stepping on each others toes it must be possible to
 obtain exclusive access to the CEC adapter. This ioctl sets the
diff --git a/Documentation/media/uapi/cec/cec-ioc-receive.rst b/Documentation/media/uapi/cec/cec-ioc-receive.rst
index bdf015b1d1dc..dc2adb391c0a 100644
--- a/Documentation/media/uapi/cec/cec-ioc-receive.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-receive.rst
@@ -34,11 +34,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 To receive a CEC message the application has to fill in the
 ``timeout`` field of struct :c:type:`cec_msg` and pass it to
 :ref:`ioctl CEC_RECEIVE <CEC_RECEIVE>`.
diff --git a/Documentation/power/states.txt b/Documentation/power/states.txt
index 8a39ce45d8a0..008ecb588317 100644
--- a/Documentation/power/states.txt
+++ b/Documentation/power/states.txt
@@ -35,9 +35,7 @@ only one way to cause the system to go into the Suspend-To-RAM state (write
 The default suspend mode (ie. the one to be used without writing anything into
 /sys/power/mem_sleep) is either "deep" (if Suspend-To-RAM is supported) or
 "s2idle", but it can be overridden by the value of the "mem_sleep_default"
-parameter in the kernel command line.  On some ACPI-based systems, depending on
-the information in the FADT, the default may be "s2idle" even if Suspend-To-RAM
-is supported.
+parameter in the kernel command line.
 
 The properties of all of the sleep states are described below.
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 26edd832c64e..187b9615e31a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3567,7 +3567,7 @@ F:	drivers/infiniband/hw/cxgb3/
 F:      include/uapi/rdma/cxgb3-abi.h
 
 CXGB4 ETHERNET DRIVER (CXGB4)
-M:      Hariprasad S <hariprasad@chelsio.com>
+M:      Ganesh Goudar <ganeshgr@chelsio.com>
 L:      netdev@vger.kernel.org
 W:      http://www.chelsio.com
 S:      Supported
@@ -4100,12 +4100,18 @@ F:	drivers/gpu/drm/bridge/
 
 DRM DRIVER FOR BOCHS VIRTUAL GPU
 M:      Gerd Hoffmann <kraxel@redhat.com>
-S:      Odd Fixes
+L:      virtualization@lists.linux-foundation.org
+T:      git git://git.kraxel.org/linux drm-qemu
+S:      Maintained
 F:      drivers/gpu/drm/bochs/
 
 DRM DRIVER FOR QEMU'S CIRRUS DEVICE
 M:      Dave Airlie <airlied@redhat.com>
-S:      Odd Fixes
+M:      Gerd Hoffmann <kraxel@redhat.com>
+L:      virtualization@lists.linux-foundation.org
+T:      git git://git.kraxel.org/linux drm-qemu
+S:      Obsolete
+W:      https://www.kraxel.org/blog/2014/10/qemu-using-cirrus-considered-harmful/
 F:      drivers/gpu/drm/cirrus/
 
 RADEON and AMDGPU DRM DRIVERS
@@ -4147,7 +4153,7 @@ F:	Documentation/gpu/i915.rst
 INTEL GVT-g DRIVERS (Intel GPU Virtualization)
 M:      Zhenyu Wang <zhenyuw@linux.intel.com>
 M:      Zhi Wang <zhi.a.wang@intel.com>
-L:      igvt-g-dev@lists.01.org
+L:      intel-gvt-dev@lists.freedesktop.org
 L:      intel-gfx@lists.freedesktop.org
 W:      https://01.org/igvt-g
 T:      git https://github.com/01org/gvt-linux.git
@@ -4298,7 +4304,10 @@ F:	Documentation/devicetree/bindings/display/renesas,du.txt
 
 DRM DRIVER FOR QXL VIRTUAL GPU
 M:      Dave Airlie <airlied@redhat.com>
-S:      Odd Fixes
+M:      Gerd Hoffmann <kraxel@redhat.com>
+L:      virtualization@lists.linux-foundation.org
+T:      git git://git.kraxel.org/linux drm-qemu
+S:      Maintained
 F:      drivers/gpu/drm/qxl/
 F:      include/uapi/drm/qxl_drm.h
 
@@ -10186,7 +10195,6 @@ F:	drivers/media/tuners/qt1010*
 QUALCOMM ATHEROS ATH9K WIRELESS DRIVER
 M:      QCA ath9k Development <ath9k-devel@qca.qualcomm.com>
 L:      linux-wireless@vger.kernel.org
-L:      ath9k-devel@lists.ath9k.org
 W:      http://wireless.kernel.org/en/users/Drivers/ath9k
 S:      Supported
 F:      drivers/net/wireless/ath/ath9k/
@@ -13057,7 +13065,7 @@ F:	drivers/input/serio/userio.c
 F:      include/uapi/linux/userio.h
 
 VIRTIO CONSOLE DRIVER
-M:      Amit Shah <amit.shah@redhat.com>
+M:      Amit Shah <amit@kernel.org>
 L:      virtualization@lists.linux-foundation.org
 S:      Maintained
 F:      drivers/char/virtio_console.c
@@ -13092,6 +13100,7 @@ M:	David Airlie <airlied@linux.ie>
 M:      Gerd Hoffmann <kraxel@redhat.com>
 L:      dri-devel@lists.freedesktop.org
 L:      virtualization@lists.linux-foundation.org
+T:      git git://git.kraxel.org/linux drm-qemu
 S:      Maintained
 F:      drivers/gpu/drm/virtio/
 F:      include/uapi/linux/virtio_gpu.h
@@ -13443,6 +13452,7 @@ F:	arch/x86/
 
 X86 PLATFORM DRIVERS
 M:      Darren Hart <dvhart@infradead.org>
+M:      Andy Shevchenko <andy@infradead.org>
 L:      platform-driver-x86@vger.kernel.org
 T:      git git://git.infradead.org/users/dvhart/linux-platform-drivers-x86.git
 S:      Maintained
@@ -13614,6 +13624,7 @@ F:	drivers/net/hamradio/z8530.h
 
 ZBUD COMPRESSED PAGE ALLOCATOR
 M:      Seth Jennings <sjenning@redhat.com>
+M:      Dan Streetman <ddstreet@ieee.org>
 L:      linux-mm@kvack.org
 S:      Maintained
 F:      mm/zbud.c
@@ -13669,6 +13680,7 @@ F:	Documentation/vm/zsmalloc.txt
 
 ZSWAP COMPRESSED SWAP CACHING
 M:      Seth Jennings <sjenning@redhat.com>
+M:      Dan Streetman <ddstreet@ieee.org>
 L:      linux-mm@kvack.org
 S:      Maintained
 F:      mm/zswap.c
diff --git a/Makefile b/Makefile
index 098840012b9b..8e223e081c9d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 4
 PATCHLEVEL = 10
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
-NAME = Anniversary Edition
+EXTRAVERSION = -rc7
+NAME = Fearless Coyote
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
@@ -797,7 +797,7 @@ KBUILD_CFLAGS   += $(call cc-option,-Werror=incompatible-pointer-types)
 KBUILD_ARFLAGS := $(call ar-option,D)
 
 # check for 'asm goto'
-ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC)), y)
+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y)
         KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO
         KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO
 endif
diff --git a/arch/arc/include/asm/delay.h b/arch/arc/include/asm/delay.h
index a36e8601114d..d5da2115d78a 100644
--- a/arch/arc/include/asm/delay.h
+++ b/arch/arc/include/asm/delay.h
@@ -26,7 +26,9 @@ static inline void __delay(unsigned long loops)
         "       lp  1f                  \n"
         "       nop                     \n"
         "1:                             \n"
-        : : "r"(loops));
+        :
+        : "r"(loops)
+        : "lp_count");
 }
 
 extern void __bad_udelay(void);
diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S
index 689dd867fdff..8b90d25a15cc 100644
--- a/arch/arc/kernel/head.S
+++ b/arch/arc/kernel/head.S
@@ -71,14 +71,14 @@ ENTRY(stext)
         GET_CPU_ID  r5
         cmp     r5, 0
         mov.nz  r0, r5
-#ifdef CONFIG_ARC_SMP_HALT_ON_RESET
-        ; Non-Master can proceed as system would be booted sufficiently
-        jnz     first_lines_of_secondary
-#else
+        bz      .Lmaster_proceed
+
         ; Non-Masters wait for Master to boot enough and bring them up
-        jnz     arc_platform_smp_wait_to_boot
-#endif
-        ; Master falls thru
+        ; when they resume, tail-call to entry point
+        mov     blink, @first_lines_of_secondary
+        j       arc_platform_smp_wait_to_boot
+
+.Lmaster_proceed:
 #endif
 
         ; Clear BSS before updating any globals
diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c
index 9274f8ade8c7..9f6b68fd4f3b 100644
--- a/arch/arc/kernel/mcip.c
+++ b/arch/arc/kernel/mcip.c
@@ -93,11 +93,10 @@ static void mcip_probe_n_setup(void)
         READ_BCR(ARC_REG_MCIP_BCR, mp);
 
         sprintf(smp_cpuinfo_buf,
-                "Extn [SMP]\t: ARConnect (v%d): %d cores with %s%s%s%s%s\n",
+                "Extn [SMP]\t: ARConnect (v%d): %d cores with %s%s%s%s\n",
                 mp.ver, mp.num_cores,
                 IS_AVAIL1(mp.ipi, "IPI "),
                 IS_AVAIL1(mp.idu, "IDU "),
-                IS_AVAIL1(mp.llm, "LLM "),
                 IS_AVAIL1(mp.dbg, "DEBUG "),
                 IS_AVAIL1(mp.gfrc, "GFRC"));
 
@@ -175,7 +174,6 @@ static void idu_irq_unmask(struct irq_data *data)
         raw_spin_unlock_irqrestore(&mcip_lock, flags);
 }
 
-#ifdef CONFIG_SMP
 static int
 idu_irq_set_affinity(struct irq_data *data, const struct cpumask *cpumask,
                      bool force)
@@ -205,12 +203,27 @@ idu_irq_set_affinity(struct irq_data *data, const struct cpumask *cpumask,
 
         return IRQ_SET_MASK_OK;
 }
-#endif
+
+static void idu_irq_enable(struct irq_data *data)
+{
+        /*
+         * By default send all common interrupts to all available online CPUs.
+         * The affinity of common interrupts in IDU must be set manually since
+         * in some cases the kernel will not call irq_set_affinity() by itself:
+         *   1. When the kernel is not configured with support of SMP.
+         *   2. When the kernel is configured with support of SMP but upper
+         *      interrupt controllers does not support setting of the affinity
+         *      and cannot propagate it to IDU.
+         */
+        idu_irq_set_affinity(data, cpu_online_mask, false);
+        idu_irq_unmask(data);
+}
 
 static struct irq_chip idu_irq_chip = {
         .name                   = "MCIP IDU Intc",
         .irq_mask               = idu_irq_mask,
         .irq_unmask             = idu_irq_unmask,
+        .irq_enable             = idu_irq_enable,
 #ifdef CONFIG_SMP
         .irq_set_affinity       = idu_irq_set_affinity,
 #endif
@@ -243,36 +256,14 @@ static int idu_irq_xlate(struct irq_domain *d, struct device_node *n,
                          const u32 *intspec, unsigned int intsize,
                          irq_hw_number_t *out_hwirq, unsigned int *out_type)
 {
-        irq_hw_number_t hwirq = *out_hwirq = intspec[0];
-        int distri = intspec[1];
-        unsigned long flags;
-
+        /*
+         * Ignore value of interrupt distribution mode for common interrupts in
+         * IDU which resides in intspec[1] since setting an affinity using value
+         * from Device Tree is deprecated in ARC.
+         */
+        *out_hwirq = intspec[0];
         *out_type = IRQ_TYPE_NONE;
 
-        /* XXX: validate distribution scheme again online cpu mask */
-        if (distri == 0) {
-                /* 0 - Round Robin to all cpus, otherwise 1 bit per core */
-                raw_spin_lock_irqsave(&mcip_lock, flags);
-                idu_set_dest(hwirq, BIT(num_online_cpus()) - 1);
-                idu_set_mode(hwirq, IDU_M_TRIG_LEVEL, IDU_M_DISTRI_RR);
-                raw_spin_unlock_irqrestore(&mcip_lock, flags);
-        } else {
-                /*
-                 * DEST based distribution for Level Triggered intr can only
-                 * have 1 CPU, so generalize it to always contain 1 cpu
-                 */
-                int cpu = ffs(distri);
-
-                if (cpu != fls(distri))
-                        pr_warn("IDU irq %lx distri mode set to cpu %x\n",
-                                hwirq, cpu);
-
-                raw_spin_lock_irqsave(&mcip_lock, flags);
-                idu_set_dest(hwirq, cpu);
-                idu_set_mode(hwirq, IDU_M_TRIG_LEVEL, IDU_M_DISTRI_DEST);
-                raw_spin_unlock_irqrestore(&mcip_lock, flags);
-        }
-
         return 0;
 }
 
diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c
index 88674d972c9d..2afbafadb6ab 100644
--- a/arch/arc/kernel/smp.c
+++ b/arch/arc/kernel/smp.c
@@ -90,22 +90,37 @@ void __init smp_cpus_done(unsigned int max_cpus)
  */
 static volatile int wake_flag;
 
+#ifdef CONFIG_ISA_ARCOMPACT
+
+#define __boot_read(f)          f
+#define __boot_write(f, v)      f = v
+
+#else
+
+#define __boot_read(f)          arc_read_uncached_32(&f)
+#define __boot_write(f, v)      arc_write_uncached_32(&f, v)
+
+#endif
+
 static void arc_default_smp_cpu_kick(int cpu, unsigned long pc)
 {
         BUG_ON(cpu == 0);
-        wake_flag = cpu;
+
+        __boot_write(wake_flag, cpu);
 }
 
 void arc_platform_smp_wait_to_boot(int cpu)
 {
-        while (wake_flag != cpu)
+        /* for halt-on-reset, we've waited already */
+        if (IS_ENABLED(CONFIG_ARC_SMP_HALT_ON_RESET))
+                return;
+
+        while (__boot_read(wake_flag) != cpu)
                 ;
 
-        wake_flag = 0;
-        __asm__ __volatile__("j @first_lines_of_secondary       \n");
+        __boot_write(wake_flag, 0);
 }
 
-
 const char *arc_platform_smp_cpuinfo(void)
 {
         return plat_smp_ops.info ? : "";
diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c
index abd961f3e763..91ebe382147f 100644
--- a/arch/arc/kernel/unaligned.c
+++ b/arch/arc/kernel/unaligned.c
@@ -241,8 +241,9 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs,
         if (state.fault)
                 goto fault;
 
+        /* clear any remanants of delay slot */
         if (delay_mode(regs)) {
-                regs->ret = regs->bta;
+                regs->ret = regs->bta ~1U;
                 regs->status32 &= ~STATUS_DE_MASK;
         } else {
                 regs->ret += state.instr_len;
diff --git a/arch/arm64/crypto/aes-modes.S b/arch/arm64/crypto/aes-modes.S
index c53dbeae79f2..838dad5c209f 100644
--- a/arch/arm64/crypto/aes-modes.S
+++ b/arch/arm64/crypto/aes-modes.S
@@ -193,15 +193,16 @@ AES_ENTRY(aes_cbc_encrypt)
         cbz             w6, .Lcbcencloop
 
         ld1             {v0.16b}, [x5]                  /* get iv */
-        enc_prepare     w3, x2, x5
+        enc_prepare     w3, x2, x6
 
 .Lcbcencloop:
         ld1             {v1.16b}, [x1], #16             /* get next pt block */
         eor             v0.16b, v0.16b, v1.16b          /* ..and xor with iv */
-        encrypt_block   v0, w3, x2, x5, w6
+        encrypt_block   v0, w3, x2, x6, w7
         st1             {v0.16b}, [x0], #16
         subs            w4, w4, #1
         bne             .Lcbcencloop
+        st1             {v0.16b}, [x5]                  /* return iv */
         ret
 AES_ENDPROC(aes_cbc_encrypt)
 
@@ -211,7 +212,7 @@ AES_ENTRY(aes_cbc_decrypt)
         cbz             w6, .LcbcdecloopNx
 
         ld1             {v7.16b}, [x5]                  /* get iv */
-        dec_prepare     w3, x2, x5
+        dec_prepare     w3, x2, x6
 
 .LcbcdecloopNx:
 #if INTERLEAVE >= 2
@@ -248,7 +249,7 @@ AES_ENTRY(aes_cbc_decrypt)
 .Lcbcdecloop:
         ld1             {v1.16b}, [x1], #16             /* get next ct block */
         mov             v0.16b, v1.16b                  /* ...and copy to v0 */
-        decrypt_block   v0, w3, x2, x5, w6
+        decrypt_block   v0, w3, x2, x6, w7
         eor             v0.16b, v0.16b, v7.16b          /* xor with iv => pt */
         mov             v7.16b, v1.16b                  /* ct is next iv */
         st1             {v0.16b}, [x0], #16
@@ -256,6 +257,7 @@ AES_ENTRY(aes_cbc_decrypt)
         bne             .Lcbcdecloop
 .Lcbcdecout:
         FRAME_POP
+        st1             {v7.16b}, [x5]                  /* return iv */
         ret
 AES_ENDPROC(aes_cbc_decrypt)
 
@@ -267,24 +269,15 @@ AES_ENDPROC(aes_cbc_decrypt)
 
 AES_ENTRY(aes_ctr_encrypt)
         FRAME_PUSH
-        cbnz            w6, .Lctrfirst          /* 1st time around? */
-        umov            x5, v4.d[1]             /* keep swabbed ctr in reg */
-        rev             x5, x5
-#if INTERLEAVE >= 2
-        cmn             w5, w4                  /* 32 bit overflow? */
-        bcs             .Lctrinc
-        add             x5, x5, #1              /* increment BE ctr */
-        b               .LctrincNx
-#else
-        b               .Lctrinc
-#endif
-.Lctrfirst:
+        cbz             w6, .Lctrnotfirst       /* 1st time around? */
         enc_prepare     w3, x2, x6
         ld1             {v4.16b}, [x5]
-        umov            x5, v4.d[1]             /* keep swabbed ctr in reg */
-        rev             x5, x5
+
+.Lctrnotfirst:
+        umov            x8, v4.d[1]             /* keep swabbed ctr in reg */
+        rev             x8, x8
 #if INTERLEAVE >= 2
-        cmn             w5, w4                  /* 32 bit overflow? */
+        cmn             w8, w4                  /* 32 bit overflow? */
         bcs             .Lctrloop
 .LctrloopNx:
         subs            w4, w4, #INTERLEAVE
@@ -292,11 +285,11 @@ AES_ENTRY(aes_ctr_encrypt)
 #if INTERLEAVE == 2
         mov             v0.8b, v4.8b
         mov             v1.8b, v4.8b
-        rev             x7, x5
-        add             x5, x5, #1
+        rev             x7, x8
+        add             x8, x8, #1
         ins             v0.d[1], x7
-        rev             x7, x5
-        add             x5, x5, #1
+        rev             x7, x8
+        add             x8, x8, #1
         ins             v1.d[1], x7
         ld1             {v2.16b-v3.16b}, [x1], #32      /* get 2 input blocks */
         do_encrypt_block2x
@@ -305,7 +298,7 @@ AES_ENTRY(aes_ctr_encrypt)
         st1             {v0.16b-v1.16b}, [x0], #32
 #else
         ldr             q8, =0x30000000200000001        /* addends 1,2,3[,0] */
-        dup             v7.4s, w5
+        dup             v7.4s, w8
         mov             v0.16b, v4.16b
         add             v7.4s, v7.4s, v8.4s
         mov             v1.16b, v4.16b
@@ -323,18 +316,12 @@ AES_ENTRY(aes_ctr_encrypt)
         eor             v2.16b, v7.16b, v2.16b
         eor             v3.16b, v5.16b, v3.16b
         st1             {v0.16b-v3.16b}, [x0], #64
-        add             x5, x5, #INTERLEAVE
+        add             x8, x8, #INTERLEAVE
 #endif
-        cbz             w4, .LctroutNx
-.LctrincNx:
-        rev             x7, x5
+        rev             x7, x8
         ins             v4.d[1], x7
+        cbz             w4, .Lctrout
         b               .LctrloopNx
-.LctroutNx:
-        sub             x5, x5, #1
-        rev             x7, x5
-        ins             v4.d[1], x7
-        b               .Lctrout
 .Lctr1x:
         adds            w4, w4, #INTERLEAVE
         beq             .Lctrout
@@ -342,30 +329,39 @@ AES_ENTRY(aes_ctr_encrypt)
 .Lctrloop:
         mov             v0.16b, v4.16b
         encrypt_block   v0, w3, x2, x6, w7
+
+        adds            x8, x8, #1              /* increment BE ctr */
+        rev             x7, x8
+        ins             v4.d[1], x7
+        bcs             .Lctrcarry              /* overflow? */
+
+.Lctrcarrydone:
         subs            w4, w4, #1
         bmi             .Lctrhalfblock          /* blocks < 0 means 1/2 block */
         ld1             {v3.16b}, [x1], #16
         eor             v3.16b, v0.16b, v3.16b
         st1             {v3.16b}, [x0], #16
-        beq             .Lctrout
-.Lctrinc:
-        adds            x5, x5, #1              /* increment BE ctr */
-        rev             x7, x5
-        ins             v4.d[1], x7
-        bcc             .Lctrloop               /* no overflow? */
-        umov            x7, v4.d[0]             /* load upper word of ctr  */
-        rev             x7, x7                  /* ... to handle the carry */
-        add             x7, x7, #1
-        rev             x7, x7
-        ins             v4.d[0], x7
-        b               .Lctrloop
+        bne             .Lctrloop
+
+.Lctrout:
+        st1             {v4.16b}, [x5]          /* return next CTR value */
+        FRAME_POP
+        ret
+
 .Lctrhalfblock:
         ld1             {v3.8b}, [x1]
         eor             v3.8b, v0.8b, v3.8b
         st1             {v3.8b}, [x0]
-.Lctrout:
         FRAME_POP
         ret
+
+.Lctrcarry:
+        umov            x7, v4.d[0]             /* load upper word of ctr  */
+        rev             x7, x7                  /* ... to handle the carry */
+        add             x7, x7, #1
+        rev             x7, x7
+        ins             v4.d[0], x7
+        b               .Lctrcarrydone
 AES_ENDPROC(aes_ctr_encrypt)
         .ltorg
 
diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c
index 23e9e13bd2aa..655e65f38f31 100644
--- a/arch/arm64/kernel/topology.c
+++ b/arch/arm64/kernel/topology.c
@@ -11,6 +11,7 @@
  * for more details.
  */
 
+#include <linux/acpi.h>
 #include <linux/cpu.h>
 #include <linux/cpumask.h>
 #include <linux/init.h>
@@ -209,7 +210,12 @@ static struct notifier_block init_cpu_capacity_notifier = {
 
 static int __init register_cpufreq_notifier(void)
 {
-        if (cap_parsing_failed)
+        /*
+         * on ACPI-based systems we need to use the default cpu capacity
+         * until we have the necessary code to parse the cpu capacity, so
+         * skip registering cpufreq notifier.
+         */
+        if (!acpi_disabled || cap_parsing_failed)
                 return -EINVAL;
 
         if (!alloc_cpumask_var(&cpus_to_visit, GFP_KERNEL)) {
diff --git a/arch/frv/include/asm/atomic.h b/arch/frv/include/asm/atomic.h
index 1c2a5e264fc7..e93c9494503a 100644
--- a/arch/frv/include/asm/atomic.h
+++ b/arch/frv/include/asm/atomic.h
@@ -139,7 +139,7 @@ static inline void atomic64_dec(atomic64_t *v)
 #define atomic64_sub_and_test(i,v)      (atomic64_sub_return((i), (v)) == 0)
 #define atomic64_dec_and_test(v)        (atomic64_dec_return((v)) == 0)
 #define atomic64_inc_and_test(v)        (atomic64_inc_return((v)) == 0)
-
+#define atomic64_inc_not_zero(v)        atomic64_add_unless((v), 1, 0)
 
 #define atomic_cmpxchg(v, old, new)     (cmpxchg(&(v)->counter, old, new))
 #define atomic_xchg(v, new)             (xchg(&(v)->counter, new))
@@ -161,6 +161,39 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
         return c;
 }
 
+static inline int atomic64_add_unless(atomic64_t *v, long long i, long long u)
+{
+        long long c, old;
+
+        c = atomic64_read(v);
+        for (;;) {
+                if (unlikely(c == u))
+                        break;
+                old = atomic64_cmpxchg(v, c, c + i);
+                if (likely(old == c))
+                        break;
+                c = old;
+        }
+        return c != u;
+}
+
+static inline long long atomic64_dec_if_positive(atomic64_t *v)
+{
+        long long c, old, dec;
+
+        c = atomic64_read(v);
+        for (;;) {
+                dec = c - 1;
+                if (unlikely(dec < 0))
+                        break;
+                old = atomic64_cmpxchg((v), c, dec);
+                if (likely(old == c))
+                        break;
+                c = old;
+        }
+                return dec;
+}
+
 #define ATOMIC_OP(op)                                                   \
 static inline int atomic_fetch_##op(int i, atomic_t *v)                 \
 {                                                                       \
diff --git a/arch/mn10300/include/asm/switch_to.h b/arch/mn10300/include/asm/switch_to.h
index 393d311735c8..67e333aa7629 100644
--- a/arch/mn10300/include/asm/switch_to.h
+++ b/arch/mn10300/include/asm/switch_to.h
@@ -16,7 +16,7 @@
 struct task_struct;
 struct thread_struct;
 
-#if !defined(CONFIG_LAZY_SAVE_FPU)
+#if defined(CONFIG_FPU) && !defined(CONFIG_LAZY_SAVE_FPU)
 struct fpu_state_struct;
 extern asmlinkage void fpu_save(struct fpu_state_struct *);
 #define switch_fpu(prev, next)                                          \
diff --git a/arch/parisc/include/asm/bitops.h b/arch/parisc/include/asm/bitops.h
index 3f9406d9b9d6..da87943328a5 100644
--- a/arch/parisc/include/asm/bitops.h
+++ b/arch/parisc/include/asm/bitops.h
@@ -6,7 +6,7 @@
 #endif
 
 #include <linux/compiler.h>
-#include <asm/types.h>          /* for BITS_PER_LONG/SHIFT_PER_LONG */
+#include <asm/types.h>
 #include <asm/byteorder.h>
 #include <asm/barrier.h>
 #include <linux/atomic.h>
@@ -17,6 +17,12 @@
  * to include/asm-i386/bitops.h or kerneldoc
  */
 
+#if __BITS_PER_LONG == 64
+#define SHIFT_PER_LONG 6
+#else
+#define SHIFT_PER_LONG 5
+#endif
+
 #define CHOP_SHIFTCOUNT(x) (((unsigned long) (x)) & (BITS_PER_LONG - 1))
 
 
diff --git a/arch/parisc/include/uapi/asm/bitsperlong.h b/arch/parisc/include/uapi/asm/bitsperlong.h
index e0a23c7bdd43..07fa7e50bdc0 100644
--- a/arch/parisc/include/uapi/asm/bitsperlong.h
+++ b/arch/parisc/include/uapi/asm/bitsperlong.h
@@ -3,10 +3,8 @@
 
 #if defined(__LP64__)
 #define __BITS_PER_LONG 64
-#define SHIFT_PER_LONG 6
 #else
 #define __BITS_PER_LONG 32
-#define SHIFT_PER_LONG 5
 #endif
 
 #include <asm-generic/bitsperlong.h>
diff --git a/arch/parisc/include/uapi/asm/swab.h b/arch/parisc/include/uapi/asm/swab.h
index e78403b129ef..928e1bbac98f 100644
--- a/arch/parisc/include/uapi/asm/swab.h
+++ b/arch/parisc/include/uapi/asm/swab.h
@@ -1,6 +1,7 @@
 #ifndef _PARISC_SWAB_H
 #define _PARISC_SWAB_H
 
+#include <asm/bitsperlong.h>
 #include <linux/types.h>
 #include <linux/compiler.h>
 
@@ -38,7 +39,7 @@ static inline __attribute_const__ __u32 __arch_swab32(__u32 x)
 }
 #define __arch_swab32 __arch_swab32
 
-#if BITS_PER_LONG > 32
+#if __BITS_PER_LONG > 32
 /*
 ** From "PA-RISC 2.0 Architecture", HP Professional Books.
 ** See Appendix I page 8 , "Endian Byte Swapping".
@@ -61,6 +62,6 @@ static inline __attribute_const__ __u64 __arch_swab64(__u64 x)
         return x;
 }
 #define __arch_swab64 __arch_swab64
-#endif /* BITS_PER_LONG > 32 */
+#endif /* __BITS_PER_LONG > 32 */
 
 #endif /* _PARISC_SWAB_H */
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index a8ee573fe610..281f4f1fcd1f 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -164,7 +164,6 @@ config PPC
         select ARCH_HAS_SCALED_CPUTIME if VIRT_CPU_ACCOUNTING_NATIVE
         select HAVE_ARCH_HARDENED_USERCOPY
         select HAVE_KERNEL_GZIP
-        select HAVE_CC_STACKPROTECTOR
 
 config GENERIC_CSUM
         def_bool CPU_LITTLE_ENDIAN
@@ -484,6 +483,7 @@ config RELOCATABLE
         bool "Build a relocatable kernel"
         depends on (PPC64 && !COMPILE_TEST) || (FLATMEM && (44x || FSL_BOOKE))
         select NONSTATIC_KERNEL
+        select MODULE_REL_CRCS if MODVERSIONS
         help
           This builds a kernel image that is capable of running at the
           location the kernel is loaded at. For ppc32, there is no any
diff --git a/arch/powerpc/include/asm/cpu_has_feature.h b/arch/powerpc/include/asm/cpu_has_feature.h
index b312b152461b..6e834caa3720 100644
--- a/arch/powerpc/include/asm/cpu_has_feature.h
+++ b/arch/powerpc/include/asm/cpu_has_feature.h
@@ -23,7 +23,9 @@ static __always_inline bool cpu_has_feature(unsigned long feature)
 {
         int i;
 
+#ifndef __clang__ /* clang can't cope with this */
         BUILD_BUG_ON(!__builtin_constant_p(feature));
+#endif
 
 #ifdef CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG
         if (!static_key_initialized) {
diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
index a34c764ca8dd..233a7e8cc8e3 100644
--- a/arch/powerpc/include/asm/mmu.h
+++ b/arch/powerpc/include/asm/mmu.h
@@ -160,7 +160,9 @@ static __always_inline bool mmu_has_feature(unsigned long feature)
 {
         int i;
 
+#ifndef __clang__ /* clang can't cope with this */
         BUILD_BUG_ON(!__builtin_constant_p(feature));
+#endif
 
 #ifdef CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG
         if (!static_key_initialized) {
diff --git a/arch/powerpc/include/asm/module.h b/arch/powerpc/include/asm/module.h
index cc12c61ef315..53885512b8d3 100644
--- a/arch/powerpc/include/asm/module.h
+++ b/arch/powerpc/include/asm/module.h
@@ -90,9 +90,5 @@ static inline int module_finalize_ftrace(struct module *mod, const Elf_Shdr *sec
 }
 #endif
 
-#if defined(CONFIG_MODVERSIONS) && defined(CONFIG_PPC64)
-#define ARCH_RELOCATES_KCRCTAB
-#define reloc_start PHYSICAL_START
-#endif
 #endif /* __KERNEL__ */
 #endif  /* _ASM_POWERPC_MODULE_H */
diff --git a/arch/powerpc/include/asm/stackprotector.h b/arch/powerpc/include/asm/stackprotector.h
deleted file mode 100644
index 6720190eabec..000000000000
--- a/arch/powerpc/include/asm/stackprotector.h
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * GCC stack protector support.
- *
- * Stack protector works by putting predefined pattern at the start of
- * the stack frame and verifying that it hasn't been overwritten when
- * returning from the function.  The pattern is called stack canary
- * and gcc expects it to be defined by a global variable called
- * "__stack_chk_guard" on PPC.  This unfortunately means that on SMP
- * we cannot have a different canary value per task.
- */
-
-#ifndef _ASM_STACKPROTECTOR_H
-#define _ASM_STACKPROTECTOR_H
-
-#include <linux/random.h>
-#include <linux/version.h>
-#include <asm/reg.h>
-
-extern unsigned long __stack_chk_guard;
-
-/*
- * Initialize the stackprotector canary value.
- *
- * NOTE: this must only be called from functions that never return,
- * and it must always be inlined.
- */
-static __always_inline void boot_init_stack_canary(void)
-{
-        unsigned long canary;
-
-        /* Try to get a semi random initial value. */
-        get_random_bytes(&canary, sizeof(canary));
-        canary ^= mftb();
-        canary ^= LINUX_VERSION_CODE;
-
-        current->stack_canary = canary;
-        __stack_chk_guard = current->stack_canary;
-}
-
-#endif  /* _ASM_STACKPROTECTOR_H */
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index 23f8082d7bfa..f4c2b52e58b3 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -19,10 +19,6 @@ CFLAGS_init.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
 CFLAGS_btext.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
 CFLAGS_prom.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
 
-# -fstack-protector triggers protection checks in this code,
-# but it is being used too early to link to meaningful stack_chk logic.
-CFLAGS_prom_init.o += $(call cc-option, -fno-stack-protector)
-
 ifdef CONFIG_FUNCTION_TRACER
 # Do not trace early boot code
 CFLAGS_REMOVE_cputable.o = -mno-sched-epilog $(CC_FLAGS_FTRACE)
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index 0601e6a7297c..195a9fc8f81c 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -91,9 +91,6 @@ int main(void)
         DEFINE(TI_livepatch_sp, offsetof(struct thread_info, livepatch_sp));
 #endif
 
-#ifdef CONFIG_CC_STACKPROTECTOR
-        DEFINE(TSK_STACK_CANARY, offsetof(struct task_struct, stack_canary));
-#endif
         DEFINE(KSP, offsetof(struct thread_struct, ksp));
         DEFINE(PT_REGS, offsetof(struct thread_struct, regs));
 #ifdef CONFIG_BOOKE
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index d88573bdd090..b94887165a10 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -545,7 +545,7 @@ static void *eeh_pe_detach_dev(void *data, void *userdata)
 static void *__eeh_clear_pe_frozen_state(void *data, void *flag)
 {
         struct eeh_pe *pe = (struct eeh_pe *)data;
-        bool *clear_sw_state = flag;
+        bool clear_sw_state = *(bool *)flag;
         int i, rc = 1;
 
         for (i = 0; rc && i < 3; i++)
diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
index 5742dbdbee46..3841d749a430 100644
--- a/arch/powerpc/kernel/entry_32.S
+++ b/arch/powerpc/kernel/entry_32.S
@@ -674,11 +674,7 @@ BEGIN_FTR_SECTION
         mtspr   SPRN_SPEFSCR,r0         /* restore SPEFSCR reg */
 END_FTR_SECTION_IFSET(CPU_FTR_SPE)
 #endif /* CONFIG_SPE */
-#if defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_SMP)
-        lwz     r0,TSK_STACK_CANARY(r2)
-        lis     r4,__stack_chk_guard@ha
-        stw     r0,__stack_chk_guard@l(r4)
-#endif
+
         lwz     r0,_CCR(r1)
         mtcrf   0xFF,r0
         /* r3-r12 are destroyed -- Cort */
diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
index bb1807184bad..0b0f89685b67 100644
--- a/arch/powerpc/kernel/module_64.c
+++ b/arch/powerpc/kernel/module_64.c
@@ -286,14 +286,6 @@ static void dedotify_versions(struct modversion_info *vers,
         for (end = (void *)vers + size; vers < end; vers++)
                 if (vers->name[0] == '.') {
                         memmove(vers->name, vers->name+1, strlen(vers->name));
-#ifdef ARCH_RELOCATES_KCRCTAB
-                        /* The TOC symbol has no CRC computed. To avoid CRC
-                         * check failing, we must force it to the expected
-                         * value (see CRC check in module.c).
-                         */
-                        if (!strcmp(vers->name, "TOC."))
-                                vers->crc = -(unsigned long)reloc_start;
-#endif
                 }
 }
 
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 04885cec24df..5dd056df0baa 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -64,12 +64,6 @@
 #include <linux/kprobes.h>
 #include <linux/kdebug.h>
 
-#ifdef CONFIG_CC_STACKPROTECTOR
-#include <linux/stackprotector.h>
-unsigned long __stack_chk_guard __read_mostly;
-EXPORT_SYMBOL(__stack_chk_guard);
-#endif
-
 /* Transactional Memory debug */
 #ifdef TM_DEBUG_SW
 #define TM_DEBUG(x...) printk(KERN_INFO x)
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index ec47a939cbdd..ac83eb04a8b8 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -2834,6 +2834,9 @@ static void __init prom_find_boot_cpu(void)
 
         cpu_pkg = call_prom("instance-to-package", 1, 1, prom_cpu);
 
+        if (!PHANDLE_VALID(cpu_pkg))
+                return;
+
         prom_getprop(cpu_pkg, "reg", &rval, sizeof(rval));
         prom.cpu = be32_to_cpu(rval);
 
diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
index cfa53ccc8baf..34f1a0dbc898 100644
--- a/arch/powerpc/mm/pgtable-radix.c
+++ b/arch/powerpc/mm/pgtable-radix.c
@@ -65,7 +65,7 @@ int radix__map_kernel_page(unsigned long ea, unsigned long pa,
                 if (!pmdp)
                         return -ENOMEM;
                 if (map_page_size == PMD_SIZE) {
-                        ptep = (pte_t *)pudp;
+                        ptep = pmdp_ptep(pmdp);
                         goto set_the_pte;
                 }
                 ptep = pte_alloc_kernel(pmdp, ea);
@@ -90,7 +90,7 @@ int radix__map_kernel_page(unsigned long ea, unsigned long pa,
                 }
                 pmdp = pmd_offset(pudp, ea);
                 if (map_page_size == PMD_SIZE) {
-                        ptep = (pte_t *)pudp;
+                        ptep = pmdp_ptep(pmdp);
                         goto set_the_pte;
                 }
                 if (!pmd_present(*pmdp)) {
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 7447ba509c30..12020b55887b 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -963,6 +963,11 @@ static int s390_fpregs_set(struct task_struct *target,
         if (target == current)
                 save_fpu_regs();
 
+        if (MACHINE_HAS_VX)
+                convert_vx_to_fp(fprs, target->thread.fpu.vxrs);
+        else
+                memcpy(&fprs, target->thread.fpu.fprs, sizeof(fprs));
+
         /* If setting FPC, must validate it first. */
         if (count > 0 && pos < offsetof(s390_fp_regs, fprs)) {
                 u32 ufpc[2] = { target->thread.fpu.fpc, 0 };
@@ -1067,6 +1072,9 @@ static int s390_vxrs_low_set(struct task_struct *target,
         if (target == current)
                 save_fpu_regs();
 
+        for (i = 0; i < __NUM_VXRS_LOW; i++)
+                vxrs[i] = *((__u64 *)(target->thread.fpu.vxrs + i) + 1);
+
         rc = user_regset_copyin(&pos, &count, &kbuf, &ubuf, vxrs, 0, -1);
         if (rc == 0)
                 for (i = 0; i < __NUM_VXRS_LOW; i++)
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 7a1897c51c54..d56ef26d4681 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -202,7 +202,7 @@ static inline pgste_t ptep_xchg_start(struct mm_struct *mm,
         return pgste;
 }
 
-static inline void ptep_xchg_commit(struct mm_struct *mm,
+static inline pte_t ptep_xchg_commit(struct mm_struct *mm,
                                     unsigned long addr, pte_t *ptep,
                                     pgste_t pgste, pte_t old, pte_t new)
 {
@@ -220,6 +220,7 @@ static inline void ptep_xchg_commit(struct mm_struct *mm,
         } else {
                 *ptep = new;
         }
+        return old;
 }
 
 pte_t ptep_xchg_direct(struct mm_struct *mm, unsigned long addr,
@@ -231,7 +232,7 @@ pte_t ptep_xchg_direct(struct mm_struct *mm, unsigned long addr,
         preempt_disable();
         pgste = ptep_xchg_start(mm, addr, ptep);
         old = ptep_flush_direct(mm, addr, ptep);
-        ptep_xchg_commit(mm, addr, ptep, pgste, old, new);
+        old = ptep_xchg_commit(mm, addr, ptep, pgste, old, new);
         preempt_enable();
         return old;
 }
@@ -246,7 +247,7 @@ pte_t ptep_xchg_lazy(struct mm_struct *mm, unsigned long addr,
         preempt_disable();
         pgste = ptep_xchg_start(mm, addr, ptep);
         old = ptep_flush_lazy(mm, addr, ptep);
-        ptep_xchg_commit(mm, addr, ptep, pgste, old, new);
+        old = ptep_xchg_commit(mm, addr, ptep, pgste, old, new);
         preempt_enable();
         return old;
 }
diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h
index b84be675e507..d0317993e947 100644
--- a/arch/sparc/include/asm/mmu_context_64.h
+++ b/arch/sparc/include/asm/mmu_context_64.h
@@ -35,15 +35,15 @@ void __tsb_context_switch(unsigned long pgd_pa,
 static inline void tsb_context_switch(struct mm_struct *mm)
 {
         __tsb_context_switch(__pa(mm->pgd),
-                             &mm->context.tsb_block[0],
+                             &mm->context.tsb_block[MM_TSB_BASE],
 #if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)
-                             (mm->context.tsb_block[1].tsb ?
-                              &mm->context.tsb_block[1] :
+                             (mm->context.tsb_block[MM_TSB_HUGE].tsb ?
+                              &mm->context.tsb_block[MM_TSB_HUGE] :
                               NULL)
 #else
                              NULL
 #endif
-                             , __pa(&mm->context.tsb_descr[0]));
+                             , __pa(&mm->context.tsb_descr[MM_TSB_BASE]));
 }
 
 void tsb_grow(struct mm_struct *mm,
diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
index 3bebf395252c..4d0248aa0928 100644
--- a/arch/sparc/kernel/irq_64.c
+++ b/arch/sparc/kernel/irq_64.c
@@ -1021,7 +1021,7 @@ static void __init alloc_one_queue(unsigned long *pa_ptr, unsigned long qmask)
         unsigned long order = get_order(size);
         unsigned long p;
 
-        p = __get_free_pages(GFP_KERNEL, order);
+        p = __get_free_pages(GFP_KERNEL | __GFP_ZERO, order);
         if (!p) {
                 prom_printf("SUN4V: Error, cannot allocate queue.\n");
                 prom_halt();
diff --git a/arch/sparc/kernel/sstate.c b/arch/sparc/kernel/sstate.c
index c59af546f522..3caed4023589 100644
--- a/arch/sparc/kernel/sstate.c
+++ b/arch/sparc/kernel/sstate.c
@@ -43,8 +43,8 @@ static const char poweroff_msg[32] __attribute__((aligned(32))) =
         "Linux powering off";
 static const char rebooting_msg[32] __attribute__((aligned(32))) =
         "Linux rebooting";
-static const char panicing_msg[32] __attribute__((aligned(32))) =
-        "Linux panicing";
+static const char panicking_msg[32] __attribute__((aligned(32))) =
+        "Linux panicking";
 
 static int sstate_reboot_call(struct notifier_block *np, unsigned long type, void *_unused)
 {
@@ -76,7 +76,7 @@ static struct notifier_block sstate_reboot_notifier = {
 
 static int sstate_panic_event(struct notifier_block *n, unsigned long event, void *ptr)
 {
-        do_set_sstate(HV_SOFT_STATE_TRANSITION, panicing_msg);
+        do_set_sstate(HV_SOFT_STATE_TRANSITION, panicking_msg);
 
         return NOTIFY_DONE;
 }
diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
index 4bc10e44d1ca..dfc97a47c9a0 100644
--- a/arch/sparc/kernel/traps_64.c
+++ b/arch/sparc/kernel/traps_64.c
@@ -2051,6 +2051,73 @@ void sun4v_resum_overflow(struct pt_regs *regs)
         atomic_inc(&sun4v_resum_oflow_cnt);
 }
 
+/* Given a set of registers, get the virtual addressi that was being accessed
+ * by the faulting instructions at tpc.
+ */
+static unsigned long sun4v_get_vaddr(struct pt_regs *regs)
+{
+        unsigned int insn;
+
+        if (!copy_from_user(&insn, (void __user *)regs->tpc, 4)) {
+                return compute_effective_address(regs, insn,
+                                                 (insn >> 25) & 0x1f);
+        }
+        return 0;
+}
+
+/* Attempt to handle non-resumable errors generated from userspace.
+ * Returns true if the signal was handled, false otherwise.
+ */
+bool sun4v_nonresum_error_user_handled(struct pt_regs *regs,
+                                  struct sun4v_error_entry *ent) {
+
+        unsigned int attrs = ent->err_attrs;
+
+        if (attrs & SUN4V_ERR_ATTRS_MEMORY) {
+                unsigned long addr = ent->err_raddr;
+                siginfo_t info;
+
+                if (addr == ~(u64)0) {
+                        /* This seems highly unlikely to ever occur */
+                        pr_emerg("SUN4V NON-RECOVERABLE ERROR: Memory error detected in unknown location!\n");
+                } else {
+                        unsigned long page_cnt = DIV_ROUND_UP(ent->err_size,
+                                                              PAGE_SIZE);
+
+                        /* Break the unfortunate news. */
+                        pr_emerg("SUN4V NON-RECOVERABLE ERROR: Memory failed at %016lX\n",
+                                 addr);
+                        pr_emerg("SUN4V NON-RECOVERABLE ERROR:   Claiming %lu ages.\n",
+                                 page_cnt);
+
+                        while (page_cnt-- > 0) {
+                                if (pfn_valid(addr >> PAGE_SHIFT))
+                                        get_page(pfn_to_page(addr >> PAGE_SHIFT));
+                                addr += PAGE_SIZE;
+                        }
+                }
+                info.si_signo = SIGKILL;
+                info.si_errno = 0;
+                info.si_trapno = 0;
+                force_sig_info(info.si_signo, &info, current);
+
+                return true;
+        }
+        if (attrs & SUN4V_ERR_ATTRS_PIO) {
+                siginfo_t info;
+
+                info.si_signo = SIGBUS;
+                info.si_code = BUS_ADRERR;
+                info.si_addr = (void __user *)sun4v_get_vaddr(regs);
+                force_sig_info(info.si_signo, &info, current);
+
+                return true;
+        }
+
+        /* Default to doing nothing */
+        return false;
+}
+
 /* We run with %pil set to PIL_NORMAL_MAX and PSTATE_IE enabled in %pstate.
  * Log the event, clear the first word of the entry, and die.
  */
@@ -2075,6 +2142,12 @@ void sun4v_nonresum_error(struct pt_regs *regs, unsigned long offset)
 
         put_cpu();
 
+        if (!(regs->tstate & TSTATE_PRIV) &&
+            sun4v_nonresum_error_user_handled(regs, &local_copy)) {
+                /* DON'T PANIC: This userspace error was handled. */
+                return;
+        }
+
 #ifdef CONFIG_PCI
         /* Check for the special PCI poke sequence. */
         if (pci_poke_in_progress && pci_poke_cpu == cpu) {
diff --git a/arch/tile/kernel/ptrace.c b/arch/tile/kernel/ptrace.c
index d89b7011667c..e279572824b1 100644
--- a/arch/tile/kernel/ptrace.c
+++ b/arch/tile/kernel/ptrace.c
@@ -111,7 +111,7 @@ static int tile_gpr_set(struct task_struct *target,
                           const void *kbuf, const void __user *ubuf)
 {
         int ret;
-        struct pt_regs regs;
+        struct pt_regs regs = *task_pt_regs(target);
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &regs, 0,
                                  sizeof(regs));
diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
index 6ef688a1ef3e..7ff1b0c86a8e 100644
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -1085,9 +1085,9 @@ static void aesni_free_simds(void)
                     aesni_simd_skciphers[i]; i++)
                 simd_skcipher_free(aesni_simd_skciphers[i]);
 
-        for (i = 0; i < ARRAY_SIZE(aesni_simd_skciphers2) &&
-                    aesni_simd_skciphers2[i].simd; i++)
-                simd_skcipher_free(aesni_simd_skciphers2[i].simd);
+        for (i = 0; i < ARRAY_SIZE(aesni_simd_skciphers2); i++)
+                if (aesni_simd_skciphers2[i].simd)
+                        simd_skcipher_free(aesni_simd_skciphers2[i].simd);
 }
 
 static int __init aesni_init(void)
@@ -1168,7 +1168,7 @@ static int __init aesni_init(void)
                 simd = simd_skcipher_create_compat(algname, drvname, basename);
                 err = PTR_ERR(simd);
                 if (IS_ERR(simd))
-                        goto unregister_simds;
+                        continue;
 
                 aesni_simd_skciphers2[i].simd = simd;
         }
diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
index 17c3564d087a..22ef4f72cf32 100644
--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -161,7 +161,13 @@ static u64 rapl_timer_ms;
 
 static inline struct rapl_pmu *cpu_to_rapl_pmu(unsigned int cpu)
 {
-        return rapl_pmus->pmus[topology_logical_package_id(cpu)];
+        unsigned int pkgid = topology_logical_package_id(cpu);
+
+        /*
+         * The unsigned check also catches the '-1' return value for non
+         * existent mappings in the topology map.
+         */
+        return pkgid < rapl_pmus->maxpkg ? rapl_pmus->pmus[pkgid] : NULL;
 }
 
 static inline u64 rapl_read_counter(struct perf_event *event)
@@ -402,6 +408,8 @@ static int rapl_pmu_event_init(struct perf_event *event)
 
         /* must be done before validate_group */
         pmu = cpu_to_rapl_pmu(event->cpu);
+        if (!pmu)
+                return -EINVAL;
         event->cpu = pmu->cpu;
         event->pmu_private = pmu;
         event->hw.event_base = msr;
@@ -585,6 +593,20 @@ static int rapl_cpu_online(unsigned int cpu)
         struct rapl_pmu *pmu = cpu_to_rapl_pmu(cpu);
         int target;
 
+        if (!pmu) {
+                pmu = kzalloc_node(sizeof(*pmu), GFP_KERNEL, cpu_to_node(cpu));
+                if (!pmu)
+                        return -ENOMEM;
+
+                raw_spin_lock_init(&pmu->lock);
+                INIT_LIST_HEAD(&pmu->active_list);
+                pmu->pmu = &rapl_pmus->pmu;
+                pmu->timer_interval = ms_to_ktime(rapl_timer_ms);
+                rapl_hrtimer_init(pmu);
+
+                rapl_pmus->pmus[topology_logical_package_id(cpu)] = pmu;
+        }
+
         /*
          * Check if there is an online cpu in the package which collects rapl
          * events already.
@@ -598,27 +620,6 @@ static int rapl_cpu_online(unsigned int cpu)
         return 0;
 }
 
-static int rapl_cpu_prepare(unsigned int cpu)
-{
-        struct rapl_pmu *pmu = cpu_to_rapl_pmu(cpu);
-
-        if (pmu)
-                return 0;
-
-        pmu = kzalloc_node(sizeof(*pmu), GFP_KERNEL, cpu_to_node(cpu));
-        if (!pmu)
-                return -ENOMEM;
-
-        raw_spin_lock_init(&pmu->lock);
-        INIT_LIST_HEAD(&pmu->active_list);
-        pmu->pmu = &rapl_pmus->pmu;
-        pmu->timer_interval = ms_to_ktime(rapl_timer_ms);
-        pmu->cpu = -1;
-        rapl_hrtimer_init(pmu);
-        rapl_pmus->pmus[topology_logical_package_id(cpu)] = pmu;
-        return 0;
-}
-
 static int rapl_check_hw_unit(bool apply_quirk)
 {
         u64 msr_rapl_power_unit_bits;
@@ -803,29 +804,21 @@ static int __init rapl_pmu_init(void)
         /*
          * Install callbacks. Core will call them for each online cpu.
          */
-
-        ret = cpuhp_setup_state(CPUHP_PERF_X86_RAPL_PREP, "perf/x86/rapl:prepare",
-                                rapl_cpu_prepare, NULL);
-        if (ret)
-                goto out;
-
         ret = cpuhp_setup_state(CPUHP_AP_PERF_X86_RAPL_ONLINE,
                                 "perf/x86/rapl:online",
                                 rapl_cpu_online, rapl_cpu_offline);
         if (ret)
-                goto out1;
+                goto out;
 
         ret = perf_pmu_register(&rapl_pmus->pmu, "power", -1);
         if (ret)
-                goto out2;
+                goto out1;
 
         rapl_advertise();
         return 0;
 
-out2:
-        cpuhp_remove_state(CPUHP_AP_PERF_X86_RAPL_ONLINE);
 out1:
-        cpuhp_remove_state(CPUHP_PERF_X86_RAPL_PREP);
+        cpuhp_remove_state(CPUHP_AP_PERF_X86_RAPL_ONLINE);
 out:
         pr_warn("Initialization failed (%d), disabled\n", ret);
         cleanup_rapl_pmus();
@@ -836,7 +829,6 @@ module_init(rapl_pmu_init);
 static void __exit intel_rapl_exit(void)
 {
         cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_RAPL_ONLINE);
-        cpuhp_remove_state_nocalls(CPUHP_PERF_X86_RAPL_PREP);
         perf_pmu_unregister(&rapl_pmus->pmu);
         cleanup_rapl_pmus();
 }
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 8c4ccdc3a3f3..1ab45976474d 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -100,7 +100,13 @@ ssize_t uncore_event_show(struct kobject *kobj,
 
 struct intel_uncore_box *uncore_pmu_to_box(struct intel_uncore_pmu *pmu, int cpu)
 {
-        return pmu->boxes[topology_logical_package_id(cpu)];
+        unsigned int pkgid = topology_logical_package_id(cpu);
+
+        /*
+         * The unsigned check also catches the '-1' return value for non
+         * existent mappings in the topology map.
+         */
+        return pkgid < max_packages ? pmu->boxes[pkgid] : NULL;
 }
 
 u64 uncore_msr_read_counter(struct intel_uncore_box *box, struct perf_event *event)
@@ -764,30 +770,6 @@ static void uncore_pmu_unregister(struct intel_uncore_pmu *pmu)
         pmu->registered = false;
 }
 
-static void __uncore_exit_boxes(struct intel_uncore_type *type, int cpu)
-{
-        struct intel_uncore_pmu *pmu = type->pmus;
-        struct intel_uncore_box *box;
-        int i, pkg;
-
-        if (pmu) {
-                pkg = topology_physical_package_id(cpu);
-                for (i = 0; i < type->num_boxes; i++, pmu++) {
-                        box = pmu->boxes[pkg];
-                        if (box)
-                                uncore_box_exit(box);
-                }
-        }
-}
-
-static void uncore_exit_boxes(void *dummy)
-{
-        struct intel_uncore_type **types;
-
-        for (types = uncore_msr_uncores; *types; types++)
-                __uncore_exit_boxes(*types++, smp_processor_id());
-}
-
 static void uncore_free_boxes(struct intel_uncore_pmu *pmu)
 {
         int pkg;
@@ -1058,86 +1040,6 @@ static void uncore_pci_exit(void)
         }
 }
 
-static int uncore_cpu_dying(unsigned int cpu)
-{
-        struct intel_uncore_type *type, **types = uncore_msr_uncores;
-        struct intel_uncore_pmu *pmu;
-        struct intel_uncore_box *box;
-        int i, pkg;
-
-        pkg = topology_logical_package_id(cpu);
-        for (; *types; types++) {
-                type = *types;
-                pmu = type->pmus;
-                for (i = 0; i < type->num_boxes; i++, pmu++) {
-                        box = pmu->boxes[pkg];
-                        if (box && atomic_dec_return(&box->refcnt) == 0)
-                                uncore_box_exit(box);
-                }
-        }
-        return 0;
-}
-
-static int first_init;
-
-static int uncore_cpu_starting(unsigned int cpu)
-{
-        struct intel_uncore_type *type, **types = uncore_msr_uncores;
-        struct intel_uncore_pmu *pmu;
-        struct intel_uncore_box *box;
-        int i, pkg, ncpus = 1;
-
-        if (first_init) {
-                /*
-                 * On init we get the number of online cpus in the package
-                 * and set refcount for all of them.
-                 */
-                ncpus = cpumask_weight(topology_core_cpumask(cpu));
-        }
-
-        pkg = topology_logical_package_id(cpu);
-        for (; *types; types++) {
-                type = *types;
-                pmu = type->pmus;
-                for (i = 0; i < type->num_boxes; i++, pmu++) {
-                        box = pmu->boxes[pkg];
-                        if (!box)
-                                continue;
-                        /* The first cpu on a package activates the box */
-                        if (atomic_add_return(ncpus, &box->refcnt) == ncpus)
-                                uncore_box_init(box);
-                }
-        }
-
-        return 0;
-}
-
-static int uncore_cpu_prepare(unsigned int cpu)
-{
-        struct intel_uncore_type *type, **types = uncore_msr_uncores;
-        struct intel_uncore_pmu *pmu;
-        struct intel_uncore_box *box;
-        int i, pkg;
-
-        pkg = topology_logical_package_id(cpu);
-        for (; *types; types++) {
-                type = *types;
-                pmu = type->pmus;
-                for (i = 0; i < type->num_boxes; i++, pmu++) {
-                        if (pmu->boxes[pkg])
-                                continue;
-                        /* First cpu of a package allocates the box */
-                        box = uncore_alloc_box(type, cpu_to_node(cpu));
-                        if (!box)
-                                return -ENOMEM;
-                        box->pmu = pmu;
-                        box->pkgid = pkg;
-                        pmu->boxes[pkg] = box;
-                }
-        }
-        return 0;
-}
-
 static void uncore_change_type_ctx(struct intel_uncore_type *type, int old_cpu,
                                    int new_cpu)
 {
@@ -1177,12 +1079,14 @@ static void uncore_change_context(struct intel_uncore_type **uncores,
 
 static int uncore_event_cpu_offline(unsigned int cpu)
 {
-        int target;
+        struct intel_uncore_type *type, **types = uncore_msr_uncores;
+        struct intel_uncore_pmu *pmu;
+        struct intel_uncore_box *box;
+        int i, pkg, target;
 
         /* Check if exiting cpu is used for collecting uncore events */
         if (!cpumask_test_and_clear_cpu(cpu, &uncore_cpu_mask))
-                return 0;
-
+                goto unref;
         /* Find a new cpu to collect uncore events */
         target = cpumask_any_but(topology_core_cpumask(cpu), cpu);
 
@@ -1194,12 +1098,82 @@ static int uncore_event_cpu_offline(unsigned int cpu)
 
         uncore_change_context(uncore_msr_uncores, cpu, target);
         uncore_change_context(uncore_pci_uncores, cpu, target);
+
+unref:
+        /* Clear the references */
+        pkg = topology_logical_package_id(cpu);
+        for (; *types; types++) {
+                type = *types;
+                pmu = type->pmus;
+                for (i = 0; i < type->num_boxes; i++, pmu++) {
+                        box = pmu->boxes[pkg];
+                        if (box && atomic_dec_return(&box->refcnt) == 0)
+                                uncore_box_exit(box);
+                }
+        }
         return 0;
 }
 
+static int allocate_boxes(struct intel_uncore_type **types,
+                         unsigned int pkg, unsigned int cpu)
+{
+        struct intel_uncore_box *box, *tmp;
+        struct intel_uncore_type *type;
+        struct intel_uncore_pmu *pmu;
+        LIST_HEAD(allocated);
+        int i;
+
+        /* Try to allocate all required boxes */
+        for (; *types; types++) {
+                type = *types;
+                pmu = type->pmus;
+                for (i = 0; i < type->num_boxes; i++, pmu++) {
+                        if (pmu->boxes[pkg])
+                                continue;
+                        box = uncore_alloc_box(type, cpu_to_node(cpu));
+                        if (!box)
+                                goto cleanup;
+                        box->pmu = pmu;
+                        box->pkgid = pkg;
+                        list_add(&box->active_list, &allocated);
+                }
+        }
+        /* Install them in the pmus */
+        list_for_each_entry_safe(box, tmp, &allocated, active_list) {
+                list_del_init(&box->active_list);
+                box->pmu->boxes[pkg] = box;
+        }
+        return 0;
+
+cleanup:
+        list_for_each_entry_safe(box, tmp, &allocated, active_list) {
+                list_del_init(&box->active_list);
+                kfree(box);
+        }
+        return -ENOMEM;
+}
+
 static int uncore_event_cpu_online(unsigned int cpu)
 {
-        int target;
+        struct intel_uncore_type *type, **types = uncore_msr_uncores;
+        struct intel_uncore_pmu *pmu;
+        struct intel_uncore_box *box;
+        int i, ret, pkg, target;
+
+        pkg = topology_logical_package_id(cpu);
+        ret = allocate_boxes(types, pkg, cpu);
+        if (ret)
+                return ret;
+
+        for (; *types; types++) {
+                type = *types;
+                pmu = type->pmus;
+                for (i = 0; i < type->num_boxes; i++, pmu++) {
+                        box = pmu->boxes[pkg];
+                        if (!box && atomic_inc_return(&box->refcnt) == 1)
+                                uncore_box_init(box);
+                }
+        }
 
         /*
          * Check if there is an online cpu in the package
@@ -1389,38 +1363,16 @@ static int __init intel_uncore_init(void)
         if (cret && pret)
                 return -ENODEV;
 
-        /*
-         * Install callbacks. Core will call them for each online cpu.
-         *
-         * The first online cpu of each package allocates and takes
-         * the refcounts for all other online cpus in that package.
-         * If msrs are not enabled no allocation is required and
-         * uncore_cpu_prepare() is not called for each online cpu.
-         */
-        if (!cret) {
-               ret = cpuhp_setup_state(CPUHP_PERF_X86_UNCORE_PREP,
-                                       "perf/x86/intel/uncore:prepare",
-                                       uncore_cpu_prepare, NULL);
-                if (ret)
-                        goto err;
-        } else {
-                cpuhp_setup_state_nocalls(CPUHP_PERF_X86_UNCORE_PREP,
-                                          "perf/x86/intel/uncore:prepare",
-                                          uncore_cpu_prepare, NULL);
-        }
-        first_init = 1;
-        cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_STARTING,
-                          "perf/x86/uncore:starting",
-                          uncore_cpu_starting, uncore_cpu_dying);
-        first_init = 0;
-        cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_ONLINE,
-                          "perf/x86/uncore:online",
-                          uncore_event_cpu_online, uncore_event_cpu_offline);
+        /* Install hotplug callbacks to setup the targets for each package */
+        ret = cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_ONLINE,
+                                "perf/x86/intel/uncore:online",
+                                uncore_event_cpu_online,
+                                uncore_event_cpu_offline);
+        if (ret)
+                goto err;
         return 0;
 
 err:
-        /* Undo box->init_box() */
-        on_each_cpu_mask(&uncore_cpu_mask, uncore_exit_boxes, NULL, 1);
         uncore_types_exit(uncore_msr_uncores);
         uncore_pci_exit();
         return ret;
@@ -1429,9 +1381,7 @@ module_init(intel_uncore_init);
 
 static void __exit intel_uncore_exit(void)
 {
-        cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_UNCORE_ONLINE);
-        cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_UNCORE_STARTING);
-        cpuhp_remove_state_nocalls(CPUHP_PERF_X86_UNCORE_PREP);
+        cpuhp_remove_state(CPUHP_AP_PERF_X86_UNCORE_ONLINE);
         uncore_types_exit(uncore_msr_uncores);
         uncore_pci_exit();
 }
diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
index 38711df3bcb5..2266f864b747 100644
--- a/arch/x86/include/asm/microcode.h
+++ b/arch/x86/include/asm/microcode.h
@@ -140,6 +140,7 @@ extern void __init load_ucode_bsp(void);
 extern void load_ucode_ap(void);
 void reload_early_microcode(void);
 extern bool get_builtin_firmware(struct cpio_data *cd, const char *name);
+extern bool initrd_gone;
 #else
 static inline int __init microcode_init(void)                   { return 0; };
 static inline void __init load_ucode_bsp(void)                  { }
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 1e35dd06b090..52f352b063fd 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -2117,6 +2117,7 @@ static inline void __init check_timer(void)
                         if (idx != -1 && irq_trigger(idx))
                                 unmask_ioapic_irq(irq_get_chip_data(0));
                 }
+                irq_domain_deactivate_irq(irq_data);
                 irq_domain_activate_irq(irq_data);
                 if (timer_irq_works()) {
                         if (disable_timer_pin_1 > 0)
@@ -2138,6 +2139,7 @@ static inline void __init check_timer(void)
                  * legacy devices should be connected to IO APIC #0
                  */
                 replace_pin_at_irq_node(data, node, apic1, pin1, apic2, pin2);
+                irq_domain_deactivate_irq(irq_data);
                 irq_domain_activate_irq(irq_data);
                 legacy_pic->unmask(0);
                 if (timer_irq_works()) {
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 00ef43233e03..537c6647d84c 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1373,20 +1373,15 @@ static unsigned long mce_adjust_timer_default(unsigned long interval)
 
 static unsigned long (*mce_adjust_timer)(unsigned long interval) = mce_adjust_timer_default;
 
-static void __restart_timer(struct timer_list *t, unsigned long interval)
+static void __start_timer(struct timer_list *t, unsigned long interval)
 {
         unsigned long when = jiffies + interval;
         unsigned long flags;
 
         local_irq_save(flags);
 
-        if (timer_pending(t)) {
-                if (time_before(when, t->expires))
-                        mod_timer(t, when);
-        } else {
-                t->expires = round_jiffies(when);
-                add_timer_on(t, smp_processor_id());
-        }
+        if (!timer_pending(t) || time_before(when, t->expires))
+                mod_timer(t, round_jiffies(when));
 
         local_irq_restore(flags);
 }
@@ -1421,7 +1416,7 @@ static void mce_timer_fn(unsigned long data)
 
 done:
         __this_cpu_write(mce_next_interval, iv);
-        __restart_timer(t, iv);
+        __start_timer(t, iv);
 }
 
 /*
@@ -1432,7 +1427,7 @@ void mce_timer_kick(unsigned long interval)
         struct timer_list *t = this_cpu_ptr(&mce_timer);
         unsigned long iv = __this_cpu_read(mce_next_interval);
 
-        __restart_timer(t, interval);
+        __start_timer(t, interval);
 
         if (interval < iv)
                 __this_cpu_write(mce_next_interval, interval);
@@ -1779,17 +1774,15 @@ static void __mcheck_cpu_clear_vendor(struct cpuinfo_x86 *c)
         }
 }
 
-static void mce_start_timer(unsigned int cpu, struct timer_list *t)
+static void mce_start_timer(struct timer_list *t)
 {
         unsigned long iv = check_interval * HZ;
 
         if (mca_cfg.ignore_ce || !iv)
                 return;
 
-        per_cpu(mce_next_interval, cpu) = iv;
-
-        t->expires = round_jiffies(jiffies + iv);
-        add_timer_on(t, cpu);
+        this_cpu_write(mce_next_interval, iv);
+        __start_timer(t, iv);
 }
 
 static void __mcheck_cpu_setup_timer(void)
@@ -1806,7 +1799,7 @@ static void __mcheck_cpu_init_timer(void)
         unsigned int cpu = smp_processor_id();
 
         setup_pinned_timer(t, mce_timer_fn, cpu);
-        mce_start_timer(cpu, t);
+        mce_start_timer(t);
 }
 
 /* Handle unconfigured int18 (should never happen) */
@@ -2566,7 +2559,7 @@ static int mce_cpu_dead(unsigned int cpu)
 
 static int mce_cpu_online(unsigned int cpu)
 {
-        struct timer_list *t = &per_cpu(mce_timer, cpu);
+        struct timer_list *t = this_cpu_ptr(&mce_timer);
         int ret;
 
         mce_device_create(cpu);
@@ -2577,13 +2570,13 @@ static int mce_cpu_online(unsigned int cpu)
                 return ret;
         }
         mce_reenable_cpu();
-        mce_start_timer(cpu, t);
+        mce_start_timer(t);
         return 0;
 }
 
 static int mce_cpu_pre_down(unsigned int cpu)
 {
-        struct timer_list *t = &per_cpu(mce_timer, cpu);
+        struct timer_list *t = this_cpu_ptr(&mce_timer);
 
         mce_disable_cpu();
         del_timer_sync(t);
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 6a31e2691f3a..079e81733a58 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -384,8 +384,9 @@ void load_ucode_amd_ap(unsigned int family)
 reget:
                 if (!get_builtin_microcode(&cp, family)) {
 #ifdef CONFIG_BLK_DEV_INITRD
-                        cp = find_cpio_data(ucode_path, (void *)initrd_start,
-                                            initrd_end - initrd_start, NULL);
+                        if (!initrd_gone)
+                                cp = find_cpio_data(ucode_path, (void *)initrd_start,
+                                                    initrd_end - initrd_start, NULL);
 #endif
                         if (!(cp.data && cp.size)) {
                                 /*
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 2af69d27da62..73102d932760 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -46,6 +46,8 @@
 static struct microcode_ops     *microcode_ops;
 static bool dis_ucode_ldr = true;
 
+bool initrd_gone;
+
 LIST_HEAD(microcode_cache);
 
 /*
@@ -190,21 +192,24 @@ void load_ucode_ap(void)
 static int __init save_microcode_in_initrd(void)
 {
         struct cpuinfo_x86 *c = &boot_cpu_data;
+        int ret = -EINVAL;
 
         switch (c->x86_vendor) {
         case X86_VENDOR_INTEL:
                 if (c->x86 >= 6)
-                        return save_microcode_in_initrd_intel();
+                        ret = save_microcode_in_initrd_intel();
                 break;
         case X86_VENDOR_AMD:
                 if (c->x86 >= 0x10)
-                        return save_microcode_in_initrd_amd(c->x86);
+                        ret = save_microcode_in_initrd_amd(c->x86);
                 break;
         default:
                 break;
         }
 
-        return -EINVAL;
+        initrd_gone = true;
+
+        return ret;
 }
 
 struct cpio_data find_microcode_in_initrd(const char *path, bool use_pa)
@@ -247,9 +252,16 @@ struct cpio_data find_microcode_in_initrd(const char *path, bool use_pa)
          * has the virtual address of the beginning of the initrd. It also
          * possibly relocates the ramdisk. In either case, initrd_start contains
          * the updated address so use that instead.
+         *
+         * initrd_gone is for the hotplug case where we've thrown out initrd
+         * already.
          */
-        if (!use_pa && initrd_start)
-                start = initrd_start;
+        if (!use_pa) {
+                if (initrd_gone)
+                        return (struct cpio_data){ NULL, 0, "" };
+                if (initrd_start)
+                        start = initrd_start;
+        }
 
         return find_cpio_data(path, (void *)start, size, NULL);
 #else /* !CONFIG_BLK_DEV_INITRD */
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 3f329b74e040..8325d8a09ab0 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -41,7 +41,7 @@
 
 static const char ucode_path[] = "kernel/x86/microcode/GenuineIntel.bin";
 
-/* Current microcode patch used in early patching */
+/* Current microcode patch used in early patching on the APs. */
 struct microcode_intel *intel_ucode_patch;
 
 static inline bool cpu_signatures_match(unsigned int s1, unsigned int p1,
@@ -607,12 +607,6 @@ int __init save_microcode_in_initrd_intel(void)
         struct ucode_cpu_info uci;
         struct cpio_data cp;
 
-        /*
-         * AP loading didn't find any microcode patch, no need to save anything.
-         */
-        if (!intel_ucode_patch || IS_ERR(intel_ucode_patch))
-                return 0;
-
         if (!load_builtin_intel_microcode(&cp))
                 cp = find_microcode_in_initrd(ucode_path, false);
 
@@ -628,7 +622,6 @@ int __init save_microcode_in_initrd_intel(void)
         return 0;
 }
 
-
 /*
  * @res_patch, output: a pointer to the patch we found.
  */
diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
index e4e97a5355ce..de7234401275 100644
--- a/arch/x86/kernel/fpu/core.c
+++ b/arch/x86/kernel/fpu/core.c
@@ -9,6 +9,7 @@
 #include <asm/fpu/regset.h>
 #include <asm/fpu/signal.h>
 #include <asm/fpu/types.h>
+#include <asm/fpu/xstate.h>
 #include <asm/traps.h>
 
 #include <linux/hardirq.h>
@@ -183,7 +184,8 @@ void fpstate_init(union fpregs_state *state)
          * it will #GP. Make sure it is replaced after the memset().
          */
         if (static_cpu_has(X86_FEATURE_XSAVES))
-                state->xsave.header.xcomp_bv = XCOMP_BV_COMPACTED_FORMAT;
+                state->xsave.header.xcomp_bv = XCOMP_BV_COMPACTED_FORMAT |
+                                               xfeatures_mask;
 
         if (static_cpu_has(X86_FEATURE_FXSR))
                 fpstate_init_fxstate(&state->fxsave);
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 85e87b46c318..dc6ba5bda9fc 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -352,6 +352,7 @@ static int hpet_resume(struct clock_event_device *evt, int timer)
         } else {
                 struct hpet_dev *hdev = EVT_TO_HPET_DEV(evt);
 
+                irq_domain_deactivate_irq(irq_get_irq_data(hdev->irq));
                 irq_domain_activate_irq(irq_get_irq_data(hdev->irq));
                 disable_irq(hdev->irq);
                 irq_set_affinity(hdev->irq, cpumask_of(hdev->cpu));
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index d153be8929a6..e52c9088660f 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3182,6 +3182,7 @@ static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
         memcpy(dest, xsave, XSAVE_HDR_OFFSET);
 
         /* Set XSTATE_BV */
+        xstate_bv &= vcpu->arch.guest_supported_xcr0 | XFEATURE_MASK_FPSSE;
         *(u64 *)(dest + XSAVE_HDR_OFFSET) = xstate_bv;
 
         /*
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 319148bd4b05..2f25a363068c 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -269,6 +269,22 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
         efi_scratch.use_pgd = true;
 
         /*
+         * Certain firmware versions are way too sentimential and still believe
+         * they are exclusive and unquestionable owners of the first physical page,
+         * even though they explicitly mark it as EFI_CONVENTIONAL_MEMORY
+         * (but then write-access it later during SetVirtualAddressMap()).
+         *
+         * Create a 1:1 mapping for this page, to avoid triple faults during early
+         * boot with such firmware. We are free to hand this page to the BIOS,
+         * as trim_bios_range() will reserve the first page and isolate it away
+         * from memory allocators anyway.
+         */
+        if (kernel_map_pages_in_pgd(pgd, 0x0, 0x0, 1, _PAGE_RW)) {
+                pr_err("Failed to create 1:1 mapping for the first page!\n");
+                return 1;
+        }
+
+        /*
          * When making calls to the firmware everything needs to be 1:1
          * mapped and addressable with 32-bit pointers. Map the kernel
          * text and allocate a new stack because we can't rely on the
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 848e8568fb3c..8fd4be610607 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -419,7 +419,7 @@ subsys_initcall(topology_init);
 
 void cpu_reset(void)
 {
-#if XCHAL_HAVE_PTP_MMU
+#if XCHAL_HAVE_PTP_MMU && IS_ENABLED(CONFIG_MMU)
         local_irq_disable();
         /*
          * We have full MMU: all autoload ways, ways 7, 8 and 9 of DTLB must
diff --git a/crypto/algapi.c b/crypto/algapi.c
index df939b54b09f..1fad2a6b3bbb 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -356,6 +356,7 @@ int crypto_register_alg(struct crypto_alg *alg)
         struct crypto_larval *larval;
         int err;
 
+        alg->cra_flags &= ~CRYPTO_ALG_DEAD;
         err = crypto_check_alg(alg);
         if (err)
                 return err;
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index f849311e9fd4..533265f110e0 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -661,9 +661,9 @@ static int aead_recvmsg_sync(struct socket *sock, struct msghdr *msg, int flags)
 unlock:
         list_for_each_entry_safe(rsgl, tmp, &ctx->list, list) {
                 af_alg_free_sg(&rsgl->sgl);
+                list_del(&rsgl->list);
                 if (rsgl != &ctx->first_rsgl)
                         sock_kfree_s(sk, rsgl, sizeof(*rsgl));
-                list_del(&rsgl->list);
         }
         INIT_LIST_HEAD(&ctx->list);
         aead_wmem_wakeup(sk);
diff --git a/drivers/acpi/acpica/tbdata.c b/drivers/acpi/acpica/tbdata.c
index 82b0b5710979..b0399e8f6d27 100644
--- a/drivers/acpi/acpica/tbdata.c
+++ b/drivers/acpi/acpica/tbdata.c
@@ -852,23 +852,18 @@ acpi_tb_install_and_load_table(acpi_physical_address address,
 
         ACPI_FUNCTION_TRACE(tb_install_and_load_table);
 
-        (void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
-
         /* Install the table and load it into the namespace */
 
         status = acpi_tb_install_standard_table(address, flags, TRUE,
                                                 override, &i);
         if (ACPI_FAILURE(status)) {
-                goto unlock_and_exit;
+                goto exit;
         }
 
-        (void)acpi_ut_release_mutex(ACPI_MTX_TABLES);
         status = acpi_tb_load_table(i, acpi_gbl_root_node);
-        (void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
 
-unlock_and_exit:
+exit:
         *table_index = i;
-        (void)acpi_ut_release_mutex(ACPI_MTX_TABLES);
         return_ACPI_STATUS(status);
 }
 
diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c
index 5fdf251a9f97..01e1b3d63fc0 100644
--- a/drivers/acpi/acpica/tbinstal.c
+++ b/drivers/acpi/acpica/tbinstal.c
@@ -217,6 +217,10 @@ acpi_tb_install_standard_table(acpi_physical_address address,
                 goto release_and_exit;
         }
 
+        /* Acquire the table lock */
+
+        (void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
+
         if (reload) {
                 /*
                  * Validate the incoming table signature.
@@ -244,7 +248,7 @@ acpi_tb_install_standard_table(acpi_physical_address address,
                                          new_table_desc.signature.integer));
 
                         status = AE_BAD_SIGNATURE;
-                        goto release_and_exit;
+                        goto unlock_and_exit;
                 }
 
                 /* Check if table is already registered */
@@ -279,7 +283,7 @@ acpi_tb_install_standard_table(acpi_physical_address address,
                                 /* Table is still loaded, this is an error */
 
                                 status = AE_ALREADY_EXISTS;
-                                goto release_and_exit;
+                                goto unlock_and_exit;
                         } else {
                                 /*
                                  * Table was unloaded, allow it to be reloaded.
@@ -290,6 +294,7 @@ acpi_tb_install_standard_table(acpi_physical_address address,
                                  * indicate the re-installation.
                                  */
                                 acpi_tb_uninstall_table(&new_table_desc);
+                                (void)acpi_ut_release_mutex(ACPI_MTX_TABLES);
                                 *table_index = i;
                                 return_ACPI_STATUS(AE_OK);
                         }
@@ -303,11 +308,19 @@ acpi_tb_install_standard_table(acpi_physical_address address,
 
         /* Invoke table handler if present */
 
+        (void)acpi_ut_release_mutex(ACPI_MTX_TABLES);
         if (acpi_gbl_table_handler) {
                 (void)acpi_gbl_table_handler(ACPI_TABLE_EVENT_INSTALL,
                                              new_table_desc.pointer,
                                              acpi_gbl_table_handler_context);
         }
+        (void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
+
+unlock_and_exit:
+
+        /* Release the table lock */
+
+        (void)acpi_ut_release_mutex(ACPI_MTX_TABLES);
 
 release_and_exit:
 
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 9b6cebe227a0..54abb26b7366 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -674,14 +674,6 @@ static void acpi_sleep_suspend_setup(void)
                 if (acpi_sleep_state_supported(i))
                         sleep_states[i] = 1;
 
-        /*
-         * Use suspend-to-idle by default if ACPI_FADT_LOW_POWER_S0 is set and
-         * the default suspend mode was not selected from the command line.
-         */
-        if (acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0 &&
-            mem_sleep_default > PM_SUSPEND_MEM)
-                mem_sleep_default = PM_SUSPEND_FREEZE;
-
         suspend_set_ops(old_suspend_ordering ?
                 &acpi_suspend_ops_old : &acpi_suspend_ops);
         freeze_set_ops(&acpi_freeze_ops);
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 02ded25c82e4..7f48156cbc0c 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -305,17 +305,6 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
                 DMI_MATCH(DMI_PRODUCT_NAME, "Dell System XPS L702X"),
                 },
         },
-        {
-        /* https://bugzilla.redhat.com/show_bug.cgi?id=1204476 */
-        /* https://bugs.launchpad.net/ubuntu/+source/linux-lts-trusty/+bug/1416940 */
-        .callback = video_detect_force_native,
-        .ident = "HP Pavilion dv6",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv6 Notebook PC"),
-                },
-        },
-
         { },
 };
 
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 9cd0a2d41816..c2d3785ec227 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1702,6 +1702,8 @@ unsigned ata_exec_internal_sg(struct ata_device *dev,
 
                 if (qc->err_mask & ~AC_ERR_OTHER)
                         qc->err_mask &= ~AC_ERR_OTHER;
+        } else if (qc->tf.command == ATA_CMD_REQ_SENSE_DATA) {
+                qc->result_tf.command |= ATA_SENSE;
         }
 
         /* finish up */
@@ -4356,10 +4358,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "ST380013AS",         "3.20",         ATA_HORKAGE_MAX_SEC_1024 },
 
         /*
-         * Device times out with higher max sects.
+         * These devices time out with higher max sects.
          * https://bugzilla.kernel.org/show_bug.cgi?id=121671
          */
-        { "LITEON CX1-JB256-HP", NULL,          ATA_HORKAGE_MAX_SEC_1024 },
+        { "LITEON CX1-JB*-HP",  NULL,           ATA_HORKAGE_MAX_SEC_1024 },
 
         /* Devices we expect to fail diagnostics */
 
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 823e938c9a78..2f32782cea6d 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -4132,6 +4132,9 @@ static int mv_platform_probe(struct platform_device *pdev)
         host->iomap = NULL;
         hpriv->base = devm_ioremap(&pdev->dev, res->start,
                                    resource_size(res));
+        if (!hpriv->base)
+                return -ENOMEM;
+
         hpriv->base -= SATAHC0_REG_BASE;
 
         hpriv->clk = clk_get(&pdev->dev, NULL);
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 4497d263209f..ac350c518e0c 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -558,9 +558,6 @@ static void fw_load_abort(struct firmware_priv *fw_priv)
         struct firmware_buf *buf = fw_priv->buf;
 
         __fw_load_abort(buf);
-
-        /* avoid user action after loading abort */
-        fw_priv->buf = NULL;
 }
 
 static LIST_HEAD(pending_fw_head);
@@ -713,7 +710,7 @@ static ssize_t firmware_loading_store(struct device *dev,
 
         mutex_lock(&fw_lock);
         fw_buf = fw_priv->buf;
-        if (!fw_buf)
+        if (fw_state_is_aborted(&fw_buf->fw_st))
                 goto out;
 
         switch (loading) {
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 8ab8ea1253e6..fa26ffd25fa6 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -389,33 +389,33 @@ static ssize_t show_valid_zones(struct device *dev,
 {
         struct memory_block *mem = to_memory_block(dev);
         unsigned long start_pfn, end_pfn;
+        unsigned long valid_start, valid_end, valid_pages;
         unsigned long nr_pages = PAGES_PER_SECTION * sections_per_block;
-        struct page *first_page;
         struct zone *zone;
         int zone_shift = 0;
 
         start_pfn = section_nr_to_pfn(mem->start_section_nr);
         end_pfn = start_pfn + nr_pages;
-        first_page = pfn_to_page(start_pfn);
 
         /* The block contains more than one zone can not be offlined. */
-        if (!test_pages_in_a_zone(start_pfn, end_pfn))
+        if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start, &valid_end))
                 return sprintf(buf, "none\n");
 
-        zone = page_zone(first_page);
+        zone = page_zone(pfn_to_page(valid_start));
+        valid_pages = valid_end - valid_start;
 
         /* MMOP_ONLINE_KEEP */
         sprintf(buf, "%s", zone->name);
 
         /* MMOP_ONLINE_KERNEL */
-        zone_shift = zone_can_shift(start_pfn, nr_pages, ZONE_NORMAL);
+        zone_can_shift(valid_start, valid_pages, ZONE_NORMAL, &zone_shift);
         if (zone_shift) {
                 strcat(buf, " ");
                 strcat(buf, (zone + zone_shift)->name);
         }
 
         /* MMOP_ONLINE_MOVABLE */
-        zone_shift = zone_can_shift(start_pfn, nr_pages, ZONE_MOVABLE);
+        zone_can_shift(valid_start, valid_pages, ZONE_MOVABLE, &zone_shift);
         if (zone_shift) {
                 strcat(buf, " ");
                 strcat(buf, (zone + zone_shift)->name);
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 872eac4cb1df..a14fac6a01d3 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -966,13 +966,13 @@ int __pm_runtime_idle(struct device *dev, int rpmflags)
         unsigned long flags;
         int retval;
 
-        might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
-
         if (rpmflags & RPM_GET_PUT) {
                 if (!atomic_dec_and_test(&dev->power.usage_count))
                         return 0;
         }
 
+        might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
+
         spin_lock_irqsave(&dev->power.lock, flags);
         retval = rpm_idle(dev, rpmflags);
         spin_unlock_irqrestore(&dev->power.lock, flags);
@@ -998,13 +998,13 @@ int __pm_runtime_suspend(struct device *dev, int rpmflags)
         unsigned long flags;
         int retval;
 
-        might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
-
         if (rpmflags & RPM_GET_PUT) {
                 if (!atomic_dec_and_test(&dev->power.usage_count))
                         return 0;
         }
 
+        might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
+
         spin_lock_irqsave(&dev->power.lock, flags);
         retval = rpm_suspend(dev, rpmflags);
         spin_unlock_irqrestore(&dev->power.lock, flags);
@@ -1029,7 +1029,8 @@ int __pm_runtime_resume(struct device *dev, int rpmflags)
         unsigned long flags;
         int retval;
 
-        might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
+        might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe &&
+                        dev->power.runtime_status != RPM_ACTIVE);
 
         if (rpmflags & RPM_GET_PUT)
                 atomic_inc(&dev->power.usage_count);
diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index f642c4264c27..168fa175d65a 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -45,6 +45,9 @@ int bcma_sprom_get(struct bcma_bus *bus);
 void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc);
 void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
 void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
+#ifdef CONFIG_BCMA_DRIVER_MIPS
+void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
+#endif /* CONFIG_BCMA_DRIVER_MIPS */
 
 /* driver_chipcommon_b.c */
 int bcma_core_chipcommon_b_init(struct bcma_drv_cc_b *ccb);
diff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c
index b4f6520e74f0..62f5bfa5065d 100644
--- a/drivers/bcma/driver_chipcommon.c
+++ b/drivers/bcma/driver_chipcommon.c
@@ -15,8 +15,6 @@
 #include <linux/platform_device.h>
 #include <linux/bcma/bcma.h>
 
-static void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
-
 static inline u32 bcma_cc_write32_masked(struct bcma_drv_cc *cc, u16 offset,
                                          u32 mask, u32 value)
 {
@@ -186,9 +184,6 @@ void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc)
         if (cc->capabilities & BCMA_CC_CAP_PMU)
                 bcma_pmu_early_init(cc);
 
-        if (IS_BUILTIN(CONFIG_BCM47XX) && bus->hosttype == BCMA_HOSTTYPE_SOC)
-                bcma_chipco_serial_init(cc);
-
         if (bus->hosttype == BCMA_HOSTTYPE_SOC)
                 bcma_core_chipcommon_flash_detect(cc);
 
@@ -378,9 +373,9 @@ u32 bcma_chipco_gpio_pulldown(struct bcma_drv_cc *cc, u32 mask, u32 value)
         return res;
 }
 
-static void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
+#ifdef CONFIG_BCMA_DRIVER_MIPS
+void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
 {
-#if IS_BUILTIN(CONFIG_BCM47XX)
         unsigned int irq;
         u32 baud_base;
         u32 i;
@@ -422,5 +417,5 @@ static void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
                 ports[i].baud_base = baud_base;
                 ports[i].reg_shift = 0;
         }
-#endif /* CONFIG_BCM47XX */
 }
+#endif /* CONFIG_BCMA_DRIVER_MIPS */
diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c
index 96f171328200..89af807cf29c 100644
--- a/drivers/bcma/driver_mips.c
+++ b/drivers/bcma/driver_mips.c
@@ -278,9 +278,12 @@ static void bcma_core_mips_nvram_init(struct bcma_drv_mips *mcore)
 
 void bcma_core_mips_early_init(struct bcma_drv_mips *mcore)
 {
+        struct bcma_bus *bus = mcore->core->bus;
+
         if (mcore->early_setup_done)
                 return;
 
+        bcma_chipco_serial_init(&bus->drv_cc);
         bcma_core_mips_nvram_init(mcore);
 
         mcore->early_setup_done = true;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index b2bdfa81f929..265f1a7072e9 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -197,13 +197,13 @@ struct blkfront_info
         /* Number of pages per ring buffer. */
         unsigned int nr_ring_pages;
         struct request_queue *rq;
-        unsigned int feature_flush;
-        unsigned int feature_fua;
+        unsigned int feature_flush:1;
+        unsigned int feature_fua:1;
         unsigned int feature_discard:1;
         unsigned int feature_secdiscard:1;
+        unsigned int feature_persistent:1;
         unsigned int discard_granularity;
         unsigned int discard_alignment;
-        unsigned int feature_persistent:1;
         /* Number of 4KB segments handled */
         unsigned int max_indirect_segments;
         int is_ready;
@@ -2223,7 +2223,7 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo)
         }
         else
                 grants = info->max_indirect_segments;
-        psegs = grants / GRANTS_PER_PSEG;
+        psegs = DIV_ROUND_UP(grants, GRANTS_PER_PSEG);
 
         err = fill_grant_buffer(rinfo,
                                 (grants + INDIRECT_GREFS(grants)) * BLK_RING_SIZE(info));
@@ -2323,13 +2323,16 @@ static void blkfront_gather_backend_features(struct blkfront_info *info)
                 blkfront_setup_discard(info);
 
         info->feature_persistent =
-                xenbus_read_unsigned(info->xbdev->otherend,
-                                     "feature-persistent", 0);
+                !!xenbus_read_unsigned(info->xbdev->otherend,
+                                       "feature-persistent", 0);
 
         indirect_segments = xenbus_read_unsigned(info->xbdev->otherend,
                                         "feature-max-indirect-segments", 0);
-        info->max_indirect_segments = min(indirect_segments,
-                                          xen_blkif_max_segments);
+        if (indirect_segments > xen_blkif_max_segments)
+                indirect_segments = xen_blkif_max_segments;
+        if (indirect_segments <= BLKIF_MAX_SEGMENTS_PER_REQUEST)
+                indirect_segments = 0;
+        info->max_indirect_segments = indirect_segments;
 }
 
 /*
@@ -2652,6 +2655,9 @@ static int __init xlblk_init(void)
         if (!xen_domain())
                 return -ENODEV;
 
+        if (xen_blkif_max_segments < BLKIF_MAX_SEGMENTS_PER_REQUEST)
+                xen_blkif_max_segments = BLKIF_MAX_SEGMENTS_PER_REQUEST;
+
         if (xen_blkif_max_ring_order > XENBUS_MAX_RING_GRANT_ORDER) {
                 pr_info("Invalid max_ring_order (%d), will use default max: %d.\n",
                         xen_blkif_max_ring_order, XENBUS_MAX_RING_GRANT_ORDER);
diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
index 4fda623e55bb..c94360671f41 100644
--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
+++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
@@ -784,8 +784,19 @@ static int brcm_avs_target_index(struct cpufreq_policy *policy,
 static int brcm_avs_suspend(struct cpufreq_policy *policy)
 {
         struct private_data *priv = policy->driver_data;
+        int ret;
+
+        ret = brcm_avs_get_pmap(priv, &priv->pmap);
+        if (ret)
+                return ret;
 
-        return brcm_avs_get_pmap(priv, &priv->pmap);
+        /*
+         * We can't use the P-state returned by brcm_avs_get_pmap(), since
+         * that's the initial P-state from when the P-map was downloaded to the
+         * AVS co-processor, not necessarily the P-state we are running at now.
+         * So, we get the current P-state explicitly.
+         */
+        return brcm_avs_get_pstate(priv, &priv->pmap.state);
 }
 
 static int brcm_avs_resume(struct cpufreq_policy *policy)
@@ -954,9 +965,9 @@ static ssize_t show_brcm_avs_pmap(struct cpufreq_policy *policy, char *buf)
         brcm_avs_parse_p1(pmap.p1, &mdiv_p0, &pdiv, &ndiv);
         brcm_avs_parse_p2(pmap.p2, &mdiv_p1, &mdiv_p2, &mdiv_p3, &mdiv_p4);
 
-        return sprintf(buf, "0x%08x 0x%08x %u %u %u %u %u %u %u\n",
+        return sprintf(buf, "0x%08x 0x%08x %u %u %u %u %u %u %u %u %u\n",
                 pmap.p1, pmap.p2, ndiv, pdiv, mdiv_p0, mdiv_p1, mdiv_p2,
-                mdiv_p3, mdiv_p4);
+                mdiv_p3, mdiv_p4, pmap.mode, pmap.state);
 }
 
 static ssize_t show_brcm_avs_voltage(struct cpufreq_policy *policy, char *buf)
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index f91c25718d16..50bd6d987fc3 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -1235,6 +1235,25 @@ static void intel_pstate_hwp_enable(struct cpudata *cpudata)
                 cpudata->epp_default = intel_pstate_get_epp(cpudata, 0);
 }
 
+#define MSR_IA32_POWER_CTL_BIT_EE       19
+
+/* Disable energy efficiency optimization */
+static void intel_pstate_disable_ee(int cpu)
+{
+        u64 power_ctl;
+        int ret;
+
+        ret = rdmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, &power_ctl);
+        if (ret)
+                return;
+
+        if (!(power_ctl & BIT(MSR_IA32_POWER_CTL_BIT_EE))) {
+                pr_info("Disabling energy efficiency optimization\n");
+                power_ctl |= BIT(MSR_IA32_POWER_CTL_BIT_EE);
+                wrmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, power_ctl);
+        }
+}
+
 static int atom_get_min_pstate(void)
 {
         u64 value;
@@ -1845,6 +1864,11 @@ static const struct x86_cpu_id intel_pstate_cpu_oob_ids[] __initconst = {
         {}
 };
 
+static const struct x86_cpu_id intel_pstate_cpu_ee_disable_ids[] = {
+        ICPU(INTEL_FAM6_KABYLAKE_DESKTOP, core_params),
+        {}
+};
+
 static int intel_pstate_init_cpu(unsigned int cpunum)
 {
         struct cpudata *cpu;
@@ -1875,6 +1899,12 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
         cpu->cpu = cpunum;
 
         if (hwp_active) {
+                const struct x86_cpu_id *id;
+
+                id = x86_match_cpu(intel_pstate_cpu_ee_disable_ids);
+                if (id)
+                        intel_pstate_disable_ee(cpunum);
+
                 intel_pstate_hwp_enable(cpu);
                 pid_params.sample_rate_ms = 50;
                 pid_params.sample_rate_ns = 50 * NSEC_PER_MSEC;
@@ -2005,7 +2035,8 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
                         limits = &performance_limits;
                         perf_limits = limits;
                 }
-                if (policy->max >= policy->cpuinfo.max_freq) {
+                if (policy->max >= policy->cpuinfo.max_freq &&
+                    !limits->no_turbo) {
                         pr_debug("set performance\n");
                         intel_pstate_set_performance_limits(perf_limits);
                         goto out;
@@ -2047,6 +2078,17 @@ static int intel_pstate_verify_policy(struct cpufreq_policy *policy)
             policy->policy != CPUFREQ_POLICY_PERFORMANCE)
                 return -EINVAL;
 
+        /* When per-CPU limits are used, sysfs limits are not used */
+        if (!per_cpu_limits) {
+                unsigned int max_freq, min_freq;
+
+                max_freq = policy->cpuinfo.max_freq *
+                                                limits->max_sysfs_pct / 100;
+                min_freq = policy->cpuinfo.max_freq *
+                                                limits->min_sysfs_pct / 100;
+                cpufreq_verify_within_limits(policy, min_freq, max_freq);
+        }
+
         return 0;
 }
 
diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
index e2ce8190ecc9..612898b4aaad 100644
--- a/drivers/crypto/ccp/ccp-dev-v5.c
+++ b/drivers/crypto/ccp/ccp-dev-v5.c
@@ -959,7 +959,7 @@ static irqreturn_t ccp5_irq_handler(int irq, void *data)
 static void ccp5_config(struct ccp_device *ccp)
 {
         /* Public side */
-        iowrite32(0x00001249, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);
+        iowrite32(0x0, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);
 }
 
 static void ccp5other_config(struct ccp_device *ccp)
diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
index 830f35e6005f..649e5610a5ce 100644
--- a/drivers/crypto/ccp/ccp-dev.h
+++ b/drivers/crypto/ccp/ccp-dev.h
@@ -238,6 +238,7 @@ struct ccp_dma_chan {
         struct ccp_device *ccp;
 
         spinlock_t lock;
+        struct list_head created;
         struct list_head pending;
         struct list_head active;
         struct list_head complete;
diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
index 6553912804f7..e5d9278f4019 100644
--- a/drivers/crypto/ccp/ccp-dmaengine.c
+++ b/drivers/crypto/ccp/ccp-dmaengine.c
@@ -63,6 +63,7 @@ static void ccp_free_chan_resources(struct dma_chan *dma_chan)
         ccp_free_desc_resources(chan->ccp, &chan->complete);
         ccp_free_desc_resources(chan->ccp, &chan->active);
         ccp_free_desc_resources(chan->ccp, &chan->pending);
+        ccp_free_desc_resources(chan->ccp, &chan->created);
 
         spin_unlock_irqrestore(&chan->lock, flags);
 }
@@ -273,6 +274,7 @@ static dma_cookie_t ccp_tx_submit(struct dma_async_tx_descriptor *tx_desc)
         spin_lock_irqsave(&chan->lock, flags);
 
         cookie = dma_cookie_assign(tx_desc);
+        list_del(&desc->entry);
         list_add_tail(&desc->entry, &chan->pending);
 
         spin_unlock_irqrestore(&chan->lock, flags);
@@ -426,7 +428,7 @@ static struct ccp_dma_desc *ccp_create_desc(struct dma_chan *dma_chan,
 
         spin_lock_irqsave(&chan->lock, sflags);
 
-        list_add_tail(&desc->entry, &chan->pending);
+        list_add_tail(&desc->entry, &chan->created);
 
         spin_unlock_irqrestore(&chan->lock, sflags);
 
@@ -610,6 +612,7 @@ static int ccp_terminate_all(struct dma_chan *dma_chan)
         /*TODO: Purge the complete list? */
         ccp_free_desc_resources(chan->ccp, &chan->active);
         ccp_free_desc_resources(chan->ccp, &chan->pending);
+        ccp_free_desc_resources(chan->ccp, &chan->created);
 
         spin_unlock_irqrestore(&chan->lock, flags);
 
@@ -679,6 +682,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
                 chan->ccp = ccp;
 
                 spin_lock_init(&chan->lock);
+                INIT_LIST_HEAD(&chan->created);
                 INIT_LIST_HEAD(&chan->pending);
                 INIT_LIST_HEAD(&chan->active);
                 INIT_LIST_HEAD(&chan->complete);
diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c
index 2ed1e24b44a8..b4b78b37f8a6 100644
--- a/drivers/crypto/chelsio/chcr_algo.c
+++ b/drivers/crypto/chelsio/chcr_algo.c
@@ -158,7 +158,7 @@ int chcr_handle_resp(struct crypto_async_request *req, unsigned char *input,
         case CRYPTO_ALG_TYPE_AEAD:
                 ctx_req.req.aead_req = (struct aead_request *)req;
                 ctx_req.ctx.reqctx = aead_request_ctx(ctx_req.req.aead_req);
-                dma_unmap_sg(&u_ctx->lldi.pdev->dev, ctx_req.req.aead_req->dst,
+                dma_unmap_sg(&u_ctx->lldi.pdev->dev, ctx_req.ctx.reqctx->dst,
                              ctx_req.ctx.reqctx->dst_nents, DMA_FROM_DEVICE);
                 if (ctx_req.ctx.reqctx->skb) {
                         kfree_skb(ctx_req.ctx.reqctx->skb);
@@ -1362,8 +1362,7 @@ static struct sk_buff *create_authenc_wr(struct aead_request *req,
         struct chcr_wr *chcr_req;
         struct cpl_rx_phys_dsgl *phys_cpl;
         struct phys_sge_parm sg_param;
-        struct scatterlist *src, *dst;
-        struct scatterlist src_sg[2], dst_sg[2];
+        struct scatterlist *src;
         unsigned int frags = 0, transhdr_len;
         unsigned int ivsize = crypto_aead_ivsize(tfm), dst_size = 0;
         unsigned int   kctx_len = 0;
@@ -1383,19 +1382,21 @@ static struct sk_buff *create_authenc_wr(struct aead_request *req,
 
         if (sg_nents_for_len(req->src, req->assoclen + req->cryptlen) < 0)
                 goto err;
-        src = scatterwalk_ffwd(src_sg, req->src, req->assoclen);
-        dst = src;
+        src = scatterwalk_ffwd(reqctx->srcffwd, req->src, req->assoclen);
+        reqctx->dst = src;
+
         if (req->src != req->dst) {
                 err = chcr_copy_assoc(req, aeadctx);
                 if (err)
                         return ERR_PTR(err);
-                dst = scatterwalk_ffwd(dst_sg, req->dst, req->assoclen);
+                reqctx->dst = scatterwalk_ffwd(reqctx->dstffwd, req->dst,
+                                               req->assoclen);
         }
         if (get_aead_subtype(tfm) == CRYPTO_ALG_SUB_TYPE_AEAD_NULL) {
                 null = 1;
                 assoclen = 0;
         }
-        reqctx->dst_nents = sg_nents_for_len(dst, req->cryptlen +
+        reqctx->dst_nents = sg_nents_for_len(reqctx->dst, req->cryptlen +
                                              (op_type ? -authsize : authsize));
         if (reqctx->dst_nents <= 0) {
                 pr_err("AUTHENC:Invalid Destination sg entries\n");
@@ -1460,7 +1461,7 @@ static struct sk_buff *create_authenc_wr(struct aead_request *req,
         sg_param.obsize = req->cryptlen + (op_type ? -authsize : authsize);
         sg_param.qid = qid;
         sg_param.align = 0;
-        if (map_writesg_phys_cpl(&u_ctx->lldi.pdev->dev, phys_cpl, dst,
+        if (map_writesg_phys_cpl(&u_ctx->lldi.pdev->dev, phys_cpl, reqctx->dst,
                                   &sg_param))
                 goto dstmap_fail;
 
@@ -1711,8 +1712,7 @@ static struct sk_buff *create_aead_ccm_wr(struct aead_request *req,
         struct chcr_wr *chcr_req;
         struct cpl_rx_phys_dsgl *phys_cpl;
         struct phys_sge_parm sg_param;
-        struct scatterlist *src, *dst;
-        struct scatterlist src_sg[2], dst_sg[2];
+        struct scatterlist *src;
         unsigned int frags = 0, transhdr_len, ivsize = AES_BLOCK_SIZE;
         unsigned int dst_size = 0, kctx_len;
         unsigned int sub_type;
@@ -1728,17 +1728,19 @@ static struct sk_buff *create_aead_ccm_wr(struct aead_request *req,
         if (sg_nents_for_len(req->src, req->assoclen + req->cryptlen) < 0)
                 goto err;
         sub_type = get_aead_subtype(tfm);
-        src = scatterwalk_ffwd(src_sg, req->src, req->assoclen);
-        dst = src;
+        src = scatterwalk_ffwd(reqctx->srcffwd, req->src, req->assoclen);
+        reqctx->dst = src;
+
         if (req->src != req->dst) {
                 err = chcr_copy_assoc(req, aeadctx);
                 if (err) {
                         pr_err("AAD copy to destination buffer fails\n");
                         return ERR_PTR(err);
                 }
-                dst = scatterwalk_ffwd(dst_sg, req->dst, req->assoclen);
+                reqctx->dst = scatterwalk_ffwd(reqctx->dstffwd, req->dst,
+                                               req->assoclen);
         }
-        reqctx->dst_nents = sg_nents_for_len(dst, req->cryptlen +
+        reqctx->dst_nents = sg_nents_for_len(reqctx->dst, req->cryptlen +
                                              (op_type ? -authsize : authsize));
         if (reqctx->dst_nents <= 0) {
                 pr_err("CCM:Invalid Destination sg entries\n");
@@ -1777,7 +1779,7 @@ static struct sk_buff *create_aead_ccm_wr(struct aead_request *req,
         sg_param.obsize = req->cryptlen + (op_type ? -authsize : authsize);
         sg_param.qid = qid;
         sg_param.align = 0;
-        if (map_writesg_phys_cpl(&u_ctx->lldi.pdev->dev, phys_cpl, dst,
+        if (map_writesg_phys_cpl(&u_ctx->lldi.pdev->dev, phys_cpl, reqctx->dst,
                                   &sg_param))
                 goto dstmap_fail;
 
@@ -1809,8 +1811,7 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req,
         struct chcr_wr *chcr_req;
         struct cpl_rx_phys_dsgl *phys_cpl;
         struct phys_sge_parm sg_param;
-        struct scatterlist *src, *dst;
-        struct scatterlist src_sg[2], dst_sg[2];
+        struct scatterlist *src;
         unsigned int frags = 0, transhdr_len;
         unsigned int ivsize = AES_BLOCK_SIZE;
         unsigned int dst_size = 0, kctx_len;
@@ -1832,13 +1833,14 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req,
         if (sg_nents_for_len(req->src, req->assoclen + req->cryptlen) < 0)
                 goto err;
 
-        src = scatterwalk_ffwd(src_sg, req->src, req->assoclen);
-        dst = src;
+        src = scatterwalk_ffwd(reqctx->srcffwd, req->src, req->assoclen);
+        reqctx->dst = src;
         if (req->src != req->dst) {
                 err = chcr_copy_assoc(req, aeadctx);
                 if (err)
                         return  ERR_PTR(err);
-                dst = scatterwalk_ffwd(dst_sg, req->dst, req->assoclen);
+                reqctx->dst = scatterwalk_ffwd(reqctx->dstffwd, req->dst,
+                                               req->assoclen);
         }
 
         if (!req->cryptlen)
@@ -1848,7 +1850,7 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req,
                 crypt_len = AES_BLOCK_SIZE;
         else
                 crypt_len = req->cryptlen;
-        reqctx->dst_nents = sg_nents_for_len(dst, req->cryptlen +
+        reqctx->dst_nents = sg_nents_for_len(reqctx->dst, req->cryptlen +
                                              (op_type ? -authsize : authsize));
         if (reqctx->dst_nents <= 0) {
                 pr_err("GCM:Invalid Destination sg entries\n");
@@ -1923,7 +1925,7 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req,
         sg_param.obsize = req->cryptlen + (op_type ? -authsize : authsize);
         sg_param.qid = qid;
         sg_param.align = 0;
-        if (map_writesg_phys_cpl(&u_ctx->lldi.pdev->dev, phys_cpl, dst,
+        if (map_writesg_phys_cpl(&u_ctx->lldi.pdev->dev, phys_cpl, reqctx->dst,
                                   &sg_param))
                 goto dstmap_fail;
 
@@ -1937,7 +1939,8 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req,
                 write_sg_to_skb(skb, &frags, src, req->cryptlen);
         } else {
                 aes_gcm_empty_pld_pad(req->dst, authsize - 1);
-                write_sg_to_skb(skb, &frags, dst, crypt_len);
+                write_sg_to_skb(skb, &frags, reqctx->dst, crypt_len);
+
         }
 
         create_wreq(ctx, chcr_req, req, skb, kctx_len, size, 1,
@@ -2189,8 +2192,8 @@ static int chcr_gcm_setkey(struct crypto_aead *aead, const u8 *key,
         unsigned int ck_size;
         int ret = 0, key_ctx_size = 0;
 
-        if (get_aead_subtype(aead) ==
-            CRYPTO_ALG_SUB_TYPE_AEAD_RFC4106) {
+        if (get_aead_subtype(aead) == CRYPTO_ALG_SUB_TYPE_AEAD_RFC4106 &&
+            keylen > 3) {
                 keylen -= 4;  /* nonce/salt is present in the last 4 bytes */
                 memcpy(aeadctx->salt, key + keylen, 4);
         }
diff --git a/drivers/crypto/chelsio/chcr_core.c b/drivers/crypto/chelsio/chcr_core.c
index 918da8e6e2d8..1c65f07e1cc9 100644
--- a/drivers/crypto/chelsio/chcr_core.c
+++ b/drivers/crypto/chelsio/chcr_core.c
@@ -52,6 +52,7 @@ static struct cxgb4_uld_info chcr_uld_info = {
 int assign_chcr_device(struct chcr_dev **dev)
 {
         struct uld_ctx *u_ctx;
+        int ret = -ENXIO;
 
         /*
          * Which device to use if multiple devices are available TODO
@@ -59,15 +60,14 @@ int assign_chcr_device(struct chcr_dev **dev)
          * must go to the same device to maintain the ordering.
          */
         mutex_lock(&dev_mutex); /* TODO ? */
-        u_ctx = list_first_entry(&uld_ctx_list, struct uld_ctx, entry);
-        if (!u_ctx) {
-                mutex_unlock(&dev_mutex);
-                return -ENXIO;
+        list_for_each_entry(u_ctx, &uld_ctx_list, entry)
+                if (u_ctx && u_ctx->dev) {
+                        *dev = u_ctx->dev;
+                        ret = 0;
+                        break;
         }
-
-        *dev = u_ctx->dev;
         mutex_unlock(&dev_mutex);
-        return 0;
+        return ret;
 }
 
 static int chcr_dev_add(struct uld_ctx *u_ctx)
@@ -202,10 +202,8 @@ static int chcr_uld_state_change(void *handle, enum cxgb4_state state)
 
 static int __init chcr_crypto_init(void)
 {
-        if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info)) {
+        if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info))
                 pr_err("ULD register fail: No chcr crypto support in cxgb4");
-                return -1;
-        }
 
         return 0;
 }
diff --git a/drivers/crypto/chelsio/chcr_crypto.h b/drivers/crypto/chelsio/chcr_crypto.h
index d5af7d64a763..7ec0a8f12475 100644
--- a/drivers/crypto/chelsio/chcr_crypto.h
+++ b/drivers/crypto/chelsio/chcr_crypto.h
@@ -158,6 +158,9 @@ struct ablk_ctx {
 };
 struct chcr_aead_reqctx {
         struct  sk_buff *skb;
+        struct scatterlist *dst;
+        struct scatterlist srcffwd[2];
+        struct scatterlist dstffwd[2];
         short int dst_nents;
         u16 verify;
         u8 iv[CHCR_MAX_CRYPTO_IV_LEN];
diff --git a/drivers/crypto/qat/qat_c62x/adf_drv.c b/drivers/crypto/qat/qat_c62x/adf_drv.c
index bc5cbc193aae..5b2d78a5b5aa 100644
--- a/drivers/crypto/qat/qat_c62x/adf_drv.c
+++ b/drivers/crypto/qat/qat_c62x/adf_drv.c
@@ -233,7 +233,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                               &hw_data->accel_capabilities_mask);
 
         /* Find and map all the device's BARS */
-        i = 0;
+        i = (hw_data->fuses & ADF_DEVICE_FUSECTL_MASK) ? 1 : 0;
         bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
         for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
                          ADF_PCI_MAX_BARS * 2) {
diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
index e8822536530b..33f0a6251e38 100644
--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
+++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
@@ -69,6 +69,7 @@
 #define ADF_ERRSOU5 (0x3A000 + 0xD8)
 #define ADF_DEVICE_FUSECTL_OFFSET 0x40
 #define ADF_DEVICE_LEGFUSE_OFFSET 0x4C
+#define ADF_DEVICE_FUSECTL_MASK 0x80000000
 #define ADF_PCI_MAX_BARS 3
 #define ADF_DEVICE_NAME_LENGTH 32
 #define ADF_ETR_MAX_RINGS_PER_BANK 16
diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
index 1e480f140663..8c4fd255a601 100644
--- a/drivers/crypto/qat/qat_common/qat_hal.c
+++ b/drivers/crypto/qat/qat_common/qat_hal.c
@@ -456,7 +456,7 @@ static int qat_hal_init_esram(struct icp_qat_fw_loader_handle *handle)
         unsigned int csr_val;
         int times = 30;
 
-        if (handle->pci_dev->device == ADF_C3XXX_PCI_DEVICE_ID)
+        if (handle->pci_dev->device != ADF_DH895XCC_PCI_DEVICE_ID)
                 return 0;
 
         csr_val = ADF_CSR_RD(csr_addr, 0);
@@ -716,7 +716,7 @@ int qat_hal_init(struct adf_accel_dev *accel_dev)
                 (void __iomem *)((uintptr_t)handle->hal_cap_ae_xfer_csr_addr_v +
                                  LOCAL_TO_XFER_REG_OFFSET);
         handle->pci_dev = pci_info->pci_dev;
-        if (handle->pci_dev->device != ADF_C3XXX_PCI_DEVICE_ID) {
+        if (handle->pci_dev->device == ADF_DH895XCC_PCI_DEVICE_ID) {
                 sram_bar =
                         &pci_info->pci_bars[hw_data->get_sram_bar_id(hw_data)];
                 handle->hal_sram_addr_v = sram_bar->virt_addr;
diff --git a/drivers/dma/cppi41.c b/drivers/dma/cppi41.c
index d5ba43a87a68..200828c60db9 100644
--- a/drivers/dma/cppi41.c
+++ b/drivers/dma/cppi41.c
@@ -153,6 +153,8 @@ struct cppi41_dd {
 
         /* context for suspend/resume */
         unsigned int dma_tdfdq;
+
+        bool is_suspended;
 };
 
 #define FIST_COMPLETION_QUEUE   93
@@ -257,6 +259,10 @@ static struct cppi41_channel *desc_to_chan(struct cppi41_dd *cdd, u32 desc)
         BUG_ON(desc_num >= ALLOC_DECS_NUM);
         c = cdd->chan_busy[desc_num];
         cdd->chan_busy[desc_num] = NULL;
+
+        /* Usecount for chan_busy[], paired with push_desc_queue() */
+        pm_runtime_put(cdd->ddev.dev);
+
         return c;
 }
 
@@ -317,12 +323,12 @@ static irqreturn_t cppi41_irq(int irq, void *data)
 
                 while (val) {
                         u32 desc, len;
-                        int error;
 
-                        error = pm_runtime_get(cdd->ddev.dev);
-                        if (error < 0)
-                                dev_err(cdd->ddev.dev, "%s pm runtime get: %i\n",
-                                        __func__, error);
+                        /*
+                         * This should never trigger, see the comments in
+                         * push_desc_queue()
+                         */
+                        WARN_ON(cdd->is_suspended);
 
                         q_num = __fls(val);
                         val &= ~(1 << q_num);
@@ -343,9 +349,6 @@ static irqreturn_t cppi41_irq(int irq, void *data)
                         c->residue = pd_trans_len(c->desc->pd6) - len;
                         dma_cookie_complete(&c->txd);
                         dmaengine_desc_get_callback_invoke(&c->txd, NULL);
-
-                        pm_runtime_mark_last_busy(cdd->ddev.dev);
-                        pm_runtime_put_autosuspend(cdd->ddev.dev);
                 }
         }
         return IRQ_HANDLED;
@@ -447,6 +450,15 @@ static void push_desc_queue(struct cppi41_channel *c)
          */
         __iowmb();
 
+        /*
+         * DMA transfers can take at least 200ms to complete with USB mass
+         * storage connected. To prevent autosuspend timeouts, we must use
+         * pm_runtime_get/put() when chan_busy[] is modified. This will get
+         * cleared in desc_to_chan() or cppi41_stop_chan() depending on the
+         * outcome of the transfer.
+         */
+        pm_runtime_get(cdd->ddev.dev);
+
         desc_phys = lower_32_bits(c->desc_phys);
         desc_num = (desc_phys - cdd->descs_phys) / sizeof(struct cppi41_desc);
         WARN_ON(cdd->chan_busy[desc_num]);
@@ -457,20 +469,26 @@ static void push_desc_queue(struct cppi41_channel *c)
         cppi_writel(reg, cdd->qmgr_mem + QMGR_QUEUE_D(c->q_num));
 }
 
-static void pending_desc(struct cppi41_channel *c)
+/*
+ * Caller must hold cdd->lock to prevent push_desc_queue()
+ * getting called out of order. We have both cppi41_dma_issue_pending()
+ * and cppi41_runtime_resume() call this function.
+ */
+static void cppi41_run_queue(struct cppi41_dd *cdd)
 {
-        struct cppi41_dd *cdd = c->cdd;
-        unsigned long flags;
+        struct cppi41_channel *c, *_c;
 
-        spin_lock_irqsave(&cdd->lock, flags);
-        list_add_tail(&c->node, &cdd->pending);
-        spin_unlock_irqrestore(&cdd->lock, flags);
+        list_for_each_entry_safe(c, _c, &cdd->pending, node) {
+                push_desc_queue(c);
+                list_del(&c->node);
+        }
 }
 
 static void cppi41_dma_issue_pending(struct dma_chan *chan)
 {
         struct cppi41_channel *c = to_cpp41_chan(chan);
         struct cppi41_dd *cdd = c->cdd;
+        unsigned long flags;
         int error;
 
         error = pm_runtime_get(cdd->ddev.dev);
@@ -482,10 +500,11 @@ static void cppi41_dma_issue_pending(struct dma_chan *chan)
                 return;
         }
 
-        if (likely(pm_runtime_active(cdd->ddev.dev)))
-                push_desc_queue(c);
-        else
-                pending_desc(c);
+        spin_lock_irqsave(&cdd->lock, flags);
+        list_add_tail(&c->node, &cdd->pending);
+        if (!cdd->is_suspended)
+                cppi41_run_queue(cdd);
+        spin_unlock_irqrestore(&cdd->lock, flags);
 
         pm_runtime_mark_last_busy(cdd->ddev.dev);
         pm_runtime_put_autosuspend(cdd->ddev.dev);
@@ -705,6 +724,9 @@ static int cppi41_stop_chan(struct dma_chan *chan)
         WARN_ON(!cdd->chan_busy[desc_num]);
         cdd->chan_busy[desc_num] = NULL;
 
+        /* Usecount for chan_busy[], paired with push_desc_queue() */
+        pm_runtime_put(cdd->ddev.dev);
+
         return 0;
 }
 
@@ -1150,8 +1172,12 @@ static int __maybe_unused cppi41_resume(struct device *dev)
 static int __maybe_unused cppi41_runtime_suspend(struct device *dev)
 {
         struct cppi41_dd *cdd = dev_get_drvdata(dev);
+        unsigned long flags;
 
+        spin_lock_irqsave(&cdd->lock, flags);
+        cdd->is_suspended = true;
         WARN_ON(!list_empty(&cdd->pending));
+        spin_unlock_irqrestore(&cdd->lock, flags);
 
         return 0;
 }
@@ -1159,14 +1185,11 @@ static int __maybe_unused cppi41_runtime_suspend(struct device *dev)
 static int __maybe_unused cppi41_runtime_resume(struct device *dev)
 {
         struct cppi41_dd *cdd = dev_get_drvdata(dev);
-        struct cppi41_channel *c, *_c;
         unsigned long flags;
 
         spin_lock_irqsave(&cdd->lock, flags);
-        list_for_each_entry_safe(c, _c, &cdd->pending, node) {
-                push_desc_queue(c);
-                list_del(&c->node);
-        }
+        cdd->is_suspended = false;
+        cppi41_run_queue(cdd);
         spin_unlock_irqrestore(&cdd->lock, flags);
 
         return 0;
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 740bbb942594..7539f73df9e0 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -1699,7 +1699,6 @@ static bool _chan_ns(const struct pl330_dmac *pl330, int i)
 static struct pl330_thread *pl330_request_channel(struct pl330_dmac *pl330)
 {
         struct pl330_thread *thrd = NULL;
-        unsigned long flags;
         int chans, i;
 
         if (pl330->state == DYING)
@@ -1707,8 +1706,6 @@ static struct pl330_thread *pl330_request_channel(struct pl330_dmac *pl330)
 
         chans = pl330->pcfg.num_chan;
 
-        spin_lock_irqsave(&pl330->lock, flags);
-
         for (i = 0; i < chans; i++) {
                 thrd = &pl330->channels[i];
                 if ((thrd->free) && (!_manager_ns(thrd) ||
@@ -1726,8 +1723,6 @@ static struct pl330_thread *pl330_request_channel(struct pl330_dmac *pl330)
                 thrd = NULL;
         }
 
-        spin_unlock_irqrestore(&pl330->lock, flags);
-
         return thrd;
 }
 
@@ -1745,7 +1740,6 @@ static inline void _free_event(struct pl330_thread *thrd, int ev)
 static void pl330_release_channel(struct pl330_thread *thrd)
 {
         struct pl330_dmac *pl330;
-        unsigned long flags;
 
         if (!thrd || thrd->free)
                 return;
@@ -1757,10 +1751,8 @@ static void pl330_release_channel(struct pl330_thread *thrd)
 
         pl330 = thrd->dmac;
 
-        spin_lock_irqsave(&pl330->lock, flags);
         _free_event(thrd, thrd->ev);
         thrd->free = true;
-        spin_unlock_irqrestore(&pl330->lock, flags);
 }
 
 /* Initialize the structure for PL330 configuration, that can be used
@@ -2122,20 +2114,20 @@ static int pl330_alloc_chan_resources(struct dma_chan *chan)
         struct pl330_dmac *pl330 = pch->dmac;
         unsigned long flags;
 
-        spin_lock_irqsave(&pch->lock, flags);
+        spin_lock_irqsave(&pl330->lock, flags);
 
         dma_cookie_init(chan);
         pch->cyclic = false;
 
         pch->thread = pl330_request_channel(pl330);
         if (!pch->thread) {
-                spin_unlock_irqrestore(&pch->lock, flags);
+                spin_unlock_irqrestore(&pl330->lock, flags);
                 return -ENOMEM;
         }
 
         tasklet_init(&pch->task, pl330_tasklet, (unsigned long) pch);
 
-        spin_unlock_irqrestore(&pch->lock, flags);
+        spin_unlock_irqrestore(&pl330->lock, flags);
 
         return 1;
 }
@@ -2238,12 +2230,13 @@ static int pl330_pause(struct dma_chan *chan)
 static void pl330_free_chan_resources(struct dma_chan *chan)
 {
         struct dma_pl330_chan *pch = to_pchan(chan);
+        struct pl330_dmac *pl330 = pch->dmac;
         unsigned long flags;
 
         tasklet_kill(&pch->task);
 
         pm_runtime_get_sync(pch->dmac->ddma.dev);
-        spin_lock_irqsave(&pch->lock, flags);
+        spin_lock_irqsave(&pl330->lock, flags);
 
         pl330_release_channel(pch->thread);
         pch->thread = NULL;
@@ -2251,7 +2244,7 @@ static void pl330_free_chan_resources(struct dma_chan *chan)
         if (pch->cyclic)
                 list_splice_tail_init(&pch->work_list, &pch->dmac->desc_pool);
 
-        spin_unlock_irqrestore(&pch->lock, flags);
+        spin_unlock_irqrestore(&pl330->lock, flags);
         pm_runtime_mark_last_busy(pch->dmac->ddma.dev);
         pm_runtime_put_autosuspend(pch->dmac->ddma.dev);
 }
diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
index 921dfa047202..260c4b4b492e 100644
--- a/drivers/firmware/efi/libstub/fdt.c
+++ b/drivers/firmware/efi/libstub/fdt.c
@@ -187,6 +187,7 @@ static efi_status_t update_fdt_memmap(void *fdt, struct efi_boot_memmap *map)
 struct exit_boot_struct {
         efi_memory_desc_t *runtime_map;
         int *runtime_entry_count;
+        void *new_fdt_addr;
 };
 
 static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
@@ -202,7 +203,7 @@ static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
         efi_get_virtmap(*map->map, *map->map_size, *map->desc_size,
                         p->runtime_map, p->runtime_entry_count);
 
-        return EFI_SUCCESS;
+        return update_fdt_memmap(p->new_fdt_addr, map);
 }
 
 /*
@@ -300,22 +301,13 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
 
         priv.runtime_map = runtime_map;
         priv.runtime_entry_count = &runtime_entry_count;
+        priv.new_fdt_addr = (void *)*new_fdt_addr;
         status = efi_exit_boot_services(sys_table, handle, &map, &priv,
                                         exit_boot_func);
 
         if (status == EFI_SUCCESS) {
                 efi_set_virtual_address_map_t *svam;
 
-                status = update_fdt_memmap((void *)*new_fdt_addr, &map);
-                if (status != EFI_SUCCESS) {
-                        /*
-                         * The kernel won't get far without the memory map, but
-                         * may still be able to print something meaningful so
-                         * return success here.
-                         */
-                        return EFI_SUCCESS;
-                }
-
                 /* Install the new virtual address map */
                 svam = sys_table->runtime->set_virtual_address_map;
                 status = svam(runtime_entry_count * desc_size, desc_size,
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 86bf3b84ada5..a07ae9e37930 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1723,7 +1723,7 @@ static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip)
 }
 
 /**
- * _gpiochip_irqchip_add() - adds an irqchip to a gpiochip
+ * gpiochip_irqchip_add_key() - adds an irqchip to a gpiochip
  * @gpiochip: the gpiochip to add the irqchip to
  * @irqchip: the irqchip to add to the gpiochip
  * @first_irq: if not dynamically assigned, the base (first) IRQ to
@@ -1749,13 +1749,13 @@ static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip)
  * the pins on the gpiochip can generate a unique IRQ. Everything else
  * need to be open coded.
  */
-int _gpiochip_irqchip_add(struct gpio_chip *gpiochip,
-                          struct irq_chip *irqchip,
-                          unsigned int first_irq,
-                          irq_flow_handler_t handler,
-                          unsigned int type,
-                          bool nested,
-                          struct lock_class_key *lock_key)
+int gpiochip_irqchip_add_key(struct gpio_chip *gpiochip,
+                             struct irq_chip *irqchip,
+                             unsigned int first_irq,
+                             irq_flow_handler_t handler,
+                             unsigned int type,
+                             bool nested,
+                             struct lock_class_key *lock_key)
 {
         struct device_node *of_node;
         bool irq_base_set = false;
@@ -1840,7 +1840,7 @@ int _gpiochip_irqchip_add(struct gpio_chip *gpiochip,
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(_gpiochip_irqchip_add);
+EXPORT_SYMBOL_GPL(gpiochip_irqchip_add_key);
 
 #else /* CONFIG_GPIOLIB_IRQCHIP */
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 29d6d84d1c28..41e41f90265d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -83,6 +83,13 @@ int amdgpu_cs_get_ring(struct amdgpu_device *adev, u32 ip_type,
                 }
                 break;
         }
+
+        if (!(*out_ring && (*out_ring)->adev)) {
+                DRM_ERROR("Ring %d is not initialized on IP %d\n",
+                          ring, ip_type);
+                return -EINVAL;
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
index 9999dc71b998..ccb5e02e7b20 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -2512,6 +2512,8 @@ static int dce_v10_0_cursor_move_locked(struct drm_crtc *crtc,
 
         WREG32(mmCUR_POSITION + amdgpu_crtc->crtc_offset, (x << 16) | y);
         WREG32(mmCUR_HOT_SPOT + amdgpu_crtc->crtc_offset, (xorigin << 16) | yorigin);
+        WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
+               ((amdgpu_crtc->cursor_width - 1) << 16) | (amdgpu_crtc->cursor_height - 1));
 
         return 0;
 }
@@ -2537,7 +2539,6 @@ static int dce_v10_0_crtc_cursor_set2(struct drm_crtc *crtc,
                                       int32_t hot_y)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
         struct drm_gem_object *obj;
         struct amdgpu_bo *aobj;
         int ret;
@@ -2578,7 +2579,9 @@ static int dce_v10_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
         dce_v10_0_lock_cursor(crtc, true);
 
-        if (hot_x != amdgpu_crtc->cursor_hot_x ||
+        if (width != amdgpu_crtc->cursor_width ||
+            height != amdgpu_crtc->cursor_height ||
+            hot_x != amdgpu_crtc->cursor_hot_x ||
             hot_y != amdgpu_crtc->cursor_hot_y) {
                 int x, y;
 
@@ -2587,16 +2590,10 @@ static int dce_v10_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
                 dce_v10_0_cursor_move_locked(crtc, x, y);
 
-                amdgpu_crtc->cursor_hot_x = hot_x;
-                amdgpu_crtc->cursor_hot_y = hot_y;
-        }
-
-        if (width != amdgpu_crtc->cursor_width ||
-            height != amdgpu_crtc->cursor_height) {
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (width - 1) << 16 | (height - 1));
                 amdgpu_crtc->cursor_width = width;
                 amdgpu_crtc->cursor_height = height;
+                amdgpu_crtc->cursor_hot_x = hot_x;
+                amdgpu_crtc->cursor_hot_y = hot_y;
         }
 
         dce_v10_0_show_cursor(crtc);
@@ -2620,7 +2617,6 @@ unpin:
 static void dce_v10_0_cursor_reset(struct drm_crtc *crtc)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
 
         if (amdgpu_crtc->cursor_bo) {
                 dce_v10_0_lock_cursor(crtc, true);
@@ -2628,10 +2624,6 @@ static void dce_v10_0_cursor_reset(struct drm_crtc *crtc)
                 dce_v10_0_cursor_move_locked(crtc, amdgpu_crtc->cursor_x,
                                              amdgpu_crtc->cursor_y);
 
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (amdgpu_crtc->cursor_width - 1) << 16 |
-                       (amdgpu_crtc->cursor_height - 1));
-
                 dce_v10_0_show_cursor(crtc);
 
                 dce_v10_0_lock_cursor(crtc, false);
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
index 2006abbbfb62..a7af5b33a5e3 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -2532,6 +2532,8 @@ static int dce_v11_0_cursor_move_locked(struct drm_crtc *crtc,
 
         WREG32(mmCUR_POSITION + amdgpu_crtc->crtc_offset, (x << 16) | y);
         WREG32(mmCUR_HOT_SPOT + amdgpu_crtc->crtc_offset, (xorigin << 16) | yorigin);
+        WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
+               ((amdgpu_crtc->cursor_width - 1) << 16) | (amdgpu_crtc->cursor_height - 1));
 
         return 0;
 }
@@ -2557,7 +2559,6 @@ static int dce_v11_0_crtc_cursor_set2(struct drm_crtc *crtc,
                                       int32_t hot_y)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
         struct drm_gem_object *obj;
         struct amdgpu_bo *aobj;
         int ret;
@@ -2598,7 +2599,9 @@ static int dce_v11_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
         dce_v11_0_lock_cursor(crtc, true);
 
-        if (hot_x != amdgpu_crtc->cursor_hot_x ||
+        if (width != amdgpu_crtc->cursor_width ||
+            height != amdgpu_crtc->cursor_height ||
+            hot_x != amdgpu_crtc->cursor_hot_x ||
             hot_y != amdgpu_crtc->cursor_hot_y) {
                 int x, y;
 
@@ -2607,16 +2610,10 @@ static int dce_v11_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
                 dce_v11_0_cursor_move_locked(crtc, x, y);
 
-                amdgpu_crtc->cursor_hot_x = hot_x;
-                amdgpu_crtc->cursor_hot_y = hot_y;
-        }
-
-        if (width != amdgpu_crtc->cursor_width ||
-            height != amdgpu_crtc->cursor_height) {
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (width - 1) << 16 | (height - 1));
                 amdgpu_crtc->cursor_width = width;
                 amdgpu_crtc->cursor_height = height;
+                amdgpu_crtc->cursor_hot_x = hot_x;
+                amdgpu_crtc->cursor_hot_y = hot_y;
         }
 
         dce_v11_0_show_cursor(crtc);
@@ -2640,7 +2637,6 @@ unpin:
 static void dce_v11_0_cursor_reset(struct drm_crtc *crtc)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
 
         if (amdgpu_crtc->cursor_bo) {
                 dce_v11_0_lock_cursor(crtc, true);
@@ -2648,10 +2644,6 @@ static void dce_v11_0_cursor_reset(struct drm_crtc *crtc)
                 dce_v11_0_cursor_move_locked(crtc, amdgpu_crtc->cursor_x,
                                              amdgpu_crtc->cursor_y);
 
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (amdgpu_crtc->cursor_width - 1) << 16 |
-                       (amdgpu_crtc->cursor_height - 1));
-
                 dce_v11_0_show_cursor(crtc);
 
                 dce_v11_0_lock_cursor(crtc, false);
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
index b4e4ec630e8c..39df6a50637f 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
@@ -1859,6 +1859,8 @@ static int dce_v6_0_cursor_move_locked(struct drm_crtc *crtc,
         struct amdgpu_device *adev = crtc->dev->dev_private;
         int xorigin = 0, yorigin = 0;
 
+        int w = amdgpu_crtc->cursor_width;
+
         amdgpu_crtc->cursor_x = x;
         amdgpu_crtc->cursor_y = y;
 
@@ -1878,6 +1880,8 @@ static int dce_v6_0_cursor_move_locked(struct drm_crtc *crtc,
 
         WREG32(mmCUR_POSITION + amdgpu_crtc->crtc_offset, (x << 16) | y);
         WREG32(mmCUR_HOT_SPOT + amdgpu_crtc->crtc_offset, (xorigin << 16) | yorigin);
+        WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
+               ((w - 1) << 16) | (amdgpu_crtc->cursor_height - 1));
 
         return 0;
 }
@@ -1903,7 +1907,6 @@ static int dce_v6_0_crtc_cursor_set2(struct drm_crtc *crtc,
                                      int32_t hot_y)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
         struct drm_gem_object *obj;
         struct amdgpu_bo *aobj;
         int ret;
@@ -1944,7 +1947,9 @@ static int dce_v6_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
         dce_v6_0_lock_cursor(crtc, true);
 
-        if (hot_x != amdgpu_crtc->cursor_hot_x ||
+        if (width != amdgpu_crtc->cursor_width ||
+            height != amdgpu_crtc->cursor_height ||
+            hot_x != amdgpu_crtc->cursor_hot_x ||
             hot_y != amdgpu_crtc->cursor_hot_y) {
                 int x, y;
 
@@ -1953,16 +1958,10 @@ static int dce_v6_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
                 dce_v6_0_cursor_move_locked(crtc, x, y);
 
-                amdgpu_crtc->cursor_hot_x = hot_x;
-                amdgpu_crtc->cursor_hot_y = hot_y;
-        }
-
-        if (width != amdgpu_crtc->cursor_width ||
-            height != amdgpu_crtc->cursor_height) {
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (width - 1) << 16 | (height - 1));
                 amdgpu_crtc->cursor_width = width;
                 amdgpu_crtc->cursor_height = height;
+                amdgpu_crtc->cursor_hot_x = hot_x;
+                amdgpu_crtc->cursor_hot_y = hot_y;
         }
 
         dce_v6_0_show_cursor(crtc);
@@ -1986,7 +1985,6 @@ unpin:
 static void dce_v6_0_cursor_reset(struct drm_crtc *crtc)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
 
         if (amdgpu_crtc->cursor_bo) {
                 dce_v6_0_lock_cursor(crtc, true);
@@ -1994,10 +1992,6 @@ static void dce_v6_0_cursor_reset(struct drm_crtc *crtc)
                 dce_v6_0_cursor_move_locked(crtc, amdgpu_crtc->cursor_x,
                                             amdgpu_crtc->cursor_y);
 
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (amdgpu_crtc->cursor_width - 1) << 16 |
-                       (amdgpu_crtc->cursor_height - 1));
-
                 dce_v6_0_show_cursor(crtc);
                 dce_v6_0_lock_cursor(crtc, false);
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
index 584abe834a3c..28102bb1704d 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -2363,6 +2363,8 @@ static int dce_v8_0_cursor_move_locked(struct drm_crtc *crtc,
 
         WREG32(mmCUR_POSITION + amdgpu_crtc->crtc_offset, (x << 16) | y);
         WREG32(mmCUR_HOT_SPOT + amdgpu_crtc->crtc_offset, (xorigin << 16) | yorigin);
+        WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
+               ((amdgpu_crtc->cursor_width - 1) << 16) | (amdgpu_crtc->cursor_height - 1));
 
         return 0;
 }
@@ -2388,7 +2390,6 @@ static int dce_v8_0_crtc_cursor_set2(struct drm_crtc *crtc,
                                      int32_t hot_y)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
         struct drm_gem_object *obj;
         struct amdgpu_bo *aobj;
         int ret;
@@ -2429,7 +2430,9 @@ static int dce_v8_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
         dce_v8_0_lock_cursor(crtc, true);
 
-        if (hot_x != amdgpu_crtc->cursor_hot_x ||
+        if (width != amdgpu_crtc->cursor_width ||
+            height != amdgpu_crtc->cursor_height ||
+            hot_x != amdgpu_crtc->cursor_hot_x ||
             hot_y != amdgpu_crtc->cursor_hot_y) {
                 int x, y;
 
@@ -2438,16 +2441,10 @@ static int dce_v8_0_crtc_cursor_set2(struct drm_crtc *crtc,
 
                 dce_v8_0_cursor_move_locked(crtc, x, y);
 
-                amdgpu_crtc->cursor_hot_x = hot_x;
-                amdgpu_crtc->cursor_hot_y = hot_y;
-        }
-
-        if (width != amdgpu_crtc->cursor_width ||
-            height != amdgpu_crtc->cursor_height) {
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (width - 1) << 16 | (height - 1));
                 amdgpu_crtc->cursor_width = width;
                 amdgpu_crtc->cursor_height = height;
+                amdgpu_crtc->cursor_hot_x = hot_x;
+                amdgpu_crtc->cursor_hot_y = hot_y;
         }
 
         dce_v8_0_show_cursor(crtc);
@@ -2471,7 +2468,6 @@ unpin:
 static void dce_v8_0_cursor_reset(struct drm_crtc *crtc)
 {
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-        struct amdgpu_device *adev = crtc->dev->dev_private;
 
         if (amdgpu_crtc->cursor_bo) {
                 dce_v8_0_lock_cursor(crtc, true);
@@ -2479,10 +2475,6 @@ static void dce_v8_0_cursor_reset(struct drm_crtc *crtc)
                 dce_v8_0_cursor_move_locked(crtc, amdgpu_crtc->cursor_x,
                                             amdgpu_crtc->cursor_y);
 
-                WREG32(mmCUR_SIZE + amdgpu_crtc->crtc_offset,
-                       (amdgpu_crtc->cursor_width - 1) << 16 |
-                       (amdgpu_crtc->cursor_height - 1));
-
                 dce_v8_0_show_cursor(crtc);
 
                 dce_v8_0_lock_cursor(crtc, false);
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_virtual.c b/drivers/gpu/drm/amd/amdgpu/dce_virtual.c
index 762f8e82ceb7..e9a176891e13 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_virtual.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_virtual.c
@@ -627,11 +627,8 @@ static const struct drm_encoder_helper_funcs dce_virtual_encoder_helper_funcs =
 
 static void dce_virtual_encoder_destroy(struct drm_encoder *encoder)
 {
-        struct amdgpu_encoder *amdgpu_encoder = to_amdgpu_encoder(encoder);
-
-        kfree(amdgpu_encoder->enc_priv);
         drm_encoder_cleanup(encoder);
-        kfree(amdgpu_encoder);
+        kfree(encoder);
 }
 
 static const struct drm_encoder_funcs dce_virtual_encoder_funcs = {
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index 45a573e63d4a..0635829b18cf 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -44,6 +44,7 @@ MODULE_FIRMWARE("radeon/tahiti_mc.bin");
 MODULE_FIRMWARE("radeon/pitcairn_mc.bin");
 MODULE_FIRMWARE("radeon/verde_mc.bin");
 MODULE_FIRMWARE("radeon/oland_mc.bin");
+MODULE_FIRMWARE("radeon/si58_mc.bin");
 
 #define MC_SEQ_MISC0__MT__MASK   0xf0000000
 #define MC_SEQ_MISC0__MT__GDDR1  0x10000000
@@ -113,6 +114,7 @@ static int gmc_v6_0_init_microcode(struct amdgpu_device *adev)
         const char *chip_name;
         char fw_name[30];
         int err;
+        bool is_58_fw = false;
 
         DRM_DEBUG("\n");
 
@@ -135,7 +137,14 @@ static int gmc_v6_0_init_microcode(struct amdgpu_device *adev)
         default: BUG();
         }
 
-        snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", chip_name);
+        /* this memory configuration requires special firmware */
+        if (((RREG32(mmMC_SEQ_MISC0) & 0xff000000) >> 24) == 0x58)
+                is_58_fw = true;
+
+        if (is_58_fw)
+                snprintf(fw_name, sizeof(fw_name), "radeon/si58_mc.bin");
+        else
+                snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", chip_name);
         err = request_firmware(&adev->mc.fw, fw_name, adev->dev);
         if (err)
                 goto out;
@@ -245,6 +254,9 @@ static void gmc_v6_0_mc_program(struct amdgpu_device *adev)
         }
         WREG32(mmHDP_REG_COHERENCY_FLUSH_CNTL, 0);
 
+        if (adev->mode_info.num_crtc)
+                amdgpu_display_set_vga_render_state(adev, false);
+
         gmc_v6_0_mc_stop(adev, &save);
 
         if (gmc_v6_0_wait_for_idle((void *)adev)) {
@@ -274,7 +286,6 @@ static void gmc_v6_0_mc_program(struct amdgpu_device *adev)
                 dev_warn(adev->dev, "Wait for MC idle timedout !\n");
         }
         gmc_v6_0_mc_resume(adev, &save);
-        amdgpu_display_set_vga_render_state(adev, false);
 }
 
 static int gmc_v6_0_mc_init(struct amdgpu_device *adev)
@@ -463,19 +474,11 @@ static int gmc_v6_0_gart_enable(struct amdgpu_device *adev)
         WREG32(mmVM_CONTEXT1_CNTL,
                VM_CONTEXT1_CNTL__ENABLE_CONTEXT_MASK |
                (1UL << VM_CONTEXT1_CNTL__PAGE_TABLE_DEPTH__SHIFT) |
-               ((amdgpu_vm_block_size - 9) << VM_CONTEXT1_CNTL__PAGE_TABLE_BLOCK_SIZE__SHIFT) |
-               VM_CONTEXT1_CNTL__RANGE_PROTECTION_FAULT_ENABLE_INTERRUPT_MASK |
-               VM_CONTEXT1_CNTL__RANGE_PROTECTION_FAULT_ENABLE_DEFAULT_MASK |
-               VM_CONTEXT1_CNTL__DUMMY_PAGE_PROTECTION_FAULT_ENABLE_INTERRUPT_MASK |
-               VM_CONTEXT1_CNTL__DUMMY_PAGE_PROTECTION_FAULT_ENABLE_DEFAULT_MASK |
-               VM_CONTEXT1_CNTL__PDE0_PROTECTION_FAULT_ENABLE_INTERRUPT_MASK |
-               VM_CONTEXT1_CNTL__PDE0_PROTECTION_FAULT_ENABLE_DEFAULT_MASK |
-               VM_CONTEXT1_CNTL__VALID_PROTECTION_FAULT_ENABLE_INTERRUPT_MASK |
-               VM_CONTEXT1_CNTL__VALID_PROTECTION_FAULT_ENABLE_DEFAULT_MASK |
-               VM_CONTEXT1_CNTL__READ_PROTECTION_FAULT_ENABLE_INTERRUPT_MASK |
-               VM_CONTEXT1_CNTL__READ_PROTECTION_FAULT_ENABLE_DEFAULT_MASK |
-               VM_CONTEXT1_CNTL__WRITE_PROTECTION_FAULT_ENABLE_INTERRUPT_MASK |
-               VM_CONTEXT1_CNTL__WRITE_PROTECTION_FAULT_ENABLE_DEFAULT_MASK);
+               ((amdgpu_vm_block_size - 9) << VM_CONTEXT1_CNTL__PAGE_TABLE_BLOCK_SIZE__SHIFT));
+        if (amdgpu_vm_fault_stop == AMDGPU_VM_FAULT_STOP_ALWAYS)
+                gmc_v6_0_set_fault_enable_default(adev, false);
+        else
+                gmc_v6_0_set_fault_enable_default(adev, true);
 
         gmc_v6_0_gart_flush_gpu_tlb(adev, 0);
         dev_info(adev->dev, "PCIE GART of %uM enabled (table at 0x%016llX).\n",
@@ -754,7 +757,10 @@ static int gmc_v6_0_late_init(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        return amdgpu_irq_get(adev, &adev->mc.vm_fault, 0);
+        if (amdgpu_vm_fault_stop != AMDGPU_VM_FAULT_STOP_ALWAYS)
+                return amdgpu_irq_get(adev, &adev->mc.vm_fault, 0);
+        else
+                return 0;
 }
 
 static int gmc_v6_0_sw_init(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index 10bedfac27b8..6e150db8f380 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -64,6 +64,7 @@ MODULE_FIRMWARE("radeon/oland_smc.bin");
 MODULE_FIRMWARE("radeon/oland_k_smc.bin");
 MODULE_FIRMWARE("radeon/hainan_smc.bin");
 MODULE_FIRMWARE("radeon/hainan_k_smc.bin");
+MODULE_FIRMWARE("radeon/banks_k_2_smc.bin");
 
 union power_info {
         struct _ATOM_POWERPLAY_INFO info;
@@ -3487,17 +3488,6 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
                     (adev->pdev->device == 0x6817) ||
                     (adev->pdev->device == 0x6806))
                         max_mclk = 120000;
-        } else if (adev->asic_type == CHIP_OLAND) {
-                if ((adev->pdev->revision == 0xC7) ||
-                    (adev->pdev->revision == 0x80) ||
-                    (adev->pdev->revision == 0x81) ||
-                    (adev->pdev->revision == 0x83) ||
-                    (adev->pdev->revision == 0x87) ||
-                    (adev->pdev->device == 0x6604) ||
-                    (adev->pdev->device == 0x6605)) {
-                        max_sclk = 75000;
-                        max_mclk = 80000;
-                }
         } else if (adev->asic_type == CHIP_HAINAN) {
                 if ((adev->pdev->revision == 0x81) ||
                     (adev->pdev->revision == 0x83) ||
@@ -3506,7 +3496,6 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
                     (adev->pdev->device == 0x6665) ||
                     (adev->pdev->device == 0x6667)) {
                         max_sclk = 75000;
-                        max_mclk = 80000;
                 }
         }
         /* Apply dpm quirks */
@@ -7713,10 +7702,11 @@ static int si_dpm_init_microcode(struct amdgpu_device *adev)
                         ((adev->pdev->device == 0x6660) ||
                         (adev->pdev->device == 0x6663) ||
                         (adev->pdev->device == 0x6665) ||
-                        (adev->pdev->device == 0x6667))) ||
-                    ((adev->pdev->revision == 0xc3) &&
-                        (adev->pdev->device == 0x6665)))
+                         (adev->pdev->device == 0x6667))))
                         chip_name = "hainan_k";
+                else if ((adev->pdev->revision == 0xc3) &&
+                         (adev->pdev->device == 0x6665))
+                        chip_name = "banks_k_2";
                 else
                         chip_name = "hainan";
                 break;
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
index 96444e4d862a..7fb9137dd89b 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
@@ -40,13 +40,14 @@
 #include "smu/smu_7_0_1_sh_mask.h"
 
 static void uvd_v4_2_mc_resume(struct amdgpu_device *adev);
-static void uvd_v4_2_init_cg(struct amdgpu_device *adev);
 static void uvd_v4_2_set_ring_funcs(struct amdgpu_device *adev);
 static void uvd_v4_2_set_irq_funcs(struct amdgpu_device *adev);
 static int uvd_v4_2_start(struct amdgpu_device *adev);
 static void uvd_v4_2_stop(struct amdgpu_device *adev);
 static int uvd_v4_2_set_clockgating_state(void *handle,
                                 enum amd_clockgating_state state);
+static void uvd_v4_2_set_dcm(struct amdgpu_device *adev,
+                             bool sw_mode);
 /**
  * uvd_v4_2_ring_get_rptr - get read pointer
  *
@@ -140,7 +141,8 @@ static int uvd_v4_2_sw_fini(void *handle)
 
         return r;
 }
-
+static void uvd_v4_2_enable_mgcg(struct amdgpu_device *adev,
+                                 bool enable);
 /**
  * uvd_v4_2_hw_init - start and test UVD block
  *
@@ -155,8 +157,7 @@ static int uvd_v4_2_hw_init(void *handle)
         uint32_t tmp;
         int r;
 
-        uvd_v4_2_init_cg(adev);
-        uvd_v4_2_set_clockgating_state(adev, AMD_CG_STATE_GATE);
+        uvd_v4_2_enable_mgcg(adev, true);
         amdgpu_asic_set_uvd_clocks(adev, 10000, 10000);
         r = uvd_v4_2_start(adev);
         if (r)
@@ -266,11 +267,13 @@ static int uvd_v4_2_start(struct amdgpu_device *adev)
         struct amdgpu_ring *ring = &adev->uvd.ring;
         uint32_t rb_bufsz;
         int i, j, r;
-
         /* disable byte swapping */
         u32 lmi_swap_cntl = 0;
         u32 mp_swap_cntl = 0;
 
+        WREG32(mmUVD_CGC_GATE, 0);
+        uvd_v4_2_set_dcm(adev, true);
+
         uvd_v4_2_mc_resume(adev);
 
         /* disable interupt */
@@ -406,6 +409,8 @@ static void uvd_v4_2_stop(struct amdgpu_device *adev)
 
         /* Unstall UMC and register bus */
         WREG32_P(mmUVD_LMI_CTRL2, 0, ~(1 << 8));
+
+        uvd_v4_2_set_dcm(adev, false);
 }
 
 /**
@@ -619,19 +624,6 @@ static void uvd_v4_2_set_dcm(struct amdgpu_device *adev,
         WREG32_UVD_CTX(ixUVD_CGC_CTRL2, tmp2);
 }
 
-static void uvd_v4_2_init_cg(struct amdgpu_device *adev)
-{
-        bool hw_mode = true;
-
-        if (hw_mode) {
-                uvd_v4_2_set_dcm(adev, false);
-        } else {
-                u32 tmp = RREG32(mmUVD_CGC_CTRL);
-                tmp &= ~UVD_CGC_CTRL__DYN_CLOCK_MODE_MASK;
-                WREG32(mmUVD_CGC_CTRL, tmp);
-        }
-}
-
 static bool uvd_v4_2_is_idle(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
@@ -685,17 +677,6 @@ static int uvd_v4_2_process_interrupt(struct amdgpu_device *adev,
 static int uvd_v4_2_set_clockgating_state(void *handle,
                                           enum amd_clockgating_state state)
 {
-        bool gate = false;
-        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-
-        if (!(adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG))
-                return 0;
-
-        if (state == AMD_CG_STATE_GATE)
-                gate = true;
-
-        uvd_v4_2_enable_mgcg(adev, gate);
-
         return 0;
 }
 
@@ -711,9 +692,6 @@ static int uvd_v4_2_set_powergating_state(void *handle,
          */
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (!(adev->pg_flags & AMD_PG_SUPPORT_UVD))
-                return 0;
-
         if (state == AMD_PG_STATE_GATE) {
                 uvd_v4_2_stop(adev);
                 return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index 5fb0b7f5c065..37ca685e5a9a 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -43,9 +43,13 @@
 
 #define GRBM_GFX_INDEX__VCE_INSTANCE__SHIFT     0x04
 #define GRBM_GFX_INDEX__VCE_INSTANCE_MASK       0x10
+#define GRBM_GFX_INDEX__VCE_ALL_PIPE            0x07
+
 #define mmVCE_LMI_VCPU_CACHE_40BIT_BAR0 0x8616
 #define mmVCE_LMI_VCPU_CACHE_40BIT_BAR1 0x8617
 #define mmVCE_LMI_VCPU_CACHE_40BIT_BAR2 0x8618
+#define mmGRBM_GFX_INDEX_DEFAULT 0xE0000000
+
 #define VCE_STATUS_VCPU_REPORT_FW_LOADED_MASK   0x02
 
 #define VCE_V3_0_FW_SIZE        (384 * 1024)
@@ -54,6 +58,9 @@
 
 #define FW_52_8_3       ((52 << 24) | (8 << 16) | (3 << 8))
 
+#define GET_VCE_INSTANCE(i)  ((i) << GRBM_GFX_INDEX__VCE_INSTANCE__SHIFT \
+                                        | GRBM_GFX_INDEX__VCE_ALL_PIPE)
+
 static void vce_v3_0_mc_resume(struct amdgpu_device *adev, int idx);
 static void vce_v3_0_set_ring_funcs(struct amdgpu_device *adev);
 static void vce_v3_0_set_irq_funcs(struct amdgpu_device *adev);
@@ -175,7 +182,7 @@ static void vce_v3_0_set_vce_sw_clock_gating(struct amdgpu_device *adev,
                 WREG32(mmVCE_UENC_CLOCK_GATING_2, data);
 
                 data = RREG32(mmVCE_UENC_REG_CLOCK_GATING);
-                data &= ~0xffc00000;
+                data &= ~0x3ff;
                 WREG32(mmVCE_UENC_REG_CLOCK_GATING, data);
 
                 data = RREG32(mmVCE_UENC_DMA_DCLK_CTRL);
@@ -249,7 +256,7 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
                 if (adev->vce.harvest_config & (1 << idx))
                         continue;
 
-                WREG32_FIELD(GRBM_GFX_INDEX, VCE_INSTANCE, idx);
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(idx));
                 vce_v3_0_mc_resume(adev, idx);
                 WREG32_FIELD(VCE_STATUS, JOB_BUSY, 1);
 
@@ -273,7 +280,7 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
                 }
         }
 
-        WREG32_FIELD(GRBM_GFX_INDEX, VCE_INSTANCE, 0);
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
         mutex_unlock(&adev->grbm_idx_mutex);
 
         return 0;
@@ -288,7 +295,7 @@ static int vce_v3_0_stop(struct amdgpu_device *adev)
                 if (adev->vce.harvest_config & (1 << idx))
                         continue;
 
-                WREG32_FIELD(GRBM_GFX_INDEX, VCE_INSTANCE, idx);
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(idx));
 
                 if (adev->asic_type >= CHIP_STONEY)
                         WREG32_P(mmVCE_VCPU_CNTL, 0, ~0x200001);
@@ -306,7 +313,7 @@ static int vce_v3_0_stop(struct amdgpu_device *adev)
                         vce_v3_0_set_vce_sw_clock_gating(adev, false);
         }
 
-        WREG32_FIELD(GRBM_GFX_INDEX, VCE_INSTANCE, 0);
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
         mutex_unlock(&adev->grbm_idx_mutex);
 
         return 0;
@@ -586,17 +593,17 @@ static bool vce_v3_0_check_soft_reset(void *handle)
          * VCE team suggest use bit 3--bit 6 for busy status check
          */
         mutex_lock(&adev->grbm_idx_mutex);
-        WREG32_FIELD(GRBM_GFX_INDEX, INSTANCE_INDEX, 0);
+        WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(0));
         if (RREG32(mmVCE_STATUS) & AMDGPU_VCE_STATUS_BUSY_MASK) {
                 srbm_soft_reset = REG_SET_FIELD(srbm_soft_reset, SRBM_SOFT_RESET, SOFT_RESET_VCE0, 1);
                 srbm_soft_reset = REG_SET_FIELD(srbm_soft_reset, SRBM_SOFT_RESET, SOFT_RESET_VCE1, 1);
         }
-        WREG32_FIELD(GRBM_GFX_INDEX, INSTANCE_INDEX, 0x10);
+        WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(1));
         if (RREG32(mmVCE_STATUS) & AMDGPU_VCE_STATUS_BUSY_MASK) {
                 srbm_soft_reset = REG_SET_FIELD(srbm_soft_reset, SRBM_SOFT_RESET, SOFT_RESET_VCE0, 1);
                 srbm_soft_reset = REG_SET_FIELD(srbm_soft_reset, SRBM_SOFT_RESET, SOFT_RESET_VCE1, 1);
         }
-        WREG32_FIELD(GRBM_GFX_INDEX, INSTANCE_INDEX, 0);
+        WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(0));
         mutex_unlock(&adev->grbm_idx_mutex);
 
         if (srbm_soft_reset) {
@@ -734,7 +741,7 @@ static int vce_v3_0_set_clockgating_state(void *handle,
                 if (adev->vce.harvest_config & (1 << i))
                         continue;
 
-                WREG32_FIELD(GRBM_GFX_INDEX, VCE_INSTANCE, i);
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(i));
 
                 if (enable) {
                         /* initialize VCE_CLOCK_GATING_A: Clock ON/OFF delay */
@@ -753,7 +760,7 @@ static int vce_v3_0_set_clockgating_state(void *handle,
                 vce_v3_0_set_vce_sw_clock_gating(adev, enable);
         }
 
-        WREG32_FIELD(GRBM_GFX_INDEX, VCE_INSTANCE, 0);
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
         mutex_unlock(&adev->grbm_idx_mutex);
 
         return 0;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c
index b0c63c5f54c9..6bb79c94cb9f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c
@@ -200,7 +200,7 @@ int cz_dpm_powergate_vce(struct pp_hwmgr *hwmgr, bool bgate)
                                 cgs_set_clockgating_state(
                                                         hwmgr->device,
                                                         AMD_IP_BLOCK_TYPE_VCE,
-                                                        AMD_CG_STATE_UNGATE);
+                                                        AMD_CG_STATE_GATE);
                                 cgs_set_powergating_state(
                                                         hwmgr->device,
                                                         AMD_IP_BLOCK_TYPE_VCE,
@@ -218,7 +218,7 @@ int cz_dpm_powergate_vce(struct pp_hwmgr *hwmgr, bool bgate)
                                 cgs_set_clockgating_state(
                                                         hwmgr->device,
                                                         AMD_IP_BLOCK_TYPE_VCE,
-                                                        AMD_PG_STATE_GATE);
+                                                        AMD_PG_STATE_UNGATE);
                                 cz_dpm_update_vce_dpm(hwmgr);
                                 cz_enable_disable_vce_dpm(hwmgr, true);
                                 return 0;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
index 4b14f259a147..0fb4e8c8f5e1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
@@ -1402,14 +1402,22 @@ int  cz_dpm_update_vce_dpm(struct pp_hwmgr *hwmgr)
                                              cz_hwmgr->vce_dpm.hard_min_clk,
                                                 PPSMC_MSG_SetEclkHardMin));
         } else {
-                /*EPR# 419220 -HW limitation to to */
-                cz_hwmgr->vce_dpm.hard_min_clk = hwmgr->vce_arbiter.ecclk;
-                smum_send_msg_to_smc_with_parameter(hwmgr->smumgr,
-                                            PPSMC_MSG_SetEclkHardMin,
-                                            cz_get_eclk_level(hwmgr,
-                                     cz_hwmgr->vce_dpm.hard_min_clk,
-                                          PPSMC_MSG_SetEclkHardMin));
-
+                /*Program HardMin based on the vce_arbiter.ecclk */
+                if (hwmgr->vce_arbiter.ecclk == 0) {
+                        smum_send_msg_to_smc_with_parameter(hwmgr->smumgr,
+                                            PPSMC_MSG_SetEclkHardMin, 0);
+                /* disable ECLK DPM 0. Otherwise VCE could hang if
+                 * switching SCLK from DPM 0 to 6/7 */
+                        smum_send_msg_to_smc_with_parameter(hwmgr->smumgr,
+                                        PPSMC_MSG_SetEclkSoftMin, 1);
+                } else {
+                        cz_hwmgr->vce_dpm.hard_min_clk = hwmgr->vce_arbiter.ecclk;
+                        smum_send_msg_to_smc_with_parameter(hwmgr->smumgr,
+                                                PPSMC_MSG_SetEclkHardMin,
+                                                cz_get_eclk_level(hwmgr,
+                                                cz_hwmgr->vce_dpm.hard_min_clk,
+                                                PPSMC_MSG_SetEclkHardMin));
+                }
         }
         return 0;
 }
diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h
index 908011d2c8f5..7abda94fc2cf 100644
--- a/drivers/gpu/drm/ast/ast_drv.h
+++ b/drivers/gpu/drm/ast/ast_drv.h
@@ -113,6 +113,7 @@ struct ast_private {
         struct ttm_bo_kmap_obj cache_kmap;
         int next_cursor;
         bool support_wide_screen;
+        bool DisableP2A;
 
         enum ast_tx_chip tx_chip_type;
         u8 dp501_maxclk;
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index f75c6421db62..533e762d036d 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -124,6 +124,12 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post)
         } else
                 *need_post = false;
 
+        /* Check P2A Access */
+        ast->DisableP2A = true;
+        data = ast_read32(ast, 0xf004);
+        if (data != 0xFFFFFFFF)
+                ast->DisableP2A = false;
+
         /* Check if we support wide screen */
         switch (ast->chip) {
         case AST1180:
@@ -140,15 +146,17 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post)
                         ast->support_wide_screen = true;
                 else {
                         ast->support_wide_screen = false;
-                        /* Read SCU7c (silicon revision register) */
-                        ast_write32(ast, 0xf004, 0x1e6e0000);
-                        ast_write32(ast, 0xf000, 0x1);
-                        data = ast_read32(ast, 0x1207c);
-                        data &= 0x300;
-                        if (ast->chip == AST2300 && data == 0x0) /* ast1300 */
-                                ast->support_wide_screen = true;
-                        if (ast->chip == AST2400 && data == 0x100) /* ast1400 */
-                                ast->support_wide_screen = true;
+                        if (ast->DisableP2A == false) {
+                                /* Read SCU7c (silicon revision register) */
+                                ast_write32(ast, 0xf004, 0x1e6e0000);
+                                ast_write32(ast, 0xf000, 0x1);
+                                data = ast_read32(ast, 0x1207c);
+                                data &= 0x300;
+                                if (ast->chip == AST2300 && data == 0x0) /* ast1300 */
+                                        ast->support_wide_screen = true;
+                                if (ast->chip == AST2400 && data == 0x100) /* ast1400 */
+                                        ast->support_wide_screen = true;
+                        }
                 }
                 break;
         }
@@ -216,80 +224,81 @@ static int ast_get_dram_info(struct drm_device *dev)
         uint32_t data, data2;
         uint32_t denum, num, div, ref_pll;
 
-        ast_write32(ast, 0xf004, 0x1e6e0000);
-        ast_write32(ast, 0xf000, 0x1);
-
-
-        ast_write32(ast, 0x10000, 0xfc600309);
-
-        do {
-                if (pci_channel_offline(dev->pdev))
-                        return -EIO;
-        } while (ast_read32(ast, 0x10000) != 0x01);
-        data = ast_read32(ast, 0x10004);
-
-        if (data & 0x40)
+        if (ast->DisableP2A)
+        {
                 ast->dram_bus_width = 16;
+                ast->dram_type = AST_DRAM_1Gx16;
+                ast->mclk = 396;
+        }
         else
-                ast->dram_bus_width = 32;
+        {
+                ast_write32(ast, 0xf004, 0x1e6e0000);
+                ast_write32(ast, 0xf000, 0x1);
+                data = ast_read32(ast, 0x10004);
+
+                if (data & 0x40)
+                        ast->dram_bus_width = 16;
+                else
+                        ast->dram_bus_width = 32;
+
+                if (ast->chip == AST2300 || ast->chip == AST2400) {
+                        switch (data & 0x03) {
+                        case 0:
+                                ast->dram_type = AST_DRAM_512Mx16;
+                                break;
+                        default:
+                        case 1:
+                                ast->dram_type = AST_DRAM_1Gx16;
+                                break;
+                        case 2:
+                                ast->dram_type = AST_DRAM_2Gx16;
+                                break;
+                        case 3:
+                                ast->dram_type = AST_DRAM_4Gx16;
+                                break;
+                        }
+                } else {
+                        switch (data & 0x0c) {
+                        case 0:
+                        case 4:
+                                ast->dram_type = AST_DRAM_512Mx16;
+                                break;
+                        case 8:
+                                if (data & 0x40)
+                                        ast->dram_type = AST_DRAM_1Gx16;
+                                else
+                                        ast->dram_type = AST_DRAM_512Mx32;
+                                break;
+                        case 0xc:
+                                ast->dram_type = AST_DRAM_1Gx32;
+                                break;
+                        }
+                }
 
-        if (ast->chip == AST2300 || ast->chip == AST2400) {
-                switch (data & 0x03) {
-                case 0:
-                        ast->dram_type = AST_DRAM_512Mx16;
-                        break;
-                default:
-                case 1:
-                        ast->dram_type = AST_DRAM_1Gx16;
-                        break;
-                case 2:
-                        ast->dram_type = AST_DRAM_2Gx16;
-                        break;
+                data = ast_read32(ast, 0x10120);
+                data2 = ast_read32(ast, 0x10170);
+                if (data2 & 0x2000)
+                        ref_pll = 14318;
+                else
+                        ref_pll = 12000;
+
+                denum = data & 0x1f;
+                num = (data & 0x3fe0) >> 5;
+                data = (data & 0xc000) >> 14;
+                switch (data) {
                 case 3:
-                        ast->dram_type = AST_DRAM_4Gx16;
-                        break;
-                }
-        } else {
-                switch (data & 0x0c) {
-                case 0:
-                case 4:
-                        ast->dram_type = AST_DRAM_512Mx16;
+                        div = 0x4;
                         break;
-                case 8:
-                        if (data & 0x40)
-                                ast->dram_type = AST_DRAM_1Gx16;
-                        else
-                                ast->dram_type = AST_DRAM_512Mx32;
+                case 2:
+                case 1:
+                        div = 0x2;
                         break;
-                case 0xc:
-                        ast->dram_type = AST_DRAM_1Gx32;
+                default:
+                        div = 0x1;
                         break;
                 }
+                ast->mclk = ref_pll * (num + 2) / (denum + 2) * (div * 1000);
         }
-
-        data = ast_read32(ast, 0x10120);
-        data2 = ast_read32(ast, 0x10170);
-        if (data2 & 0x2000)
-                ref_pll = 14318;
-        else
-                ref_pll = 12000;
-
-        denum = data & 0x1f;
-        num = (data & 0x3fe0) >> 5;
-        data = (data & 0xc000) >> 14;
-        switch (data) {
-        case 3:
-                div = 0x4;
-                break;
-        case 2:
-        case 1:
-                div = 0x2;
-                break;
-        default:
-                div = 0x1;
-                break;
-        }
-        ast->mclk = ref_pll * (num + 2) / (denum + 2) * (div * 1000);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
index 810c51d92b99..5331ee1df086 100644
--- a/drivers/gpu/drm/ast/ast_post.c
+++ b/drivers/gpu/drm/ast/ast_post.c
@@ -379,12 +379,20 @@ void ast_post_gpu(struct drm_device *dev)
         ast_open_key(ast);
         ast_set_def_ext_reg(dev);
 
-        if (ast->chip == AST2300 || ast->chip == AST2400)
-                ast_init_dram_2300(dev);
-        else
-                ast_init_dram_reg(dev);
+        if (ast->DisableP2A == false)
+        {
+                if (ast->chip == AST2300 || ast->chip == AST2400)
+                        ast_init_dram_2300(dev);
+                else
+                        ast_init_dram_reg(dev);
 
-        ast_init_3rdtx(dev);
+                ast_init_3rdtx(dev);
+        }
+        else
+        {
+                if (ast->tx_chip_type != AST_TX_NONE)
+                        ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa3, 0xcf, 0x80);        /* Enable DVO */
+        }
 }
 
 /* AST 2300 DRAM settings */
diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
index eb9bf8786c24..18eefdcbf1ba 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
@@ -1382,6 +1382,7 @@ int analogix_dp_bind(struct device *dev, struct drm_device *drm_dev,
 
         pm_runtime_enable(dev);
 
+        pm_runtime_get_sync(dev);
         phy_power_on(dp->phy);
 
         analogix_dp_init_dp(dp);
@@ -1414,9 +1415,15 @@ int analogix_dp_bind(struct device *dev, struct drm_device *drm_dev,
                 goto err_disable_pm_runtime;
         }
 
+        phy_power_off(dp->phy);
+        pm_runtime_put(dev);
+
         return 0;
 
 err_disable_pm_runtime:
+
+        phy_power_off(dp->phy);
+        pm_runtime_put(dev);
         pm_runtime_disable(dev);
 
         return ret;
diff --git a/drivers/gpu/drm/cirrus/Kconfig b/drivers/gpu/drm/cirrus/Kconfig
index 04b3c161dfae..7f4cc6e172ab 100644
--- a/drivers/gpu/drm/cirrus/Kconfig
+++ b/drivers/gpu/drm/cirrus/Kconfig
@@ -7,3 +7,12 @@ config DRM_CIRRUS_QEMU
          This is a KMS driver for emulated cirrus device in qemu.
          It is *NOT* intended for real cirrus devices. This requires
          the modesetting userspace X.org driver.
+
+         Cirrus is obsolete, the hardware was designed in the 90ies
+         and can't keep up with todays needs.  More background:
+         https://www.kraxel.org/blog/2014/10/qemu-using-cirrus-considered-harmful/
+
+         Better alternatives are:
+           - stdvga (DRM_BOCHS, qemu -vga std, default in qemu 2.2+)
+           - qxl (DRM_QXL, qemu -vga qxl, works best with spice)
+           - virtio (DRM_VIRTIO_GPU), qemu -vga virtio)
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 60697482b94c..fdfb1ec17e66 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -291,15 +291,15 @@ drm_atomic_get_crtc_state(struct drm_atomic_state *state,
 EXPORT_SYMBOL(drm_atomic_get_crtc_state);
 
 static void set_out_fence_for_crtc(struct drm_atomic_state *state,
-                                   struct drm_crtc *crtc, s64 __user *fence_ptr)
+                                   struct drm_crtc *crtc, s32 __user *fence_ptr)
 {
         state->crtcs[drm_crtc_index(crtc)].out_fence_ptr = fence_ptr;
 }
 
-static s64 __user *get_out_fence_for_crtc(struct drm_atomic_state *state,
+static s32 __user *get_out_fence_for_crtc(struct drm_atomic_state *state,
                                           struct drm_crtc *crtc)
 {
-        s64 __user *fence_ptr;
+        s32 __user *fence_ptr;
 
         fence_ptr = state->crtcs[drm_crtc_index(crtc)].out_fence_ptr;
         state->crtcs[drm_crtc_index(crtc)].out_fence_ptr = NULL;
@@ -512,7 +512,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
                 state->color_mgmt_changed |= replaced;
                 return ret;
         } else if (property == config->prop_out_fence_ptr) {
-                s64 __user *fence_ptr = u64_to_user_ptr(val);
+                s32 __user *fence_ptr = u64_to_user_ptr(val);
 
                 if (!fence_ptr)
                         return 0;
@@ -1915,7 +1915,7 @@ EXPORT_SYMBOL(drm_atomic_clean_old_fb);
  */
 
 struct drm_out_fence_state {
-        s64 __user *out_fence_ptr;
+        s32 __user *out_fence_ptr;
         struct sync_file *sync_file;
         int fd;
 };
@@ -1952,7 +1952,7 @@ static int prepare_crtc_signaling(struct drm_device *dev,
                 return 0;
 
         for_each_crtc_in_state(state, crtc, crtc_state, i) {
-                u64 __user *fence_ptr;
+                s32 __user *fence_ptr;
 
                 fence_ptr = get_out_fence_for_crtc(crtc_state->state, crtc);
 
@@ -2032,13 +2032,16 @@ static void complete_crtc_signaling(struct drm_device *dev,
         }
 
         for_each_crtc_in_state(state, crtc, crtc_state, i) {
+                struct drm_pending_vblank_event *event = crtc_state->event;
                 /*
-                 * TEST_ONLY and PAGE_FLIP_EVENT are mutually
-                 * exclusive, if they weren't, this code should be
-                 * called on success for TEST_ONLY too.
+                 * Free the allocated event. drm_atomic_helper_setup_commit
+                 * can allocate an event too, so only free it if it's ours
+                 * to prevent a double free in drm_atomic_state_clear.
                  */
-                if (crtc_state->event)
-                        drm_event_cancel_free(dev, &crtc_state->event->base);
+                if (event && (event->base.fence || event->base.file_priv)) {
+                        drm_event_cancel_free(dev, &event->base);
+                        crtc_state->event = NULL;
+                }
         }
 
         if (!fence_state)
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 34f757bcabae..4594477dee00 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1666,9 +1666,6 @@ int drm_atomic_helper_prepare_planes(struct drm_device *dev,
 
                 funcs = plane->helper_private;
 
-                if (!drm_atomic_helper_framebuffer_changed(dev, state, plane_state->crtc))
-                        continue;
-
                 if (funcs->prepare_fb) {
                         ret = funcs->prepare_fb(plane, plane_state);
                         if (ret)
@@ -1685,9 +1682,6 @@ fail:
                 if (j >= i)
                         continue;
 
-                if (!drm_atomic_helper_framebuffer_changed(dev, state, plane_state->crtc))
-                        continue;
-
                 funcs = plane->helper_private;
 
                 if (funcs->cleanup_fb)
@@ -1954,9 +1948,6 @@ void drm_atomic_helper_cleanup_planes(struct drm_device *dev,
         for_each_plane_in_state(old_state, plane, plane_state, i) {
                 const struct drm_plane_helper_funcs *funcs;
 
-                if (!drm_atomic_helper_framebuffer_changed(dev, old_state, plane_state->crtc))
-                        continue;
-
                 funcs = plane->helper_private;
 
                 if (funcs->cleanup_fb)
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index 5a4526289392..7a7019ac9388 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -225,6 +225,7 @@ int drm_connector_init(struct drm_device *dev,
 
         INIT_LIST_HEAD(&connector->probed_modes);
         INIT_LIST_HEAD(&connector->modes);
+        mutex_init(&connector->mutex);
         connector->edid_blob_ptr = NULL;
         connector->status = connector_status_unknown;
 
@@ -359,6 +360,8 @@ void drm_connector_cleanup(struct drm_connector *connector)
                 connector->funcs->atomic_destroy_state(connector,
                                                        connector->state);
 
+        mutex_destroy(&connector->mutex);
+
         memset(connector, 0, sizeof(*connector));
 }
 EXPORT_SYMBOL(drm_connector_cleanup);
@@ -374,14 +377,18 @@ EXPORT_SYMBOL(drm_connector_cleanup);
  */
 int drm_connector_register(struct drm_connector *connector)
 {
-        int ret;
+        int ret = 0;
 
-        if (connector->registered)
+        if (!connector->dev->registered)
                 return 0;
 
+        mutex_lock(&connector->mutex);
+        if (connector->registered)
+                goto unlock;
+
         ret = drm_sysfs_connector_add(connector);
         if (ret)
-                return ret;
+                goto unlock;
 
         ret = drm_debugfs_connector_add(connector);
         if (ret) {
@@ -397,12 +404,14 @@ int drm_connector_register(struct drm_connector *connector)
         drm_mode_object_register(connector->dev, &connector->base);
 
         connector->registered = true;
-        return 0;
+        goto unlock;
 
 err_debugfs:
         drm_debugfs_connector_remove(connector);
 err_sysfs:
         drm_sysfs_connector_remove(connector);
+unlock:
+        mutex_unlock(&connector->mutex);
         return ret;
 }
 EXPORT_SYMBOL(drm_connector_register);
@@ -415,8 +424,11 @@ EXPORT_SYMBOL(drm_connector_register);
  */
 void drm_connector_unregister(struct drm_connector *connector)
 {
-        if (!connector->registered)
+        mutex_lock(&connector->mutex);
+        if (!connector->registered) {
+                mutex_unlock(&connector->mutex);
                 return;
+        }
 
         if (connector->funcs->early_unregister)
                 connector->funcs->early_unregister(connector);
@@ -425,6 +437,7 @@ void drm_connector_unregister(struct drm_connector *connector)
         drm_debugfs_connector_remove(connector);
 
         connector->registered = false;
+        mutex_unlock(&connector->mutex);
 }
 EXPORT_SYMBOL(drm_connector_unregister);
 
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index a525751b4559..6594b4088f11 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -745,6 +745,8 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
         if (ret)
                 goto err_minors;
 
+        dev->registered = true;
+
         if (dev->driver->load) {
                 ret = dev->driver->load(dev, flags);
                 if (ret)
@@ -785,6 +787,8 @@ void drm_dev_unregister(struct drm_device *dev)
 
         drm_lastclose(dev);
 
+        dev->registered = false;
+
         if (drm_core_check_feature(dev, DRIVER_MODESET))
                 drm_modeset_unregister_all(dev);
 
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index ac6a35212501..e6b19bc9021a 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1460,6 +1460,13 @@ drm_mode_create_from_cmdline_mode(struct drm_device *dev,
                 return NULL;
 
         mode->type |= DRM_MODE_TYPE_USERDEF;
+        /* fix up 1368x768: GFT/CVT can't express 1366 width due to alignment */
+        if (cmd->xres == 1366 && mode->hdisplay == 1368) {
+                mode->hdisplay = 1366;
+                mode->hsync_start--;
+                mode->hsync_end--;
+                drm_mode_set_name(mode);
+        }
         drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
         return mode;
 }
diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
index ac953f037be7..cf8f0128c161 100644
--- a/drivers/gpu/drm/drm_probe_helper.c
+++ b/drivers/gpu/drm/drm_probe_helper.c
@@ -143,8 +143,18 @@ void drm_kms_helper_poll_enable_locked(struct drm_device *dev)
         }
 
         if (dev->mode_config.delayed_event) {
+                /*
+                 * FIXME:
+                 *
+                 * Use short (1s) delay to handle the initial delayed event.
+                 * This delay should not be needed, but Optimus/nouveau will
+                 * fail in a mysterious way if the delayed event is handled as
+                 * soon as possible like it is done in
+                 * drm_helper_probe_single_connector_modes() in case the poll
+                 * was enabled before.
+                 */
                 poll = true;
-                delay = 0;
+                delay = HZ;
         }
 
         if (poll)
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
index 169ac96e8f08..fe0e85b41310 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
@@ -116,9 +116,14 @@ static int etnaviv_iommu_find_iova(struct etnaviv_iommu *mmu,
                 struct list_head list;
                 bool found;
 
+                /*
+                 * XXX: The DRM_MM_SEARCH_BELOW is really a hack to trick
+                 * drm_mm into giving out a low IOVA after address space
+                 * rollover. This needs a proper fix.
+                 */
                 ret = drm_mm_insert_node_in_range(&mmu->mm, node,
                         size, 0, mmu->last_iova, ~0UL,
-                        DRM_MM_SEARCH_DEFAULT);
+                        mmu->last_iova ? DRM_MM_SEARCH_DEFAULT : DRM_MM_SEARCH_BELOW);
 
                 if (ret != -ENOSPC)
                         break;
diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
index 6ca1f3117fe8..75eeb831ed6a 100644
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -46,7 +46,8 @@ enum decon_flag_bits {
         BIT_CLKS_ENABLED,
         BIT_IRQS_ENABLED,
         BIT_WIN_UPDATED,
-        BIT_SUSPENDED
+        BIT_SUSPENDED,
+        BIT_REQUEST_UPDATE
 };
 
 struct decon_context {
@@ -141,12 +142,6 @@ static void decon_commit(struct exynos_drm_crtc *crtc)
                 m->crtc_vsync_end = m->crtc_vsync_start + 1;
         }
 
-        decon_set_bits(ctx, DECON_VIDCON0, VIDCON0_ENVID, 0);
-
-        /* enable clock gate */
-        val = CMU_CLKGAGE_MODE_SFR_F | CMU_CLKGAGE_MODE_MEM_F;
-        writel(val, ctx->addr + DECON_CMU);
-
         if (ctx->out_type & (IFTYPE_I80 | I80_HW_TRG))
                 decon_setup_trigger(ctx);
 
@@ -315,6 +310,7 @@ static void decon_update_plane(struct exynos_drm_crtc *crtc,
 
         /* window enable */
         decon_set_bits(ctx, DECON_WINCONx(win), WINCONx_ENWIN_F, ~0);
+        set_bit(BIT_REQUEST_UPDATE, &ctx->flags);
 }
 
 static void decon_disable_plane(struct exynos_drm_crtc *crtc,
@@ -327,6 +323,7 @@ static void decon_disable_plane(struct exynos_drm_crtc *crtc,
                 return;
 
         decon_set_bits(ctx, DECON_WINCONx(win), WINCONx_ENWIN_F, 0);
+        set_bit(BIT_REQUEST_UPDATE, &ctx->flags);
 }
 
 static void decon_atomic_flush(struct exynos_drm_crtc *crtc)
@@ -340,8 +337,8 @@ static void decon_atomic_flush(struct exynos_drm_crtc *crtc)
         for (i = ctx->first_win; i < WINDOWS_NR; i++)
                 decon_shadow_protect_win(ctx, i, false);
 
-        /* standalone update */
-        decon_set_bits(ctx, DECON_UPDATE, STANDALONE_UPDATE_F, ~0);
+        if (test_and_clear_bit(BIT_REQUEST_UPDATE, &ctx->flags))
+                decon_set_bits(ctx, DECON_UPDATE, STANDALONE_UPDATE_F, ~0);
 
         if (ctx->out_type & IFTYPE_I80)
                 set_bit(BIT_WIN_UPDATED, &ctx->flags);
diff --git a/drivers/gpu/drm/i915/gvt/aperture_gm.c b/drivers/gpu/drm/i915/gvt/aperture_gm.c
index 0d41ebc4aea6..f7bce8603958 100644
--- a/drivers/gpu/drm/i915/gvt/aperture_gm.c
+++ b/drivers/gpu/drm/i915/gvt/aperture_gm.c
@@ -37,13 +37,6 @@
 #include "i915_drv.h"
 #include "gvt.h"
 
-#define MB_TO_BYTES(mb) ((mb) << 20ULL)
-#define BYTES_TO_MB(b) ((b) >> 20ULL)
-
-#define HOST_LOW_GM_SIZE MB_TO_BYTES(128)
-#define HOST_HIGH_GM_SIZE MB_TO_BYTES(384)
-#define HOST_FENCE 4
-
 static int alloc_gm(struct intel_vgpu *vgpu, bool high_gm)
 {
         struct intel_gvt *gvt = vgpu->gvt;
@@ -165,6 +158,14 @@ void intel_vgpu_write_fence(struct intel_vgpu *vgpu,
         POSTING_READ(fence_reg_lo);
 }
 
+static void _clear_vgpu_fence(struct intel_vgpu *vgpu)
+{
+        int i;
+
+        for (i = 0; i < vgpu_fence_sz(vgpu); i++)
+                intel_vgpu_write_fence(vgpu, i, 0);
+}
+
 static void free_vgpu_fence(struct intel_vgpu *vgpu)
 {
         struct intel_gvt *gvt = vgpu->gvt;
@@ -178,9 +179,9 @@ static void free_vgpu_fence(struct intel_vgpu *vgpu)
         intel_runtime_pm_get(dev_priv);
 
         mutex_lock(&dev_priv->drm.struct_mutex);
+        _clear_vgpu_fence(vgpu);
         for (i = 0; i < vgpu_fence_sz(vgpu); i++) {
                 reg = vgpu->fence.regs[i];
-                intel_vgpu_write_fence(vgpu, i, 0);
                 list_add_tail(&reg->link,
                               &dev_priv->mm.fence_list);
         }
@@ -208,13 +209,14 @@ static int alloc_vgpu_fence(struct intel_vgpu *vgpu)
                         continue;
                 list_del(pos);
                 vgpu->fence.regs[i] = reg;
-                intel_vgpu_write_fence(vgpu, i, 0);
                 if (++i == vgpu_fence_sz(vgpu))
                         break;
         }
         if (i != vgpu_fence_sz(vgpu))
                 goto out_free_fence;
 
+        _clear_vgpu_fence(vgpu);
+
         mutex_unlock(&dev_priv->drm.struct_mutex);
         intel_runtime_pm_put(dev_priv);
         return 0;
@@ -314,6 +316,22 @@ void intel_vgpu_free_resource(struct intel_vgpu *vgpu)
 }
 
 /**
+ * intel_vgpu_reset_resource - reset resource state owned by a vGPU
+ * @vgpu: a vGPU
+ *
+ * This function is used to reset resource state owned by a vGPU.
+ *
+ */
+void intel_vgpu_reset_resource(struct intel_vgpu *vgpu)
+{
+        struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
+
+        intel_runtime_pm_get(dev_priv);
+        _clear_vgpu_fence(vgpu);
+        intel_runtime_pm_put(dev_priv);
+}
+
+/**
  * intel_alloc_vgpu_resource - allocate HW resource for a vGPU
  * @vgpu: vGPU
  * @param: vGPU creation params
diff --git a/drivers/gpu/drm/i915/gvt/cfg_space.c b/drivers/gpu/drm/i915/gvt/cfg_space.c
index 711c31c8d8b4..4a6a2ed65732 100644
--- a/drivers/gpu/drm/i915/gvt/cfg_space.c
+++ b/drivers/gpu/drm/i915/gvt/cfg_space.c
@@ -282,3 +282,77 @@ int intel_vgpu_emulate_cfg_write(struct intel_vgpu *vgpu, unsigned int offset,
         }
         return 0;
 }
+
+/**
+ * intel_vgpu_init_cfg_space - init vGPU configuration space when create vGPU
+ *
+ * @vgpu: a vGPU
+ * @primary: is the vGPU presented as primary
+ *
+ */
+void intel_vgpu_init_cfg_space(struct intel_vgpu *vgpu,
+                               bool primary)
+{
+        struct intel_gvt *gvt = vgpu->gvt;
+        const struct intel_gvt_device_info *info = &gvt->device_info;
+        u16 *gmch_ctl;
+        int i;
+
+        memcpy(vgpu_cfg_space(vgpu), gvt->firmware.cfg_space,
+               info->cfg_space_size);
+
+        if (!primary) {
+                vgpu_cfg_space(vgpu)[PCI_CLASS_DEVICE] =
+                        INTEL_GVT_PCI_CLASS_VGA_OTHER;
+                vgpu_cfg_space(vgpu)[PCI_CLASS_PROG] =
+                        INTEL_GVT_PCI_CLASS_VGA_OTHER;
+        }
+
+        /* Show guest that there isn't any stolen memory.*/
+        gmch_ctl = (u16 *)(vgpu_cfg_space(vgpu) + INTEL_GVT_PCI_GMCH_CONTROL);
+        *gmch_ctl &= ~(BDW_GMCH_GMS_MASK << BDW_GMCH_GMS_SHIFT);
+
+        intel_vgpu_write_pci_bar(vgpu, PCI_BASE_ADDRESS_2,
+                                 gvt_aperture_pa_base(gvt), true);
+
+        vgpu_cfg_space(vgpu)[PCI_COMMAND] &= ~(PCI_COMMAND_IO
+                                             | PCI_COMMAND_MEMORY
+                                             | PCI_COMMAND_MASTER);
+        /*
+         * Clear the bar upper 32bit and let guest to assign the new value
+         */
+        memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_1, 0, 4);
+        memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_3, 0, 4);
+        memset(vgpu_cfg_space(vgpu) + INTEL_GVT_PCI_OPREGION, 0, 4);
+
+        for (i = 0; i < INTEL_GVT_MAX_BAR_NUM; i++) {
+                vgpu->cfg_space.bar[i].size = pci_resource_len(
+                                              gvt->dev_priv->drm.pdev, i * 2);
+                vgpu->cfg_space.bar[i].tracked = false;
+        }
+}
+
+/**
+ * intel_vgpu_reset_cfg_space - reset vGPU configuration space
+ *
+ * @vgpu: a vGPU
+ *
+ */
+void intel_vgpu_reset_cfg_space(struct intel_vgpu *vgpu)
+{
+        u8 cmd = vgpu_cfg_space(vgpu)[PCI_COMMAND];
+        bool primary = vgpu_cfg_space(vgpu)[PCI_CLASS_DEVICE] !=
+                                INTEL_GVT_PCI_CLASS_VGA_OTHER;
+
+        if (cmd & PCI_COMMAND_MEMORY) {
+                trap_gttmmio(vgpu, false);
+                map_aperture(vgpu, false);
+        }
+
+        /**
+         * Currently we only do such reset when vGPU is not
+         * owned by any VM, so we simply restore entire cfg
+         * space to default value.
+         */
+        intel_vgpu_init_cfg_space(vgpu, primary);
+}
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index d26a092c70e8..e4563984cb1e 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -481,7 +481,6 @@ struct parser_exec_state {
         (s->vgpu->gvt->device_info.gmadr_bytes_in_cmd >> 2)
 
 static unsigned long bypass_scan_mask = 0;
-static bool bypass_batch_buffer_scan = true;
 
 /* ring ALL, type = 0 */
 static struct sub_op_bits sub_op_mi[] = {
@@ -1525,9 +1524,6 @@ static int batch_buffer_needs_scan(struct parser_exec_state *s)
 {
         struct intel_gvt *gvt = s->vgpu->gvt;
 
-        if (bypass_batch_buffer_scan)
-                return 0;
-
         if (IS_BROADWELL(gvt->dev_priv) || IS_SKYLAKE(gvt->dev_priv)) {
                 /* BDW decides privilege based on address space */
                 if (cmd_val(s, 0) & (1 << 8))
diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c
index f32bb6f6495c..34083731669d 100644
--- a/drivers/gpu/drm/i915/gvt/execlist.c
+++ b/drivers/gpu/drm/i915/gvt/execlist.c
@@ -364,58 +364,30 @@ static void free_workload(struct intel_vgpu_workload *workload)
 #define get_desc_from_elsp_dwords(ed, i) \
         ((struct execlist_ctx_descriptor_format *)&((ed)->data[i * 2]))
 
-
-#define BATCH_BUFFER_ADDR_MASK ((1UL << 32) - (1U << 2))
-#define BATCH_BUFFER_ADDR_HIGH_MASK ((1UL << 16) - (1U))
-static int set_gma_to_bb_cmd(struct intel_shadow_bb_entry *entry_obj,
-                             unsigned long add, int gmadr_bytes)
-{
-        if (WARN_ON(gmadr_bytes != 4 && gmadr_bytes != 8))
-                return -1;
-
-        *((u32 *)(entry_obj->bb_start_cmd_va + (1 << 2))) = add &
-                BATCH_BUFFER_ADDR_MASK;
-        if (gmadr_bytes == 8) {
-                *((u32 *)(entry_obj->bb_start_cmd_va + (2 << 2))) =
-                        add & BATCH_BUFFER_ADDR_HIGH_MASK;
-        }
-
-        return 0;
-}
-
 static void prepare_shadow_batch_buffer(struct intel_vgpu_workload *workload)
 {
-        int gmadr_bytes = workload->vgpu->gvt->device_info.gmadr_bytes_in_cmd;
+        const int gmadr_bytes = workload->vgpu->gvt->device_info.gmadr_bytes_in_cmd;
+        struct intel_shadow_bb_entry *entry_obj;
 
         /* pin the gem object to ggtt */
-        if (!list_empty(&workload->shadow_bb)) {
-                struct intel_shadow_bb_entry *entry_obj =
-                        list_first_entry(&workload->shadow_bb,
-                                         struct intel_shadow_bb_entry,
-                                         list);
-                struct intel_shadow_bb_entry *temp;
+        list_for_each_entry(entry_obj, &workload->shadow_bb, list) {
+                struct i915_vma *vma;
 
-                list_for_each_entry_safe(entry_obj, temp, &workload->shadow_bb,
-                                list) {
-                        struct i915_vma *vma;
-
-                        vma = i915_gem_object_ggtt_pin(entry_obj->obj, NULL, 0,
-                                                       4, 0);
-                        if (IS_ERR(vma)) {
-                                gvt_err("Cannot pin\n");
-                                return;
-                        }
-
-                        /* FIXME: we are not tracking our pinned VMA leaving it
-                         * up to the core to fix up the stray pin_count upon
-                         * free.
-                         */
-
-                        /* update the relocate gma with shadow batch buffer*/
-                        set_gma_to_bb_cmd(entry_obj,
-                                          i915_ggtt_offset(vma),
-                                          gmadr_bytes);
+                vma = i915_gem_object_ggtt_pin(entry_obj->obj, NULL, 0, 4, 0);
+                if (IS_ERR(vma)) {
+                        gvt_err("Cannot pin\n");
+                        return;
                 }
+
+                /* FIXME: we are not tracking our pinned VMA leaving it
+                 * up to the core to fix up the stray pin_count upon
+                 * free.
+                 */
+
+                /* update the relocate gma with shadow batch buffer*/
+                entry_obj->bb_start_cmd_va[1] = i915_ggtt_offset(vma);
+                if (gmadr_bytes == 8)
+                        entry_obj->bb_start_cmd_va[2] = 0;
         }
 }
 
@@ -826,7 +798,7 @@ int intel_vgpu_init_execlist(struct intel_vgpu *vgpu)
                 INIT_LIST_HEAD(&vgpu->workload_q_head[i]);
         }
 
-        vgpu->workloads = kmem_cache_create("gvt-g vgpu workload",
+        vgpu->workloads = kmem_cache_create("gvt-g_vgpu_workload",
                         sizeof(struct intel_vgpu_workload), 0,
                         SLAB_HWCACHE_ALIGN,
                         NULL);
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 6c5fdf5b2ce2..47dec4acf7ff 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -240,15 +240,8 @@ static inline int get_pse_type(int type)
 static u64 read_pte64(struct drm_i915_private *dev_priv, unsigned long index)
 {
         void __iomem *addr = (gen8_pte_t __iomem *)dev_priv->ggtt.gsm + index;
-        u64 pte;
 
-#ifdef readq
-        pte = readq(addr);
-#else
-        pte = ioread32(addr);
-        pte |= (u64)ioread32(addr + 4) << 32;
-#endif
-        return pte;
+        return readq(addr);
 }
 
 static void write_pte64(struct drm_i915_private *dev_priv,
@@ -256,12 +249,8 @@ static void write_pte64(struct drm_i915_private *dev_priv,
 {
         void __iomem *addr = (gen8_pte_t __iomem *)dev_priv->ggtt.gsm + index;
 
-#ifdef writeq
         writeq(pte, addr);
-#else
-        iowrite32((u32)pte, addr);
-        iowrite32(pte >> 32, addr + 4);
-#endif
+
         I915_WRITE(GFX_FLSH_CNTL_GEN6, GFX_FLSH_CNTL_EN);
         POSTING_READ(GFX_FLSH_CNTL_GEN6);
 }
@@ -1380,8 +1369,7 @@ static int gen8_mm_alloc_page_table(struct intel_vgpu_mm *mm)
                         info->gtt_entry_size;
                 mem = kzalloc(mm->has_shadow_page_table ?
                         mm->page_table_entry_size * 2
-                                : mm->page_table_entry_size,
-                        GFP_ATOMIC);
+                                : mm->page_table_entry_size, GFP_KERNEL);
                 if (!mem)
                         return -ENOMEM;
                 mm->virtual_page_table = mem;
@@ -1532,7 +1520,7 @@ struct intel_vgpu_mm *intel_vgpu_create_mm(struct intel_vgpu *vgpu,
         struct intel_vgpu_mm *mm;
         int ret;
 
-        mm = kzalloc(sizeof(*mm), GFP_ATOMIC);
+        mm = kzalloc(sizeof(*mm), GFP_KERNEL);
         if (!mm) {
                 ret = -ENOMEM;
                 goto fail;
@@ -1886,30 +1874,27 @@ static int alloc_scratch_pages(struct intel_vgpu *vgpu,
         struct intel_gvt_gtt_pte_ops *ops = vgpu->gvt->gtt.pte_ops;
         int page_entry_num = GTT_PAGE_SIZE >>
                                 vgpu->gvt->device_info.gtt_entry_size_shift;
-        struct page *scratch_pt;
+        void *scratch_pt;
         unsigned long mfn;
         int i;
-        void *p;
 
         if (WARN_ON(type < GTT_TYPE_PPGTT_PTE_PT || type >= GTT_TYPE_MAX))
                 return -EINVAL;
 
-        scratch_pt = alloc_page(GFP_KERNEL | GFP_ATOMIC | __GFP_ZERO);
+        scratch_pt = (void *)get_zeroed_page(GFP_KERNEL);
         if (!scratch_pt) {
                 gvt_err("fail to allocate scratch page\n");
                 return -ENOMEM;
         }
 
-        p = kmap_atomic(scratch_pt);
-        mfn = intel_gvt_hypervisor_virt_to_mfn(p);
+        mfn = intel_gvt_hypervisor_virt_to_mfn(scratch_pt);
         if (mfn == INTEL_GVT_INVALID_ADDR) {
-                gvt_err("fail to translate vaddr:0x%llx\n", (u64)p);
-                kunmap_atomic(p);
-                __free_page(scratch_pt);
+                gvt_err("fail to translate vaddr:0x%lx\n", (unsigned long)scratch_pt);
+                free_page((unsigned long)scratch_pt);
                 return -EFAULT;
         }
         gtt->scratch_pt[type].page_mfn = mfn;
-        gtt->scratch_pt[type].page = scratch_pt;
+        gtt->scratch_pt[type].page = virt_to_page(scratch_pt);
         gvt_dbg_mm("vgpu%d create scratch_pt: type %d mfn=0x%lx\n",
                         vgpu->id, type, mfn);
 
@@ -1918,7 +1903,7 @@ static int alloc_scratch_pages(struct intel_vgpu *vgpu,
          * scratch_pt[type] indicate the scratch pt/scratch page used by the
          * 'type' pt.
          * e.g. scratch_pt[GTT_TYPE_PPGTT_PDE_PT] is used by
-         * GTT_TYPE_PPGTT_PDE_PT level pt, that means this scatch_pt it self
+         * GTT_TYPE_PPGTT_PDE_PT level pt, that means this scratch_pt it self
          * is GTT_TYPE_PPGTT_PTE_PT, and full filled by scratch page mfn.
          */
         if (type > GTT_TYPE_PPGTT_PTE_PT && type < GTT_TYPE_MAX) {
@@ -1936,11 +1921,9 @@ static int alloc_scratch_pages(struct intel_vgpu *vgpu,
                         se.val64 |= PPAT_CACHED_INDEX;
 
                 for (i = 0; i < page_entry_num; i++)
-                        ops->set_entry(p, &se, i, false, 0, vgpu);
+                        ops->set_entry(scratch_pt, &se, i, false, 0, vgpu);
         }
 
-        kunmap_atomic(p);
-
         return 0;
 }
 
@@ -2208,7 +2191,7 @@ int intel_vgpu_g2v_destroy_ppgtt_mm(struct intel_vgpu *vgpu,
 int intel_gvt_init_gtt(struct intel_gvt *gvt)
 {
         int ret;
-        void *page_addr;
+        void *page;
 
         gvt_dbg_core("init gtt\n");
 
@@ -2221,17 +2204,14 @@ int intel_gvt_init_gtt(struct intel_gvt *gvt)
                 return -ENODEV;
         }
 
-        gvt->gtt.scratch_ggtt_page =
-                alloc_page(GFP_KERNEL | GFP_ATOMIC | __GFP_ZERO);
-        if (!gvt->gtt.scratch_ggtt_page) {
+        page = (void *)get_zeroed_page(GFP_KERNEL);
+        if (!page) {
                 gvt_err("fail to allocate scratch ggtt page\n");
                 return -ENOMEM;
         }
+        gvt->gtt.scratch_ggtt_page = virt_to_page(page);
 
-        page_addr = page_address(gvt->gtt.scratch_ggtt_page);
-
-        gvt->gtt.scratch_ggtt_mfn =
-                intel_gvt_hypervisor_virt_to_mfn(page_addr);
+        gvt->gtt.scratch_ggtt_mfn = intel_gvt_hypervisor_virt_to_mfn(page);
         if (gvt->gtt.scratch_ggtt_mfn == INTEL_GVT_INVALID_ADDR) {
                 gvt_err("fail to translate scratch ggtt page\n");
                 __free_page(gvt->gtt.scratch_ggtt_page);
@@ -2297,3 +2277,30 @@ void intel_vgpu_reset_ggtt(struct intel_vgpu *vgpu)
         for (offset = 0; offset < num_entries; offset++)
                 ops->set_entry(NULL, &e, index + offset, false, 0, vgpu);
 }
+
+/**
+ * intel_vgpu_reset_gtt - reset the all GTT related status
+ * @vgpu: a vGPU
+ * @dmlr: true for vGPU Device Model Level Reset, false for GT Reset
+ *
+ * This function is called from vfio core to reset reset all
+ * GTT related status, including GGTT, PPGTT, scratch page.
+ *
+ */
+void intel_vgpu_reset_gtt(struct intel_vgpu *vgpu, bool dmlr)
+{
+        int i;
+
+        ppgtt_free_all_shadow_page(vgpu);
+        if (!dmlr)
+                return;
+
+        intel_vgpu_reset_ggtt(vgpu);
+
+        /* clear scratch page for security */
+        for (i = GTT_TYPE_PPGTT_PTE_PT; i < GTT_TYPE_MAX; i++) {
+                if (vgpu->gtt.scratch_pt[i].page != NULL)
+                        memset(page_address(vgpu->gtt.scratch_pt[i].page),
+                                0, PAGE_SIZE);
+        }
+}
diff --git a/drivers/gpu/drm/i915/gvt/gtt.h b/drivers/gpu/drm/i915/gvt/gtt.h
index b315ab3593ec..f88eb5e89bea 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.h
+++ b/drivers/gpu/drm/i915/gvt/gtt.h
@@ -208,6 +208,7 @@ extern void intel_vgpu_clean_gtt(struct intel_vgpu *vgpu);
 void intel_vgpu_reset_ggtt(struct intel_vgpu *vgpu);
 
 extern int intel_gvt_init_gtt(struct intel_gvt *gvt);
+extern void intel_vgpu_reset_gtt(struct intel_vgpu *vgpu, bool dmlr);
 extern void intel_gvt_clean_gtt(struct intel_gvt *gvt);
 
 extern struct intel_vgpu_mm *intel_gvt_find_ppgtt_mm(struct intel_vgpu *vgpu,
diff --git a/drivers/gpu/drm/i915/gvt/gvt.c b/drivers/gpu/drm/i915/gvt/gvt.c
index 398877c3d2fd..e6bf5c533fbe 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.c
+++ b/drivers/gpu/drm/i915/gvt/gvt.c
@@ -201,6 +201,8 @@ void intel_gvt_clean_device(struct drm_i915_private *dev_priv)
         intel_gvt_hypervisor_host_exit(&dev_priv->drm.pdev->dev, gvt);
         intel_gvt_clean_vgpu_types(gvt);
 
+        idr_destroy(&gvt->vgpu_idr);
+
         kfree(dev_priv->gvt);
         dev_priv->gvt = NULL;
 }
@@ -237,6 +239,8 @@ int intel_gvt_init_device(struct drm_i915_private *dev_priv)
 
         gvt_dbg_core("init gvt device\n");
 
+        idr_init(&gvt->vgpu_idr);
+
         mutex_init(&gvt->lock);
         gvt->dev_priv = dev_priv;
 
@@ -244,7 +248,7 @@ int intel_gvt_init_device(struct drm_i915_private *dev_priv)
 
         ret = intel_gvt_setup_mmio_info(gvt);
         if (ret)
-                return ret;
+                goto out_clean_idr;
 
         ret = intel_gvt_load_firmware(gvt);
         if (ret)
@@ -313,6 +317,8 @@ out_free_firmware:
         intel_gvt_free_firmware(gvt);
 out_clean_mmio_info:
         intel_gvt_clean_mmio_info(gvt);
+out_clean_idr:
+        idr_destroy(&gvt->vgpu_idr);
         kfree(gvt);
         return ret;
 }
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index 0af17016f33f..e227caf5859e 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -323,6 +323,7 @@ struct intel_vgpu_creation_params {
 
 int intel_vgpu_alloc_resource(struct intel_vgpu *vgpu,
                               struct intel_vgpu_creation_params *param);
+void intel_vgpu_reset_resource(struct intel_vgpu *vgpu);
 void intel_vgpu_free_resource(struct intel_vgpu *vgpu);
 void intel_vgpu_write_fence(struct intel_vgpu *vgpu,
         u32 fence, u64 value);
@@ -375,6 +376,8 @@ void intel_gvt_clean_vgpu_types(struct intel_gvt *gvt);
 struct intel_vgpu *intel_gvt_create_vgpu(struct intel_gvt *gvt,
                                          struct intel_vgpu_type *type);
 void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu);
+void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
+                                 unsigned int engine_mask);
 void intel_gvt_reset_vgpu(struct intel_vgpu *vgpu);
 
 
@@ -411,6 +414,10 @@ int intel_gvt_ggtt_index_g2h(struct intel_vgpu *vgpu, unsigned long g_index,
 int intel_gvt_ggtt_h2g_index(struct intel_vgpu *vgpu, unsigned long h_index,
                              unsigned long *g_index);
 
+void intel_vgpu_init_cfg_space(struct intel_vgpu *vgpu,
+                bool primary);
+void intel_vgpu_reset_cfg_space(struct intel_vgpu *vgpu);
+
 int intel_vgpu_emulate_cfg_read(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes);
 
@@ -424,7 +431,6 @@ void intel_vgpu_clean_opregion(struct intel_vgpu *vgpu);
 int intel_vgpu_init_opregion(struct intel_vgpu *vgpu, u32 gpa);
 
 int intel_vgpu_emulate_opregion_request(struct intel_vgpu *vgpu, u32 swsci);
-int setup_vgpu_mmio(struct intel_vgpu *vgpu);
 void populate_pvinfo_page(struct intel_vgpu *vgpu);
 
 struct intel_gvt_ops {
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 522809710312..ab2ea157da4c 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -93,7 +93,8 @@ static void write_vreg(struct intel_vgpu *vgpu, unsigned int offset,
 static int new_mmio_info(struct intel_gvt *gvt,
                 u32 offset, u32 flags, u32 size,
                 u32 addr_mask, u32 ro_mask, u32 device,
-                void *read, void *write)
+                int (*read)(struct intel_vgpu *, unsigned int, void *, unsigned int),
+                int (*write)(struct intel_vgpu *, unsigned int, void *, unsigned int))
 {
         struct intel_gvt_mmio_info *info, *p;
         u32 start, end, i;
@@ -219,7 +220,7 @@ static int mul_force_wake_write(struct intel_vgpu *vgpu,
                 default:
                         /*should not hit here*/
                         gvt_err("invalid forcewake offset 0x%x\n", offset);
-                        return 1;
+                        return -EINVAL;
                 }
         } else {
                 ack_reg_offset = FORCEWAKE_ACK_HSW_REG;
@@ -230,77 +231,45 @@ static int mul_force_wake_write(struct intel_vgpu *vgpu,
         return 0;
 }
 
-static int handle_device_reset(struct intel_vgpu *vgpu, unsigned int offset,
-                void *p_data, unsigned int bytes, unsigned long bitmap)
-{
-        struct intel_gvt_workload_scheduler *scheduler =
-                &vgpu->gvt->scheduler;
-
-        vgpu->resetting = true;
-
-        intel_vgpu_stop_schedule(vgpu);
-        /*
-         * The current_vgpu will set to NULL after stopping the
-         * scheduler when the reset is triggered by current vgpu.
-         */
-        if (scheduler->current_vgpu == NULL) {
-                mutex_unlock(&vgpu->gvt->lock);
-                intel_gvt_wait_vgpu_idle(vgpu);
-                mutex_lock(&vgpu->gvt->lock);
-        }
-
-        intel_vgpu_reset_execlist(vgpu, bitmap);
-
-        /* full GPU reset */
-        if (bitmap == 0xff) {
-                mutex_unlock(&vgpu->gvt->lock);
-                intel_vgpu_clean_gtt(vgpu);
-                mutex_lock(&vgpu->gvt->lock);
-                setup_vgpu_mmio(vgpu);
-                populate_pvinfo_page(vgpu);
-                intel_vgpu_init_gtt(vgpu);
-        }
-
-        vgpu->resetting = false;
-
-        return 0;
-}
-
 static int gdrst_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
-                void *p_data, unsigned int bytes)
+                            void *p_data, unsigned int bytes)
 {
+        unsigned int engine_mask = 0;
         u32 data;
-        u64 bitmap = 0;
 
         write_vreg(vgpu, offset, p_data, bytes);
         data = vgpu_vreg(vgpu, offset);
 
         if (data & GEN6_GRDOM_FULL) {
                 gvt_dbg_mmio("vgpu%d: request full GPU reset\n", vgpu->id);
-                bitmap = 0xff;
-        }
-        if (data & GEN6_GRDOM_RENDER) {
-                gvt_dbg_mmio("vgpu%d: request RCS reset\n", vgpu->id);
-                bitmap |= (1 << RCS);
-        }
-        if (data & GEN6_GRDOM_MEDIA) {
-                gvt_dbg_mmio("vgpu%d: request VCS reset\n", vgpu->id);
-                bitmap |= (1 << VCS);
-        }
-        if (data & GEN6_GRDOM_BLT) {
-                gvt_dbg_mmio("vgpu%d: request BCS Reset\n", vgpu->id);
-                bitmap |= (1 << BCS);
-        }
-        if (data & GEN6_GRDOM_VECS) {
-                gvt_dbg_mmio("vgpu%d: request VECS Reset\n", vgpu->id);
-                bitmap |= (1 << VECS);
-        }
-        if (data & GEN8_GRDOM_MEDIA2) {
-                gvt_dbg_mmio("vgpu%d: request VCS2 Reset\n", vgpu->id);
-                if (HAS_BSD2(vgpu->gvt->dev_priv))
-                        bitmap |= (1 << VCS2);
+                engine_mask = ALL_ENGINES;
+        } else {
+                if (data & GEN6_GRDOM_RENDER) {
+                        gvt_dbg_mmio("vgpu%d: request RCS reset\n", vgpu->id);
+                        engine_mask |= (1 << RCS);
+                }
+                if (data & GEN6_GRDOM_MEDIA) {
+                        gvt_dbg_mmio("vgpu%d: request VCS reset\n", vgpu->id);
+                        engine_mask |= (1 << VCS);
+                }
+                if (data & GEN6_GRDOM_BLT) {
+                        gvt_dbg_mmio("vgpu%d: request BCS Reset\n", vgpu->id);
+                        engine_mask |= (1 << BCS);
+                }
+                if (data & GEN6_GRDOM_VECS) {
+                        gvt_dbg_mmio("vgpu%d: request VECS Reset\n", vgpu->id);
+                        engine_mask |= (1 << VECS);
+                }
+                if (data & GEN8_GRDOM_MEDIA2) {
+                        gvt_dbg_mmio("vgpu%d: request VCS2 Reset\n", vgpu->id);
+                        if (HAS_BSD2(vgpu->gvt->dev_priv))
+                                engine_mask |= (1 << VCS2);
+                }
         }
-        return handle_device_reset(vgpu, offset, p_data, bytes, bitmap);
+
+        intel_gvt_reset_vgpu_locked(vgpu, false, engine_mask);
+
+        return 0;
 }
 
 static int gmbus_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
@@ -974,7 +943,7 @@ static int sbi_data_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
         return 0;
 }
 
-static bool sbi_ctl_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
+static int sbi_ctl_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes)
 {
         u32 data;
@@ -1366,7 +1335,6 @@ static int ring_mode_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
 static int gvt_reg_tlb_control_handler(struct intel_vgpu *vgpu,
                 unsigned int offset, void *p_data, unsigned int bytes)
 {
-        int rc = 0;
         unsigned int id = 0;
 
         write_vreg(vgpu, offset, p_data, bytes);
@@ -1389,12 +1357,11 @@ static int gvt_reg_tlb_control_handler(struct intel_vgpu *vgpu,
                 id = VECS;
                 break;
         default:
-                rc = -EINVAL;
-                break;
+                return -EINVAL;
         }
         set_bit(id, (void *)vgpu->tlb_handle_pending);
 
-        return rc;
+        return 0;
 }
 
 static int ring_reset_ctl_write(struct intel_vgpu *vgpu,
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index faaae07ae487..3f656e3a6e5a 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -230,8 +230,8 @@ static struct intel_vgpu_type *intel_gvt_find_vgpu_type(struct intel_gvt *gvt,
         return NULL;
 }
 
-static ssize_t available_instance_show(struct kobject *kobj, struct device *dev,
-                char *buf)
+static ssize_t available_instances_show(struct kobject *kobj,
+                                        struct device *dev, char *buf)
 {
         struct intel_vgpu_type *type;
         unsigned int num = 0;
@@ -269,12 +269,12 @@ static ssize_t description_show(struct kobject *kobj, struct device *dev,
                                 type->fence);
 }
 
-static MDEV_TYPE_ATTR_RO(available_instance);
+static MDEV_TYPE_ATTR_RO(available_instances);
 static MDEV_TYPE_ATTR_RO(device_api);
 static MDEV_TYPE_ATTR_RO(description);
 
 static struct attribute *type_attrs[] = {
-        &mdev_type_attr_available_instance.attr,
+        &mdev_type_attr_available_instances.attr,
         &mdev_type_attr_device_api.attr,
         &mdev_type_attr_description.attr,
         NULL,
@@ -398,6 +398,7 @@ static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
         struct intel_vgpu_type *type;
         struct device *pdev;
         void *gvt;
+        int ret;
 
         pdev = mdev_parent_dev(mdev);
         gvt = kdev_to_i915(pdev)->gvt;
@@ -406,13 +407,15 @@ static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
         if (!type) {
                 gvt_err("failed to find type %s to create\n",
                                                 kobject_name(kobj));
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
         }
 
         vgpu = intel_gvt_ops->vgpu_create(gvt, type);
         if (IS_ERR_OR_NULL(vgpu)) {
-                gvt_err("create intel vgpu failed\n");
-                return -EINVAL;
+                ret = vgpu == NULL ? -EFAULT : PTR_ERR(vgpu);
+                gvt_err("failed to create intel vgpu: %d\n", ret);
+                goto out;
         }
 
         INIT_WORK(&vgpu->vdev.release_work, intel_vgpu_release_work);
@@ -422,7 +425,10 @@ static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
 
         gvt_dbg_core("intel_vgpu_create succeeded for mdev: %s\n",
                      dev_name(mdev_dev(mdev)));
-        return 0;
+        ret = 0;
+
+out:
+        return ret;
 }
 
 static int intel_vgpu_remove(struct mdev_device *mdev)
diff --git a/drivers/gpu/drm/i915/gvt/mmio.c b/drivers/gpu/drm/i915/gvt/mmio.c
index 09c9450a1946..4df078bc5d04 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.c
+++ b/drivers/gpu/drm/i915/gvt/mmio.c
@@ -125,25 +125,12 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
         if (WARN_ON(!reg_is_mmio(gvt, offset + bytes - 1)))
                 goto err;
 
-        mmio = intel_gvt_find_mmio_info(gvt, rounddown(offset, 4));
-        if (!mmio && !vgpu->mmio.disable_warn_untrack) {
-                gvt_err("vgpu%d: read untracked MMIO %x len %d val %x\n",
-                                vgpu->id, offset, bytes, *(u32 *)p_data);
-
-                if (offset == 0x206c) {
-                        gvt_err("------------------------------------------\n");
-                        gvt_err("vgpu%d: likely triggers a gfx reset\n",
-                        vgpu->id);
-                        gvt_err("------------------------------------------\n");
-                        vgpu->mmio.disable_warn_untrack = true;
-                }
-        }
-
         if (!intel_gvt_mmio_is_unalign(gvt, offset)) {
                 if (WARN_ON(!IS_ALIGNED(offset, bytes)))
                         goto err;
         }
 
+        mmio = intel_gvt_find_mmio_info(gvt, rounddown(offset, 4));
         if (mmio) {
                 if (!intel_gvt_mmio_is_unalign(gvt, mmio->offset)) {
                         if (WARN_ON(offset + bytes > mmio->offset + mmio->size))
@@ -152,9 +139,23 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
                                 goto err;
                 }
                 ret = mmio->read(vgpu, offset, p_data, bytes);
-        } else
+        } else {
                 ret = intel_vgpu_default_mmio_read(vgpu, offset, p_data, bytes);
 
+                if (!vgpu->mmio.disable_warn_untrack) {
+                        gvt_err("vgpu%d: read untracked MMIO %x(%dB) val %x\n",
+                                vgpu->id, offset, bytes, *(u32 *)p_data);
+
+                        if (offset == 0x206c) {
+                                gvt_err("------------------------------------------\n");
+                                gvt_err("vgpu%d: likely triggers a gfx reset\n",
+                                        vgpu->id);
+                                gvt_err("------------------------------------------\n");
+                                vgpu->mmio.disable_warn_untrack = true;
+                        }
+                }
+        }
+
         if (ret)
                 goto err;
 
@@ -302,3 +303,56 @@ err:
         mutex_unlock(&gvt->lock);
         return ret;
 }
+
+
+/**
+ * intel_vgpu_reset_mmio - reset virtual MMIO space
+ * @vgpu: a vGPU
+ *
+ */
+void intel_vgpu_reset_mmio(struct intel_vgpu *vgpu)
+{
+        struct intel_gvt *gvt = vgpu->gvt;
+        const struct intel_gvt_device_info *info = &gvt->device_info;
+
+        memcpy(vgpu->mmio.vreg, gvt->firmware.mmio, info->mmio_size);
+        memcpy(vgpu->mmio.sreg, gvt->firmware.mmio, info->mmio_size);
+
+        vgpu_vreg(vgpu, GEN6_GT_THREAD_STATUS_REG) = 0;
+
+        /* set the bit 0:2(Core C-State ) to C0 */
+        vgpu_vreg(vgpu, GEN6_GT_CORE_STATUS) = 0;
+}
+
+/**
+ * intel_vgpu_init_mmio - init MMIO  space
+ * @vgpu: a vGPU
+ *
+ * Returns:
+ * Zero on success, negative error code if failed
+ */
+int intel_vgpu_init_mmio(struct intel_vgpu *vgpu)
+{
+        const struct intel_gvt_device_info *info = &vgpu->gvt->device_info;
+
+        vgpu->mmio.vreg = vzalloc(info->mmio_size * 2);
+        if (!vgpu->mmio.vreg)
+                return -ENOMEM;
+
+        vgpu->mmio.sreg = vgpu->mmio.vreg + info->mmio_size;
+
+        intel_vgpu_reset_mmio(vgpu);
+
+        return 0;
+}
+
+/**
+ * intel_vgpu_clean_mmio - clean MMIO space
+ * @vgpu: a vGPU
+ *
+ */
+void intel_vgpu_clean_mmio(struct intel_vgpu *vgpu)
+{
+        vfree(vgpu->mmio.vreg);
+        vgpu->mmio.vreg = vgpu->mmio.sreg = NULL;
+}
diff --git a/drivers/gpu/drm/i915/gvt/mmio.h b/drivers/gpu/drm/i915/gvt/mmio.h
index 87d5b5e366a3..3bc620f56f35 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.h
+++ b/drivers/gpu/drm/i915/gvt/mmio.h
@@ -86,6 +86,10 @@ struct intel_gvt_mmio_info *intel_gvt_find_mmio_info(struct intel_gvt *gvt,
         *offset; \
 })
 
+int intel_vgpu_init_mmio(struct intel_vgpu *vgpu);
+void intel_vgpu_reset_mmio(struct intel_vgpu *vgpu);
+void intel_vgpu_clean_mmio(struct intel_vgpu *vgpu);
+
 int intel_vgpu_gpa_to_mmio_offset(struct intel_vgpu *vgpu, u64 gpa);
 
 int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, u64 pa,
diff --git a/drivers/gpu/drm/i915/gvt/opregion.c b/drivers/gpu/drm/i915/gvt/opregion.c
index 81cd921770c6..d9fb41ab7119 100644
--- a/drivers/gpu/drm/i915/gvt/opregion.c
+++ b/drivers/gpu/drm/i915/gvt/opregion.c
@@ -36,9 +36,9 @@ static int init_vgpu_opregion(struct intel_vgpu *vgpu, u32 gpa)
                         vgpu->id))
                 return -EINVAL;
 
-        vgpu_opregion(vgpu)->va = (void *)__get_free_pages(GFP_ATOMIC |
-                        GFP_DMA32 | __GFP_ZERO,
-                        INTEL_GVT_OPREGION_PORDER);
+        vgpu_opregion(vgpu)->va = (void *)__get_free_pages(GFP_KERNEL |
+                        __GFP_ZERO,
+                        get_order(INTEL_GVT_OPREGION_SIZE));
 
         if (!vgpu_opregion(vgpu)->va)
                 return -ENOMEM;
@@ -97,7 +97,7 @@ void intel_vgpu_clean_opregion(struct intel_vgpu *vgpu)
         if (intel_gvt_host.hypervisor_type == INTEL_GVT_HYPERVISOR_XEN) {
                 map_vgpu_opregion(vgpu, false);
                 free_pages((unsigned long)vgpu_opregion(vgpu)->va,
-                                INTEL_GVT_OPREGION_PORDER);
+                                get_order(INTEL_GVT_OPREGION_SIZE));
 
                 vgpu_opregion(vgpu)->va = NULL;
         }
diff --git a/drivers/gpu/drm/i915/gvt/reg.h b/drivers/gpu/drm/i915/gvt/reg.h
index 0dfe789d8f02..fbd023a16f18 100644
--- a/drivers/gpu/drm/i915/gvt/reg.h
+++ b/drivers/gpu/drm/i915/gvt/reg.h
@@ -50,8 +50,7 @@
 #define INTEL_GVT_OPREGION_PARM                   0x204
 
 #define INTEL_GVT_OPREGION_PAGES        2
-#define INTEL_GVT_OPREGION_PORDER       1
-#define INTEL_GVT_OPREGION_SIZE         (2 * 4096)
+#define INTEL_GVT_OPREGION_SIZE         (INTEL_GVT_OPREGION_PAGES * PAGE_SIZE)
 
 #define VGT_SPRSTRIDE(pipe)     _PIPE(pipe, _SPRA_STRIDE, _PLANE_STRIDE_2_B)
 
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 4db242250235..e91885dffeff 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -350,13 +350,15 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
 {
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct intel_vgpu_workload *workload;
+        struct intel_vgpu *vgpu;
         int event;
 
         mutex_lock(&gvt->lock);
 
         workload = scheduler->current_workload[ring_id];
+        vgpu = workload->vgpu;
 
-        if (!workload->status && !workload->vgpu->resetting) {
+        if (!workload->status && !vgpu->resetting) {
                 wait_event(workload->shadow_ctx_status_wq,
                            !atomic_read(&workload->shadow_ctx_active));
 
@@ -364,8 +366,7 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
 
                 for_each_set_bit(event, workload->pending_events,
                                  INTEL_GVT_EVENT_MAX)
-                        intel_vgpu_trigger_virtual_event(workload->vgpu,
-                                        event);
+                        intel_vgpu_trigger_virtual_event(vgpu, event);
         }
 
         gvt_dbg_sched("ring id %d complete workload %p status %d\n",
@@ -373,11 +374,10 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
 
         scheduler->current_workload[ring_id] = NULL;
 
-        atomic_dec(&workload->vgpu->running_workload_num);
-
         list_del_init(&workload->list);
         workload->complete(workload);
 
+        atomic_dec(&vgpu->running_workload_num);
         wake_up(&scheduler->workload_complete_wq);
         mutex_unlock(&gvt->lock);
 }
@@ -459,11 +459,11 @@ complete:
                 gvt_dbg_sched("will complete workload %p\n, status: %d\n",
                                 workload, workload->status);
 
-                complete_current_workload(gvt, ring_id);
-
                 if (workload->req)
                         i915_gem_request_put(fetch_and_zero(&workload->req));
 
+                complete_current_workload(gvt, ring_id);
+
                 if (need_force_wake)
                         intel_uncore_forcewake_put(gvt->dev_priv,
                                         FORCEWAKE_ALL);
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.h b/drivers/gpu/drm/i915/gvt/scheduler.h
index 3b30c28bff51..2833dfa8c9ae 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.h
+++ b/drivers/gpu/drm/i915/gvt/scheduler.h
@@ -113,7 +113,7 @@ struct intel_shadow_bb_entry {
         struct drm_i915_gem_object *obj;
         void *va;
         unsigned long len;
-        void *bb_start_cmd_va;
+        u32 *bb_start_cmd_va;
 };
 
 #define workload_q_head(vgpu, ring_id) \
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index 536d2b9d5777..7295bc8e12fb 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -35,79 +35,6 @@
 #include "gvt.h"
 #include "i915_pvinfo.h"
 
-static void clean_vgpu_mmio(struct intel_vgpu *vgpu)
-{
-        vfree(vgpu->mmio.vreg);
-        vgpu->mmio.vreg = vgpu->mmio.sreg = NULL;
-}
-
-int setup_vgpu_mmio(struct intel_vgpu *vgpu)
-{
-        struct intel_gvt *gvt = vgpu->gvt;
-        const struct intel_gvt_device_info *info = &gvt->device_info;
-
-        if (vgpu->mmio.vreg)
-                memset(vgpu->mmio.vreg, 0, info->mmio_size * 2);
-        else {
-                vgpu->mmio.vreg = vzalloc(info->mmio_size * 2);
-                if (!vgpu->mmio.vreg)
-                        return -ENOMEM;
-        }
-
-        vgpu->mmio.sreg = vgpu->mmio.vreg + info->mmio_size;
-
-        memcpy(vgpu->mmio.vreg, gvt->firmware.mmio, info->mmio_size);
-        memcpy(vgpu->mmio.sreg, gvt->firmware.mmio, info->mmio_size);
-
-        vgpu_vreg(vgpu, GEN6_GT_THREAD_STATUS_REG) = 0;
-
-        /* set the bit 0:2(Core C-State ) to C0 */
-        vgpu_vreg(vgpu, GEN6_GT_CORE_STATUS) = 0;
-        return 0;
-}
-
-static void setup_vgpu_cfg_space(struct intel_vgpu *vgpu,
-        struct intel_vgpu_creation_params *param)
-{
-        struct intel_gvt *gvt = vgpu->gvt;
-        const struct intel_gvt_device_info *info = &gvt->device_info;
-        u16 *gmch_ctl;
-        int i;
-
-        memcpy(vgpu_cfg_space(vgpu), gvt->firmware.cfg_space,
-               info->cfg_space_size);
-
-        if (!param->primary) {
-                vgpu_cfg_space(vgpu)[PCI_CLASS_DEVICE] =
-                        INTEL_GVT_PCI_CLASS_VGA_OTHER;
-                vgpu_cfg_space(vgpu)[PCI_CLASS_PROG] =
-                        INTEL_GVT_PCI_CLASS_VGA_OTHER;
-        }
-
-        /* Show guest that there isn't any stolen memory.*/
-        gmch_ctl = (u16 *)(vgpu_cfg_space(vgpu) + INTEL_GVT_PCI_GMCH_CONTROL);
-        *gmch_ctl &= ~(BDW_GMCH_GMS_MASK << BDW_GMCH_GMS_SHIFT);
-
-        intel_vgpu_write_pci_bar(vgpu, PCI_BASE_ADDRESS_2,
-                                 gvt_aperture_pa_base(gvt), true);
-
-        vgpu_cfg_space(vgpu)[PCI_COMMAND] &= ~(PCI_COMMAND_IO
-                                             | PCI_COMMAND_MEMORY
-                                             | PCI_COMMAND_MASTER);
-        /*
-         * Clear the bar upper 32bit and let guest to assign the new value
-         */
-        memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_1, 0, 4);
-        memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_3, 0, 4);
-        memset(vgpu_cfg_space(vgpu) + INTEL_GVT_PCI_OPREGION, 0, 4);
-
-        for (i = 0; i < INTEL_GVT_MAX_BAR_NUM; i++) {
-                vgpu->cfg_space.bar[i].size = pci_resource_len(
-                                              gvt->dev_priv->drm.pdev, i * 2);
-                vgpu->cfg_space.bar[i].tracked = false;
-        }
-}
-
 void populate_pvinfo_page(struct intel_vgpu *vgpu)
 {
         /* setup the ballooning information */
@@ -177,7 +104,7 @@ int intel_gvt_init_vgpu_types(struct intel_gvt *gvt)
                 if (low_avail / min_low == 0)
                         break;
                 gvt->types[i].low_gm_size = min_low;
-                gvt->types[i].high_gm_size = 3 * gvt->types[i].low_gm_size;
+                gvt->types[i].high_gm_size = max((min_low<<3), MB_TO_BYTES(384U));
                 gvt->types[i].fence = 4;
                 gvt->types[i].max_instance = low_avail / min_low;
                 gvt->types[i].avail_instance = gvt->types[i].max_instance;
@@ -217,7 +144,7 @@ static void intel_gvt_update_vgpu_types(struct intel_gvt *gvt)
          */
         low_gm_avail = MB_TO_BYTES(256) - HOST_LOW_GM_SIZE -
                 gvt->gm.vgpu_allocated_low_gm_size;
-        high_gm_avail = MB_TO_BYTES(256) * 3 - HOST_HIGH_GM_SIZE -
+        high_gm_avail = MB_TO_BYTES(256) * 8UL - HOST_HIGH_GM_SIZE -
                 gvt->gm.vgpu_allocated_high_gm_size;
         fence_avail = gvt_fence_sz(gvt) - HOST_FENCE -
                 gvt->fence.vgpu_allocated_fence_num;
@@ -268,7 +195,7 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
         intel_vgpu_clean_gtt(vgpu);
         intel_gvt_hypervisor_detach_vgpu(vgpu);
         intel_vgpu_free_resource(vgpu);
-        clean_vgpu_mmio(vgpu);
+        intel_vgpu_clean_mmio(vgpu);
         vfree(vgpu);
 
         intel_gvt_update_vgpu_types(gvt);
@@ -300,11 +227,11 @@ static struct intel_vgpu *__intel_gvt_create_vgpu(struct intel_gvt *gvt,
         vgpu->gvt = gvt;
         bitmap_zero(vgpu->tlb_handle_pending, I915_NUM_ENGINES);
 
-        setup_vgpu_cfg_space(vgpu, param);
+        intel_vgpu_init_cfg_space(vgpu, param->primary);
 
-        ret = setup_vgpu_mmio(vgpu);
+        ret = intel_vgpu_init_mmio(vgpu);
         if (ret)
-                goto out_free_vgpu;
+                goto out_clean_idr;
 
         ret = intel_vgpu_alloc_resource(vgpu, param);
         if (ret)
@@ -354,7 +281,9 @@ out_detach_hypervisor_vgpu:
 out_clean_vgpu_resource:
         intel_vgpu_free_resource(vgpu);
 out_clean_vgpu_mmio:
-        clean_vgpu_mmio(vgpu);
+        intel_vgpu_clean_mmio(vgpu);
+out_clean_idr:
+        idr_remove(&gvt->vgpu_idr, vgpu->id);
 out_free_vgpu:
         vfree(vgpu);
         mutex_unlock(&gvt->lock);
@@ -398,7 +327,75 @@ struct intel_vgpu *intel_gvt_create_vgpu(struct intel_gvt *gvt,
 }
 
 /**
- * intel_gvt_reset_vgpu - reset a virtual GPU
+ * intel_gvt_reset_vgpu_locked - reset a virtual GPU by DMLR or GT reset
+ * @vgpu: virtual GPU
+ * @dmlr: vGPU Device Model Level Reset or GT Reset
+ * @engine_mask: engines to reset for GT reset
+ *
+ * This function is called when user wants to reset a virtual GPU through
+ * device model reset or GT reset. The caller should hold the gvt lock.
+ *
+ * vGPU Device Model Level Reset (DMLR) simulates the PCI level reset to reset
+ * the whole vGPU to default state as when it is created. This vGPU function
+ * is required both for functionary and security concerns.The ultimate goal
+ * of vGPU FLR is that reuse a vGPU instance by virtual machines. When we
+ * assign a vGPU to a virtual machine we must isse such reset first.
+ *
+ * Full GT Reset and Per-Engine GT Reset are soft reset flow for GPU engines
+ * (Render, Blitter, Video, Video Enhancement). It is defined by GPU Spec.
+ * Unlike the FLR, GT reset only reset particular resource of a vGPU per
+ * the reset request. Guest driver can issue a GT reset by programming the
+ * virtual GDRST register to reset specific virtual GPU engine or all
+ * engines.
+ *
+ * The parameter dev_level is to identify if we will do DMLR or GT reset.
+ * The parameter engine_mask is to specific the engines that need to be
+ * resetted. If value ALL_ENGINES is given for engine_mask, it means
+ * the caller requests a full GT reset that we will reset all virtual
+ * GPU engines. For FLR, engine_mask is ignored.
+ */
+void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
+                                 unsigned int engine_mask)
+{
+        struct intel_gvt *gvt = vgpu->gvt;
+        struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
+
+        gvt_dbg_core("------------------------------------------\n");
+        gvt_dbg_core("resseting vgpu%d, dmlr %d, engine_mask %08x\n",
+                     vgpu->id, dmlr, engine_mask);
+        vgpu->resetting = true;
+
+        intel_vgpu_stop_schedule(vgpu);
+        /*
+         * The current_vgpu will set to NULL after stopping the
+         * scheduler when the reset is triggered by current vgpu.
+         */
+        if (scheduler->current_vgpu == NULL) {
+                mutex_unlock(&gvt->lock);
+                intel_gvt_wait_vgpu_idle(vgpu);
+                mutex_lock(&gvt->lock);
+        }
+
+        intel_vgpu_reset_execlist(vgpu, dmlr ? ALL_ENGINES : engine_mask);
+
+        /* full GPU reset or device model level reset */
+        if (engine_mask == ALL_ENGINES || dmlr) {
+                intel_vgpu_reset_gtt(vgpu, dmlr);
+                intel_vgpu_reset_resource(vgpu);
+                intel_vgpu_reset_mmio(vgpu);
+                populate_pvinfo_page(vgpu);
+
+                if (dmlr)
+                        intel_vgpu_reset_cfg_space(vgpu);
+        }
+
+        vgpu->resetting = false;
+        gvt_dbg_core("reset vgpu%d done\n", vgpu->id);
+        gvt_dbg_core("------------------------------------------\n");
+}
+
+/**
+ * intel_gvt_reset_vgpu - reset a virtual GPU (Function Level)
  * @vgpu: virtual GPU
  *
  * This function is called when user wants to reset a virtual GPU.
@@ -406,4 +403,7 @@ struct intel_vgpu *intel_gvt_create_vgpu(struct intel_gvt *gvt,
  */
 void intel_gvt_reset_vgpu(struct intel_vgpu *vgpu)
 {
+        mutex_lock(&vgpu->gvt->lock);
+        intel_gvt_reset_vgpu_locked(vgpu, true, 0);
+        mutex_unlock(&vgpu->gvt->lock);
 }
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 445fec9c2841..b2c4a0b8a627 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -2378,7 +2378,7 @@ static int intel_runtime_suspend(struct device *kdev)
 
         assert_forcewakes_inactive(dev_priv);
 
-        if (!IS_VALLEYVIEW(dev_priv) || !IS_CHERRYVIEW(dev_priv))
+        if (!IS_VALLEYVIEW(dev_priv) && !IS_CHERRYVIEW(dev_priv))
                 intel_hpd_poll_init(dev_priv);
 
         DRM_DEBUG_KMS("Device suspended\n");
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 243224aeabf8..8493e19b563a 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1012,6 +1012,8 @@ struct intel_fbc {
         struct work_struct underrun_work;
 
         struct intel_fbc_state_cache {
+                struct i915_vma *vma;
+
                 struct {
                         unsigned int mode_flags;
                         uint32_t hsw_bdw_pixel_rate;
@@ -1025,15 +1027,14 @@ struct intel_fbc {
                 } plane;
 
                 struct {
-                        u64 ilk_ggtt_offset;
                         uint32_t pixel_format;
                         unsigned int stride;
-                        int fence_reg;
-                        unsigned int tiling_mode;
                 } fb;
         } state_cache;
 
         struct intel_fbc_reg_params {
+                struct i915_vma *vma;
+
                 struct {
                         enum pipe pipe;
                         enum plane plane;
@@ -1041,10 +1042,8 @@ struct intel_fbc {
                 } crtc;
 
                 struct {
-                        u64 ggtt_offset;
                         uint32_t pixel_format;
                         unsigned int stride;
-                        int fence_reg;
                 } fb;
 
                 int cfb_size;
@@ -1977,6 +1976,11 @@ struct drm_i915_private {
 
         struct i915_frontbuffer_tracking fb_tracking;
 
+        struct intel_atomic_helper {
+                struct llist_head free_list;
+                struct work_struct free_work;
+        } atomic_helper;
+
         u16 orig_clock;
 
         bool mchbar_need_disable;
@@ -3163,13 +3167,6 @@ i915_gem_object_to_ggtt(struct drm_i915_gem_object *obj,
         return i915_gem_obj_to_vma(obj, &to_i915(obj->base.dev)->ggtt.base, view);
 }
 
-static inline unsigned long
-i915_gem_object_ggtt_offset(struct drm_i915_gem_object *o,
-                            const struct i915_ggtt_view *view)
-{
-        return i915_ggtt_offset(i915_gem_object_to_ggtt(o, view));
-}
-
 /* i915_gem_fence_reg.c */
 int __must_check i915_vma_get_fence(struct i915_vma *vma);
 int __must_check i915_vma_put_fence(struct i915_vma *vma);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 3dd7fc662859..4b23a7814713 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -595,47 +595,21 @@ i915_gem_phys_pwrite(struct drm_i915_gem_object *obj,
                      struct drm_i915_gem_pwrite *args,
                      struct drm_file *file)
 {
-        struct drm_device *dev = obj->base.dev;
         void *vaddr = obj->phys_handle->vaddr + args->offset;
         char __user *user_data = u64_to_user_ptr(args->data_ptr);
-        int ret;
 
         /* We manually control the domain here and pretend that it
          * remains coherent i.e. in the GTT domain, like shmem_pwrite.
          */
-        lockdep_assert_held(&obj->base.dev->struct_mutex);
-        ret = i915_gem_object_wait(obj,
-                                   I915_WAIT_INTERRUPTIBLE |
-                                   I915_WAIT_LOCKED |
-                                   I915_WAIT_ALL,
-                                   MAX_SCHEDULE_TIMEOUT,
-                                   to_rps_client(file));
-        if (ret)
-                return ret;
-
         intel_fb_obj_invalidate(obj, ORIGIN_CPU);
-        if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
-                unsigned long unwritten;
-
-                /* The physical object once assigned is fixed for the lifetime
-                 * of the obj, so we can safely drop the lock and continue
-                 * to access vaddr.
-                 */
-                mutex_unlock(&dev->struct_mutex);
-                unwritten = copy_from_user(vaddr, user_data, args->size);
-                mutex_lock(&dev->struct_mutex);
-                if (unwritten) {
-                        ret = -EFAULT;
-                        goto out;
-                }
-        }
+        if (copy_from_user(vaddr, user_data, args->size))
+                return -EFAULT;
 
         drm_clflush_virt_range(vaddr, args->size);
-        i915_gem_chipset_flush(to_i915(dev));
+        i915_gem_chipset_flush(to_i915(obj->base.dev));
 
-out:
         intel_fb_obj_flush(obj, false, ORIGIN_CPU);
-        return ret;
+        return 0;
 }
 
 void *i915_gem_object_alloc(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index bd08814b015c..d534a316a16e 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -199,6 +199,7 @@ found:
         }
 
         /* Unbinding will emit any required flushes */
+        ret = 0;
         while (!list_empty(&eviction_list)) {
                 vma = list_first_entry(&eviction_list,
                                        struct i915_vma,
diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
index a792dcb902b5..e924a9516079 100644
--- a/drivers/gpu/drm/i915/i915_vma.c
+++ b/drivers/gpu/drm/i915/i915_vma.c
@@ -185,6 +185,7 @@ int i915_vma_bind(struct i915_vma *vma, enum i915_cache_level cache_level,
                         return ret;
         }
 
+        trace_i915_vma_bind(vma, bind_flags);
         ret = vma->vm->bind_vma(vma, cache_level, bind_flags);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/i915/intel_atomic_plane.c b/drivers/gpu/drm/i915/intel_atomic_plane.c
index dbe9fb41ae53..8d3e515f27ba 100644
--- a/drivers/gpu/drm/i915/intel_atomic_plane.c
+++ b/drivers/gpu/drm/i915/intel_atomic_plane.c
@@ -85,6 +85,8 @@ intel_plane_duplicate_state(struct drm_plane *plane)
 
         __drm_atomic_helper_plane_duplicate_state(plane, state);
 
+        intel_state->vma = NULL;
+
         return state;
 }
 
@@ -100,6 +102,24 @@ void
 intel_plane_destroy_state(struct drm_plane *plane,
                           struct drm_plane_state *state)
 {
+        struct i915_vma *vma;
+
+        vma = fetch_and_zero(&to_intel_plane_state(state)->vma);
+
+        /*
+         * FIXME: Normally intel_cleanup_plane_fb handles destruction of vma.
+         * We currently don't clear all planes during driver unload, so we have
+         * to be able to unpin vma here for now.
+         *
+         * Normally this can only happen during unload when kmscon is disabled
+         * and userspace doesn't attempt to set a framebuffer at all.
+         */
+        if (vma) {
+                mutex_lock(&plane->dev->struct_mutex);
+                intel_unpin_fb_vma(vma);
+                mutex_unlock(&plane->dev->struct_mutex);
+        }
+
         drm_atomic_helper_plane_destroy_state(plane, state);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 86ecec5601d4..588470eb8d39 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -499,6 +499,7 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
         struct drm_i915_private *dev_priv = to_i915(crt->base.base.dev);
         struct edid *edid;
         struct i2c_adapter *i2c;
+        bool ret = false;
 
         BUG_ON(crt->base.type != INTEL_OUTPUT_ANALOG);
 
@@ -515,17 +516,17 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
                  */
                 if (!is_digital) {
                         DRM_DEBUG_KMS("CRT detected via DDC:0x50 [EDID]\n");
-                        return true;
+                        ret = true;
+                } else {
+                        DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
                 }
-
-                DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
         } else {
                 DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [no valid EDID found]\n");
         }
 
         kfree(edid);
 
-        return false;
+        return ret;
 }
 
 static enum drm_connector_status
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3dc8724df400..f1e4a21d4664 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2235,24 +2235,22 @@ intel_pin_and_fence_fb_obj(struct drm_framebuffer *fb, unsigned int rotation)
                         i915_vma_pin_fence(vma);
         }
 
+        i915_vma_get(vma);
 err:
         intel_runtime_pm_put(dev_priv);
         return vma;
 }
 
-void intel_unpin_fb_obj(struct drm_framebuffer *fb, unsigned int rotation)
+void intel_unpin_fb_vma(struct i915_vma *vma)
 {
-        struct drm_i915_gem_object *obj = intel_fb_obj(fb);
-        struct i915_ggtt_view view;
-        struct i915_vma *vma;
+        lockdep_assert_held(&vma->vm->dev->struct_mutex);
 
-        WARN_ON(!mutex_is_locked(&obj->base.dev->struct_mutex));
-
-        intel_fill_fb_ggtt_view(&view, fb, rotation);
-        vma = i915_gem_object_to_ggtt(obj, &view);
+        if (WARN_ON_ONCE(!vma))
+                return;
 
         i915_vma_unpin_fence(vma);
         i915_gem_object_unpin_from_display_plane(vma);
+        i915_vma_put(vma);
 }
 
 static int intel_fb_pitch(const struct drm_framebuffer *fb, int plane,
@@ -2585,8 +2583,9 @@ intel_fill_fb_info(struct drm_i915_private *dev_priv,
                          * We only keep the x/y offsets, so push all of the
                          * gtt offset into the x/y offsets.
                          */
-                        _intel_adjust_tile_offset(&x, &y, tile_size,
-                                                  tile_width, tile_height, pitch_tiles,
+                        _intel_adjust_tile_offset(&x, &y,
+                                                  tile_width, tile_height,
+                                                  tile_size, pitch_tiles,
                                                   gtt_offset_rotated * tile_size, 0);
 
                         gtt_offset_rotated += rot_info->plane[i].width * rot_info->plane[i].height;
@@ -2746,7 +2745,6 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
         struct drm_device *dev = intel_crtc->base.dev;
         struct drm_i915_private *dev_priv = to_i915(dev);
         struct drm_crtc *c;
-        struct intel_crtc *i;
         struct drm_i915_gem_object *obj;
         struct drm_plane *primary = intel_crtc->base.primary;
         struct drm_plane_state *plane_state = primary->state;
@@ -2771,20 +2769,20 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
          * an fb with another CRTC instead
          */
         for_each_crtc(dev, c) {
-                i = to_intel_crtc(c);
+                struct intel_plane_state *state;
 
                 if (c == &intel_crtc->base)
                         continue;
 
-                if (!i->active)
+                if (!to_intel_crtc(c)->active)
                         continue;
 
-                fb = c->primary->fb;
-                if (!fb)
+                state = to_intel_plane_state(c->primary->state);
+                if (!state->vma)
                         continue;
 
-                obj = intel_fb_obj(fb);
-                if (i915_gem_object_ggtt_offset(obj, NULL) == plane_config->base) {
+                if (intel_plane_ggtt_offset(state) == plane_config->base) {
+                        fb = c->primary->fb;
                         drm_framebuffer_reference(fb);
                         goto valid_fb;
                 }
@@ -2805,6 +2803,19 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
         return;
 
 valid_fb:
+        mutex_lock(&dev->struct_mutex);
+        intel_state->vma =
+                intel_pin_and_fence_fb_obj(fb, primary->state->rotation);
+        mutex_unlock(&dev->struct_mutex);
+        if (IS_ERR(intel_state->vma)) {
+                DRM_ERROR("failed to pin boot fb on pipe %d: %li\n",
+                          intel_crtc->pipe, PTR_ERR(intel_state->vma));
+
+                intel_state->vma = NULL;
+                drm_framebuffer_unreference(fb);
+                return;
+        }
+
         plane_state->src_x = 0;
         plane_state->src_y = 0;
         plane_state->src_w = fb->width << 16;
@@ -2967,6 +2978,9 @@ int skl_check_plane_surface(struct intel_plane_state *plane_state)
         unsigned int rotation = plane_state->base.rotation;
         int ret;
 
+        if (!plane_state->base.visible)
+                return 0;
+
         /* Rotate src coordinates to match rotated GTT view */
         if (drm_rotation_90_or_270(rotation))
                 drm_rect_rotate(&plane_state->base.src,
@@ -3097,13 +3111,13 @@ static void i9xx_update_primary_plane(struct drm_plane *primary,
         I915_WRITE(DSPSTRIDE(plane), fb->pitches[0]);
         if (INTEL_GEN(dev_priv) >= 4) {
                 I915_WRITE(DSPSURF(plane),
-                           intel_fb_gtt_offset(fb, rotation) +
+                           intel_plane_ggtt_offset(plane_state) +
                            intel_crtc->dspaddr_offset);
                 I915_WRITE(DSPTILEOFF(plane), (y << 16) | x);
                 I915_WRITE(DSPLINOFF(plane), linear_offset);
         } else {
                 I915_WRITE(DSPADDR(plane),
-                           intel_fb_gtt_offset(fb, rotation) +
+                           intel_plane_ggtt_offset(plane_state) +
                            intel_crtc->dspaddr_offset);
         }
         POSTING_READ(reg);
@@ -3200,7 +3214,7 @@ static void ironlake_update_primary_plane(struct drm_plane *primary,
 
         I915_WRITE(DSPSTRIDE(plane), fb->pitches[0]);
         I915_WRITE(DSPSURF(plane),
-                   intel_fb_gtt_offset(fb, rotation) +
+                   intel_plane_ggtt_offset(plane_state) +
                    intel_crtc->dspaddr_offset);
         if (IS_HASWELL(dev_priv) || IS_BROADWELL(dev_priv)) {
                 I915_WRITE(DSPOFFSET(plane), (y << 16) | x);
@@ -3223,23 +3237,6 @@ u32 intel_fb_stride_alignment(const struct drm_i915_private *dev_priv,
         }
 }
 
-u32 intel_fb_gtt_offset(struct drm_framebuffer *fb,
-                        unsigned int rotation)
-{
-        struct drm_i915_gem_object *obj = intel_fb_obj(fb);
-        struct i915_ggtt_view view;
-        struct i915_vma *vma;
-
-        intel_fill_fb_ggtt_view(&view, fb, rotation);
-
-        vma = i915_gem_object_to_ggtt(obj, &view);
-        if (WARN(!vma, "ggtt vma for display object not found! (view=%u)\n",
-                 view.type))
-                return -1;
-
-        return i915_ggtt_offset(vma);
-}
-
 static void skl_detach_scaler(struct intel_crtc *intel_crtc, int id)
 {
         struct drm_device *dev = intel_crtc->base.dev;
@@ -3434,7 +3431,7 @@ static void skylake_update_primary_plane(struct drm_plane *plane,
         }
 
         I915_WRITE(PLANE_SURF(pipe, 0),
-                   intel_fb_gtt_offset(fb, rotation) + surf_addr);
+                   intel_plane_ggtt_offset(plane_state) + surf_addr);
 
         POSTING_READ(PLANE_SURF(pipe, 0));
 }
@@ -6846,6 +6843,12 @@ static void intel_crtc_disable_noatomic(struct drm_crtc *crtc)
         }
 
         state = drm_atomic_state_alloc(crtc->dev);
+        if (!state) {
+                DRM_DEBUG_KMS("failed to disable [CRTC:%d:%s], out of memory",
+                              crtc->base.id, crtc->name);
+                return;
+        }
+
         state->acquire_ctx = crtc->dev->mode_config.acquire_ctx;
 
         /* Everything's already locked, -EDEADLK can't happen. */
@@ -11243,6 +11246,7 @@ found:
         }
 
         old->restore_state = restore_state;
+        drm_atomic_state_put(state);
 
         /* let the connector get through one full cycle before testing */
         intel_wait_for_vblank(dev_priv, intel_crtc->pipe);
@@ -11522,7 +11526,7 @@ static void intel_unpin_work_fn(struct work_struct *__work)
                 flush_work(&work->mmio_work);
 
         mutex_lock(&dev->struct_mutex);
-        intel_unpin_fb_obj(work->old_fb, primary->state->rotation);
+        intel_unpin_fb_vma(work->old_vma);
         i915_gem_object_put(work->pending_flip_obj);
         mutex_unlock(&dev->struct_mutex);
 
@@ -12232,8 +12236,10 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
                 goto cleanup_pending;
         }
 
-        work->gtt_offset = intel_fb_gtt_offset(fb, primary->state->rotation);
-        work->gtt_offset += intel_crtc->dspaddr_offset;
+        work->old_vma = to_intel_plane_state(primary->state)->vma;
+        to_intel_plane_state(primary->state)->vma = vma;
+
+        work->gtt_offset = i915_ggtt_offset(vma) + intel_crtc->dspaddr_offset;
         work->rotation = crtc->primary->state->rotation;
 
         /*
@@ -12287,7 +12293,8 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
 cleanup_request:
         i915_add_request_no_flush(request);
 cleanup_unpin:
-        intel_unpin_fb_obj(fb, crtc->primary->state->rotation);
+        to_intel_plane_state(primary->state)->vma = work->old_vma;
+        intel_unpin_fb_vma(vma);
 cleanup_pending:
         atomic_dec(&intel_crtc->unpin_work_count);
 unlock:
@@ -14512,8 +14519,14 @@ intel_atomic_commit_ready(struct i915_sw_fence *fence,
                 break;
 
         case FENCE_FREE:
-                drm_atomic_state_put(&state->base);
-                break;
+                {
+                        struct intel_atomic_helper *helper =
+                                &to_i915(state->base.dev)->atomic_helper;
+
+                        if (llist_add(&state->freed, &helper->free_list))
+                                schedule_work(&helper->free_work);
+                        break;
+                }
         }
 
         return NOTIFY_DONE;
@@ -14774,6 +14787,8 @@ intel_prepare_plane_fb(struct drm_plane *plane,
                         DRM_DEBUG_KMS("failed to pin object\n");
                         return PTR_ERR(vma);
                 }
+
+                to_intel_plane_state(new_state)->vma = vma;
         }
 
         return 0;
@@ -14792,19 +14807,12 @@ void
 intel_cleanup_plane_fb(struct drm_plane *plane,
                        struct drm_plane_state *old_state)
 {
-        struct drm_i915_private *dev_priv = to_i915(plane->dev);
-        struct intel_plane_state *old_intel_state;
-        struct drm_i915_gem_object *old_obj = intel_fb_obj(old_state->fb);
-        struct drm_i915_gem_object *obj = intel_fb_obj(plane->state->fb);
-
-        old_intel_state = to_intel_plane_state(old_state);
-
-        if (!obj && !old_obj)
-                return;
+        struct i915_vma *vma;
 
-        if (old_obj && (plane->type != DRM_PLANE_TYPE_CURSOR ||
-            !INTEL_INFO(dev_priv)->cursor_needs_physical))
-                intel_unpin_fb_obj(old_state->fb, old_state->rotation);
+        /* Should only be called after a successful intel_prepare_plane_fb()! */
+        vma = fetch_and_zero(&to_intel_plane_state(old_state)->vma);
+        if (vma)
+                intel_unpin_fb_vma(vma);
 }
 
 int
@@ -15146,7 +15154,7 @@ intel_update_cursor_plane(struct drm_plane *plane,
         if (!obj)
                 addr = 0;
         else if (!INTEL_INFO(dev_priv)->cursor_needs_physical)
-                addr = i915_gem_object_ggtt_offset(obj, NULL);
+                addr = intel_plane_ggtt_offset(state);
         else
                 addr = obj->phys_handle->busaddr;
 
@@ -16392,6 +16400,18 @@ fail:
         drm_modeset_acquire_fini(&ctx);
 }
 
+static void intel_atomic_helper_free_state(struct work_struct *work)
+{
+        struct drm_i915_private *dev_priv =
+                container_of(work, typeof(*dev_priv), atomic_helper.free_work);
+        struct intel_atomic_state *state, *next;
+        struct llist_node *freed;
+
+        freed = llist_del_all(&dev_priv->atomic_helper.free_list);
+        llist_for_each_entry_safe(state, next, freed, freed)
+                drm_atomic_state_put(&state->base);
+}
+
 int intel_modeset_init(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
@@ -16411,6 +16431,9 @@ int intel_modeset_init(struct drm_device *dev)
 
         dev->mode_config.funcs = &intel_mode_funcs;
 
+        INIT_WORK(&dev_priv->atomic_helper.free_work,
+                  intel_atomic_helper_free_state);
+
         intel_init_quirks(dev);
 
         intel_init_pm(dev_priv);
@@ -17024,47 +17047,19 @@ void intel_display_resume(struct drm_device *dev)
 
         if (ret)
                 DRM_ERROR("Restoring old state failed with %i\n", ret);
-        drm_atomic_state_put(state);
+        if (state)
+                drm_atomic_state_put(state);
 }
 
 void intel_modeset_gem_init(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
-        struct drm_crtc *c;
-        struct drm_i915_gem_object *obj;
 
         intel_init_gt_powersave(dev_priv);
 
         intel_modeset_init_hw(dev);
 
         intel_setup_overlay(dev_priv);
-
-        /*
-         * Make sure any fbs we allocated at startup are properly
-         * pinned & fenced.  When we do the allocation it's too early
-         * for this.
-         */
-        for_each_crtc(dev, c) {
-                struct i915_vma *vma;
-
-                obj = intel_fb_obj(c->primary->fb);
-                if (obj == NULL)
-                        continue;
-
-                mutex_lock(&dev->struct_mutex);
-                vma = intel_pin_and_fence_fb_obj(c->primary->fb,
-                                                 c->primary->state->rotation);
-                mutex_unlock(&dev->struct_mutex);
-                if (IS_ERR(vma)) {
-                        DRM_ERROR("failed to pin boot fb on pipe %d\n",
-                                  to_intel_crtc(c)->pipe);
-                        drm_framebuffer_unreference(c->primary->fb);
-                        c->primary->fb = NULL;
-                        c->primary->crtc = c->primary->state->crtc = NULL;
-                        update_state_fb(c->primary);
-                        c->state->plane_mask &= ~(1 << drm_plane_index(c->primary));
-                }
-        }
 }
 
 int intel_connector_register(struct drm_connector *connector)
@@ -17094,6 +17089,9 @@ void intel_modeset_cleanup(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
 
+        flush_work(&dev_priv->atomic_helper.free_work);
+        WARN_ON(!llist_empty(&dev_priv->atomic_helper.free_list));
+
         intel_disable_gt_powersave(dev_priv);
 
         /*
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index cd132c216a67..03a2112004f9 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -370,11 +370,14 @@ struct intel_atomic_state {
         struct skl_wm_values wm_results;
 
         struct i915_sw_fence commit_ready;
+
+        struct llist_node freed;
 };
 
 struct intel_plane_state {
         struct drm_plane_state base;
         struct drm_rect clip;
+        struct i915_vma *vma;
 
         struct {
                 u32 offset;
@@ -1044,6 +1047,7 @@ struct intel_flip_work {
         struct work_struct mmio_work;
 
         struct drm_crtc *crtc;
+        struct i915_vma *old_vma;
         struct drm_framebuffer *old_fb;
         struct drm_i915_gem_object *pending_flip_obj;
         struct drm_pending_vblank_event *event;
@@ -1271,7 +1275,7 @@ void intel_release_load_detect_pipe(struct drm_connector *connector,
                                     struct drm_modeset_acquire_ctx *ctx);
 struct i915_vma *
 intel_pin_and_fence_fb_obj(struct drm_framebuffer *fb, unsigned int rotation);
-void intel_unpin_fb_obj(struct drm_framebuffer *fb, unsigned int rotation);
+void intel_unpin_fb_vma(struct i915_vma *vma);
 struct drm_framebuffer *
 __intel_framebuffer_create(struct drm_device *dev,
                            struct drm_mode_fb_cmd2 *mode_cmd,
@@ -1360,7 +1364,10 @@ void intel_mode_from_pipe_config(struct drm_display_mode *mode,
 int skl_update_scaler_crtc(struct intel_crtc_state *crtc_state);
 int skl_max_scale(struct intel_crtc *crtc, struct intel_crtc_state *crtc_state);
 
-u32 intel_fb_gtt_offset(struct drm_framebuffer *fb, unsigned int rotation);
+static inline u32 intel_plane_ggtt_offset(const struct intel_plane_state *state)
+{
+        return i915_ggtt_offset(state->vma);
+}
 
 u32 skl_plane_ctl_format(uint32_t pixel_format);
 u32 skl_plane_ctl_tiling(uint64_t fb_modifier);
diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
index 62f215b12eb5..f3a1d6a5cabe 100644
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -173,7 +173,7 @@ static void i8xx_fbc_activate(struct drm_i915_private *dev_priv)
         if (IS_I945GM(dev_priv))
                 fbc_ctl |= FBC_CTL_C3_IDLE; /* 945 needs special SR handling */
         fbc_ctl |= (cfb_pitch & 0xff) << FBC_CTL_STRIDE_SHIFT;
-        fbc_ctl |= params->fb.fence_reg;
+        fbc_ctl |= params->vma->fence->id;
         I915_WRITE(FBC_CONTROL, fbc_ctl);
 }
 
@@ -193,8 +193,8 @@ static void g4x_fbc_activate(struct drm_i915_private *dev_priv)
         else
                 dpfc_ctl |= DPFC_CTL_LIMIT_1X;
 
-        if (params->fb.fence_reg != I915_FENCE_REG_NONE) {
-                dpfc_ctl |= DPFC_CTL_FENCE_EN | params->fb.fence_reg;
+        if (params->vma->fence) {
+                dpfc_ctl |= DPFC_CTL_FENCE_EN | params->vma->fence->id;
                 I915_WRITE(DPFC_FENCE_YOFF, params->crtc.fence_y_offset);
         } else {
                 I915_WRITE(DPFC_FENCE_YOFF, 0);
@@ -251,13 +251,14 @@ static void ilk_fbc_activate(struct drm_i915_private *dev_priv)
                 break;
         }
 
-        if (params->fb.fence_reg != I915_FENCE_REG_NONE) {
+        if (params->vma->fence) {
                 dpfc_ctl |= DPFC_CTL_FENCE_EN;
                 if (IS_GEN5(dev_priv))
-                        dpfc_ctl |= params->fb.fence_reg;
+                        dpfc_ctl |= params->vma->fence->id;
                 if (IS_GEN6(dev_priv)) {
                         I915_WRITE(SNB_DPFC_CTL_SA,
-                                   SNB_CPU_FENCE_ENABLE | params->fb.fence_reg);
+                                   SNB_CPU_FENCE_ENABLE |
+                                   params->vma->fence->id);
                         I915_WRITE(DPFC_CPU_FENCE_OFFSET,
                                    params->crtc.fence_y_offset);
                 }
@@ -269,7 +270,8 @@ static void ilk_fbc_activate(struct drm_i915_private *dev_priv)
         }
 
         I915_WRITE(ILK_DPFC_FENCE_YOFF, params->crtc.fence_y_offset);
-        I915_WRITE(ILK_FBC_RT_BASE, params->fb.ggtt_offset | ILK_FBC_RT_VALID);
+        I915_WRITE(ILK_FBC_RT_BASE,
+                   i915_ggtt_offset(params->vma) | ILK_FBC_RT_VALID);
         /* enable it... */
         I915_WRITE(ILK_DPFC_CONTROL, dpfc_ctl | DPFC_CTL_EN);
 
@@ -319,10 +321,11 @@ static void gen7_fbc_activate(struct drm_i915_private *dev_priv)
                 break;
         }
 
-        if (params->fb.fence_reg != I915_FENCE_REG_NONE) {
+        if (params->vma->fence) {
                 dpfc_ctl |= IVB_DPFC_CTL_FENCE_EN;
                 I915_WRITE(SNB_DPFC_CTL_SA,
-                           SNB_CPU_FENCE_ENABLE | params->fb.fence_reg);
+                           SNB_CPU_FENCE_ENABLE |
+                           params->vma->fence->id);
                 I915_WRITE(DPFC_CPU_FENCE_OFFSET, params->crtc.fence_y_offset);
         } else {
                 I915_WRITE(SNB_DPFC_CTL_SA,0);
@@ -727,14 +730,6 @@ static bool intel_fbc_hw_tracking_covers_screen(struct intel_crtc *crtc)
         return effective_w <= max_w && effective_h <= max_h;
 }
 
-/* XXX replace me when we have VMA tracking for intel_plane_state */
-static int get_fence_id(struct drm_framebuffer *fb)
-{
-        struct i915_vma *vma = i915_gem_object_to_ggtt(intel_fb_obj(fb), NULL);
-
-        return vma && vma->fence ? vma->fence->id : I915_FENCE_REG_NONE;
-}
-
 static void intel_fbc_update_state_cache(struct intel_crtc *crtc,
                                          struct intel_crtc_state *crtc_state,
                                          struct intel_plane_state *plane_state)
@@ -743,7 +738,8 @@ static void intel_fbc_update_state_cache(struct intel_crtc *crtc,
         struct intel_fbc *fbc = &dev_priv->fbc;
         struct intel_fbc_state_cache *cache = &fbc->state_cache;
         struct drm_framebuffer *fb = plane_state->base.fb;
-        struct drm_i915_gem_object *obj;
+
+        cache->vma = NULL;
 
         cache->crtc.mode_flags = crtc_state->base.adjusted_mode.flags;
         if (IS_HASWELL(dev_priv) || IS_BROADWELL(dev_priv))
@@ -758,16 +754,10 @@ static void intel_fbc_update_state_cache(struct intel_crtc *crtc,
         if (!cache->plane.visible)
                 return;
 
-        obj = intel_fb_obj(fb);
-
-        /* FIXME: We lack the proper locking here, so only run this on the
-         * platforms that need. */
-        if (IS_GEN(dev_priv, 5, 6))
-                cache->fb.ilk_ggtt_offset = i915_gem_object_ggtt_offset(obj, NULL);
         cache->fb.pixel_format = fb->pixel_format;
         cache->fb.stride = fb->pitches[0];
-        cache->fb.fence_reg = get_fence_id(fb);
-        cache->fb.tiling_mode = i915_gem_object_get_tiling(obj);
+
+        cache->vma = plane_state->vma;
 }
 
 static bool intel_fbc_can_activate(struct intel_crtc *crtc)
@@ -784,7 +774,7 @@ static bool intel_fbc_can_activate(struct intel_crtc *crtc)
                 return false;
         }
 
-        if (!cache->plane.visible) {
+        if (!cache->vma) {
                 fbc->no_fbc_reason = "primary plane not visible";
                 return false;
         }
@@ -807,8 +797,7 @@ static bool intel_fbc_can_activate(struct intel_crtc *crtc)
          * so have no fence associated with it) due to aperture constaints
          * at the time of pinning.
          */
-        if (cache->fb.tiling_mode != I915_TILING_X ||
-            cache->fb.fence_reg == I915_FENCE_REG_NONE) {
+        if (!cache->vma->fence) {
                 fbc->no_fbc_reason = "framebuffer not tiled or fenced";
                 return false;
         }
@@ -888,17 +877,16 @@ static void intel_fbc_get_reg_params(struct intel_crtc *crtc,
          * zero. */
         memset(params, 0, sizeof(*params));
 
+        params->vma = cache->vma;
+
         params->crtc.pipe = crtc->pipe;
         params->crtc.plane = crtc->plane;
         params->crtc.fence_y_offset = get_crtc_fence_y_offset(crtc);
 
         params->fb.pixel_format = cache->fb.pixel_format;
         params->fb.stride = cache->fb.stride;
-        params->fb.fence_reg = cache->fb.fence_reg;
 
         params->cfb_size = intel_fbc_calculate_cfb_size(dev_priv, cache);
-
-        params->fb.ggtt_offset = cache->fb.ilk_ggtt_offset;
 }
 
 static bool intel_fbc_reg_params_equal(struct intel_fbc_reg_params *params1,
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index beb08982dc0b..f4a8c4fc57c4 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -284,7 +284,7 @@ static int intelfb_create(struct drm_fb_helper *helper,
 out_destroy_fbi:
         drm_fb_helper_release_fbi(helper);
 out_unpin:
-        intel_unpin_fb_obj(&ifbdev->fb->base, DRM_ROTATE_0);
+        intel_unpin_fb_vma(vma);
 out_unlock:
         mutex_unlock(&dev->struct_mutex);
         return ret;
@@ -549,7 +549,7 @@ static void intel_fbdev_destroy(struct intel_fbdev *ifbdev)
 
         if (ifbdev->fb) {
                 mutex_lock(&ifbdev->helper.dev->struct_mutex);
-                intel_unpin_fb_obj(&ifbdev->fb->base, DRM_ROTATE_0);
+                intel_unpin_fb_vma(ifbdev->vma);
                 mutex_unlock(&ifbdev->helper.dev->struct_mutex);
 
                 drm_framebuffer_remove(&ifbdev->fb->base);
@@ -742,6 +742,9 @@ void intel_fbdev_initial_config_async(struct drm_device *dev)
 {
         struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;
 
+        if (!ifbdev)
+                return;
+
         ifbdev->cookie = async_schedule(intel_fbdev_initial_config, ifbdev);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index d4961fa20c73..beabc17e7c8a 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -979,18 +979,8 @@ static inline int gen8_emit_flush_coherentl3_wa(struct intel_engine_cs *engine,
                                                 uint32_t *batch,
                                                 uint32_t index)
 {
-        struct drm_i915_private *dev_priv = engine->i915;
         uint32_t l3sqc4_flush = (0x40400000 | GEN8_LQSC_FLUSH_COHERENT_LINES);
 
-        /*
-         * WaDisableLSQCROPERFforOCL:kbl
-         * This WA is implemented in skl_init_clock_gating() but since
-         * this batch updates GEN8_L3SQCREG4 with default value we need to
-         * set this bit here to retain the WA during flush.
-         */
-        if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_E0))
-                l3sqc4_flush |= GEN8_LQSC_RO_PERF_DIS;
-
         wa_ctx_emit(batch, index, (MI_STORE_REGISTER_MEM_GEN8 |
                                    MI_SRM_LRM_GLOBAL_GTT));
         wa_ctx_emit_reg(batch, index, GEN8_L3SQCREG4);
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index aeb637dc1fdf..91cb4c422ad5 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -1095,14 +1095,6 @@ static int kbl_init_workarounds(struct intel_engine_cs *engine)
                 WA_SET_BIT_MASKED(HDC_CHICKEN0,
                                   HDC_FENCE_DEST_SLM_DISABLE);
 
-        /* GEN8_L3SQCREG4 has a dependency with WA batch so any new changes
-         * involving this register should also be added to WA batch as required.
-         */
-        if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_E0))
-                /* WaDisableLSQCROPERFforOCL:kbl */
-                I915_WRITE(GEN8_L3SQCREG4, I915_READ(GEN8_L3SQCREG4) |
-                           GEN8_LQSC_RO_PERF_DIS);
-
         /* WaToEnableHwFixForPushConstHWBug:kbl */
         if (IS_KBL_REVID(dev_priv, KBL_REVID_C0, REVID_FOREVER))
                 WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2,
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 8f131a08d440..242a73e66d82 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -273,7 +273,7 @@ skl_update_plane(struct drm_plane *drm_plane,
 
         I915_WRITE(PLANE_CTL(pipe, plane), plane_ctl);
         I915_WRITE(PLANE_SURF(pipe, plane),
-                   intel_fb_gtt_offset(fb, rotation) + surf_addr);
+                   intel_plane_ggtt_offset(plane_state) + surf_addr);
         POSTING_READ(PLANE_SURF(pipe, plane));
 }
 
@@ -458,7 +458,7 @@ vlv_update_plane(struct drm_plane *dplane,
         I915_WRITE(SPSIZE(pipe, plane), (crtc_h << 16) | crtc_w);
         I915_WRITE(SPCNTR(pipe, plane), sprctl);
         I915_WRITE(SPSURF(pipe, plane),
-                   intel_fb_gtt_offset(fb, rotation) + sprsurf_offset);
+                   intel_plane_ggtt_offset(plane_state) + sprsurf_offset);
         POSTING_READ(SPSURF(pipe, plane));
 }
 
@@ -594,7 +594,7 @@ ivb_update_plane(struct drm_plane *plane,
                 I915_WRITE(SPRSCALE(pipe), sprscale);
         I915_WRITE(SPRCTL(pipe), sprctl);
         I915_WRITE(SPRSURF(pipe),
-                   intel_fb_gtt_offset(fb, rotation) + sprsurf_offset);
+                   intel_plane_ggtt_offset(plane_state) + sprsurf_offset);
         POSTING_READ(SPRSURF(pipe));
 }
 
@@ -721,7 +721,7 @@ ilk_update_plane(struct drm_plane *plane,
         I915_WRITE(DVSSCALE(pipe), dvsscale);
         I915_WRITE(DVSCNTR(pipe), dvscntr);
         I915_WRITE(DVSSURF(pipe),
-                   intel_fb_gtt_offset(fb, rotation) + dvssurf_offset);
+                   intel_plane_ggtt_offset(plane_state) + dvssurf_offset);
         POSTING_READ(DVSSURF(pipe));
 }
 
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index 14ff87686a36..686a580c711a 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -345,7 +345,6 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
 {
         struct adreno_platform_config *config = pdev->dev.platform_data;
         struct msm_gpu *gpu = &adreno_gpu->base;
-        struct msm_mmu *mmu;
         int ret;
 
         adreno_gpu->funcs = funcs;
@@ -385,8 +384,8 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
                 return ret;
         }
 
-        mmu = gpu->aspace->mmu;
-        if (mmu) {
+        if (gpu->aspace && gpu->aspace->mmu) {
+                struct msm_mmu *mmu = gpu->aspace->mmu;
                 ret = mmu->funcs->attach(mmu, iommu_ports,
                                 ARRAY_SIZE(iommu_ports));
                 if (ret)
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
index 5f6cd8745dbc..c396d459a9d0 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
@@ -119,13 +119,7 @@ static void mdp5_prepare_commit(struct msm_kms *kms, struct drm_atomic_state *st
 
 static void mdp5_complete_commit(struct msm_kms *kms, struct drm_atomic_state *state)
 {
-        int i;
         struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
-        struct drm_plane *plane;
-        struct drm_plane_state *plane_state;
-
-        for_each_plane_in_state(state, plane, plane_state, i)
-                mdp5_plane_complete_commit(plane, plane_state);
 
         if (mdp5_kms->smp)
                 mdp5_smp_complete_commit(mdp5_kms->smp, &mdp5_kms->state->smp);
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
index 17b0cc101171..cdfc63d90c7b 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
@@ -104,8 +104,6 @@ struct mdp5_plane_state {
 
         /* assigned by crtc blender */
         enum mdp_mixer_stage_id stage;
-
-        bool pending : 1;
 };
 #define to_mdp5_plane_state(x) \
                 container_of(x, struct mdp5_plane_state, base)
@@ -232,8 +230,6 @@ int mdp5_irq_domain_init(struct mdp5_kms *mdp5_kms);
 void mdp5_irq_domain_fini(struct mdp5_kms *mdp5_kms);
 
 uint32_t mdp5_plane_get_flush(struct drm_plane *plane);
-void mdp5_plane_complete_commit(struct drm_plane *plane,
-        struct drm_plane_state *state);
 enum mdp5_pipe mdp5_plane_pipe(struct drm_plane *plane);
 struct drm_plane *mdp5_plane_init(struct drm_device *dev, bool primary);
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
index c099da7bc212..25d9d0a97156 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
@@ -179,7 +179,6 @@ mdp5_plane_atomic_print_state(struct drm_printer *p,
         drm_printf(p, "\tzpos=%u\n", pstate->zpos);
         drm_printf(p, "\talpha=%u\n", pstate->alpha);
         drm_printf(p, "\tstage=%s\n", stage2name(pstate->stage));
-        drm_printf(p, "\tpending=%u\n", pstate->pending);
 }
 
 static void mdp5_plane_reset(struct drm_plane *plane)
@@ -220,8 +219,6 @@ mdp5_plane_duplicate_state(struct drm_plane *plane)
         if (mdp5_state && mdp5_state->base.fb)
                 drm_framebuffer_reference(mdp5_state->base.fb);
 
-        mdp5_state->pending = false;
-
         return &mdp5_state->base;
 }
 
@@ -288,13 +285,6 @@ static int mdp5_plane_atomic_check(struct drm_plane *plane,
         DBG("%s: check (%d -> %d)", plane->name,
                         plane_enabled(old_state), plane_enabled(state));
 
-        /* We don't allow faster-than-vblank updates.. if we did add this
-         * some day, we would need to disallow in cases where hwpipe
-         * changes
-         */
-        if (WARN_ON(to_mdp5_plane_state(old_state)->pending))
-                return -EBUSY;
-
         max_width = config->hw->lm.max_width << 16;
         max_height = config->hw->lm.max_height << 16;
 
@@ -370,12 +360,9 @@ static void mdp5_plane_atomic_update(struct drm_plane *plane,
                                      struct drm_plane_state *old_state)
 {
         struct drm_plane_state *state = plane->state;
-        struct mdp5_plane_state *mdp5_state = to_mdp5_plane_state(state);
 
         DBG("%s: update", plane->name);
 
-        mdp5_state->pending = true;
-
         if (plane_enabled(state)) {
                 int ret;
 
@@ -851,15 +838,6 @@ uint32_t mdp5_plane_get_flush(struct drm_plane *plane)
         return pstate->hwpipe->flush_mask;
 }
 
-/* called after vsync in thread context */
-void mdp5_plane_complete_commit(struct drm_plane *plane,
-        struct drm_plane_state *state)
-{
-        struct mdp5_plane_state *pstate = to_mdp5_plane_state(plane->state);
-
-        pstate->pending = false;
-}
-
 /* initialize plane */
 struct drm_plane *mdp5_plane_init(struct drm_device *dev, bool primary)
 {
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index d8bc59c7e261..8098677a3916 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -294,6 +294,8 @@ put_iova(struct drm_gem_object *obj)
         WARN_ON(!mutex_is_locked(&dev->struct_mutex));
 
         for (id = 0; id < ARRAY_SIZE(msm_obj->domain); id++) {
+                if (!priv->aspace[id])
+                        continue;
                 msm_gem_unmap_vma(priv->aspace[id],
                                 &msm_obj->domain[id], msm_obj->sgt);
         }
diff --git a/drivers/gpu/drm/nouveau/dispnv04/hw.c b/drivers/gpu/drm/nouveau/dispnv04/hw.c
index 74856a8b8f35..e64f52464ecf 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/hw.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/hw.c
@@ -222,6 +222,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype)
                 uint32_t mpllP;
 
                 pci_read_config_dword(pci_get_bus_and_slot(0, 3), 0x6c, &mpllP);
+                mpllP = (mpllP >> 8) & 0xf;
                 if (!mpllP)
                         mpllP = 4;
 
@@ -232,7 +233,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype)
                 uint32_t clock;
 
                 pci_read_config_dword(pci_get_bus_and_slot(0, 5), 0x4c, &clock);
-                return clock;
+                return clock / 1000;
         }
 
         ret = nouveau_hw_get_pllvals(dev, plltype, &pllvals);
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index cef08da1da4e..6a157763dfc3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -411,7 +411,8 @@ nouveau_display_init(struct drm_device *dev)
                 return ret;
 
         /* enable polling for external displays */
-        drm_kms_helper_poll_enable(dev);
+        if (!dev->mode_config.poll_enabled)
+                drm_kms_helper_poll_enable(dev);
 
         /* enable hotplug interrupts */
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 59348fc41c77..bc85a45f91cd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -773,7 +773,10 @@ nouveau_pmops_runtime_resume(struct device *dev)
         pci_set_master(pdev);
 
         ret = nouveau_do_resume(drm_dev, true);
-        drm_kms_helper_poll_enable(drm_dev);
+
+        if (!drm_dev->mode_config.poll_enabled)
+                drm_kms_helper_poll_enable(drm_dev);
+
         /* do magic */
         nvif_mask(&device->object, 0x088488, (1 << 25), (1 << 25));
         vga_switcheroo_set_dynamic_switch(pdev, VGA_SWITCHEROO_ON);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 8d5ed5bfdacb..42c1fa53d431 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -165,6 +165,8 @@ struct nouveau_drm {
         struct backlight_device *backlight;
         struct list_head bl_connectors;
         struct work_struct hpd_work;
+        struct work_struct fbcon_work;
+        int fbcon_new_state;
 #ifdef CONFIG_ACPI
         struct notifier_block acpi_nb;
 #endif
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 2f2a3dcd4ad7..fa2d0a978ccc 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -470,19 +470,43 @@ static const struct drm_fb_helper_funcs nouveau_fbcon_helper_funcs = {
         .fb_probe = nouveau_fbcon_create,
 };
 
+static void
+nouveau_fbcon_set_suspend_work(struct work_struct *work)
+{
+        struct nouveau_drm *drm = container_of(work, typeof(*drm), fbcon_work);
+        int state = READ_ONCE(drm->fbcon_new_state);
+
+        if (state == FBINFO_STATE_RUNNING)
+                pm_runtime_get_sync(drm->dev->dev);
+
+        console_lock();
+        if (state == FBINFO_STATE_RUNNING)
+                nouveau_fbcon_accel_restore(drm->dev);
+        drm_fb_helper_set_suspend(&drm->fbcon->helper, state);
+        if (state != FBINFO_STATE_RUNNING)
+                nouveau_fbcon_accel_save_disable(drm->dev);
+        console_unlock();
+
+        if (state == FBINFO_STATE_RUNNING) {
+                pm_runtime_mark_last_busy(drm->dev->dev);
+                pm_runtime_put_sync(drm->dev->dev);
+        }
+}
+
 void
 nouveau_fbcon_set_suspend(struct drm_device *dev, int state)
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
-        if (drm->fbcon) {
-                console_lock();
-                if (state == FBINFO_STATE_RUNNING)
-                        nouveau_fbcon_accel_restore(dev);
-                drm_fb_helper_set_suspend(&drm->fbcon->helper, state);
-                if (state != FBINFO_STATE_RUNNING)
-                        nouveau_fbcon_accel_save_disable(dev);
-                console_unlock();
-        }
+
+        if (!drm->fbcon)
+                return;
+
+        drm->fbcon_new_state = state;
+        /* Since runtime resume can happen as a result of a sysfs operation,
+         * it's possible we already have the console locked. So handle fbcon
+         * init/deinit from a seperate work thread
+         */
+        schedule_work(&drm->fbcon_work);
 }
 
 int
@@ -502,6 +526,7 @@ nouveau_fbcon_init(struct drm_device *dev)
                 return -ENOMEM;
 
         drm->fbcon = fbcon;
+        INIT_WORK(&drm->fbcon_work, nouveau_fbcon_set_suspend_work);
 
         drm_fb_helper_prepare(dev, &fbcon->helper, &nouveau_fbcon_helper_funcs);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.h b/drivers/gpu/drm/nouveau/nouveau_fence.h
index ccdce1b4eec4..d5e58a38f160 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.h
@@ -99,6 +99,7 @@ struct nv84_fence_priv {
         struct nouveau_bo *bo;
         struct nouveau_bo *bo_gart;
         u32 *suspend;
+        struct mutex mutex;
 };
 
 int  nv84_fence_context_new(struct nouveau_channel *);
diff --git a/drivers/gpu/drm/nouveau/nouveau_led.h b/drivers/gpu/drm/nouveau/nouveau_led.h
index 187ecdb82002..21a5775028cc 100644
--- a/drivers/gpu/drm/nouveau/nouveau_led.h
+++ b/drivers/gpu/drm/nouveau/nouveau_led.h
@@ -42,7 +42,7 @@ nouveau_led(struct drm_device *dev)
 }
 
 /* nouveau_led.c */
-#if IS_ENABLED(CONFIG_LEDS_CLASS)
+#if IS_REACHABLE(CONFIG_LEDS_CLASS)
 int  nouveau_led_init(struct drm_device *dev);
 void nouveau_led_suspend(struct drm_device *dev);
 void nouveau_led_resume(struct drm_device *dev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_usif.c b/drivers/gpu/drm/nouveau/nouveau_usif.c
index 08f9c6fa0f7f..1fba38622744 100644
--- a/drivers/gpu/drm/nouveau/nouveau_usif.c
+++ b/drivers/gpu/drm/nouveau/nouveau_usif.c
@@ -313,7 +313,8 @@ usif_ioctl(struct drm_file *filp, void __user *user, u32 argc)
         if (!(ret = nvif_unpack(-ENOSYS, &data, &size, argv->v0, 0, 0, true))) {
                 /* block access to objects not created via this interface */
                 owner = argv->v0.owner;
-                if (argv->v0.object == 0ULL)
+                if (argv->v0.object == 0ULL &&
+                    argv->v0.type != NVIF_IOCTL_V0_DEL)
                         argv->v0.owner = NVDRM_OBJECT_ANY; /* except client */
                 else
                         argv->v0.owner = NVDRM_OBJECT_USIF;
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 2c2c64507661..32097fd615fd 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -4052,6 +4052,11 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
                 }
         }
 
+        for_each_crtc_in_state(state, crtc, crtc_state, i) {
+                if (crtc->state->event)
+                        drm_crtc_vblank_get(crtc);
+        }
+
         /* Update plane(s). */
         for_each_plane_in_state(state, plane, plane_state, i) {
                 struct nv50_wndw_atom *asyw = nv50_wndw_atom(plane->state);
@@ -4101,6 +4106,7 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
                         drm_crtc_send_vblank_event(crtc, crtc->state->event);
                         spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
                         crtc->state->event = NULL;
+                        drm_crtc_vblank_put(crtc);
                 }
         }
 
diff --git a/drivers/gpu/drm/nouveau/nv84_fence.c b/drivers/gpu/drm/nouveau/nv84_fence.c
index 52b87ae83e7b..f0b322bec7df 100644
--- a/drivers/gpu/drm/nouveau/nv84_fence.c
+++ b/drivers/gpu/drm/nouveau/nv84_fence.c
@@ -107,8 +107,10 @@ nv84_fence_context_del(struct nouveau_channel *chan)
         struct nv84_fence_chan *fctx = chan->fence;
 
         nouveau_bo_wr32(priv->bo, chan->chid * 16 / 4, fctx->base.sequence);
+        mutex_lock(&priv->mutex);
         nouveau_bo_vma_del(priv->bo, &fctx->vma_gart);
         nouveau_bo_vma_del(priv->bo, &fctx->vma);
+        mutex_unlock(&priv->mutex);
         nouveau_fence_context_del(&fctx->base);
         chan->fence = NULL;
         nouveau_fence_context_free(&fctx->base);
@@ -134,11 +136,13 @@ nv84_fence_context_new(struct nouveau_channel *chan)
         fctx->base.sync32 = nv84_fence_sync32;
         fctx->base.sequence = nv84_fence_read(chan);
 
+        mutex_lock(&priv->mutex);
         ret = nouveau_bo_vma_add(priv->bo, cli->vm, &fctx->vma);
         if (ret == 0) {
                 ret = nouveau_bo_vma_add(priv->bo_gart, cli->vm,
                                         &fctx->vma_gart);
         }
+        mutex_unlock(&priv->mutex);
 
         if (ret)
                 nv84_fence_context_del(chan);
@@ -212,6 +216,8 @@ nv84_fence_create(struct nouveau_drm *drm)
         priv->base.context_base = dma_fence_context_alloc(priv->base.contexts);
         priv->base.uevent = true;
 
+        mutex_init(&priv->mutex);
+
         /* Use VRAM if there is any ; otherwise fallback to system memory */
         domain = drm->device.info.ram_size != 0 ? TTM_PL_FLAG_VRAM :
                          /*
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
index 6f0436df0219..f8f2f16c22a2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
@@ -59,7 +59,7 @@ gt215_hda_eld(NV50_DISP_MTHD_V1)
                         );
                 }
                 for (i = 0; i < size; i++)
-                        nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[0]);
+                        nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[i]);
                 for (; i < 0x60; i++)
                         nvkm_wr32(device, 0x61c440 + soff, (i << 8));
                 nvkm_mask(device, 0x61c448 + soff, 0x80000003, 0x80000003);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
index 567466f93cd5..0db8efbf1c2e 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
@@ -433,8 +433,6 @@ nv50_disp_dptmds_war(struct nvkm_device *device)
         case 0x94:
         case 0x96:
         case 0x98:
-        case 0xaa:
-        case 0xac:
                 return true;
         default:
                 break;
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 00ea0002b539..30bd4a6a9d46 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -97,9 +97,10 @@
  *   2.46.0 - Add PFP_SYNC_ME support on evergreen
  *   2.47.0 - Add UVD_NO_OP register support
  *   2.48.0 - TA_CS_BC_BASE_ADDR allowed on SI
+ *   2.49.0 - DRM_RADEON_GEM_INFO ioctl returns correct vram_size/visible values
  */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        48
+#define KMS_DRIVER_MINOR        49
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
@@ -366,11 +367,10 @@ static void
 radeon_pci_shutdown(struct pci_dev *pdev)
 {
         /* if we are running in a VM, make sure the device
-         * torn down properly on reboot/shutdown.
-         * unfortunately we can't detect certain
-         * hypervisors so just do this all the time.
+         * torn down properly on reboot/shutdown
          */
-        radeon_pci_remove(pdev);
+        if (radeon_device_is_virtual())
+                radeon_pci_remove(pdev);
 }
 
 static int radeon_pmops_suspend(struct device *dev)
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index 0bcffd8a7bd3..96683f5b2b1b 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -220,8 +220,8 @@ int radeon_gem_info_ioctl(struct drm_device *dev, void *data,
 
         man = &rdev->mman.bdev.man[TTM_PL_VRAM];
 
-        args->vram_size = rdev->mc.real_vram_size;
-        args->vram_visible = (u64)man->size << PAGE_SHIFT;
+        args->vram_size = (u64)man->size << PAGE_SHIFT;
+        args->vram_visible = rdev->mc.visible_vram_size;
         args->vram_visible -= rdev->vram_pin_size;
         args->gart_size = rdev->mc.gtt_size;
         args->gart_size -= rdev->gart_pin_size;
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index e8a38d296855..414776811e71 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -114,6 +114,9 @@ MODULE_FIRMWARE("radeon/hainan_mc.bin");
 MODULE_FIRMWARE("radeon/hainan_rlc.bin");
 MODULE_FIRMWARE("radeon/hainan_smc.bin");
 MODULE_FIRMWARE("radeon/hainan_k_smc.bin");
+MODULE_FIRMWARE("radeon/banks_k_2_smc.bin");
+
+MODULE_FIRMWARE("radeon/si58_mc.bin");
 
 static u32 si_get_cu_active_bitmap(struct radeon_device *rdev, u32 se, u32 sh);
 static void si_pcie_gen3_enable(struct radeon_device *rdev);
@@ -1650,6 +1653,8 @@ static int si_init_microcode(struct radeon_device *rdev)
         int err;
         int new_fw = 0;
         bool new_smc = false;
+        bool si58_fw = false;
+        bool banks2_fw = false;
 
         DRM_DEBUG("\n");
 
@@ -1727,10 +1732,11 @@ static int si_init_microcode(struct radeon_device *rdev)
                      ((rdev->pdev->device == 0x6660) ||
                       (rdev->pdev->device == 0x6663) ||
                       (rdev->pdev->device == 0x6665) ||
-                      (rdev->pdev->device == 0x6667))) ||
-                    ((rdev->pdev->revision == 0xc3) &&
-                     (rdev->pdev->device == 0x6665)))
+                      (rdev->pdev->device == 0x6667))))
                         new_smc = true;
+                else if ((rdev->pdev->revision == 0xc3) &&
+                         (rdev->pdev->device == 0x6665))
+                        banks2_fw = true;
                 new_chip_name = "hainan";
                 pfp_req_size = SI_PFP_UCODE_SIZE * 4;
                 me_req_size = SI_PM4_UCODE_SIZE * 4;
@@ -1742,6 +1748,10 @@ static int si_init_microcode(struct radeon_device *rdev)
         default: BUG();
         }
 
+        /* this memory configuration requires special firmware */
+        if (((RREG32(MC_SEQ_MISC0) & 0xff000000) >> 24) == 0x58)
+                si58_fw = true;
+
         DRM_INFO("Loading %s Microcode\n", new_chip_name);
 
         snprintf(fw_name, sizeof(fw_name), "radeon/%s_pfp.bin", new_chip_name);
@@ -1845,7 +1855,10 @@ static int si_init_microcode(struct radeon_device *rdev)
                 }
         }
 
-        snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", new_chip_name);
+        if (si58_fw)
+                snprintf(fw_name, sizeof(fw_name), "radeon/si58_mc.bin");
+        else
+                snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", new_chip_name);
         err = request_firmware(&rdev->mc_fw, fw_name, rdev->dev);
         if (err) {
                 snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc2.bin", chip_name);
@@ -1876,7 +1889,9 @@ static int si_init_microcode(struct radeon_device *rdev)
                 }
         }
 
-        if (new_smc)
+        if (banks2_fw)
+                snprintf(fw_name, sizeof(fw_name), "radeon/banks_k_2_smc.bin");
+        else if (new_smc)
                 snprintf(fw_name, sizeof(fw_name), "radeon/%s_k_smc.bin", new_chip_name);
         else
                 snprintf(fw_name, sizeof(fw_name), "radeon/%s_smc.bin", new_chip_name);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 13ba73fd9b68..2944916f7102 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -3008,17 +3008,6 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                     (rdev->pdev->device == 0x6817) ||
                     (rdev->pdev->device == 0x6806))
                         max_mclk = 120000;
-        } else if (rdev->family == CHIP_OLAND) {
-                if ((rdev->pdev->revision == 0xC7) ||
-                    (rdev->pdev->revision == 0x80) ||
-                    (rdev->pdev->revision == 0x81) ||
-                    (rdev->pdev->revision == 0x83) ||
-                    (rdev->pdev->revision == 0x87) ||
-                    (rdev->pdev->device == 0x6604) ||
-                    (rdev->pdev->device == 0x6605)) {
-                        max_sclk = 75000;
-                        max_mclk = 80000;
-                }
         } else if (rdev->family == CHIP_HAINAN) {
                 if ((rdev->pdev->revision == 0x81) ||
                     (rdev->pdev->revision == 0x83) ||
@@ -3027,7 +3016,6 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                     (rdev->pdev->device == 0x6665) ||
                     (rdev->pdev->device == 0x6667)) {
                         max_sclk = 75000;
-                        max_mclk = 80000;
                 }
         }
         /* Apply dpm quirks */
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index a0fd3e66bc4b..7aadce1f7e7a 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -839,7 +839,7 @@ static void vc4_crtc_destroy_state(struct drm_crtc *crtc,
 
         }
 
-        __drm_atomic_helper_crtc_destroy_state(state);
+        drm_atomic_helper_crtc_destroy_state(crtc, state);
 }
 
 static const struct drm_crtc_funcs vc4_crtc_funcs = {
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index db920771bfb5..ab3016982466 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -594,12 +594,14 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
                                           args->shader_rec_count);
         struct vc4_bo *bo;
 
-        if (uniforms_offset < shader_rec_offset ||
+        if (shader_rec_offset < args->bin_cl_size ||
+            uniforms_offset < shader_rec_offset ||
             exec_size < uniforms_offset ||
             args->shader_rec_count >= (UINT_MAX /
                                           sizeof(struct vc4_shader_state)) ||
             temp_size < exec_size) {
                 DRM_ERROR("overflow in exec arguments\n");
+                ret = -EINVAL;
                 goto fail;
         }
 
diff --git a/drivers/gpu/drm/vc4/vc4_render_cl.c b/drivers/gpu/drm/vc4/vc4_render_cl.c
index 08886a309757..5cdd003605f5 100644
--- a/drivers/gpu/drm/vc4/vc4_render_cl.c
+++ b/drivers/gpu/drm/vc4/vc4_render_cl.c
@@ -461,7 +461,7 @@ static int vc4_rcl_surface_setup(struct vc4_exec_info *exec,
                 }
 
                 ret = vc4_full_res_bounds_check(exec, *obj, surf);
-                if (!ret)
+                if (ret)
                         return ret;
 
                 return 0;
diff --git a/drivers/gpu/drm/virtio/virtgpu_fb.c b/drivers/gpu/drm/virtio/virtgpu_fb.c
index dd21f950e129..cde9f3758106 100644
--- a/drivers/gpu/drm/virtio/virtgpu_fb.c
+++ b/drivers/gpu/drm/virtio/virtgpu_fb.c
@@ -331,7 +331,7 @@ static int virtio_gpufb_create(struct drm_fb_helper *helper,
         info->fbops = &virtio_gpufb_ops;
         info->pixmap.flags = FB_PIXMAP_SYSTEM;
 
-        info->screen_base = obj->vmap;
+        info->screen_buffer = obj->vmap;
         info->screen_size = obj->gem_base.size;
         drm_fb_helper_fill_fix(info, fb->pitches[0], fb->depth);
         drm_fb_helper_fill_var(info, &vfbdev->helper,
diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index f31a778b0851..b22d0f83f8e3 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -168,7 +168,7 @@ struct cp2112_device {
         atomic_t xfer_avail;
         struct gpio_chip gc;
         u8 *in_out_buffer;
-        spinlock_t lock;
+        struct mutex lock;
 
         struct gpio_desc *desc[8];
         bool gpio_poll;
@@ -186,10 +186,9 @@ static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
         struct cp2112_device *dev = gpiochip_get_data(chip);
         struct hid_device *hdev = dev->hdev;
         u8 *buf = dev->in_out_buffer;
-        unsigned long flags;
         int ret;
 
-        spin_lock_irqsave(&dev->lock, flags);
+        mutex_lock(&dev->lock);
 
         ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
                                  CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
@@ -213,8 +212,8 @@ static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
         ret = 0;
 
 exit:
-        spin_unlock_irqrestore(&dev->lock, flags);
-        return ret <= 0 ? ret : -EIO;
+        mutex_unlock(&dev->lock);
+        return ret < 0 ? ret : -EIO;
 }
 
 static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
@@ -222,10 +221,9 @@ static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
         struct cp2112_device *dev = gpiochip_get_data(chip);
         struct hid_device *hdev = dev->hdev;
         u8 *buf = dev->in_out_buffer;
-        unsigned long flags;
         int ret;
 
-        spin_lock_irqsave(&dev->lock, flags);
+        mutex_lock(&dev->lock);
 
         buf[0] = CP2112_GPIO_SET;
         buf[1] = value ? 0xff : 0;
@@ -237,7 +235,7 @@ static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
         if (ret < 0)
                 hid_err(hdev, "error setting GPIO values: %d\n", ret);
 
-        spin_unlock_irqrestore(&dev->lock, flags);
+        mutex_unlock(&dev->lock);
 }
 
 static int cp2112_gpio_get_all(struct gpio_chip *chip)
@@ -245,10 +243,9 @@ static int cp2112_gpio_get_all(struct gpio_chip *chip)
         struct cp2112_device *dev = gpiochip_get_data(chip);
         struct hid_device *hdev = dev->hdev;
         u8 *buf = dev->in_out_buffer;
-        unsigned long flags;
         int ret;
 
-        spin_lock_irqsave(&dev->lock, flags);
+        mutex_lock(&dev->lock);
 
         ret = hid_hw_raw_request(hdev, CP2112_GPIO_GET, buf,
                                  CP2112_GPIO_GET_LENGTH, HID_FEATURE_REPORT,
@@ -262,7 +259,7 @@ static int cp2112_gpio_get_all(struct gpio_chip *chip)
         ret = buf[1];
 
 exit:
-        spin_unlock_irqrestore(&dev->lock, flags);
+        mutex_unlock(&dev->lock);
 
         return ret;
 }
@@ -284,10 +281,9 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
         struct cp2112_device *dev = gpiochip_get_data(chip);
         struct hid_device *hdev = dev->hdev;
         u8 *buf = dev->in_out_buffer;
-        unsigned long flags;
         int ret;
 
-        spin_lock_irqsave(&dev->lock, flags);
+        mutex_lock(&dev->lock);
 
         ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
                                  CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
@@ -308,7 +304,7 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
                 goto fail;
         }
 
-        spin_unlock_irqrestore(&dev->lock, flags);
+        mutex_unlock(&dev->lock);
 
         /*
          * Set gpio value when output direction is already set,
@@ -319,7 +315,7 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
         return 0;
 
 fail:
-        spin_unlock_irqrestore(&dev->lock, flags);
+        mutex_unlock(&dev->lock);
         return ret < 0 ? ret : -EIO;
 }
 
@@ -1235,7 +1231,7 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
         if (!dev->in_out_buffer)
                 return -ENOMEM;
 
-        spin_lock_init(&dev->lock);
+        mutex_init(&dev->lock);
 
         ret = hid_parse(hdev);
         if (ret) {
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index f46f2c5117fa..350accfee8e8 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -76,6 +76,9 @@
 #define USB_VENDOR_ID_ALPS_JP           0x044E
 #define HID_DEVICE_ID_ALPS_U1_DUAL      0x120B
 
+#define USB_VENDOR_ID_AMI               0x046b
+#define USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE       0xff10
+
 #define USB_VENDOR_ID_ANTON             0x1130
 #define USB_DEVICE_ID_ANTON_TOUCH_PAD   0x3101
 
diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
index c5c5fbe9d605..52026dc94d5c 100644
--- a/drivers/hid/hid-lg.c
+++ b/drivers/hid/hid-lg.c
@@ -872,7 +872,7 @@ static const struct hid_device_id lg_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG),
                 .driver_data = LG_NOGET | LG_FF4 },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2),
-                .driver_data = LG_FF2 },
+                .driver_data = LG_NOGET | LG_FF2 },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FLIGHT_SYSTEM_G940),
                 .driver_data = LG_FF3 },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR),
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index e9d6cc7cdfc5..30a2977e2645 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -57,6 +57,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_AMI, USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 0884dc9554fd..672145b0d8f5 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -166,19 +166,21 @@ static int wacom_pl_irq(struct wacom_wac *wacom)
                 wacom->id[0] = STYLUS_DEVICE_ID;
         }
 
-        pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1));
-        if (features->pressure_max > 255)
-                pressure = (pressure << 1) | ((data[4] >> 6) & 1);
-        pressure += (features->pressure_max + 1) / 2;
-
-        input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14));
-        input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14));
-        input_report_abs(input, ABS_PRESSURE, pressure);
-
-        input_report_key(input, BTN_TOUCH, data[4] & 0x08);
-        input_report_key(input, BTN_STYLUS, data[4] & 0x10);
-        /* Only allow the stylus2 button to be reported for the pen tool. */
-        input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20));
+        if (prox) {
+                pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1));
+                if (features->pressure_max > 255)
+                        pressure = (pressure << 1) | ((data[4] >> 6) & 1);
+                pressure += (features->pressure_max + 1) / 2;
+
+                input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14));
+                input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14));
+                input_report_abs(input, ABS_PRESSURE, pressure);
+
+                input_report_key(input, BTN_TOUCH, data[4] & 0x08);
+                input_report_key(input, BTN_STYLUS, data[4] & 0x10);
+                /* Only allow the stylus2 button to be reported for the pen tool. */
+                input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20));
+        }
 
         if (!prox)
                 wacom->id[0] = 0;
diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index cd49cb17eb7f..308dbda700eb 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -383,6 +383,7 @@ int hv_ringbuffer_read(struct vmbus_channel *channel,
                 return ret;
         }
 
+        init_cached_read_index(channel);
         next_read_location = hv_get_next_read_location(inring_info);
         next_read_location = hv_copyfrom_ringbuffer(inring_info, &desc,
                                                     sizeof(desc),
diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index 686971263bef..45d6771fac8c 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -962,10 +962,6 @@ static int cdns_i2c_probe(struct platform_device *pdev)
                 goto err_clk_dis;
         }
 
-        ret = i2c_add_adapter(&id->adap);
-        if (ret < 0)
-                goto err_clk_dis;
-
         /*
          * Cadence I2C controller has a bug wherein it generates
          * invalid read transaction after HW timeout in master receiver mode.
@@ -975,6 +971,10 @@ static int cdns_i2c_probe(struct platform_device *pdev)
          */
         cdns_i2c_writereg(CDNS_I2C_TIMEOUT_MAX, CDNS_I2C_TIME_OUT_OFFSET);
 
+        ret = i2c_add_adapter(&id->adap);
+        if (ret < 0)
+                goto err_clk_dis;
+
         dev_info(&pdev->dev, "%u kHz mmio %08lx irq %d\n",
                  id->i2c_clk / 1000, (unsigned long)r_mem->start, id->irq);
 
diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c
index c62b7cd475f8..3310f2e0dbd3 100644
--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
+++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
@@ -28,6 +28,7 @@
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
+#include <linux/pinctrl/consumer.h>
 #include <linux/platform_device.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
@@ -636,12 +637,31 @@ static int lpi2c_imx_remove(struct platform_device *pdev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
+static int lpi2c_imx_suspend(struct device *dev)
+{
+        pinctrl_pm_select_sleep_state(dev);
+
+        return 0;
+}
+
+static int lpi2c_imx_resume(struct device *dev)
+{
+        pinctrl_pm_select_default_state(dev);
+
+        return 0;
+}
+#endif
+
+static SIMPLE_DEV_PM_OPS(imx_lpi2c_pm, lpi2c_imx_suspend, lpi2c_imx_resume);
+
 static struct platform_driver lpi2c_imx_driver = {
         .probe = lpi2c_imx_probe,
         .remove = lpi2c_imx_remove,
         .driver = {
                 .name = DRIVER_NAME,
                 .of_match_table = lpi2c_imx_of_match,
+                .pm = &imx_lpi2c_pm,
         },
 };
 
diff --git a/drivers/iio/adc/palmas_gpadc.c b/drivers/iio/adc/palmas_gpadc.c
index 2bbf0c521beb..7d61b566e148 100644
--- a/drivers/iio/adc/palmas_gpadc.c
+++ b/drivers/iio/adc/palmas_gpadc.c
@@ -775,7 +775,7 @@ static int palmas_adc_wakeup_reset(struct palmas_gpadc *adc)
 
 static int palmas_gpadc_suspend(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = dev_get_drvdata(dev);
         struct palmas_gpadc *adc = iio_priv(indio_dev);
         int wakeup = adc->wakeup1_enable || adc->wakeup2_enable;
         int ret;
@@ -798,7 +798,7 @@ static int palmas_gpadc_suspend(struct device *dev)
 
 static int palmas_gpadc_resume(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = dev_get_drvdata(dev);
         struct palmas_gpadc *adc = iio_priv(indio_dev);
         int wakeup = adc->wakeup1_enable || adc->wakeup2_enable;
         int ret;
diff --git a/drivers/iio/health/afe4403.c b/drivers/iio/health/afe4403.c
index 9a081465c42f..6bb23a49e81e 100644
--- a/drivers/iio/health/afe4403.c
+++ b/drivers/iio/health/afe4403.c
@@ -422,7 +422,7 @@ MODULE_DEVICE_TABLE(of, afe4403_of_match);
 
 static int __maybe_unused afe4403_suspend(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = spi_get_drvdata(to_spi_device(dev));
         struct afe4403_data *afe = iio_priv(indio_dev);
         int ret;
 
@@ -443,7 +443,7 @@ static int __maybe_unused afe4403_suspend(struct device *dev)
 
 static int __maybe_unused afe4403_resume(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = spi_get_drvdata(to_spi_device(dev));
         struct afe4403_data *afe = iio_priv(indio_dev);
         int ret;
 
diff --git a/drivers/iio/health/afe4404.c b/drivers/iio/health/afe4404.c
index 45266404f7e3..964f5231a831 100644
--- a/drivers/iio/health/afe4404.c
+++ b/drivers/iio/health/afe4404.c
@@ -428,7 +428,7 @@ MODULE_DEVICE_TABLE(of, afe4404_of_match);
 
 static int __maybe_unused afe4404_suspend(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
         struct afe4404_data *afe = iio_priv(indio_dev);
         int ret;
 
@@ -449,7 +449,7 @@ static int __maybe_unused afe4404_suspend(struct device *dev)
 
 static int __maybe_unused afe4404_resume(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
         struct afe4404_data *afe = iio_priv(indio_dev);
         int ret;
 
diff --git a/drivers/iio/health/max30100.c b/drivers/iio/health/max30100.c
index 90ab8a2d2846..183c14329d6e 100644
--- a/drivers/iio/health/max30100.c
+++ b/drivers/iio/health/max30100.c
@@ -238,7 +238,7 @@ static irqreturn_t max30100_interrupt_handler(int irq, void *private)
 
         mutex_lock(&data->lock);
 
-        while (cnt || (cnt = max30100_fifo_count(data) > 0)) {
+        while (cnt || (cnt = max30100_fifo_count(data)) > 0) {
                 ret = max30100_read_measurement(data);
                 if (ret)
                         break;
diff --git a/drivers/iio/humidity/dht11.c b/drivers/iio/humidity/dht11.c
index 9c47bc98f3ac..2a22ad920333 100644
--- a/drivers/iio/humidity/dht11.c
+++ b/drivers/iio/humidity/dht11.c
@@ -71,7 +71,8 @@
  * a) select an implementation using busy loop polling on those systems
  * b) use the checksum to do some probabilistic decoding
  */
-#define DHT11_START_TRANSMISSION        18  /* ms */
+#define DHT11_START_TRANSMISSION_MIN    18000  /* us */
+#define DHT11_START_TRANSMISSION_MAX    20000  /* us */
 #define DHT11_MIN_TIMERES       34000  /* ns */
 #define DHT11_THRESHOLD         49000  /* ns */
 #define DHT11_AMBIG_LOW         23000  /* ns */
@@ -228,7 +229,8 @@ static int dht11_read_raw(struct iio_dev *iio_dev,
                 ret = gpio_direction_output(dht11->gpio, 0);
                 if (ret)
                         goto err;
-                msleep(DHT11_START_TRANSMISSION);
+                usleep_range(DHT11_START_TRANSMISSION_MIN,
+                             DHT11_START_TRANSMISSION_MAX);
                 ret = gpio_direction_input(dht11->gpio);
                 if (ret)
                         goto err;
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index e7dcfac877ca..3e70a9c5d79d 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2811,7 +2811,8 @@ static int cma_bind_addr(struct rdma_cm_id *id, struct sockaddr *src_addr,
         if (!src_addr || !src_addr->sa_family) {
                 src_addr = (struct sockaddr *) &id->route.addr.src_addr;
                 src_addr->sa_family = dst_addr->sa_family;
-                if (dst_addr->sa_family == AF_INET6) {
+                if (IS_ENABLED(CONFIG_IPV6) &&
+                    dst_addr->sa_family == AF_INET6) {
                         struct sockaddr_in6 *src_addr6 = (struct sockaddr_in6 *) src_addr;
                         struct sockaddr_in6 *dst_addr6 = (struct sockaddr_in6 *) dst_addr;
                         src_addr6->sin6_scope_id = dst_addr6->sin6_scope_id;
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 1e62a5f0cb28..4609b921f899 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -134,6 +134,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
                  IB_ACCESS_REMOTE_ATOMIC | IB_ACCESS_MW_BIND));
 
         if (access & IB_ACCESS_ON_DEMAND) {
+                put_pid(umem->pid);
                 ret = ib_umem_odp_get(context, umem);
                 if (ret) {
                         kfree(umem);
@@ -149,6 +150,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
 
         page_list = (struct page **) __get_free_page(GFP_KERNEL);
         if (!page_list) {
+                put_pid(umem->pid);
                 kfree(umem);
                 return ERR_PTR(-ENOMEM);
         }
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index 9d5fe1853da4..6262dc035f3c 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -1135,16 +1135,7 @@ static int iwch_query_port(struct ib_device *ibdev,
 
         memset(props, 0, sizeof(struct ib_port_attr));
         props->max_mtu = IB_MTU_4096;
-        if (netdev->mtu >= 4096)
-                props->active_mtu = IB_MTU_4096;
-        else if (netdev->mtu >= 2048)
-                props->active_mtu = IB_MTU_2048;
-        else if (netdev->mtu >= 1024)
-                props->active_mtu = IB_MTU_1024;
-        else if (netdev->mtu >= 512)
-                props->active_mtu = IB_MTU_512;
-        else
-                props->active_mtu = IB_MTU_256;
+        props->active_mtu = ib_mtu_int_to_enum(netdev->mtu);
 
         if (!netif_carrier_ok(netdev))
                 props->state = IB_PORT_DOWN;
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index f1510cc76d2d..9398143d7c5e 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1804,20 +1804,21 @@ static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
         skb_trim(skb, dlen);
         mutex_lock(&ep->com.mutex);
 
-        /* update RX credits */
-        update_rx_credits(ep, dlen);
-
         switch (ep->com.state) {
         case MPA_REQ_SENT:
+                update_rx_credits(ep, dlen);
                 ep->rcv_seq += dlen;
                 disconnect = process_mpa_reply(ep, skb);
                 break;
         case MPA_REQ_WAIT:
+                update_rx_credits(ep, dlen);
                 ep->rcv_seq += dlen;
                 disconnect = process_mpa_request(ep, skb);
                 break;
         case FPDU_MODE: {
                 struct c4iw_qp_attributes attrs;
+
+                update_rx_credits(ep, dlen);
                 BUG_ON(!ep->com.qp);
                 if (status)
                         pr_err("%s Unexpected streaming data." \
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 19c6477af19f..bec82a600d77 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -505,6 +505,15 @@ static int poll_cq(struct t4_wq *wq, struct t4_cq *cq, struct t4_cqe *cqe,
         }
 
         /*
+         * Special cqe for drain WR completions...
+         */
+        if (CQE_OPCODE(hw_cqe) == C4IW_DRAIN_OPCODE) {
+                *cookie = CQE_DRAIN_COOKIE(hw_cqe);
+                *cqe = *hw_cqe;
+                goto skip_cqe;
+        }
+
+        /*
          * Gotta tweak READ completions:
          *      1) the cqe doesn't contain the sq_wptr from the wr.
          *      2) opcode not reflected from the wr.
@@ -753,6 +762,9 @@ static int c4iw_poll_cq_one(struct c4iw_cq *chp, struct ib_wc *wc)
                                 c4iw_invalidate_mr(qhp->rhp,
                                                    CQE_WRID_FR_STAG(&cqe));
                         break;
+                case C4IW_DRAIN_OPCODE:
+                        wc->opcode = IB_WC_SEND;
+                        break;
                 default:
                         printk(KERN_ERR MOD "Unexpected opcode %d "
                                "in the CQE received for QPID=0x%0x\n",
@@ -817,15 +829,8 @@ static int c4iw_poll_cq_one(struct c4iw_cq *chp, struct ib_wc *wc)
                 }
         }
 out:
-        if (wq) {
-                if (unlikely(qhp->attr.state != C4IW_QP_STATE_RTS)) {
-                        if (t4_sq_empty(wq))
-                                complete(&qhp->sq_drained);
-                        if (t4_rq_empty(wq))
-                                complete(&qhp->rq_drained);
-                }
+        if (wq)
                 spin_unlock(&qhp->lock);
-        }
         return ret;
 }
 
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index 516b0ae6dc3f..40c0e7b9fc6e 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -846,9 +846,17 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
                 }
         }
 
+        rdev->free_workq = create_singlethread_workqueue("iw_cxgb4_free");
+        if (!rdev->free_workq) {
+                err = -ENOMEM;
+                goto err_free_status_page;
+        }
+
         rdev->status_page->db_off = 0;
 
         return 0;
+err_free_status_page:
+        free_page((unsigned long)rdev->status_page);
 destroy_ocqp_pool:
         c4iw_ocqp_pool_destroy(rdev);
 destroy_rqtpool:
@@ -862,6 +870,7 @@ destroy_resource:
 
 static void c4iw_rdev_close(struct c4iw_rdev *rdev)
 {
+        destroy_workqueue(rdev->free_workq);
         kfree(rdev->wr_log);
         free_page((unsigned long)rdev->status_page);
         c4iw_pblpool_destroy(rdev);
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index 4788e1a46fde..8cd4d054a87e 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -45,6 +45,7 @@
 #include <linux/kref.h>
 #include <linux/timer.h>
 #include <linux/io.h>
+#include <linux/workqueue.h>
 
 #include <asm/byteorder.h>
 
@@ -107,6 +108,7 @@ struct c4iw_dev_ucontext {
         struct list_head qpids;
         struct list_head cqids;
         struct mutex lock;
+        struct kref kref;
 };
 
 enum c4iw_rdev_flags {
@@ -183,6 +185,7 @@ struct c4iw_rdev {
         atomic_t wr_log_idx;
         struct wr_log_entry *wr_log;
         int wr_log_size;
+        struct workqueue_struct *free_workq;
 };
 
 static inline int c4iw_fatal_error(struct c4iw_rdev *rdev)
@@ -480,8 +483,8 @@ struct c4iw_qp {
         wait_queue_head_t wait;
         struct timer_list timer;
         int sq_sig_all;
-        struct completion rq_drained;
-        struct completion sq_drained;
+        struct work_struct free_work;
+        struct c4iw_ucontext *ucontext;
 };
 
 static inline struct c4iw_qp *to_c4iw_qp(struct ib_qp *ibqp)
@@ -495,6 +498,7 @@ struct c4iw_ucontext {
         u32 key;
         spinlock_t mmap_lock;
         struct list_head mmaps;
+        struct kref kref;
 };
 
 static inline struct c4iw_ucontext *to_c4iw_ucontext(struct ib_ucontext *c)
@@ -502,6 +506,18 @@ static inline struct c4iw_ucontext *to_c4iw_ucontext(struct ib_ucontext *c)
         return container_of(c, struct c4iw_ucontext, ibucontext);
 }
 
+void _c4iw_free_ucontext(struct kref *kref);
+
+static inline void c4iw_put_ucontext(struct c4iw_ucontext *ucontext)
+{
+        kref_put(&ucontext->kref, _c4iw_free_ucontext);
+}
+
+static inline void c4iw_get_ucontext(struct c4iw_ucontext *ucontext)
+{
+        kref_get(&ucontext->kref);
+}
+
 struct c4iw_mm_entry {
         struct list_head entry;
         u64 addr;
@@ -615,6 +631,8 @@ static inline int to_ib_qp_state(int c4iw_qp_state)
         return IB_QPS_ERR;
 }
 
+#define C4IW_DRAIN_OPCODE FW_RI_SGE_EC_CR_RETURN
+
 static inline u32 c4iw_ib_to_tpt_access(int a)
 {
         return (a & IB_ACCESS_REMOTE_WRITE ? FW_RI_MEM_ACCESS_REM_WRITE : 0) |
@@ -997,8 +1015,6 @@ extern int c4iw_wr_log;
 extern int db_fc_threshold;
 extern int db_coalescing_threshold;
 extern int use_dsgl;
-void c4iw_drain_rq(struct ib_qp *qp);
-void c4iw_drain_sq(struct ib_qp *qp);
 void c4iw_invalidate_mr(struct c4iw_dev *rhp, u32 rkey);
 
 #endif
diff --git a/drivers/infiniband/hw/cxgb4/provider.c b/drivers/infiniband/hw/cxgb4/provider.c
index 49b51b7e0fd7..3345e1c312f7 100644
--- a/drivers/infiniband/hw/cxgb4/provider.c
+++ b/drivers/infiniband/hw/cxgb4/provider.c
@@ -93,17 +93,28 @@ static int c4iw_process_mad(struct ib_device *ibdev, int mad_flags,
         return -ENOSYS;
 }
 
-static int c4iw_dealloc_ucontext(struct ib_ucontext *context)
+void _c4iw_free_ucontext(struct kref *kref)
 {
-        struct c4iw_dev *rhp = to_c4iw_dev(context->device);
-        struct c4iw_ucontext *ucontext = to_c4iw_ucontext(context);
+        struct c4iw_ucontext *ucontext;
+        struct c4iw_dev *rhp;
         struct c4iw_mm_entry *mm, *tmp;
 
-        PDBG("%s context %p\n", __func__, context);
+        ucontext = container_of(kref, struct c4iw_ucontext, kref);
+        rhp = to_c4iw_dev(ucontext->ibucontext.device);
+
+        PDBG("%s ucontext %p\n", __func__, ucontext);
         list_for_each_entry_safe(mm, tmp, &ucontext->mmaps, entry)
                 kfree(mm);
         c4iw_release_dev_ucontext(&rhp->rdev, &ucontext->uctx);
         kfree(ucontext);
+}
+
+static int c4iw_dealloc_ucontext(struct ib_ucontext *context)
+{
+        struct c4iw_ucontext *ucontext = to_c4iw_ucontext(context);
+
+        PDBG("%s context %p\n", __func__, context);
+        c4iw_put_ucontext(ucontext);
         return 0;
 }
 
@@ -127,6 +138,7 @@ static struct ib_ucontext *c4iw_alloc_ucontext(struct ib_device *ibdev,
         c4iw_init_dev_ucontext(&rhp->rdev, &context->uctx);
         INIT_LIST_HEAD(&context->mmaps);
         spin_lock_init(&context->mmap_lock);
+        kref_init(&context->kref);
 
         if (udata->outlen < sizeof(uresp) - sizeof(uresp.reserved)) {
                 if (!warned++)
@@ -361,16 +373,7 @@ static int c4iw_query_port(struct ib_device *ibdev, u8 port,
 
         memset(props, 0, sizeof(struct ib_port_attr));
         props->max_mtu = IB_MTU_4096;
-        if (netdev->mtu >= 4096)
-                props->active_mtu = IB_MTU_4096;
-        else if (netdev->mtu >= 2048)
-                props->active_mtu = IB_MTU_2048;
-        else if (netdev->mtu >= 1024)
-                props->active_mtu = IB_MTU_1024;
-        else if (netdev->mtu >= 512)
-                props->active_mtu = IB_MTU_512;
-        else
-                props->active_mtu = IB_MTU_256;
+        props->active_mtu = ib_mtu_int_to_enum(netdev->mtu);
 
         if (!netif_carrier_ok(netdev))
                 props->state = IB_PORT_DOWN;
@@ -607,8 +610,6 @@ int c4iw_register_device(struct c4iw_dev *dev)
         dev->ibdev.uverbs_abi_ver = C4IW_UVERBS_ABI_VERSION;
         dev->ibdev.get_port_immutable = c4iw_port_immutable;
         dev->ibdev.get_dev_fw_str = get_dev_fw_str;
-        dev->ibdev.drain_sq = c4iw_drain_sq;
-        dev->ibdev.drain_rq = c4iw_drain_rq;
 
         dev->ibdev.iwcm = kmalloc(sizeof(struct iw_cm_verbs), GFP_KERNEL);
         if (!dev->ibdev.iwcm)
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index cda5542e13a2..04c1c382dedb 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -715,13 +715,32 @@ static int build_inv_stag(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
         return 0;
 }
 
-static void _free_qp(struct kref *kref)
+static void free_qp_work(struct work_struct *work)
+{
+        struct c4iw_ucontext *ucontext;
+        struct c4iw_qp *qhp;
+        struct c4iw_dev *rhp;
+
+        qhp = container_of(work, struct c4iw_qp, free_work);
+        ucontext = qhp->ucontext;
+        rhp = qhp->rhp;
+
+        PDBG("%s qhp %p ucontext %p\n", __func__, qhp, ucontext);
+        destroy_qp(&rhp->rdev, &qhp->wq,
+                   ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+
+        if (ucontext)
+                c4iw_put_ucontext(ucontext);
+        kfree(qhp);
+}
+
+static void queue_qp_free(struct kref *kref)
 {
         struct c4iw_qp *qhp;
 
         qhp = container_of(kref, struct c4iw_qp, kref);
         PDBG("%s qhp %p\n", __func__, qhp);
-        kfree(qhp);
+        queue_work(qhp->rhp->rdev.free_workq, &qhp->free_work);
 }
 
 void c4iw_qp_add_ref(struct ib_qp *qp)
@@ -733,7 +752,7 @@ void c4iw_qp_add_ref(struct ib_qp *qp)
 void c4iw_qp_rem_ref(struct ib_qp *qp)
 {
         PDBG("%s ib_qp %p\n", __func__, qp);
-        kref_put(&to_c4iw_qp(qp)->kref, _free_qp);
+        kref_put(&to_c4iw_qp(qp)->kref, queue_qp_free);
 }
 
 static void add_to_fc_list(struct list_head *head, struct list_head *entry)
@@ -776,6 +795,64 @@ static int ring_kernel_rq_db(struct c4iw_qp *qhp, u16 inc)
         return 0;
 }
 
+static void complete_sq_drain_wr(struct c4iw_qp *qhp, struct ib_send_wr *wr)
+{
+        struct t4_cqe cqe = {};
+        struct c4iw_cq *schp;
+        unsigned long flag;
+        struct t4_cq *cq;
+
+        schp = to_c4iw_cq(qhp->ibqp.send_cq);
+        cq = &schp->cq;
+
+        cqe.u.drain_cookie = wr->wr_id;
+        cqe.header = cpu_to_be32(CQE_STATUS_V(T4_ERR_SWFLUSH) |
+                                 CQE_OPCODE_V(C4IW_DRAIN_OPCODE) |
+                                 CQE_TYPE_V(1) |
+                                 CQE_SWCQE_V(1) |
+                                 CQE_QPID_V(qhp->wq.sq.qid));
+
+        spin_lock_irqsave(&schp->lock, flag);
+        cqe.bits_type_ts = cpu_to_be64(CQE_GENBIT_V((u64)cq->gen));
+        cq->sw_queue[cq->sw_pidx] = cqe;
+        t4_swcq_produce(cq);
+        spin_unlock_irqrestore(&schp->lock, flag);
+
+        spin_lock_irqsave(&schp->comp_handler_lock, flag);
+        (*schp->ibcq.comp_handler)(&schp->ibcq,
+                                   schp->ibcq.cq_context);
+        spin_unlock_irqrestore(&schp->comp_handler_lock, flag);
+}
+
+static void complete_rq_drain_wr(struct c4iw_qp *qhp, struct ib_recv_wr *wr)
+{
+        struct t4_cqe cqe = {};
+        struct c4iw_cq *rchp;
+        unsigned long flag;
+        struct t4_cq *cq;
+
+        rchp = to_c4iw_cq(qhp->ibqp.recv_cq);
+        cq = &rchp->cq;
+
+        cqe.u.drain_cookie = wr->wr_id;
+        cqe.header = cpu_to_be32(CQE_STATUS_V(T4_ERR_SWFLUSH) |
+                                 CQE_OPCODE_V(C4IW_DRAIN_OPCODE) |
+                                 CQE_TYPE_V(0) |
+                                 CQE_SWCQE_V(1) |
+                                 CQE_QPID_V(qhp->wq.sq.qid));
+
+        spin_lock_irqsave(&rchp->lock, flag);
+        cqe.bits_type_ts = cpu_to_be64(CQE_GENBIT_V((u64)cq->gen));
+        cq->sw_queue[cq->sw_pidx] = cqe;
+        t4_swcq_produce(cq);
+        spin_unlock_irqrestore(&rchp->lock, flag);
+
+        spin_lock_irqsave(&rchp->comp_handler_lock, flag);
+        (*rchp->ibcq.comp_handler)(&rchp->ibcq,
+                                   rchp->ibcq.cq_context);
+        spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);
+}
+
 int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                    struct ib_send_wr **bad_wr)
 {
@@ -794,8 +871,8 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
         spin_lock_irqsave(&qhp->lock, flag);
         if (t4_wq_in_error(&qhp->wq)) {
                 spin_unlock_irqrestore(&qhp->lock, flag);
-                *bad_wr = wr;
-                return -EINVAL;
+                complete_sq_drain_wr(qhp, wr);
+                return err;
         }
         num_wrs = t4_sq_avail(&qhp->wq);
         if (num_wrs == 0) {
@@ -937,8 +1014,8 @@ int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
         spin_lock_irqsave(&qhp->lock, flag);
         if (t4_wq_in_error(&qhp->wq)) {
                 spin_unlock_irqrestore(&qhp->lock, flag);
-                *bad_wr = wr;
-                return -EINVAL;
+                complete_rq_drain_wr(qhp, wr);
+                return err;
         }
         num_wrs = t4_rq_avail(&qhp->wq);
         if (num_wrs == 0) {
@@ -1550,7 +1627,12 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
                 }
                 break;
         case C4IW_QP_STATE_CLOSING:
-                if (!internal) {
+
+                /*
+                 * Allow kernel users to move to ERROR for qp draining.
+                 */
+                if (!internal && (qhp->ibqp.uobject || attrs->next_state !=
+                                  C4IW_QP_STATE_ERROR)) {
                         ret = -EINVAL;
                         goto out;
                 }
@@ -1643,7 +1725,6 @@ int c4iw_destroy_qp(struct ib_qp *ib_qp)
         struct c4iw_dev *rhp;
         struct c4iw_qp *qhp;
         struct c4iw_qp_attributes attrs;
-        struct c4iw_ucontext *ucontext;
 
         qhp = to_c4iw_qp(ib_qp);
         rhp = qhp->rhp;
@@ -1663,11 +1744,6 @@ int c4iw_destroy_qp(struct ib_qp *ib_qp)
         spin_unlock_irq(&rhp->lock);
         free_ird(rhp, qhp->attr.max_ird);
 
-        ucontext = ib_qp->uobject ?
-                   to_c4iw_ucontext(ib_qp->uobject->context) : NULL;
-        destroy_qp(&rhp->rdev, &qhp->wq,
-                   ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
-
         c4iw_qp_rem_ref(ib_qp);
 
         PDBG("%s ib_qp %p qpid 0x%0x\n", __func__, ib_qp, qhp->wq.sq.qid);
@@ -1763,11 +1839,10 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
         qhp->attr.max_ird = 0;
         qhp->sq_sig_all = attrs->sq_sig_type == IB_SIGNAL_ALL_WR;
         spin_lock_init(&qhp->lock);
-        init_completion(&qhp->sq_drained);
-        init_completion(&qhp->rq_drained);
         mutex_init(&qhp->mutex);
         init_waitqueue_head(&qhp->wait);
         kref_init(&qhp->kref);
+        INIT_WORK(&qhp->free_work, free_qp_work);
 
         ret = insert_handle(rhp, &rhp->qpidr, qhp, qhp->wq.sq.qid);
         if (ret)
@@ -1854,6 +1929,9 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
                         ma_sync_key_mm->len = PAGE_SIZE;
                         insert_mmap(ucontext, ma_sync_key_mm);
                 }
+
+                c4iw_get_ucontext(ucontext);
+                qhp->ucontext = ucontext;
         }
         qhp->ibqp.qp_num = qhp->wq.sq.qid;
         init_timer(&(qhp->timer));
@@ -1958,40 +2036,3 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
         init_attr->sq_sig_type = qhp->sq_sig_all ? IB_SIGNAL_ALL_WR : 0;
         return 0;
 }
-
-static void move_qp_to_err(struct c4iw_qp *qp)
-{
-        struct c4iw_qp_attributes attrs = { .next_state = C4IW_QP_STATE_ERROR };
-
-        (void)c4iw_modify_qp(qp->rhp, qp, C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
-}
-
-void c4iw_drain_sq(struct ib_qp *ibqp)
-{
-        struct c4iw_qp *qp = to_c4iw_qp(ibqp);
-        unsigned long flag;
-        bool need_to_wait;
-
-        move_qp_to_err(qp);
-        spin_lock_irqsave(&qp->lock, flag);
-        need_to_wait = !t4_sq_empty(&qp->wq);
-        spin_unlock_irqrestore(&qp->lock, flag);
-
-        if (need_to_wait)
-                wait_for_completion(&qp->sq_drained);
-}
-
-void c4iw_drain_rq(struct ib_qp *ibqp)
-{
-        struct c4iw_qp *qp = to_c4iw_qp(ibqp);
-        unsigned long flag;
-        bool need_to_wait;
-
-        move_qp_to_err(qp);
-        spin_lock_irqsave(&qp->lock, flag);
-        need_to_wait = !t4_rq_empty(&qp->wq);
-        spin_unlock_irqrestore(&qp->lock, flag);
-
-        if (need_to_wait)
-                wait_for_completion(&qp->rq_drained);
-}
diff --git a/drivers/infiniband/hw/cxgb4/t4.h b/drivers/infiniband/hw/cxgb4/t4.h
index 862381aa83c8..640d22148a3e 100644
--- a/drivers/infiniband/hw/cxgb4/t4.h
+++ b/drivers/infiniband/hw/cxgb4/t4.h
@@ -179,6 +179,7 @@ struct t4_cqe {
                         __be32 wrid_hi;
                         __be32 wrid_low;
                 } gen;
+                u64 drain_cookie;
         } u;
         __be64 reserved;
         __be64 bits_type_ts;
@@ -238,6 +239,7 @@ struct t4_cqe {
 /* generic accessor macros */
 #define CQE_WRID_HI(x)          (be32_to_cpu((x)->u.gen.wrid_hi))
 #define CQE_WRID_LOW(x)         (be32_to_cpu((x)->u.gen.wrid_low))
+#define CQE_DRAIN_COOKIE(x)     ((x)->u.drain_cookie)
 
 /* macros for flit 3 of the cqe */
 #define CQE_GENBIT_S    63
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 29e97df9e1a7..4c000d60d5c6 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -100,16 +100,7 @@ static int i40iw_query_port(struct ib_device *ibdev,
         memset(props, 0, sizeof(*props));
 
         props->max_mtu = IB_MTU_4096;
-        if (netdev->mtu >= 4096)
-                props->active_mtu = IB_MTU_4096;
-        else if (netdev->mtu >= 2048)
-                props->active_mtu = IB_MTU_2048;
-        else if (netdev->mtu >= 1024)
-                props->active_mtu = IB_MTU_1024;
-        else if (netdev->mtu >= 512)
-                props->active_mtu = IB_MTU_512;
-        else
-                props->active_mtu = IB_MTU_256;
+        props->active_mtu = ib_mtu_int_to_enum(netdev->mtu);
 
         props->lid = 1;
         if (netif_carrier_ok(iwdev->netdev))
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index aff9fb14768b..5a31f3c6a421 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -478,17 +478,7 @@ static int nes_query_port(struct ib_device *ibdev, u8 port, struct ib_port_attr
         memset(props, 0, sizeof(*props));
 
         props->max_mtu = IB_MTU_4096;
-
-        if (netdev->mtu  >= 4096)
-                props->active_mtu = IB_MTU_4096;
-        else if (netdev->mtu  >= 2048)
-                props->active_mtu = IB_MTU_2048;
-        else if (netdev->mtu  >= 1024)
-                props->active_mtu = IB_MTU_1024;
-        else if (netdev->mtu  >= 512)
-                props->active_mtu = IB_MTU_512;
-        else
-                props->active_mtu = IB_MTU_256;
+        props->active_mtu = ib_mtu_int_to_enum(netdev->mtu);
 
         props->lid = 1;
         props->lmc = 0;
diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c
index 7b74d09a8217..3ac8aa5ef37d 100644
--- a/drivers/infiniband/hw/qedr/main.c
+++ b/drivers/infiniband/hw/qedr/main.c
@@ -576,8 +576,7 @@ static int qedr_set_device_attr(struct qedr_dev *dev)
         return 0;
 }
 
-void qedr_unaffiliated_event(void *context,
-                             u8 event_code)
+void qedr_unaffiliated_event(void *context, u8 event_code)
 {
         pr_err("unaffiliated event not implemented yet\n");
 }
@@ -792,6 +791,9 @@ static struct qedr_dev *qedr_add(struct qed_dev *cdev, struct pci_dev *pdev,
                 if (device_create_file(&dev->ibdev.dev, qedr_attributes[i]))
                         goto sysfs_err;
 
+        if (!test_and_set_bit(QEDR_ENET_STATE_BIT, &dev->enet_state))
+                qedr_ib_dispatch_event(dev, QEDR_PORT, IB_EVENT_PORT_ACTIVE);
+
         DP_DEBUG(dev, QEDR_MSG_INIT, "qedr driver loaded successfully\n");
         return dev;
 
@@ -824,11 +826,10 @@ static void qedr_remove(struct qedr_dev *dev)
         ib_dealloc_device(&dev->ibdev);
 }
 
-static int qedr_close(struct qedr_dev *dev)
+static void qedr_close(struct qedr_dev *dev)
 {
-        qedr_ib_dispatch_event(dev, 1, IB_EVENT_PORT_ERR);
-
-        return 0;
+        if (test_and_clear_bit(QEDR_ENET_STATE_BIT, &dev->enet_state))
+                qedr_ib_dispatch_event(dev, QEDR_PORT, IB_EVENT_PORT_ERR);
 }
 
 static void qedr_shutdown(struct qedr_dev *dev)
@@ -837,6 +838,12 @@ static void qedr_shutdown(struct qedr_dev *dev)
         qedr_remove(dev);
 }
 
+static void qedr_open(struct qedr_dev *dev)
+{
+        if (!test_and_set_bit(QEDR_ENET_STATE_BIT, &dev->enet_state))
+                qedr_ib_dispatch_event(dev, QEDR_PORT, IB_EVENT_PORT_ACTIVE);
+}
+
 static void qedr_mac_address_change(struct qedr_dev *dev)
 {
         union ib_gid *sgid = &dev->sgid_tbl[0];
@@ -863,7 +870,7 @@ static void qedr_mac_address_change(struct qedr_dev *dev)
 
         ether_addr_copy(dev->gsi_ll2_mac_address, dev->ndev->dev_addr);
 
-        qedr_ib_dispatch_event(dev, 1, IB_EVENT_GID_CHANGE);
+        qedr_ib_dispatch_event(dev, QEDR_PORT, IB_EVENT_GID_CHANGE);
 
         if (rc)
                 DP_ERR(dev, "Error updating mac filter\n");
@@ -877,7 +884,7 @@ static void qedr_notify(struct qedr_dev *dev, enum qede_roce_event event)
 {
         switch (event) {
         case QEDE_UP:
-                qedr_ib_dispatch_event(dev, 1, IB_EVENT_PORT_ACTIVE);
+                qedr_open(dev);
                 break;
         case QEDE_DOWN:
                 qedr_close(dev);
diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h
index 620badd7d4fb..bb32e4792ec9 100644
--- a/drivers/infiniband/hw/qedr/qedr.h
+++ b/drivers/infiniband/hw/qedr/qedr.h
@@ -113,6 +113,8 @@ struct qedr_device_attr {
         struct qed_rdma_events events;
 };
 
+#define QEDR_ENET_STATE_BIT     (0)
+
 struct qedr_dev {
         struct ib_device        ibdev;
         struct qed_dev          *cdev;
@@ -153,6 +155,8 @@ struct qedr_dev {
         struct qedr_cq          *gsi_sqcq;
         struct qedr_cq          *gsi_rqcq;
         struct qedr_qp          *gsi_qp;
+
+        unsigned long enet_state;
 };
 
 #define QEDR_MAX_SQ_PBL                 (0x8000)
@@ -188,6 +192,7 @@ struct qedr_dev {
 #define QEDR_ROCE_MAX_CNQ_SIZE          (0x4000)
 
 #define QEDR_MAX_PORT                   (1)
+#define QEDR_PORT                       (1)
 
 #define QEDR_UVERBS(CMD_NAME) (1ull << IB_USER_VERBS_CMD_##CMD_NAME)
 
@@ -251,9 +256,6 @@ struct qedr_cq {
 
         u16 icid;
 
-        /* Lock to protect completion handler */
-        spinlock_t comp_handler_lock;
-
         /* Lock to protect multiplem CQ's */
         spinlock_t cq_lock;
         u8 arm_flags;
diff --git a/drivers/infiniband/hw/qedr/qedr_cm.c b/drivers/infiniband/hw/qedr/qedr_cm.c
index 63890ebb72bd..a9a8d8745d2e 100644
--- a/drivers/infiniband/hw/qedr/qedr_cm.c
+++ b/drivers/infiniband/hw/qedr/qedr_cm.c
@@ -87,11 +87,8 @@ void qedr_ll2_tx_cb(void *_qdev, struct qed_roce_ll2_packet *pkt)
         qedr_inc_sw_gsi_cons(&qp->sq);
         spin_unlock_irqrestore(&qp->q_lock, flags);
 
-        if (cq->ibcq.comp_handler) {
-                spin_lock_irqsave(&cq->comp_handler_lock, flags);
+        if (cq->ibcq.comp_handler)
                 (*cq->ibcq.comp_handler) (&cq->ibcq, cq->ibcq.cq_context);
-                spin_unlock_irqrestore(&cq->comp_handler_lock, flags);
-        }
 }
 
 void qedr_ll2_rx_cb(void *_dev, struct qed_roce_ll2_packet *pkt,
@@ -113,11 +110,8 @@ void qedr_ll2_rx_cb(void *_dev, struct qed_roce_ll2_packet *pkt,
 
         spin_unlock_irqrestore(&qp->q_lock, flags);
 
-        if (cq->ibcq.comp_handler) {
-                spin_lock_irqsave(&cq->comp_handler_lock, flags);
+        if (cq->ibcq.comp_handler)
                 (*cq->ibcq.comp_handler) (&cq->ibcq, cq->ibcq.cq_context);
-                spin_unlock_irqrestore(&cq->comp_handler_lock, flags);
-        }
 }
 
 static void qedr_destroy_gsi_cq(struct qedr_dev *dev,
@@ -404,9 +398,9 @@ static inline int qedr_gsi_build_packet(struct qedr_dev *dev,
         }
 
         if (ether_addr_equal(udh.eth.smac_h, udh.eth.dmac_h))
-                packet->tx_dest = QED_ROCE_LL2_TX_DEST_NW;
-        else
                 packet->tx_dest = QED_ROCE_LL2_TX_DEST_LB;
+        else
+                packet->tx_dest = QED_ROCE_LL2_TX_DEST_NW;
 
         packet->roce_mode = roce_mode;
         memcpy(packet->header.vaddr, ud_header_buffer, header_size);
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 57c8de208077..c7d6c9a783bd 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -471,8 +471,6 @@ struct ib_pd *qedr_alloc_pd(struct ib_device *ibdev,
                             struct ib_ucontext *context, struct ib_udata *udata)
 {
         struct qedr_dev *dev = get_qedr_dev(ibdev);
-        struct qedr_ucontext *uctx = NULL;
-        struct qedr_alloc_pd_uresp uresp;
         struct qedr_pd *pd;
         u16 pd_id;
         int rc;
@@ -489,21 +487,33 @@ struct ib_pd *qedr_alloc_pd(struct ib_device *ibdev,
         if (!pd)
                 return ERR_PTR(-ENOMEM);
 
-        dev->ops->rdma_alloc_pd(dev->rdma_ctx, &pd_id);
+        rc = dev->ops->rdma_alloc_pd(dev->rdma_ctx, &pd_id);
+        if (rc)
+                goto err;
 
-        uresp.pd_id = pd_id;
         pd->pd_id = pd_id;
 
         if (udata && context) {
+                struct qedr_alloc_pd_uresp uresp;
+
+                uresp.pd_id = pd_id;
+
                 rc = ib_copy_to_udata(udata, &uresp, sizeof(uresp));
-                if (rc)
+                if (rc) {
                         DP_ERR(dev, "copy error pd_id=0x%x.\n", pd_id);
-                uctx = get_qedr_ucontext(context);
-                uctx->pd = pd;
-                pd->uctx = uctx;
+                        dev->ops->rdma_dealloc_pd(dev->rdma_ctx, pd_id);
+                        goto err;
+                }
+
+                pd->uctx = get_qedr_ucontext(context);
+                pd->uctx->pd = pd;
         }
 
         return &pd->ibpd;
+
+err:
+        kfree(pd);
+        return ERR_PTR(rc);
 }
 
 int qedr_dealloc_pd(struct ib_pd *ibpd)
@@ -1600,7 +1610,7 @@ err0:
         return ERR_PTR(-EFAULT);
 }
 
-enum ib_qp_state qedr_get_ibqp_state(enum qed_roce_qp_state qp_state)
+static enum ib_qp_state qedr_get_ibqp_state(enum qed_roce_qp_state qp_state)
 {
         switch (qp_state) {
         case QED_ROCE_QP_STATE_RESET:
@@ -1621,7 +1631,8 @@ enum ib_qp_state qedr_get_ibqp_state(enum qed_roce_qp_state qp_state)
         return IB_QPS_ERR;
 }
 
-enum qed_roce_qp_state qedr_get_state_from_ibqp(enum ib_qp_state qp_state)
+static enum qed_roce_qp_state qedr_get_state_from_ibqp(
+                                        enum ib_qp_state qp_state)
 {
         switch (qp_state) {
         case IB_QPS_RESET:
@@ -1657,7 +1668,7 @@ static int qedr_update_qp_state(struct qedr_dev *dev,
         int status = 0;
 
         if (new_state == qp->state)
-                return 1;
+                return 0;
 
         switch (qp->state) {
         case QED_ROCE_QP_STATE_RESET:
@@ -1733,6 +1744,14 @@ static int qedr_update_qp_state(struct qedr_dev *dev,
                 /* ERR->XXX */
                 switch (new_state) {
                 case QED_ROCE_QP_STATE_RESET:
+                        if ((qp->rq.prod != qp->rq.cons) ||
+                            (qp->sq.prod != qp->sq.cons)) {
+                                DP_NOTICE(dev,
+                                          "Error->Reset with rq/sq not empty rq.prod=%x rq.cons=%x sq.prod=%x sq.cons=%x\n",
+                                          qp->rq.prod, qp->rq.cons, qp->sq.prod,
+                                          qp->sq.cons);
+                                status = -EINVAL;
+                        }
                         break;
                 default:
                         status = -EINVAL;
@@ -1865,7 +1884,6 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
                          qp_params.sgid.dwords[2], qp_params.sgid.dwords[3]);
                 DP_DEBUG(dev, QEDR_MSG_QP, "remote_mac=[%pM]\n",
                          qp_params.remote_mac_addr);
-;
 
                 qp_params.mtu = qp->mtu;
                 qp_params.lb_indication = false;
@@ -2016,7 +2034,7 @@ int qedr_query_qp(struct ib_qp *ibqp,
 
         qp_attr->qp_state = qedr_get_ibqp_state(params.state);
         qp_attr->cur_qp_state = qedr_get_ibqp_state(params.state);
-        qp_attr->path_mtu = iboe_get_mtu(params.mtu);
+        qp_attr->path_mtu = ib_mtu_int_to_enum(params.mtu);
         qp_attr->path_mig_state = IB_MIG_MIGRATED;
         qp_attr->rq_psn = params.rq_psn;
         qp_attr->sq_psn = params.sq_psn;
@@ -2028,7 +2046,7 @@ int qedr_query_qp(struct ib_qp *ibqp,
         qp_attr->cap.max_recv_wr = qp->rq.max_wr;
         qp_attr->cap.max_send_sge = qp->sq.max_sges;
         qp_attr->cap.max_recv_sge = qp->rq.max_sges;
-        qp_attr->cap.max_inline_data = qp->max_inline_data;
+        qp_attr->cap.max_inline_data = ROCE_REQ_MAX_INLINE_DATA_SIZE;
         qp_init_attr->cap = qp_attr->cap;
 
         memcpy(&qp_attr->ah_attr.grh.dgid.raw[0], &params.dgid.bytes[0],
@@ -2302,7 +2320,8 @@ int qedr_dereg_mr(struct ib_mr *ib_mr)
         return rc;
 }
 
-struct qedr_mr *__qedr_alloc_mr(struct ib_pd *ibpd, int max_page_list_len)
+static struct qedr_mr *__qedr_alloc_mr(struct ib_pd *ibpd,
+                                       int max_page_list_len)
 {
         struct qedr_pd *pd = get_qedr_pd(ibpd);
         struct qedr_dev *dev = get_qedr_dev(ibpd->device);
@@ -2704,7 +2723,7 @@ static int qedr_prepare_reg(struct qedr_qp *qp,
         return 0;
 }
 
-enum ib_wc_opcode qedr_ib_to_wc_opcode(enum ib_wr_opcode opcode)
+static enum ib_wc_opcode qedr_ib_to_wc_opcode(enum ib_wr_opcode opcode)
 {
         switch (opcode) {
         case IB_WR_RDMA_WRITE:
@@ -2729,7 +2748,7 @@ enum ib_wc_opcode qedr_ib_to_wc_opcode(enum ib_wr_opcode opcode)
         }
 }
 
-inline bool qedr_can_post_send(struct qedr_qp *qp, struct ib_send_wr *wr)
+static inline bool qedr_can_post_send(struct qedr_qp *qp, struct ib_send_wr *wr)
 {
         int wq_is_full, err_wr, pbl_is_full;
         struct qedr_dev *dev = qp->dev;
@@ -2766,7 +2785,7 @@ inline bool qedr_can_post_send(struct qedr_qp *qp, struct ib_send_wr *wr)
         return true;
 }
 
-int __qedr_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
+static int __qedr_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                      struct ib_send_wr **bad_wr)
 {
         struct qedr_dev *dev = get_qedr_dev(ibqp->device);
@@ -3234,9 +3253,10 @@ static int qedr_poll_cq_req(struct qedr_dev *dev,
                                   IB_WC_SUCCESS, 0);
                 break;
         case RDMA_CQE_REQ_STS_WORK_REQUEST_FLUSHED_ERR:
-                DP_ERR(dev,
-                       "Error: POLL CQ with RDMA_CQE_REQ_STS_WORK_REQUEST_FLUSHED_ERR. CQ icid=0x%x, QP icid=0x%x\n",
-                       cq->icid, qp->icid);
+                if (qp->state != QED_ROCE_QP_STATE_ERR)
+                        DP_ERR(dev,
+                               "Error: POLL CQ with RDMA_CQE_REQ_STS_WORK_REQUEST_FLUSHED_ERR. CQ icid=0x%x, QP icid=0x%x\n",
+                               cq->icid, qp->icid);
                 cnt = process_req(dev, qp, cq, num_entries, wc, req->sq_cons,
                                   IB_WC_WR_FLUSH_ERR, 1);
                 break;
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
index 231a1ce1f4be..bd8fbd3d2032 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
@@ -1029,7 +1029,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev,
         if (ret) {
                 dev_err(&pdev->dev, "failed to allocate interrupts\n");
                 ret = -ENOMEM;
-                goto err_netdevice;
+                goto err_free_cq_ring;
         }
 
         /* Allocate UAR table. */
@@ -1092,8 +1092,6 @@ err_free_uar_table:
 err_free_intrs:
         pvrdma_free_irq(dev);
         pvrdma_disable_msi_all(dev);
-err_netdevice:
-        unregister_netdevice_notifier(&dev->nb_netdev);
 err_free_cq_ring:
         pvrdma_page_dir_cleanup(dev, &dev->cq_pdir);
 err_free_async_ring:
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
index 54891370d18a..c2aa52638dcb 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
@@ -306,7 +306,7 @@ struct ib_ucontext *pvrdma_alloc_ucontext(struct ib_device *ibdev,
         union pvrdma_cmd_resp rsp;
         struct pvrdma_cmd_create_uc *cmd = &req.create_uc;
         struct pvrdma_cmd_create_uc_resp *resp = &rsp.create_uc_resp;
-        struct pvrdma_alloc_ucontext_resp uresp;
+        struct pvrdma_alloc_ucontext_resp uresp = {0};
         int ret;
         void *ptr;
 
diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index 342e78163613..4abdeb359fb4 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -555,7 +555,7 @@ struct rxe_dev *rxe_net_add(struct net_device *ndev)
         }
 
         spin_lock_bh(&dev_list_lock);
-        list_add_tail(&rxe_dev_list, &rxe->list);
+        list_add_tail(&rxe->list, &rxe_dev_list);
         spin_unlock_bh(&dev_list_lock);
         return rxe;
 }
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
index 486d576e55bc..44b2108253bd 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -813,8 +813,7 @@ void rxe_qp_destroy(struct rxe_qp *qp)
         del_timer_sync(&qp->rnr_nak_timer);
 
         rxe_cleanup_task(&qp->req.task);
-        if (qp_type(qp) == IB_QPT_RC)
-                rxe_cleanup_task(&qp->comp.task);
+        rxe_cleanup_task(&qp->comp.task);
 
         /* flush out any receive wr's or pending requests */
         __rxe_do_task(&qp->req.task);
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index 9104e6b8cac9..e71af717e71b 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -651,13 +651,6 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep,
                                                    SHOST_DIX_GUARD_CRC);
                 }
 
-                /*
-                 * Limit the sg_tablesize and max_sectors based on the device
-                 * max fastreg page list length.
-                 */
-                shost->sg_tablesize = min_t(unsigned short, shost->sg_tablesize,
-                        ib_conn->device->ib_device->attrs.max_fast_reg_page_list_len);
-
                 if (iscsi_host_add(shost,
                                    ib_conn->device->ib_device->dma_device)) {
                         mutex_unlock(&iser_conn->state_mutex);
@@ -679,6 +672,10 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep,
         max_fr_sectors = ((shost->sg_tablesize - 1) * PAGE_SIZE) >> 9;
         shost->max_sectors = min(iser_max_sectors, max_fr_sectors);
 
+        iser_dbg("iser_conn %p, sg_tablesize %u, max_sectors %u\n",
+                 iser_conn, shost->sg_tablesize,
+                 shost->max_sectors);
+
         if (cmds_max > max_cmds) {
                 iser_info("cmds_max changed from %u to %u\n",
                           cmds_max, max_cmds);
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index 0be6a7c5ddb5..9d0b22ad58c1 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -496,7 +496,6 @@ struct ib_conn {
  * @rx_descs:         rx buffers array (cyclic buffer)
  * @num_rx_descs:     number of rx descriptors
  * @scsi_sg_tablesize: scsi host sg_tablesize
- * @scsi_max_sectors: scsi host max sectors
  */
 struct iser_conn {
         struct ib_conn               ib_conn;
@@ -519,7 +518,6 @@ struct iser_conn {
         struct iser_rx_desc          *rx_descs;
         u32                          num_rx_descs;
         unsigned short               scsi_sg_tablesize;
-        unsigned int                 scsi_max_sectors;
         bool                         snd_w_inv;
 };
 
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 8ae7a3beddb7..6a9d1cb548ee 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -707,18 +707,7 @@ iser_calc_scsi_params(struct iser_conn *iser_conn,
         sup_sg_tablesize = min_t(unsigned, ISCSI_ISER_MAX_SG_TABLESIZE,
                                  device->ib_device->attrs.max_fast_reg_page_list_len);
 
-        if (sg_tablesize > sup_sg_tablesize) {
-                sg_tablesize = sup_sg_tablesize;
-                iser_conn->scsi_max_sectors = sg_tablesize * SIZE_4K / 512;
-        } else {
-                iser_conn->scsi_max_sectors = max_sectors;
-        }
-
-        iser_conn->scsi_sg_tablesize = sg_tablesize;
-
-        iser_dbg("iser_conn %p, sg_tablesize %u, max_sectors %u\n",
-                 iser_conn, iser_conn->scsi_sg_tablesize,
-                 iser_conn->scsi_max_sectors);
+        iser_conn->scsi_sg_tablesize = min(sg_tablesize, sup_sg_tablesize);
 }
 
 /**
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 8ddc07123193..79bf48477ddb 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -371,6 +371,7 @@ static struct srp_fr_pool *srp_create_fr_pool(struct ib_device *device,
         struct srp_fr_desc *d;
         struct ib_mr *mr;
         int i, ret = -EINVAL;
+        enum ib_mr_type mr_type;
 
         if (pool_size <= 0)
                 goto err;
@@ -384,9 +385,13 @@ static struct srp_fr_pool *srp_create_fr_pool(struct ib_device *device,
         spin_lock_init(&pool->lock);
         INIT_LIST_HEAD(&pool->free_list);
 
+        if (device->attrs.device_cap_flags & IB_DEVICE_SG_GAPS_REG)
+                mr_type = IB_MR_TYPE_SG_GAPS;
+        else
+                mr_type = IB_MR_TYPE_MEM_REG;
+
         for (i = 0, d = &pool->desc[0]; i < pool->size; i++, d++) {
-                mr = ib_alloc_mr(pd, IB_MR_TYPE_MEM_REG,
-                                 max_page_list_len);
+                mr = ib_alloc_mr(pd, mr_type, max_page_list_len);
                 if (IS_ERR(mr)) {
                         ret = PTR_ERR(mr);
                         if (ret == -ENOMEM)
@@ -3694,6 +3699,12 @@ static int __init srp_init_module(void)
                 indirect_sg_entries = cmd_sg_entries;
         }
 
+        if (indirect_sg_entries > SG_MAX_SEGMENTS) {
+                pr_warn("Clamping indirect_sg_entries to %u\n",
+                        SG_MAX_SEGMENTS);
+                indirect_sg_entries = SG_MAX_SEGMENTS;
+        }
+
         srp_remove_wq = create_workqueue("srp_remove");
         if (!srp_remove_wq) {
                 ret = -ENOMEM;
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 11447ab1055c..bf5c36e229ba 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -901,7 +901,7 @@ void rmi_enable_irq(struct rmi_device *rmi_dev, bool clear_wake)
         data->enabled = true;
         if (clear_wake && device_may_wakeup(rmi_dev->xport->dev)) {
                 retval = disable_irq_wake(irq);
-                if (!retval)
+                if (retval)
                         dev_warn(&rmi_dev->dev,
                                  "Failed to disable irq for wake: %d\n",
                                  retval);
@@ -936,7 +936,7 @@ void rmi_disable_irq(struct rmi_device *rmi_dev, bool enable_wake)
         disable_irq(irq);
         if (enable_wake && device_may_wakeup(rmi_dev->xport->dev)) {
                 retval = enable_irq_wake(irq);
-                if (!retval)
+                if (retval)
                         dev_warn(&rmi_dev->dev,
                                  "Failed to enable irq for wake: %d\n",
                                  retval);
diff --git a/drivers/input/touchscreen/wm97xx-core.c b/drivers/input/touchscreen/wm97xx-core.c
index 83cf11312fd9..c9d1c91e1887 100644
--- a/drivers/input/touchscreen/wm97xx-core.c
+++ b/drivers/input/touchscreen/wm97xx-core.c
@@ -682,7 +682,7 @@ static int wm97xx_probe(struct device *dev)
         }
         platform_set_drvdata(wm->battery_dev, wm);
         wm->battery_dev->dev.parent = dev;
-        wm->battery_dev->dev.platform_data = pdata->batt_pdata;
+        wm->battery_dev->dev.platform_data = pdata ? pdata->batt_pdata : NULL;
         ret = platform_device_add(wm->battery_dev);
         if (ret < 0)
                 goto batt_reg_err;
diff --git a/drivers/isdn/hardware/eicon/message.c b/drivers/isdn/hardware/eicon/message.c
index 1a1d99704fe6..296f1411fe84 100644
--- a/drivers/isdn/hardware/eicon/message.c
+++ b/drivers/isdn/hardware/eicon/message.c
@@ -11297,7 +11297,8 @@ static void mixer_notify_update(PLCI *plci, byte others)
                                 ((CAPI_MSG *) msg)->header.ncci = 0;
                                 ((CAPI_MSG *) msg)->info.facility_req.Selector = SELECTOR_LINE_INTERCONNECT;
                                 ((CAPI_MSG *) msg)->info.facility_req.structs[0] = 3;
-                                PUT_WORD(&(((CAPI_MSG *) msg)->info.facility_req.structs[1]), LI_REQ_SILENT_UPDATE);
+                                ((CAPI_MSG *) msg)->info.facility_req.structs[1] = LI_REQ_SILENT_UPDATE & 0xff;
+                                ((CAPI_MSG *) msg)->info.facility_req.structs[2] = LI_REQ_SILENT_UPDATE >> 8;
                                 ((CAPI_MSG *) msg)->info.facility_req.structs[3] = 0;
                                 w = api_put(notify_plci->appl, (CAPI_MSG *) msg);
                                 if (w != _QUEUE_FULL)
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 7c6c57216bf2..8a9f742d8ed7 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1534,18 +1534,18 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string
                 return PTR_ERR(key);
         }
 
-        rcu_read_lock();
+        down_read(&key->sem);
 
         ukp = user_key_payload(key);
         if (!ukp) {
-                rcu_read_unlock();
+                up_read(&key->sem);
                 key_put(key);
                 kzfree(new_key_string);
                 return -EKEYREVOKED;
         }
 
         if (cc->key_size != ukp->datalen) {
-                rcu_read_unlock();
+                up_read(&key->sem);
                 key_put(key);
                 kzfree(new_key_string);
                 return -EINVAL;
@@ -1553,7 +1553,7 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string
 
         memcpy(cc->key, ukp->data, cc->key_size);
 
-        rcu_read_unlock();
+        up_read(&key->sem);
         key_put(key);
 
         /* clear the flag since following operations may invalidate previously valid key */
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 6400cffb986d..3570bcb7a4a4 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -427,7 +427,7 @@ static struct pgpath *choose_pgpath(struct multipath *m, size_t nr_bytes)
         unsigned long flags;
         struct priority_group *pg;
         struct pgpath *pgpath;
-        bool bypassed = true;
+        unsigned bypassed = 1;
 
         if (!atomic_read(&m->nr_valid_paths)) {
                 clear_bit(MPATHF_QUEUE_IO, &m->flags);
@@ -466,7 +466,7 @@ check_current_pg:
          */
         do {
                 list_for_each_entry(pg, &m->priority_groups, list) {
-                        if (pg->bypassed == bypassed)
+                        if (pg->bypassed == !!bypassed)
                                 continue;
                         pgpath = choose_path_in_pg(m, pg, nr_bytes);
                         if (!IS_ERR_OR_NULL(pgpath)) {
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 9d7275fb541a..6e702fc69a83 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -779,6 +779,10 @@ static void dm_old_request_fn(struct request_queue *q)
                 int srcu_idx;
                 struct dm_table *map = dm_get_live_table(md, &srcu_idx);
 
+                if (unlikely(!map)) {
+                        dm_put_live_table(md, srcu_idx);
+                        return;
+                }
                 ti = dm_table_find_target(map, pos);
                 dm_put_live_table(md, srcu_idx);
         }
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 82821ee0d57f..01175dac0db6 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5291,6 +5291,11 @@ int md_run(struct mddev *mddev)
         if (start_readonly && mddev->ro == 0)
                 mddev->ro = 2; /* read-only, but switch on first write */
 
+        /*
+         * NOTE: some pers->run(), for example r5l_recovery_log(), wakes
+         * up mddev->thread. It is important to initialize critical
+         * resources for mddev->thread BEFORE calling pers->run().
+         */
         err = pers->run(mddev);
         if (err)
                 pr_warn("md: pers->run() failed ...\n");
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 0e8ed2c327b0..302dea3296ba 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -162,6 +162,8 @@ struct r5l_log {
 
         /* to submit async io_units, to fulfill ordering of flush */
         struct work_struct deferred_io_work;
+        /* to disable write back during in degraded mode */
+        struct work_struct disable_writeback_work;
 };
 
 /*
@@ -611,6 +613,21 @@ static void r5l_submit_io_async(struct work_struct *work)
                 r5l_do_submit_io(log, io);
 }
 
+static void r5c_disable_writeback_async(struct work_struct *work)
+{
+        struct r5l_log *log = container_of(work, struct r5l_log,
+                                           disable_writeback_work);
+        struct mddev *mddev = log->rdev->mddev;
+
+        if (log->r5c_journal_mode == R5C_JOURNAL_MODE_WRITE_THROUGH)
+                return;
+        pr_info("md/raid:%s: Disabling writeback cache for degraded array.\n",
+                mdname(mddev));
+        mddev_suspend(mddev);
+        log->r5c_journal_mode = R5C_JOURNAL_MODE_WRITE_THROUGH;
+        mddev_resume(mddev);
+}
+
 static void r5l_submit_current_io(struct r5l_log *log)
 {
         struct r5l_io_unit *io = log->current_io;
@@ -1393,8 +1410,6 @@ static void r5l_do_reclaim(struct r5l_log *log)
         next_checkpoint = r5c_calculate_new_cp(conf);
         spin_unlock_irq(&log->io_list_lock);
 
-        BUG_ON(reclaimable < 0);
-
         if (reclaimable == 0 || !write_super)
                 return;
 
@@ -2062,7 +2077,7 @@ static int
 r5c_recovery_rewrite_data_only_stripes(struct r5l_log *log,
                                        struct r5l_recovery_ctx *ctx)
 {
-        struct stripe_head *sh, *next;
+        struct stripe_head *sh;
         struct mddev *mddev = log->rdev->mddev;
         struct page *page;
         sector_t next_checkpoint = MaxSector;
@@ -2076,7 +2091,7 @@ r5c_recovery_rewrite_data_only_stripes(struct r5l_log *log,
 
         WARN_ON(list_empty(&ctx->cached_list));
 
-        list_for_each_entry_safe(sh, next, &ctx->cached_list, lru) {
+        list_for_each_entry(sh, &ctx->cached_list, lru) {
                 struct r5l_meta_block *mb;
                 int i;
                 int offset;
@@ -2126,14 +2141,39 @@ r5c_recovery_rewrite_data_only_stripes(struct r5l_log *log,
                 ctx->pos = write_pos;
                 ctx->seq += 1;
                 next_checkpoint = sh->log_start;
-                list_del_init(&sh->lru);
-                raid5_release_stripe(sh);
         }
         log->next_checkpoint = next_checkpoint;
         __free_page(page);
         return 0;
 }
 
+static void r5c_recovery_flush_data_only_stripes(struct r5l_log *log,
+                                                 struct r5l_recovery_ctx *ctx)
+{
+        struct mddev *mddev = log->rdev->mddev;
+        struct r5conf *conf = mddev->private;
+        struct stripe_head *sh, *next;
+
+        if (ctx->data_only_stripes == 0)
+                return;
+
+        log->r5c_journal_mode = R5C_JOURNAL_MODE_WRITE_BACK;
+
+        list_for_each_entry_safe(sh, next, &ctx->cached_list, lru) {
+                r5c_make_stripe_write_out(sh);
+                set_bit(STRIPE_HANDLE, &sh->state);
+                list_del_init(&sh->lru);
+                raid5_release_stripe(sh);
+        }
+
+        md_wakeup_thread(conf->mddev->thread);
+        /* reuse conf->wait_for_quiescent in recovery */
+        wait_event(conf->wait_for_quiescent,
+                   atomic_read(&conf->active_stripes) == 0);
+
+        log->r5c_journal_mode = R5C_JOURNAL_MODE_WRITE_THROUGH;
+}
+
 static int r5l_recovery_log(struct r5l_log *log)
 {
         struct mddev *mddev = log->rdev->mddev;
@@ -2160,32 +2200,31 @@ static int r5l_recovery_log(struct r5l_log *log)
         pos = ctx.pos;
         ctx.seq += 10000;
 
-        if (ctx.data_only_stripes == 0) {
-                log->next_checkpoint = ctx.pos;
-                r5l_log_write_empty_meta_block(log, ctx.pos, ctx.seq++);
-                ctx.pos = r5l_ring_add(log, ctx.pos, BLOCK_SECTORS);
-        }
 
         if ((ctx.data_only_stripes == 0) && (ctx.data_parity_stripes == 0))
                 pr_debug("md/raid:%s: starting from clean shutdown\n",
                          mdname(mddev));
-        else {
+        else
                 pr_debug("md/raid:%s: recovering %d data-only stripes and %d data-parity stripes\n",
                          mdname(mddev), ctx.data_only_stripes,
                          ctx.data_parity_stripes);
 
-                if (ctx.data_only_stripes > 0)
-                        if (r5c_recovery_rewrite_data_only_stripes(log, &ctx)) {
-                                pr_err("md/raid:%s: failed to rewrite stripes to journal\n",
-                                       mdname(mddev));
-                                return -EIO;
-                        }
+        if (ctx.data_only_stripes == 0) {
+                log->next_checkpoint = ctx.pos;
+                r5l_log_write_empty_meta_block(log, ctx.pos, ctx.seq++);
+                ctx.pos = r5l_ring_add(log, ctx.pos, BLOCK_SECTORS);
+        } else if (r5c_recovery_rewrite_data_only_stripes(log, &ctx)) {
+                pr_err("md/raid:%s: failed to rewrite stripes to journal\n",
+                       mdname(mddev));
+                return -EIO;
         }
 
         log->log_start = ctx.pos;
         log->seq = ctx.seq;
         log->last_checkpoint = pos;
         r5l_write_super(log, pos);
+
+        r5c_recovery_flush_data_only_stripes(log, &ctx);
         return 0;
 }
 
@@ -2247,6 +2286,10 @@ static ssize_t r5c_journal_mode_store(struct mddev *mddev,
             val > R5C_JOURNAL_MODE_WRITE_BACK)
                 return -EINVAL;
 
+        if (raid5_calc_degraded(conf) > 0 &&
+            val == R5C_JOURNAL_MODE_WRITE_BACK)
+                return -EINVAL;
+
         mddev_suspend(mddev);
         conf->log->r5c_journal_mode = val;
         mddev_resume(mddev);
@@ -2301,6 +2344,16 @@ int r5c_try_caching_write(struct r5conf *conf,
                 set_bit(STRIPE_R5C_CACHING, &sh->state);
         }
 
+        /*
+         * When run in degraded mode, array is set to write-through mode.
+         * This check helps drain pending write safely in the transition to
+         * write-through mode.
+         */
+        if (s->failed) {
+                r5c_make_stripe_write_out(sh);
+                return -EAGAIN;
+        }
+
         for (i = disks; i--; ) {
                 dev = &sh->dev[i];
                 /* if non-overwrite, use writing-out phase */
@@ -2351,6 +2404,8 @@ void r5c_release_extra_page(struct stripe_head *sh)
                         struct page *p = sh->dev[i].orig_page;
 
                         sh->dev[i].orig_page = sh->dev[i].page;
+                        clear_bit(R5_OrigPageUPTDODATE, &sh->dev[i].flags);
+
                         if (!using_disk_info_extra_page)
                                 put_page(p);
                 }
@@ -2555,6 +2610,19 @@ ioerr:
         return ret;
 }
 
+void r5c_update_on_rdev_error(struct mddev *mddev)
+{
+        struct r5conf *conf = mddev->private;
+        struct r5l_log *log = conf->log;
+
+        if (!log)
+                return;
+
+        if (raid5_calc_degraded(conf) > 0 &&
+            conf->log->r5c_journal_mode == R5C_JOURNAL_MODE_WRITE_BACK)
+                schedule_work(&log->disable_writeback_work);
+}
+
 int r5l_init_log(struct r5conf *conf, struct md_rdev *rdev)
 {
         struct request_queue *q = bdev_get_queue(rdev->bdev);
@@ -2627,6 +2695,7 @@ int r5l_init_log(struct r5conf *conf, struct md_rdev *rdev)
         spin_lock_init(&log->no_space_stripes_lock);
 
         INIT_WORK(&log->deferred_io_work, r5l_submit_io_async);
+        INIT_WORK(&log->disable_writeback_work, r5c_disable_writeback_async);
 
         log->r5c_journal_mode = R5C_JOURNAL_MODE_WRITE_THROUGH;
         INIT_LIST_HEAD(&log->stripe_in_journal_list);
@@ -2659,6 +2728,7 @@ io_kc:
 
 void r5l_exit_log(struct r5l_log *log)
 {
+        flush_work(&log->disable_writeback_work);
         md_unregister_thread(&log->reclaim_thread);
         mempool_destroy(log->meta_pool);
         bioset_free(log->bs);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 36c13e4be9c9..3c7e106c12a2 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -556,7 +556,7 @@ static struct stripe_head *__find_stripe(struct r5conf *conf, sector_t sector,
  * of the two sections, and some non-in_sync devices may
  * be insync in the section most affected by failed devices.
  */
-static int calc_degraded(struct r5conf *conf)
+int raid5_calc_degraded(struct r5conf *conf)
 {
         int degraded, degraded2;
         int i;
@@ -619,7 +619,7 @@ static int has_failed(struct r5conf *conf)
         if (conf->mddev->reshape_position == MaxSector)
                 return conf->mddev->degraded > conf->max_degraded;
 
-        degraded = calc_degraded(conf);
+        degraded = raid5_calc_degraded(conf);
         if (degraded > conf->max_degraded)
                 return 1;
         return 0;
@@ -1015,7 +1015,17 @@ again:
 
                         if (test_bit(R5_SkipCopy, &sh->dev[i].flags))
                                 WARN_ON(test_bit(R5_UPTODATE, &sh->dev[i].flags));
-                        sh->dev[i].vec.bv_page = sh->dev[i].page;
+
+                        if (!op_is_write(op) &&
+                            test_bit(R5_InJournal, &sh->dev[i].flags))
+                                /*
+                                 * issuing read for a page in journal, this
+                                 * must be preparing for prexor in rmw; read
+                                 * the data into orig_page
+                                 */
+                                sh->dev[i].vec.bv_page = sh->dev[i].orig_page;
+                        else
+                                sh->dev[i].vec.bv_page = sh->dev[i].page;
                         bi->bi_vcnt = 1;
                         bi->bi_io_vec[0].bv_len = STRIPE_SIZE;
                         bi->bi_io_vec[0].bv_offset = 0;
@@ -2380,6 +2390,13 @@ static void raid5_end_read_request(struct bio * bi)
                 } else if (test_bit(R5_ReadNoMerge, &sh->dev[i].flags))
                         clear_bit(R5_ReadNoMerge, &sh->dev[i].flags);
 
+                if (test_bit(R5_InJournal, &sh->dev[i].flags))
+                        /*
+                         * end read for a page in journal, this
+                         * must be preparing for prexor in rmw
+                         */
+                        set_bit(R5_OrigPageUPTDODATE, &sh->dev[i].flags);
+
                 if (atomic_read(&rdev->read_errors))
                         atomic_set(&rdev->read_errors, 0);
         } else {
@@ -2538,7 +2555,7 @@ static void raid5_error(struct mddev *mddev, struct md_rdev *rdev)
 
         spin_lock_irqsave(&conf->device_lock, flags);
         clear_bit(In_sync, &rdev->flags);
-        mddev->degraded = calc_degraded(conf);
+        mddev->degraded = raid5_calc_degraded(conf);
         spin_unlock_irqrestore(&conf->device_lock, flags);
         set_bit(MD_RECOVERY_INTR, &mddev->recovery);
 
@@ -2552,6 +2569,7 @@ static void raid5_error(struct mddev *mddev, struct md_rdev *rdev)
                 bdevname(rdev->bdev, b),
                 mdname(mddev),
                 conf->raid_disks - mddev->degraded);
+        r5c_update_on_rdev_error(mddev);
 }
 
 /*
@@ -2880,6 +2898,30 @@ sector_t raid5_compute_blocknr(struct stripe_head *sh, int i, int previous)
         return r_sector;
 }
 
+/*
+ * There are cases where we want handle_stripe_dirtying() and
+ * schedule_reconstruction() to delay towrite to some dev of a stripe.
+ *
+ * This function checks whether we want to delay the towrite. Specifically,
+ * we delay the towrite when:
+ *
+ *   1. degraded stripe has a non-overwrite to the missing dev, AND this
+ *      stripe has data in journal (for other devices).
+ *
+ *      In this case, when reading data for the non-overwrite dev, it is
+ *      necessary to handle complex rmw of write back cache (prexor with
+ *      orig_page, and xor with page). To keep read path simple, we would
+ *      like to flush data in journal to RAID disks first, so complex rmw
+ *      is handled in the write patch (handle_stripe_dirtying).
+ *
+ */
+static inline bool delay_towrite(struct r5dev *dev,
+                                   struct stripe_head_state *s)
+{
+        return !test_bit(R5_OVERWRITE, &dev->flags) &&
+                !test_bit(R5_Insync, &dev->flags) && s->injournal;
+}
+
 static void
 schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
                          int rcw, int expand)
@@ -2900,7 +2942,7 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
                 for (i = disks; i--; ) {
                         struct r5dev *dev = &sh->dev[i];
 
-                        if (dev->towrite) {
+                        if (dev->towrite && !delay_towrite(dev, s)) {
                                 set_bit(R5_LOCKED, &dev->flags);
                                 set_bit(R5_Wantdrain, &dev->flags);
                                 if (!expand)
@@ -3295,13 +3337,6 @@ static int want_replace(struct stripe_head *sh, int disk_idx)
         return rv;
 }
 
-/* fetch_block - checks the given member device to see if its data needs
- * to be read or computed to satisfy a request.
- *
- * Returns 1 when no more member devices need to be checked, otherwise returns
- * 0 to tell the loop in handle_stripe_fill to continue
- */
-
 static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s,
                            int disk_idx, int disks)
 {
@@ -3392,6 +3427,12 @@ static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s,
         return 0;
 }
 
+/* fetch_block - checks the given member device to see if its data needs
+ * to be read or computed to satisfy a request.
+ *
+ * Returns 1 when no more member devices need to be checked, otherwise returns
+ * 0 to tell the loop in handle_stripe_fill to continue
+ */
 static int fetch_block(struct stripe_head *sh, struct stripe_head_state *s,
                        int disk_idx, int disks)
 {
@@ -3478,10 +3519,26 @@ static void handle_stripe_fill(struct stripe_head *sh,
          * midst of changing due to a write
          */
         if (!test_bit(STRIPE_COMPUTE_RUN, &sh->state) && !sh->check_state &&
-            !sh->reconstruct_state)
+            !sh->reconstruct_state) {
+
+                /*
+                 * For degraded stripe with data in journal, do not handle
+                 * read requests yet, instead, flush the stripe to raid
+                 * disks first, this avoids handling complex rmw of write
+                 * back cache (prexor with orig_page, and then xor with
+                 * page) in the read path
+                 */
+                if (s->injournal && s->failed) {
+                        if (test_bit(STRIPE_R5C_CACHING, &sh->state))
+                                r5c_make_stripe_write_out(sh);
+                        goto out;
+                }
+
                 for (i = disks; i--; )
                         if (fetch_block(sh, s, i, disks))
                                 break;
+        }
+out:
         set_bit(STRIPE_HANDLE, &sh->state);
 }
 
@@ -3594,6 +3651,21 @@ unhash:
                 break_stripe_batch_list(head_sh, STRIPE_EXPAND_SYNC_FLAGS);
 }
 
+/*
+ * For RMW in write back cache, we need extra page in prexor to store the
+ * old data. This page is stored in dev->orig_page.
+ *
+ * This function checks whether we have data for prexor. The exact logic
+ * is:
+ *       R5_UPTODATE && (!R5_InJournal || R5_OrigPageUPTDODATE)
+ */
+static inline bool uptodate_for_rmw(struct r5dev *dev)
+{
+        return (test_bit(R5_UPTODATE, &dev->flags)) &&
+                (!test_bit(R5_InJournal, &dev->flags) ||
+                 test_bit(R5_OrigPageUPTDODATE, &dev->flags));
+}
+
 static int handle_stripe_dirtying(struct r5conf *conf,
                                   struct stripe_head *sh,
                                   struct stripe_head_state *s,
@@ -3622,12 +3694,11 @@ static int handle_stripe_dirtying(struct r5conf *conf,
         } else for (i = disks; i--; ) {
                 /* would I have to read this buffer for read_modify_write */
                 struct r5dev *dev = &sh->dev[i];
-                if ((dev->towrite || i == sh->pd_idx || i == sh->qd_idx ||
+                if (((dev->towrite && !delay_towrite(dev, s)) ||
+                     i == sh->pd_idx || i == sh->qd_idx ||
                      test_bit(R5_InJournal, &dev->flags)) &&
                     !test_bit(R5_LOCKED, &dev->flags) &&
-                    !((test_bit(R5_UPTODATE, &dev->flags) &&
-                       (!test_bit(R5_InJournal, &dev->flags) ||
-                        dev->page != dev->orig_page)) ||
+                    !(uptodate_for_rmw(dev) ||
                       test_bit(R5_Wantcompute, &dev->flags))) {
                         if (test_bit(R5_Insync, &dev->flags))
                                 rmw++;
@@ -3639,7 +3710,6 @@ static int handle_stripe_dirtying(struct r5conf *conf,
                     i != sh->pd_idx && i != sh->qd_idx &&
                     !test_bit(R5_LOCKED, &dev->flags) &&
                     !(test_bit(R5_UPTODATE, &dev->flags) ||
-                      test_bit(R5_InJournal, &dev->flags) ||
                       test_bit(R5_Wantcompute, &dev->flags))) {
                         if (test_bit(R5_Insync, &dev->flags))
                                 rcw++;
@@ -3689,13 +3759,11 @@ static int handle_stripe_dirtying(struct r5conf *conf,
 
                 for (i = disks; i--; ) {
                         struct r5dev *dev = &sh->dev[i];
-                        if ((dev->towrite ||
+                        if (((dev->towrite && !delay_towrite(dev, s)) ||
                              i == sh->pd_idx || i == sh->qd_idx ||
                              test_bit(R5_InJournal, &dev->flags)) &&
                             !test_bit(R5_LOCKED, &dev->flags) &&
-                            !((test_bit(R5_UPTODATE, &dev->flags) &&
-                               (!test_bit(R5_InJournal, &dev->flags) ||
-                                dev->page != dev->orig_page)) ||
+                            !(uptodate_for_rmw(dev) ||
                               test_bit(R5_Wantcompute, &dev->flags)) &&
                             test_bit(R5_Insync, &dev->flags)) {
                                 if (test_bit(STRIPE_PREREAD_ACTIVE,
@@ -3722,7 +3790,6 @@ static int handle_stripe_dirtying(struct r5conf *conf,
                             i != sh->pd_idx && i != sh->qd_idx &&
                             !test_bit(R5_LOCKED, &dev->flags) &&
                             !(test_bit(R5_UPTODATE, &dev->flags) ||
-                              test_bit(R5_InJournal, &dev->flags) ||
                               test_bit(R5_Wantcompute, &dev->flags))) {
                                 rcw++;
                                 if (test_bit(R5_Insync, &dev->flags) &&
@@ -7025,7 +7092,7 @@ static int raid5_run(struct mddev *mddev)
         /*
          * 0 for a fully functional array, 1 or 2 for a degraded array.
          */
-        mddev->degraded = calc_degraded(conf);
+        mddev->degraded = raid5_calc_degraded(conf);
 
         if (has_failed(conf)) {
                 pr_crit("md/raid:%s: not enough operational devices (%d/%d failed)\n",
@@ -7272,7 +7339,7 @@ static int raid5_spare_active(struct mddev *mddev)
                 }
         }
         spin_lock_irqsave(&conf->device_lock, flags);
-        mddev->degraded = calc_degraded(conf);
+        mddev->degraded = raid5_calc_degraded(conf);
         spin_unlock_irqrestore(&conf->device_lock, flags);
         print_raid5_conf(conf);
         return count;
@@ -7632,7 +7699,7 @@ static int raid5_start_reshape(struct mddev *mddev)
                  * pre and post number of devices.
                  */
                 spin_lock_irqsave(&conf->device_lock, flags);
-                mddev->degraded = calc_degraded(conf);
+                mddev->degraded = raid5_calc_degraded(conf);
                 spin_unlock_irqrestore(&conf->device_lock, flags);
         }
         mddev->raid_disks = conf->raid_disks;
@@ -7720,7 +7787,7 @@ static void raid5_finish_reshape(struct mddev *mddev)
                 } else {
                         int d;
                         spin_lock_irq(&conf->device_lock);
-                        mddev->degraded = calc_degraded(conf);
+                        mddev->degraded = raid5_calc_degraded(conf);
                         spin_unlock_irq(&conf->device_lock);
                         for (d = conf->raid_disks ;
                              d < conf->raid_disks - mddev->delta_disks;
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index ed8e1362ab36..1440fa26e296 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -322,6 +322,11 @@ enum r5dev_flags {
                          * data and parity being written are in the journal
                          * device
                          */
+        R5_OrigPageUPTDODATE,   /* with write back cache, we read old data into
+                                 * dev->orig_page for prexor. When this flag is
+                                 * set, orig_page contains latest data in the
+                                 * raid disk.
+                                 */
 };
 
 /*
@@ -753,6 +758,7 @@ extern sector_t raid5_compute_sector(struct r5conf *conf, sector_t r_sector,
 extern struct stripe_head *
 raid5_get_active_stripe(struct r5conf *conf, sector_t sector,
                         int previous, int noblock, int noquiesce);
+extern int raid5_calc_degraded(struct r5conf *conf);
 extern int r5l_init_log(struct r5conf *conf, struct md_rdev *rdev);
 extern void r5l_exit_log(struct r5l_log *log);
 extern int r5l_write_stripe(struct r5l_log *log, struct stripe_head *head_sh);
@@ -781,4 +787,5 @@ extern void r5c_flush_cache(struct r5conf *conf, int num);
 extern void r5c_check_stripe_cache_usage(struct r5conf *conf);
 extern void r5c_check_cached_full_stripe(struct r5conf *conf);
 extern struct md_sysfs_entry r5c_journal_mode;
+extern void r5c_update_on_rdev_error(struct mddev *mddev);
 #endif
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index 0ea4efb3de66..87a6b65ed3af 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -30,8 +30,9 @@
 
 #include "cec-priv.h"
 
-static int cec_report_features(struct cec_adapter *adap, unsigned int la_idx);
-static int cec_report_phys_addr(struct cec_adapter *adap, unsigned int la_idx);
+static void cec_fill_msg_report_features(struct cec_adapter *adap,
+                                         struct cec_msg *msg,
+                                         unsigned int la_idx);
 
 /*
  * 400 ms is the time it takes for one 16 byte message to be
@@ -288,10 +289,10 @@ static void cec_data_cancel(struct cec_data *data)
 
         /* Mark it as an error */
         data->msg.tx_ts = ktime_get_ns();
-        data->msg.tx_status = CEC_TX_STATUS_ERROR |
-                              CEC_TX_STATUS_MAX_RETRIES;
+        data->msg.tx_status |= CEC_TX_STATUS_ERROR |
+                               CEC_TX_STATUS_MAX_RETRIES;
+        data->msg.tx_error_cnt++;
         data->attempts = 0;
-        data->msg.tx_error_cnt = 1;
         /* Queue transmitted message for monitoring purposes */
         cec_queue_msg_monitor(data->adap, &data->msg, 1);
 
@@ -851,7 +852,7 @@ static const u8 cec_msg_size[256] = {
         [CEC_MSG_REQUEST_ARC_TERMINATION] = 2 | DIRECTED,
         [CEC_MSG_TERMINATE_ARC] = 2 | DIRECTED,
         [CEC_MSG_REQUEST_CURRENT_LATENCY] = 4 | BCAST,
-        [CEC_MSG_REPORT_CURRENT_LATENCY] = 7 | BCAST,
+        [CEC_MSG_REPORT_CURRENT_LATENCY] = 6 | BCAST,
         [CEC_MSG_CDC_MESSAGE] = 2 | BCAST,
 };
 
@@ -1205,7 +1206,7 @@ static int cec_config_thread_func(void *arg)
                 las->log_addr[i] = CEC_LOG_ADDR_INVALID;
                 if (last_la == CEC_LOG_ADDR_INVALID ||
                     last_la == CEC_LOG_ADDR_UNREGISTERED ||
-                    !(last_la & type2mask[type]))
+                    !((1 << last_la) & type2mask[type]))
                         last_la = la_list[0];
 
                 err = cec_config_log_addr(adap, i, last_la);
@@ -1250,30 +1251,49 @@ configured:
                 for (i = 1; i < las->num_log_addrs; i++)
                         las->log_addr[i] = CEC_LOG_ADDR_INVALID;
         }
+        for (i = las->num_log_addrs; i < CEC_MAX_LOG_ADDRS; i++)
+                las->log_addr[i] = CEC_LOG_ADDR_INVALID;
         adap->is_configured = true;
         adap->is_configuring = false;
         cec_post_state_event(adap);
-        mutex_unlock(&adap->lock);
 
+        /*
+         * Now post the Report Features and Report Physical Address broadcast
+         * messages. Note that these are non-blocking transmits, meaning that
+         * they are just queued up and once adap->lock is unlocked the main
+         * thread will kick in and start transmitting these.
+         *
+         * If after this function is done (but before one or more of these
+         * messages are actually transmitted) the CEC adapter is unconfigured,
+         * then any remaining messages will be dropped by the main thread.
+         */
         for (i = 0; i < las->num_log_addrs; i++) {
+                struct cec_msg msg = {};
+
                 if (las->log_addr[i] == CEC_LOG_ADDR_INVALID ||
                     (las->flags & CEC_LOG_ADDRS_FL_CDC_ONLY))
                         continue;
 
-                /*
-                 * Report Features must come first according
-                 * to CEC 2.0
-                 */
-                if (las->log_addr[i] != CEC_LOG_ADDR_UNREGISTERED)
-                        cec_report_features(adap, i);
-                cec_report_phys_addr(adap, i);
+                msg.msg[0] = (las->log_addr[i] << 4) | 0x0f;
+
+                /* Report Features must come first according to CEC 2.0 */
+                if (las->log_addr[i] != CEC_LOG_ADDR_UNREGISTERED &&
+                    adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0) {
+                        cec_fill_msg_report_features(adap, &msg, i);
+                        cec_transmit_msg_fh(adap, &msg, NULL, false);
+                }
+
+                /* Report Physical Address */
+                cec_msg_report_physical_addr(&msg, adap->phys_addr,
+                                             las->primary_device_type[i]);
+                dprintk(2, "config: la %d pa %x.%x.%x.%x\n",
+                        las->log_addr[i],
+                        cec_phys_addr_exp(adap->phys_addr));
+                cec_transmit_msg_fh(adap, &msg, NULL, false);
         }
-        for (i = las->num_log_addrs; i < CEC_MAX_LOG_ADDRS; i++)
-                las->log_addr[i] = CEC_LOG_ADDR_INVALID;
-        mutex_lock(&adap->lock);
         adap->kthread_config = NULL;
-        mutex_unlock(&adap->lock);
         complete(&adap->config_completion);
+        mutex_unlock(&adap->lock);
         return 0;
 
 unconfigure:
@@ -1526,52 +1546,32 @@ EXPORT_SYMBOL_GPL(cec_s_log_addrs);
 
 /* High-level core CEC message handling */
 
-/* Transmit the Report Features message */
-static int cec_report_features(struct cec_adapter *adap, unsigned int la_idx)
+/* Fill in the Report Features message */
+static void cec_fill_msg_report_features(struct cec_adapter *adap,
+                                         struct cec_msg *msg,
+                                         unsigned int la_idx)
 {
-        struct cec_msg msg = { };
         const struct cec_log_addrs *las = &adap->log_addrs;
         const u8 *features = las->features[la_idx];
         bool op_is_dev_features = false;
         unsigned int idx;
 
-        /* This is 2.0 and up only */
-        if (adap->log_addrs.cec_version < CEC_OP_CEC_VERSION_2_0)
-                return 0;
-
         /* Report Features */
-        msg.msg[0] = (las->log_addr[la_idx] << 4) | 0x0f;
-        msg.len = 4;
-        msg.msg[1] = CEC_MSG_REPORT_FEATURES;
-        msg.msg[2] = adap->log_addrs.cec_version;
-        msg.msg[3] = las->all_device_types[la_idx];
+        msg->msg[0] = (las->log_addr[la_idx] << 4) | 0x0f;
+        msg->len = 4;
+        msg->msg[1] = CEC_MSG_REPORT_FEATURES;
+        msg->msg[2] = adap->log_addrs.cec_version;
+        msg->msg[3] = las->all_device_types[la_idx];
 
         /* Write RC Profiles first, then Device Features */
         for (idx = 0; idx < ARRAY_SIZE(las->features[0]); idx++) {
-                msg.msg[msg.len++] = features[idx];
+                msg->msg[msg->len++] = features[idx];
                 if ((features[idx] & CEC_OP_FEAT_EXT) == 0) {
                         if (op_is_dev_features)
                                 break;
                         op_is_dev_features = true;
                 }
         }
-        return cec_transmit_msg(adap, &msg, false);
-}
-
-/* Transmit the Report Physical Address message */
-static int cec_report_phys_addr(struct cec_adapter *adap, unsigned int la_idx)
-{
-        const struct cec_log_addrs *las = &adap->log_addrs;
-        struct cec_msg msg = { };
-
-        /* Report Physical Address */
-        msg.msg[0] = (las->log_addr[la_idx] << 4) | 0x0f;
-        cec_msg_report_physical_addr(&msg, adap->phys_addr,
-                                     las->primary_device_type[la_idx]);
-        dprintk(2, "config: la %d pa %x.%x.%x.%x\n",
-                las->log_addr[la_idx],
-                        cec_phys_addr_exp(adap->phys_addr));
-        return cec_transmit_msg(adap, &msg, false);
 }
 
 /* Transmit the Feature Abort message */
@@ -1777,9 +1777,10 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
         }
 
         case CEC_MSG_GIVE_FEATURES:
-                if (adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0)
-                        return cec_report_features(adap, la_idx);
-                return 0;
+                if (adap->log_addrs.cec_version < CEC_OP_CEC_VERSION_2_0)
+                        return cec_feature_abort(adap, msg);
+                cec_fill_msg_report_features(adap, &tx_cec_msg, la_idx);
+                return cec_transmit_msg(adap, &tx_cec_msg, false);
 
         default:
                 /*
diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c
index bc5e8cfe7ca2..8f11d7e45993 100644
--- a/drivers/media/dvb-core/dvb_net.c
+++ b/drivers/media/dvb-core/dvb_net.c
@@ -719,6 +719,9 @@ static void dvb_net_ule_check_crc(struct dvb_net_ule_handle *h,
                 skb_copy_from_linear_data(h->priv->ule_skb, dest_addr,
                                           ETH_ALEN);
                 skb_pull(h->priv->ule_skb, ETH_ALEN);
+        } else {
+                /* dest_addr buffer is only valid if h->priv->ule_dbit == 0 */
+                eth_zero_addr(dest_addr);
         }
 
         /* Handle ULE Extension Headers. */
@@ -750,16 +753,8 @@ static void dvb_net_ule_check_crc(struct dvb_net_ule_handle *h,
         if (!h->priv->ule_bridged) {
                 skb_push(h->priv->ule_skb, ETH_HLEN);
                 h->ethh = (struct ethhdr *)h->priv->ule_skb->data;
-                if (!h->priv->ule_dbit) {
-                        /*
-                         * dest_addr buffer is only valid if
-                         * h->priv->ule_dbit == 0
-                         */
-                        memcpy(h->ethh->h_dest, dest_addr, ETH_ALEN);
-                        eth_zero_addr(h->ethh->h_source);
-                } else /* zeroize source and dest */
-                        memset(h->ethh, 0, ETH_ALEN * 2);
-
+                memcpy(h->ethh->h_dest, dest_addr, ETH_ALEN);
+                eth_zero_addr(h->ethh->h_source);
                 h->ethh->h_proto = htons(h->priv->ule_sndu_type);
         }
         /* else:  skb is in correct state; nothing to do. */
diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index b31fa6fae009..b979ea148251 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -655,6 +655,7 @@ config VIDEO_S5K6A3
 config VIDEO_S5K4ECGX
         tristate "Samsung S5K4ECGX sensor support"
         depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
+        select CRC32
         ---help---
           This is a V4L2 sensor-level driver for Samsung S5K4ECGX 5M
           camera sensor with an embedded SoC image signal processor.
diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
index 59872b31f832..f4e92bdfe192 100644
--- a/drivers/media/i2c/smiapp/smiapp-core.c
+++ b/drivers/media/i2c/smiapp/smiapp-core.c
@@ -2741,9 +2741,7 @@ static const struct v4l2_subdev_internal_ops smiapp_internal_ops = {
  * I2C Driver
  */
 
-#ifdef CONFIG_PM
-
-static int smiapp_suspend(struct device *dev)
+static int __maybe_unused smiapp_suspend(struct device *dev)
 {
         struct i2c_client *client = to_i2c_client(dev);
         struct v4l2_subdev *subdev = i2c_get_clientdata(client);
@@ -2768,7 +2766,7 @@ static int smiapp_suspend(struct device *dev)
         return 0;
 }
 
-static int smiapp_resume(struct device *dev)
+static int __maybe_unused smiapp_resume(struct device *dev)
 {
         struct i2c_client *client = to_i2c_client(dev);
         struct v4l2_subdev *subdev = i2c_get_clientdata(client);
@@ -2783,13 +2781,6 @@ static int smiapp_resume(struct device *dev)
         return rval;
 }
 
-#else
-
-#define smiapp_suspend  NULL
-#define smiapp_resume   NULL
-
-#endif /* CONFIG_PM */
-
 static struct smiapp_hwconfig *smiapp_get_hwconfig(struct device *dev)
 {
         struct smiapp_hwconfig *hwcfg;
@@ -2913,13 +2904,9 @@ static int smiapp_probe(struct i2c_client *client,
         if (IS_ERR(sensor->xshutdown))
                 return PTR_ERR(sensor->xshutdown);
 
-        pm_runtime_enable(&client->dev);
-
-        rval = pm_runtime_get_sync(&client->dev);
-        if (rval < 0) {
-                rval = -ENODEV;
-                goto out_power_off;
-        }
+        rval = smiapp_power_on(&client->dev);
+        if (rval < 0)
+                return rval;
 
         rval = smiapp_identify_module(sensor);
         if (rval) {
@@ -3100,6 +3087,9 @@ static int smiapp_probe(struct i2c_client *client,
         if (rval < 0)
                 goto out_media_entity_cleanup;
 
+        pm_runtime_set_active(&client->dev);
+        pm_runtime_get_noresume(&client->dev);
+        pm_runtime_enable(&client->dev);
         pm_runtime_set_autosuspend_delay(&client->dev, 1000);
         pm_runtime_use_autosuspend(&client->dev);
         pm_runtime_put_autosuspend(&client->dev);
@@ -3113,8 +3103,7 @@ out_cleanup:
         smiapp_cleanup(sensor);
 
 out_power_off:
-        pm_runtime_put(&client->dev);
-        pm_runtime_disable(&client->dev);
+        smiapp_power_off(&client->dev);
 
         return rval;
 }
@@ -3127,8 +3116,10 @@ static int smiapp_remove(struct i2c_client *client)
 
         v4l2_async_unregister_subdev(subdev);
 
-        pm_runtime_suspend(&client->dev);
         pm_runtime_disable(&client->dev);
+        if (!pm_runtime_status_suspended(&client->dev))
+                smiapp_power_off(&client->dev);
+        pm_runtime_set_suspended(&client->dev);
 
         for (i = 0; i < sensor->ssds_used; i++) {
                 v4l2_device_unregister_subdev(&sensor->ssds[i].sd);
diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
index 3a0fe8cc64e9..48646a7f3fb0 100644
--- a/drivers/media/i2c/tvp5150.c
+++ b/drivers/media/i2c/tvp5150.c
@@ -291,8 +291,12 @@ static void tvp5150_selmux(struct v4l2_subdev *sd)
         tvp5150_write(sd, TVP5150_OP_MODE_CTL, opmode);
         tvp5150_write(sd, TVP5150_VD_IN_SRC_SEL_1, input);
 
-        /* Svideo should enable YCrCb output and disable GPCL output
-         * For Composite and TV, it should be the reverse
+        /*
+         * Setup the FID/GLCO/VLK/HVLK and INTREQ/GPCL/VBLK output signals. For
+         * S-Video we output the vertical lock (VLK) signal on FID/GLCO/VLK/HVLK
+         * and set INTREQ/GPCL/VBLK to logic 0. For composite we output the
+         * field indicator (FID) signal on FID/GLCO/VLK/HVLK and set
+         * INTREQ/GPCL/VBLK to logic 1.
          */
         val = tvp5150_read(sd, TVP5150_MISC_CTL);
         if (val < 0) {
@@ -301,9 +305,9 @@ static void tvp5150_selmux(struct v4l2_subdev *sd)
         }
 
         if (decoder->input == TVP5150_SVIDEO)
-                val = (val & ~0x40) | 0x10;
+                val = (val & ~TVP5150_MISC_CTL_GPCL) | TVP5150_MISC_CTL_HVLK;
         else
-                val = (val & ~0x10) | 0x40;
+                val = (val & ~TVP5150_MISC_CTL_HVLK) | TVP5150_MISC_CTL_GPCL;
         tvp5150_write(sd, TVP5150_MISC_CTL, val);
 };
 
@@ -455,7 +459,12 @@ static const struct i2c_reg_value tvp5150_init_enable[] = {
         },{     /* Automatic offset and AGC enabled */
                 TVP5150_ANAL_CHL_CTL, 0x15
         },{     /* Activate YCrCb output 0x9 or 0xd ? */
-                TVP5150_MISC_CTL, 0x6f
+                TVP5150_MISC_CTL, TVP5150_MISC_CTL_GPCL |
+                                  TVP5150_MISC_CTL_INTREQ_OE |
+                                  TVP5150_MISC_CTL_YCBCR_OE |
+                                  TVP5150_MISC_CTL_SYNC_OE |
+                                  TVP5150_MISC_CTL_VBLANK |
+                                  TVP5150_MISC_CTL_CLOCK_OE,
         },{     /* Activates video std autodetection for all standards */
                 TVP5150_AUTOSW_MSK, 0x0
         },{     /* Default format: 0x47. For 4:2:2: 0x40 */
@@ -861,8 +870,6 @@ static int tvp5150_fill_fmt(struct v4l2_subdev *sd,
 
         f = &format->format;
 
-        tvp5150_reset(sd, 0);
-
         f->width = decoder->rect.width;
         f->height = decoder->rect.height / 2;
 
@@ -1051,21 +1058,27 @@ static const struct media_entity_operations tvp5150_sd_media_ops = {
 static int tvp5150_s_stream(struct v4l2_subdev *sd, int enable)
 {
         struct tvp5150 *decoder = to_tvp5150(sd);
-        /* Output format: 8-bit ITU-R BT.656 with embedded syncs */
-        int val = 0x09;
-
-        /* Output format: 8-bit 4:2:2 YUV with discrete sync */
-        if (decoder->mbus_type == V4L2_MBUS_PARALLEL)
-                val = 0x0d;
+        int val;
 
-        /* Initializes TVP5150 to its default values */
-        /* # set PCLK (27MHz) */
-        tvp5150_write(sd, TVP5150_CONF_SHARED_PIN, 0x00);
+        /* Enable or disable the video output signals. */
+        val = tvp5150_read(sd, TVP5150_MISC_CTL);
+        if (val < 0)
+                return val;
+
+        val &= ~(TVP5150_MISC_CTL_YCBCR_OE | TVP5150_MISC_CTL_SYNC_OE |
+                 TVP5150_MISC_CTL_CLOCK_OE);
+
+        if (enable) {
+                /*
+                 * Enable the YCbCr and clock outputs. In discrete sync mode
+                 * (non-BT.656) additionally enable the the sync outputs.
+                 */
+                val |= TVP5150_MISC_CTL_YCBCR_OE | TVP5150_MISC_CTL_CLOCK_OE;
+                if (decoder->mbus_type == V4L2_MBUS_PARALLEL)
+                        val |= TVP5150_MISC_CTL_SYNC_OE;
+        }
 
-        if (enable)
-                tvp5150_write(sd, TVP5150_MISC_CTL, val);
-        else
-                tvp5150_write(sd, TVP5150_MISC_CTL, 0x00);
+        tvp5150_write(sd, TVP5150_MISC_CTL, val);
 
         return 0;
 }
@@ -1524,7 +1537,6 @@ static int tvp5150_probe(struct i2c_client *c,
                 res = core->hdl.error;
                 goto err;
         }
-        v4l2_ctrl_handler_setup(&core->hdl);
 
         /* Default is no cropping */
         core->rect.top = 0;
@@ -1535,6 +1547,8 @@ static int tvp5150_probe(struct i2c_client *c,
         core->rect.left = 0;
         core->rect.width = TVP5150_H_MAX;
 
+        tvp5150_reset(sd, 0);   /* Calls v4l2_ctrl_handler_setup() */
+
         res = v4l2_async_register_subdev(sd);
         if (res < 0)
                 goto err;
diff --git a/drivers/media/i2c/tvp5150_reg.h b/drivers/media/i2c/tvp5150_reg.h
index 25a994944918..30a48c28d05a 100644
--- a/drivers/media/i2c/tvp5150_reg.h
+++ b/drivers/media/i2c/tvp5150_reg.h
@@ -9,6 +9,15 @@
 #define TVP5150_ANAL_CHL_CTL         0x01 /* Analog channel controls */
 #define TVP5150_OP_MODE_CTL          0x02 /* Operation mode controls */
 #define TVP5150_MISC_CTL             0x03 /* Miscellaneous controls */
+#define TVP5150_MISC_CTL_VBLK_GPCL      BIT(7)
+#define TVP5150_MISC_CTL_GPCL           BIT(6)
+#define TVP5150_MISC_CTL_INTREQ_OE      BIT(5)
+#define TVP5150_MISC_CTL_HVLK           BIT(4)
+#define TVP5150_MISC_CTL_YCBCR_OE       BIT(3)
+#define TVP5150_MISC_CTL_SYNC_OE        BIT(2)
+#define TVP5150_MISC_CTL_VBLANK         BIT(1)
+#define TVP5150_MISC_CTL_CLOCK_OE       BIT(0)
+
 #define TVP5150_AUTOSW_MSK           0x04 /* Autoswitch mask: TVP5150A / TVP5150AM */
 
 /* Reserved 05h */
diff --git a/drivers/media/pci/cobalt/cobalt-driver.c b/drivers/media/pci/cobalt/cobalt-driver.c
index 979634000597..d5c911c09e2b 100644
--- a/drivers/media/pci/cobalt/cobalt-driver.c
+++ b/drivers/media/pci/cobalt/cobalt-driver.c
@@ -308,9 +308,7 @@ static void cobalt_pci_iounmap(struct cobalt *cobalt, struct pci_dev *pci_dev)
 static void cobalt_free_msi(struct cobalt *cobalt, struct pci_dev *pci_dev)
 {
         free_irq(pci_dev->irq, (void *)cobalt);
-
-        if (cobalt->msi_enabled)
-                pci_disable_msi(pci_dev);
+        pci_free_irq_vectors(pci_dev);
 }
 
 static int cobalt_setup_pci(struct cobalt *cobalt, struct pci_dev *pci_dev,
@@ -387,14 +385,12 @@ static int cobalt_setup_pci(struct cobalt *cobalt, struct pci_dev *pci_dev,
            from being generated. */
         cobalt_set_interrupt(cobalt, false);
 
-        if (pci_enable_msi_range(pci_dev, 1, 1) < 1) {
+        if (pci_alloc_irq_vectors(pci_dev, 1, 1, PCI_IRQ_MSI) < 1) {
                 cobalt_err("Could not enable MSI\n");
-                cobalt->msi_enabled = false;
                 ret = -EIO;
                 goto err_release;
         }
         msi_config_show(cobalt, pci_dev);
-        cobalt->msi_enabled = true;
 
         /* Register IRQ */
         if (request_irq(pci_dev->irq, cobalt_irq_handler, IRQF_SHARED,
diff --git a/drivers/media/pci/cobalt/cobalt-driver.h b/drivers/media/pci/cobalt/cobalt-driver.h
index ed00dc9d9399..00f773ec359a 100644
--- a/drivers/media/pci/cobalt/cobalt-driver.h
+++ b/drivers/media/pci/cobalt/cobalt-driver.h
@@ -287,8 +287,6 @@ struct cobalt {
         u32 irq_none;
         u32 irq_full_fifo;
 
-        bool msi_enabled;
-
         /* omnitek dma */
         int dma_channels;
         int first_fifo_channel;
diff --git a/drivers/media/usb/dvb-usb/pctv452e.c b/drivers/media/usb/dvb-usb/pctv452e.c
index 07fa08be9e99..d54ebe7e0215 100644
--- a/drivers/media/usb/dvb-usb/pctv452e.c
+++ b/drivers/media/usb/dvb-usb/pctv452e.c
@@ -97,14 +97,13 @@ struct pctv452e_state {
         u8 c;      /* transaction counter, wraps around...  */
         u8 initialized; /* set to 1 if 0x15 has been sent */
         u16 last_rc_key;
-
-        unsigned char data[80];
 };
 
 static int tt3650_ci_msg(struct dvb_usb_device *d, u8 cmd, u8 *data,
                          unsigned int write_len, unsigned int read_len)
 {
         struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
+        u8 *buf;
         u8 id;
         unsigned int rlen;
         int ret;
@@ -114,36 +113,39 @@ static int tt3650_ci_msg(struct dvb_usb_device *d, u8 cmd, u8 *data,
                 return -EIO;
         }
 
-        mutex_lock(&state->ca_mutex);
+        buf = kmalloc(64, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
         id = state->c++;
 
-        state->data[0] = SYNC_BYTE_OUT;
-        state->data[1] = id;
-        state->data[2] = cmd;
-        state->data[3] = write_len;
+        buf[0] = SYNC_BYTE_OUT;
+        buf[1] = id;
+        buf[2] = cmd;
+        buf[3] = write_len;
 
-        memcpy(state->data + 4, data, write_len);
+        memcpy(buf + 4, data, write_len);
 
         rlen = (read_len > 0) ? 64 : 0;
-        ret = dvb_usb_generic_rw(d, state->data, 4 + write_len,
-                                  state->data, rlen, /* delay_ms */ 0);
+        ret = dvb_usb_generic_rw(d, buf, 4 + write_len,
+                                  buf, rlen, /* delay_ms */ 0);
         if (0 != ret)
                 goto failed;
 
         ret = -EIO;
-        if (SYNC_BYTE_IN != state->data[0] || id != state->data[1])
+        if (SYNC_BYTE_IN != buf[0] || id != buf[1])
                 goto failed;
 
-        memcpy(data, state->data + 4, read_len);
+        memcpy(data, buf + 4, read_len);
 
-        mutex_unlock(&state->ca_mutex);
+        kfree(buf);
         return 0;
 
 failed:
         err("CI error %d; %02X %02X %02X -> %*ph.",
-             ret, SYNC_BYTE_OUT, id, cmd, 3, state->data);
+             ret, SYNC_BYTE_OUT, id, cmd, 3, buf);
 
-        mutex_unlock(&state->ca_mutex);
+        kfree(buf);
         return ret;
 }
 
@@ -410,53 +412,57 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr,
                                 u8 *rcv_buf, u8 rcv_len)
 {
         struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
+        u8 *buf;
         u8 id;
         int ret;
 
-        mutex_lock(&state->ca_mutex);
+        buf = kmalloc(64, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
         id = state->c++;
 
         ret = -EINVAL;
         if (snd_len > 64 - 7 || rcv_len > 64 - 7)
                 goto failed;
 
-        state->data[0] = SYNC_BYTE_OUT;
-        state->data[1] = id;
-        state->data[2] = PCTV_CMD_I2C;
-        state->data[3] = snd_len + 3;
-        state->data[4] = addr << 1;
-        state->data[5] = snd_len;
-        state->data[6] = rcv_len;
+        buf[0] = SYNC_BYTE_OUT;
+        buf[1] = id;
+        buf[2] = PCTV_CMD_I2C;
+        buf[3] = snd_len + 3;
+        buf[4] = addr << 1;
+        buf[5] = snd_len;
+        buf[6] = rcv_len;
 
-        memcpy(state->data + 7, snd_buf, snd_len);
+        memcpy(buf + 7, snd_buf, snd_len);
 
-        ret = dvb_usb_generic_rw(d, state->data, 7 + snd_len,
-                                  state->data, /* rcv_len */ 64,
+        ret = dvb_usb_generic_rw(d, buf, 7 + snd_len,
+                                  buf, /* rcv_len */ 64,
                                   /* delay_ms */ 0);
         if (ret < 0)
                 goto failed;
 
         /* TT USB protocol error. */
         ret = -EIO;
-        if (SYNC_BYTE_IN != state->data[0] || id != state->data[1])
+        if (SYNC_BYTE_IN != buf[0] || id != buf[1])
                 goto failed;
 
         /* I2C device didn't respond as expected. */
         ret = -EREMOTEIO;
-        if (state->data[5] < snd_len || state->data[6] < rcv_len)
+        if (buf[5] < snd_len || buf[6] < rcv_len)
                 goto failed;
 
-        memcpy(rcv_buf, state->data + 7, rcv_len);
-        mutex_unlock(&state->ca_mutex);
+        memcpy(rcv_buf, buf + 7, rcv_len);
 
+        kfree(buf);
         return rcv_len;
 
 failed:
         err("I2C error %d; %02X %02X  %02X %02X %02X -> %*ph",
              ret, SYNC_BYTE_OUT, id, addr << 1, snd_len, rcv_len,
-             7, state->data);
+             7, buf);
 
-        mutex_unlock(&state->ca_mutex);
+        kfree(buf);
         return ret;
 }
 
@@ -505,7 +511,7 @@ static u32 pctv452e_i2c_func(struct i2c_adapter *adapter)
 static int pctv452e_power_ctrl(struct dvb_usb_device *d, int i)
 {
         struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
-        u8 *rx;
+        u8 *b0, *rx;
         int ret;
 
         info("%s: %d\n", __func__, i);
@@ -516,11 +522,12 @@ static int pctv452e_power_ctrl(struct dvb_usb_device *d, int i)
         if (state->initialized)
                 return 0;
 
-        rx = kmalloc(PCTV_ANSWER_LEN, GFP_KERNEL);
-        if (!rx)
+        b0 = kmalloc(5 + PCTV_ANSWER_LEN, GFP_KERNEL);
+        if (!b0)
                 return -ENOMEM;
 
-        mutex_lock(&state->ca_mutex);
+        rx = b0 + 5;
+
         /* hmm where shoud this should go? */
         ret = usb_set_interface(d->udev, 0, ISOC_INTERFACE_ALTERNATIVE);
         if (ret != 0)
@@ -528,66 +535,70 @@ static int pctv452e_power_ctrl(struct dvb_usb_device *d, int i)
                         __func__, ret);
 
         /* this is a one-time initialization, dont know where to put */
-        state->data[0] = 0xaa;
-        state->data[1] = state->c++;
-        state->data[2] = PCTV_CMD_RESET;
-        state->data[3] = 1;
-        state->data[4] = 0;
+        b0[0] = 0xaa;
+        b0[1] = state->c++;
+        b0[2] = PCTV_CMD_RESET;
+        b0[3] = 1;
+        b0[4] = 0;
         /* reset board */
-        ret = dvb_usb_generic_rw(d, state->data, 5, rx, PCTV_ANSWER_LEN, 0);
+        ret = dvb_usb_generic_rw(d, b0, 5, rx, PCTV_ANSWER_LEN, 0);
         if (ret)
                 goto ret;
 
-        state->data[1] = state->c++;
-        state->data[4] = 1;
+        b0[1] = state->c++;
+        b0[4] = 1;
         /* reset board (again?) */
-        ret = dvb_usb_generic_rw(d, state->data, 5, rx, PCTV_ANSWER_LEN, 0);
+        ret = dvb_usb_generic_rw(d, b0, 5, rx, PCTV_ANSWER_LEN, 0);
         if (ret)
                 goto ret;
 
         state->initialized = 1;
 
 ret:
-        mutex_unlock(&state->ca_mutex);
-        kfree(rx);
+        kfree(b0);
         return ret;
 }
 
 static int pctv452e_rc_query(struct dvb_usb_device *d)
 {
         struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
+        u8 *b, *rx;
         int ret, i;
         u8 id;
 
-        mutex_lock(&state->ca_mutex);
+        b = kmalloc(CMD_BUFFER_SIZE + PCTV_ANSWER_LEN, GFP_KERNEL);
+        if (!b)
+                return -ENOMEM;
+
+        rx = b + CMD_BUFFER_SIZE;
+
         id = state->c++;
 
         /* prepare command header  */
-        state->data[0] = SYNC_BYTE_OUT;
-        state->data[1] = id;
-        state->data[2] = PCTV_CMD_IR;
-        state->data[3] = 0;
+        b[0] = SYNC_BYTE_OUT;
+        b[1] = id;
+        b[2] = PCTV_CMD_IR;
+        b[3] = 0;
 
         /* send ir request */
-        ret = dvb_usb_generic_rw(d, state->data, 4,
-                                 state->data, PCTV_ANSWER_LEN, 0);
+        ret = dvb_usb_generic_rw(d, b, 4, rx, PCTV_ANSWER_LEN, 0);
         if (ret != 0)
                 goto ret;
 
         if (debug > 3) {
-                info("%s: read: %2d: %*ph: ", __func__, ret, 3, state->data);
-                for (i = 0; (i < state->data[3]) && ((i + 3) < PCTV_ANSWER_LEN); i++)
-                        info(" %02x", state->data[i + 3]);
+                info("%s: read: %2d: %*ph: ", __func__, ret, 3, rx);
+                for (i = 0; (i < rx[3]) && ((i+3) < PCTV_ANSWER_LEN); i++)
+                        info(" %02x", rx[i+3]);
 
                 info("\n");
         }
 
-        if ((state->data[3] == 9) &&  (state->data[12] & 0x01)) {
+        if ((rx[3] == 9) &&  (rx[12] & 0x01)) {
                 /* got a "press" event */
-                state->last_rc_key = RC_SCANCODE_RC5(state->data[7], state->data[6]);
+                state->last_rc_key = RC_SCANCODE_RC5(rx[7], rx[6]);
                 if (debug > 2)
                         info("%s: cmd=0x%02x sys=0x%02x\n",
-                                __func__, state->data[6], state->data[7]);
+                                __func__, rx[6], rx[7]);
 
                 rc_keydown(d->rc_dev, RC_TYPE_RC5, state->last_rc_key, 0);
         } else if (state->last_rc_key) {
@@ -595,7 +606,7 @@ static int pctv452e_rc_query(struct dvb_usb_device *d)
                 state->last_rc_key = 0;
         }
 ret:
-        mutex_unlock(&state->ca_mutex);
+        kfree(b);
         return ret;
 }
 
diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index a0547dbf9806..76382c858c35 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -330,7 +330,7 @@ static int h_memstick_read_dev_id(struct memstick_dev *card,
         struct ms_id_register id_reg;
 
         if (!(*mrq)) {
-                memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, NULL,
+                memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, &id_reg,
                                   sizeof(struct ms_id_register));
                 *mrq = &card->current_mrq;
                 return 0;
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index b44306b886cb..73db08558e4d 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -3354,10 +3354,11 @@ int dw_mci_runtime_resume(struct device *dev)
 
                 if (!slot)
                         continue;
-                if (slot->mmc->pm_flags & MMC_PM_KEEP_POWER) {
+                if (slot->mmc->pm_flags & MMC_PM_KEEP_POWER)
                         dw_mci_set_ios(slot->mmc, &slot->mmc->ios);
-                        dw_mci_setup_bus(slot, true);
-                }
+
+                /* Force setup bus to guarantee available clock output */
+                dw_mci_setup_bus(slot, true);
         }
 
         /* Now that slots are all setup, we can enable card detect */
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 23909804ffb8..0def99590d16 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -2733,7 +2733,8 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id)
                 if (intmask & SDHCI_INT_RETUNE)
                         mmc_retune_needed(host->mmc);
 
-                if (intmask & SDHCI_INT_CARD_INT) {
+                if ((intmask & SDHCI_INT_CARD_INT) &&
+                    (host->ier & SDHCI_INT_CARD_INT)) {
                         sdhci_enable_sdio_irq_nolock(host, false);
                         host->thread_isr |= SDHCI_INT_CARD_INT;
                         result = IRQ_WAKE_THREAD;
diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c
index 7be393c96b1a..cf7c18947189 100644
--- a/drivers/net/can/c_can/c_can_pci.c
+++ b/drivers/net/can/c_can/c_can_pci.c
@@ -161,6 +161,7 @@ static int c_can_pci_probe(struct pci_dev *pdev,
 
         dev->irq = pdev->irq;
         priv->base = addr;
+        priv->device = &pdev->dev;
 
         if (!c_can_pci_data->freq) {
                 dev_err(&pdev->dev, "no clock frequency defined\n");
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index 680d1ff07a55..6749b1829469 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -948,7 +948,12 @@ static int ti_hecc_probe(struct platform_device *pdev)
         netif_napi_add(ndev, &priv->napi, ti_hecc_rx_poll,
                 HECC_DEF_NAPI_WEIGHT);
 
-        clk_enable(priv->clk);
+        err = clk_prepare_enable(priv->clk);
+        if (err) {
+                dev_err(&pdev->dev, "clk_prepare_enable() failed\n");
+                goto probe_exit_clk;
+        }
+
         err = register_candev(ndev);
         if (err) {
                 dev_err(&pdev->dev, "register_candev() failed\n");
@@ -981,7 +986,7 @@ static int ti_hecc_remove(struct platform_device *pdev)
         struct ti_hecc_priv *priv = netdev_priv(ndev);
 
         unregister_candev(ndev);
-        clk_disable(priv->clk);
+        clk_disable_unprepare(priv->clk);
         clk_put(priv->clk);
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         iounmap(priv->base);
@@ -1006,7 +1011,7 @@ static int ti_hecc_suspend(struct platform_device *pdev, pm_message_t state)
         hecc_set_bit(priv, HECC_CANMC, HECC_CANMC_PDR);
         priv->can.state = CAN_STATE_SLEEPING;
 
-        clk_disable(priv->clk);
+        clk_disable_unprepare(priv->clk);
 
         return 0;
 }
@@ -1015,8 +1020,11 @@ static int ti_hecc_resume(struct platform_device *pdev)
 {
         struct net_device *dev = platform_get_drvdata(pdev);
         struct ti_hecc_priv *priv = netdev_priv(dev);
+        int err;
 
-        clk_enable(priv->clk);
+        err = clk_prepare_enable(priv->clk);
+        if (err)
+                return err;
 
         hecc_clear_bit(priv, HECC_CANMC, HECC_CANMC_PDR);
         priv->can.state = CAN_STATE_ERROR_ACTIVE;
diff --git a/drivers/net/ethernet/adaptec/starfire.c b/drivers/net/ethernet/adaptec/starfire.c
index c12d2618eebf..3872ab96b80a 100644
--- a/drivers/net/ethernet/adaptec/starfire.c
+++ b/drivers/net/ethernet/adaptec/starfire.c
@@ -1152,6 +1152,12 @@ static void init_ring(struct net_device *dev)
                 if (skb == NULL)
                         break;
                 np->rx_info[i].mapping = pci_map_single(np->pci_dev, skb->data, np->rx_buf_sz, PCI_DMA_FROMDEVICE);
+                if (pci_dma_mapping_error(np->pci_dev,
+                                          np->rx_info[i].mapping)) {
+                        dev_kfree_skb(skb);
+                        np->rx_info[i].skb = NULL;
+                        break;
+                }
                 /* Grrr, we cannot offset to correctly align the IP header. */
                 np->rx_ring[i].rxaddr = cpu_to_dma(np->rx_info[i].mapping | RxDescValid);
         }
@@ -1182,8 +1188,9 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
 {
         struct netdev_private *np = netdev_priv(dev);
         unsigned int entry;
+        unsigned int prev_tx;
         u32 status;
-        int i;
+        int i, j;
 
         /*
          * be cautious here, wrapping the queue has weird semantics
@@ -1201,6 +1208,7 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
         }
 #endif /* ZEROCOPY && HAS_BROKEN_FIRMWARE */
 
+        prev_tx = np->cur_tx;
         entry = np->cur_tx % TX_RING_SIZE;
         for (i = 0; i < skb_num_frags(skb); i++) {
                 int wrap_ring = 0;
@@ -1234,6 +1242,11 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
                                                skb_frag_size(this_frag),
                                                PCI_DMA_TODEVICE);
                 }
+                if (pci_dma_mapping_error(np->pci_dev,
+                                          np->tx_info[entry].mapping)) {
+                        dev->stats.tx_dropped++;
+                        goto err_out;
+                }
 
                 np->tx_ring[entry].addr = cpu_to_dma(np->tx_info[entry].mapping);
                 np->tx_ring[entry].status = cpu_to_le32(status);
@@ -1268,8 +1281,30 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
                 netif_stop_queue(dev);
 
         return NETDEV_TX_OK;
-}
 
+err_out:
+        entry = prev_tx % TX_RING_SIZE;
+        np->tx_info[entry].skb = NULL;
+        if (i > 0) {
+                pci_unmap_single(np->pci_dev,
+                                 np->tx_info[entry].mapping,
+                                 skb_first_frag_len(skb),
+                                 PCI_DMA_TODEVICE);
+                np->tx_info[entry].mapping = 0;
+                entry = (entry + np->tx_info[entry].used_slots) % TX_RING_SIZE;
+                for (j = 1; j < i; j++) {
+                        pci_unmap_single(np->pci_dev,
+                                         np->tx_info[entry].mapping,
+                                         skb_frag_size(
+                                                &skb_shinfo(skb)->frags[j-1]),
+                                         PCI_DMA_TODEVICE);
+                        entry++;
+                }
+        }
+        dev_kfree_skb_any(skb);
+        np->cur_tx = prev_tx;
+        return NETDEV_TX_OK;
+}
 
 /* The interrupt handler does all of the Rx thread work and cleans up
    after the Tx thread. */
@@ -1569,6 +1604,12 @@ static void refill_rx_ring(struct net_device *dev)
                                 break;  /* Better luck next round. */
                         np->rx_info[entry].mapping =
                                 pci_map_single(np->pci_dev, skb->data, np->rx_buf_sz, PCI_DMA_FROMDEVICE);
+                        if (pci_dma_mapping_error(np->pci_dev,
+                                                np->rx_info[entry].mapping)) {
+                                dev_kfree_skb(skb);
+                                np->rx_info[entry].skb = NULL;
+                                break;
+                        }
                         np->rx_ring[entry].rxaddr =
                                 cpu_to_dma(np->rx_info[entry].mapping | RxDescValid);
                 }
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index 5b7ba25e0065..8a280e7d66bd 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -891,6 +891,8 @@
 #define PCS_V1_WINDOW_SELECT            0x03fc
 #define PCS_V2_WINDOW_DEF               0x9060
 #define PCS_V2_WINDOW_SELECT            0x9064
+#define PCS_V2_RV_WINDOW_DEF            0x1060
+#define PCS_V2_RV_WINDOW_SELECT         0x1064
 
 /* PCS register entry bit positions and sizes */
 #define PCS_V2_WINDOW_DEF_OFFSET_INDEX  6
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index aaf0350076a9..a7d16db5c4b2 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -1151,7 +1151,7 @@ static int xgbe_read_mmd_regs_v2(struct xgbe_prv_data *pdata, int prtad,
         offset = pdata->xpcs_window + (mmd_address & pdata->xpcs_window_mask);
 
         spin_lock_irqsave(&pdata->xpcs_lock, flags);
-        XPCS32_IOWRITE(pdata, PCS_V2_WINDOW_SELECT, index);
+        XPCS32_IOWRITE(pdata, pdata->xpcs_window_sel_reg, index);
         mmd_data = XPCS16_IOREAD(pdata, offset);
         spin_unlock_irqrestore(&pdata->xpcs_lock, flags);
 
@@ -1183,7 +1183,7 @@ static void xgbe_write_mmd_regs_v2(struct xgbe_prv_data *pdata, int prtad,
         offset = pdata->xpcs_window + (mmd_address & pdata->xpcs_window_mask);
 
         spin_lock_irqsave(&pdata->xpcs_lock, flags);
-        XPCS32_IOWRITE(pdata, PCS_V2_WINDOW_SELECT, index);
+        XPCS32_IOWRITE(pdata, pdata->xpcs_window_sel_reg, index);
         XPCS16_IOWRITE(pdata, offset, mmd_data);
         spin_unlock_irqrestore(&pdata->xpcs_lock, flags);
 }
@@ -3407,8 +3407,10 @@ static int xgbe_init(struct xgbe_prv_data *pdata)
 
         /* Flush Tx queues */
         ret = xgbe_flush_tx_queues(pdata);
-        if (ret)
+        if (ret) {
+                netdev_err(pdata->netdev, "error flushing TX queues\n");
                 return ret;
+        }
 
         /*
          * Initialize DMA related features
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 9943629fcbf9..1c87cc204075 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -1070,7 +1070,9 @@ static int xgbe_start(struct xgbe_prv_data *pdata)
 
         DBGPR("-->xgbe_start\n");
 
-        hw_if->init(pdata);
+        ret = hw_if->init(pdata);
+        if (ret)
+                return ret;
 
         xgbe_napi_enable(pdata, 1);
 
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
index e76b7f65b805..c2730f15bd8b 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
@@ -265,6 +265,7 @@ static int xgbe_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         struct xgbe_prv_data *pdata;
         struct device *dev = &pdev->dev;
         void __iomem * const *iomap_table;
+        struct pci_dev *rdev;
         unsigned int ma_lo, ma_hi;
         unsigned int reg;
         int bar_mask;
@@ -326,8 +327,20 @@ static int xgbe_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (netif_msg_probe(pdata))
                 dev_dbg(dev, "xpcs_regs  = %p\n", pdata->xpcs_regs);
 
+        /* Set the PCS indirect addressing definition registers */
+        rdev = pci_get_domain_bus_and_slot(0, 0, PCI_DEVFN(0, 0));
+        if (rdev &&
+            (rdev->vendor == PCI_VENDOR_ID_AMD) && (rdev->device == 0x15d0)) {
+                pdata->xpcs_window_def_reg = PCS_V2_RV_WINDOW_DEF;
+                pdata->xpcs_window_sel_reg = PCS_V2_RV_WINDOW_SELECT;
+        } else {
+                pdata->xpcs_window_def_reg = PCS_V2_WINDOW_DEF;
+                pdata->xpcs_window_sel_reg = PCS_V2_WINDOW_SELECT;
+        }
+        pci_dev_put(rdev);
+
         /* Configure the PCS indirect addressing support */
-        reg = XPCS32_IOREAD(pdata, PCS_V2_WINDOW_DEF);
+        reg = XPCS32_IOREAD(pdata, pdata->xpcs_window_def_reg);
         pdata->xpcs_window = XPCS_GET_BITS(reg, PCS_V2_WINDOW_DEF, OFFSET);
         pdata->xpcs_window <<= 6;
         pdata->xpcs_window_size = XPCS_GET_BITS(reg, PCS_V2_WINDOW_DEF, SIZE);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
index f52a9bd05bac..00108815b55e 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
@@ -955,6 +955,8 @@ struct xgbe_prv_data {
 
         /* XPCS indirect addressing lock */
         spinlock_t xpcs_lock;
+        unsigned int xpcs_window_def_reg;
+        unsigned int xpcs_window_sel_reg;
         unsigned int xpcs_window;
         unsigned int xpcs_window_size;
         unsigned int xpcs_window_mask;
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index c8f525574d68..7dcc907a449d 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -685,8 +685,6 @@ static int alx_alloc_rings(struct alx_priv *alx)
                 return -ENOMEM;
         }
 
-        alx_reinit_rings(alx);
-
         return 0;
 }
 
@@ -703,7 +701,7 @@ static void alx_free_rings(struct alx_priv *alx)
         if (alx->qnapi[0] && alx->qnapi[0]->rxq)
                 kfree(alx->qnapi[0]->rxq->bufs);
 
-        if (!alx->descmem.virt)
+        if (alx->descmem.virt)
                 dma_free_coherent(&alx->hw.pdev->dev,
                                   alx->descmem.size,
                                   alx->descmem.virt,
@@ -984,6 +982,7 @@ static int alx_realloc_resources(struct alx_priv *alx)
         alx_free_rings(alx);
         alx_free_napis(alx);
         alx_disable_advanced_intr(alx);
+        alx_init_intr(alx, false);
 
         err = alx_alloc_napis(alx);
         if (err)
@@ -1241,6 +1240,12 @@ static int __alx_open(struct alx_priv *alx, bool resume)
         if (err)
                 goto out_free_rings;
 
+        /* must be called after alx_request_irq because the chip stops working
+         * if we copy the dma addresses in alx_init_ring_ptrs twice when
+         * requesting msi-x interrupts failed
+         */
+        alx_reinit_rings(alx);
+
         netif_set_real_num_tx_queues(alx->dev, alx->num_txq);
         netif_set_real_num_rx_queues(alx->dev, alx->num_rxq);
 
diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
index 3b14d5144228..c483618b57bd 100644
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
@@ -913,6 +913,8 @@ static int bcm_enet_open(struct net_device *dev)
                 priv->old_link = 0;
                 priv->old_duplex = -1;
                 priv->old_pause = -1;
+        } else {
+                phydev = NULL;
         }
 
         /* mask all interrupts and request them */
@@ -1083,7 +1085,7 @@ static int bcm_enet_open(struct net_device *dev)
         enet_dmac_writel(priv, priv->dma_chan_int_mask,
                          ENETDMAC_IRMASK, priv->tx_chan);
 
-        if (priv->has_phy)
+        if (phydev)
                 phy_start(phydev);
         else
                 bcm_enet_adjust_link(dev);
@@ -1126,7 +1128,7 @@ out_freeirq:
         free_irq(dev->irq, dev);
 
 out_phy_disconnect:
-        if (priv->has_phy)
+        if (phydev)
                 phy_disconnect(phydev);
 
         return ret;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 9608cb49a11c..4fcc6a84a087 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1099,7 +1099,7 @@ static struct sk_buff *bnxt_gro_func_5730x(struct bnxt_tpa_info *tpa_info,
 {
 #ifdef CONFIG_INET
         struct tcphdr *th;
-        int len, nw_off, tcp_opt_len;
+        int len, nw_off, tcp_opt_len = 0;
 
         if (tcp_ts)
                 tcp_opt_len = 12;
@@ -5314,17 +5314,12 @@ static int bnxt_update_link(struct bnxt *bp, bool chng_link_state)
         if ((link_info->support_auto_speeds | diff) !=
             link_info->support_auto_speeds) {
                 /* An advertised speed is no longer supported, so we need to
-                 * update the advertisement settings.  See bnxt_reset() for
-                 * comments about the rtnl_lock() sequence below.
+                 * update the advertisement settings.  Caller holds RTNL
+                 * so we can modify link settings.
                  */
-                clear_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
-                rtnl_lock();
                 link_info->advertising = link_info->support_auto_speeds;
-                if (test_bit(BNXT_STATE_OPEN, &bp->state) &&
-                    (link_info->autoneg & BNXT_AUTONEG_SPEED))
+                if (link_info->autoneg & BNXT_AUTONEG_SPEED)
                         bnxt_hwrm_set_link_setting(bp, true, false);
-                set_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
-                rtnl_unlock();
         }
         return 0;
 }
@@ -6200,29 +6195,37 @@ bnxt_restart_timer:
         mod_timer(&bp->timer, jiffies + bp->current_interval);
 }
 
-/* Only called from bnxt_sp_task() */
-static void bnxt_reset(struct bnxt *bp, bool silent)
+static void bnxt_rtnl_lock_sp(struct bnxt *bp)
 {
-        /* bnxt_reset_task() calls bnxt_close_nic() which waits
-         * for BNXT_STATE_IN_SP_TASK to clear.
-         * If there is a parallel dev_close(), bnxt_close() may be holding
+        /* We are called from bnxt_sp_task which has BNXT_STATE_IN_SP_TASK
+         * set.  If the device is being closed, bnxt_close() may be holding
          * rtnl() and waiting for BNXT_STATE_IN_SP_TASK to clear.  So we
          * must clear BNXT_STATE_IN_SP_TASK before holding rtnl().
          */
         clear_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
         rtnl_lock();
-        if (test_bit(BNXT_STATE_OPEN, &bp->state))
-                bnxt_reset_task(bp, silent);
+}
+
+static void bnxt_rtnl_unlock_sp(struct bnxt *bp)
+{
         set_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
         rtnl_unlock();
 }
 
+/* Only called from bnxt_sp_task() */
+static void bnxt_reset(struct bnxt *bp, bool silent)
+{
+        bnxt_rtnl_lock_sp(bp);
+        if (test_bit(BNXT_STATE_OPEN, &bp->state))
+                bnxt_reset_task(bp, silent);
+        bnxt_rtnl_unlock_sp(bp);
+}
+
 static void bnxt_cfg_ntp_filters(struct bnxt *);
 
 static void bnxt_sp_task(struct work_struct *work)
 {
         struct bnxt *bp = container_of(work, struct bnxt, sp_task);
-        int rc;
 
         set_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
         smp_mb__after_atomic();
@@ -6236,16 +6239,6 @@ static void bnxt_sp_task(struct work_struct *work)
 
         if (test_and_clear_bit(BNXT_RX_NTP_FLTR_SP_EVENT, &bp->sp_event))
                 bnxt_cfg_ntp_filters(bp);
-        if (test_and_clear_bit(BNXT_LINK_CHNG_SP_EVENT, &bp->sp_event)) {
-                if (test_and_clear_bit(BNXT_LINK_SPEED_CHNG_SP_EVENT,
-                                       &bp->sp_event))
-                        bnxt_hwrm_phy_qcaps(bp);
-
-                rc = bnxt_update_link(bp, true);
-                if (rc)
-                        netdev_err(bp->dev, "SP task can't update link (rc: %x)\n",
-                                   rc);
-        }
         if (test_and_clear_bit(BNXT_HWRM_EXEC_FWD_REQ_SP_EVENT, &bp->sp_event))
                 bnxt_hwrm_exec_fwd_req(bp);
         if (test_and_clear_bit(BNXT_VXLAN_ADD_PORT_SP_EVENT, &bp->sp_event)) {
@@ -6266,18 +6259,39 @@ static void bnxt_sp_task(struct work_struct *work)
                 bnxt_hwrm_tunnel_dst_port_free(
                         bp, TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_GENEVE);
         }
+        if (test_and_clear_bit(BNXT_PERIODIC_STATS_SP_EVENT, &bp->sp_event))
+                bnxt_hwrm_port_qstats(bp);
+
+        /* These functions below will clear BNXT_STATE_IN_SP_TASK.  They
+         * must be the last functions to be called before exiting.
+         */
+        if (test_and_clear_bit(BNXT_LINK_CHNG_SP_EVENT, &bp->sp_event)) {
+                int rc = 0;
+
+                if (test_and_clear_bit(BNXT_LINK_SPEED_CHNG_SP_EVENT,
+                                       &bp->sp_event))
+                        bnxt_hwrm_phy_qcaps(bp);
+
+                bnxt_rtnl_lock_sp(bp);
+                if (test_bit(BNXT_STATE_OPEN, &bp->state))
+                        rc = bnxt_update_link(bp, true);
+                bnxt_rtnl_unlock_sp(bp);
+                if (rc)
+                        netdev_err(bp->dev, "SP task can't update link (rc: %x)\n",
+                                   rc);
+        }
+        if (test_and_clear_bit(BNXT_HWRM_PORT_MODULE_SP_EVENT, &bp->sp_event)) {
+                bnxt_rtnl_lock_sp(bp);
+                if (test_bit(BNXT_STATE_OPEN, &bp->state))
+                        bnxt_get_port_module_status(bp);
+                bnxt_rtnl_unlock_sp(bp);
+        }
         if (test_and_clear_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event))
                 bnxt_reset(bp, false);
 
         if (test_and_clear_bit(BNXT_RESET_TASK_SILENT_SP_EVENT, &bp->sp_event))
                 bnxt_reset(bp, true);
 
-        if (test_and_clear_bit(BNXT_HWRM_PORT_MODULE_SP_EVENT, &bp->sp_event))
-                bnxt_get_port_module_status(bp);
-
-        if (test_and_clear_bit(BNXT_PERIODIC_STATS_SP_EVENT, &bp->sp_event))
-                bnxt_hwrm_port_qstats(bp);
-
         smp_mb__before_atomic();
         clear_bit(BNXT_STATE_IN_SP_TASK, &bp->state);
 }
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index c0fb80acc2da..baba2db9d9c2 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -43,13 +43,13 @@
 #define DEFAULT_RX_RING_SIZE    512 /* must be power of 2 */
 #define MIN_RX_RING_SIZE        64
 #define MAX_RX_RING_SIZE        8192
-#define RX_RING_BYTES(bp)       (sizeof(struct macb_dma_desc)   \
+#define RX_RING_BYTES(bp)       (macb_dma_desc_get_size(bp)     \
                                  * (bp)->rx_ring_size)
 
 #define DEFAULT_TX_RING_SIZE    512 /* must be power of 2 */
 #define MIN_TX_RING_SIZE        64
 #define MAX_TX_RING_SIZE        4096
-#define TX_RING_BYTES(bp)       (sizeof(struct macb_dma_desc)   \
+#define TX_RING_BYTES(bp)       (macb_dma_desc_get_size(bp)     \
                                  * (bp)->tx_ring_size)
 
 /* level of occupied TX descriptors under which we wake up TX process */
@@ -78,6 +78,37 @@
  */
 #define MACB_HALT_TIMEOUT       1230
 
+/* DMA buffer descriptor might be different size
+ * depends on hardware configuration.
+ */
+static unsigned int macb_dma_desc_get_size(struct macb *bp)
+{
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+        if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                return sizeof(struct macb_dma_desc) + sizeof(struct macb_dma_desc_64);
+#endif
+        return sizeof(struct macb_dma_desc);
+}
+
+static unsigned int macb_adj_dma_desc_idx(struct macb *bp, unsigned int idx)
+{
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+        /* Dma buffer descriptor is 4 words length (instead of 2 words)
+         * for 64b GEM.
+         */
+        if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                idx <<= 1;
+#endif
+        return idx;
+}
+
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+static struct macb_dma_desc_64 *macb_64b_desc(struct macb *bp, struct macb_dma_desc *desc)
+{
+        return (struct macb_dma_desc_64 *)((void *)desc + sizeof(struct macb_dma_desc));
+}
+#endif
+
 /* Ring buffer accessors */
 static unsigned int macb_tx_ring_wrap(struct macb *bp, unsigned int index)
 {
@@ -87,7 +118,9 @@ static unsigned int macb_tx_ring_wrap(struct macb *bp, unsigned int index)
 static struct macb_dma_desc *macb_tx_desc(struct macb_queue *queue,
                                           unsigned int index)
 {
-        return &queue->tx_ring[macb_tx_ring_wrap(queue->bp, index)];
+        index = macb_tx_ring_wrap(queue->bp, index);
+        index = macb_adj_dma_desc_idx(queue->bp, index);
+        return &queue->tx_ring[index];
 }
 
 static struct macb_tx_skb *macb_tx_skb(struct macb_queue *queue,
@@ -101,7 +134,7 @@ static dma_addr_t macb_tx_dma(struct macb_queue *queue, unsigned int index)
         dma_addr_t offset;
 
         offset = macb_tx_ring_wrap(queue->bp, index) *
-                 sizeof(struct macb_dma_desc);
+                        macb_dma_desc_get_size(queue->bp);
 
         return queue->tx_ring_dma + offset;
 }
@@ -113,7 +146,9 @@ static unsigned int macb_rx_ring_wrap(struct macb *bp, unsigned int index)
 
 static struct macb_dma_desc *macb_rx_desc(struct macb *bp, unsigned int index)
 {
-        return &bp->rx_ring[macb_rx_ring_wrap(bp, index)];
+        index = macb_rx_ring_wrap(bp, index);
+        index = macb_adj_dma_desc_idx(bp, index);
+        return &bp->rx_ring[index];
 }
 
 static void *macb_rx_buffer(struct macb *bp, unsigned int index)
@@ -560,12 +595,32 @@ static void macb_tx_unmap(struct macb *bp, struct macb_tx_skb *tx_skb)
         }
 }
 
-static inline void macb_set_addr(struct macb_dma_desc *desc, dma_addr_t addr)
+static void macb_set_addr(struct macb *bp, struct macb_dma_desc *desc, dma_addr_t addr)
 {
-        desc->addr = (u32)addr;
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-        desc->addrh = (u32)(addr >> 32);
+        struct macb_dma_desc_64 *desc_64;
+
+        if (bp->hw_dma_cap == HW_DMA_CAP_64B) {
+                desc_64 = macb_64b_desc(bp, desc);
+                desc_64->addrh = upper_32_bits(addr);
+        }
 #endif
+        desc->addr = lower_32_bits(addr);
+}
+
+static dma_addr_t macb_get_addr(struct macb *bp, struct macb_dma_desc *desc)
+{
+        dma_addr_t addr = 0;
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+        struct macb_dma_desc_64 *desc_64;
+
+        if (bp->hw_dma_cap == HW_DMA_CAP_64B) {
+                desc_64 = macb_64b_desc(bp, desc);
+                addr = ((u64)(desc_64->addrh) << 32);
+        }
+#endif
+        addr |= MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, desc->addr));
+        return addr;
 }
 
 static void macb_tx_error_task(struct work_struct *work)
@@ -649,16 +704,17 @@ static void macb_tx_error_task(struct work_struct *work)
 
         /* Set end of TX queue */
         desc = macb_tx_desc(queue, 0);
-        macb_set_addr(desc, 0);
+        macb_set_addr(bp, desc, 0);
         desc->ctrl = MACB_BIT(TX_USED);
 
         /* Make descriptor updates visible to hardware */
         wmb();
 
         /* Reinitialize the TX desc queue */
-        queue_writel(queue, TBQP, (u32)(queue->tx_ring_dma));
+        queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma));
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-        queue_writel(queue, TBQPH, (u32)(queue->tx_ring_dma >> 32));
+        if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                queue_writel(queue, TBQPH, upper_32_bits(queue->tx_ring_dma));
 #endif
         /* Make TX ring reflect state of hardware */
         queue->tx_head = 0;
@@ -750,6 +806,7 @@ static void gem_rx_refill(struct macb *bp)
         unsigned int            entry;
         struct sk_buff          *skb;
         dma_addr_t              paddr;
+        struct macb_dma_desc *desc;
 
         while (CIRC_SPACE(bp->rx_prepared_head, bp->rx_tail,
                           bp->rx_ring_size) > 0) {
@@ -759,6 +816,7 @@ static void gem_rx_refill(struct macb *bp)
                 rmb();
 
                 bp->rx_prepared_head++;
+                desc = macb_rx_desc(bp, entry);
 
                 if (!bp->rx_skbuff[entry]) {
                         /* allocate sk_buff for this free entry in ring */
@@ -782,14 +840,14 @@ static void gem_rx_refill(struct macb *bp)
 
                         if (entry == bp->rx_ring_size - 1)
                                 paddr |= MACB_BIT(RX_WRAP);
-                        macb_set_addr(&(bp->rx_ring[entry]), paddr);
-                        bp->rx_ring[entry].ctrl = 0;
+                        macb_set_addr(bp, desc, paddr);
+                        desc->ctrl = 0;
 
                         /* properly align Ethernet header */
                         skb_reserve(skb, NET_IP_ALIGN);
                 } else {
-                        bp->rx_ring[entry].addr &= ~MACB_BIT(RX_USED);
-                        bp->rx_ring[entry].ctrl = 0;
+                        desc->addr &= ~MACB_BIT(RX_USED);
+                        desc->ctrl = 0;
                 }
         }
 
@@ -835,16 +893,13 @@ static int gem_rx(struct macb *bp, int budget)
                 bool rxused;
 
                 entry = macb_rx_ring_wrap(bp, bp->rx_tail);
-                desc = &bp->rx_ring[entry];
+                desc = macb_rx_desc(bp, entry);
 
                 /* Make hw descriptor updates visible to CPU */
                 rmb();
 
                 rxused = (desc->addr & MACB_BIT(RX_USED)) ? true : false;
-                addr = MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, desc->addr));
-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-                addr |= ((u64)(desc->addrh) << 32);
-#endif
+                addr = macb_get_addr(bp, desc);
                 ctrl = desc->ctrl;
 
                 if (!rxused)
@@ -987,15 +1042,17 @@ static int macb_rx_frame(struct macb *bp, unsigned int first_frag,
 static inline void macb_init_rx_ring(struct macb *bp)
 {
         dma_addr_t addr;
+        struct macb_dma_desc *desc = NULL;
         int i;
 
         addr = bp->rx_buffers_dma;
         for (i = 0; i < bp->rx_ring_size; i++) {
-                bp->rx_ring[i].addr = addr;
-                bp->rx_ring[i].ctrl = 0;
+                desc = macb_rx_desc(bp, i);
+                macb_set_addr(bp, desc, addr);
+                desc->ctrl = 0;
                 addr += bp->rx_buffer_size;
         }
-        bp->rx_ring[bp->rx_ring_size - 1].addr |= MACB_BIT(RX_WRAP);
+        desc->addr |= MACB_BIT(RX_WRAP);
         bp->rx_tail = 0;
 }
 
@@ -1008,15 +1065,14 @@ static int macb_rx(struct macb *bp, int budget)
 
         for (tail = bp->rx_tail; budget > 0; tail++) {
                 struct macb_dma_desc *desc = macb_rx_desc(bp, tail);
-                u32 addr, ctrl;
+                u32 ctrl;
 
                 /* Make hw descriptor updates visible to CPU */
                 rmb();
 
-                addr = desc->addr;
                 ctrl = desc->ctrl;
 
-                if (!(addr & MACB_BIT(RX_USED)))
+                if (!(desc->addr & MACB_BIT(RX_USED)))
                         break;
 
                 if (ctrl & MACB_BIT(RX_SOF)) {
@@ -1336,7 +1392,7 @@ static unsigned int macb_tx_map(struct macb *bp,
         i = tx_head;
         entry = macb_tx_ring_wrap(bp, i);
         ctrl = MACB_BIT(TX_USED);
-        desc = &queue->tx_ring[entry];
+        desc = macb_tx_desc(queue, entry);
         desc->ctrl = ctrl;
 
         if (lso_ctrl) {
@@ -1358,7 +1414,7 @@ static unsigned int macb_tx_map(struct macb *bp,
                 i--;
                 entry = macb_tx_ring_wrap(bp, i);
                 tx_skb = &queue->tx_skb[entry];
-                desc = &queue->tx_ring[entry];
+                desc = macb_tx_desc(queue, entry);
 
                 ctrl = (u32)tx_skb->size;
                 if (eof) {
@@ -1379,7 +1435,7 @@ static unsigned int macb_tx_map(struct macb *bp,
                         ctrl |= MACB_BF(MSS_MFS, mss_mfs);
 
                 /* Set TX buffer descriptor */
-                macb_set_addr(desc, tx_skb->mapping);
+                macb_set_addr(bp, desc, tx_skb->mapping);
                 /* desc->addr must be visible to hardware before clearing
                  * 'TX_USED' bit in desc->ctrl.
                  */
@@ -1586,11 +1642,9 @@ static void gem_free_rx_buffers(struct macb *bp)
                 if (!skb)
                         continue;
 
-                desc = &bp->rx_ring[i];
-                addr = MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, desc->addr));
-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-                addr |= ((u64)(desc->addrh) << 32);
-#endif
+                desc = macb_rx_desc(bp, i);
+                addr = macb_get_addr(bp, desc);
+
                 dma_unmap_single(&bp->pdev->dev, addr, bp->rx_buffer_size,
                                  DMA_FROM_DEVICE);
                 dev_kfree_skb_any(skb);
@@ -1711,15 +1765,17 @@ out_err:
 static void gem_init_rings(struct macb *bp)
 {
         struct macb_queue *queue;
+        struct macb_dma_desc *desc = NULL;
         unsigned int q;
         int i;
 
         for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
                 for (i = 0; i < bp->tx_ring_size; i++) {
-                        queue->tx_ring[i].addr = 0;
-                        queue->tx_ring[i].ctrl = MACB_BIT(TX_USED);
+                        desc = macb_tx_desc(queue, i);
+                        macb_set_addr(bp, desc, 0);
+                        desc->ctrl = MACB_BIT(TX_USED);
                 }
-                queue->tx_ring[bp->tx_ring_size - 1].ctrl |= MACB_BIT(TX_WRAP);
+                desc->ctrl |= MACB_BIT(TX_WRAP);
                 queue->tx_head = 0;
                 queue->tx_tail = 0;
         }
@@ -1733,16 +1789,18 @@ static void gem_init_rings(struct macb *bp)
 static void macb_init_rings(struct macb *bp)
 {
         int i;
+        struct macb_dma_desc *desc = NULL;
 
         macb_init_rx_ring(bp);
 
         for (i = 0; i < bp->tx_ring_size; i++) {
-                bp->queues[0].tx_ring[i].addr = 0;
-                bp->queues[0].tx_ring[i].ctrl = MACB_BIT(TX_USED);
+                desc = macb_tx_desc(&bp->queues[0], i);
+                macb_set_addr(bp, desc, 0);
+                desc->ctrl = MACB_BIT(TX_USED);
         }
         bp->queues[0].tx_head = 0;
         bp->queues[0].tx_tail = 0;
-        bp->queues[0].tx_ring[bp->tx_ring_size - 1].ctrl |= MACB_BIT(TX_WRAP);
+        desc->ctrl |= MACB_BIT(TX_WRAP);
 }
 
 static void macb_reset_hw(struct macb *bp)
@@ -1863,7 +1921,8 @@ static void macb_configure_dma(struct macb *bp)
                         dmacfg &= ~GEM_BIT(TXCOEN);
 
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-                dmacfg |= GEM_BIT(ADDR64);
+                if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                        dmacfg |= GEM_BIT(ADDR64);
 #endif
                 netdev_dbg(bp->dev, "Cadence configure DMA with 0x%08x\n",
                            dmacfg);
@@ -1910,14 +1969,16 @@ static void macb_init_hw(struct macb *bp)
         macb_configure_dma(bp);
 
         /* Initialize TX and RX buffers */
-        macb_writel(bp, RBQP, (u32)(bp->rx_ring_dma));
+        macb_writel(bp, RBQP, lower_32_bits(bp->rx_ring_dma));
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-        macb_writel(bp, RBQPH, (u32)(bp->rx_ring_dma >> 32));
+        if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                macb_writel(bp, RBQPH, upper_32_bits(bp->rx_ring_dma));
 #endif
         for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
-                queue_writel(queue, TBQP, (u32)(queue->tx_ring_dma));
+                queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma));
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-                queue_writel(queue, TBQPH, (u32)(queue->tx_ring_dma >> 32));
+                if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                        queue_writel(queue, TBQPH, upper_32_bits(queue->tx_ring_dma));
 #endif
 
                 /* Enable interrupts */
@@ -2627,7 +2688,8 @@ static int macb_init(struct platform_device *pdev)
                         queue->IMR  = GEM_IMR(hw_q - 1);
                         queue->TBQP = GEM_TBQP(hw_q - 1);
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-                        queue->TBQPH = GEM_TBQPH(hw_q -1);
+                        if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                                queue->TBQPH = GEM_TBQPH(hw_q - 1);
 #endif
                 } else {
                         /* queue0 uses legacy registers */
@@ -2637,7 +2699,8 @@ static int macb_init(struct platform_device *pdev)
                         queue->IMR  = MACB_IMR;
                         queue->TBQP = MACB_TBQP;
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-                        queue->TBQPH = MACB_TBQPH;
+                        if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                                queue->TBQPH = MACB_TBQPH;
 #endif
                 }
 
@@ -2730,13 +2793,14 @@ static int macb_init(struct platform_device *pdev)
 static int at91ether_start(struct net_device *dev)
 {
         struct macb *lp = netdev_priv(dev);
+        struct macb_dma_desc *desc;
         dma_addr_t addr;
         u32 ctl;
         int i;
 
         lp->rx_ring = dma_alloc_coherent(&lp->pdev->dev,
                                          (AT91ETHER_MAX_RX_DESCR *
-                                          sizeof(struct macb_dma_desc)),
+                                          macb_dma_desc_get_size(lp)),
                                          &lp->rx_ring_dma, GFP_KERNEL);
         if (!lp->rx_ring)
                 return -ENOMEM;
@@ -2748,7 +2812,7 @@ static int at91ether_start(struct net_device *dev)
         if (!lp->rx_buffers) {
                 dma_free_coherent(&lp->pdev->dev,
                                   AT91ETHER_MAX_RX_DESCR *
-                                  sizeof(struct macb_dma_desc),
+                                  macb_dma_desc_get_size(lp),
                                   lp->rx_ring, lp->rx_ring_dma);
                 lp->rx_ring = NULL;
                 return -ENOMEM;
@@ -2756,13 +2820,14 @@ static int at91ether_start(struct net_device *dev)
 
         addr = lp->rx_buffers_dma;
         for (i = 0; i < AT91ETHER_MAX_RX_DESCR; i++) {
-                lp->rx_ring[i].addr = addr;
-                lp->rx_ring[i].ctrl = 0;
+                desc = macb_rx_desc(lp, i);
+                macb_set_addr(lp, desc, addr);
+                desc->ctrl = 0;
                 addr += AT91ETHER_MAX_RBUFF_SZ;
         }
 
         /* Set the Wrap bit on the last descriptor */
-        lp->rx_ring[AT91ETHER_MAX_RX_DESCR - 1].addr |= MACB_BIT(RX_WRAP);
+        desc->addr |= MACB_BIT(RX_WRAP);
 
         /* Reset buffer index */
         lp->rx_tail = 0;
@@ -2834,7 +2899,7 @@ static int at91ether_close(struct net_device *dev)
 
         dma_free_coherent(&lp->pdev->dev,
                           AT91ETHER_MAX_RX_DESCR *
-                          sizeof(struct macb_dma_desc),
+                          macb_dma_desc_get_size(lp),
                           lp->rx_ring, lp->rx_ring_dma);
         lp->rx_ring = NULL;
 
@@ -2885,13 +2950,15 @@ static int at91ether_start_xmit(struct sk_buff *skb, struct net_device *dev)
 static void at91ether_rx(struct net_device *dev)
 {
         struct macb *lp = netdev_priv(dev);
+        struct macb_dma_desc *desc;
         unsigned char *p_recv;
         struct sk_buff *skb;
         unsigned int pktlen;
 
-        while (lp->rx_ring[lp->rx_tail].addr & MACB_BIT(RX_USED)) {
+        desc = macb_rx_desc(lp, lp->rx_tail);
+        while (desc->addr & MACB_BIT(RX_USED)) {
                 p_recv = lp->rx_buffers + lp->rx_tail * AT91ETHER_MAX_RBUFF_SZ;
-                pktlen = MACB_BF(RX_FRMLEN, lp->rx_ring[lp->rx_tail].ctrl);
+                pktlen = MACB_BF(RX_FRMLEN, desc->ctrl);
                 skb = netdev_alloc_skb(dev, pktlen + 2);
                 if (skb) {
                         skb_reserve(skb, 2);
@@ -2905,17 +2972,19 @@ static void at91ether_rx(struct net_device *dev)
                         lp->stats.rx_dropped++;
                 }
 
-                if (lp->rx_ring[lp->rx_tail].ctrl & MACB_BIT(RX_MHASH_MATCH))
+                if (desc->ctrl & MACB_BIT(RX_MHASH_MATCH))
                         lp->stats.multicast++;
 
                 /* reset ownership bit */
-                lp->rx_ring[lp->rx_tail].addr &= ~MACB_BIT(RX_USED);
+                desc->addr &= ~MACB_BIT(RX_USED);
 
                 /* wrap after last buffer */
                 if (lp->rx_tail == AT91ETHER_MAX_RX_DESCR - 1)
                         lp->rx_tail = 0;
                 else
                         lp->rx_tail++;
+
+                desc = macb_rx_desc(lp, lp->rx_tail);
         }
 }
 
@@ -3211,8 +3280,11 @@ static int macb_probe(struct platform_device *pdev)
         device_init_wakeup(&pdev->dev, bp->wol & MACB_WOL_HAS_MAGIC_PACKET);
 
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-        if (GEM_BFEXT(DBWDEF, gem_readl(bp, DCFG1)) > GEM_DBW32)
+        if (GEM_BFEXT(DAW64, gem_readl(bp, DCFG6))) {
                 dma_set_mask(&pdev->dev, DMA_BIT_MASK(44));
+                bp->hw_dma_cap = HW_DMA_CAP_64B;
+        } else
+                bp->hw_dma_cap = HW_DMA_CAP_32B;
 #endif
 
         spin_lock_init(&bp->lock);
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index d67adad67be1..fc8550a5d47f 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -385,6 +385,8 @@
 /* Bitfields in DCFG6. */
 #define GEM_PBUF_LSO_OFFSET                     27
 #define GEM_PBUF_LSO_SIZE                       1
+#define GEM_DAW64_OFFSET                        23
+#define GEM_DAW64_SIZE                          1
 
 /* Constants for CLK */
 #define MACB_CLK_DIV8                           0
@@ -487,12 +489,20 @@
 struct macb_dma_desc {
         u32     addr;
         u32     ctrl;
+};
+
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-        u32     addrh;
-        u32     resvd;
-#endif
+enum macb_hw_dma_cap {
+        HW_DMA_CAP_32B,
+        HW_DMA_CAP_64B,
 };
 
+struct macb_dma_desc_64 {
+        u32 addrh;
+        u32 resvd;
+};
+#endif
+
 /* DMA descriptor bitfields */
 #define MACB_RX_USED_OFFSET                     0
 #define MACB_RX_USED_SIZE                       1
@@ -874,6 +884,10 @@ struct macb {
         unsigned int            jumbo_max_len;
 
         u32                     wol;
+
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+        enum macb_hw_dma_cap hw_dma_cap;
+#endif
 };
 
 static inline bool macb_is_gem(struct macb *bp)
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_xcv.c b/drivers/net/ethernet/cavium/thunder/thunder_xcv.c
index 67befedef709..578c7f8f11bf 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_xcv.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_xcv.c
@@ -116,8 +116,7 @@ void xcv_setup_link(bool link_up, int link_speed)
         int speed = 2;
 
         if (!xcv) {
-                dev_err(&xcv->pdev->dev,
-                        "XCV init not done, probe may have failed\n");
+                pr_err("XCV init not done, probe may have failed\n");
                 return;
         }
 
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 1a7f8ad7b9c6..cd49a54c538d 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -362,8 +362,10 @@ static int be_mac_addr_set(struct net_device *netdev, void *p)
                 status = -EPERM;
                 goto err;
         }
-done:
+
+        /* Remember currently programmed MAC */
         ether_addr_copy(adapter->dev_mac, addr->sa_data);
+done:
         ether_addr_copy(netdev->dev_addr, addr->sa_data);
         dev_info(dev, "MAC address changed to %pM\n", addr->sa_data);
         return 0;
@@ -3618,8 +3620,10 @@ static void be_disable_if_filters(struct be_adapter *adapter)
 {
         /* Don't delete MAC on BE3 VFs without FILTMGMT privilege  */
         if (!BEx_chip(adapter) || !be_virtfn(adapter) ||
-            check_privilege(adapter, BE_PRIV_FILTMGMT))
+            check_privilege(adapter, BE_PRIV_FILTMGMT)) {
                 be_dev_mac_del(adapter, adapter->pmac_id[0]);
+                eth_zero_addr(adapter->dev_mac);
+        }
 
         be_clear_uc_list(adapter);
         be_clear_mc_list(adapter);
@@ -3773,12 +3777,27 @@ static int be_enable_if_filters(struct be_adapter *adapter)
         if (status)
                 return status;
 
-        /* Don't add MAC on BE3 VFs without FILTMGMT privilege */
-        if (!BEx_chip(adapter) || !be_virtfn(adapter) ||
-            check_privilege(adapter, BE_PRIV_FILTMGMT)) {
+        /* Normally this condition usually true as the ->dev_mac is zeroed.
+         * But on BE3 VFs the initial MAC is pre-programmed by PF and
+         * subsequent be_dev_mac_add() can fail (after fresh boot)
+         */
+        if (!ether_addr_equal(adapter->dev_mac, adapter->netdev->dev_addr)) {
+                int old_pmac_id = -1;
+
+                /* Remember old programmed MAC if any - can happen on BE3 VF */
+                if (!is_zero_ether_addr(adapter->dev_mac))
+                        old_pmac_id = adapter->pmac_id[0];
+
                 status = be_dev_mac_add(adapter, adapter->netdev->dev_addr);
                 if (status)
                         return status;
+
+                /* Delete the old programmed MAC as we successfully programmed
+                 * a new MAC
+                 */
+                if (old_pmac_id >= 0 && old_pmac_id != adapter->pmac_id[0])
+                        be_dev_mac_del(adapter, old_pmac_id);
+
                 ether_addr_copy(adapter->dev_mac, adapter->netdev->dev_addr);
         }
 
@@ -4552,6 +4571,10 @@ static int be_mac_setup(struct be_adapter *adapter)
 
                 memcpy(adapter->netdev->dev_addr, mac, ETH_ALEN);
                 memcpy(adapter->netdev->perm_addr, mac, ETH_ALEN);
+
+                /* Initial MAC for BE3 VFs is already programmed by PF */
+                if (BEx_chip(adapter) && be_virtfn(adapter))
+                        memcpy(adapter->dev_mac, mac, ETH_ALEN);
         }
 
         return 0;
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index a6e7afa878be..957bfc220978 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2010,8 +2010,8 @@ static void free_skb_rx_queue(struct gfar_priv_rx_q *rx_queue)
                 if (!rxb->page)
                         continue;
 
-                dma_unmap_single(rx_queue->dev, rxb->dma,
-                                 PAGE_SIZE, DMA_FROM_DEVICE);
+                dma_unmap_page(rx_queue->dev, rxb->dma,
+                               PAGE_SIZE, DMA_FROM_DEVICE);
                 __free_page(rxb->page);
 
                 rxb->page = NULL;
@@ -2948,7 +2948,7 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
         }
 
         /* try reuse page */
-        if (unlikely(page_count(page) != 1))
+        if (unlikely(page_count(page) != 1 || page_is_pfmemalloc(page)))
                 return false;
 
         /* change offset to the other half */
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index a831f947ca8c..309f5c66083c 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1601,8 +1601,11 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
         netdev->netdev_ops = &ibmveth_netdev_ops;
         netdev->ethtool_ops = &netdev_ethtool_ops;
         SET_NETDEV_DEV(netdev, &dev->dev);
-        netdev->hw_features = NETIF_F_SG | NETIF_F_RXCSUM |
-                NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+        netdev->hw_features = NETIF_F_SG;
+        if (vio_get_attribute(dev, "ibm,illan-options", NULL) != NULL) {
+                netdev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                                       NETIF_F_RXCSUM;
+        }
 
         netdev->features |= netdev->hw_features;
 
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 3dd87889e67e..1c29c86f8709 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -2517,7 +2517,7 @@ static int mtk_remove(struct platform_device *pdev)
 }
 
 const struct of_device_id of_mtk_match[] = {
-        { .compatible = "mediatek,mt7623-eth" },
+        { .compatible = "mediatek,mt2701-eth" },
         {},
 };
 MODULE_DEVICE_TABLE(of, of_mtk_match);
diff --git a/drivers/net/ethernet/mellanox/mlx4/catas.c b/drivers/net/ethernet/mellanox/mlx4/catas.c
index c7e939945259..53daa6ca5d83 100644
--- a/drivers/net/ethernet/mellanox/mlx4/catas.c
+++ b/drivers/net/ethernet/mellanox/mlx4/catas.c
@@ -158,7 +158,7 @@ static int mlx4_reset_slave(struct mlx4_dev *dev)
         return -ETIMEDOUT;
 }
 
-static int mlx4_comm_internal_err(u32 slave_read)
+int mlx4_comm_internal_err(u32 slave_read)
 {
         return (u32)COMM_CHAN_EVENT_INTERNAL_ERR ==
                 (slave_read & (u32)COMM_CHAN_EVENT_INTERNAL_ERR) ? 1 : 0;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index d9c9f86a30df..d5a9372ed84d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -1732,8 +1732,6 @@ static void mlx4_en_get_channels(struct net_device *dev,
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
 
-        memset(channel, 0, sizeof(*channel));
-
         channel->max_rx = MAX_RX_RINGS;
         channel->max_tx = MLX4_EN_MAX_TX_RING_P_UP;
 
@@ -1752,10 +1750,7 @@ static int mlx4_en_set_channels(struct net_device *dev,
         int xdp_count;
         int err = 0;
 
-        if (channel->other_count || channel->combined_count ||
-            channel->tx_count > MLX4_EN_MAX_TX_RING_P_UP ||
-            channel->rx_count > MAX_RX_RINGS ||
-            !channel->tx_count || !channel->rx_count)
+        if (!channel->tx_count || !channel->rx_count)
                 return -EINVAL;
 
         tmp = kzalloc(sizeof(*tmp), GFP_KERNEL);
diff --git a/drivers/net/ethernet/mellanox/mlx4/intf.c b/drivers/net/ethernet/mellanox/mlx4/intf.c
index 0e8b7c44931f..8258d08acd8c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/intf.c
+++ b/drivers/net/ethernet/mellanox/mlx4/intf.c
@@ -222,6 +222,18 @@ void mlx4_unregister_device(struct mlx4_dev *dev)
                 return;
 
         mlx4_stop_catas_poll(dev);
+        if (dev->persist->interface_state & MLX4_INTERFACE_STATE_DELETION &&
+            mlx4_is_slave(dev)) {
+                /* In mlx4_remove_one on a VF */
+                u32 slave_read =
+                        swab32(readl(&mlx4_priv(dev)->mfunc.comm->slave_read));
+
+                if (mlx4_comm_internal_err(slave_read)) {
+                        mlx4_dbg(dev, "%s: comm channel is down, entering error state.\n",
+                                 __func__);
+                        mlx4_enter_error_state(dev->persist);
+                }
+        }
         mutex_lock(&intf_mutex);
 
         list_for_each_entry(intf, &intf_list, list)
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index 88ee7d8a5923..086920b615af 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -1220,6 +1220,7 @@ void mlx4_qp_event(struct mlx4_dev *dev, u32 qpn, int event_type);
 void mlx4_srq_event(struct mlx4_dev *dev, u32 srqn, int event_type);
 
 void mlx4_enter_error_state(struct mlx4_dev_persistent *persist);
+int mlx4_comm_internal_err(u32 slave_read);
 
 int mlx4_SENSE_PORT(struct mlx4_dev *dev, int port,
                     enum mlx4_port_type *type);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 3797cc7c1288..caa837e5e2b9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -1728,7 +1728,7 @@ int mlx5_cmd_init(struct mlx5_core_dev *dev)
         if (cmd->cmdif_rev > CMD_IF_REV) {
                 dev_err(&dev->pdev->dev, "driver does not support command interface version. driver %d, firmware %d\n",
                         CMD_IF_REV, cmd->cmdif_rev);
-                err = -ENOTSUPP;
+                err = -EOPNOTSUPP;
                 goto err_free_page;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 951dbd58594d..d5ecb8f53fd4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -791,7 +791,8 @@ void mlx5e_disable_vlan_filter(struct mlx5e_priv *priv);
 int mlx5e_modify_rqs_vsd(struct mlx5e_priv *priv, bool vsd);
 
 int mlx5e_redirect_rqt(struct mlx5e_priv *priv, u32 rqtn, int sz, int ix);
-void mlx5e_build_tir_ctx_hash(void *tirc, struct mlx5e_priv *priv);
+void mlx5e_build_indir_tir_ctx_hash(struct mlx5e_priv *priv, void *tirc,
+                                    enum mlx5e_traffic_types tt);
 
 int mlx5e_open_locked(struct net_device *netdev);
 int mlx5e_close_locked(struct net_device *netdev);
@@ -863,12 +864,12 @@ static inline void mlx5e_arfs_destroy_tables(struct mlx5e_priv *priv) {}
 
 static inline int mlx5e_arfs_enable(struct mlx5e_priv *priv)
 {
-        return -ENOTSUPP;
+        return -EOPNOTSUPP;
 }
 
 static inline int mlx5e_arfs_disable(struct mlx5e_priv *priv)
 {
-        return -ENOTSUPP;
+        return -EOPNOTSUPP;
 }
 #else
 int mlx5e_arfs_create_tables(struct mlx5e_priv *priv);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index f0b460f47f29..0523ed47f597 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -89,7 +89,7 @@ static int mlx5e_dcbnl_ieee_getets(struct net_device *netdev,
         int i;
 
         if (!MLX5_CAP_GEN(priv->mdev, ets))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         ets->ets_cap = mlx5_max_tc(priv->mdev) + 1;
         for (i = 0; i < ets->ets_cap; i++) {
@@ -236,7 +236,7 @@ static int mlx5e_dcbnl_ieee_setets(struct net_device *netdev,
         int err;
 
         if (!MLX5_CAP_GEN(priv->mdev, ets))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         err = mlx5e_dbcnl_validate_ets(netdev, ets);
         if (err)
@@ -402,7 +402,7 @@ static u8 mlx5e_dcbnl_setall(struct net_device *netdev)
         struct mlx5_core_dev *mdev = priv->mdev;
         struct ieee_ets ets;
         struct ieee_pfc pfc;
-        int err = -ENOTSUPP;
+        int err = -EOPNOTSUPP;
         int i;
 
         if (!MLX5_CAP_GEN(mdev, ets))
@@ -511,6 +511,11 @@ static void mlx5e_dcbnl_getpgtccfgtx(struct net_device *netdev,
         struct mlx5e_priv *priv = netdev_priv(netdev);
         struct mlx5_core_dev *mdev = priv->mdev;
 
+        if (!MLX5_CAP_GEN(priv->mdev, ets)) {
+                netdev_err(netdev, "%s, ets is not supported\n", __func__);
+                return;
+        }
+
         if (priority >= CEE_DCBX_MAX_PRIO) {
                 netdev_err(netdev,
                            "%s, priority is out of range\n", __func__);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 33a399a8b5d5..bb67863aa361 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -543,7 +543,6 @@ static int mlx5e_set_channels(struct net_device *dev,
                               struct ethtool_channels *ch)
 {
         struct mlx5e_priv *priv = netdev_priv(dev);
-        int ncv = mlx5e_get_max_num_channels(priv->mdev);
         unsigned int count = ch->combined_count;
         bool arfs_enabled;
         bool was_opened;
@@ -554,16 +553,6 @@ static int mlx5e_set_channels(struct net_device *dev,
                             __func__);
                 return -EINVAL;
         }
-        if (ch->rx_count || ch->tx_count) {
-                netdev_info(dev, "%s: separate rx/tx count not supported\n",
-                            __func__);
-                return -EINVAL;
-        }
-        if (count > ncv) {
-                netdev_info(dev, "%s: count (%d) > max (%d)\n",
-                            __func__, count, ncv);
-                return -EINVAL;
-        }
 
         if (priv->params.num_channels == count)
                 return 0;
@@ -606,7 +595,7 @@ static int mlx5e_get_coalesce(struct net_device *netdev,
         struct mlx5e_priv *priv = netdev_priv(netdev);
 
         if (!MLX5_CAP_GEN(priv->mdev, cq_moderation))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         coal->rx_coalesce_usecs       = priv->params.rx_cq_moderation.usec;
         coal->rx_max_coalesced_frames = priv->params.rx_cq_moderation.pkts;
@@ -631,7 +620,7 @@ static int mlx5e_set_coalesce(struct net_device *netdev,
         int i;
 
         if (!MLX5_CAP_GEN(mdev, cq_moderation))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         mutex_lock(&priv->state_lock);
 
@@ -991,15 +980,18 @@ static int mlx5e_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key,
 
 static void mlx5e_modify_tirs_hash(struct mlx5e_priv *priv, void *in, int inlen)
 {
-        struct mlx5_core_dev *mdev = priv->mdev;
         void *tirc = MLX5_ADDR_OF(modify_tir_in, in, ctx);
-        int i;
+        struct mlx5_core_dev *mdev = priv->mdev;
+        int ctxlen = MLX5_ST_SZ_BYTES(tirc);
+        int tt;
 
         MLX5_SET(modify_tir_in, in, bitmask.hash, 1);
-        mlx5e_build_tir_ctx_hash(tirc, priv);
 
-        for (i = 0; i < MLX5E_NUM_INDIR_TIRS; i++)
-                mlx5_core_modify_tir(mdev, priv->indir_tir[i].tirn, in, inlen);
+        for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++) {
+                memset(tirc, 0, ctxlen);
+                mlx5e_build_indir_tir_ctx_hash(priv, tirc, tt);
+                mlx5_core_modify_tir(mdev, priv->indir_tir[tt].tirn, in, inlen);
+        }
 }
 
 static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
@@ -1007,6 +999,7 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
 {
         struct mlx5e_priv *priv = netdev_priv(dev);
         int inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
+        bool hash_changed = false;
         void *in;
 
         if ((hfunc != ETH_RSS_HASH_NO_CHANGE) &&
@@ -1028,14 +1021,21 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
                 mlx5e_redirect_rqt(priv, rqtn, MLX5E_INDIR_RQT_SIZE, 0);
         }
 
-        if (key)
+        if (hfunc != ETH_RSS_HASH_NO_CHANGE &&
+            hfunc != priv->params.rss_hfunc) {
+                priv->params.rss_hfunc = hfunc;
+                hash_changed = true;
+        }
+
+        if (key) {
                 memcpy(priv->params.toeplitz_hash_key, key,
                        sizeof(priv->params.toeplitz_hash_key));
+                hash_changed = hash_changed ||
+                               priv->params.rss_hfunc == ETH_RSS_HASH_TOP;
+        }
 
-        if (hfunc != ETH_RSS_HASH_NO_CHANGE)
-                priv->params.rss_hfunc = hfunc;
-
-        mlx5e_modify_tirs_hash(priv, in, inlen);
+        if (hash_changed)
+                mlx5e_modify_tirs_hash(priv, in, inlen);
 
         mutex_unlock(&priv->state_lock);
 
@@ -1307,7 +1307,7 @@ static int mlx5e_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
         u32 mlx5_wol_mode;
 
         if (!wol_supported)
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         if (wol->wolopts & ~wol_supported)
                 return -EINVAL;
@@ -1437,7 +1437,7 @@ static int set_pflag_rx_cqe_based_moder(struct net_device *netdev, bool enable)
 
         if (rx_cq_period_mode == MLX5_CQ_PERIOD_MODE_START_FROM_CQE &&
             !MLX5_CAP_GEN(mdev, cq_period_start_from_cqe))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         if (!rx_mode_changed)
                 return 0;
@@ -1463,7 +1463,7 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev,
         bool reset;
 
         if (!MLX5_CAP_GEN(mdev, cqe_compression))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         if (enable && priv->tstamp.hwtstamp_config.rx_filter != HWTSTAMP_FILTER_NONE) {
                 netdev_err(netdev, "Can't enable cqe compression while timestamping is enabled.\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index 1fe80de5d68f..a0e5a69402b3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -1089,7 +1089,7 @@ int mlx5e_create_flow_steering(struct mlx5e_priv *priv)
                                                MLX5_FLOW_NAMESPACE_KERNEL);
 
         if (!priv->fs.ns)
-                return -EINVAL;
+                return -EOPNOTSUPP;
 
         err = mlx5e_arfs_create_tables(priv);
         if (err) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
index d088effd7160..f33f72d0237c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
@@ -92,7 +92,7 @@ static struct mlx5e_ethtool_table *get_flow_table(struct mlx5e_priv *priv,
         ns = mlx5_get_flow_namespace(priv->mdev,
                                      MLX5_FLOW_NAMESPACE_ETHTOOL);
         if (!ns)
-                return ERR_PTR(-ENOTSUPP);
+                return ERR_PTR(-EOPNOTSUPP);
 
         table_size = min_t(u32, BIT(MLX5_CAP_FLOWTABLE(priv->mdev,
                                                        flow_table_properties_nic_receive.log_max_ft_size)),
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 2b7dd315020c..f14ca3385fdd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -2022,8 +2022,23 @@ static void mlx5e_build_tir_ctx_lro(void *tirc, struct mlx5e_priv *priv)
         MLX5_SET(tirc, tirc, lro_timeout_period_usecs, priv->params.lro_timeout);
 }
 
-void mlx5e_build_tir_ctx_hash(void *tirc, struct mlx5e_priv *priv)
+void mlx5e_build_indir_tir_ctx_hash(struct mlx5e_priv *priv, void *tirc,
+                                    enum mlx5e_traffic_types tt)
 {
+        void *hfso = MLX5_ADDR_OF(tirc, tirc, rx_hash_field_selector_outer);
+
+#define MLX5_HASH_IP            (MLX5_HASH_FIELD_SEL_SRC_IP   |\
+                                 MLX5_HASH_FIELD_SEL_DST_IP)
+
+#define MLX5_HASH_IP_L4PORTS    (MLX5_HASH_FIELD_SEL_SRC_IP   |\
+                                 MLX5_HASH_FIELD_SEL_DST_IP   |\
+                                 MLX5_HASH_FIELD_SEL_L4_SPORT |\
+                                 MLX5_HASH_FIELD_SEL_L4_DPORT)
+
+#define MLX5_HASH_IP_IPSEC_SPI  (MLX5_HASH_FIELD_SEL_SRC_IP   |\
+                                 MLX5_HASH_FIELD_SEL_DST_IP   |\
+                                 MLX5_HASH_FIELD_SEL_IPSEC_SPI)
+
         MLX5_SET(tirc, tirc, rx_hash_fn,
                  mlx5e_rx_hash_fn(priv->params.rss_hfunc));
         if (priv->params.rss_hfunc == ETH_RSS_HASH_TOP) {
@@ -2035,6 +2050,88 @@ void mlx5e_build_tir_ctx_hash(void *tirc, struct mlx5e_priv *priv)
                 MLX5_SET(tirc, tirc, rx_hash_symmetric, 1);
                 memcpy(rss_key, priv->params.toeplitz_hash_key, len);
         }
+
+        switch (tt) {
+        case MLX5E_TT_IPV4_TCP:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV4);
+                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
+                         MLX5_L4_PROT_TYPE_TCP);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_L4PORTS);
+                break;
+
+        case MLX5E_TT_IPV6_TCP:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV6);
+                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
+                         MLX5_L4_PROT_TYPE_TCP);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_L4PORTS);
+                break;
+
+        case MLX5E_TT_IPV4_UDP:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV4);
+                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
+                         MLX5_L4_PROT_TYPE_UDP);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_L4PORTS);
+                break;
+
+        case MLX5E_TT_IPV6_UDP:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV6);
+                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
+                         MLX5_L4_PROT_TYPE_UDP);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_L4PORTS);
+                break;
+
+        case MLX5E_TT_IPV4_IPSEC_AH:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV4);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_IPSEC_SPI);
+                break;
+
+        case MLX5E_TT_IPV6_IPSEC_AH:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV6);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_IPSEC_SPI);
+                break;
+
+        case MLX5E_TT_IPV4_IPSEC_ESP:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV4);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_IPSEC_SPI);
+                break;
+
+        case MLX5E_TT_IPV6_IPSEC_ESP:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV6);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_IPSEC_SPI);
+                break;
+
+        case MLX5E_TT_IPV4:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV4);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP);
+                break;
+
+        case MLX5E_TT_IPV6:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV6);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP);
+                break;
+        default:
+                WARN_ONCE(true, "%s: bad traffic type!\n", __func__);
+        }
 }
 
 static int mlx5e_modify_tirs_lro(struct mlx5e_priv *priv)
@@ -2404,110 +2501,13 @@ void mlx5e_cleanup_nic_tx(struct mlx5e_priv *priv)
 static void mlx5e_build_indir_tir_ctx(struct mlx5e_priv *priv, u32 *tirc,
                                       enum mlx5e_traffic_types tt)
 {
-        void *hfso = MLX5_ADDR_OF(tirc, tirc, rx_hash_field_selector_outer);
-
         MLX5_SET(tirc, tirc, transport_domain, priv->mdev->mlx5e_res.td.tdn);
 
-#define MLX5_HASH_IP            (MLX5_HASH_FIELD_SEL_SRC_IP   |\
-                                 MLX5_HASH_FIELD_SEL_DST_IP)
-
-#define MLX5_HASH_IP_L4PORTS    (MLX5_HASH_FIELD_SEL_SRC_IP   |\
-                                 MLX5_HASH_FIELD_SEL_DST_IP   |\
-                                 MLX5_HASH_FIELD_SEL_L4_SPORT |\
-                                 MLX5_HASH_FIELD_SEL_L4_DPORT)
-
-#define MLX5_HASH_IP_IPSEC_SPI  (MLX5_HASH_FIELD_SEL_SRC_IP   |\
-                                 MLX5_HASH_FIELD_SEL_DST_IP   |\
-                                 MLX5_HASH_FIELD_SEL_IPSEC_SPI)
-
         mlx5e_build_tir_ctx_lro(tirc, priv);
 
         MLX5_SET(tirc, tirc, disp_type, MLX5_TIRC_DISP_TYPE_INDIRECT);
         MLX5_SET(tirc, tirc, indirect_table, priv->indir_rqt.rqtn);
-        mlx5e_build_tir_ctx_hash(tirc, priv);
-
-        switch (tt) {
-        case MLX5E_TT_IPV4_TCP:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV4);
-                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
-                         MLX5_L4_PROT_TYPE_TCP);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_L4PORTS);
-                break;
-
-        case MLX5E_TT_IPV6_TCP:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV6);
-                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
-                         MLX5_L4_PROT_TYPE_TCP);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_L4PORTS);
-                break;
-
-        case MLX5E_TT_IPV4_UDP:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV4);
-                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
-                         MLX5_L4_PROT_TYPE_UDP);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_L4PORTS);
-                break;
-
-        case MLX5E_TT_IPV6_UDP:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV6);
-                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
-                         MLX5_L4_PROT_TYPE_UDP);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_L4PORTS);
-                break;
-
-        case MLX5E_TT_IPV4_IPSEC_AH:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV4);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_IPSEC_SPI);
-                break;
-
-        case MLX5E_TT_IPV6_IPSEC_AH:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV6);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_IPSEC_SPI);
-                break;
-
-        case MLX5E_TT_IPV4_IPSEC_ESP:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV4);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_IPSEC_SPI);
-                break;
-
-        case MLX5E_TT_IPV6_IPSEC_ESP:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV6);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_IPSEC_SPI);
-                break;
-
-        case MLX5E_TT_IPV4:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV4);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP);
-                break;
-
-        case MLX5E_TT_IPV6:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV6);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP);
-                break;
-        default:
-                WARN_ONCE(true,
-                          "mlx5e_build_indir_tir_ctx: bad traffic type!\n");
-        }
+        mlx5e_build_indir_tir_ctx_hash(priv, tirc, tt);
 }
 
 static void mlx5e_build_direct_tir_ctx(struct mlx5e_priv *priv, u32 *tirc,
@@ -3331,7 +3331,7 @@ static const struct net_device_ops mlx5e_netdev_ops_sriov = {
 static int mlx5e_check_required_hca_cap(struct mlx5_core_dev *mdev)
 {
         if (MLX5_CAP_GEN(mdev, port_type) != MLX5_CAP_PORT_TYPE_ETH)
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
         if (!MLX5_CAP_GEN(mdev, eth_net_offloads) ||
             !MLX5_CAP_GEN(mdev, nic_flow_table) ||
             !MLX5_CAP_ETH(mdev, csum_cap) ||
@@ -3343,7 +3343,7 @@ static int mlx5e_check_required_hca_cap(struct mlx5_core_dev *mdev)
                                < 3) {
                 mlx5_core_warn(mdev,
                                "Not creating net device, some required device capabilities are missing\n");
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
         }
         if (!MLX5_CAP_ETH(mdev, self_lb_en_modifiable))
                 mlx5_core_warn(mdev, "Self loop back prevention is not supported\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 0e2fb3ed1790..06d5e6fecb0a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -193,6 +193,9 @@ static inline bool mlx5e_rx_cache_put(struct mlx5e_rq *rq,
                 return false;
         }
 
+        if (unlikely(page_is_pfmemalloc(dma_info->page)))
+                return false;
+
         cache->page_cache[cache->tail] = *dma_info;
         cache->tail = tail_next;
         return true;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 46bef6a26a8c..c5282b6aba8b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -663,6 +663,7 @@ static int mlx5e_route_lookup_ipv4(struct mlx5e_priv *priv,
                                    __be32 *saddr,
                                    int *out_ttl)
 {
+        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
         struct rtable *rt;
         struct neighbour *n = NULL;
         int ttl;
@@ -677,12 +678,11 @@ static int mlx5e_route_lookup_ipv4(struct mlx5e_priv *priv,
 #else
         return -EOPNOTSUPP;
 #endif
-
-        if (!switchdev_port_same_parent_id(priv->netdev, rt->dst.dev)) {
-                pr_warn("%s: can't offload, devices not on same HW e-switch\n", __func__);
-                ip_rt_put(rt);
-                return -EOPNOTSUPP;
-        }
+        /* if the egress device isn't on the same HW e-switch, we use the uplink */
+        if (!switchdev_port_same_parent_id(priv->netdev, rt->dst.dev))
+                *out_dev = mlx5_eswitch_get_uplink_netdev(esw);
+        else
+                *out_dev = rt->dst.dev;
 
         ttl = ip4_dst_hoplimit(&rt->dst);
         n = dst_neigh_lookup(&rt->dst, &fl4->daddr);
@@ -693,7 +693,6 @@ static int mlx5e_route_lookup_ipv4(struct mlx5e_priv *priv,
         *out_n = n;
         *saddr = fl4->saddr;
         *out_ttl = ttl;
-        *out_dev = rt->dst.dev;
 
         return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index f14d9c9ba773..d0c8bf014453 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -133,7 +133,7 @@ static int modify_esw_vport_cvlan(struct mlx5_core_dev *dev, u32 vport,
 
         if (!MLX5_CAP_ESW(dev, vport_cvlan_strip) ||
             !MLX5_CAP_ESW(dev, vport_cvlan_insert_if_not_exist))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         esw_debug(dev, "Set Vport[%d] VLAN %d qos %d set=%x\n",
                   vport, vlan, qos, set_flags);
@@ -353,7 +353,7 @@ static int esw_create_legacy_fdb_table(struct mlx5_eswitch *esw, int nvports)
         root_ns = mlx5_get_flow_namespace(dev, MLX5_FLOW_NAMESPACE_FDB);
         if (!root_ns) {
                 esw_warn(dev, "Failed to get FDB flow namespace\n");
-                return -ENOMEM;
+                return -EOPNOTSUPP;
         }
 
         flow_group_in = mlx5_vzalloc(inlen);
@@ -962,7 +962,7 @@ static int esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
         root_ns = mlx5_get_flow_namespace(dev, MLX5_FLOW_NAMESPACE_ESW_EGRESS);
         if (!root_ns) {
                 esw_warn(dev, "Failed to get E-Switch egress flow namespace\n");
-                return -EIO;
+                return -EOPNOTSUPP;
         }
 
         flow_group_in = mlx5_vzalloc(inlen);
@@ -1079,7 +1079,7 @@ static int esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
         root_ns = mlx5_get_flow_namespace(dev, MLX5_FLOW_NAMESPACE_ESW_INGRESS);
         if (!root_ns) {
                 esw_warn(dev, "Failed to get E-Switch ingress flow namespace\n");
-                return -EIO;
+                return -EOPNOTSUPP;
         }
 
         flow_group_in = mlx5_vzalloc(inlen);
@@ -1630,7 +1630,7 @@ int mlx5_eswitch_enable_sriov(struct mlx5_eswitch *esw, int nvfs, int mode)
         if (!MLX5_CAP_GEN(esw->dev, eswitch_flow_table) ||
             !MLX5_CAP_ESW_FLOWTABLE_FDB(esw->dev, ft_support)) {
                 esw_warn(esw->dev, "E-Switch FDB is not supported, aborting ...\n");
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
         }
 
         if (!MLX5_CAP_ESW_INGRESS_ACL(esw->dev, ft_support))
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 03293ed1cc22..595f7c7383b3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -166,7 +166,7 @@ static int esw_add_vlan_action_check(struct mlx5_esw_flow_attr *attr,
         return 0;
 
 out_notsupp:
-        return -ENOTSUPP;
+        return -EOPNOTSUPP;
 }
 
 int mlx5_eswitch_add_vlan_action(struct mlx5_eswitch *esw,
@@ -424,6 +424,7 @@ static int esw_create_offloads_fdb_table(struct mlx5_eswitch *esw, int nvports)
         root_ns = mlx5_get_flow_namespace(dev, MLX5_FLOW_NAMESPACE_FDB);
         if (!root_ns) {
                 esw_warn(dev, "Failed to get FDB flow namespace\n");
+                err = -EOPNOTSUPP;
                 goto ns_err;
         }
 
@@ -535,7 +536,7 @@ static int esw_create_offloads_table(struct mlx5_eswitch *esw)
         ns = mlx5_get_flow_namespace(dev, MLX5_FLOW_NAMESPACE_OFFLOADS);
         if (!ns) {
                 esw_warn(esw->dev, "Failed to get offloads flow namespace\n");
-                return -ENOMEM;
+                return -EOPNOTSUPP;
         }
 
         ft_offloads = mlx5_create_flow_table(ns, 0, dev->priv.sriov.num_vfs + 2, 0, 0);
@@ -655,7 +656,7 @@ static int esw_offloads_start(struct mlx5_eswitch *esw)
                 esw_warn(esw->dev, "Failed setting eswitch to offloads, err %d\n", err);
                 err1 = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_LEGACY);
                 if (err1)
-                        esw_warn(esw->dev, "Failed setting eswitch back to legacy, err %d\n", err);
+                        esw_warn(esw->dev, "Failed setting eswitch back to legacy, err %d\n", err1);
         }
         if (esw->offloads.inline_mode == MLX5_INLINE_MODE_NONE) {
                 if (mlx5_eswitch_inline_mode_get(esw,
@@ -674,9 +675,14 @@ int esw_offloads_init(struct mlx5_eswitch *esw, int nvports)
         int vport;
         int err;
 
+        /* disable PF RoCE so missed packets don't go through RoCE steering */
+        mlx5_dev_list_lock();
+        mlx5_remove_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
+        mlx5_dev_list_unlock();
+
         err = esw_create_offloads_fdb_table(esw, nvports);
         if (err)
-                return err;
+                goto create_fdb_err;
 
         err = esw_create_offloads_table(esw);
         if (err)
@@ -696,11 +702,6 @@ int esw_offloads_init(struct mlx5_eswitch *esw, int nvports)
                         goto err_reps;
         }
 
-        /* disable PF RoCE so missed packets don't go through RoCE steering */
-        mlx5_dev_list_lock();
-        mlx5_remove_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
-        mlx5_dev_list_unlock();
-
         return 0;
 
 err_reps:
@@ -717,6 +718,13 @@ create_fg_err:
 
 create_ft_err:
         esw_destroy_offloads_fdb_table(esw);
+
+create_fdb_err:
+        /* enable back PF RoCE */
+        mlx5_dev_list_lock();
+        mlx5_add_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
+        mlx5_dev_list_unlock();
+
         return err;
 }
 
@@ -724,11 +732,6 @@ static int esw_offloads_stop(struct mlx5_eswitch *esw)
 {
         int err, err1, num_vfs = esw->dev->priv.sriov.num_vfs;
 
-        /* enable back PF RoCE */
-        mlx5_dev_list_lock();
-        mlx5_add_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
-        mlx5_dev_list_unlock();
-
         mlx5_eswitch_disable_sriov(esw);
         err = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_LEGACY);
         if (err) {
@@ -738,6 +741,11 @@ static int esw_offloads_stop(struct mlx5_eswitch *esw)
                         esw_warn(esw->dev, "Failed setting eswitch back to offloads, err %d\n", err);
         }
 
+        /* enable back PF RoCE */
+        mlx5_dev_list_lock();
+        mlx5_add_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
+        mlx5_dev_list_unlock();
+
         return err;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index c4478ecd8056..b53fc85a2375 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -322,7 +322,7 @@ int mlx5_cmd_update_fte(struct mlx5_core_dev *dev,
                                                 flow_table_properties_nic_receive.
                                                 flow_modify_en);
         if (!atomic_mod_cap)
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
         opmod = 1;
 
         return  mlx5_cmd_set_fte(dev, opmod, modify_mask, ft, group_id, fte);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 0ac7a2fc916c..6346a8f5883b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1822,7 +1822,7 @@ static int create_anchor_flow_table(struct mlx5_flow_steering *steering)
         struct mlx5_flow_table *ft;
 
         ns = mlx5_get_flow_namespace(steering->dev, MLX5_FLOW_NAMESPACE_ANCHOR);
-        if (!ns)
+        if (WARN_ON(!ns))
                 return -EINVAL;
         ft = mlx5_create_flow_table(ns, ANCHOR_PRIO, ANCHOR_SIZE, ANCHOR_LEVEL, 0);
         if (IS_ERR(ft)) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index d01e9f21d469..3c315eb8d270 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -807,7 +807,7 @@ static int mlx5_core_set_issi(struct mlx5_core_dev *dev)
                 return 0;
         }
 
-        return -ENOTSUPP;
+        return -EOPNOTSUPP;
 }
 
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
index d2ec9d232a70..fd12e0a377a5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
@@ -620,7 +620,7 @@ static int mlx5_set_port_qetcr_reg(struct mlx5_core_dev *mdev, u32 *in,
         u32 out[MLX5_ST_SZ_DW(qtct_reg)];
 
         if (!MLX5_CAP_GEN(mdev, ets))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         return mlx5_core_access_reg(mdev, in, inlen, out, sizeof(out),
                                     MLX5_REG_QETCR, 0, 1);
@@ -632,7 +632,7 @@ static int mlx5_query_port_qetcr_reg(struct mlx5_core_dev *mdev, u32 *out,
         u32 in[MLX5_ST_SZ_DW(qtct_reg)];
 
         if (!MLX5_CAP_GEN(mdev, ets))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         memset(in, 0, sizeof(in));
         return mlx5_core_access_reg(mdev, in, sizeof(in), out, outlen,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
index 269e4401c342..7129c30a2ab4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
@@ -532,7 +532,7 @@ int mlx5_modify_nic_vport_node_guid(struct mlx5_core_dev *mdev,
         if (!MLX5_CAP_GEN(mdev, vport_group_manager))
                 return -EACCES;
         if (!MLX5_CAP_ESW(mdev, nic_vport_node_guid_modify))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         in = mlx5_vzalloc(inlen);
         if (!in)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 01d0efa9c5c7..9e494a446b7e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -1172,7 +1172,8 @@ static int mlxsw_sp_nexthop_mac_update(struct mlxsw_sp *mlxsw_sp, u32 adj_index,
 
 static int
 mlxsw_sp_nexthop_group_mac_update(struct mlxsw_sp *mlxsw_sp,
-                                  struct mlxsw_sp_nexthop_group *nh_grp)
+                                  struct mlxsw_sp_nexthop_group *nh_grp,
+                                  bool reallocate)
 {
         u32 adj_index = nh_grp->adj_index; /* base */
         struct mlxsw_sp_nexthop *nh;
@@ -1187,7 +1188,7 @@ mlxsw_sp_nexthop_group_mac_update(struct mlxsw_sp *mlxsw_sp,
                         continue;
                 }
 
-                if (nh->update) {
+                if (nh->update || reallocate) {
                         err = mlxsw_sp_nexthop_mac_update(mlxsw_sp,
                                                           adj_index, nh);
                         if (err)
@@ -1248,7 +1249,8 @@ mlxsw_sp_nexthop_group_refresh(struct mlxsw_sp *mlxsw_sp,
                 /* Nothing was added or removed, so no need to reallocate. Just
                  * update MAC on existing adjacency indexes.
                  */
-                err = mlxsw_sp_nexthop_group_mac_update(mlxsw_sp, nh_grp);
+                err = mlxsw_sp_nexthop_group_mac_update(mlxsw_sp, nh_grp,
+                                                        false);
                 if (err) {
                         dev_warn(mlxsw_sp->bus_info->dev, "Failed to update neigh MAC in adjacency table.\n");
                         goto set_trap;
@@ -1276,7 +1278,7 @@ mlxsw_sp_nexthop_group_refresh(struct mlxsw_sp *mlxsw_sp,
         nh_grp->adj_index_valid = 1;
         nh_grp->adj_index = adj_index;
         nh_grp->ecmp_size = ecmp_size;
-        err = mlxsw_sp_nexthop_group_mac_update(mlxsw_sp, nh_grp);
+        err = mlxsw_sp_nexthop_group_mac_update(mlxsw_sp, nh_grp, true);
         if (err) {
                 dev_warn(mlxsw_sp->bus_info->dev, "Failed to update neigh MAC in adjacency table.\n");
                 goto set_trap;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index 8e5cb7605b0f..873ce2cd76ba 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -297,7 +297,7 @@ static void qed_ll2_txq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle)
                 list_del(&p_pkt->list_entry);
                 b_last_packet = list_empty(&p_tx->active_descq);
                 list_add_tail(&p_pkt->list_entry, &p_tx->free_descq);
-                if (p_ll2_conn->conn_type == QED_LL2_TYPE_ISCSI_OOO) {
+                if (p_ll2_conn->conn.conn_type == QED_LL2_TYPE_ISCSI_OOO) {
                         struct qed_ooo_buffer *p_buffer;
 
                         p_buffer = (struct qed_ooo_buffer *)p_pkt->cookie;
@@ -309,7 +309,7 @@ static void qed_ll2_txq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle)
                         b_last_frag =
                                 p_tx->cur_completing_bd_idx == p_pkt->bd_used;
                         tx_frag = p_pkt->bds_set[0].tx_frag;
-                        if (p_ll2_conn->gsi_enable)
+                        if (p_ll2_conn->conn.gsi_enable)
                                 qed_ll2b_release_tx_gsi_packet(p_hwfn,
                                                                p_ll2_conn->
                                                                my_id,
@@ -378,7 +378,7 @@ static int qed_ll2_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
 
                 spin_unlock_irqrestore(&p_tx->lock, flags);
                 tx_frag = p_pkt->bds_set[0].tx_frag;
-                if (p_ll2_conn->gsi_enable)
+                if (p_ll2_conn->conn.gsi_enable)
                         qed_ll2b_complete_tx_gsi_packet(p_hwfn,
                                                         p_ll2_conn->my_id,
                                                         p_pkt->cookie,
@@ -550,7 +550,7 @@ static void qed_ll2_rxq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle)
 
                 list_move_tail(&p_pkt->list_entry, &p_rx->free_descq);
 
-                if (p_ll2_conn->conn_type == QED_LL2_TYPE_ISCSI_OOO) {
+                if (p_ll2_conn->conn.conn_type == QED_LL2_TYPE_ISCSI_OOO) {
                         struct qed_ooo_buffer *p_buffer;
 
                         p_buffer = (struct qed_ooo_buffer *)p_pkt->cookie;
@@ -738,7 +738,7 @@ qed_ooo_submit_tx_buffers(struct qed_hwfn *p_hwfn,
                 rc = qed_ll2_prepare_tx_packet(p_hwfn, p_ll2_conn->my_id, 1,
                                                p_buffer->vlan, bd_flags,
                                                l4_hdr_offset_w,
-                                               p_ll2_conn->tx_dest, 0,
+                                               p_ll2_conn->conn.tx_dest, 0,
                                                first_frag,
                                                p_buffer->packet_length,
                                                p_buffer, true);
@@ -858,7 +858,7 @@ qed_ll2_acquire_connection_ooo(struct qed_hwfn *p_hwfn,
         u16 buf_idx;
         int rc = 0;
 
-        if (p_ll2_info->conn_type != QED_LL2_TYPE_ISCSI_OOO)
+        if (p_ll2_info->conn.conn_type != QED_LL2_TYPE_ISCSI_OOO)
                 return rc;
 
         if (!rx_num_ooo_buffers)
@@ -901,7 +901,7 @@ static void
 qed_ll2_establish_connection_ooo(struct qed_hwfn *p_hwfn,
                                  struct qed_ll2_info *p_ll2_conn)
 {
-        if (p_ll2_conn->conn_type != QED_LL2_TYPE_ISCSI_OOO)
+        if (p_ll2_conn->conn.conn_type != QED_LL2_TYPE_ISCSI_OOO)
                 return;
 
         qed_ooo_release_all_isles(p_hwfn, p_hwfn->p_ooo_info);
@@ -913,7 +913,7 @@ static void qed_ll2_release_connection_ooo(struct qed_hwfn *p_hwfn,
 {
         struct qed_ooo_buffer *p_buffer;
 
-        if (p_ll2_conn->conn_type != QED_LL2_TYPE_ISCSI_OOO)
+        if (p_ll2_conn->conn.conn_type != QED_LL2_TYPE_ISCSI_OOO)
                 return;
 
         qed_ooo_release_all_isles(p_hwfn, p_hwfn->p_ooo_info);
@@ -945,23 +945,19 @@ static int qed_ll2_start_ooo(struct qed_dev *cdev,
 {
         struct qed_hwfn *hwfn = QED_LEADING_HWFN(cdev);
         u8 *handle = &hwfn->pf_params.iscsi_pf_params.ll2_ooo_queue_id;
-        struct qed_ll2_info *ll2_info;
+        struct qed_ll2_conn ll2_info;
         int rc;
 
-        ll2_info = kzalloc(sizeof(*ll2_info), GFP_KERNEL);
-        if (!ll2_info)
-                return -ENOMEM;
-        ll2_info->conn_type = QED_LL2_TYPE_ISCSI_OOO;
-        ll2_info->mtu = params->mtu;
-        ll2_info->rx_drop_ttl0_flg = params->drop_ttl0_packets;
-        ll2_info->rx_vlan_removal_en = params->rx_vlan_stripping;
-        ll2_info->tx_tc = OOO_LB_TC;
-        ll2_info->tx_dest = CORE_TX_DEST_LB;
-
-        rc = qed_ll2_acquire_connection(hwfn, ll2_info,
+        ll2_info.conn_type = QED_LL2_TYPE_ISCSI_OOO;
+        ll2_info.mtu = params->mtu;
+        ll2_info.rx_drop_ttl0_flg = params->drop_ttl0_packets;
+        ll2_info.rx_vlan_removal_en = params->rx_vlan_stripping;
+        ll2_info.tx_tc = OOO_LB_TC;
+        ll2_info.tx_dest = CORE_TX_DEST_LB;
+
+        rc = qed_ll2_acquire_connection(hwfn, &ll2_info,
                                         QED_LL2_RX_SIZE, QED_LL2_TX_SIZE,
                                         handle);
-        kfree(ll2_info);
         if (rc) {
                 DP_INFO(cdev, "Failed to acquire LL2 OOO connection\n");
                 goto out;
@@ -1006,7 +1002,7 @@ static int qed_sp_ll2_rx_queue_start(struct qed_hwfn *p_hwfn,
                                      struct qed_ll2_info *p_ll2_conn,
                                      u8 action_on_error)
 {
-        enum qed_ll2_conn_type conn_type = p_ll2_conn->conn_type;
+        enum qed_ll2_conn_type conn_type = p_ll2_conn->conn.conn_type;
         struct qed_ll2_rx_queue *p_rx = &p_ll2_conn->rx_queue;
         struct core_rx_start_ramrod_data *p_ramrod = NULL;
         struct qed_spq_entry *p_ent = NULL;
@@ -1032,7 +1028,7 @@ static int qed_sp_ll2_rx_queue_start(struct qed_hwfn *p_hwfn,
         p_ramrod->sb_index = p_rx->rx_sb_index;
         p_ramrod->complete_event_flg = 1;
 
-        p_ramrod->mtu = cpu_to_le16(p_ll2_conn->mtu);
+        p_ramrod->mtu = cpu_to_le16(p_ll2_conn->conn.mtu);
         DMA_REGPAIR_LE(p_ramrod->bd_base,
                        p_rx->rxq_chain.p_phys_addr);
         cqe_pbl_size = (u16)qed_chain_get_page_cnt(&p_rx->rcq_chain);
@@ -1040,8 +1036,8 @@ static int qed_sp_ll2_rx_queue_start(struct qed_hwfn *p_hwfn,
         DMA_REGPAIR_LE(p_ramrod->cqe_pbl_addr,
                        qed_chain_get_pbl_phys(&p_rx->rcq_chain));
 
-        p_ramrod->drop_ttl0_flg = p_ll2_conn->rx_drop_ttl0_flg;
-        p_ramrod->inner_vlan_removal_en = p_ll2_conn->rx_vlan_removal_en;
+        p_ramrod->drop_ttl0_flg = p_ll2_conn->conn.rx_drop_ttl0_flg;
+        p_ramrod->inner_vlan_removal_en = p_ll2_conn->conn.rx_vlan_removal_en;
         p_ramrod->queue_id = p_ll2_conn->queue_id;
         p_ramrod->main_func_queue = (conn_type == QED_LL2_TYPE_ISCSI_OOO) ? 0
                                                                           : 1;
@@ -1056,14 +1052,14 @@ static int qed_sp_ll2_rx_queue_start(struct qed_hwfn *p_hwfn,
         }
 
         p_ramrod->action_on_error.error_type = action_on_error;
-        p_ramrod->gsi_offload_flag = p_ll2_conn->gsi_enable;
+        p_ramrod->gsi_offload_flag = p_ll2_conn->conn.gsi_enable;
         return qed_spq_post(p_hwfn, p_ent, NULL);
 }
 
 static int qed_sp_ll2_tx_queue_start(struct qed_hwfn *p_hwfn,
                                      struct qed_ll2_info *p_ll2_conn)
 {
-        enum qed_ll2_conn_type conn_type = p_ll2_conn->conn_type;
+        enum qed_ll2_conn_type conn_type = p_ll2_conn->conn.conn_type;
         struct qed_ll2_tx_queue *p_tx = &p_ll2_conn->tx_queue;
         struct core_tx_start_ramrod_data *p_ramrod = NULL;
         struct qed_spq_entry *p_ent = NULL;
@@ -1075,7 +1071,7 @@ static int qed_sp_ll2_tx_queue_start(struct qed_hwfn *p_hwfn,
         if (!QED_LL2_TX_REGISTERED(p_ll2_conn))
                 return 0;
 
-        if (p_ll2_conn->conn_type == QED_LL2_TYPE_ISCSI_OOO)
+        if (p_ll2_conn->conn.conn_type == QED_LL2_TYPE_ISCSI_OOO)
                 p_ll2_conn->tx_stats_en = 0;
         else
                 p_ll2_conn->tx_stats_en = 1;
@@ -1096,7 +1092,7 @@ static int qed_sp_ll2_tx_queue_start(struct qed_hwfn *p_hwfn,
 
         p_ramrod->sb_id = cpu_to_le16(qed_int_get_sp_sb_id(p_hwfn));
         p_ramrod->sb_index = p_tx->tx_sb_index;
-        p_ramrod->mtu = cpu_to_le16(p_ll2_conn->mtu);
+        p_ramrod->mtu = cpu_to_le16(p_ll2_conn->conn.mtu);
         p_ramrod->stats_en = p_ll2_conn->tx_stats_en;
         p_ramrod->stats_id = p_ll2_conn->tx_stats_id;
 
@@ -1106,7 +1102,7 @@ static int qed_sp_ll2_tx_queue_start(struct qed_hwfn *p_hwfn,
         p_ramrod->pbl_size = cpu_to_le16(pbl_size);
 
         memset(&pq_params, 0, sizeof(pq_params));
-        pq_params.core.tc = p_ll2_conn->tx_tc;
+        pq_params.core.tc = p_ll2_conn->conn.tx_tc;
         pq_id = qed_get_qm_pq(p_hwfn, PROTOCOLID_CORE, &pq_params);
         p_ramrod->qm_pq_id = cpu_to_le16(pq_id);
 
@@ -1123,7 +1119,7 @@ static int qed_sp_ll2_tx_queue_start(struct qed_hwfn *p_hwfn,
                 DP_NOTICE(p_hwfn, "Unknown connection type: %d\n", conn_type);
         }
 
-        p_ramrod->gsi_offload_flag = p_ll2_conn->gsi_enable;
+        p_ramrod->gsi_offload_flag = p_ll2_conn->conn.gsi_enable;
         return qed_spq_post(p_hwfn, p_ent, NULL);
 }
 
@@ -1224,7 +1220,7 @@ qed_ll2_acquire_connection_rx(struct qed_hwfn *p_hwfn,
 
         DP_VERBOSE(p_hwfn, QED_MSG_LL2,
                    "Allocated LL2 Rxq [Type %08x] with 0x%08x buffers\n",
-                   p_ll2_info->conn_type, rx_num_desc);
+                   p_ll2_info->conn.conn_type, rx_num_desc);
 
 out:
         return rc;
@@ -1262,7 +1258,7 @@ static int qed_ll2_acquire_connection_tx(struct qed_hwfn *p_hwfn,
 
         DP_VERBOSE(p_hwfn, QED_MSG_LL2,
                    "Allocated LL2 Txq [Type %08x] with 0x%08x buffers\n",
-                   p_ll2_info->conn_type, tx_num_desc);
+                   p_ll2_info->conn.conn_type, tx_num_desc);
 
 out:
         if (rc)
@@ -1273,7 +1269,7 @@ out:
 }
 
 int qed_ll2_acquire_connection(struct qed_hwfn *p_hwfn,
-                               struct qed_ll2_info *p_params,
+                               struct qed_ll2_conn *p_params,
                                u16 rx_num_desc,
                                u16 tx_num_desc,
                                u8 *p_connection_handle)
@@ -1302,15 +1298,7 @@ int qed_ll2_acquire_connection(struct qed_hwfn *p_hwfn,
         if (!p_ll2_info)
                 return -EBUSY;
 
-        p_ll2_info->conn_type = p_params->conn_type;
-        p_ll2_info->mtu = p_params->mtu;
-        p_ll2_info->rx_drop_ttl0_flg = p_params->rx_drop_ttl0_flg;
-        p_ll2_info->rx_vlan_removal_en = p_params->rx_vlan_removal_en;
-        p_ll2_info->tx_tc = p_params->tx_tc;
-        p_ll2_info->tx_dest = p_params->tx_dest;
-        p_ll2_info->ai_err_packet_too_big = p_params->ai_err_packet_too_big;
-        p_ll2_info->ai_err_no_buf = p_params->ai_err_no_buf;
-        p_ll2_info->gsi_enable = p_params->gsi_enable;
+        p_ll2_info->conn = *p_params;
 
         rc = qed_ll2_acquire_connection_rx(p_hwfn, p_ll2_info, rx_num_desc);
         if (rc)
@@ -1371,9 +1359,9 @@ static int qed_ll2_establish_connection_rx(struct qed_hwfn *p_hwfn,
 
         SET_FIELD(action_on_error,
                   CORE_RX_ACTION_ON_ERROR_PACKET_TOO_BIG,
-                  p_ll2_conn->ai_err_packet_too_big);
+                  p_ll2_conn->conn.ai_err_packet_too_big);
         SET_FIELD(action_on_error,
-                  CORE_RX_ACTION_ON_ERROR_NO_BUFF, p_ll2_conn->ai_err_no_buf);
+                  CORE_RX_ACTION_ON_ERROR_NO_BUFF, p_ll2_conn->conn.ai_err_no_buf);
 
         return qed_sp_ll2_rx_queue_start(p_hwfn, p_ll2_conn, action_on_error);
 }
@@ -1600,7 +1588,7 @@ static void qed_ll2_prepare_tx_packet_set_bd(struct qed_hwfn *p_hwfn,
                    "LL2 [q 0x%02x cid 0x%08x type 0x%08x] Tx Producer at [0x%04x] - set with a %04x bytes %02x BDs buffer at %08x:%08x\n",
                    p_ll2->queue_id,
                    p_ll2->cid,
-                   p_ll2->conn_type,
+                   p_ll2->conn.conn_type,
                    prod_idx,
                    first_frag_len,
                    num_of_bds,
@@ -1676,7 +1664,7 @@ static void qed_ll2_tx_packet_notify(struct qed_hwfn *p_hwfn,
                    (NETIF_MSG_TX_QUEUED | QED_MSG_LL2),
                    "LL2 [q 0x%02x cid 0x%08x type 0x%08x] Doorbelled [producer 0x%04x]\n",
                    p_ll2_conn->queue_id,
-                   p_ll2_conn->cid, p_ll2_conn->conn_type, db_msg.spq_prod);
+                   p_ll2_conn->cid, p_ll2_conn->conn.conn_type, db_msg.spq_prod);
 }
 
 int qed_ll2_prepare_tx_packet(struct qed_hwfn *p_hwfn,
@@ -1817,7 +1805,7 @@ int qed_ll2_terminate_connection(struct qed_hwfn *p_hwfn, u8 connection_handle)
                 qed_ll2_rxq_flush(p_hwfn, connection_handle);
         }
 
-        if (p_ll2_conn->conn_type == QED_LL2_TYPE_ISCSI_OOO)
+        if (p_ll2_conn->conn.conn_type == QED_LL2_TYPE_ISCSI_OOO)
                 qed_ooo_release_all_isles(p_hwfn, p_hwfn->p_ooo_info);
 
         return rc;
@@ -1993,7 +1981,7 @@ static void qed_ll2_register_cb_ops(struct qed_dev *cdev,
 
 static int qed_ll2_start(struct qed_dev *cdev, struct qed_ll2_params *params)
 {
-        struct qed_ll2_info ll2_info;
+        struct qed_ll2_conn ll2_info;
         struct qed_ll2_buffer *buffer, *tmp_buffer;
         enum qed_ll2_conn_type conn_type;
         struct qed_ptt *p_ptt;
@@ -2041,6 +2029,7 @@ static int qed_ll2_start(struct qed_dev *cdev, struct qed_ll2_params *params)
 
         /* Prepare the temporary ll2 information */
         memset(&ll2_info, 0, sizeof(ll2_info));
+
         ll2_info.conn_type = conn_type;
         ll2_info.mtu = params->mtu;
         ll2_info.rx_drop_ttl0_flg = params->drop_ttl0_packets;
@@ -2120,7 +2109,6 @@ static int qed_ll2_start(struct qed_dev *cdev, struct qed_ll2_params *params)
         }
 
         ether_addr_copy(cdev->ll2_mac_address, params->ll2_mac_address);
-
         return 0;
 
 release_terminate_all:
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.h b/drivers/net/ethernet/qlogic/qed/qed_ll2.h
index 6625a3ae5a33..31417928b635 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.h
@@ -112,15 +112,8 @@ struct qed_ll2_tx_queue {
         bool b_completing_packet;
 };
 
-struct qed_ll2_info {
-        /* Lock protecting the state of LL2 */
-        struct mutex mutex;
+struct qed_ll2_conn {
         enum qed_ll2_conn_type conn_type;
-        u32 cid;
-        u8 my_id;
-        u8 queue_id;
-        u8 tx_stats_id;
-        bool b_active;
         u16 mtu;
         u8 rx_drop_ttl0_flg;
         u8 rx_vlan_removal_en;
@@ -128,10 +121,21 @@ struct qed_ll2_info {
         enum core_tx_dest tx_dest;
         enum core_error_handle ai_err_packet_too_big;
         enum core_error_handle ai_err_no_buf;
+        u8 gsi_enable;
+};
+
+struct qed_ll2_info {
+        /* Lock protecting the state of LL2 */
+        struct mutex mutex;
+        struct qed_ll2_conn conn;
+        u32 cid;
+        u8 my_id;
+        u8 queue_id;
+        u8 tx_stats_id;
+        bool b_active;
         u8 tx_stats_en;
         struct qed_ll2_rx_queue rx_queue;
         struct qed_ll2_tx_queue tx_queue;
-        u8 gsi_enable;
 };
 
 /**
@@ -149,7 +153,7 @@ struct qed_ll2_info {
  * @return 0 on success, failure otherwise
  */
 int qed_ll2_acquire_connection(struct qed_hwfn *p_hwfn,
-                               struct qed_ll2_info *p_params,
+                               struct qed_ll2_conn *p_params,
                                u16 rx_num_desc,
                                u16 tx_num_desc,
                                u8 *p_connection_handle);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c
index 2a16547c8966..2dbdb3298991 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
@@ -2632,7 +2632,7 @@ static int qed_roce_ll2_start(struct qed_dev *cdev,
 {
         struct qed_hwfn *hwfn = QED_LEADING_HWFN(cdev);
         struct qed_roce_ll2_info *roce_ll2;
-        struct qed_ll2_info ll2_params;
+        struct qed_ll2_conn ll2_params;
         int rc;
 
         if (!params) {
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 89ac1e3f6175..301f48755093 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -179,6 +179,49 @@ static struct mdiobb_ops bb_ops = {
         .get_mdio_data = ravb_get_mdio_data,
 };
 
+/* Free TX skb function for AVB-IP */
+static int ravb_tx_free(struct net_device *ndev, int q, bool free_txed_only)
+{
+        struct ravb_private *priv = netdev_priv(ndev);
+        struct net_device_stats *stats = &priv->stats[q];
+        struct ravb_tx_desc *desc;
+        int free_num = 0;
+        int entry;
+        u32 size;
+
+        for (; priv->cur_tx[q] - priv->dirty_tx[q] > 0; priv->dirty_tx[q]++) {
+                bool txed;
+
+                entry = priv->dirty_tx[q] % (priv->num_tx_ring[q] *
+                                             NUM_TX_DESC);
+                desc = &priv->tx_ring[q][entry];
+                txed = desc->die_dt == DT_FEMPTY;
+                if (free_txed_only && !txed)
+                        break;
+                /* Descriptor type must be checked before all other reads */
+                dma_rmb();
+                size = le16_to_cpu(desc->ds_tagl) & TX_DS;
+                /* Free the original skb. */
+                if (priv->tx_skb[q][entry / NUM_TX_DESC]) {
+                        dma_unmap_single(ndev->dev.parent, le32_to_cpu(desc->dptr),
+                                         size, DMA_TO_DEVICE);
+                        /* Last packet descriptor? */
+                        if (entry % NUM_TX_DESC == NUM_TX_DESC - 1) {
+                                entry /= NUM_TX_DESC;
+                                dev_kfree_skb_any(priv->tx_skb[q][entry]);
+                                priv->tx_skb[q][entry] = NULL;
+                                if (txed)
+                                        stats->tx_packets++;
+                        }
+                        free_num++;
+                }
+                if (txed)
+                        stats->tx_bytes += size;
+                desc->die_dt = DT_EEMPTY;
+        }
+        return free_num;
+}
+
 /* Free skb's and DMA buffers for Ethernet AVB */
 static void ravb_ring_free(struct net_device *ndev, int q)
 {
@@ -194,19 +237,21 @@ static void ravb_ring_free(struct net_device *ndev, int q)
         kfree(priv->rx_skb[q]);
         priv->rx_skb[q] = NULL;
 
-        /* Free TX skb ringbuffer */
-        if (priv->tx_skb[q]) {
-                for (i = 0; i < priv->num_tx_ring[q]; i++)
-                        dev_kfree_skb(priv->tx_skb[q][i]);
-        }
-        kfree(priv->tx_skb[q]);
-        priv->tx_skb[q] = NULL;
-
         /* Free aligned TX buffers */
         kfree(priv->tx_align[q]);
         priv->tx_align[q] = NULL;
 
         if (priv->rx_ring[q]) {
+                for (i = 0; i < priv->num_rx_ring[q]; i++) {
+                        struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i];
+
+                        if (!dma_mapping_error(ndev->dev.parent,
+                                               le32_to_cpu(desc->dptr)))
+                                dma_unmap_single(ndev->dev.parent,
+                                                 le32_to_cpu(desc->dptr),
+                                                 PKT_BUF_SZ,
+                                                 DMA_FROM_DEVICE);
+                }
                 ring_size = sizeof(struct ravb_ex_rx_desc) *
                             (priv->num_rx_ring[q] + 1);
                 dma_free_coherent(ndev->dev.parent, ring_size, priv->rx_ring[q],
@@ -215,12 +260,20 @@ static void ravb_ring_free(struct net_device *ndev, int q)
         }
 
         if (priv->tx_ring[q]) {
+                ravb_tx_free(ndev, q, false);
+
                 ring_size = sizeof(struct ravb_tx_desc) *
                             (priv->num_tx_ring[q] * NUM_TX_DESC + 1);
                 dma_free_coherent(ndev->dev.parent, ring_size, priv->tx_ring[q],
                                   priv->tx_desc_dma[q]);
                 priv->tx_ring[q] = NULL;
         }
+
+        /* Free TX skb ringbuffer.
+         * SKBs are freed by ravb_tx_free() call above.
+         */
+        kfree(priv->tx_skb[q]);
+        priv->tx_skb[q] = NULL;
 }
 
 /* Format skb and descriptor buffer for Ethernet AVB */
@@ -431,44 +484,6 @@ static int ravb_dmac_init(struct net_device *ndev)
         return 0;
 }
 
-/* Free TX skb function for AVB-IP */
-static int ravb_tx_free(struct net_device *ndev, int q)
-{
-        struct ravb_private *priv = netdev_priv(ndev);
-        struct net_device_stats *stats = &priv->stats[q];
-        struct ravb_tx_desc *desc;
-        int free_num = 0;
-        int entry;
-        u32 size;
-
-        for (; priv->cur_tx[q] - priv->dirty_tx[q] > 0; priv->dirty_tx[q]++) {
-                entry = priv->dirty_tx[q] % (priv->num_tx_ring[q] *
-                                             NUM_TX_DESC);
-                desc = &priv->tx_ring[q][entry];
-                if (desc->die_dt != DT_FEMPTY)
-                        break;
-                /* Descriptor type must be checked before all other reads */
-                dma_rmb();
-                size = le16_to_cpu(desc->ds_tagl) & TX_DS;
-                /* Free the original skb. */
-                if (priv->tx_skb[q][entry / NUM_TX_DESC]) {
-                        dma_unmap_single(ndev->dev.parent, le32_to_cpu(desc->dptr),
-                                         size, DMA_TO_DEVICE);
-                        /* Last packet descriptor? */
-                        if (entry % NUM_TX_DESC == NUM_TX_DESC - 1) {
-                                entry /= NUM_TX_DESC;
-                                dev_kfree_skb_any(priv->tx_skb[q][entry]);
-                                priv->tx_skb[q][entry] = NULL;
-                                stats->tx_packets++;
-                        }
-                        free_num++;
-                }
-                stats->tx_bytes += size;
-                desc->die_dt = DT_EEMPTY;
-        }
-        return free_num;
-}
-
 static void ravb_get_tx_tstamp(struct net_device *ndev)
 {
         struct ravb_private *priv = netdev_priv(ndev);
@@ -902,7 +917,7 @@ static int ravb_poll(struct napi_struct *napi, int budget)
                         spin_lock_irqsave(&priv->lock, flags);
                         /* Clear TX interrupt */
                         ravb_write(ndev, ~mask, TIS);
-                        ravb_tx_free(ndev, q);
+                        ravb_tx_free(ndev, q, true);
                         netif_wake_subqueue(ndev, q);
                         mmiowb();
                         spin_unlock_irqrestore(&priv->lock, flags);
@@ -1567,7 +1582,8 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 
         priv->cur_tx[q] += NUM_TX_DESC;
         if (priv->cur_tx[q] - priv->dirty_tx[q] >
-            (priv->num_tx_ring[q] - 1) * NUM_TX_DESC && !ravb_tx_free(ndev, q))
+            (priv->num_tx_ring[q] - 1) * NUM_TX_DESC &&
+            !ravb_tx_free(ndev, q, true))
                 netif_stop_subqueue(ndev, q);
 
 exit:
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
index be3c91c7f211..5484fd726d5a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
@@ -305,8 +305,12 @@ static int dwmac1000_irq_status(struct mac_device_info *hw,
 {
         void __iomem *ioaddr = hw->pcsr;
         u32 intr_status = readl(ioaddr + GMAC_INT_STATUS);
+        u32 intr_mask = readl(ioaddr + GMAC_INT_MASK);
         int ret = 0;
 
+        /* Discard masked bits */
+        intr_status &= ~intr_mask;
+
         /* Not used events (e.g. MMC interrupts) are not handled. */
         if ((intr_status & GMAC_INT_STATUS_MMCTIS))
                 x->mmc_tx_irq_n++;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 082cd48db6a7..36942f5a6a53 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -351,6 +351,7 @@ void stmmac_remove_config_dt(struct platform_device *pdev,
         if (of_phy_is_fixed_link(np))
                 of_phy_deregister_fixed_link(np);
         of_node_put(plat->phy_node);
+        of_node_put(plat->mdio_node);
 }
 #else
 struct plat_stmmacenet_data *
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 8b6810bad54b..99d3df788ce8 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -69,7 +69,6 @@ struct gtp_dev {
         struct socket           *sock0;
         struct socket           *sock1u;
 
-        struct net              *net;
         struct net_device       *dev;
 
         unsigned int            hash_size;
@@ -316,7 +315,7 @@ static int gtp_encap_recv(struct sock *sk, struct sk_buff *skb)
 
         netdev_dbg(gtp->dev, "encap_recv sk=%p\n", sk);
 
-        xnet = !net_eq(gtp->net, dev_net(gtp->dev));
+        xnet = !net_eq(sock_net(sk), dev_net(gtp->dev));
 
         switch (udp_sk(sk)->encap_type) {
         case UDP_ENCAP_GTP0:
@@ -612,7 +611,7 @@ static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev)
                                     pktinfo.fl4.saddr, pktinfo.fl4.daddr,
                                     pktinfo.iph->tos,
                                     ip4_dst_hoplimit(&pktinfo.rt->dst),
-                                    htons(IP_DF),
+                                    0,
                                     pktinfo.gtph_port, pktinfo.gtph_port,
                                     true, false);
                 break;
@@ -658,7 +657,7 @@ static void gtp_link_setup(struct net_device *dev)
 static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize);
 static void gtp_hashtable_free(struct gtp_dev *gtp);
 static int gtp_encap_enable(struct net_device *dev, struct gtp_dev *gtp,
-                            int fd_gtp0, int fd_gtp1, struct net *src_net);
+                            int fd_gtp0, int fd_gtp1);
 
 static int gtp_newlink(struct net *src_net, struct net_device *dev,
                         struct nlattr *tb[], struct nlattr *data[])
@@ -675,7 +674,7 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
         fd0 = nla_get_u32(data[IFLA_GTP_FD0]);
         fd1 = nla_get_u32(data[IFLA_GTP_FD1]);
 
-        err = gtp_encap_enable(dev, gtp, fd0, fd1, src_net);
+        err = gtp_encap_enable(dev, gtp, fd0, fd1);
         if (err < 0)
                 goto out_err;
 
@@ -821,7 +820,7 @@ static void gtp_hashtable_free(struct gtp_dev *gtp)
 }
 
 static int gtp_encap_enable(struct net_device *dev, struct gtp_dev *gtp,
-                            int fd_gtp0, int fd_gtp1, struct net *src_net)
+                            int fd_gtp0, int fd_gtp1)
 {
         struct udp_tunnel_sock_cfg tuncfg = {NULL};
         struct socket *sock0, *sock1u;
@@ -858,7 +857,6 @@ static int gtp_encap_enable(struct net_device *dev, struct gtp_dev *gtp,
 
         gtp->sock0 = sock0;
         gtp->sock1u = sock1u;
-        gtp->net = src_net;
 
         tuncfg.sk_user_data = gtp;
         tuncfg.encap_rcv = gtp_encap_recv;
@@ -1376,3 +1374,4 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Harald Welte <hwelte@sysmocom.de>");
 MODULE_DESCRIPTION("Interface driver for GTP encapsulated traffic");
 MODULE_ALIAS_RTNL_LINK("gtp");
+MODULE_ALIAS_GENL_FAMILY("gtp");
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 5a1cc089acb7..86e5749226ef 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -1295,6 +1295,9 @@ void netvsc_channel_cb(void *context)
         ndev = hv_get_drvdata(device);
         buffer = get_per_channel_state(channel);
 
+        /* commit_rd_index() -> hv_signal_on_read() needs this. */
+        init_cached_read_index(channel);
+
         do {
                 desc = get_next_pkt_raw(channel);
                 if (desc != NULL) {
@@ -1347,6 +1350,9 @@ void netvsc_channel_cb(void *context)
 
                         bufferlen = bytes_recvd;
                 }
+
+                init_cached_read_index(channel);
+
         } while (1);
 
         if (bufferlen > NETVSC_PACKET_SIZE)
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 5c26653eceb5..402618565838 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -825,7 +825,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
                         return -EINVAL;
 
                 if (virtio_net_hdr_from_skb(skb, &vnet_hdr,
-                                            macvtap_is_little_endian(q)))
+                                            macvtap_is_little_endian(q), true))
                         BUG();
 
                 if (copy_to_iter(&vnet_hdr, sizeof(vnet_hdr), iter) !=
diff --git a/drivers/net/phy/bcm63xx.c b/drivers/net/phy/bcm63xx.c
index e741bf614c4e..b0492ef2cdaa 100644
--- a/drivers/net/phy/bcm63xx.c
+++ b/drivers/net/phy/bcm63xx.c
@@ -21,6 +21,23 @@ MODULE_DESCRIPTION("Broadcom 63xx internal PHY driver");
 MODULE_AUTHOR("Maxime Bizon <mbizon@freebox.fr>");
 MODULE_LICENSE("GPL");
 
+static int bcm63xx_config_intr(struct phy_device *phydev)
+{
+        int reg, err;
+
+        reg = phy_read(phydev, MII_BCM63XX_IR);
+        if (reg < 0)
+                return reg;
+
+        if (phydev->interrupts == PHY_INTERRUPT_ENABLED)
+                reg &= ~MII_BCM63XX_IR_GMASK;
+        else
+                reg |= MII_BCM63XX_IR_GMASK;
+
+        err = phy_write(phydev, MII_BCM63XX_IR, reg);
+        return err;
+}
+
 static int bcm63xx_config_init(struct phy_device *phydev)
 {
         int reg, err;
@@ -55,7 +72,7 @@ static struct phy_driver bcm63xx_driver[] = {
         .config_aneg    = genphy_config_aneg,
         .read_status    = genphy_read_status,
         .ack_interrupt  = bcm_phy_ack_intr,
-        .config_intr    = bcm_phy_config_intr,
+        .config_intr    = bcm63xx_config_intr,
 }, {
         /* same phy as above, with just a different OUI */
         .phy_id         = 0x002bdc00,
@@ -67,7 +84,7 @@ static struct phy_driver bcm63xx_driver[] = {
         .config_aneg    = genphy_config_aneg,
         .read_status    = genphy_read_status,
         .ack_interrupt  = bcm_phy_ack_intr,
-        .config_intr    = bcm_phy_config_intr,
+        .config_intr    = bcm63xx_config_intr,
 } };
 
 module_phy_driver(bcm63xx_driver);
diff --git a/drivers/net/phy/dp83848.c b/drivers/net/phy/dp83848.c
index 800b39f06279..a10d0e7fc5f7 100644
--- a/drivers/net/phy/dp83848.c
+++ b/drivers/net/phy/dp83848.c
@@ -17,6 +17,7 @@
 #include <linux/phy.h>
 
 #define TI_DP83848C_PHY_ID              0x20005ca0
+#define TI_DP83620_PHY_ID               0x20005ce0
 #define NS_DP83848C_PHY_ID              0x20005c90
 #define TLK10X_PHY_ID                   0x2000a210
 #define TI_DP83822_PHY_ID               0x2000a240
@@ -77,6 +78,7 @@ static int dp83848_config_intr(struct phy_device *phydev)
 static struct mdio_device_id __maybe_unused dp83848_tbl[] = {
         { TI_DP83848C_PHY_ID, 0xfffffff0 },
         { NS_DP83848C_PHY_ID, 0xfffffff0 },
+        { TI_DP83620_PHY_ID, 0xfffffff0 },
         { TLK10X_PHY_ID, 0xfffffff0 },
         { TI_DP83822_PHY_ID, 0xfffffff0 },
         { }
@@ -106,6 +108,7 @@ MODULE_DEVICE_TABLE(mdio, dp83848_tbl);
 static struct phy_driver dp83848_driver[] = {
         DP83848_PHY_DRIVER(TI_DP83848C_PHY_ID, "TI DP83848C 10/100 Mbps PHY"),
         DP83848_PHY_DRIVER(NS_DP83848C_PHY_ID, "NS DP83848C 10/100 Mbps PHY"),
+        DP83848_PHY_DRIVER(TI_DP83620_PHY_ID, "TI DP83620 10/100 Mbps PHY"),
         DP83848_PHY_DRIVER(TLK10X_PHY_ID, "TI TLK10X 10/100 Mbps PHY"),
         DP83848_PHY_DRIVER(TI_DP83822_PHY_ID, "TI DP83822 10/100 Mbps PHY"),
 };
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 0b78210c0fa7..ed0d235cf850 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1679,6 +1679,8 @@ static struct phy_driver marvell_drivers[] = {
                 .ack_interrupt = &marvell_ack_interrupt,
                 .config_intr = &marvell_config_intr,
                 .did_interrupt = &m88e1121_did_interrupt,
+                .get_wol = &m88e1318_get_wol,
+                .set_wol = &m88e1318_set_wol,
                 .resume = &marvell_resume,
                 .suspend = &marvell_suspend,
                 .get_sset_count = marvell_get_sset_count,
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 9a77289109b7..6742070ca676 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -1008,6 +1008,20 @@ static struct phy_driver ksphy_driver[] = {
         .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
         .resume         = genphy_resume,
+}, {
+        .phy_id         = PHY_ID_KSZ8795,
+        .phy_id_mask    = MICREL_PHY_ID_MASK,
+        .name           = "Micrel KSZ8795",
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = ksz8873mll_config_aneg,
+        .read_status    = ksz8873mll_read_status,
+        .get_sset_count = kszphy_get_sset_count,
+        .get_strings    = kszphy_get_strings,
+        .get_stats      = kszphy_get_stats,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
 } };
 
 module_phy_driver(ksphy_driver);
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 48da6e93c3f7..7cc1b7dcfe05 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -29,6 +29,7 @@
 #include <linux/mii.h>
 #include <linux/ethtool.h>
 #include <linux/phy.h>
+#include <linux/phy_led_triggers.h>
 #include <linux/timer.h>
 #include <linux/workqueue.h>
 #include <linux/mdio.h>
@@ -649,14 +650,18 @@ void phy_start_machine(struct phy_device *phydev)
  * phy_trigger_machine - trigger the state machine to run
  *
  * @phydev: the phy_device struct
+ * @sync: indicate whether we should wait for the workqueue cancelation
  *
  * Description: There has been a change in state which requires that the
  *   state machine runs.
  */
 
-static void phy_trigger_machine(struct phy_device *phydev)
+static void phy_trigger_machine(struct phy_device *phydev, bool sync)
 {
-        cancel_delayed_work_sync(&phydev->state_queue);
+        if (sync)
+                cancel_delayed_work_sync(&phydev->state_queue);
+        else
+                cancel_delayed_work(&phydev->state_queue);
         queue_delayed_work(system_power_efficient_wq, &phydev->state_queue, 0);
 }
 
@@ -693,7 +698,7 @@ static void phy_error(struct phy_device *phydev)
         phydev->state = PHY_HALTED;
         mutex_unlock(&phydev->lock);
 
-        phy_trigger_machine(phydev);
+        phy_trigger_machine(phydev, false);
 }
 
 /**
@@ -840,7 +845,7 @@ void phy_change(struct phy_device *phydev)
         }
 
         /* reschedule state queue work to run as soon as possible */
-        phy_trigger_machine(phydev);
+        phy_trigger_machine(phydev, true);
         return;
 
 ignore:
@@ -942,7 +947,7 @@ void phy_start(struct phy_device *phydev)
         if (do_resume)
                 phy_resume(phydev);
 
-        phy_trigger_machine(phydev);
+        phy_trigger_machine(phydev, true);
 }
 EXPORT_SYMBOL(phy_start);
 
diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c
index fa62bdf2f526..94ca42e630bb 100644
--- a/drivers/net/phy/phy_led_triggers.c
+++ b/drivers/net/phy/phy_led_triggers.c
@@ -12,6 +12,7 @@
  */
 #include <linux/leds.h>
 #include <linux/phy.h>
+#include <linux/phy_led_triggers.h>
 #include <linux/netdevice.h>
 
 static struct phy_led_trigger *phy_speed_to_led_trigger(struct phy_device *phy,
@@ -102,8 +103,10 @@ int phy_led_triggers_register(struct phy_device *phy)
                                             sizeof(struct phy_led_trigger) *
                                                    phy->phy_num_led_triggers,
                                             GFP_KERNEL);
-        if (!phy->phy_led_triggers)
-                return -ENOMEM;
+        if (!phy->phy_led_triggers) {
+                err = -ENOMEM;
+                goto out_clear;
+        }
 
         for (i = 0; i < phy->phy_num_led_triggers; i++) {
                 err = phy_led_trigger_register(phy, &phy->phy_led_triggers[i],
@@ -120,6 +123,8 @@ out_unreg:
         while (i--)
                 phy_led_trigger_unregister(&phy->phy_led_triggers[i]);
         devm_kfree(&phy->mdio.dev, phy->phy_led_triggers);
+out_clear:
+        phy->phy_num_led_triggers = 0;
         return err;
 }
 EXPORT_SYMBOL_GPL(phy_led_triggers_register);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index cd8e02c94be0..2cd10b26b650 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1360,7 +1360,7 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                         return -EINVAL;
 
                 if (virtio_net_hdr_from_skb(skb, &gso,
-                                            tun_is_little_endian(tun))) {
+                                            tun_is_little_endian(tun), true)) {
                         struct skb_shared_info *sinfo = skb_shinfo(skb);
                         pr_err("unexpected GSO type: "
                                "0x%x, gso_size %d, hdr_len %d\n",
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index fe7b2886cb6b..86144f9a80ee 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -531,6 +531,7 @@ static const struct driver_info wwan_info = {
 #define SAMSUNG_VENDOR_ID       0x04e8
 #define LENOVO_VENDOR_ID        0x17ef
 #define NVIDIA_VENDOR_ID        0x0955
+#define HP_VENDOR_ID            0x03f0
 
 static const struct usb_device_id       products[] = {
 /* BLACKLIST !!
@@ -677,6 +678,13 @@ static const struct usb_device_id	products[] = {
         .driver_info = 0,
 },
 
+/* HP lt2523 (Novatel E371) - handled by qmi_wwan */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(HP_VENDOR_ID, 0x421d, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+
 /* AnyDATA ADU960S - handled by qmi_wwan */
 {
         USB_DEVICE_AND_INTERFACE_INFO(0x16d5, 0x650a, USB_CLASS_COMM,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 6fe1cdb0174f..24d5272cdce5 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -654,6 +654,13 @@ static const struct usb_device_id products[] = {
                                               USB_CDC_PROTO_NONE),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
         },
+        {       /* HP lt2523 (Novatel E371) */
+                USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d,
+                                              USB_CLASS_COMM,
+                                              USB_CDC_SUBCLASS_ETHERNET,
+                                              USB_CDC_PROTO_NONE),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
         {       /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */
                 USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7),
                 .driver_info = (unsigned long)&qmi_wwan_info,
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index f3b48ad90865..ad42295356dd 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -32,7 +32,7 @@
 #define NETNEXT_VERSION         "08"
 
 /* Information for net */
-#define NET_VERSION             "6"
+#define NET_VERSION             "8"
 
 #define DRIVER_VERSION          "v1." NETNEXT_VERSION "." NET_VERSION
 #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
@@ -1936,6 +1936,9 @@ static int r8152_poll(struct napi_struct *napi, int budget)
                 napi_complete(napi);
                 if (!list_empty(&tp->rx_done))
                         napi_schedule(napi);
+                else if (!skb_queue_empty(&tp->tx_queue) &&
+                         !list_empty(&tp->tx_free))
+                        napi_schedule(napi);
         }
 
         return work_done;
@@ -3155,10 +3158,13 @@ static void set_carrier(struct r8152 *tp)
                 if (!netif_carrier_ok(netdev)) {
                         tp->rtl_ops.enable(tp);
                         set_bit(RTL8152_SET_RX_MODE, &tp->flags);
+                        netif_stop_queue(netdev);
                         napi_disable(&tp->napi);
                         netif_carrier_on(netdev);
                         rtl_start_rx(tp);
                         napi_enable(&tp->napi);
+                        netif_wake_queue(netdev);
+                        netif_info(tp, link, netdev, "carrier on\n");
                 }
         } else {
                 if (netif_carrier_ok(netdev)) {
@@ -3166,6 +3172,7 @@ static void set_carrier(struct r8152 *tp)
                         napi_disable(&tp->napi);
                         tp->rtl_ops.disable(tp);
                         napi_enable(&tp->napi);
+                        netif_info(tp, link, netdev, "carrier off\n");
                 }
         }
 }
@@ -3515,12 +3522,12 @@ static int rtl8152_pre_reset(struct usb_interface *intf)
         if (!netif_running(netdev))
                 return 0;
 
+        netif_stop_queue(netdev);
         napi_disable(&tp->napi);
         clear_bit(WORK_ENABLE, &tp->flags);
         usb_kill_urb(tp->intr_urb);
         cancel_delayed_work_sync(&tp->schedule);
         if (netif_carrier_ok(netdev)) {
-                netif_stop_queue(netdev);
                 mutex_lock(&tp->control);
                 tp->rtl_ops.disable(tp);
                 mutex_unlock(&tp->control);
@@ -3545,12 +3552,17 @@ static int rtl8152_post_reset(struct usb_interface *intf)
         if (netif_carrier_ok(netdev)) {
                 mutex_lock(&tp->control);
                 tp->rtl_ops.enable(tp);
+                rtl_start_rx(tp);
                 rtl8152_set_rx_mode(netdev);
                 mutex_unlock(&tp->control);
-                netif_wake_queue(netdev);
         }
 
         napi_enable(&tp->napi);
+        netif_wake_queue(netdev);
+        usb_submit_urb(tp->intr_urb, GFP_KERNEL);
+
+        if (!list_empty(&tp->rx_done))
+                napi_schedule(&tp->napi);
 
         return 0;
 }
@@ -3572,6 +3584,8 @@ static bool delay_autosuspend(struct r8152 *tp)
          */
         if (!sw_linking && tp->rtl_ops.in_nway(tp))
                 return true;
+        else if (!skb_queue_empty(&tp->tx_queue))
+                return true;
         else
                 return false;
 }
@@ -3581,10 +3595,15 @@ static int rtl8152_rumtime_suspend(struct r8152 *tp)
         struct net_device *netdev = tp->netdev;
         int ret = 0;
 
+        set_bit(SELECTIVE_SUSPEND, &tp->flags);
+        smp_mb__after_atomic();
+
         if (netif_running(netdev) && test_bit(WORK_ENABLE, &tp->flags)) {
                 u32 rcr = 0;
 
                 if (delay_autosuspend(tp)) {
+                        clear_bit(SELECTIVE_SUSPEND, &tp->flags);
+                        smp_mb__after_atomic();
                         ret = -EBUSY;
                         goto out1;
                 }
@@ -3601,6 +3620,8 @@ static int rtl8152_rumtime_suspend(struct r8152 *tp)
                         if (!(ocp_data & RXFIFO_EMPTY)) {
                                 rxdy_gated_en(tp, false);
                                 ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RCR, rcr);
+                                clear_bit(SELECTIVE_SUSPEND, &tp->flags);
+                                smp_mb__after_atomic();
                                 ret = -EBUSY;
                                 goto out1;
                         }
@@ -3620,8 +3641,6 @@ static int rtl8152_rumtime_suspend(struct r8152 *tp)
                 }
         }
 
-        set_bit(SELECTIVE_SUSPEND, &tp->flags);
-
 out1:
         return ret;
 }
@@ -3677,12 +3696,15 @@ static int rtl8152_resume(struct usb_interface *intf)
         if (netif_running(tp->netdev) && tp->netdev->flags & IFF_UP) {
                 if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
                         tp->rtl_ops.autosuspend_en(tp, false);
-                        clear_bit(SELECTIVE_SUSPEND, &tp->flags);
                         napi_disable(&tp->napi);
                         set_bit(WORK_ENABLE, &tp->flags);
                         if (netif_carrier_ok(tp->netdev))
                                 rtl_start_rx(tp);
                         napi_enable(&tp->napi);
+                        clear_bit(SELECTIVE_SUSPEND, &tp->flags);
+                        smp_mb__after_atomic();
+                        if (!list_empty(&tp->rx_done))
+                                napi_schedule(&tp->napi);
                 } else {
                         tp->rtl_ops.up(tp);
                         netif_carrier_off(tp->netdev);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 4a105006ca63..765c2d6358da 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -48,8 +48,16 @@ module_param(gso, bool, 0444);
  */
 DECLARE_EWMA(pkt_len, 1, 64)
 
+/* With mergeable buffers we align buffer address and use the low bits to
+ * encode its true size. Buffer size is up to 1 page so we need to align to
+ * square root of page size to ensure we reserve enough bits to encode the true
+ * size.
+ */
+#define MERGEABLE_BUFFER_MIN_ALIGN_SHIFT ((PAGE_SHIFT + 1) / 2)
+
 /* Minimum alignment for mergeable packet buffers. */
-#define MERGEABLE_BUFFER_ALIGN max(L1_CACHE_BYTES, 256)
+#define MERGEABLE_BUFFER_ALIGN max(L1_CACHE_BYTES, \
+                                   1 << MERGEABLE_BUFFER_MIN_ALIGN_SHIFT)
 
 #define VIRTNET_DRIVER_VERSION "1.0.0"
 
@@ -1104,7 +1112,7 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb)
                 hdr = skb_vnet_hdr(skb);
 
         if (virtio_net_hdr_from_skb(skb, &hdr->hdr,
-                                    virtio_is_little_endian(vi->vdev)))
+                                    virtio_is_little_endian(vi->vdev), false))
                 BUG();
 
         if (vi->mergeable_rx_bufs)
@@ -1707,6 +1715,11 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog)
         u16 xdp_qp = 0, curr_qp;
         int i, err;
 
+        if (prog && prog->xdp_adjust_head) {
+                netdev_warn(dev, "Does not support bpf_xdp_adjust_head()\n");
+                return -EOPNOTSUPP;
+        }
+
         if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO4) ||
             virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO6) ||
             virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_ECN) ||
@@ -1890,8 +1903,12 @@ static void free_receive_page_frags(struct virtnet_info *vi)
                         put_page(vi->rq[i].alloc_frag.page);
 }
 
-static bool is_xdp_queue(struct virtnet_info *vi, int q)
+static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q)
 {
+        /* For small receive mode always use kfree_skb variants */
+        if (!vi->mergeable_rx_bufs)
+                return false;
+
         if (q < (vi->curr_queue_pairs - vi->xdp_queue_pairs))
                 return false;
         else if (q < vi->curr_queue_pairs)
@@ -1908,7 +1925,7 @@ static void free_unused_bufs(struct virtnet_info *vi)
         for (i = 0; i < vi->max_queue_pairs; i++) {
                 struct virtqueue *vq = vi->sq[i].vq;
                 while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) {
-                        if (!is_xdp_queue(vi, i))
+                        if (!is_xdp_raw_buffer_queue(vi, i))
                                 dev_kfree_skb(buf);
                         else
                                 put_page(virt_to_head_page(buf));
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index ca7196c40060..50b62db213b0 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2268,7 +2268,7 @@ static void vxlan_cleanup(unsigned long arg)
                                 = container_of(p, struct vxlan_fdb, hlist);
                         unsigned long timeout;
 
-                        if (f->state & NUD_PERMANENT)
+                        if (f->state & (NUD_PERMANENT | NUD_NOARP))
                                 continue;
 
                         timeout = f->used + vxlan->cfg.age_interval * HZ;
@@ -2354,7 +2354,7 @@ static int vxlan_open(struct net_device *dev)
 }
 
 /* Purge the forwarding table */
-static void vxlan_flush(struct vxlan_dev *vxlan)
+static void vxlan_flush(struct vxlan_dev *vxlan, bool do_all)
 {
         unsigned int h;
 
@@ -2364,6 +2364,8 @@ static void vxlan_flush(struct vxlan_dev *vxlan)
                 hlist_for_each_safe(p, n, &vxlan->fdb_head[h]) {
                         struct vxlan_fdb *f
                                 = container_of(p, struct vxlan_fdb, hlist);
+                        if (!do_all && (f->state & (NUD_PERMANENT | NUD_NOARP)))
+                                continue;
                         /* the all_zeros_mac entry is deleted at vxlan_uninit */
                         if (!is_zero_ether_addr(f->eth_addr))
                                 vxlan_fdb_destroy(vxlan, f);
@@ -2385,7 +2387,7 @@ static int vxlan_stop(struct net_device *dev)
 
         del_timer_sync(&vxlan->age_timer);
 
-        vxlan_flush(vxlan);
+        vxlan_flush(vxlan, false);
         vxlan_sock_release(vxlan);
 
         return ret;
@@ -2890,7 +2892,7 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
         memcpy(&vxlan->cfg, conf, sizeof(*conf));
         if (!vxlan->cfg.dst_port) {
                 if (conf->flags & VXLAN_F_GPE)
-                        vxlan->cfg.dst_port = 4790; /* IANA assigned VXLAN-GPE port */
+                        vxlan->cfg.dst_port = htons(4790); /* IANA VXLAN-GPE port */
                 else
                         vxlan->cfg.dst_port = default_port;
         }
@@ -3058,6 +3060,8 @@ static void vxlan_dellink(struct net_device *dev, struct list_head *head)
         struct vxlan_dev *vxlan = netdev_priv(dev);
         struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
 
+        vxlan_flush(vxlan, true);
+
         spin_lock(&vn->sock_lock);
         if (!hlist_unhashed(&vxlan->hlist))
                 hlist_del_rcu(&vxlan->hlist);
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
index d02ca1491d16..8d3e53fac1da 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
@@ -91,7 +91,7 @@
 
 #define IWL8000_FW_PRE "iwlwifi-8000C-"
 #define IWL8000_MODULE_FIRMWARE(api) \
-        IWL8000_FW_PRE "-" __stringify(api) ".ucode"
+        IWL8000_FW_PRE __stringify(api) ".ucode"
 
 #define IWL8265_FW_PRE "iwlwifi-8265-"
 #define IWL8265_MODULE_FIRMWARE(api) \
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 636c8b03e318..09e9e2e3ed04 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1164,9 +1164,10 @@ static void iwl_mvm_realloc_queues_after_restart(struct iwl_mvm *mvm,
                 .frame_limit = IWL_FRAME_LIMIT,
         };
 
-        /* Make sure reserved queue is still marked as such (or allocated) */
-        mvm->queue_info[mvm_sta->reserved_queue].status =
-                IWL_MVM_QUEUE_RESERVED;
+        /* Make sure reserved queue is still marked as such (if allocated) */
+        if (mvm_sta->reserved_queue != IEEE80211_INVAL_HW_QUEUE)
+                mvm->queue_info[mvm_sta->reserved_queue].status =
+                        IWL_MVM_QUEUE_RESERVED;
 
         for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
                 struct iwl_mvm_tid_data *tid_data = &mvm_sta->tid_data[i];
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index 63a051be832e..bec7d9c46087 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -843,8 +843,10 @@ static void iwl_mvm_thermal_zone_unregister(struct iwl_mvm *mvm)
                 return;
 
         IWL_DEBUG_TEMP(mvm, "Thermal zone device unregister\n");
-        thermal_zone_device_unregister(mvm->tz_device.tzone);
-        mvm->tz_device.tzone = NULL;
+        if (mvm->tz_device.tzone) {
+                thermal_zone_device_unregister(mvm->tz_device.tzone);
+                mvm->tz_device.tzone = NULL;
+        }
 }
 
 static void iwl_mvm_cooling_device_unregister(struct iwl_mvm *mvm)
@@ -853,8 +855,10 @@ static void iwl_mvm_cooling_device_unregister(struct iwl_mvm *mvm)
                 return;
 
         IWL_DEBUG_TEMP(mvm, "Cooling device unregister\n");
-        thermal_cooling_device_unregister(mvm->cooling_dev.cdev);
-        mvm->cooling_dev.cdev = NULL;
+        if (mvm->cooling_dev.cdev) {
+                thermal_cooling_device_unregister(mvm->cooling_dev.cdev);
+                mvm->cooling_dev.cdev = NULL;
+        }
 }
 #endif /* CONFIG_THERMAL */
 
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index e30ffd29b7e9..579521327b03 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -221,18 +221,18 @@ static struct net_device_stats *xenvif_get_stats(struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->num_queues;
         unsigned long rx_bytes = 0;
         unsigned long rx_packets = 0;
         unsigned long tx_bytes = 0;
         unsigned long tx_packets = 0;
         unsigned int index;
 
+        spin_lock(&vif->lock);
         if (vif->queues == NULL)
                 goto out;
 
         /* Aggregate tx and rx stats from each queue */
-        for (index = 0; index < num_queues; ++index) {
+        for (index = 0; index < vif->num_queues; ++index) {
                 queue = &vif->queues[index];
                 rx_bytes += queue->stats.rx_bytes;
                 rx_packets += queue->stats.rx_packets;
@@ -241,6 +241,8 @@ static struct net_device_stats *xenvif_get_stats(struct net_device *dev)
         }
 
 out:
+        spin_unlock(&vif->lock);
+
         vif->dev->stats.rx_bytes = rx_bytes;
         vif->dev->stats.rx_packets = rx_packets;
         vif->dev->stats.tx_bytes = tx_bytes;
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 3124eaec9427..85b742e1c42f 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -493,11 +493,22 @@ static int backend_create_xenvif(struct backend_info *be)
 static void backend_disconnect(struct backend_info *be)
 {
         if (be->vif) {
+                unsigned int queue_index;
+
                 xen_unregister_watchers(be->vif);
 #ifdef CONFIG_DEBUG_FS
                 xenvif_debugfs_delif(be->vif);
 #endif /* CONFIG_DEBUG_FS */
                 xenvif_disconnect_data(be->vif);
+                for (queue_index = 0; queue_index < be->vif->num_queues; ++queue_index)
+                        xenvif_deinit_queue(&be->vif->queues[queue_index]);
+
+                spin_lock(&be->vif->lock);
+                vfree(be->vif->queues);
+                be->vif->num_queues = 0;
+                be->vif->queues = NULL;
+                spin_unlock(&be->vif->lock);
+
                 xenvif_disconnect_ctrl(be->vif);
         }
 }
@@ -1034,6 +1045,8 @@ static void connect(struct backend_info *be)
 err:
         if (be->vif->num_queues > 0)
                 xenvif_disconnect_data(be->vif); /* Clean up existing queues */
+        for (queue_index = 0; queue_index < be->vif->num_queues; ++queue_index)
+                xenvif_deinit_queue(&be->vif->queues[queue_index]);
         vfree(be->vif->queues);
         be->vif->queues = NULL;
         be->vif->num_queues = 0;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index a479cd99911d..8315fe73ecd0 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -321,7 +321,7 @@ static void xennet_alloc_rx_buffers(struct netfront_queue *queue)
         queue->rx.req_prod_pvt = req_prod;
 
         /* Not enough requests? Try again later. */
-        if (req_prod - queue->rx.rsp_cons < NET_RX_SLOTS_MIN) {
+        if (req_prod - queue->rx.sring->req_prod < NET_RX_SLOTS_MIN) {
                 mod_timer(&queue->rx_refill_timer, jiffies + (HZ/10));
                 return;
         }
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index fcc9dcfdf675..e65041c640cb 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1663,13 +1663,13 @@ nvme_fc_map_data(struct nvme_fc_ctrl *ctrl, struct request *rq,
                 return 0;
 
         freq->sg_table.sgl = freq->first_sgl;
-        ret = sg_alloc_table_chained(&freq->sg_table, rq->nr_phys_segments,
-                        freq->sg_table.sgl);
+        ret = sg_alloc_table_chained(&freq->sg_table,
+                        blk_rq_nr_phys_segments(rq), freq->sg_table.sgl);
         if (ret)
                 return -ENOMEM;
 
         op->nents = blk_rq_map_sg(rq->q, rq, freq->sg_table.sgl);
-        WARN_ON(op->nents > rq->nr_phys_segments);
+        WARN_ON(op->nents > blk_rq_nr_phys_segments(rq));
         dir = (rq_data_dir(rq) == WRITE) ? DMA_TO_DEVICE : DMA_FROM_DEVICE;
         freq->sg_cnt = fc_dma_map_sg(ctrl->lport->dev, freq->sg_table.sgl,
                                 op->nents, dir);
diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index 6f5074153dcd..be8c800078e2 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -631,6 +631,7 @@ static void nvmet_subsys_release(struct config_item *item)
 {
         struct nvmet_subsys *subsys = to_subsys(item);
 
+        nvmet_subsys_del_ctrls(subsys);
         nvmet_subsys_put(subsys);
 }
 
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index b1d66ed655c9..fc5ba2f9e15f 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -200,7 +200,7 @@ static void nvmet_keep_alive_timer(struct work_struct *work)
         pr_err("ctrl %d keep-alive timer (%d seconds) expired!\n",
                 ctrl->cntlid, ctrl->kato);
 
-        ctrl->ops->delete_ctrl(ctrl);
+        nvmet_ctrl_fatal_error(ctrl);
 }
 
 static void nvmet_start_keep_alive_timer(struct nvmet_ctrl *ctrl)
@@ -816,6 +816,9 @@ static void nvmet_ctrl_free(struct kref *ref)
         list_del(&ctrl->subsys_entry);
         mutex_unlock(&subsys->lock);
 
+        flush_work(&ctrl->async_event_work);
+        cancel_work_sync(&ctrl->fatal_err_work);
+
         ida_simple_remove(&subsys->cntlid_ida, ctrl->cntlid);
         nvmet_subsys_put(subsys);
 
@@ -935,6 +938,16 @@ static void nvmet_subsys_free(struct kref *ref)
         kfree(subsys);
 }
 
+void nvmet_subsys_del_ctrls(struct nvmet_subsys *subsys)
+{
+        struct nvmet_ctrl *ctrl;
+
+        mutex_lock(&subsys->lock);
+        list_for_each_entry(ctrl, &subsys->ctrls, subsys_entry)
+                ctrl->ops->delete_ctrl(ctrl);
+        mutex_unlock(&subsys->lock);
+}
+
 void nvmet_subsys_put(struct nvmet_subsys *subsys)
 {
         kref_put(&subsys->ref, nvmet_subsys_free);
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 173e842f19c9..ba57f9852bde 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1314,7 +1314,7 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport,
                         (struct fcnvme_ls_disconnect_rqst *)iod->rqstbuf;
         struct fcnvme_ls_disconnect_acc *acc =
                         (struct fcnvme_ls_disconnect_acc *)iod->rspbuf;
-        struct nvmet_fc_tgt_queue *queue;
+        struct nvmet_fc_tgt_queue *queue = NULL;
         struct nvmet_fc_tgt_assoc *assoc;
         int ret = 0;
         bool del_assoc = false;
@@ -1348,7 +1348,18 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport,
                 assoc = nvmet_fc_find_target_assoc(tgtport,
                                 be64_to_cpu(rqst->associd.association_id));
                 iod->assoc = assoc;
-                if (!assoc)
+                if (assoc) {
+                        if (rqst->discon_cmd.scope ==
+                                        FCNVME_DISCONN_CONNECTION) {
+                                queue = nvmet_fc_find_target_queue(tgtport,
+                                                be64_to_cpu(
+                                                        rqst->discon_cmd.id));
+                                if (!queue) {
+                                        nvmet_fc_tgt_a_put(assoc);
+                                        ret = VERR_NO_CONN;
+                                }
+                        }
+                } else
                         ret = VERR_NO_ASSOC;
         }
 
@@ -1373,21 +1384,18 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport,
                         FCNVME_LS_DISCONNECT);
 
 
-        if (rqst->discon_cmd.scope == FCNVME_DISCONN_CONNECTION) {
-                queue = nvmet_fc_find_target_queue(tgtport,
-                                        be64_to_cpu(rqst->discon_cmd.id));
-                if (queue) {
-                        int qid = queue->qid;
+        /* are we to delete a Connection ID (queue) */
+        if (queue) {
+                int qid = queue->qid;
 
-                        nvmet_fc_delete_target_queue(queue);
+                nvmet_fc_delete_target_queue(queue);
 
-                        /* release the get taken by find_target_queue */
-                        nvmet_fc_tgt_q_put(queue);
+                /* release the get taken by find_target_queue */
+                nvmet_fc_tgt_q_put(queue);
 
-                        /* tear association down if io queue terminated */
-                        if (!qid)
-                                del_assoc = true;
-                }
+                /* tear association down if io queue terminated */
+                if (!qid)
+                        del_assoc = true;
         }
 
         /* release get taken in nvmet_fc_find_target_assoc */
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 23d5eb1c944f..cc7ad06b43a7 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -282,6 +282,7 @@ void nvmet_ctrl_put(struct nvmet_ctrl *ctrl);
 struct nvmet_subsys *nvmet_subsys_alloc(const char *subsysnqn,
                 enum nvme_subsys_type type);
 void nvmet_subsys_put(struct nvmet_subsys *subsys);
+void nvmet_subsys_del_ctrls(struct nvmet_subsys *subsys);
 
 struct nvmet_ns *nvmet_find_namespace(struct nvmet_ctrl *ctrl, __le32 nsid);
 void nvmet_put_namespace(struct nvmet_ns *ns);
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 8c3760a78ac0..60990220bd83 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -438,6 +438,10 @@ static int nvmet_rdma_post_recv(struct nvmet_rdma_device *ndev,
 {
         struct ib_recv_wr *bad_wr;
 
+        ib_dma_sync_single_for_device(ndev->device,
+                cmd->sge[0].addr, cmd->sge[0].length,
+                DMA_FROM_DEVICE);
+
         if (ndev->srq)
                 return ib_post_srq_recv(ndev->srq, &cmd->wr, &bad_wr);
         return ib_post_recv(cmd->queue->cm_id->qp, &cmd->wr, &bad_wr);
@@ -538,6 +542,11 @@ static void nvmet_rdma_queue_response(struct nvmet_req *req)
                 first_wr = &rsp->send_wr;
 
         nvmet_rdma_post_recv(rsp->queue->dev, rsp->cmd);
+
+        ib_dma_sync_single_for_device(rsp->queue->dev->device,
+                rsp->send_sge.addr, rsp->send_sge.length,
+                DMA_TO_DEVICE);
+
         if (ib_post_send(cm_id->qp, first_wr, &bad_wr)) {
                 pr_err("sending cmd response failed\n");
                 nvmet_rdma_release_rsp(rsp);
@@ -698,6 +707,14 @@ static void nvmet_rdma_handle_command(struct nvmet_rdma_queue *queue,
         cmd->n_rdma = 0;
         cmd->req.port = queue->port;
 
+
+        ib_dma_sync_single_for_cpu(queue->dev->device,
+                cmd->cmd->sge[0].addr, cmd->cmd->sge[0].length,
+                DMA_FROM_DEVICE);
+        ib_dma_sync_single_for_cpu(queue->dev->device,
+                cmd->send_sge.addr, cmd->send_sge.length,
+                DMA_TO_DEVICE);
+
         if (!nvmet_req_init(&cmd->req, &queue->nvme_cq,
                         &queue->nvme_sq, &nvmet_rdma_ops))
                 return;
diff --git a/drivers/parport/parport_gsc.c b/drivers/parport/parport_gsc.c
index dd6d4ccb41e4..3858b87fd0bb 100644
--- a/drivers/parport/parport_gsc.c
+++ b/drivers/parport/parport_gsc.c
@@ -293,7 +293,7 @@ struct parport *parport_gsc_probe_port(unsigned long base,
                 p->irq = PARPORT_IRQ_NONE;
         }
         if (p->irq != PARPORT_IRQ_NONE) {
-                printk(", irq %d", p->irq);
+                pr_cont(", irq %d", p->irq);
 
                 if (p->dma == PARPORT_DMA_AUTO) {
                         p->dma = PARPORT_DMA_NONE;
@@ -303,8 +303,8 @@ struct parport *parport_gsc_probe_port(unsigned long base,
                                            is mandatory (see above) */
                 p->dma = PARPORT_DMA_NONE;
 
-        printk(" [");
-#define printmode(x) {if(p->modes&PARPORT_MODE_##x){printk("%s%s",f?",":"",#x);f++;}}
+        pr_cont(" [");
+#define printmode(x) {if(p->modes&PARPORT_MODE_##x){pr_cont("%s%s",f?",":"",#x);f++;}}
         {
                 int f = 0;
                 printmode(PCSPP);
@@ -315,7 +315,7 @@ struct parport *parport_gsc_probe_port(unsigned long base,
 //              printmode(DMA);
         }
 #undef printmode
-        printk("]\n");
+        pr_cont("]\n");
 
         if (p->irq != PARPORT_IRQ_NONE) {
                 if (request_irq (p->irq, parport_irq_handler,
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 17ac1dce3286..3dd8bcbb3011 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -532,25 +532,32 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev)
         link = kzalloc(sizeof(*link), GFP_KERNEL);
         if (!link)
                 return NULL;
+
         INIT_LIST_HEAD(&link->sibling);
         INIT_LIST_HEAD(&link->children);
         INIT_LIST_HEAD(&link->link);
         link->pdev = pdev;
-        if (pci_pcie_type(pdev) != PCI_EXP_TYPE_ROOT_PORT) {
+
+        /*
+         * Root Ports and PCI/PCI-X to PCIe Bridges are roots of PCIe
+         * hierarchies.
+         */
+        if (pci_pcie_type(pdev) == PCI_EXP_TYPE_ROOT_PORT ||
+            pci_pcie_type(pdev) == PCI_EXP_TYPE_PCIE_BRIDGE) {
+                link->root = link;
+        } else {
                 struct pcie_link_state *parent;
+
                 parent = pdev->bus->parent->self->link_state;
                 if (!parent) {
                         kfree(link);
                         return NULL;
                 }
+
                 link->parent = parent;
+                link->root = link->parent->root;
                 list_add(&link->link, &parent->children);
         }
-        /* Setup a pointer to the root port link */
-        if (!link->parent)
-                link->root = link;
-        else
-                link->root = link->parent->root;
 
         list_add(&link->sibling, &link_list);
         pdev->link_state = link;
diff --git a/drivers/pinctrl/berlin/berlin-bg4ct.c b/drivers/pinctrl/berlin/berlin-bg4ct.c
index 09172043d589..c617ec49e9ed 100644
--- a/drivers/pinctrl/berlin/berlin-bg4ct.c
+++ b/drivers/pinctrl/berlin/berlin-bg4ct.c
@@ -217,7 +217,7 @@ static const struct berlin_desc_group berlin4ct_soc_pinctrl_groups[] = {
         BERLIN_PINCTRL_GROUP("SCRD0_CRD_PRES", 0xc, 0x3, 0x15,
                         BERLIN_PINCTRL_FUNCTION(0x0, "gpio"), /* GPIO20 */
                         BERLIN_PINCTRL_FUNCTION(0x1, "scrd0"), /* crd pres */
-                        BERLIN_PINCTRL_FUNCTION(0x1, "sd1a")), /* DAT3 */
+                        BERLIN_PINCTRL_FUNCTION(0x3, "sd1a")), /* DAT3 */
         BERLIN_PINCTRL_GROUP("SPI1_SS0n", 0xc, 0x3, 0x18,
                         BERLIN_PINCTRL_FUNCTION(0x0, "spi1"), /* SS0n */
                         BERLIN_PINCTRL_FUNCTION(0x1, "gpio"), /* GPIO37 */
diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 37300634b7d2..d94aef17348b 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -731,16 +731,23 @@ static void __iomem *byt_gpio_reg(struct byt_gpio *vg, unsigned int offset,
                                   int reg)
 {
         struct byt_community *comm = byt_get_community(vg, offset);
-        u32 reg_offset = 0;
+        u32 reg_offset;
 
         if (!comm)
                 return NULL;
 
         offset -= comm->pin_base;
-        if (reg == BYT_INT_STAT_REG)
+        switch (reg) {
+        case BYT_INT_STAT_REG:
                 reg_offset = (offset / 32) * 4;
-        else
+                break;
+        case BYT_DEBOUNCE_REG:
+                reg_offset = 0;
+                break;
+        default:
                 reg_offset = comm->pad_map[offset] * 16;
+                break;
+        }
 
         return comm->reg_base + reg_offset + reg;
 }
@@ -1092,6 +1099,7 @@ static int byt_pin_config_get(struct pinctrl_dev *pctl_dev, unsigned int offset,
         enum pin_config_param param = pinconf_to_config_param(*config);
         void __iomem *conf_reg = byt_gpio_reg(vg, offset, BYT_CONF0_REG);
         void __iomem *val_reg = byt_gpio_reg(vg, offset, BYT_VAL_REG);
+        void __iomem *db_reg = byt_gpio_reg(vg, offset, BYT_DEBOUNCE_REG);
         unsigned long flags;
         u32 conf, pull, val, debounce;
         u16 arg = 0;
@@ -1128,7 +1136,7 @@ static int byt_pin_config_get(struct pinctrl_dev *pctl_dev, unsigned int offset,
                         return -EINVAL;
 
                 raw_spin_lock_irqsave(&vg->lock, flags);
-                debounce = readl(byt_gpio_reg(vg, offset, BYT_DEBOUNCE_REG));
+                debounce = readl(db_reg);
                 raw_spin_unlock_irqrestore(&vg->lock, flags);
 
                 switch (debounce & BYT_DEBOUNCE_PULSE_MASK) {
@@ -1176,6 +1184,7 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
         unsigned int param, arg;
         void __iomem *conf_reg = byt_gpio_reg(vg, offset, BYT_CONF0_REG);
         void __iomem *val_reg = byt_gpio_reg(vg, offset, BYT_VAL_REG);
+        void __iomem *db_reg = byt_gpio_reg(vg, offset, BYT_DEBOUNCE_REG);
         unsigned long flags;
         u32 conf, val, debounce;
         int i, ret = 0;
@@ -1238,36 +1247,44 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
 
                         break;
                 case PIN_CONFIG_INPUT_DEBOUNCE:
-                        debounce = readl(byt_gpio_reg(vg, offset,
-                                                      BYT_DEBOUNCE_REG));
-                        conf &= ~BYT_DEBOUNCE_PULSE_MASK;
+                        debounce = readl(db_reg);
+                        debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+
+                        if (arg)
+                                conf |= BYT_DEBOUNCE_EN;
+                        else
+                                conf &= ~BYT_DEBOUNCE_EN;
 
                         switch (arg) {
                         case 375:
-                                conf |= BYT_DEBOUNCE_PULSE_375US;
+                                debounce |= BYT_DEBOUNCE_PULSE_375US;
                                 break;
                         case 750:
-                                conf |= BYT_DEBOUNCE_PULSE_750US;
+                                debounce |= BYT_DEBOUNCE_PULSE_750US;
                                 break;
                         case 1500:
-                                conf |= BYT_DEBOUNCE_PULSE_1500US;
+                                debounce |= BYT_DEBOUNCE_PULSE_1500US;
                                 break;
                         case 3000:
-                                conf |= BYT_DEBOUNCE_PULSE_3MS;
+                                debounce |= BYT_DEBOUNCE_PULSE_3MS;
                                 break;
                         case 6000:
-                                conf |= BYT_DEBOUNCE_PULSE_6MS;
+                                debounce |= BYT_DEBOUNCE_PULSE_6MS;
                                 break;
                         case 12000:
-                                conf |= BYT_DEBOUNCE_PULSE_12MS;
+                                debounce |= BYT_DEBOUNCE_PULSE_12MS;
                                 break;
                         case 24000:
-                                conf |= BYT_DEBOUNCE_PULSE_24MS;
+                                debounce |= BYT_DEBOUNCE_PULSE_24MS;
                                 break;
                         default:
-                                ret = -EINVAL;
+                                if (arg)
+                                        ret = -EINVAL;
+                                break;
                         }
 
+                        if (!ret)
+                                writel(debounce, db_reg);
                         break;
                 default:
                         ret = -ENOTSUPP;
@@ -1606,7 +1623,9 @@ static void byt_gpio_irq_handler(struct irq_desc *desc)
                         continue;
                 }
 
+                raw_spin_lock(&vg->lock);
                 pending = readl(reg);
+                raw_spin_unlock(&vg->lock);
                 for_each_set_bit(pin, &pending, 32) {
                         virq = irq_find_mapping(vg->chip.irqdomain, base + pin);
                         generic_handle_irq(virq);
@@ -1617,6 +1636,8 @@ static void byt_gpio_irq_handler(struct irq_desc *desc)
 
 static void byt_gpio_irq_init_hw(struct byt_gpio *vg)
 {
+        struct gpio_chip *gc = &vg->chip;
+        struct device *dev = &vg->pdev->dev;
         void __iomem *reg;
         u32 base, value;
         int i;
@@ -1638,10 +1659,12 @@ static void byt_gpio_irq_init_hw(struct byt_gpio *vg)
                 }
 
                 value = readl(reg);
-                if ((value & BYT_PIN_MUX) == byt_get_gpio_mux(vg, i) &&
-                    !(value & BYT_DIRECT_IRQ_EN)) {
+                if (value & BYT_DIRECT_IRQ_EN) {
+                        clear_bit(i, gc->irq_valid_mask);
+                        dev_dbg(dev, "excluding GPIO %d from IRQ domain\n", i);
+                } else if ((value & BYT_PIN_MUX) == byt_get_gpio_mux(vg, i)) {
                         byt_gpio_clear_triggering(vg, i);
-                        dev_dbg(&vg->pdev->dev, "disabling GPIO %d\n", i);
+                        dev_dbg(dev, "disabling GPIO %d\n", i);
                 }
         }
 
@@ -1680,6 +1703,7 @@ static int byt_gpio_probe(struct byt_gpio *vg)
         gc->can_sleep   = false;
         gc->parent      = &vg->pdev->dev;
         gc->ngpio       = vg->soc_data->npins;
+        gc->irq_need_valid_mask = true;
 
 #ifdef CONFIG_PM_SLEEP
         vg->saved_context = devm_kcalloc(&vg->pdev->dev, gc->ngpio,
diff --git a/drivers/pinctrl/intel/pinctrl-broxton.c b/drivers/pinctrl/intel/pinctrl-broxton.c
index 59cb7a6fc5be..901b356b09d7 100644
--- a/drivers/pinctrl/intel/pinctrl-broxton.c
+++ b/drivers/pinctrl/intel/pinctrl-broxton.c
@@ -19,7 +19,7 @@
 
 #define BXT_PAD_OWN     0x020
 #define BXT_HOSTSW_OWN  0x080
-#define BXT_PADCFGLOCK  0x090
+#define BXT_PADCFGLOCK  0x060
 #define BXT_GPI_IE      0x110
 
 #define BXT_COMMUNITY(s, e)                             \
diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
index 1e139672f1af..6df35dcb29ae 100644
--- a/drivers/pinctrl/intel/pinctrl-intel.c
+++ b/drivers/pinctrl/intel/pinctrl-intel.c
@@ -353,6 +353,21 @@ static int intel_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned function,
         return 0;
 }
 
+static void __intel_gpio_set_direction(void __iomem *padcfg0, bool input)
+{
+        u32 value;
+
+        value = readl(padcfg0);
+        if (input) {
+                value &= ~PADCFG0_GPIORXDIS;
+                value |= PADCFG0_GPIOTXDIS;
+        } else {
+                value &= ~PADCFG0_GPIOTXDIS;
+                value |= PADCFG0_GPIORXDIS;
+        }
+        writel(value, padcfg0);
+}
+
 static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
                                      struct pinctrl_gpio_range *range,
                                      unsigned pin)
@@ -375,11 +390,11 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
         /* Disable SCI/SMI/NMI generation */
         value &= ~(PADCFG0_GPIROUTIOXAPIC | PADCFG0_GPIROUTSCI);
         value &= ~(PADCFG0_GPIROUTSMI | PADCFG0_GPIROUTNMI);
-        /* Disable TX buffer and enable RX (this will be input) */
-        value &= ~PADCFG0_GPIORXDIS;
-        value |= PADCFG0_GPIOTXDIS;
         writel(value, padcfg0);
 
+        /* Disable TX buffer and enable RX (this will be input) */
+        __intel_gpio_set_direction(padcfg0, true);
+
         raw_spin_unlock_irqrestore(&pctrl->lock, flags);
 
         return 0;
@@ -392,18 +407,11 @@ static int intel_gpio_set_direction(struct pinctrl_dev *pctldev,
         struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
         void __iomem *padcfg0;
         unsigned long flags;
-        u32 value;
 
         raw_spin_lock_irqsave(&pctrl->lock, flags);
 
         padcfg0 = intel_get_padcfg(pctrl, pin, PADCFG0);
-
-        value = readl(padcfg0);
-        if (input)
-                value |= PADCFG0_GPIOTXDIS;
-        else
-                value &= ~PADCFG0_GPIOTXDIS;
-        writel(value, padcfg0);
+        __intel_gpio_set_direction(padcfg0, input);
 
         raw_spin_unlock_irqrestore(&pctrl->lock, flags);
 
diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
index b21896126f76..4d4ef42a39b5 100644
--- a/drivers/pinctrl/intel/pinctrl-merrifield.c
+++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
@@ -794,6 +794,9 @@ static int mrfld_config_set(struct pinctrl_dev *pctldev, unsigned int pin,
         unsigned int i;
         int ret;
 
+        if (!mrfld_buf_available(mp, pin))
+                return -ENOTSUPP;
+
         for (i = 0; i < nconfigs; i++) {
                 switch (pinconf_to_config_param(configs[i])) {
                 case PIN_CONFIG_BIAS_DISABLE:
diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
index c3928aa3fefa..e0bca4df2a2f 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
@@ -253,9 +253,8 @@ static const unsigned int uart_tx_ao_a_pins[]	= { PIN(GPIOAO_0, 0) };
 static const unsigned int uart_rx_ao_a_pins[]   = { PIN(GPIOAO_1, 0) };
 static const unsigned int uart_cts_ao_a_pins[]  = { PIN(GPIOAO_2, 0) };
 static const unsigned int uart_rts_ao_a_pins[]  = { PIN(GPIOAO_3, 0) };
-static const unsigned int uart_tx_ao_b_pins[]   = { PIN(GPIOAO_0, 0) };
-static const unsigned int uart_rx_ao_b_pins[]   = { PIN(GPIOAO_1, 0),
-                                                    PIN(GPIOAO_5, 0) };
+static const unsigned int uart_tx_ao_b_pins[]   = { PIN(GPIOAO_4, 0) };
+static const unsigned int uart_rx_ao_b_pins[]   = { PIN(GPIOAO_5, 0) };
 static const unsigned int uart_cts_ao_b_pins[]  = { PIN(GPIOAO_2, 0) };
 static const unsigned int uart_rts_ao_b_pins[]  = { PIN(GPIOAO_3, 0) };
 
@@ -498,7 +497,7 @@ static struct meson_pmx_group meson_gxbb_aobus_groups[] = {
         GPIO_GROUP(GPIOAO_13, 0),
 
         /* bank AO */
-        GROUP(uart_tx_ao_b,     0,      26),
+        GROUP(uart_tx_ao_b,     0,      24),
         GROUP(uart_rx_ao_b,     0,      25),
         GROUP(uart_tx_ao_a,     0,      12),
         GROUP(uart_rx_ao_a,     0,      11),
diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
index 25694f7094c7..b69743b07a1d 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
@@ -214,9 +214,8 @@ static const unsigned int uart_tx_ao_a_pins[]	= { PIN(GPIOAO_0, 0) };
 static const unsigned int uart_rx_ao_a_pins[]   = { PIN(GPIOAO_1, 0) };
 static const unsigned int uart_cts_ao_a_pins[]  = { PIN(GPIOAO_2, 0) };
 static const unsigned int uart_rts_ao_a_pins[]  = { PIN(GPIOAO_3, 0) };
-static const unsigned int uart_tx_ao_b_pins[]   = { PIN(GPIOAO_0, 0) };
-static const unsigned int uart_rx_ao_b_pins[]   = { PIN(GPIOAO_1, 0),
-                                                    PIN(GPIOAO_5, 0) };
+static const unsigned int uart_tx_ao_b_pins[]   = { PIN(GPIOAO_4, 0) };
+static const unsigned int uart_rx_ao_b_pins[]   = { PIN(GPIOAO_5, 0) };
 static const unsigned int uart_cts_ao_b_pins[]  = { PIN(GPIOAO_2, 0) };
 static const unsigned int uart_rts_ao_b_pins[]  = { PIN(GPIOAO_3, 0) };
 
@@ -409,7 +408,7 @@ static struct meson_pmx_group meson_gxl_aobus_groups[] = {
         GPIO_GROUP(GPIOAO_9, 0),
 
         /* bank AO */
-        GROUP(uart_tx_ao_b,     0,      26),
+        GROUP(uart_tx_ao_b,     0,      24),
         GROUP(uart_rx_ao_b,     0,      25),
         GROUP(uart_tx_ao_a,     0,      12),
         GROUP(uart_rx_ao_a,     0,      11),
diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index c9a146948192..537b52055756 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -202,6 +202,8 @@ static void amd_gpio_dbg_show(struct seq_file *s, struct gpio_chip *gc)
                         i = 128;
                         pin_num = AMD_GPIO_PINS_BANK2 + i;
                         break;
+                default:
+                        return;
                 }
 
                 for (; i < pin_num; i++) {
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 0eb51e33cb1b..207a8de4e1ed 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -564,8 +564,7 @@ static int sunxi_pconf_group_set(struct pinctrl_dev *pctldev,
                         val = arg / 10 - 1;
                         break;
                 case PIN_CONFIG_BIAS_DISABLE:
-                        val = 0;
-                        break;
+                        continue;
                 case PIN_CONFIG_BIAS_PULL_UP:
                         if (arg == 0)
                                 return -EINVAL;
diff --git a/drivers/pinctrl/uniphier/pinctrl-uniphier-ld20.c b/drivers/pinctrl/uniphier/pinctrl-uniphier-ld20.c
index aa8bd9794683..96686336e3a3 100644
--- a/drivers/pinctrl/uniphier/pinctrl-uniphier-ld20.c
+++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-ld20.c
@@ -561,7 +561,7 @@ static const int ether_rgmii_muxvals[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
                                           0, 0, 0, 0};
 static const unsigned ether_rmii_pins[] = {30, 31, 32, 33, 34, 35, 36, 37, 39,
                                            41, 42, 45};
-static const int ether_rmii_muxvals[] = {1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1};
+static const int ether_rmii_muxvals[] = {0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1};
 static const unsigned i2c0_pins[] = {63, 64};
 static const int i2c0_muxvals[] = {0, 0};
 static const unsigned i2c1_pins[] = {65, 66};
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 410741acb3c9..f46ece2ce3c4 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -813,6 +813,7 @@ static void ideapad_acpi_notify(acpi_handle handle, u32 event, void *data)
                         case 8:
                         case 7:
                         case 6:
+                        case 1:
                                 ideapad_input_report(priv, vpc_bit);
                                 break;
                         case 5:
diff --git a/drivers/platform/x86/intel_mid_powerbtn.c b/drivers/platform/x86/intel_mid_powerbtn.c
index 1fc0de870ff8..361770568ad0 100644
--- a/drivers/platform/x86/intel_mid_powerbtn.c
+++ b/drivers/platform/x86/intel_mid_powerbtn.c
@@ -77,7 +77,7 @@ static int mfld_pb_probe(struct platform_device *pdev)
 
         input_set_capability(input, EV_KEY, KEY_POWER);
 
-        error = request_threaded_irq(irq, NULL, mfld_pb_isr, 0,
+        error = request_threaded_irq(irq, NULL, mfld_pb_isr, IRQF_ONESHOT,
                                      DRIVER_NAME, input);
         if (error) {
                 dev_err(&pdev->dev, "Unable to request irq %d for mfld power"
diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
index 97b4c3a219c0..25f15df5c2d7 100644
--- a/drivers/platform/x86/mlx-platform.c
+++ b/drivers/platform/x86/mlx-platform.c
@@ -326,7 +326,7 @@ static int __init mlxplat_init(void)
         return 0;
 
 fail_platform_mux_register:
-        for (i--; i > 0 ; i--)
+        while (--i >= 0)
                 platform_device_unregister(priv->pdev_mux[i]);
         platform_device_unregister(priv->pdev_i2c);
 fail_alloc:
diff --git a/drivers/platform/x86/surface3-wmi.c b/drivers/platform/x86/surface3-wmi.c
index cbf4d83a7271..25b176996cb7 100644
--- a/drivers/platform/x86/surface3-wmi.c
+++ b/drivers/platform/x86/surface3-wmi.c
@@ -139,7 +139,7 @@ static acpi_status s3_wmi_attach_spi_device(acpi_handle handle,
 
 static int s3_wmi_check_platform_device(struct device *dev, void *data)
 {
-        struct acpi_device *adev, *ts_adev;
+        struct acpi_device *adev, *ts_adev = NULL;
         acpi_handle handle;
         acpi_status status;
 
@@ -244,13 +244,11 @@ static int s3_wmi_remove(struct platform_device *device)
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int s3_wmi_resume(struct device *dev)
+static int __maybe_unused s3_wmi_resume(struct device *dev)
 {
         s3_wmi_send_lid_state();
         return 0;
 }
-#endif
 static SIMPLE_DEV_PM_OPS(s3_wmi_pm, NULL, s3_wmi_resume);
 
 static struct platform_driver s3_wmi_driver = {
diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
index e6a512ebeae2..a3ade9e4ef47 100644
--- a/drivers/regulator/axp20x-regulator.c
+++ b/drivers/regulator/axp20x-regulator.c
@@ -272,7 +272,7 @@ static const struct regulator_desc axp806_regulators[] = {
                         64, AXP806_DCDCD_V_CTRL, 0x3f, AXP806_PWR_OUT_CTRL1,
                         BIT(3)),
         AXP_DESC(AXP806, DCDCE, "dcdce", "vine", 1100, 3400, 100,
-                 AXP806_DCDCB_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(4)),
+                 AXP806_DCDCE_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(4)),
         AXP_DESC(AXP806, ALDO1, "aldo1", "aldoin", 700, 3300, 100,
                  AXP806_ALDO1_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(5)),
         AXP_DESC(AXP806, ALDO2, "aldo2", "aldoin", 700, 3400, 100,
diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
index a43b0e8a438d..988a7472c2ab 100644
--- a/drivers/regulator/fixed.c
+++ b/drivers/regulator/fixed.c
@@ -30,9 +30,6 @@
 #include <linux/of_gpio.h>
 #include <linux/regulator/of_regulator.h>
 #include <linux/regulator/machine.h>
-#include <linux/acpi.h>
-#include <linux/property.h>
-#include <linux/gpio/consumer.h>
 
 struct fixed_voltage_data {
         struct regulator_desc desc;
@@ -97,44 +94,6 @@ of_get_fixed_voltage_config(struct device *dev,
         return config;
 }
 
-/**
- * acpi_get_fixed_voltage_config - extract fixed_voltage_config structure info
- * @dev: device requesting for fixed_voltage_config
- * @desc: regulator description
- *
- * Populates fixed_voltage_config structure by extracting data through ACPI
- * interface, returns a pointer to the populated structure of NULL if memory
- * alloc fails.
- */
-static struct fixed_voltage_config *
-acpi_get_fixed_voltage_config(struct device *dev,
-                              const struct regulator_desc *desc)
-{
-        struct fixed_voltage_config *config;
-        const char *supply_name;
-        struct gpio_desc *gpiod;
-        int ret;
-
-        config = devm_kzalloc(dev, sizeof(*config), GFP_KERNEL);
-        if (!config)
-                return ERR_PTR(-ENOMEM);
-
-        ret = device_property_read_string(dev, "supply-name", &supply_name);
-        if (!ret)
-                config->supply_name = supply_name;
-
-        gpiod = gpiod_get(dev, "gpio", GPIOD_ASIS);
-        if (IS_ERR(gpiod))
-                return ERR_PTR(-ENODEV);
-
-        config->gpio = desc_to_gpio(gpiod);
-        config->enable_high = device_property_read_bool(dev,
-                                                        "enable-active-high");
-        gpiod_put(gpiod);
-
-        return config;
-}
-
 static struct regulator_ops fixed_voltage_ops = {
 };
 
@@ -155,11 +114,6 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev)
                                                      &drvdata->desc);
                 if (IS_ERR(config))
                         return PTR_ERR(config);
-        } else if (ACPI_HANDLE(&pdev->dev)) {
-                config = acpi_get_fixed_voltage_config(&pdev->dev,
-                                                       &drvdata->desc);
-                if (IS_ERR(config))
-                        return PTR_ERR(config);
         } else {
                 config = dev_get_platdata(&pdev->dev);
         }
diff --git a/drivers/regulator/twl6030-regulator.c b/drivers/regulator/twl6030-regulator.c
index 4864b9d742c0..716191046a70 100644
--- a/drivers/regulator/twl6030-regulator.c
+++ b/drivers/regulator/twl6030-regulator.c
@@ -452,7 +452,7 @@ static int twl6030smps_map_voltage(struct regulator_dev *rdev, int min_uV,
                         vsel = 62;
                 else if ((min_uV > 1800000) && (min_uV <= 1900000))
                         vsel = 61;
-                else if ((min_uV > 1350000) && (min_uV <= 1800000))
+                else if ((min_uV > 1500000) && (min_uV <= 1800000))
                         vsel = 60;
                 else if ((min_uV > 1350000) && (min_uV <= 1500000))
                         vsel = 59;
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index c93c5a8fba32..5dc673dc9487 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -1551,12 +1551,15 @@ config RTC_DRV_MPC5121
           will be called rtc-mpc5121.
 
 config RTC_DRV_JZ4740
-        bool "Ingenic JZ4740 SoC"
+        tristate "Ingenic JZ4740 SoC"
         depends on MACH_INGENIC || COMPILE_TEST
         help
           If you say yes here you get support for the Ingenic JZ47xx SoCs RTC
           controllers.
 
+          This driver can also be buillt as a module. If so, the module
+          will be called rtc-jz4740.
+
 config RTC_DRV_LPC24XX
         tristate "NXP RTC for LPC178x/18xx/408x/43xx"
         depends on ARCH_LPC18XX || COMPILE_TEST
diff --git a/drivers/rtc/rtc-jz4740.c b/drivers/rtc/rtc-jz4740.c
index 72918c1ba092..64989afffa3d 100644
--- a/drivers/rtc/rtc-jz4740.c
+++ b/drivers/rtc/rtc-jz4740.c
@@ -17,6 +17,7 @@
 #include <linux/clk.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/reboot.h>
@@ -294,7 +295,7 @@ static void jz4740_rtc_power_off(void)
                              JZ_REG_RTC_RESET_COUNTER, reset_counter_ticks);
 
         jz4740_rtc_poweroff(dev_for_power_off);
-        machine_halt();
+        kernel_halt();
 }
 
 static const struct of_device_id jz4740_rtc_of_match[] = {
@@ -302,6 +303,7 @@ static const struct of_device_id jz4740_rtc_of_match[] = {
         { .compatible = "ingenic,jz4780-rtc", .data = (void *)ID_JZ4780 },
         {},
 };
+MODULE_DEVICE_TABLE(of, jz4740_rtc_of_match);
 
 static int jz4740_rtc_probe(struct platform_device *pdev)
 {
@@ -429,6 +431,7 @@ static const struct platform_device_id jz4740_rtc_ids[] = {
         { "jz4780-rtc", ID_JZ4780 },
         {}
 };
+MODULE_DEVICE_TABLE(platform, jz4740_rtc_ids);
 
 static struct platform_driver jz4740_rtc_driver = {
         .probe   = jz4740_rtc_probe,
@@ -440,4 +443,9 @@ static struct platform_driver jz4740_rtc_driver = {
         .id_table = jz4740_rtc_ids,
 };
 
-builtin_platform_driver(jz4740_rtc_driver);
+module_platform_driver(jz4740_rtc_driver);
+
+MODULE_AUTHOR("Lars-Peter Clausen <lars@metafoo.de>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("RTC driver for the JZ4740 SoC\n");
+MODULE_ALIAS("platform:jz4740-rtc");
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 0b09638fa39b..1f5d92a25a49 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -836,6 +836,7 @@ static int sd_setup_write_same_cmnd(struct scsi_cmnd *cmd)
         struct bio *bio = rq->bio;
         sector_t sector = blk_rq_pos(rq);
         unsigned int nr_sectors = blk_rq_sectors(rq);
+        unsigned int nr_bytes = blk_rq_bytes(rq);
         int ret;
 
         if (sdkp->device->no_write_same)
@@ -868,7 +869,21 @@ static int sd_setup_write_same_cmnd(struct scsi_cmnd *cmd)
 
         cmd->transfersize = sdp->sector_size;
         cmd->allowed = SD_MAX_RETRIES;
-        return scsi_init_io(cmd);
+
+        /*
+         * For WRITE SAME the data transferred via the DATA OUT buffer is
+         * different from the amount of data actually written to the target.
+         *
+         * We set up __data_len to the amount of data transferred via the
+         * DATA OUT buffer so that blk_rq_map_sg sets up the proper S/G list
+         * to transfer a single sector of data first, but then reset it to
+         * the amount of data to be written right after so that the I/O path
+         * knows how much to actually write.
+         */
+        rq->__data_len = sdp->sector_size;
+        ret = scsi_init_io(cmd);
+        rq->__data_len = nr_bytes;
+        return ret;
 }
 
 static int sd_setup_flush_cmnd(struct scsi_cmnd *cmd)
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index ec91bd07f00a..c680d7641311 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -534,7 +534,9 @@ static int virtscsi_queuecommand(struct virtio_scsi *vscsi,
 {
         struct Scsi_Host *shost = virtio_scsi_host(vscsi->vdev);
         struct virtio_scsi_cmd *cmd = scsi_cmd_priv(sc);
+        unsigned long flags;
         int req_size;
+        int ret;
 
         BUG_ON(scsi_sg_count(sc) > shost->sg_tablesize);
 
@@ -562,8 +564,15 @@ static int virtscsi_queuecommand(struct virtio_scsi *vscsi,
                 req_size = sizeof(cmd->req.cmd);
         }
 
-        if (virtscsi_kick_cmd(req_vq, cmd, req_size, sizeof(cmd->resp.cmd)) != 0)
+        ret = virtscsi_kick_cmd(req_vq, cmd, req_size, sizeof(cmd->resp.cmd));
+        if (ret == -EIO) {
+                cmd->resp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET;
+                spin_lock_irqsave(&req_vq->vq_lock, flags);
+                virtscsi_complete_cmd(vscsi, cmd);
+                spin_unlock_irqrestore(&req_vq->vq_lock, flags);
+        } else if (ret != 0) {
                 return SCSI_MLQUEUE_HOST_BUSY;
+        }
         return 0;
 }
 
diff --git a/drivers/staging/greybus/timesync_platform.c b/drivers/staging/greybus/timesync_platform.c
index 113f3d6c4b3a..27f75b17679b 100644
--- a/drivers/staging/greybus/timesync_platform.c
+++ b/drivers/staging/greybus/timesync_platform.c
@@ -45,12 +45,18 @@ u32 gb_timesync_platform_get_clock_rate(void)
 
 int gb_timesync_platform_lock_bus(struct gb_timesync_svc *pdata)
 {
+        if (!arche_platform_change_state_cb)
+                return 0;
+
         return arche_platform_change_state_cb(ARCHE_PLATFORM_STATE_TIME_SYNC,
                                               pdata);
 }
 
 void gb_timesync_platform_unlock_bus(void)
 {
+        if (!arche_platform_change_state_cb)
+                return;
+
         arche_platform_change_state_cb(ARCHE_PLATFORM_STATE_ACTIVE, NULL);
 }
 
diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
index c4a508a124dc..541af5946203 100644
--- a/drivers/thermal/thermal_hwmon.c
+++ b/drivers/thermal/thermal_hwmon.c
@@ -59,6 +59,14 @@ static LIST_HEAD(thermal_hwmon_list);
 static DEFINE_MUTEX(thermal_hwmon_list_lock);
 
 static ssize_t
+name_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct thermal_hwmon_device *hwmon = dev_get_drvdata(dev);
+        return sprintf(buf, "%s\n", hwmon->type);
+}
+static DEVICE_ATTR_RO(name);
+
+static ssize_t
 temp_input_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
         int temperature;
@@ -157,12 +165,15 @@ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
 
         INIT_LIST_HEAD(&hwmon->tz_list);
         strlcpy(hwmon->type, tz->type, THERMAL_NAME_LENGTH);
-        hwmon->device = hwmon_device_register_with_info(NULL, hwmon->type,
-                                                        hwmon, NULL, NULL);
+        hwmon->device = hwmon_device_register(NULL);
         if (IS_ERR(hwmon->device)) {
                 result = PTR_ERR(hwmon->device);
                 goto free_mem;
         }
+        dev_set_drvdata(hwmon->device, hwmon);
+        result = device_create_file(hwmon->device, &dev_attr_name);
+        if (result)
+                goto free_mem;
 
  register_sys_interface:
         temp = kzalloc(sizeof(*temp), GFP_KERNEL);
@@ -211,8 +222,10 @@ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
  free_temp_mem:
         kfree(temp);
  unregister_name:
-        if (new_hwmon_device)
+        if (new_hwmon_device) {
+                device_remove_file(hwmon->device, &dev_attr_name);
                 hwmon_device_unregister(hwmon->device);
+        }
  free_mem:
         if (new_hwmon_device)
                 kfree(hwmon);
@@ -254,6 +267,7 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
         list_del(&hwmon->node);
         mutex_unlock(&thermal_hwmon_list_lock);
 
+        device_remove_file(hwmon->device, &dev_attr_name);
         hwmon_device_unregister(hwmon->device);
         kfree(hwmon);
 }
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index d2e50a27140c..24f9f98968a5 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* CBM - Flash disk */
         { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* WORLDE easy key (easykey.25) MIDI controller  */
+        { USB_DEVICE(0x0218, 0x0401), .driver_info =
+                        USB_QUIRK_CONFIG_INTF_STRINGS },
+
         /* HP 5300/5370C scanner */
         { USB_DEVICE(0x03f0, 0x0701), .driver_info =
                         USB_QUIRK_STRING_FETCH_255 },
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 5490fc51638e..fd80c1b9c823 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -2269,6 +2269,8 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
                 if (len < sizeof(*d) || h->interface >= ffs->interfaces_count)
                         return -EINVAL;
                 length = le32_to_cpu(d->dwSize);
+                if (len < length)
+                        return -EINVAL;
                 type = le32_to_cpu(d->dwPropertyDataType);
                 if (type < USB_EXT_PROP_UNICODE ||
                     type > USB_EXT_PROP_UNICODE_MULTI) {
@@ -2277,6 +2279,11 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
                         return -EINVAL;
                 }
                 pnl = le16_to_cpu(d->wPropertyNameLength);
+                if (length < 14 + pnl) {
+                        pr_vdebug("invalid os descriptor length: %d pnl:%d (descriptor %d)\n",
+                                  length, pnl, type);
+                        return -EINVAL;
+                }
                 pdl = le32_to_cpu(*(u32 *)((u8 *)data + 10 + pnl));
                 if (length != 14 + pnl + pdl) {
                         pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n",
@@ -2363,6 +2370,9 @@ static int __ffs_data_got_descs(struct ffs_data *ffs,
                 }
         }
         if (flags & (1 << i)) {
+                if (len < 4) {
+                        goto error;
+                }
                 os_descs_count = get_unaligned_le32(data);
                 data += 4;
                 len -= 4;
@@ -2435,7 +2445,8 @@ static int __ffs_data_got_strings(struct ffs_data *ffs,
 
         ENTER();
 
-        if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
+        if (unlikely(len < 16 ||
+                     get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
                      get_unaligned_le32(data + 4) != len))
                 goto error;
         str_count  = get_unaligned_le32(data + 8);
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index fca288bbc800..772f15821242 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -594,11 +594,11 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                                                 | MUSB_PORT_STAT_RESUME;
                                 musb->rh_timer = jiffies
                                         + msecs_to_jiffies(USB_RESUME_TIMEOUT);
-                                musb->need_finish_resume = 1;
-
                                 musb->xceiv->otg->state = OTG_STATE_A_HOST;
                                 musb->is_active = 1;
                                 musb_host_resume_root_hub(musb);
+                                schedule_delayed_work(&musb->finish_resume_work,
+                                        msecs_to_jiffies(USB_RESUME_TIMEOUT));
                                 break;
                         case OTG_STATE_B_WAIT_ACON:
                                 musb->xceiv->otg->state = OTG_STATE_B_PERIPHERAL;
@@ -1925,6 +1925,14 @@ static void musb_pm_runtime_check_session(struct musb *musb)
 static void musb_irq_work(struct work_struct *data)
 {
         struct musb *musb = container_of(data, struct musb, irq_work.work);
+        int error;
+
+        error = pm_runtime_get_sync(musb->controller);
+        if (error < 0) {
+                dev_err(musb->controller, "Could not enable: %i\n", error);
+
+                return;
+        }
 
         musb_pm_runtime_check_session(musb);
 
@@ -1932,6 +1940,9 @@ static void musb_irq_work(struct work_struct *data)
                 musb->xceiv_old_state = musb->xceiv->otg->state;
                 sysfs_notify(&musb->controller->kobj, NULL, "mode");
         }
+
+        pm_runtime_mark_last_busy(musb->controller);
+        pm_runtime_put_autosuspend(musb->controller);
 }
 
 static void musb_recover_from_babble(struct musb *musb)
@@ -2710,11 +2721,6 @@ static int musb_resume(struct device *dev)
         mask = MUSB_DEVCTL_BDEVICE | MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV;
         if ((devctl & mask) != (musb->context.devctl & mask))
                 musb->port1_status = 0;
-        if (musb->need_finish_resume) {
-                musb->need_finish_resume = 0;
-                schedule_delayed_work(&musb->finish_resume_work,
-                                      msecs_to_jiffies(USB_RESUME_TIMEOUT));
-        }
 
         /*
          * The USB HUB code expects the device to be in RPM_ACTIVE once it came
@@ -2766,12 +2772,6 @@ static int musb_runtime_resume(struct device *dev)
 
         musb_restore_context(musb);
 
-        if (musb->need_finish_resume) {
-                musb->need_finish_resume = 0;
-                schedule_delayed_work(&musb->finish_resume_work,
-                                msecs_to_jiffies(USB_RESUME_TIMEOUT));
-        }
-
         spin_lock_irqsave(&musb->lock, flags);
         error = musb_run_resume_work(musb);
         if (error)
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index ade902ea1221..ce5a18c98c6d 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -410,7 +410,6 @@ struct musb {
 
         /* is_suspended means USB B_PERIPHERAL suspend */
         unsigned                is_suspended:1;
-        unsigned                need_finish_resume :1;
 
         /* may_wakeup means remote wakeup is enabled */
         unsigned                may_wakeup:1;
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 7ce31a4c7e7f..42cc72e54c05 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2007,6 +2007,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 46fca6b75846..1db4b61bdf7b 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -49,6 +49,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
+        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) },
         { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) },
         { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
         { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID_UCSGT) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index e3b7af8adfb7..09d9be88209e 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -27,6 +27,7 @@
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
 #define ATEN_PRODUCT_ID         0x2008
+#define ATEN_PRODUCT_ID2        0x2118
 
 #define IODATA_VENDOR_ID        0x04bb
 #define IODATA_PRODUCT_ID       0x0a03
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 1bc6089b9008..696458db7e3c 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -124,6 +124,7 @@ static const struct usb_device_id id_table[] = {
         {USB_DEVICE(0x1410, 0xa021)},   /* Novatel Gobi 3000 Composite */
         {USB_DEVICE(0x413c, 0x8193)},   /* Dell Gobi 3000 QDL */
         {USB_DEVICE(0x413c, 0x8194)},   /* Dell Gobi 3000 Composite */
+        {USB_DEVICE(0x413c, 0x81a6)},   /* Dell DW5570 QDL (MC8805) */
         {USB_DEVICE(0x1199, 0x68a4)},   /* Sierra Wireless QDL */
         {USB_DEVICE(0x1199, 0x68a5)},   /* Sierra Wireless Modem */
         {USB_DEVICE(0x1199, 0x68a8)},   /* Sierra Wireless QDL */
diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
index c8823578a1b2..7690e5bf3cf1 100644
--- a/drivers/vfio/vfio_iommu_spapr_tce.c
+++ b/drivers/vfio/vfio_iommu_spapr_tce.c
@@ -1123,12 +1123,11 @@ static long tce_iommu_ioctl(void *iommu_data,
                 mutex_lock(&container->lock);
 
                 ret = tce_iommu_create_default_window(container);
-                if (ret)
-                        return ret;
-
-                ret = tce_iommu_create_window(container, create.page_shift,
-                                create.window_size, create.levels,
-                                &create.start_addr);
+                if (!ret)
+                        ret = tce_iommu_create_window(container,
+                                        create.page_shift,
+                                        create.window_size, create.levels,
+                                        &create.start_addr);
 
                 mutex_unlock(&container->lock);
 
@@ -1270,6 +1269,10 @@ static int tce_iommu_attach_group(void *iommu_data,
         /* pr_debug("tce_vfio: Attaching group #%u to iommu %p\n",
                         iommu_group_id(iommu_group), iommu_group); */
         table_group = iommu_group_get_iommudata(iommu_group);
+        if (!table_group) {
+                ret = -ENODEV;
+                goto unlock_exit;
+        }
 
         if (tce_groups_attached(container) && (!table_group->ops ||
                         !table_group->ops->take_ownership ||
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index d6432603880c..8f99fe08de02 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -130,14 +130,14 @@ static long vhost_get_vring_endian(struct vhost_virtqueue *vq, u32 idx,
 
 static void vhost_init_is_le(struct vhost_virtqueue *vq)
 {
-        if (vhost_has_feature(vq, VIRTIO_F_VERSION_1))
-                vq->is_le = true;
+        vq->is_le = vhost_has_feature(vq, VIRTIO_F_VERSION_1)
+                || virtio_legacy_is_little_endian();
 }
 #endif /* CONFIG_VHOST_CROSS_ENDIAN_LEGACY */
 
 static void vhost_reset_is_le(struct vhost_virtqueue *vq)
 {
-        vq->is_le = virtio_legacy_is_little_endian();
+        vhost_init_is_le(vq);
 }
 
 struct vhost_flush_struct {
@@ -1714,10 +1714,8 @@ int vhost_vq_init_access(struct vhost_virtqueue *vq)
         int r;
         bool is_le = vq->is_le;
 
-        if (!vq->private_data) {
-                vhost_reset_is_le(vq);
+        if (!vq->private_data)
                 return 0;
-        }
 
         vhost_init_is_le(vq);
 
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index bbbf588540ed..ce5e63d2c66a 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -373,6 +373,7 @@ static void vhost_vsock_handle_rx_kick(struct vhost_work *work)
 
 static int vhost_vsock_start(struct vhost_vsock *vsock)
 {
+        struct vhost_virtqueue *vq;
         size_t i;
         int ret;
 
@@ -383,19 +384,20 @@ static int vhost_vsock_start(struct vhost_vsock *vsock)
                 goto err;
 
         for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) {
-                struct vhost_virtqueue *vq = &vsock->vqs[i];
+                vq = &vsock->vqs[i];
 
                 mutex_lock(&vq->mutex);
 
                 if (!vhost_vq_access_ok(vq)) {
                         ret = -EFAULT;
-                        mutex_unlock(&vq->mutex);
                         goto err_vq;
                 }
 
                 if (!vq->private_data) {
                         vq->private_data = vsock;
-                        vhost_vq_init_access(vq);
+                        ret = vhost_vq_init_access(vq);
+                        if (ret)
+                                goto err_vq;
                 }
 
                 mutex_unlock(&vq->mutex);
@@ -405,8 +407,11 @@ static int vhost_vsock_start(struct vhost_vsock *vsock)
         return 0;
 
 err_vq:
+        vq->private_data = NULL;
+        mutex_unlock(&vq->mutex);
+
         for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) {
-                struct vhost_virtqueue *vq = &vsock->vqs[i];
+                vq = &vsock->vqs[i];
 
                 mutex_lock(&vq->mutex);
                 vq->private_data = NULL;
diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c
index f89245b8ba8e..68a113594808 100644
--- a/drivers/video/fbdev/core/fbcmap.c
+++ b/drivers/video/fbdev/core/fbcmap.c
@@ -163,17 +163,18 @@ void fb_dealloc_cmap(struct fb_cmap *cmap)
 
 int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
 {
-        int tooff = 0, fromoff = 0;
-        int size;
+        unsigned int tooff = 0, fromoff = 0;
+        size_t size;
 
         if (to->start > from->start)
                 fromoff = to->start - from->start;
         else
                 tooff = from->start - to->start;
-        size = to->len - tooff;
-        if (size > (int) (from->len - fromoff))
-                size = from->len - fromoff;
-        if (size <= 0)
+        if (fromoff >= from->len || tooff >= to->len)
+                return -EINVAL;
+
+        size = min_t(size_t, to->len - tooff, from->len - fromoff);
+        if (size == 0)
                 return -EINVAL;
         size *= sizeof(u16);
 
@@ -187,17 +188,18 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
 
 int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
 {
-        int tooff = 0, fromoff = 0;
-        int size;
+        unsigned int tooff = 0, fromoff = 0;
+        size_t size;
 
         if (to->start > from->start)
                 fromoff = to->start - from->start;
         else
                 tooff = from->start - to->start;
-        size = to->len - tooff;
-        if (size > (int) (from->len - fromoff))
-                size = from->len - fromoff;
-        if (size <= 0)
+        if (fromoff >= from->len || tooff >= to->len)
+                return -EINVAL;
+
+        size = min_t(size_t, to->len - tooff, from->len - fromoff);
+        if (size == 0)
                 return -EINVAL;
         size *= sizeof(u16);
 
diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index d47a2fcef818..c71fde5fe835 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -59,6 +59,7 @@
 #define pr_fmt(fmt) "virtio-mmio: " fmt
 
 #include <linux/acpi.h>
+#include <linux/dma-mapping.h>
 #include <linux/highmem.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
@@ -498,6 +499,7 @@ static int virtio_mmio_probe(struct platform_device *pdev)
         struct virtio_mmio_device *vm_dev;
         struct resource *mem;
         unsigned long magic;
+        int rc;
 
         mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (!mem)
@@ -547,9 +549,25 @@ static int virtio_mmio_probe(struct platform_device *pdev)
         }
         vm_dev->vdev.id.vendor = readl(vm_dev->base + VIRTIO_MMIO_VENDOR_ID);
 
-        if (vm_dev->version == 1)
+        if (vm_dev->version == 1) {
                 writel(PAGE_SIZE, vm_dev->base + VIRTIO_MMIO_GUEST_PAGE_SIZE);
 
+                rc = dma_set_mask(&pdev->dev, DMA_BIT_MASK(64));
+                /*
+                 * In the legacy case, ensure our coherently-allocated virtio
+                 * ring will be at an address expressable as a 32-bit PFN.
+                 */
+                if (!rc)
+                        dma_set_coherent_mask(&pdev->dev,
+                                              DMA_BIT_MASK(32 + PAGE_SHIFT));
+        } else {
+                rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
+        }
+        if (rc)
+                rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+        if (rc)
+                dev_warn(&pdev->dev, "Failed to enable 64-bit or 32-bit DMA.  Trying to continue, but this might not work.\n");
+
         platform_set_drvdata(pdev, vm_dev);
 
         return register_virtio_device(&vm_dev->vdev);
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index f905d6eeb048..f8afc6dcc29f 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -414,9 +414,9 @@ dma_addr_t xen_swiotlb_map_page(struct device *dev, struct page *page,
         if (map == SWIOTLB_MAP_ERROR)
                 return DMA_ERROR_CODE;
 
+        dev_addr = xen_phys_to_bus(map);
         xen_dma_map_page(dev, pfn_to_page(map >> PAGE_SHIFT),
                                         dev_addr, map & ~PAGE_MASK, size, dir, attrs);
-        dev_addr = xen_phys_to_bus(map);
 
         /*
          * Ensure that the address returned is DMA'ble
@@ -575,13 +575,14 @@ xen_swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl,
                                 sg_dma_len(sgl) = 0;
                                 return 0;
                         }
+                        dev_addr = xen_phys_to_bus(map);
                         xen_dma_map_page(hwdev, pfn_to_page(map >> PAGE_SHIFT),
                                                 dev_addr,
                                                 map & ~PAGE_MASK,
                                                 sg->length,
                                                 dir,
                                                 attrs);
-                        sg->dma_address = xen_phys_to_bus(map);
+                        sg->dma_address = dev_addr;
                 } else {
                         /* we are not interested in the dma_addr returned by
                          * xen_dma_map_page, only in the potential cache flushes executed
diff --git a/fs/Kconfig b/fs/Kconfig
index c2a377cdda2b..83eab52fb3f6 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -38,6 +38,7 @@ config FS_DAX
         bool "Direct Access (DAX) support"
         depends on MMU
         depends on !(ARM || MIPS || SPARC)
+        select FS_IOMAP
         help
           Direct Access (DAX) can be used on memory-backed block devices.
           If the block device supports DAX and the filesystem supports DAX,
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 5db5d1340d69..3c47614a4b32 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -331,7 +331,7 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
         struct blk_plug plug;
         struct blkdev_dio *dio;
         struct bio *bio;
-        bool is_read = (iov_iter_rw(iter) == READ);
+        bool is_read = (iov_iter_rw(iter) == READ), is_sync;
         loff_t pos = iocb->ki_pos;
         blk_qc_t qc = BLK_QC_T_NONE;
         int ret;
@@ -344,7 +344,7 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
         bio_get(bio); /* extra ref for the completion handler */
 
         dio = container_of(bio, struct blkdev_dio, bio);
-        dio->is_sync = is_sync_kiocb(iocb);
+        dio->is_sync = is_sync = is_sync_kiocb(iocb);
         if (dio->is_sync)
                 dio->waiter = current;
         else
@@ -398,7 +398,7 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
         }
         blk_finish_plug(&plug);
 
-        if (!dio->is_sync)
+        if (!is_sync)
                 return -EIOCBQUEUED;
 
         for (;;) {
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 4e024260ad71..1e861a063721 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3835,10 +3835,7 @@ cache_acl:
                 break;
         case S_IFDIR:
                 inode->i_fop = &btrfs_dir_file_operations;
-                if (root == fs_info->tree_root)
-                        inode->i_op = &btrfs_dir_ro_inode_operations;
-                else
-                        inode->i_op = &btrfs_dir_inode_operations;
+                inode->i_op = &btrfs_dir_inode_operations;
                 break;
         case S_IFLNK:
                 inode->i_op = &btrfs_symlink_inode_operations;
@@ -4505,8 +4502,19 @@ search_again:
                 if (found_type > min_type) {
                         del_item = 1;
                 } else {
-                        if (item_end < new_size)
+                        if (item_end < new_size) {
+                                /*
+                                 * With NO_HOLES mode, for the following mapping
+                                 *
+                                 * [0-4k][hole][8k-12k]
+                                 *
+                                 * if truncating isize down to 6k, it ends up
+                                 * isize being 8k.
+                                 */
+                                if (btrfs_fs_incompat(root->fs_info, NO_HOLES))
+                                        last_size = new_size;
                                 break;
+                        }
                         if (found_key.offset >= new_size)
                                 del_item = 1;
                         else
@@ -5710,6 +5718,7 @@ static struct inode *new_simple_dir(struct super_block *s,
 
         inode->i_ino = BTRFS_EMPTY_SUBVOL_DIR_OBJECTID;
         inode->i_op = &btrfs_dir_ro_inode_operations;
+        inode->i_opflags &= ~IOP_XATTR;
         inode->i_fop = &simple_dir_operations;
         inode->i_mode = S_IFDIR | S_IRUGO | S_IWUSR | S_IXUGO;
         inode->i_mtime = current_time(inode);
@@ -7215,7 +7224,6 @@ static struct extent_map *btrfs_create_dio_extent(struct inode *inode,
         struct extent_map *em = NULL;
         int ret;
 
-        down_read(&BTRFS_I(inode)->dio_sem);
         if (type != BTRFS_ORDERED_NOCOW) {
                 em = create_pinned_em(inode, start, len, orig_start,
                                       block_start, block_len, orig_block_len,
@@ -7234,7 +7242,6 @@ static struct extent_map *btrfs_create_dio_extent(struct inode *inode,
                 em = ERR_PTR(ret);
         }
  out:
-        up_read(&BTRFS_I(inode)->dio_sem);
 
         return em;
 }
@@ -8692,6 +8699,7 @@ static ssize_t btrfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
                 dio_data.unsubmitted_oe_range_start = (u64)offset;
                 dio_data.unsubmitted_oe_range_end = (u64)offset;
                 current->journal_info = &dio_data;
+                down_read(&BTRFS_I(inode)->dio_sem);
         } else if (test_bit(BTRFS_INODE_READDIO_NEED_LOCK,
                                      &BTRFS_I(inode)->runtime_flags)) {
                 inode_dio_end(inode);
@@ -8704,6 +8712,7 @@ static ssize_t btrfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
                                    iter, btrfs_get_blocks_direct, NULL,
                                    btrfs_submit_direct, flags);
         if (iov_iter_rw(iter) == WRITE) {
+                up_read(&BTRFS_I(inode)->dio_sem);
                 current->journal_info = NULL;
                 if (ret < 0 && ret != -EIOCBQUEUED) {
                         if (dio_data.reserve)
@@ -9212,6 +9221,7 @@ static int btrfs_truncate(struct inode *inode)
                         break;
                 }
 
+                btrfs_block_rsv_release(fs_info, rsv, -1);
                 ret = btrfs_block_rsv_migrate(&fs_info->trans_block_rsv,
                                               rsv, min_size, 0);
                 BUG_ON(ret);    /* shouldn't happen */
@@ -10579,8 +10589,6 @@ static const struct inode_operations btrfs_dir_inode_operations = {
 static const struct inode_operations btrfs_dir_ro_inode_operations = {
         .lookup         = btrfs_lookup,
         .permission     = btrfs_permission,
-        .get_acl        = btrfs_get_acl,
-        .set_acl        = btrfs_set_acl,
         .update_time    = btrfs_update_time,
 };
 
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 8f6a2a5863b9..a27fc8791551 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -285,6 +285,7 @@ initiate_cifs_search(const unsigned int xid, struct file *file)
                         rc = -ENOMEM;
                         goto error_exit;
                 }
+                spin_lock_init(&cifsFile->file_info_lock);
                 file->private_data = cifsFile;
                 cifsFile->tlink = cifs_get_tlink(tlink);
                 tcon = tlink_tcon(tlink);
diff --git a/fs/dax.c b/fs/dax.c
index ddcddfeaa03b..c45598b912e1 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -990,7 +990,6 @@ int __dax_zero_page_range(struct block_device *bdev, sector_t sector,
 }
 EXPORT_SYMBOL_GPL(__dax_zero_page_range);
 
-#ifdef CONFIG_FS_IOMAP
 static sector_t dax_iomap_sector(struct iomap *iomap, loff_t pos)
 {
         return iomap->blkno + (((pos & PAGE_MASK) - iomap->offset) >> 9);
@@ -1032,6 +1031,11 @@ dax_iomap_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
                 struct blk_dax_ctl dax = { 0 };
                 ssize_t map_len;
 
+                if (fatal_signal_pending(current)) {
+                        ret = -EINTR;
+                        break;
+                }
+
                 dax.sector = dax_iomap_sector(iomap, pos);
                 dax.size = (length + offset + PAGE_SIZE - 1) & PAGE_MASK;
                 map_len = dax_map_atomic(iomap->bdev, &dax);
@@ -1428,4 +1432,3 @@ int dax_iomap_pmd_fault(struct vm_area_struct *vma, unsigned long address,
 }
 EXPORT_SYMBOL_GPL(dax_iomap_pmd_fault);
 #endif /* CONFIG_FS_DAX_PMD */
-#endif /* CONFIG_FS_IOMAP */
diff --git a/fs/ext2/Kconfig b/fs/ext2/Kconfig
index 36bea5adcaba..c634874e12d9 100644
--- a/fs/ext2/Kconfig
+++ b/fs/ext2/Kconfig
@@ -1,6 +1,5 @@
 config EXT2_FS
         tristate "Second extended fs support"
-        select FS_IOMAP if FS_DAX
         help
           Ext2 is a standard Linux file system for hard disks.
 
diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig
index 7b90691e98c4..e38039fd96ff 100644
--- a/fs/ext4/Kconfig
+++ b/fs/ext4/Kconfig
@@ -37,7 +37,6 @@ config EXT4_FS
         select CRC16
         select CRYPTO
         select CRYPTO_CRC32C
-        select FS_IOMAP if FS_DAX
         help
           This is the next generation of the ext3 filesystem.
 
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 4304072161aa..40d61077bead 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -542,6 +542,7 @@ void __fscache_disable_cookie(struct fscache_cookie *cookie, bool invalidate)
                 hlist_for_each_entry(object, &cookie->backing_objects, cookie_link) {
                         if (invalidate)
                                 set_bit(FSCACHE_OBJECT_RETIRED, &object->flags);
+                        clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags);
                         fscache_raise_event(object, FSCACHE_OBJECT_EV_KILL);
                 }
         } else {
@@ -560,6 +561,10 @@ void __fscache_disable_cookie(struct fscache_cookie *cookie, bool invalidate)
                 wait_on_atomic_t(&cookie->n_active, fscache_wait_atomic_t,
                                  TASK_UNINTERRUPTIBLE);
 
+        /* Make sure any pending writes are cancelled. */
+        if (cookie->def->type != FSCACHE_COOKIE_TYPE_INDEX)
+                fscache_invalidate_writes(cookie);
+
         /* Reset the cookie state if it wasn't relinquished */
         if (!test_bit(FSCACHE_COOKIE_RELINQUISHED, &cookie->flags)) {
                 atomic_inc(&cookie->n_active);
diff --git a/fs/fscache/netfs.c b/fs/fscache/netfs.c
index 9b28649df3a1..a8aa00be4444 100644
--- a/fs/fscache/netfs.c
+++ b/fs/fscache/netfs.c
@@ -48,6 +48,7 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
         cookie->flags           = 1 << FSCACHE_COOKIE_ENABLED;
 
         spin_lock_init(&cookie->lock);
+        spin_lock_init(&cookie->stores_lock);
         INIT_HLIST_HEAD(&cookie->backing_objects);
 
         /* check the netfs type is not already present */
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 9e792e30f4db..7a182c87f378 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -30,6 +30,7 @@ static const struct fscache_state *fscache_look_up_object(struct fscache_object
 static const struct fscache_state *fscache_object_available(struct fscache_object *, int);
 static const struct fscache_state *fscache_parent_ready(struct fscache_object *, int);
 static const struct fscache_state *fscache_update_object(struct fscache_object *, int);
+static const struct fscache_state *fscache_object_dead(struct fscache_object *, int);
 
 #define __STATE_NAME(n) fscache_osm_##n
 #define STATE(n) (&__STATE_NAME(n))
@@ -91,7 +92,7 @@ static WORK_STATE(LOOKUP_FAILURE,	"LCFL", fscache_lookup_failure);
 static WORK_STATE(KILL_OBJECT,          "KILL", fscache_kill_object);
 static WORK_STATE(KILL_DEPENDENTS,      "KDEP", fscache_kill_dependents);
 static WORK_STATE(DROP_OBJECT,          "DROP", fscache_drop_object);
-static WORK_STATE(OBJECT_DEAD,          "DEAD", (void*)2UL);
+static WORK_STATE(OBJECT_DEAD,          "DEAD", fscache_object_dead);
 
 static WAIT_STATE(WAIT_FOR_INIT,        "?INI",
                   TRANSIT_TO(INIT_OBJECT,       1 << FSCACHE_OBJECT_EV_NEW_CHILD));
@@ -229,6 +230,10 @@ execute_work_state:
         event = -1;
         if (new_state == NO_TRANSIT) {
                 _debug("{OBJ%x} %s notrans", object->debug_id, state->name);
+                if (unlikely(state == STATE(OBJECT_DEAD))) {
+                        _leave(" [dead]");
+                        return;
+                }
                 fscache_enqueue_object(object);
                 event_mask = object->oob_event_mask;
                 goto unmask_events;
@@ -239,7 +244,7 @@ execute_work_state:
         object->state = state = new_state;
 
         if (state->work) {
-                if (unlikely(state->work == ((void *)2UL))) {
+                if (unlikely(state == STATE(OBJECT_DEAD))) {
                         _leave(" [dead]");
                         return;
                 }
@@ -645,6 +650,12 @@ static const struct fscache_state *fscache_kill_object(struct fscache_object *ob
         fscache_mark_object_dead(object);
         object->oob_event_mask = 0;
 
+        if (test_bit(FSCACHE_OBJECT_RETIRED, &object->flags)) {
+                /* Reject any new read/write ops and abort any that are pending. */
+                clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags);
+                fscache_cancel_all_ops(object);
+        }
+
         if (list_empty(&object->dependents) &&
             object->n_ops == 0 &&
             object->n_children == 0)
@@ -1077,3 +1088,20 @@ void fscache_object_mark_killed(struct fscache_object *object,
         }
 }
 EXPORT_SYMBOL(fscache_object_mark_killed);
+
+/*
+ * The object is dead.  We can get here if an object gets queued by an event
+ * that would lead to its death (such as EV_KILL) when the dispatcher is
+ * already running (and so can be requeued) but hasn't yet cleared the event
+ * mask.
+ */
+static const struct fscache_state *fscache_object_dead(struct fscache_object *object,
+                                                       int event)
+{
+        if (!test_and_set_bit(FSCACHE_OBJECT_RUN_AFTER_DEAD,
+                              &object->flags))
+                return NO_TRANSIT;
+
+        WARN(true, "FS-Cache object redispatched after death");
+        return NO_TRANSIT;
+}
diff --git a/fs/iomap.c b/fs/iomap.c
index 354a123f170e..a51cb4c07d4d 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -114,6 +114,9 @@ iomap_write_begin(struct inode *inode, loff_t pos, unsigned len, unsigned flags,
 
         BUG_ON(pos + len > iomap->offset + iomap->length);
 
+        if (fatal_signal_pending(current))
+                return -EINTR;
+
         page = grab_cache_page_write_begin(inode->i_mapping, index, flags);
         if (!page)
                 return -ENOMEM;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ecc151697fd4..0a0eaecf9676 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2700,7 +2700,8 @@ static inline void nfs4_exclusive_attrset(struct nfs4_opendata *opendata,
                 sattr->ia_valid |= ATTR_MTIME;
 
         /* Except MODE, it seems harmless of setting twice. */
-        if ((attrset[1] & FATTR4_WORD1_MODE))
+        if (opendata->o_arg.createmode != NFS4_CREATE_EXCLUSIVE &&
+                attrset[1] & FATTR4_WORD1_MODE)
                 sattr->ia_valid &= ~ATTR_MODE;
 
         if (attrset[2] & FATTR4_WORD2_SECURITY_LABEL)
@@ -8490,6 +8491,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
                 goto out;
         }
 
+        nfs4_sequence_free_slot(&lgp->res.seq_res);
         err = nfs4_handle_exception(server, nfs4err, exception);
         if (!status) {
                 if (exception->retry)
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 90e6193ce6be..daeb94e3acd4 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1091,6 +1091,7 @@ static void nfs_increment_seqid(int status, struct nfs_seqid *seqid)
                 case -NFS4ERR_BADXDR:
                 case -NFS4ERR_RESOURCE:
                 case -NFS4ERR_NOFILEHANDLE:
+                case -NFS4ERR_MOVED:
                         /* Non-seqid mutating errors */
                         return;
         };
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 59554f3adf29..dd042498ce7c 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1200,10 +1200,10 @@ _pnfs_return_layout(struct inode *ino)
 
         send = pnfs_prepare_layoutreturn(lo, &stateid, NULL);
         spin_unlock(&ino->i_lock);
-        pnfs_free_lseg_list(&tmp_list);
         if (send)
                 status = pnfs_send_layoutreturn(lo, &stateid, IOMODE_ANY, true);
 out_put_layout_hdr:
+        pnfs_free_lseg_list(&tmp_list);
         pnfs_put_layout_hdr(lo);
 out:
         dprintk("<-- %s status: %d\n", __func__, status);
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index 596205d939a1..1fc07a9c70e9 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -223,10 +223,11 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
         struct nfs4_layout_stateid *ls;
         struct nfs4_stid *stp;
 
-        stp = nfs4_alloc_stid(cstate->clp, nfs4_layout_stateid_cache);
+        stp = nfs4_alloc_stid(cstate->clp, nfs4_layout_stateid_cache,
+                                        nfsd4_free_layout_stateid);
         if (!stp)
                 return NULL;
-        stp->sc_free = nfsd4_free_layout_stateid;
+
         get_nfs4_file(fp);
         stp->sc_file = fp;
 
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 4b4beaaa4eaa..a0dee8ae9f97 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -633,8 +633,8 @@ out:
         return co;
 }
 
-struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
-                                         struct kmem_cache *slab)
+struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab,
+                                  void (*sc_free)(struct nfs4_stid *))
 {
         struct nfs4_stid *stid;
         int new_id;
@@ -650,6 +650,8 @@ struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
         idr_preload_end();
         if (new_id < 0)
                 goto out_free;
+
+        stid->sc_free = sc_free;
         stid->sc_client = cl;
         stid->sc_stateid.si_opaque.so_id = new_id;
         stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
@@ -675,15 +677,12 @@ out_free:
 static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp)
 {
         struct nfs4_stid *stid;
-        struct nfs4_ol_stateid *stp;
 
-        stid = nfs4_alloc_stid(clp, stateid_slab);
+        stid = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_ol_stateid);
         if (!stid)
                 return NULL;
 
-        stp = openlockstateid(stid);
-        stp->st_stid.sc_free = nfs4_free_ol_stateid;
-        return stp;
+        return openlockstateid(stid);
 }
 
 static void nfs4_free_deleg(struct nfs4_stid *stid)
@@ -781,11 +780,10 @@ alloc_init_deleg(struct nfs4_client *clp, struct svc_fh *current_fh,
                 goto out_dec;
         if (delegation_blocked(&current_fh->fh_handle))
                 goto out_dec;
-        dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab));
+        dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab, nfs4_free_deleg));
         if (dp == NULL)
                 goto out_dec;
 
-        dp->dl_stid.sc_free = nfs4_free_deleg;
         /*
          * delegation seqid's are never incremented.  The 4.1 special
          * meaning of seqid 0 isn't meaningful, really, but let's avoid
@@ -5580,7 +5578,6 @@ init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo,
         stp->st_stateowner = nfs4_get_stateowner(&lo->lo_owner);
         get_nfs4_file(fp);
         stp->st_stid.sc_file = fp;
-        stp->st_stid.sc_free = nfs4_free_lock_stateid;
         stp->st_access_bmap = 0;
         stp->st_deny_bmap = open_stp->st_deny_bmap;
         stp->st_openstp = open_stp;
@@ -5623,7 +5620,7 @@ find_or_create_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fi,
         lst = find_lock_stateid(lo, fi);
         if (lst == NULL) {
                 spin_unlock(&clp->cl_lock);
-                ns = nfs4_alloc_stid(clp, stateid_slab);
+                ns = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_lock_stateid);
                 if (ns == NULL)
                         return NULL;
 
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index c9399366f9df..4516e8b7d776 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -603,8 +603,8 @@ extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp,
 __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
                      stateid_t *stateid, unsigned char typemask,
                      struct nfs4_stid **s, struct nfsd_net *nn);
-struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
-                struct kmem_cache *slab);
+struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab,
+                                  void (*sc_free)(struct nfs4_stid *));
 void nfs4_unhash_stid(struct nfs4_stid *s);
 void nfs4_put_stid(struct nfs4_stid *s);
 void nfs4_inc_and_copy_stateid(stateid_t *dst, struct nfs4_stid *stid);
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 26c6fdb4bf67..ca13236dbb1f 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -332,37 +332,6 @@ nfsd_sanitize_attrs(struct inode *inode, struct iattr *iap)
         }
 }
 
-static __be32
-nfsd_get_write_access(struct svc_rqst *rqstp, struct svc_fh *fhp,
-                struct iattr *iap)
-{
-        struct inode *inode = d_inode(fhp->fh_dentry);
-        int host_err;
-
-        if (iap->ia_size < inode->i_size) {
-                __be32 err;
-
-                err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
-                                NFSD_MAY_TRUNC | NFSD_MAY_OWNER_OVERRIDE);
-                if (err)
-                        return err;
-        }
-
-        host_err = get_write_access(inode);
-        if (host_err)
-                goto out_nfserrno;
-
-        host_err = locks_verify_truncate(inode, NULL, iap->ia_size);
-        if (host_err)
-                goto out_put_write_access;
-        return 0;
-
-out_put_write_access:
-        put_write_access(inode);
-out_nfserrno:
-        return nfserrno(host_err);
-}
-
 /*
  * Set various file attributes.  After this call fhp needs an fh_put.
  */
@@ -377,7 +346,6 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
         __be32          err;
         int             host_err;
         bool            get_write_count;
-        int             size_change = 0;
 
         if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
                 accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
@@ -390,11 +358,11 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
         /* Get inode */
         err = fh_verify(rqstp, fhp, ftype, accmode);
         if (err)
-                goto out;
+                return err;
         if (get_write_count) {
                 host_err = fh_want_write(fhp);
                 if (host_err)
-                        return nfserrno(host_err);
+                        goto out_host_err;
         }
 
         dentry = fhp->fh_dentry;
@@ -405,50 +373,59 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
                 iap->ia_valid &= ~ATTR_MODE;
 
         if (!iap->ia_valid)
-                goto out;
+                return 0;
 
         nfsd_sanitize_attrs(inode, iap);
 
+        if (check_guard && guardtime != inode->i_ctime.tv_sec)
+                return nfserr_notsync;
+
         /*
          * The size case is special, it changes the file in addition to the
-         * attributes.
+         * attributes, and file systems don't expect it to be mixed with
+         * "random" attribute changes.  We thus split out the size change
+         * into a separate call for vfs_truncate, and do the rest as a
+         * a separate setattr call.
          */
         if (iap->ia_valid & ATTR_SIZE) {
-                err = nfsd_get_write_access(rqstp, fhp, iap);
-                if (err)
-                        goto out;
-                size_change = 1;
+                struct path path = {
+                        .mnt    = fhp->fh_export->ex_path.mnt,
+                        .dentry = dentry,
+                };
+                bool implicit_mtime = false;
 
                 /*
-                 * RFC5661, Section 18.30.4:
-                 *   Changing the size of a file with SETATTR indirectly
-                 *   changes the time_modify and change attributes.
-                 *
-                 * (and similar for the older RFCs)
+                 * vfs_truncate implicity updates the mtime IFF the file size
+                 * actually changes.  Avoid the additional seattr call below if
+                 * the only other attribute that the client sends is the mtime.
                  */
-                if (iap->ia_size != i_size_read(inode))
-                        iap->ia_valid |= ATTR_MTIME;
-        }
+                if (iap->ia_size != i_size_read(inode) &&
+                    ((iap->ia_valid & ~(ATTR_SIZE | ATTR_MTIME)) == 0))
+                        implicit_mtime = true;
 
-        iap->ia_valid |= ATTR_CTIME;
+                host_err = vfs_truncate(&path, iap->ia_size);
+                if (host_err)
+                        goto out_host_err;
 
-        if (check_guard && guardtime != inode->i_ctime.tv_sec) {
-                err = nfserr_notsync;
-                goto out_put_write_access;
+                iap->ia_valid &= ~ATTR_SIZE;
+                if (implicit_mtime)
+                        iap->ia_valid &= ~ATTR_MTIME;
+                if (!iap->ia_valid)
+                        goto done;
         }
 
+        iap->ia_valid |= ATTR_CTIME;
+
         fh_lock(fhp);
         host_err = notify_change(dentry, iap, NULL);
         fh_unlock(fhp);
-        err = nfserrno(host_err);
+        if (host_err)
+                goto out_host_err;
 
-out_put_write_access:
-        if (size_change)
-                put_write_access(inode);
-        if (!err)
-                err = nfserrno(commit_metadata(fhp));
-out:
-        return err;
+done:
+        host_err = commit_metadata(fhp);
+out_host_err:
+        return nfserrno(host_err);
 }
 
 #if defined(CONFIG_NFSD_V4)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 8e7e61b28f31..87c9a9aacda3 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -3179,6 +3179,8 @@ int proc_pid_readdir(struct file *file, struct dir_context *ctx)
              iter.tgid += 1, iter = next_tgid(ns, iter)) {
                 char name[PROC_NUMBUF];
                 int len;
+
+                cond_resched();
                 if (!has_pid_permissions(ns, iter.task, 2))
                         continue;
 
diff --git a/fs/romfs/super.c b/fs/romfs/super.c
index d0f8a38dfafa..0186fe6d39f3 100644
--- a/fs/romfs/super.c
+++ b/fs/romfs/super.c
@@ -74,6 +74,7 @@
 #include <linux/highmem.h>
 #include <linux/pagemap.h>
 #include <linux/uaccess.h>
+#include <linux/major.h>
 #include "internal.h"
 
 static struct kmem_cache *romfs_inode_cachep;
@@ -416,7 +417,22 @@ static void romfs_destroy_inode(struct inode *inode)
 static int romfs_statfs(struct dentry *dentry, struct kstatfs *buf)
 {
         struct super_block *sb = dentry->d_sb;
-        u64 id = huge_encode_dev(sb->s_bdev->bd_dev);
+        u64 id = 0;
+
+        /* When calling huge_encode_dev(),
+         * use sb->s_bdev->bd_dev when,
+         *   - CONFIG_ROMFS_ON_BLOCK defined
+         * use sb->s_dev when,
+         *   - CONFIG_ROMFS_ON_BLOCK undefined and
+         *   - CONFIG_ROMFS_ON_MTD defined
+         * leave id as 0 when,
+         *   - CONFIG_ROMFS_ON_BLOCK undefined and
+         *   - CONFIG_ROMFS_ON_MTD undefined
+         */
+        if (sb->s_bdev)
+                id = huge_encode_dev(sb->s_bdev->bd_dev);
+        else if (sb->s_dev)
+                id = huge_encode_dev(sb->s_dev);
 
         buf->f_type = ROMFS_MAGIC;
         buf->f_namelen = ROMFS_MAXFN;
@@ -489,6 +505,11 @@ static int romfs_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_flags |= MS_RDONLY | MS_NOATIME;
         sb->s_op = &romfs_super_ops;
 
+#ifdef CONFIG_ROMFS_ON_MTD
+        /* Use same dev ID from the underlying mtdblock device */
+        if (sb->s_mtd)
+                sb->s_dev = MKDEV(MTD_BLOCK_MAJOR, sb->s_mtd->index);
+#endif
         /* read the image superblock and check it */
         rsb = kmalloc(512, GFP_KERNEL);
         if (!rsb)
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index d96e2f30084b..43953e03c356 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -63,6 +63,7 @@ struct userfaultfd_wait_queue {
         struct uffd_msg msg;
         wait_queue_t wq;
         struct userfaultfd_ctx *ctx;
+        bool waken;
 };
 
 struct userfaultfd_wake_range {
@@ -86,6 +87,12 @@ static int userfaultfd_wake_function(wait_queue_t *wq, unsigned mode,
         if (len && (start > uwq->msg.arg.pagefault.address ||
                     start + len <= uwq->msg.arg.pagefault.address))
                 goto out;
+        WRITE_ONCE(uwq->waken, true);
+        /*
+         * The implicit smp_mb__before_spinlock in try_to_wake_up()
+         * renders uwq->waken visible to other CPUs before the task is
+         * waken.
+         */
         ret = wake_up_state(wq->private, mode);
         if (ret)
                 /*
@@ -264,6 +271,7 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
         struct userfaultfd_wait_queue uwq;
         int ret;
         bool must_wait, return_to_userland;
+        long blocking_state;
 
         BUG_ON(!rwsem_is_locked(&mm->mmap_sem));
 
@@ -334,10 +342,13 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
         uwq.wq.private = current;
         uwq.msg = userfault_msg(vmf->address, vmf->flags, reason);
         uwq.ctx = ctx;
+        uwq.waken = false;
 
         return_to_userland =
                 (vmf->flags & (FAULT_FLAG_USER|FAULT_FLAG_KILLABLE)) ==
                 (FAULT_FLAG_USER|FAULT_FLAG_KILLABLE);
+        blocking_state = return_to_userland ? TASK_INTERRUPTIBLE :
+                         TASK_KILLABLE;
 
         spin_lock(&ctx->fault_pending_wqh.lock);
         /*
@@ -350,8 +361,7 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
          * following the spin_unlock to happen before the list_add in
          * __add_wait_queue.
          */
-        set_current_state(return_to_userland ? TASK_INTERRUPTIBLE :
-                          TASK_KILLABLE);
+        set_current_state(blocking_state);
         spin_unlock(&ctx->fault_pending_wqh.lock);
 
         must_wait = userfaultfd_must_wait(ctx, vmf->address, vmf->flags,
@@ -364,6 +374,29 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
                 wake_up_poll(&ctx->fd_wqh, POLLIN);
                 schedule();
                 ret |= VM_FAULT_MAJOR;
+
+                /*
+                 * False wakeups can orginate even from rwsem before
+                 * up_read() however userfaults will wait either for a
+                 * targeted wakeup on the specific uwq waitqueue from
+                 * wake_userfault() or for signals or for uffd
+                 * release.
+                 */
+                while (!READ_ONCE(uwq.waken)) {
+                        /*
+                         * This needs the full smp_store_mb()
+                         * guarantee as the state write must be
+                         * visible to other CPUs before reading
+                         * uwq.waken from other CPUs.
+                         */
+                        set_current_state(blocking_state);
+                        if (READ_ONCE(uwq.waken) ||
+                            READ_ONCE(ctx->released) ||
+                            (return_to_userland ? signal_pending(current) :
+                             fatal_signal_pending(current)))
+                                break;
+                        schedule();
+                }
         }
 
         __set_current_state(TASK_RUNNING);
diff --git a/fs/xfs/libxfs/xfs_ag_resv.c b/fs/xfs/libxfs/xfs_ag_resv.c
index d346d42c54d1..33db69be4832 100644
--- a/fs/xfs/libxfs/xfs_ag_resv.c
+++ b/fs/xfs/libxfs/xfs_ag_resv.c
@@ -39,6 +39,7 @@
 #include "xfs_rmap_btree.h"
 #include "xfs_btree.h"
 #include "xfs_refcount_btree.h"
+#include "xfs_ialloc_btree.h"
 
 /*
  * Per-AG Block Reservations
@@ -200,22 +201,30 @@ __xfs_ag_resv_init(
         struct xfs_mount                *mp = pag->pag_mount;
         struct xfs_ag_resv              *resv;
         int                             error;
+        xfs_extlen_t                    reserved;
 
-        resv = xfs_perag_resv(pag, type);
         if (used > ask)
                 ask = used;
-        resv->ar_asked = ask;
-        resv->ar_reserved = resv->ar_orig_reserved = ask - used;
-        mp->m_ag_max_usable -= ask;
+        reserved = ask - used;
 
-        trace_xfs_ag_resv_init(pag, type, ask);
-
-        error = xfs_mod_fdblocks(mp, -(int64_t)resv->ar_reserved, true);
-        if (error)
+        error = xfs_mod_fdblocks(mp, -(int64_t)reserved, true);
+        if (error) {
                 trace_xfs_ag_resv_init_error(pag->pag_mount, pag->pag_agno,
                                 error, _RET_IP_);
+                xfs_warn(mp,
+"Per-AG reservation for AG %u failed.  Filesystem may run out of space.",
+                                pag->pag_agno);
+                return error;
+        }
 
-        return error;
+        mp->m_ag_max_usable -= ask;
+
+        resv = xfs_perag_resv(pag, type);
+        resv->ar_asked = ask;
+        resv->ar_reserved = resv->ar_orig_reserved = reserved;
+
+        trace_xfs_ag_resv_init(pag, type, ask);
+        return 0;
 }
 
 /* Create a per-AG block reservation. */
@@ -223,6 +232,8 @@ int
 xfs_ag_resv_init(
         struct xfs_perag                *pag)
 {
+        struct xfs_mount                *mp = pag->pag_mount;
+        xfs_agnumber_t                  agno = pag->pag_agno;
         xfs_extlen_t                    ask;
         xfs_extlen_t                    used;
         int                             error = 0;
@@ -231,23 +242,45 @@ xfs_ag_resv_init(
         if (pag->pag_meta_resv.ar_asked == 0) {
                 ask = used = 0;
 
-                error = xfs_refcountbt_calc_reserves(pag->pag_mount,
-                                pag->pag_agno, &ask, &used);
+                error = xfs_refcountbt_calc_reserves(mp, agno, &ask, &used);
                 if (error)
                         goto out;
 
-                error = __xfs_ag_resv_init(pag, XFS_AG_RESV_METADATA,
-                                ask, used);
+                error = xfs_finobt_calc_reserves(mp, agno, &ask, &used);
                 if (error)
                         goto out;
+
+                error = __xfs_ag_resv_init(pag, XFS_AG_RESV_METADATA,
+                                ask, used);
+                if (error) {
+                        /*
+                         * Because we didn't have per-AG reservations when the
+                         * finobt feature was added we might not be able to
+                         * reserve all needed blocks.  Warn and fall back to the
+                         * old and potentially buggy code in that case, but
+                         * ensure we do have the reservation for the refcountbt.
+                         */
+                        ask = used = 0;
+
+                        mp->m_inotbt_nores = true;
+
+                        error = xfs_refcountbt_calc_reserves(mp, agno, &ask,
+                                        &used);
+                        if (error)
+                                goto out;
+
+                        error = __xfs_ag_resv_init(pag, XFS_AG_RESV_METADATA,
+                                        ask, used);
+                        if (error)
+                                goto out;
+                }
         }
 
         /* Create the AGFL metadata reservation */
         if (pag->pag_agfl_resv.ar_asked == 0) {
                 ask = used = 0;
 
-                error = xfs_rmapbt_calc_reserves(pag->pag_mount, pag->pag_agno,
-                                &ask, &used);
+                error = xfs_rmapbt_calc_reserves(mp, agno, &ask, &used);
                 if (error)
                         goto out;
 
@@ -256,9 +289,16 @@ xfs_ag_resv_init(
                         goto out;
         }
 
+#ifdef DEBUG
+        /* need to read in the AGF for the ASSERT below to work */
+        error = xfs_alloc_pagf_init(pag->pag_mount, NULL, pag->pag_agno, 0);
+        if (error)
+                return error;
+
         ASSERT(xfs_perag_resv(pag, XFS_AG_RESV_METADATA)->ar_reserved +
                xfs_perag_resv(pag, XFS_AG_RESV_AGFL)->ar_reserved <=
                pag->pagf_freeblks + pag->pagf_flcount);
+#endif
 out:
         return error;
 }
diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
index af1ecb19121e..6622d46ddec3 100644
--- a/fs/xfs/libxfs/xfs_attr.c
+++ b/fs/xfs/libxfs/xfs_attr.c
@@ -131,9 +131,6 @@ xfs_attr_get(
         if (XFS_FORCED_SHUTDOWN(ip->i_mount))
                 return -EIO;
 
-        if (!xfs_inode_hasattr(ip))
-                return -ENOATTR;
-
         error = xfs_attr_args_init(&args, ip, name, flags);
         if (error)
                 return error;
@@ -392,9 +389,6 @@ xfs_attr_remove(
         if (XFS_FORCED_SHUTDOWN(dp->i_mount))
                 return -EIO;
 
-        if (!xfs_inode_hasattr(dp))
-                return -ENOATTR;
-
         error = xfs_attr_args_init(&args, dp, name, flags);
         if (error)
                 return error;
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 44773c9eb957..bfc00de5c6f1 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -3629,7 +3629,7 @@ xfs_bmap_btalloc(
                 align = xfs_get_cowextsz_hint(ap->ip);
         else if (xfs_alloc_is_userdata(ap->datatype))
                 align = xfs_get_extsz_hint(ap->ip);
-        if (unlikely(align)) {
+        if (align) {
                 error = xfs_bmap_extsize_align(mp, &ap->got, &ap->prev,
                                                 align, 0, ap->eof, 0, ap->conv,
                                                 &ap->offset, &ap->length);
@@ -3701,7 +3701,7 @@ xfs_bmap_btalloc(
                 args.minlen = ap->minlen;
         }
         /* apply extent size hints if obtained earlier */
-        if (unlikely(align)) {
+        if (align) {
                 args.prod = align;
                 if ((args.mod = (xfs_extlen_t)do_mod(ap->offset, args.prod)))
                         args.mod = (xfs_extlen_t)(args.prod - args.mod);
@@ -4514,8 +4514,6 @@ xfs_bmapi_write(
         int                     n;              /* current extent index */
         xfs_fileoff_t           obno;           /* old block number (offset) */
         int                     whichfork;      /* data or attr fork */
-        char                    inhole;         /* current location is hole in file */
-        char                    wasdelay;       /* old extent was delayed */
 
 #ifdef DEBUG
         xfs_fileoff_t           orig_bno;       /* original block number value */
@@ -4603,22 +4601,44 @@ xfs_bmapi_write(
         bma.firstblock = firstblock;
 
         while (bno < end && n < *nmap) {
-                inhole = eof || bma.got.br_startoff > bno;
-                wasdelay = !inhole && isnullstartblock(bma.got.br_startblock);
+                bool                    need_alloc = false, wasdelay = false;
 
-                /*
-                 * Make sure we only reflink into a hole.
-                 */
-                if (flags & XFS_BMAPI_REMAP)
-                        ASSERT(inhole);
-                if (flags & XFS_BMAPI_COWFORK)
-                        ASSERT(!inhole);
+                /* in hole or beyoned EOF? */
+                if (eof || bma.got.br_startoff > bno) {
+                        if (flags & XFS_BMAPI_DELALLOC) {
+                                /*
+                                 * For the COW fork we can reasonably get a
+                                 * request for converting an extent that races
+                                 * with other threads already having converted
+                                 * part of it, as there converting COW to
+                                 * regular blocks is not protected using the
+                                 * IOLOCK.
+                                 */
+                                ASSERT(flags & XFS_BMAPI_COWFORK);
+                                if (!(flags & XFS_BMAPI_COWFORK)) {
+                                        error = -EIO;
+                                        goto error0;
+                                }
+
+                                if (eof || bno >= end)
+                                        break;
+                        } else {
+                                need_alloc = true;
+                        }
+                } else {
+                        /*
+                         * Make sure we only reflink into a hole.
+                         */
+                        ASSERT(!(flags & XFS_BMAPI_REMAP));
+                        if (isnullstartblock(bma.got.br_startblock))
+                                wasdelay = true;
+                }
 
                 /*
                  * First, deal with the hole before the allocated space
                  * that we found, if any.
                  */
-                if (inhole || wasdelay) {
+                if (need_alloc || wasdelay) {
                         bma.eof = eof;
                         bma.conv = !!(flags & XFS_BMAPI_CONVERT);
                         bma.wasdel = wasdelay;
diff --git a/fs/xfs/libxfs/xfs_bmap.h b/fs/xfs/libxfs/xfs_bmap.h
index cecd094404cc..cdef87db5262 100644
--- a/fs/xfs/libxfs/xfs_bmap.h
+++ b/fs/xfs/libxfs/xfs_bmap.h
@@ -110,6 +110,9 @@ struct xfs_extent_free_item
 /* Map something in the CoW fork. */
 #define XFS_BMAPI_COWFORK       0x200
 
+/* Only convert delalloc space, don't allocate entirely new extents */
+#define XFS_BMAPI_DELALLOC      0x400
+
 #define XFS_BMAPI_FLAGS \
         { XFS_BMAPI_ENTIRE,     "ENTIRE" }, \
         { XFS_BMAPI_METADATA,   "METADATA" }, \
@@ -120,7 +123,8 @@ struct xfs_extent_free_item
         { XFS_BMAPI_CONVERT,    "CONVERT" }, \
         { XFS_BMAPI_ZERO,       "ZERO" }, \
         { XFS_BMAPI_REMAP,      "REMAP" }, \
-        { XFS_BMAPI_COWFORK,    "COWFORK" }
+        { XFS_BMAPI_COWFORK,    "COWFORK" }, \
+        { XFS_BMAPI_DELALLOC,   "DELALLOC" }
 
 
 static inline int xfs_bmapi_aflag(int w)
diff --git a/fs/xfs/libxfs/xfs_ialloc_btree.c b/fs/xfs/libxfs/xfs_ialloc_btree.c
index 0fd086d03d41..7c471881c9a6 100644
--- a/fs/xfs/libxfs/xfs_ialloc_btree.c
+++ b/fs/xfs/libxfs/xfs_ialloc_btree.c
@@ -82,11 +82,12 @@ xfs_finobt_set_root(
 }
 
 STATIC int
-xfs_inobt_alloc_block(
+__xfs_inobt_alloc_block(
         struct xfs_btree_cur    *cur,
         union xfs_btree_ptr     *start,
         union xfs_btree_ptr     *new,
-        int                     *stat)
+        int                     *stat,
+        enum xfs_ag_resv_type   resv)
 {
         xfs_alloc_arg_t         args;           /* block allocation args */
         int                     error;          /* error return value */
@@ -103,6 +104,7 @@ xfs_inobt_alloc_block(
         args.maxlen = 1;
         args.prod = 1;
         args.type = XFS_ALLOCTYPE_NEAR_BNO;
+        args.resv = resv;
 
         error = xfs_alloc_vextent(&args);
         if (error) {
@@ -123,6 +125,27 @@ xfs_inobt_alloc_block(
 }
 
 STATIC int
+xfs_inobt_alloc_block(
+        struct xfs_btree_cur    *cur,
+        union xfs_btree_ptr     *start,
+        union xfs_btree_ptr     *new,
+        int                     *stat)
+{
+        return __xfs_inobt_alloc_block(cur, start, new, stat, XFS_AG_RESV_NONE);
+}
+
+STATIC int
+xfs_finobt_alloc_block(
+        struct xfs_btree_cur    *cur,
+        union xfs_btree_ptr     *start,
+        union xfs_btree_ptr     *new,
+        int                     *stat)
+{
+        return __xfs_inobt_alloc_block(cur, start, new, stat,
+                        XFS_AG_RESV_METADATA);
+}
+
+STATIC int
 xfs_inobt_free_block(
         struct xfs_btree_cur    *cur,
         struct xfs_buf          *bp)
@@ -328,7 +351,7 @@ static const struct xfs_btree_ops xfs_finobt_ops = {
 
         .dup_cursor             = xfs_inobt_dup_cursor,
         .set_root               = xfs_finobt_set_root,
-        .alloc_block            = xfs_inobt_alloc_block,
+        .alloc_block            = xfs_finobt_alloc_block,
         .free_block             = xfs_inobt_free_block,
         .get_minrecs            = xfs_inobt_get_minrecs,
         .get_maxrecs            = xfs_inobt_get_maxrecs,
@@ -480,3 +503,64 @@ xfs_inobt_rec_check_count(
         return 0;
 }
 #endif  /* DEBUG */
+
+static xfs_extlen_t
+xfs_inobt_max_size(
+        struct xfs_mount        *mp)
+{
+        /* Bail out if we're uninitialized, which can happen in mkfs. */
+        if (mp->m_inobt_mxr[0] == 0)
+                return 0;
+
+        return xfs_btree_calc_size(mp, mp->m_inobt_mnr,
+                (uint64_t)mp->m_sb.sb_agblocks * mp->m_sb.sb_inopblock /
+                                XFS_INODES_PER_CHUNK);
+}
+
+static int
+xfs_inobt_count_blocks(
+        struct xfs_mount        *mp,
+        xfs_agnumber_t          agno,
+        xfs_btnum_t             btnum,
+        xfs_extlen_t            *tree_blocks)
+{
+        struct xfs_buf          *agbp;
+        struct xfs_btree_cur    *cur;
+        int                     error;
+
+        error = xfs_ialloc_read_agi(mp, NULL, agno, &agbp);
+        if (error)
+                return error;
+
+        cur = xfs_inobt_init_cursor(mp, NULL, agbp, agno, btnum);
+        error = xfs_btree_count_blocks(cur, tree_blocks);
+        xfs_btree_del_cursor(cur, error ? XFS_BTREE_ERROR : XFS_BTREE_NOERROR);
+        xfs_buf_relse(agbp);
+
+        return error;
+}
+
+/*
+ * Figure out how many blocks to reserve and how many are used by this btree.
+ */
+int
+xfs_finobt_calc_reserves(
+        struct xfs_mount        *mp,
+        xfs_agnumber_t          agno,
+        xfs_extlen_t            *ask,
+        xfs_extlen_t            *used)
+{
+        xfs_extlen_t            tree_len = 0;
+        int                     error;
+
+        if (!xfs_sb_version_hasfinobt(&mp->m_sb))
+                return 0;
+
+        error = xfs_inobt_count_blocks(mp, agno, XFS_BTNUM_FINO, &tree_len);
+        if (error)
+                return error;
+
+        *ask += xfs_inobt_max_size(mp);
+        *used += tree_len;
+        return 0;
+}
diff --git a/fs/xfs/libxfs/xfs_ialloc_btree.h b/fs/xfs/libxfs/xfs_ialloc_btree.h
index bd88453217ce..aa81e2e63f3f 100644
--- a/fs/xfs/libxfs/xfs_ialloc_btree.h
+++ b/fs/xfs/libxfs/xfs_ialloc_btree.h
@@ -72,4 +72,7 @@ int xfs_inobt_rec_check_count(struct xfs_mount *,
 #define xfs_inobt_rec_check_count(mp, rec)      0
 #endif  /* DEBUG */
 
+int xfs_finobt_calc_reserves(struct xfs_mount *mp, xfs_agnumber_t agno,
+                xfs_extlen_t *ask, xfs_extlen_t *used);
+
 #endif  /* __XFS_IALLOC_BTREE_H__ */
diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
index 2580262e4ea0..584ec896a533 100644
--- a/fs/xfs/libxfs/xfs_sb.c
+++ b/fs/xfs/libxfs/xfs_sb.c
@@ -242,7 +242,7 @@ xfs_mount_validate_sb(
             sbp->sb_blocklog < XFS_MIN_BLOCKSIZE_LOG                    ||
             sbp->sb_blocklog > XFS_MAX_BLOCKSIZE_LOG                    ||
             sbp->sb_blocksize != (1 << sbp->sb_blocklog)                ||
-            sbp->sb_dirblklog > XFS_MAX_BLOCKSIZE_LOG                   ||
+            sbp->sb_dirblklog + sbp->sb_blocklog > XFS_MAX_BLOCKSIZE_LOG ||
             sbp->sb_inodesize < XFS_DINODE_MIN_SIZE                     ||
             sbp->sb_inodesize > XFS_DINODE_MAX_SIZE                     ||
             sbp->sb_inodelog < XFS_DINODE_MIN_LOG                       ||
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index b9abce524c33..c1417919ab0a 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -528,7 +528,6 @@ xfs_getbmap(
         xfs_bmbt_irec_t         *map;           /* buffer for user's data */
         xfs_mount_t             *mp;            /* file system mount point */
         int                     nex;            /* # of user extents can do */
-        int                     nexleft;        /* # of user extents left */
         int                     subnex;         /* # of bmapi's can do */
         int                     nmap;           /* number of map entries */
         struct getbmapx         *out;           /* output structure */
@@ -686,10 +685,8 @@ xfs_getbmap(
                 goto out_free_map;
         }
 
-        nexleft = nex;
-
         do {
-                nmap = (nexleft > subnex) ? subnex : nexleft;
+                nmap = (nex> subnex) ? subnex : nex;
                 error = xfs_bmapi_read(ip, XFS_BB_TO_FSBT(mp, bmv->bmv_offset),
                                        XFS_BB_TO_FSB(mp, bmv->bmv_length),
                                        map, &nmap, bmapi_flags);
@@ -697,8 +694,8 @@ xfs_getbmap(
                         goto out_free_map;
                 ASSERT(nmap <= subnex);
 
-                for (i = 0; i < nmap && nexleft && bmv->bmv_length &&
-                                cur_ext < bmv->bmv_count; i++) {
+                for (i = 0; i < nmap && bmv->bmv_length &&
+                                cur_ext < bmv->bmv_count - 1; i++) {
                         out[cur_ext].bmv_oflags = 0;
                         if (map[i].br_state == XFS_EXT_UNWRITTEN)
                                 out[cur_ext].bmv_oflags |= BMV_OF_PREALLOC;
@@ -760,16 +757,27 @@ xfs_getbmap(
                                 continue;
                         }
 
+                        /*
+                         * In order to report shared extents accurately,
+                         * we report each distinct shared/unshared part
+                         * of a single bmbt record using multiple bmap
+                         * extents.  To make that happen, we iterate the
+                         * same map array item multiple times, each
+                         * time trimming out the subextent that we just
+                         * reported.
+                         *
+                         * Because of this, we must check the out array
+                         * index (cur_ext) directly against bmv_count-1
+                         * to avoid overflows.
+                         */
                         if (inject_map.br_startblock != NULLFSBLOCK) {
                                 map[i] = inject_map;
                                 i--;
-                        } else
-                                nexleft--;
+                        }
                         bmv->bmv_entries++;
                         cur_ext++;
                 }
-        } while (nmap && nexleft && bmv->bmv_length &&
-                 cur_ext < bmv->bmv_count);
+        } while (nmap && bmv->bmv_length && cur_ext < bmv->bmv_count - 1);
 
  out_free_map:
         kmem_free(map);
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 7f0a01f7b592..ac3b4db519df 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -422,6 +422,7 @@ retry:
 out_free_pages:
         for (i = 0; i < bp->b_page_count; i++)
                 __free_page(bp->b_pages[i]);
+        bp->b_flags &= ~_XBF_PAGES;
         return error;
 }
 
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index b9557795eb74..de32f0fe47c8 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1792,22 +1792,23 @@ xfs_inactive_ifree(
         int                     error;
 
         /*
-         * The ifree transaction might need to allocate blocks for record
-         * insertion to the finobt. We don't want to fail here at ENOSPC, so
-         * allow ifree to dip into the reserved block pool if necessary.
-         *
-         * Freeing large sets of inodes generally means freeing inode chunks,
-         * directory and file data blocks, so this should be relatively safe.
-         * Only under severe circumstances should it be possible to free enough
-         * inodes to exhaust the reserve block pool via finobt expansion while
-         * at the same time not creating free space in the filesystem.
+         * We try to use a per-AG reservation for any block needed by the finobt
+         * tree, but as the finobt feature predates the per-AG reservation
+         * support a degraded file system might not have enough space for the
+         * reservation at mount time.  In that case try to dip into the reserved
+         * pool and pray.
          *
          * Send a warning if the reservation does happen to fail, as the inode
          * now remains allocated and sits on the unlinked list until the fs is
          * repaired.
          */
-        error = xfs_trans_alloc(mp, &M_RES(mp)->tr_ifree,
-                        XFS_IFREE_SPACE_RES(mp), 0, XFS_TRANS_RESERVE, &tp);
+        if (unlikely(mp->m_inotbt_nores)) {
+                error = xfs_trans_alloc(mp, &M_RES(mp)->tr_ifree,
+                                XFS_IFREE_SPACE_RES(mp), 0, XFS_TRANS_RESERVE,
+                                &tp);
+        } else {
+                error = xfs_trans_alloc(mp, &M_RES(mp)->tr_ifree, 0, 0, 0, &tp);
+        }
         if (error) {
                 if (error == -ENOSPC) {
                         xfs_warn_ratelimited(mp,
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 0d147428971e..1aa3abd67b36 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -681,7 +681,7 @@ xfs_iomap_write_allocate(
         xfs_trans_t     *tp;
         int             nimaps;
         int             error = 0;
-        int             flags = 0;
+        int             flags = XFS_BMAPI_DELALLOC;
         int             nres;
 
         if (whichfork == XFS_COW_FORK)
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index 84f785218907..7f351f706b7a 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -140,6 +140,7 @@ typedef struct xfs_mount {
         int                     m_fixedfsid[2]; /* unchanged for life of FS */
         uint                    m_dmevmask;     /* DMI events for this FS */
         __uint64_t              m_flags;        /* global mount flags */
+        bool                    m_inotbt_nores; /* no per-AG finobt resv. */
         int                     m_ialloc_inos;  /* inodes in inode allocation */
         int                     m_ialloc_blks;  /* blocks in inode allocation */
         int                     m_ialloc_min_blks;/* min blocks in sparse inode
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index 45e50ea90769..b669b123287b 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -1177,7 +1177,8 @@ xfs_qm_dqusage_adjust(
          * the case in all other instances. It's OK that we do this because
          * quotacheck is done only at mount time.
          */
-        error = xfs_iget(mp, NULL, ino, 0, XFS_ILOCK_EXCL, &ip);
+        error = xfs_iget(mp, NULL, ino, XFS_IGET_DONTCACHE, XFS_ILOCK_EXCL,
+                         &ip);
         if (error) {
                 *res = BULKSTAT_RV_NOTHING;
                 return error;
diff --git a/include/asm-generic/export.h b/include/asm-generic/export.h
index 63554e9f6e0c..719db1968d81 100644
--- a/include/asm-generic/export.h
+++ b/include/asm-generic/export.h
@@ -9,18 +9,15 @@
 #ifndef KSYM_ALIGN
 #define KSYM_ALIGN 8
 #endif
-#ifndef KCRC_ALIGN
-#define KCRC_ALIGN 8
-#endif
 #else
 #define __put .long
 #ifndef KSYM_ALIGN
 #define KSYM_ALIGN 4
 #endif
+#endif
 #ifndef KCRC_ALIGN
 #define KCRC_ALIGN 4
 #endif
-#endif
 
 #ifdef CONFIG_HAVE_UNDERSCORE_SYMBOL_PREFIX
 #define KSYM(name) _##name
@@ -52,7 +49,11 @@ KSYM(__kstrtab_\name):
         .section ___kcrctab\sec+\name,"a"
         .balign KCRC_ALIGN
 KSYM(__kcrctab_\name):
-        __put KSYM(__crc_\name)
+#if defined(CONFIG_MODULE_REL_CRCS)
+        .long KSYM(__crc_\name) - .
+#else
+        .long KSYM(__crc_\name)
+#endif
         .weak KSYM(__crc_\name)
         .previous
 #endif
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 192016e2b518..9c4ee144b5f6 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -517,6 +517,7 @@ struct drm_device {
         struct drm_minor *control;              /**< Control node */
         struct drm_minor *primary;              /**< Primary node */
         struct drm_minor *render;               /**< Render node */
+        bool registered;
 
         /* currently active master for this device. Protected by master_mutex */
         struct drm_master *master;
diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h
index d6d241f63b9f..56814e8ae7ea 100644
--- a/include/drm/drm_atomic.h
+++ b/include/drm/drm_atomic.h
@@ -144,7 +144,7 @@ struct __drm_crtcs_state {
         struct drm_crtc *ptr;
         struct drm_crtc_state *state;
         struct drm_crtc_commit *commit;
-        s64 __user *out_fence_ptr;
+        s32 __user *out_fence_ptr;
 };
 
 struct __drm_connnectors_state {
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index a9b95246e26e..045a97cbeba2 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -381,6 +381,8 @@ struct drm_connector_funcs {
          * core drm connector interfaces. Everything added from this callback
          * should be unregistered in the early_unregister callback.
          *
+         * This is called while holding drm_connector->mutex.
+         *
          * Returns:
          *
          * 0 on success, or a negative error code on failure.
@@ -395,6 +397,8 @@ struct drm_connector_funcs {
          * late_register(). It is called from drm_connector_unregister(),
          * early in the driver unload sequence to disable userspace access
          * before data structures are torndown.
+         *
+         * This is called while holding drm_connector->mutex.
          */
         void (*early_unregister)(struct drm_connector *connector);
 
@@ -559,7 +563,6 @@ struct drm_cmdline_mode {
  * @interlace_allowed: can this connector handle interlaced modes?
  * @doublescan_allowed: can this connector handle doublescan?
  * @stereo_allowed: can this connector handle stereo modes?
- * @registered: is this connector exposed (registered) with userspace?
  * @modes: modes available on this connector (from fill_modes() + user)
  * @status: one of the drm_connector_status enums (connected, not, or unknown)
  * @probed_modes: list of modes derived directly from the display
@@ -608,6 +611,13 @@ struct drm_connector {
         char *name;
 
         /**
+         * @mutex: Lock for general connector state, but currently only protects
+         * @registered. Most of the connector state is still protected by the
+         * mutex in &drm_mode_config.
+         */
+        struct mutex mutex;
+
+        /**
          * @index: Compacted connector index, which matches the position inside
          * the mode_config.list for drivers not supporting hot-add/removing. Can
          * be used as an array index. It is invariant over the lifetime of the
@@ -620,6 +630,10 @@ struct drm_connector {
         bool interlace_allowed;
         bool doublescan_allowed;
         bool stereo_allowed;
+        /**
+         * @registered: Is this connector exposed (registered) with userspace?
+         * Protected by @mutex.
+         */
         bool registered;
         struct list_head modes; /* list of modes on this connector */
 
diff --git a/include/drm/drm_mode_config.h b/include/drm/drm_mode_config.h
index bf9991b20611..137432386310 100644
--- a/include/drm/drm_mode_config.h
+++ b/include/drm/drm_mode_config.h
@@ -488,7 +488,7 @@ struct drm_mode_config {
         /**
          * @prop_out_fence_ptr: Sync File fd pointer representing the
          * outgoing fences for a CRTC. Userspace should provide a pointer to a
-         * value of type s64, and then cast that pointer to u64.
+         * value of type s32, and then cast that pointer to u64.
          */
         struct drm_property *prop_out_fence_ptr;
         /**
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 05cf951df3fe..3ed1f3b1d594 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -247,6 +247,8 @@ struct bpf_map * __must_check bpf_map_inc(struct bpf_map *map, bool uref);
 void bpf_map_put_with_uref(struct bpf_map *map);
 void bpf_map_put(struct bpf_map *map);
 int bpf_map_precharge_memlock(u32 pages);
+void *bpf_map_area_alloc(size_t size);
+void bpf_map_area_free(void *base);
 
 extern int sysctl_unprivileged_bpf_disabled;
 
diff --git a/include/linux/can/core.h b/include/linux/can/core.h
index a0875001b13c..df08a41d5be5 100644
--- a/include/linux/can/core.h
+++ b/include/linux/can/core.h
@@ -45,10 +45,9 @@ struct can_proto {
 extern int  can_proto_register(const struct can_proto *cp);
 extern void can_proto_unregister(const struct can_proto *cp);
 
-extern int  can_rx_register(struct net_device *dev, canid_t can_id,
-                            canid_t mask,
-                            void (*func)(struct sk_buff *, void *),
-                            void *data, char *ident);
+int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
+                    void (*func)(struct sk_buff *, void *),
+                    void *data, char *ident, struct sock *sk);
 
 extern void can_rx_unregister(struct net_device *dev, canid_t can_id,
                               canid_t mask,
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index d936a0021839..921acaaa1601 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -8,9 +8,7 @@ enum cpuhp_state {
         CPUHP_CREATE_THREADS,
         CPUHP_PERF_PREPARE,
         CPUHP_PERF_X86_PREPARE,
-        CPUHP_PERF_X86_UNCORE_PREP,
         CPUHP_PERF_X86_AMD_UNCORE_PREP,
-        CPUHP_PERF_X86_RAPL_PREP,
         CPUHP_PERF_BFIN,
         CPUHP_PERF_POWER,
         CPUHP_PERF_SUPERH,
@@ -86,7 +84,6 @@ enum cpuhp_state {
         CPUHP_AP_IRQ_ARMADA_XP_STARTING,
         CPUHP_AP_IRQ_BCM2836_STARTING,
         CPUHP_AP_ARM_MVEBU_COHERENCY,
-        CPUHP_AP_PERF_X86_UNCORE_STARTING,
         CPUHP_AP_PERF_X86_AMD_UNCORE_STARTING,
         CPUHP_AP_PERF_X86_STARTING,
         CPUHP_AP_PERF_X86_AMD_IBS_STARTING,
diff --git a/include/linux/export.h b/include/linux/export.h
index 2a0f61fbc731..1a1dfdb2a5c6 100644
--- a/include/linux/export.h
+++ b/include/linux/export.h
@@ -43,12 +43,19 @@ extern struct module __this_module;
 #ifdef CONFIG_MODVERSIONS
 /* Mark the CRC weak since genksyms apparently decides not to
  * generate a checksums for some symbols */
+#if defined(CONFIG_MODULE_REL_CRCS)
 #define __CRC_SYMBOL(sym, sec)                                          \
-        extern __visible void *__crc_##sym __attribute__((weak));       \
-        static const unsigned long __kcrctab_##sym                      \
-        __used                                                          \
-        __attribute__((section("___kcrctab" sec "+" #sym), used))       \
-        = (unsigned long) &__crc_##sym;
+        asm("   .section \"___kcrctab" sec "+" #sym "\", \"a\"  \n"     \
+            "   .weak   " VMLINUX_SYMBOL_STR(__crc_##sym) "     \n"     \
+            "   .long   " VMLINUX_SYMBOL_STR(__crc_##sym) " - . \n"     \
+            "   .previous                                       \n");
+#else
+#define __CRC_SYMBOL(sym, sec)                                          \
+        asm("   .section \"___kcrctab" sec "+" #sym "\", \"a\"  \n"     \
+            "   .weak   " VMLINUX_SYMBOL_STR(__crc_##sym) "     \n"     \
+            "   .long   " VMLINUX_SYMBOL_STR(__crc_##sym) "     \n"     \
+            "   .previous                                       \n");
+#endif
 #else
 #define __CRC_SYMBOL(sym, sec)
 #endif
diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
index 13ba552e6c09..4c467ef50159 100644
--- a/include/linux/fscache-cache.h
+++ b/include/linux/fscache-cache.h
@@ -360,6 +360,7 @@ struct fscache_object {
 #define FSCACHE_OBJECT_IS_AVAILABLE     5       /* T if object has become active */
 #define FSCACHE_OBJECT_RETIRED          6       /* T if object was retired on relinquishment */
 #define FSCACHE_OBJECT_KILLED_BY_CACHE  7       /* T if object was killed by the cache */
+#define FSCACHE_OBJECT_RUN_AFTER_DEAD   8       /* T if object has been dispatched after death */
 
         struct list_head        cache_link;     /* link in cache->object_list */
         struct hlist_node       cookie_link;    /* link in cookie->backing_objects */
diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h
index c2748accea71..e973faba69dc 100644
--- a/include/linux/gpio/driver.h
+++ b/include/linux/gpio/driver.h
@@ -274,37 +274,67 @@ void gpiochip_set_nested_irqchip(struct gpio_chip *gpiochip,
                 struct irq_chip *irqchip,
                 int parent_irq);
 
-int _gpiochip_irqchip_add(struct gpio_chip *gpiochip,
+int gpiochip_irqchip_add_key(struct gpio_chip *gpiochip,
+                             struct irq_chip *irqchip,
+                             unsigned int first_irq,
+                             irq_flow_handler_t handler,
+                             unsigned int type,
+                             bool nested,
+                             struct lock_class_key *lock_key);
+
+#ifdef CONFIG_LOCKDEP
+
+/*
+ * Lockdep requires that each irqchip instance be created with a
+ * unique key so as to avoid unnecessary warnings. This upfront
+ * boilerplate static inlines provides such a key for each
+ * unique instance.
+ */
+static inline int gpiochip_irqchip_add(struct gpio_chip *gpiochip,
+                                       struct irq_chip *irqchip,
+                                       unsigned int first_irq,
+                                       irq_flow_handler_t handler,
+                                       unsigned int type)
+{
+        static struct lock_class_key key;
+
+        return gpiochip_irqchip_add_key(gpiochip, irqchip, first_irq,
+                                        handler, type, false, &key);
+}
+
+static inline int gpiochip_irqchip_add_nested(struct gpio_chip *gpiochip,
                           struct irq_chip *irqchip,
                           unsigned int first_irq,
                           irq_flow_handler_t handler,
-                          unsigned int type,
-                          bool nested,
-                          struct lock_class_key *lock_key);
+                          unsigned int type)
+{
+
+        static struct lock_class_key key;
+
+        return gpiochip_irqchip_add_key(gpiochip, irqchip, first_irq,
+                                        handler, type, true, &key);
+}
+#else
+static inline int gpiochip_irqchip_add(struct gpio_chip *gpiochip,
+                                       struct irq_chip *irqchip,
+                                       unsigned int first_irq,
+                                       irq_flow_handler_t handler,
+                                       unsigned int type)
+{
+        return gpiochip_irqchip_add_key(gpiochip, irqchip, first_irq,
+                                        handler, type, false, NULL);
+}
 
-/* FIXME: I assume threaded IRQchips do not have the lockdep problem */
 static inline int gpiochip_irqchip_add_nested(struct gpio_chip *gpiochip,
                           struct irq_chip *irqchip,
                           unsigned int first_irq,
                           irq_flow_handler_t handler,
                           unsigned int type)
 {
-        return _gpiochip_irqchip_add(gpiochip, irqchip, first_irq,
-                                     handler, type, true, NULL);
+        return gpiochip_irqchip_add_key(gpiochip, irqchip, first_irq,
+                                        handler, type, true, NULL);
 }
-
-#ifdef CONFIG_LOCKDEP
-#define gpiochip_irqchip_add(...)                               \
-(                                                               \
-        ({                                                      \
-                static struct lock_class_key _key;              \
-                _gpiochip_irqchip_add(__VA_ARGS__, false, &_key); \
-        })                                                      \
-)
-#else
-#define gpiochip_irqchip_add(...)                               \
-        _gpiochip_irqchip_add(__VA_ARGS__, false, NULL)
-#endif
+#endif /* CONFIG_LOCKDEP */
 
 #endif /* CONFIG_GPIOLIB_IRQCHIP */
 
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index 42fe43fb0c80..183efde54269 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -128,6 +128,7 @@ struct hv_ring_buffer_info {
         u32 ring_data_startoffset;
         u32 priv_write_index;
         u32 priv_read_index;
+        u32 cached_read_index;
 };
 
 /*
@@ -180,6 +181,19 @@ static inline u32 hv_get_bytes_to_write(struct hv_ring_buffer_info *rbi)
         return write;
 }
 
+static inline u32 hv_get_cached_bytes_to_write(
+        const struct hv_ring_buffer_info *rbi)
+{
+        u32 read_loc, write_loc, dsize, write;
+
+        dsize = rbi->ring_datasize;
+        read_loc = rbi->cached_read_index;
+        write_loc = rbi->ring_buffer->write_index;
+
+        write = write_loc >= read_loc ? dsize - (write_loc - read_loc) :
+                read_loc - write_loc;
+        return write;
+}
 /*
  * VMBUS version is 32 bit entity broken up into
  * two 16 bit quantities: major_number. minor_number.
@@ -1488,7 +1502,7 @@ hv_get_ring_buffer(struct hv_ring_buffer_info *ring_info)
 
 static inline  void hv_signal_on_read(struct vmbus_channel *channel)
 {
-        u32 cur_write_sz;
+        u32 cur_write_sz, cached_write_sz;
         u32 pending_sz;
         struct hv_ring_buffer_info *rbi = &channel->inbound;
 
@@ -1512,12 +1526,24 @@ static inline  void hv_signal_on_read(struct vmbus_channel *channel)
 
         cur_write_sz = hv_get_bytes_to_write(rbi);
 
-        if (cur_write_sz >= pending_sz)
+        if (cur_write_sz < pending_sz)
+                return;
+
+        cached_write_sz = hv_get_cached_bytes_to_write(rbi);
+        if (cached_write_sz < pending_sz)
                 vmbus_setevent(channel);
 
         return;
 }
 
+static inline void
+init_cached_read_index(struct vmbus_channel *channel)
+{
+        struct hv_ring_buffer_info *rbi = &channel->inbound;
+
+        rbi->cached_read_index = rbi->ring_buffer->read_index;
+}
+
 /*
  * An API to support in-place processing of incoming VMBUS packets.
  */
@@ -1569,6 +1595,8 @@ static inline void put_pkt_raw(struct vmbus_channel *channel,
  * This call commits the read index and potentially signals the host.
  * Here is the pattern for using the "in-place" consumption APIs:
  *
+ * init_cached_read_index();
+ *
  * while (get_next_pkt_raw() {
  *      process the packet "in-place";
  *      put_pkt_raw();
diff --git a/include/linux/irq.h b/include/linux/irq.h
index e79875574b39..39e3254e5769 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -184,6 +184,7 @@ struct irq_data {
  *
  * IRQD_TRIGGER_MASK            - Mask for the trigger type bits
  * IRQD_SETAFFINITY_PENDING     - Affinity setting is pending
+ * IRQD_ACTIVATED               - Interrupt has already been activated
  * IRQD_NO_BALANCING            - Balancing disabled for this IRQ
  * IRQD_PER_CPU                 - Interrupt is per cpu
  * IRQD_AFFINITY_SET            - Interrupt affinity was set
@@ -202,6 +203,7 @@ struct irq_data {
 enum {
         IRQD_TRIGGER_MASK               = 0xf,
         IRQD_SETAFFINITY_PENDING        = (1 <<  8),
+        IRQD_ACTIVATED                  = (1 <<  9),
         IRQD_NO_BALANCING               = (1 << 10),
         IRQD_PER_CPU                    = (1 << 11),
         IRQD_AFFINITY_SET               = (1 << 12),
@@ -312,6 +314,21 @@ static inline bool irqd_affinity_is_managed(struct irq_data *d)
         return __irqd_to_state(d) & IRQD_AFFINITY_MANAGED;
 }
 
+static inline bool irqd_is_activated(struct irq_data *d)
+{
+        return __irqd_to_state(d) & IRQD_ACTIVATED;
+}
+
+static inline void irqd_set_activated(struct irq_data *d)
+{
+        __irqd_to_state(d) |= IRQD_ACTIVATED;
+}
+
+static inline void irqd_clr_activated(struct irq_data *d)
+{
+        __irqd_to_state(d) &= ~IRQD_ACTIVATED;
+}
+
 #undef __irqd_to_state
 
 static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
diff --git a/include/linux/log2.h b/include/linux/log2.h
index fd7ff3d91e6a..ef3d4f67118c 100644
--- a/include/linux/log2.h
+++ b/include/linux/log2.h
@@ -203,6 +203,17 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
  *  ... and so on.
  */
 
-#define order_base_2(n) ilog2(roundup_pow_of_two(n))
+static inline __attribute_const__
+int __order_base_2(unsigned long n)
+{
+        return n > 1 ? ilog2(n - 1) + 1 : 0;
+}
 
+#define order_base_2(n)                         \
+(                                               \
+        __builtin_constant_p(n) ? (             \
+                ((n) == 0 || (n) == 1) ? 0 :    \
+                ilog2((n) - 1) + 1) :           \
+        __order_base_2(n)                       \
+)
 #endif /* _LINUX_LOG2_H */
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 01033fadea47..134a2f69c21a 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -85,7 +85,8 @@ extern int zone_grow_waitqueues(struct zone *zone, unsigned long nr_pages);
 extern int add_one_highpage(struct page *page, int pfn, int bad_ppro);
 /* VM interface that may be used by firmware interface */
 extern int online_pages(unsigned long, unsigned long, int);
-extern int test_pages_in_a_zone(unsigned long, unsigned long);
+extern int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
+        unsigned long *valid_start, unsigned long *valid_end);
 extern void __offline_isolated_pages(unsigned long, unsigned long);
 
 typedef void (*online_page_callback_t)(struct page *page);
@@ -284,7 +285,7 @@ extern void sparse_remove_one_section(struct zone *zone, struct mem_section *ms,
                 unsigned long map_offset);
 extern struct page *sparse_decode_mem_map(unsigned long coded_mem_map,
                                           unsigned long pnum);
-extern int zone_can_shift(unsigned long pfn, unsigned long nr_pages,
-                          enum zone_type target);
+extern bool zone_can_shift(unsigned long pfn, unsigned long nr_pages,
+                          enum zone_type target, int *zone_shift);
 
 #endif /* __LINUX_MEMORY_HOTPLUG_H */
diff --git a/include/linux/micrel_phy.h b/include/linux/micrel_phy.h
index 257173e0095e..f541da68d1e7 100644
--- a/include/linux/micrel_phy.h
+++ b/include/linux/micrel_phy.h
@@ -35,6 +35,8 @@
 #define PHY_ID_KSZ886X          0x00221430
 #define PHY_ID_KSZ8863          0x00221435
 
+#define PHY_ID_KSZ8795          0x00221550
+
 /* struct phy_device dev_flags definitions */
 #define MICREL_PHY_50MHZ_CLK    0x00000001
 #define MICREL_PHY_FXEN         0x00000002
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 36d9896fbc1e..f4aac87adcc3 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -972,12 +972,16 @@ static __always_inline struct zoneref *next_zones_zonelist(struct zoneref *z,
  * @zonelist - The zonelist to search for a suitable zone
  * @highest_zoneidx - The zone index of the highest zone to return
  * @nodes - An optional nodemask to filter the zonelist with
- * @zone - The first suitable zone found is returned via this parameter
+ * @return - Zoneref pointer for the first suitable zone found (see below)
  *
  * This function returns the first zone at or below a given zone index that is
  * within the allowed nodemask. The zoneref returned is a cursor that can be
  * used to iterate the zonelist with next_zones_zonelist by advancing it by
  * one before calling.
+ *
+ * When no eligible zone is found, zoneref->zone is NULL (zoneref itself is
+ * never NULL). This may happen either genuinely, or due to concurrent nodemask
+ * update due to cpuset modification.
  */
 static inline struct zoneref *first_zones_zonelist(struct zonelist *zonelist,
                                         enum zone_type highest_zoneidx,
diff --git a/include/linux/module.h b/include/linux/module.h
index 7c84273d60b9..cc7cba219b20 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -346,7 +346,7 @@ struct module {
 
         /* Exported symbols */
         const struct kernel_symbol *syms;
-        const unsigned long *crcs;
+        const s32 *crcs;
         unsigned int num_syms;
 
         /* Kernel parameters. */
@@ -359,18 +359,18 @@ struct module {
         /* GPL-only exported symbols. */
         unsigned int num_gpl_syms;
         const struct kernel_symbol *gpl_syms;
-        const unsigned long *gpl_crcs;
+        const s32 *gpl_crcs;
 
 #ifdef CONFIG_UNUSED_SYMBOLS
         /* unused exported symbols. */
         const struct kernel_symbol *unused_syms;
-        const unsigned long *unused_crcs;
+        const s32 *unused_crcs;
         unsigned int num_unused_syms;
 
         /* GPL-only, unused exported symbols. */
         unsigned int num_unused_gpl_syms;
         const struct kernel_symbol *unused_gpl_syms;
-        const unsigned long *unused_gpl_crcs;
+        const s32 *unused_gpl_crcs;
 #endif
 
 #ifdef CONFIG_MODULE_SIG
@@ -382,7 +382,7 @@ struct module {
 
         /* symbols that will be GPL-only in the near future. */
         const struct kernel_symbol *gpl_future_syms;
-        const unsigned long *gpl_future_crcs;
+        const s32 *gpl_future_crcs;
         unsigned int num_gpl_future_syms;
 
         /* Exception table */
@@ -523,7 +523,7 @@ struct module *find_module(const char *name);
 
 struct symsearch {
         const struct kernel_symbol *start, *stop;
-        const unsigned long *crcs;
+        const s32 *crcs;
         enum {
                 NOT_GPL_ONLY,
                 GPL_ONLY,
@@ -539,7 +539,7 @@ struct symsearch {
  */
 const struct kernel_symbol *find_symbol(const char *name,
                                         struct module **owner,
-                                        const unsigned long **crc,
+                                        const s32 **crc,
                                         bool gplok,
                                         bool warn);
 
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 9bde9558b596..70ad0291d517 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -866,11 +866,15 @@ struct netdev_xdp {
  *      of useless work if you return NETDEV_TX_BUSY.
  *      Required; cannot be NULL.
  *
- * netdev_features_t (*ndo_fix_features)(struct net_device *dev,
- *              netdev_features_t features);
- *      Adjusts the requested feature flags according to device-specific
- *      constraints, and returns the resulting flags. Must not modify
- *      the device state.
+ * netdev_features_t (*ndo_features_check)(struct sk_buff *skb,
+ *                                         struct net_device *dev
+ *                                         netdev_features_t features);
+ *      Called by core transmit path to determine if device is capable of
+ *      performing offload operations on a given packet. This is to give
+ *      the device an opportunity to implement any restrictions that cannot
+ *      be otherwise expressed by feature flags. The check is called with
+ *      the set of features that the stack has calculated and it returns
+ *      those the driver believes to be appropriate.
  *
  * u16 (*ndo_select_queue)(struct net_device *dev, struct sk_buff *skb,
  *                         void *accel_priv, select_queue_fallback_t fallback);
@@ -1028,6 +1032,12 @@ struct netdev_xdp {
  *      Called to release previously enslaved netdev.
  *
  *      Feature/offload setting functions.
+ * netdev_features_t (*ndo_fix_features)(struct net_device *dev,
+ *              netdev_features_t features);
+ *      Adjusts the requested feature flags according to device-specific
+ *      constraints, and returns the resulting flags. Must not modify
+ *      the device state.
+ *
  * int (*ndo_set_features)(struct net_device *dev, netdev_features_t features);
  *      Called to update device configuration to new features. Passed
  *      feature set might be less than what was returned by ndo_fix_features()).
@@ -1100,15 +1110,6 @@ struct netdev_xdp {
  *      Callback to use for xmit over the accelerated station. This
  *      is used in place of ndo_start_xmit on accelerated net
  *      devices.
- * netdev_features_t (*ndo_features_check)(struct sk_buff *skb,
- *                                         struct net_device *dev
- *                                         netdev_features_t features);
- *      Called by core transmit path to determine if device is capable of
- *      performing offload operations on a given packet. This is to give
- *      the device an opportunity to implement any restrictions that cannot
- *      be otherwise expressed by feature flags. The check is called with
- *      the set of features that the stack has calculated and it returns
- *      those the driver believes to be appropriate.
  * int (*ndo_set_tx_maxrate)(struct net_device *dev,
  *                           int queue_index, u32 maxrate);
  *      Called when a user wants to set a max-rate limitation of specific
diff --git a/include/linux/nfs4.h b/include/linux/nfs4.h
index bca536341d1a..1b1ca04820a3 100644
--- a/include/linux/nfs4.h
+++ b/include/linux/nfs4.h
@@ -282,7 +282,7 @@ enum nfsstat4 {
 
 static inline bool seqid_mutating_err(u32 err)
 {
-        /* rfc 3530 section 8.1.5: */
+        /* See RFC 7530, section 9.1.7 */
         switch (err) {
         case NFS4ERR_STALE_CLIENTID:
         case NFS4ERR_STALE_STATEID:
@@ -291,6 +291,7 @@ static inline bool seqid_mutating_err(u32 err)
         case NFS4ERR_BADXDR:
         case NFS4ERR_RESOURCE:
         case NFS4ERR_NOFILEHANDLE:
+        case NFS4ERR_MOVED:
                 return false;
         };
         return true;
diff --git a/include/linux/nmi.h b/include/linux/nmi.h
index aacca824a6ae..0a3fadc32693 100644
--- a/include/linux/nmi.h
+++ b/include/linux/nmi.h
@@ -110,6 +110,7 @@ extern int watchdog_user_enabled;
 extern int watchdog_thresh;
 extern unsigned long watchdog_enabled;
 extern unsigned long *watchdog_cpumask_bits;
+extern atomic_t watchdog_park_in_progress;
 #ifdef CONFIG_SMP
 extern int sysctl_softlockup_all_cpu_backtrace;
 extern int sysctl_hardlockup_all_cpu_backtrace;
diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h
index 1c7eec09e5eb..3a481a49546e 100644
--- a/include/linux/percpu-refcount.h
+++ b/include/linux/percpu-refcount.h
@@ -204,7 +204,7 @@ static inline void percpu_ref_get(struct percpu_ref *ref)
 static inline bool percpu_ref_tryget(struct percpu_ref *ref)
 {
         unsigned long __percpu *percpu_count;
-        int ret;
+        bool ret;
 
         rcu_read_lock_sched();
 
@@ -238,7 +238,7 @@ static inline bool percpu_ref_tryget(struct percpu_ref *ref)
 static inline bool percpu_ref_tryget_live(struct percpu_ref *ref)
 {
         unsigned long __percpu *percpu_count;
-        int ret = false;
+        bool ret = false;
 
         rcu_read_lock_sched();
 
diff --git a/include/linux/phy.h b/include/linux/phy.h
index f7d95f644eed..7fc1105605bf 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -25,7 +25,6 @@
 #include <linux/timer.h>
 #include <linux/workqueue.h>
 #include <linux/mod_devicetable.h>
-#include <linux/phy_led_triggers.h>
 
 #include <linux/atomic.h>
 
diff --git a/include/linux/phy_led_triggers.h b/include/linux/phy_led_triggers.h
index a2daea0a37d2..b37b05bfd1a6 100644
--- a/include/linux/phy_led_triggers.h
+++ b/include/linux/phy_led_triggers.h
@@ -18,11 +18,11 @@ struct phy_device;
 #ifdef CONFIG_LED_TRIGGER_PHY
 
 #include <linux/leds.h>
+#include <linux/phy.h>
 
 #define PHY_LED_TRIGGER_SPEED_SUFFIX_SIZE       10
-#define PHY_MII_BUS_ID_SIZE     (20 - 3)
 
-#define PHY_LINK_LED_TRIGGER_NAME_SIZE (PHY_MII_BUS_ID_SIZE + \
+#define PHY_LINK_LED_TRIGGER_NAME_SIZE (MII_BUS_ID_SIZE + \
                                        FIELD_SIZEOF(struct mdio_device, addr)+\
                                        PHY_LED_TRIGGER_SPEED_SUFFIX_SIZE)
 
diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
index 85cc819676e8..333ad11b3dd9 100644
--- a/include/linux/sunrpc/clnt.h
+++ b/include/linux/sunrpc/clnt.h
@@ -216,5 +216,6 @@ void rpc_clnt_xprt_switch_put(struct rpc_clnt *);
 void rpc_clnt_xprt_switch_add_xprt(struct rpc_clnt *, struct rpc_xprt *);
 bool rpc_clnt_xprt_switch_has_addr(struct rpc_clnt *clnt,
                         const struct sockaddr *sap);
+void rpc_cleanup_clids(void);
 #endif /* __KERNEL__ */
 #endif /* _LINUX_SUNRPC_CLNT_H */
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 0c729c3c8549..d9718378a8be 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -194,8 +194,6 @@ struct platform_freeze_ops {
 };
 
 #ifdef CONFIG_SUSPEND
-extern suspend_state_t mem_sleep_default;
-
 /**
  * suspend_set_ops - set platform dependent suspend operations
  * @ops: The new suspend operations to set.
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index 66204007d7ac..5209b5ed2a64 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -56,7 +56,8 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
 
 static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb,
                                           struct virtio_net_hdr *hdr,
-                                          bool little_endian)
+                                          bool little_endian,
+                                          bool has_data_valid)
 {
         memset(hdr, 0, sizeof(*hdr));   /* no info leak */
 
@@ -91,7 +92,8 @@ static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb,
                                 skb_checksum_start_offset(skb));
                 hdr->csum_offset = __cpu_to_virtio16(little_endian,
                                 skb->csum_offset);
-        } else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
+        } else if (has_data_valid &&
+                   skb->ip_summed == CHECKSUM_UNNECESSARY) {
                 hdr->flags = VIRTIO_NET_HDR_F_DATA_VALID;
         } /* else everything is zero */
 
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 487e57391664..dbf0abba33b8 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -776,6 +776,11 @@ static inline __be32 ip6_make_flowlabel(struct net *net, struct sk_buff *skb,
 {
         u32 hash;
 
+        /* @flowlabel may include more than a flow label, eg, the traffic class.
+         * Here we want only the flow label value.
+         */
+        flowlabel &= IPV6_FLOWLABEL_MASK;
+
         if (flowlabel ||
             net->ipv6.sysctl.auto_flowlabels == IP6_AUTO_FLOW_LABEL_OFF ||
             (!autolabel &&
@@ -871,7 +876,7 @@ int ip6_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
  *      upper-layer output functions
  */
 int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
-             struct ipv6_txoptions *opt, int tclass);
+             __u32 mark, struct ipv6_txoptions *opt, int tclass);
 
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr);
 
diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h
index d4c1c75b8862..73dd87647460 100644
--- a/include/net/lwtunnel.h
+++ b/include/net/lwtunnel.h
@@ -44,6 +44,8 @@ struct lwtunnel_encap_ops {
         int (*get_encap_size)(struct lwtunnel_state *lwtstate);
         int (*cmp_encap)(struct lwtunnel_state *a, struct lwtunnel_state *b);
         int (*xmit)(struct sk_buff *skb);
+
+        struct module *owner;
 };
 
 #ifdef CONFIG_LWTUNNEL
@@ -105,6 +107,8 @@ int lwtunnel_encap_add_ops(const struct lwtunnel_encap_ops *op,
                            unsigned int num);
 int lwtunnel_encap_del_ops(const struct lwtunnel_encap_ops *op,
                            unsigned int num);
+int lwtunnel_valid_encap_type(u16 encap_type);
+int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int len);
 int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
                          struct nlattr *encap,
                          unsigned int family, const void *cfg,
@@ -168,6 +172,15 @@ static inline int lwtunnel_encap_del_ops(const struct lwtunnel_encap_ops *op,
         return -EOPNOTSUPP;
 }
 
+static inline int lwtunnel_valid_encap_type(u16 encap_type)
+{
+        return -EOPNOTSUPP;
+}
+static inline int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int len)
+{
+        return -EOPNOTSUPP;
+}
+
 static inline int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
                                        struct nlattr *encap,
                                        unsigned int family, const void *cfg,
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 924325c46aab..7dfdb517f0be 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -207,9 +207,9 @@ struct nft_set_iter {
         unsigned int    skip;
         int             err;
         int             (*fn)(const struct nft_ctx *ctx,
-                              const struct nft_set *set,
+                              struct nft_set *set,
                               const struct nft_set_iter *iter,
-                              const struct nft_set_elem *elem);
+                              struct nft_set_elem *elem);
 };
 
 /**
@@ -301,7 +301,7 @@ struct nft_set_ops {
         void                            (*remove)(const struct nft_set *set,
                                                   const struct nft_set_elem *elem);
         void                            (*walk)(const struct nft_ctx *ctx,
-                                                const struct nft_set *set,
+                                                struct nft_set *set,
                                                 struct nft_set_iter *iter);
 
         unsigned int                    (*privsize)(const struct nlattr * const nla[]);
diff --git a/include/net/netfilter/nft_fib.h b/include/net/netfilter/nft_fib.h
index cbedda077db2..5ceb2205e4e3 100644
--- a/include/net/netfilter/nft_fib.h
+++ b/include/net/netfilter/nft_fib.h
@@ -9,6 +9,12 @@ struct nft_fib {
 
 extern const struct nla_policy nft_fib_policy[];
 
+static inline bool
+nft_fib_is_loopback(const struct sk_buff *skb, const struct net_device *in)
+{
+        return skb->pkt_type == PACKET_LOOPBACK || in->flags & IFF_LOOPBACK;
+}
+
 int nft_fib_dump(struct sk_buff *skb, const struct nft_expr *expr);
 int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                  const struct nlattr * const tb[]);
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 958a24d8fae7..b567e4452a47 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -352,6 +352,20 @@ static inline int ib_mtu_enum_to_int(enum ib_mtu mtu)
         }
 }
 
+static inline enum ib_mtu ib_mtu_int_to_enum(int mtu)
+{
+        if (mtu >= 4096)
+                return IB_MTU_4096;
+        else if (mtu >= 2048)
+                return IB_MTU_2048;
+        else if (mtu >= 1024)
+                return IB_MTU_1024;
+        else if (mtu >= 512)
+                return IB_MTU_512;
+        else
+                return IB_MTU_256;
+}
+
 enum ib_port_state {
         IB_PORT_NOP             = 0,
         IB_PORT_DOWN            = 1,
diff --git a/include/soc/arc/mcip.h b/include/soc/arc/mcip.h
index 6902c2a8bd23..4b6b489a8d7c 100644
--- a/include/soc/arc/mcip.h
+++ b/include/soc/arc/mcip.h
@@ -55,17 +55,17 @@ struct mcip_cmd {
 
 struct mcip_bcr {
 #ifdef CONFIG_CPU_BIG_ENDIAN
-                unsigned int pad3:8,
-                             idu:1, llm:1, num_cores:6,
-                             iocoh:1,  gfrc:1, dbg:1, pad2:1,
-                             msg:1, sem:1, ipi:1, pad:1,
+                unsigned int pad4:6, pw_dom:1, pad3:1,
+                             idu:1, pad2:1, num_cores:6,
+                             pad:1,  gfrc:1, dbg:1, pw:1,
+                             msg:1, sem:1, ipi:1, slv:1,
                              ver:8;
 #else
                 unsigned int ver:8,
-                             pad:1, ipi:1, sem:1, msg:1,
-                             pad2:1, dbg:1, gfrc:1, iocoh:1,
-                             num_cores:6, llm:1, idu:1,
-                             pad3:8;
+                             slv:1, ipi:1, sem:1, msg:1,
+                             pw:1, dbg:1, gfrc:1, pad:1,
+                             num_cores:6, pad2:1, idu:1,
+                             pad3:1, pw_dom:1, pad4:6;
 #endif
 };
 
diff --git a/include/uapi/linux/cec-funcs.h b/include/uapi/linux/cec-funcs.h
index 3cbc327801d6..c451eec42a83 100644
--- a/include/uapi/linux/cec-funcs.h
+++ b/include/uapi/linux/cec-funcs.h
@@ -1665,14 +1665,15 @@ static inline void cec_msg_report_current_latency(struct cec_msg *msg,
                                                   __u8 audio_out_compensated,
                                                   __u8 audio_out_delay)
 {
-        msg->len = 7;
+        msg->len = 6;
         msg->msg[0] |= 0xf; /* broadcast */
         msg->msg[1] = CEC_MSG_REPORT_CURRENT_LATENCY;
         msg->msg[2] = phys_addr >> 8;
         msg->msg[3] = phys_addr & 0xff;
         msg->msg[4] = video_latency;
         msg->msg[5] = (low_latency_mode << 2) | audio_out_compensated;
-        msg->msg[6] = audio_out_delay;
+        if (audio_out_compensated == 3)
+                msg->msg[msg->len++] = audio_out_delay;
 }
 
 static inline void cec_ops_report_current_latency(const struct cec_msg *msg,
@@ -1686,7 +1687,10 @@ static inline void cec_ops_report_current_latency(const struct cec_msg *msg,
         *video_latency = msg->msg[4];
         *low_latency_mode = (msg->msg[5] >> 2) & 1;
         *audio_out_compensated = msg->msg[5] & 3;
-        *audio_out_delay = msg->msg[6];
+        if (*audio_out_compensated == 3 && msg->len >= 7)
+                *audio_out_delay = msg->msg[6];
+        else
+                *audio_out_delay = 0;
 }
 
 static inline void cec_msg_request_current_latency(struct cec_msg *msg,
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index f0db7788f887..3dc91a46e8b8 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -1384,6 +1384,8 @@ enum ethtool_link_mode_bit_indices {
         ETHTOOL_LINK_MODE_10000baseLR_Full_BIT  = 44,
         ETHTOOL_LINK_MODE_10000baseLRM_Full_BIT = 45,
         ETHTOOL_LINK_MODE_10000baseER_Full_BIT  = 46,
+        ETHTOOL_LINK_MODE_2500baseT_Full_BIT    = 47,
+        ETHTOOL_LINK_MODE_5000baseT_Full_BIT    = 48,
 
 
         /* Last allowed bit for __ETHTOOL_LINK_MODE_LEGACY_MASK is bit
@@ -1393,7 +1395,7 @@ enum ethtool_link_mode_bit_indices {
          */
 
         __ETHTOOL_LINK_MODE_LAST
-          = ETHTOOL_LINK_MODE_10000baseER_Full_BIT,
+          = ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
 };
 
 #define __ETHTOOL_LINK_MODE_LEGACY_MASK(base_name)      \
diff --git a/include/uapi/linux/netfilter/nf_log.h b/include/uapi/linux/netfilter/nf_log.h
index 8be21e02387d..d0b5fa91ff54 100644
--- a/include/uapi/linux/netfilter/nf_log.h
+++ b/include/uapi/linux/netfilter/nf_log.h
@@ -9,4 +9,6 @@
 #define NF_LOG_MACDECODE        0x20    /* Decode MAC header */
 #define NF_LOG_MASK             0x2f
 
+#define NF_LOG_PREFIXLEN        128
+
 #endif /* _NETFILTER_NF_LOG_H */
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 881d49e94569..e3f27e09eb2b 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -235,7 +235,7 @@ enum nft_rule_compat_flags {
 /**
  * enum nft_rule_compat_attributes - nf_tables rule compat attributes
  *
- * @NFTA_RULE_COMPAT_PROTO: numerice value of handled protocol (NLA_U32)
+ * @NFTA_RULE_COMPAT_PROTO: numeric value of handled protocol (NLA_U32)
  * @NFTA_RULE_COMPAT_FLAGS: bitmask of enum nft_rule_compat_flags (NLA_U32)
  */
 enum nft_rule_compat_attributes {
@@ -499,7 +499,7 @@ enum nft_bitwise_attributes {
  * enum nft_byteorder_ops - nf_tables byteorder operators
  *
  * @NFT_BYTEORDER_NTOH: network to host operator
- * @NFT_BYTEORDER_HTON: host to network opertaor
+ * @NFT_BYTEORDER_HTON: host to network operator
  */
 enum nft_byteorder_ops {
         NFT_BYTEORDER_NTOH,
diff --git a/include/uapi/rdma/Kbuild b/include/uapi/rdma/Kbuild
index 82bdf5626859..bb68cb1b04ed 100644
--- a/include/uapi/rdma/Kbuild
+++ b/include/uapi/rdma/Kbuild
@@ -16,3 +16,4 @@ header-y += nes-abi.h
 header-y += ocrdma-abi.h
 header-y += hns-abi.h
 header-y += vmw_pvrdma-abi.h
+header-y += qedr-abi.h
diff --git a/include/uapi/rdma/cxgb3-abi.h b/include/uapi/rdma/cxgb3-abi.h
index 48a19bda071b..d24eee12128f 100644
--- a/include/uapi/rdma/cxgb3-abi.h
+++ b/include/uapi/rdma/cxgb3-abi.h
@@ -30,7 +30,7 @@
  * SOFTWARE.
  */
 #ifndef CXGB3_ABI_USER_H
-#define CXBG3_ABI_USER_H
+#define CXGB3_ABI_USER_H
 
 #include <linux/types.h>
 
diff --git a/init/Kconfig b/init/Kconfig
index e1a937348a3e..4dd8bd232a1d 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1987,6 +1987,10 @@ config MODVERSIONS
           make them incompatible with the kernel you are running.  If
           unsure, say N.
 
+config MODULE_REL_CRCS
+        bool
+        depends on MODVERSIONS
+
 config MODULE_SRCVERSION_ALL
         bool "Source checksum for all modules"
         help
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 229a5d5df977..3d55d95dcf49 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -11,7 +11,6 @@
  */
 #include <linux/bpf.h>
 #include <linux/err.h>
-#include <linux/vmalloc.h>
 #include <linux/slab.h>
 #include <linux/mm.h>
 #include <linux/filter.h>
@@ -74,14 +73,10 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr)
         if (array_size >= U32_MAX - PAGE_SIZE)
                 return ERR_PTR(-ENOMEM);
 
-
         /* allocate all map elements and zero-initialize them */
-        array = kzalloc(array_size, GFP_USER | __GFP_NOWARN);
-        if (!array) {
-                array = vzalloc(array_size);
-                if (!array)
-                        return ERR_PTR(-ENOMEM);
-        }
+        array = bpf_map_area_alloc(array_size);
+        if (!array)
+                return ERR_PTR(-ENOMEM);
 
         /* copy mandatory map attributes */
         array->map.map_type = attr->map_type;
@@ -97,7 +92,7 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr)
 
         if (array_size >= U32_MAX - PAGE_SIZE ||
             elem_size > PCPU_MIN_UNIT_SIZE || bpf_array_alloc_percpu(array)) {
-                kvfree(array);
+                bpf_map_area_free(array);
                 return ERR_PTR(-ENOMEM);
         }
 out:
@@ -262,7 +257,7 @@ static void array_map_free(struct bpf_map *map)
         if (array->map.map_type == BPF_MAP_TYPE_PERCPU_ARRAY)
                 bpf_array_free_percpu(array);
 
-        kvfree(array);
+        bpf_map_area_free(array);
 }
 
 static const struct bpf_map_ops array_ops = {
@@ -319,7 +314,8 @@ static void fd_array_map_free(struct bpf_map *map)
         /* make sure it's empty */
         for (i = 0; i < array->map.max_entries; i++)
                 BUG_ON(array->ptrs[i] != NULL);
-        kvfree(array);
+
+        bpf_map_area_free(array);
 }
 
 static void *fd_array_map_lookup_elem(struct bpf_map *map, void *key)
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 3f2bb58952d8..a753bbe7df0a 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -13,7 +13,6 @@
 #include <linux/bpf.h>
 #include <linux/jhash.h>
 #include <linux/filter.h>
-#include <linux/vmalloc.h>
 #include "percpu_freelist.h"
 #include "bpf_lru_list.h"
 
@@ -103,7 +102,7 @@ static void htab_free_elems(struct bpf_htab *htab)
                 free_percpu(pptr);
         }
 free_elems:
-        vfree(htab->elems);
+        bpf_map_area_free(htab->elems);
 }
 
 static struct htab_elem *prealloc_lru_pop(struct bpf_htab *htab, void *key,
@@ -125,7 +124,8 @@ static int prealloc_init(struct bpf_htab *htab)
 {
         int err = -ENOMEM, i;
 
-        htab->elems = vzalloc(htab->elem_size * htab->map.max_entries);
+        htab->elems = bpf_map_area_alloc(htab->elem_size *
+                                         htab->map.max_entries);
         if (!htab->elems)
                 return -ENOMEM;
 
@@ -320,14 +320,10 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
                 goto free_htab;
 
         err = -ENOMEM;
-        htab->buckets = kmalloc_array(htab->n_buckets, sizeof(struct bucket),
-                                      GFP_USER | __GFP_NOWARN);
-
-        if (!htab->buckets) {
-                htab->buckets = vmalloc(htab->n_buckets * sizeof(struct bucket));
-                if (!htab->buckets)
-                        goto free_htab;
-        }
+        htab->buckets = bpf_map_area_alloc(htab->n_buckets *
+                                           sizeof(struct bucket));
+        if (!htab->buckets)
+                goto free_htab;
 
         for (i = 0; i < htab->n_buckets; i++) {
                 INIT_HLIST_HEAD(&htab->buckets[i].head);
@@ -354,7 +350,7 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
 free_extra_elems:
         free_percpu(htab->extra_elems);
 free_buckets:
-        kvfree(htab->buckets);
+        bpf_map_area_free(htab->buckets);
 free_htab:
         kfree(htab);
         return ERR_PTR(err);
@@ -1014,7 +1010,7 @@ static void htab_map_free(struct bpf_map *map)
                 prealloc_destroy(htab);
 
         free_percpu(htab->extra_elems);
-        kvfree(htab->buckets);
+        bpf_map_area_free(htab->buckets);
         kfree(htab);
 }
 
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 732ae16d12b7..be8519148c25 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -7,7 +7,6 @@
 #include <linux/bpf.h>
 #include <linux/jhash.h>
 #include <linux/filter.h>
-#include <linux/vmalloc.h>
 #include <linux/stacktrace.h>
 #include <linux/perf_event.h>
 #include "percpu_freelist.h"
@@ -32,7 +31,7 @@ static int prealloc_elems_and_freelist(struct bpf_stack_map *smap)
         u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size;
         int err;
 
-        smap->elems = vzalloc(elem_size * smap->map.max_entries);
+        smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries);
         if (!smap->elems)
                 return -ENOMEM;
 
@@ -45,7 +44,7 @@ static int prealloc_elems_and_freelist(struct bpf_stack_map *smap)
         return 0;
 
 free_elems:
-        vfree(smap->elems);
+        bpf_map_area_free(smap->elems);
         return err;
 }
 
@@ -76,12 +75,9 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)
         if (cost >= U32_MAX - PAGE_SIZE)
                 return ERR_PTR(-E2BIG);
 
-        smap = kzalloc(cost, GFP_USER | __GFP_NOWARN);
-        if (!smap) {
-                smap = vzalloc(cost);
-                if (!smap)
-                        return ERR_PTR(-ENOMEM);
-        }
+        smap = bpf_map_area_alloc(cost);
+        if (!smap)
+                return ERR_PTR(-ENOMEM);
 
         err = -E2BIG;
         cost += n_buckets * (value_size + sizeof(struct stack_map_bucket));
@@ -112,7 +108,7 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)
 put_buffers:
         put_callchain_buffers();
 free_smap:
-        kvfree(smap);
+        bpf_map_area_free(smap);
         return ERR_PTR(err);
 }
 
@@ -262,9 +258,9 @@ static void stack_map_free(struct bpf_map *map)
         /* wait for bpf programs to complete before freeing stack map */
         synchronize_rcu();
 
-        vfree(smap->elems);
+        bpf_map_area_free(smap->elems);
         pcpu_freelist_destroy(&smap->freelist);
-        kvfree(smap);
+        bpf_map_area_free(smap);
         put_callchain_buffers();
 }
 
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 1d6b29e4e2c3..19b6129eab23 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -12,6 +12,8 @@
 #include <linux/bpf.h>
 #include <linux/syscalls.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/mmzone.h>
 #include <linux/anon_inodes.h>
 #include <linux/file.h>
 #include <linux/license.h>
@@ -49,6 +51,30 @@ void bpf_register_map_type(struct bpf_map_type_list *tl)
         list_add(&tl->list_node, &bpf_map_types);
 }
 
+void *bpf_map_area_alloc(size_t size)
+{
+        /* We definitely need __GFP_NORETRY, so OOM killer doesn't
+         * trigger under memory pressure as we really just want to
+         * fail instead.
+         */
+        const gfp_t flags = __GFP_NOWARN | __GFP_NORETRY | __GFP_ZERO;
+        void *area;
+
+        if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
+                area = kmalloc(size, GFP_USER | flags);
+                if (area != NULL)
+                        return area;
+        }
+
+        return __vmalloc(size, GFP_KERNEL | __GFP_HIGHMEM | flags,
+                         PAGE_KERNEL);
+}
+
+void bpf_map_area_free(void *area)
+{
+        kvfree(area);
+}
+
 int bpf_map_precharge_memlock(u32 pages)
 {
         struct user_struct *user = get_current_user();
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 2ee9ec3051b2..688dd02af985 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -5221,6 +5221,11 @@ err_free_css:
         return ERR_PTR(err);
 }
 
+/*
+ * The returned cgroup is fully initialized including its control mask, but
+ * it isn't associated with its kernfs_node and doesn't have the control
+ * mask applied.
+ */
 static struct cgroup *cgroup_create(struct cgroup *parent)
 {
         struct cgroup_root *root = parent->root;
@@ -5288,11 +5293,6 @@ static struct cgroup *cgroup_create(struct cgroup *parent)
 
         cgroup_propagate_control(cgrp);
 
-        /* @cgrp doesn't have dir yet so the following will only create csses */
-        ret = cgroup_apply_control_enable(cgrp);
-        if (ret)
-                goto out_destroy;
-
         return cgrp;
 
 out_cancel_ref:
@@ -5300,9 +5300,6 @@ out_cancel_ref:
 out_free_cgrp:
         kfree(cgrp);
         return ERR_PTR(ret);
-out_destroy:
-        cgroup_destroy_locked(cgrp);
-        return ERR_PTR(ret);
 }
 
 static int cgroup_mkdir(struct kernfs_node *parent_kn, const char *name,
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 110b38a58493..e5aaa806702d 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1469,7 +1469,6 @@ ctx_group_list(struct perf_event *event, struct perf_event_context *ctx)
 static void
 list_add_event(struct perf_event *event, struct perf_event_context *ctx)
 {
-
         lockdep_assert_held(&ctx->lock);
 
         WARN_ON_ONCE(event->attach_state & PERF_ATTACH_CONTEXT);
@@ -1624,6 +1623,8 @@ static void perf_group_attach(struct perf_event *event)
 {
         struct perf_event *group_leader = event->group_leader, *pos;
 
+        lockdep_assert_held(&event->ctx->lock);
+
         /*
          * We can have double attach due to group movement in perf_event_open.
          */
@@ -1697,6 +1698,8 @@ static void perf_group_detach(struct perf_event *event)
         struct perf_event *sibling, *tmp;
         struct list_head *list = NULL;
 
+        lockdep_assert_held(&event->ctx->lock);
+
         /*
          * We can have double detach due to exit/hot-unplug + close.
          */
@@ -1895,9 +1898,29 @@ __perf_remove_from_context(struct perf_event *event,
  */
 static void perf_remove_from_context(struct perf_event *event, unsigned long flags)
 {
-        lockdep_assert_held(&event->ctx->mutex);
+        struct perf_event_context *ctx = event->ctx;
+
+        lockdep_assert_held(&ctx->mutex);
 
         event_function_call(event, __perf_remove_from_context, (void *)flags);
+
+        /*
+         * The above event_function_call() can NO-OP when it hits
+         * TASK_TOMBSTONE. In that case we must already have been detached
+         * from the context (by perf_event_exit_event()) but the grouping
+         * might still be in-tact.
+         */
+        WARN_ON_ONCE(event->attach_state & PERF_ATTACH_CONTEXT);
+        if ((flags & DETACH_GROUP) &&
+            (event->attach_state & PERF_ATTACH_GROUP)) {
+                /*
+                 * Since in that case we cannot possibly be scheduled, simply
+                 * detach now.
+                 */
+                raw_spin_lock_irq(&ctx->lock);
+                perf_group_detach(event);
+                raw_spin_unlock_irq(&ctx->lock);
+        }
 }
 
 /*
@@ -6609,6 +6632,27 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
         char *buf = NULL;
         char *name;
 
+        if (vma->vm_flags & VM_READ)
+                prot |= PROT_READ;
+        if (vma->vm_flags & VM_WRITE)
+                prot |= PROT_WRITE;
+        if (vma->vm_flags & VM_EXEC)
+                prot |= PROT_EXEC;
+
+        if (vma->vm_flags & VM_MAYSHARE)
+                flags = MAP_SHARED;
+        else
+                flags = MAP_PRIVATE;
+
+        if (vma->vm_flags & VM_DENYWRITE)
+                flags |= MAP_DENYWRITE;
+        if (vma->vm_flags & VM_MAYEXEC)
+                flags |= MAP_EXECUTABLE;
+        if (vma->vm_flags & VM_LOCKED)
+                flags |= MAP_LOCKED;
+        if (vma->vm_flags & VM_HUGETLB)
+                flags |= MAP_HUGETLB;
+
         if (file) {
                 struct inode *inode;
                 dev_t dev;
@@ -6635,27 +6679,6 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
                 maj = MAJOR(dev);
                 min = MINOR(dev);
 
-                if (vma->vm_flags & VM_READ)
-                        prot |= PROT_READ;
-                if (vma->vm_flags & VM_WRITE)
-                        prot |= PROT_WRITE;
-                if (vma->vm_flags & VM_EXEC)
-                        prot |= PROT_EXEC;
-
-                if (vma->vm_flags & VM_MAYSHARE)
-                        flags = MAP_SHARED;
-                else
-                        flags = MAP_PRIVATE;
-
-                if (vma->vm_flags & VM_DENYWRITE)
-                        flags |= MAP_DENYWRITE;
-                if (vma->vm_flags & VM_MAYEXEC)
-                        flags |= MAP_EXECUTABLE;
-                if (vma->vm_flags & VM_LOCKED)
-                        flags |= MAP_LOCKED;
-                if (vma->vm_flags & VM_HUGETLB)
-                        flags |= MAP_HUGETLB;
-
                 goto got_name;
         } else {
                 if (vma->vm_ops && vma->vm_ops->name) {
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 8c0a0ae43521..b59e6768c5e9 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1346,6 +1346,30 @@ void irq_domain_free_irqs_parent(struct irq_domain *domain,
 }
 EXPORT_SYMBOL_GPL(irq_domain_free_irqs_parent);
 
+static void __irq_domain_activate_irq(struct irq_data *irq_data)
+{
+        if (irq_data && irq_data->domain) {
+                struct irq_domain *domain = irq_data->domain;
+
+                if (irq_data->parent_data)
+                        __irq_domain_activate_irq(irq_data->parent_data);
+                if (domain->ops->activate)
+                        domain->ops->activate(domain, irq_data);
+        }
+}
+
+static void __irq_domain_deactivate_irq(struct irq_data *irq_data)
+{
+        if (irq_data && irq_data->domain) {
+                struct irq_domain *domain = irq_data->domain;
+
+                if (domain->ops->deactivate)
+                        domain->ops->deactivate(domain, irq_data);
+                if (irq_data->parent_data)
+                        __irq_domain_deactivate_irq(irq_data->parent_data);
+        }
+}
+
 /**
  * irq_domain_activate_irq - Call domain_ops->activate recursively to activate
  *                           interrupt
@@ -1356,13 +1380,9 @@ EXPORT_SYMBOL_GPL(irq_domain_free_irqs_parent);
  */
 void irq_domain_activate_irq(struct irq_data *irq_data)
 {
-        if (irq_data && irq_data->domain) {
-                struct irq_domain *domain = irq_data->domain;
-
-                if (irq_data->parent_data)
-                        irq_domain_activate_irq(irq_data->parent_data);
-                if (domain->ops->activate)
-                        domain->ops->activate(domain, irq_data);
+        if (!irqd_is_activated(irq_data)) {
+                __irq_domain_activate_irq(irq_data);
+                irqd_set_activated(irq_data);
         }
 }
 
@@ -1376,13 +1396,9 @@ void irq_domain_activate_irq(struct irq_data *irq_data)
  */
 void irq_domain_deactivate_irq(struct irq_data *irq_data)
 {
-        if (irq_data && irq_data->domain) {
-                struct irq_domain *domain = irq_data->domain;
-
-                if (domain->ops->deactivate)
-                        domain->ops->deactivate(domain, irq_data);
-                if (irq_data->parent_data)
-                        irq_domain_deactivate_irq(irq_data->parent_data);
+        if (irqd_is_activated(irq_data)) {
+                __irq_domain_deactivate_irq(irq_data);
+                irqd_clr_activated(irq_data);
         }
 }
 
diff --git a/kernel/module.c b/kernel/module.c
index 38d4270925d4..3d8f126208e3 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -389,16 +389,16 @@ extern const struct kernel_symbol __start___ksymtab_gpl[];
 extern const struct kernel_symbol __stop___ksymtab_gpl[];
 extern const struct kernel_symbol __start___ksymtab_gpl_future[];
 extern const struct kernel_symbol __stop___ksymtab_gpl_future[];
-extern const unsigned long __start___kcrctab[];
-extern const unsigned long __start___kcrctab_gpl[];
-extern const unsigned long __start___kcrctab_gpl_future[];
+extern const s32 __start___kcrctab[];
+extern const s32 __start___kcrctab_gpl[];
+extern const s32 __start___kcrctab_gpl_future[];
 #ifdef CONFIG_UNUSED_SYMBOLS
 extern const struct kernel_symbol __start___ksymtab_unused[];
 extern const struct kernel_symbol __stop___ksymtab_unused[];
 extern const struct kernel_symbol __start___ksymtab_unused_gpl[];
 extern const struct kernel_symbol __stop___ksymtab_unused_gpl[];
-extern const unsigned long __start___kcrctab_unused[];
-extern const unsigned long __start___kcrctab_unused_gpl[];
+extern const s32 __start___kcrctab_unused[];
+extern const s32 __start___kcrctab_unused_gpl[];
 #endif
 
 #ifndef CONFIG_MODVERSIONS
@@ -497,7 +497,7 @@ struct find_symbol_arg {
 
         /* Output */
         struct module *owner;
-        const unsigned long *crc;
+        const s32 *crc;
         const struct kernel_symbol *sym;
 };
 
@@ -563,7 +563,7 @@ static bool find_symbol_in_section(const struct symsearch *syms,
  * (optional) module which owns it.  Needs preempt disabled or module_mutex. */
 const struct kernel_symbol *find_symbol(const char *name,
                                         struct module **owner,
-                                        const unsigned long **crc,
+                                        const s32 **crc,
                                         bool gplok,
                                         bool warn)
 {
@@ -1249,23 +1249,17 @@ static int try_to_force_load(struct module *mod, const char *reason)
 }
 
 #ifdef CONFIG_MODVERSIONS
-/* If the arch applies (non-zero) relocations to kernel kcrctab, unapply it. */
-static unsigned long maybe_relocated(unsigned long crc,
-                                     const struct module *crc_owner)
+
+static u32 resolve_rel_crc(const s32 *crc)
 {
-#ifdef ARCH_RELOCATES_KCRCTAB
-        if (crc_owner == NULL)
-                return crc - (unsigned long)reloc_start;
-#endif
-        return crc;
+        return *(u32 *)((void *)crc + *crc);
 }
 
 static int check_version(Elf_Shdr *sechdrs,
                          unsigned int versindex,
                          const char *symname,
                          struct module *mod,
-                         const unsigned long *crc,
-                         const struct module *crc_owner)
+                         const s32 *crc)
 {
         unsigned int i, num_versions;
         struct modversion_info *versions;
@@ -1283,13 +1277,19 @@ static int check_version(Elf_Shdr *sechdrs,
                 / sizeof(struct modversion_info);
 
         for (i = 0; i < num_versions; i++) {
+                u32 crcval;
+
                 if (strcmp(versions[i].name, symname) != 0)
                         continue;
 
-                if (versions[i].crc == maybe_relocated(*crc, crc_owner))
+                if (IS_ENABLED(CONFIG_MODULE_REL_CRCS))
+                        crcval = resolve_rel_crc(crc);
+                else
+                        crcval = *crc;
+                if (versions[i].crc == crcval)
                         return 1;
-                pr_debug("Found checksum %lX vs module %lX\n",
-                       maybe_relocated(*crc, crc_owner), versions[i].crc);
+                pr_debug("Found checksum %X vs module %lX\n",
+                         crcval, versions[i].crc);
                 goto bad_version;
         }
 
@@ -1307,7 +1307,7 @@ static inline int check_modstruct_version(Elf_Shdr *sechdrs,
                                           unsigned int versindex,
                                           struct module *mod)
 {
-        const unsigned long *crc;
+        const s32 *crc;
 
         /*
          * Since this should be found in kernel (which can't be removed), no
@@ -1321,8 +1321,7 @@ static inline int check_modstruct_version(Elf_Shdr *sechdrs,
         }
         preempt_enable();
         return check_version(sechdrs, versindex,
-                             VMLINUX_SYMBOL_STR(module_layout), mod, crc,
-                             NULL);
+                             VMLINUX_SYMBOL_STR(module_layout), mod, crc);
 }
 
 /* First part is kernel version, which we ignore if module has crcs. */
@@ -1340,8 +1339,7 @@ static inline int check_version(Elf_Shdr *sechdrs,
                                 unsigned int versindex,
                                 const char *symname,
                                 struct module *mod,
-                                const unsigned long *crc,
-                                const struct module *crc_owner)
+                                const s32 *crc)
 {
         return 1;
 }
@@ -1368,7 +1366,7 @@ static const struct kernel_symbol *resolve_symbol(struct module *mod,
 {
         struct module *owner;
         const struct kernel_symbol *sym;
-        const unsigned long *crc;
+        const s32 *crc;
         int err;
 
         /*
@@ -1383,8 +1381,7 @@ static const struct kernel_symbol *resolve_symbol(struct module *mod,
         if (!sym)
                 goto unlock;
 
-        if (!check_version(info->sechdrs, info->index.vers, name, mod, crc,
-                           owner)) {
+        if (!check_version(info->sechdrs, info->index.vers, name, mod, crc)) {
                 sym = ERR_PTR(-EINVAL);
                 goto getname;
         }
diff --git a/kernel/panic.c b/kernel/panic.c
index 901c4fb46002..08aa88dde7de 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -249,7 +249,7 @@ void panic(const char *fmt, ...)
                  * Delay timeout seconds before rebooting the machine.
                  * We can't use the "normal" timers since we just panicked.
                  */
-                pr_emerg("Rebooting in %d seconds..", panic_timeout);
+                pr_emerg("Rebooting in %d seconds..\n", panic_timeout);
 
                 for (i = 0; i < panic_timeout * 1000; i += PANIC_TIMER_STEP) {
                         touch_nmi_watchdog();
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index f67ceb7768b8..15e6baef5c73 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -46,7 +46,7 @@ static const char * const mem_sleep_labels[] = {
 const char *mem_sleep_states[PM_SUSPEND_MAX];
 
 suspend_state_t mem_sleep_current = PM_SUSPEND_FREEZE;
-suspend_state_t mem_sleep_default = PM_SUSPEND_MAX;
+static suspend_state_t mem_sleep_default = PM_SUSPEND_MEM;
 
 unsigned int pm_suspend_global_flags;
 EXPORT_SYMBOL_GPL(pm_suspend_global_flags);
@@ -168,7 +168,7 @@ void suspend_set_ops(const struct platform_suspend_ops *ops)
         }
         if (valid_state(PM_SUSPEND_MEM)) {
                 mem_sleep_states[PM_SUSPEND_MEM] = mem_sleep_labels[PM_SUSPEND_MEM];
-                if (mem_sleep_default >= PM_SUSPEND_MEM)
+                if (mem_sleep_default == PM_SUSPEND_MEM)
                         mem_sleep_current = PM_SUSPEND_MEM;
         }
 
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 8dbaec0e4f7f..1aea594a54db 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2475,6 +2475,7 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
                                 break;
                         if (neg)
                                 continue;
+                        val = convmul * val / convdiv;
                         if ((min && val < *min) || (max && val > *max))
                                 continue;
                         *i = val;
diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
index 775569ec50d0..af344a1bf0d0 100644
--- a/kernel/trace/trace_hwlat.c
+++ b/kernel/trace/trace_hwlat.c
@@ -266,7 +266,7 @@ out:
 static struct cpumask save_cpumask;
 static bool disable_migrate;
 
-static void move_to_next_cpu(void)
+static void move_to_next_cpu(bool initmask)
 {
         static struct cpumask *current_mask;
         int next_cpu;
@@ -275,7 +275,7 @@ static void move_to_next_cpu(void)
                 return;
 
         /* Just pick the first CPU on first iteration */
-        if (!current_mask) {
+        if (initmask) {
                 current_mask = &save_cpumask;
                 get_online_cpus();
                 cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask);
@@ -330,10 +330,12 @@ static void move_to_next_cpu(void)
 static int kthread_fn(void *data)
 {
         u64 interval;
+        bool initmask = true;
 
         while (!kthread_should_stop()) {
 
-                move_to_next_cpu();
+                move_to_next_cpu(initmask);
+                initmask = false;
 
                 local_irq_disable();
                 get_sample();
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index a133ecd741e4..7ad9e53ad174 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -1372,7 +1372,7 @@ kprobe_trace_selftest_target(int a1, int a2, int a3, int a4, int a5, int a6)
         return a1 + a2 + a3 + a4 + a5 + a6;
 }
 
-static struct __init trace_event_file *
+static __init struct trace_event_file *
 find_trace_probe_file(struct trace_kprobe *tk, struct trace_array *tr)
 {
         struct trace_event_file *file;
diff --git a/kernel/ucount.c b/kernel/ucount.c
index 9d20d5dd298a..4bbd38ec3788 100644
--- a/kernel/ucount.c
+++ b/kernel/ucount.c
@@ -128,10 +128,10 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
         struct hlist_head *hashent = ucounts_hashentry(ns, uid);
         struct ucounts *ucounts, *new;
 
-        spin_lock(&ucounts_lock);
+        spin_lock_irq(&ucounts_lock);
         ucounts = find_ucounts(ns, uid, hashent);
         if (!ucounts) {
-                spin_unlock(&ucounts_lock);
+                spin_unlock_irq(&ucounts_lock);
 
                 new = kzalloc(sizeof(*new), GFP_KERNEL);
                 if (!new)
@@ -141,7 +141,7 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
                 new->uid = uid;
                 atomic_set(&new->count, 0);
 
-                spin_lock(&ucounts_lock);
+                spin_lock_irq(&ucounts_lock);
                 ucounts = find_ucounts(ns, uid, hashent);
                 if (ucounts) {
                         kfree(new);
@@ -152,16 +152,18 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
         }
         if (!atomic_add_unless(&ucounts->count, 1, INT_MAX))
                 ucounts = NULL;
-        spin_unlock(&ucounts_lock);
+        spin_unlock_irq(&ucounts_lock);
         return ucounts;
 }
 
 static void put_ucounts(struct ucounts *ucounts)
 {
+        unsigned long flags;
+
         if (atomic_dec_and_test(&ucounts->count)) {
-                spin_lock(&ucounts_lock);
+                spin_lock_irqsave(&ucounts_lock, flags);
                 hlist_del_init(&ucounts->node);
-                spin_unlock(&ucounts_lock);
+                spin_unlock_irqrestore(&ucounts_lock, flags);
 
                 kfree(ucounts);
         }
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index d4b0fa01cae3..63177be0159e 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -49,6 +49,8 @@ unsigned long *watchdog_cpumask_bits = cpumask_bits(&watchdog_cpumask);
 #define for_each_watchdog_cpu(cpu) \
         for_each_cpu_and((cpu), cpu_online_mask, &watchdog_cpumask)
 
+atomic_t watchdog_park_in_progress = ATOMIC_INIT(0);
+
 /*
  * The 'watchdog_running' variable is set to 1 when the watchdog threads
  * are registered/started and is set to 0 when the watchdog threads are
@@ -260,6 +262,9 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
         int duration;
         int softlockup_all_cpu_backtrace = sysctl_softlockup_all_cpu_backtrace;
 
+        if (atomic_read(&watchdog_park_in_progress) != 0)
+                return HRTIMER_NORESTART;
+
         /* kick the hardlockup detector */
         watchdog_interrupt_count();
 
@@ -467,12 +472,16 @@ static int watchdog_park_threads(void)
 {
         int cpu, ret = 0;
 
+        atomic_set(&watchdog_park_in_progress, 1);
+
         for_each_watchdog_cpu(cpu) {
                 ret = kthread_park(per_cpu(softlockup_watchdog, cpu));
                 if (ret)
                         break;
         }
 
+        atomic_set(&watchdog_park_in_progress, 0);
+
         return ret;
 }
 
diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
index 84016c8aee6b..12b8dd640786 100644
--- a/kernel/watchdog_hld.c
+++ b/kernel/watchdog_hld.c
@@ -84,6 +84,9 @@ static void watchdog_overflow_callback(struct perf_event *event,
         /* Ensure the watchdog never gets throttled */
         event->hw.interrupts = 0;
 
+        if (atomic_read(&watchdog_park_in_progress) != 0)
+                return;
+
         if (__this_cpu_read(watchdog_nmi_touch) == true) {
                 __this_cpu_write(watchdog_nmi_touch, false);
                 return;
diff --git a/lib/ioremap.c b/lib/ioremap.c
index 86c8911b0e3a..a3e14ce92a56 100644
--- a/lib/ioremap.c
+++ b/lib/ioremap.c
@@ -144,4 +144,3 @@ int ioremap_page_range(unsigned long addr,
 
         return err;
 }
-EXPORT_SYMBOL_GPL(ioremap_page_range);
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 0b92d605fb69..84812a9fb16f 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -769,7 +769,7 @@ static void radix_tree_free_nodes(struct radix_tree_node *node)
                         struct radix_tree_node *old = child;
                         offset = child->offset + 1;
                         child = child->parent;
-                        WARN_ON_ONCE(!list_empty(&node->private_list));
+                        WARN_ON_ONCE(!list_empty(&old->private_list));
                         radix_tree_node_free(old);
                         if (old == entry_to_node(node))
                                 return;
diff --git a/mm/filemap.c b/mm/filemap.c
index b772a33ef640..3f9afded581b 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1791,6 +1791,11 @@ static ssize_t do_generic_file_read(struct file *filp, loff_t *ppos,
 
                 cond_resched();
 find_page:
+                if (fatal_signal_pending(current)) {
+                        error = -EINTR;
+                        goto out;
+                }
+
                 page = find_get_page(mapping, index);
                 if (!page) {
                         page_cache_sync_readahead(mapping,
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 9a6bd6c8d55a..5f3ad65c85de 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -783,6 +783,12 @@ struct page *follow_devmap_pmd(struct vm_area_struct *vma, unsigned long addr,
 
         assert_spin_locked(pmd_lockptr(mm, pmd));
 
+        /*
+         * When we COW a devmap PMD entry, we split it into PTEs, so we should
+         * not be in this function with `flags & FOLL_COW` set.
+         */
+        WARN_ONCE(flags & FOLL_COW, "mm: In follow_devmap_pmd with FOLL_COW set");
+
         if (flags & FOLL_WRITE && !pmd_write(*pmd))
                 return NULL;
 
@@ -1128,6 +1134,16 @@ out_unlock:
         return ret;
 }
 
+/*
+ * FOLL_FORCE can write to even unwritable pmd's, but only
+ * after we've gone through a COW cycle and they are dirty.
+ */
+static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags)
+{
+        return pmd_write(pmd) ||
+               ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd));
+}
+
 struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
                                    unsigned long addr,
                                    pmd_t *pmd,
@@ -1138,7 +1154,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
 
         assert_spin_locked(pmd_lockptr(mm, pmd));
 
-        if (flags & FOLL_WRITE && !pmd_write(*pmd))
+        if (flags & FOLL_WRITE && !can_follow_write_pmd(*pmd, flags))
                 goto out;
 
         /* Avoid dumping huge zero page */
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index b82b3e215157..f479365530b6 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -13,6 +13,7 @@
  *
  */
 
+#include <linux/ftrace.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/printk.h>
@@ -300,6 +301,8 @@ void kasan_report(unsigned long addr, size_t size,
         if (likely(!kasan_report_enabled()))
                 return;
 
+        disable_trace_on_warning();
+
         info.access_addr = (void *)addr;
         info.access_size = size;
         info.is_write = is_write;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index a63a8f832664..b822e158b319 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4353,9 +4353,9 @@ static int mem_cgroup_do_precharge(unsigned long count)
                 return ret;
         }
 
-        /* Try charges one by one with reclaim */
+        /* Try charges one by one with reclaim, but do not retry */
         while (count--) {
-                ret = try_charge(mc.to, GFP_KERNEL & ~__GFP_NORETRY, 1);
+                ret = try_charge(mc.to, GFP_KERNEL | __GFP_NORETRY, 1);
                 if (ret)
                         return ret;
                 mc.precharge++;
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index e43142c15631..b8c11e063ff0 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1033,36 +1033,39 @@ static void node_states_set_node(int node, struct memory_notify *arg)
         node_set_state(node, N_MEMORY);
 }
 
-int zone_can_shift(unsigned long pfn, unsigned long nr_pages,
-                   enum zone_type target)
+bool zone_can_shift(unsigned long pfn, unsigned long nr_pages,
+                   enum zone_type target, int *zone_shift)
 {
         struct zone *zone = page_zone(pfn_to_page(pfn));
         enum zone_type idx = zone_idx(zone);
         int i;
 
+        *zone_shift = 0;
+
         if (idx < target) {
                 /* pages must be at end of current zone */
                 if (pfn + nr_pages != zone_end_pfn(zone))
-                        return 0;
+                        return false;
 
                 /* no zones in use between current zone and target */
                 for (i = idx + 1; i < target; i++)
                         if (zone_is_initialized(zone - idx + i))
-                                return 0;
+                                return false;
         }
 
         if (target < idx) {
                 /* pages must be at beginning of current zone */
                 if (pfn != zone->zone_start_pfn)
-                        return 0;
+                        return false;
 
                 /* no zones in use between current zone and target */
                 for (i = target + 1; i < idx; i++)
                         if (zone_is_initialized(zone - idx + i))
-                                return 0;
+                                return false;
         }
 
-        return target - idx;
+        *zone_shift = target - idx;
+        return true;
 }
 
 /* Must be protected by mem_hotplug_begin() */
@@ -1089,10 +1092,13 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, int online_typ
             !can_online_high_movable(zone))
                 return -EINVAL;
 
-        if (online_type == MMOP_ONLINE_KERNEL)
-                zone_shift = zone_can_shift(pfn, nr_pages, ZONE_NORMAL);
-        else if (online_type == MMOP_ONLINE_MOVABLE)
-                zone_shift = zone_can_shift(pfn, nr_pages, ZONE_MOVABLE);
+        if (online_type == MMOP_ONLINE_KERNEL) {
+                if (!zone_can_shift(pfn, nr_pages, ZONE_NORMAL, &zone_shift))
+                        return -EINVAL;
+        } else if (online_type == MMOP_ONLINE_MOVABLE) {
+                if (!zone_can_shift(pfn, nr_pages, ZONE_MOVABLE, &zone_shift))
+                        return -EINVAL;
+        }
 
         zone = move_pfn_range(zone_shift, pfn, pfn + nr_pages);
         if (!zone)
@@ -1477,17 +1483,20 @@ bool is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
 }
 
 /*
- * Confirm all pages in a range [start, end) is belongs to the same zone.
+ * Confirm all pages in a range [start, end) belong to the same zone.
+ * When true, return its valid [start, end).
  */
-int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
+int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
+                         unsigned long *valid_start, unsigned long *valid_end)
 {
         unsigned long pfn, sec_end_pfn;
+        unsigned long start, end;
         struct zone *zone = NULL;
         struct page *page;
         int i;
-        for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn);
+        for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn + 1);
              pfn < end_pfn;
-             pfn = sec_end_pfn + 1, sec_end_pfn += PAGES_PER_SECTION) {
+             pfn = sec_end_pfn, sec_end_pfn += PAGES_PER_SECTION) {
                 /* Make sure the memory section is present first */
                 if (!present_section_nr(pfn_to_section_nr(pfn)))
                         continue;
@@ -1503,10 +1512,20 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
                         page = pfn_to_page(pfn + i);
                         if (zone && page_zone(page) != zone)
                                 return 0;
+                        if (!zone)
+                                start = pfn + i;
                         zone = page_zone(page);
+                        end = pfn + MAX_ORDER_NR_PAGES;
                 }
         }
-        return 1;
+
+        if (zone) {
+                *valid_start = start;
+                *valid_end = end;
+                return 1;
+        } else {
+                return 0;
+        }
 }
 
 /*
@@ -1833,6 +1852,7 @@ static int __ref __offline_pages(unsigned long start_pfn,
         long offlined_pages;
         int ret, drain, retry_max, node;
         unsigned long flags;
+        unsigned long valid_start, valid_end;
         struct zone *zone;
         struct memory_notify arg;
 
@@ -1843,10 +1863,10 @@ static int __ref __offline_pages(unsigned long start_pfn,
                 return -EINVAL;
         /* This makes hotplug much easier...and readable.
            we assume this for now. .*/
-        if (!test_pages_in_a_zone(start_pfn, end_pfn))
+        if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start, &valid_end))
                 return -EINVAL;
 
-        zone = page_zone(pfn_to_page(start_pfn));
+        zone = page_zone(pfn_to_page(valid_start));
         node = zone_to_nid(zone);
         nr_pages = end_pfn - start_pfn;
 
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 2e346645eb80..1e7873e40c9a 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2017,8 +2017,8 @@ retry_cpuset:
 
         nmask = policy_nodemask(gfp, pol);
         zl = policy_zonelist(gfp, pol, node);
-        mpol_cond_put(pol);
         page = __alloc_pages_nodemask(gfp, order, zl, nmask);
+        mpol_cond_put(pol);
 out:
         if (unlikely(!page && read_mems_allowed_retry(cpuset_mems_cookie)))
                 goto retry_cpuset;
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d604d2596b7b..f3e0c69a97b7 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3523,12 +3523,13 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
         struct page *page = NULL;
         unsigned int alloc_flags;
         unsigned long did_some_progress;
-        enum compact_priority compact_priority = DEF_COMPACT_PRIORITY;
+        enum compact_priority compact_priority;
         enum compact_result compact_result;
-        int compaction_retries = 0;
-        int no_progress_loops = 0;
+        int compaction_retries;
+        int no_progress_loops;
         unsigned long alloc_start = jiffies;
         unsigned int stall_timeout = 10 * HZ;
+        unsigned int cpuset_mems_cookie;
 
         /*
          * In the slowpath, we sanity check order to avoid ever trying to
@@ -3549,6 +3550,23 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
                                 (__GFP_ATOMIC|__GFP_DIRECT_RECLAIM)))
                 gfp_mask &= ~__GFP_ATOMIC;
 
+retry_cpuset:
+        compaction_retries = 0;
+        no_progress_loops = 0;
+        compact_priority = DEF_COMPACT_PRIORITY;
+        cpuset_mems_cookie = read_mems_allowed_begin();
+        /*
+         * We need to recalculate the starting point for the zonelist iterator
+         * because we might have used different nodemask in the fast path, or
+         * there was a cpuset modification and we are retrying - otherwise we
+         * could end up iterating over non-eligible zones endlessly.
+         */
+        ac->preferred_zoneref = first_zones_zonelist(ac->zonelist,
+                                        ac->high_zoneidx, ac->nodemask);
+        if (!ac->preferred_zoneref->zone)
+                goto nopage;
+
+
         /*
          * The fast path uses conservative alloc_flags to succeed only until
          * kswapd needs to be woken up, and to avoid the cost of setting up
@@ -3708,6 +3726,13 @@ retry:
                                 &compaction_retries))
                 goto retry;
 
+        /*
+         * It's possible we raced with cpuset update so the OOM would be
+         * premature (see below the nopage: label for full explanation).
+         */
+        if (read_mems_allowed_retry(cpuset_mems_cookie))
+                goto retry_cpuset;
+
         /* Reclaim has failed us, start killing things */
         page = __alloc_pages_may_oom(gfp_mask, order, ac, &did_some_progress);
         if (page)
@@ -3720,6 +3745,16 @@ retry:
         }
 
 nopage:
+        /*
+         * When updating a task's mems_allowed or mempolicy nodemask, it is
+         * possible to race with parallel threads in such a way that our
+         * allocation can fail while the mask is being updated. If we are about
+         * to fail, check if the cpuset changed during allocation and if so,
+         * retry.
+         */
+        if (read_mems_allowed_retry(cpuset_mems_cookie))
+                goto retry_cpuset;
+
         warn_alloc(gfp_mask,
                         "page allocation failure: order:%u", order);
 got_pg:
@@ -3734,7 +3769,6 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
                         struct zonelist *zonelist, nodemask_t *nodemask)
 {
         struct page *page;
-        unsigned int cpuset_mems_cookie;
         unsigned int alloc_flags = ALLOC_WMARK_LOW;
         gfp_t alloc_mask = gfp_mask; /* The gfp_t that was actually used for allocation */
         struct alloc_context ac = {
@@ -3771,9 +3805,6 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
         if (IS_ENABLED(CONFIG_CMA) && ac.migratetype == MIGRATE_MOVABLE)
                 alloc_flags |= ALLOC_CMA;
 
-retry_cpuset:
-        cpuset_mems_cookie = read_mems_allowed_begin();
-
         /* Dirty zone balancing only done in the fast path */
         ac.spread_dirty_pages = (gfp_mask & __GFP_WRITE);
 
@@ -3784,8 +3815,13 @@ retry_cpuset:
          */
         ac.preferred_zoneref = first_zones_zonelist(ac.zonelist,
                                         ac.high_zoneidx, ac.nodemask);
-        if (!ac.preferred_zoneref) {
+        if (!ac.preferred_zoneref->zone) {
                 page = NULL;
+                /*
+                 * This might be due to race with cpuset_current_mems_allowed
+                 * update, so make sure we retry with original nodemask in the
+                 * slow path.
+                 */
                 goto no_zone;
         }
 
@@ -3794,6 +3830,7 @@ retry_cpuset:
         if (likely(page))
                 goto out;
 
+no_zone:
         /*
          * Runtime PM, block IO and its error handling path can deadlock
          * because I/O on the device might not complete.
@@ -3805,21 +3842,10 @@ retry_cpuset:
          * Restore the original nodemask if it was potentially replaced with
          * &cpuset_current_mems_allowed to optimize the fast-path attempt.
          */
-        if (cpusets_enabled())
+        if (unlikely(ac.nodemask != nodemask))
                 ac.nodemask = nodemask;
-        page = __alloc_pages_slowpath(alloc_mask, order, &ac);
 
-no_zone:
-        /*
-         * When updating a task's mems_allowed, it is possible to race with
-         * parallel threads in such a way that an allocation can fail while
-         * the mask is being updated. If a page allocation is about to fail,
-         * check if the cpuset changed during allocation and if so, retry.
-         */
-        if (unlikely(!page && read_mems_allowed_retry(cpuset_mems_cookie))) {
-                alloc_mask = gfp_mask;
-                goto retry_cpuset;
-        }
+        page = __alloc_pages_slowpath(alloc_mask, order, &ac);
 
 out:
         if (memcg_kmem_enabled() && (gfp_mask & __GFP_ACCOUNT) && page &&
@@ -7248,6 +7274,7 @@ int alloc_contig_range(unsigned long start, unsigned long end,
                 .zone = page_zone(pfn_to_page(start)),
                 .mode = MIGRATE_SYNC,
                 .ignore_skip_hint = true,
+                .gfp_mask = GFP_KERNEL,
         };
         INIT_LIST_HEAD(&cc.migratepages);
 
diff --git a/mm/shmem.c b/mm/shmem.c
index bb53285a1d99..3a7587a0314d 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -415,6 +415,7 @@ static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo,
                 struct shrink_control *sc, unsigned long nr_to_split)
 {
         LIST_HEAD(list), *pos, *next;
+        LIST_HEAD(to_remove);
         struct inode *inode;
         struct shmem_inode_info *info;
         struct page *page;
@@ -441,9 +442,8 @@ static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo,
                 /* Check if there's anything to gain */
                 if (round_up(inode->i_size, PAGE_SIZE) ==
                                 round_up(inode->i_size, HPAGE_PMD_SIZE)) {
-                        list_del_init(&info->shrinklist);
+                        list_move(&info->shrinklist, &to_remove);
                         removed++;
-                        iput(inode);
                         goto next;
                 }
 
@@ -454,6 +454,13 @@ next:
         }
         spin_unlock(&sbinfo->shrinklist_lock);
 
+        list_for_each_safe(pos, next, &to_remove) {
+                info = list_entry(pos, struct shmem_inode_info, shrinklist);
+                inode = &info->vfs_inode;
+                list_del_init(&info->shrinklist);
+                iput(inode);
+        }
+
         list_for_each_safe(pos, next, &list) {
                 int ret;
 
diff --git a/mm/slub.c b/mm/slub.c
index 067598a00849..7aa6f433f4de 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -496,10 +496,11 @@ static inline int check_valid_pointer(struct kmem_cache *s,
         return 1;
 }
 
-static void print_section(char *text, u8 *addr, unsigned int length)
+static void print_section(char *level, char *text, u8 *addr,
+                          unsigned int length)
 {
         metadata_access_enable();
-        print_hex_dump(KERN_ERR, text, DUMP_PREFIX_ADDRESS, 16, 1, addr,
+        print_hex_dump(level, text, DUMP_PREFIX_ADDRESS, 16, 1, addr,
                         length, 1);
         metadata_access_disable();
 }
@@ -636,14 +637,15 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
                p, p - addr, get_freepointer(s, p));
 
         if (s->flags & SLAB_RED_ZONE)
-                print_section("Redzone ", p - s->red_left_pad, s->red_left_pad);
+                print_section(KERN_ERR, "Redzone ", p - s->red_left_pad,
+                              s->red_left_pad);
         else if (p > addr + 16)
-                print_section("Bytes b4 ", p - 16, 16);
+                print_section(KERN_ERR, "Bytes b4 ", p - 16, 16);
 
-        print_section("Object ", p, min_t(unsigned long, s->object_size,
-                                PAGE_SIZE));
+        print_section(KERN_ERR, "Object ", p,
+                      min_t(unsigned long, s->object_size, PAGE_SIZE));
         if (s->flags & SLAB_RED_ZONE)
-                print_section("Redzone ", p + s->object_size,
+                print_section(KERN_ERR, "Redzone ", p + s->object_size,
                         s->inuse - s->object_size);
 
         if (s->offset)
@@ -658,7 +660,8 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
 
         if (off != size_from_object(s))
                 /* Beginning of the filler is the free pointer */
-                print_section("Padding ", p + off, size_from_object(s) - off);
+                print_section(KERN_ERR, "Padding ", p + off,
+                              size_from_object(s) - off);
 
         dump_stack();
 }
@@ -820,7 +823,7 @@ static int slab_pad_check(struct kmem_cache *s, struct page *page)
                 end--;
 
         slab_err(s, page, "Padding overwritten. 0x%p-0x%p", fault, end - 1);
-        print_section("Padding ", end - remainder, remainder);
+        print_section(KERN_ERR, "Padding ", end - remainder, remainder);
 
         restore_bytes(s, "slab padding", POISON_INUSE, end - remainder, end);
         return 0;
@@ -973,7 +976,7 @@ static void trace(struct kmem_cache *s, struct page *page, void *object,
                         page->freelist);
 
                 if (!alloc)
-                        print_section("Object ", (void *)object,
+                        print_section(KERN_INFO, "Object ", (void *)object,
                                         s->object_size);
 
                 dump_stack();
diff --git a/mm/zswap.c b/mm/zswap.c
index 067a0d62f318..cabf09e0128b 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -78,7 +78,13 @@ static u64 zswap_duplicate_entry;
 
 /* Enable/disable zswap (disabled by default) */
 static bool zswap_enabled;
-module_param_named(enabled, zswap_enabled, bool, 0644);
+static int zswap_enabled_param_set(const char *,
+                                   const struct kernel_param *);
+static struct kernel_param_ops zswap_enabled_param_ops = {
+        .set =          zswap_enabled_param_set,
+        .get =          param_get_bool,
+};
+module_param_cb(enabled, &zswap_enabled_param_ops, &zswap_enabled, 0644);
 
 /* Crypto compressor to use */
 #define ZSWAP_COMPRESSOR_DEFAULT "lzo"
@@ -176,6 +182,9 @@ static atomic_t zswap_pools_count = ATOMIC_INIT(0);
 /* used by param callback function */
 static bool zswap_init_started;
 
+/* fatal error during init */
+static bool zswap_init_failed;
+
 /*********************************
 * helpers and fwd declarations
 **********************************/
@@ -624,6 +633,11 @@ static int __zswap_param_set(const char *val, const struct kernel_param *kp,
         char *s = strstrip((char *)val);
         int ret;
 
+        if (zswap_init_failed) {
+                pr_err("can't set param, initialization failed\n");
+                return -ENODEV;
+        }
+
         /* no change required */
         if (!strcmp(s, *(char **)kp->arg))
                 return 0;
@@ -703,6 +717,17 @@ static int zswap_zpool_param_set(const char *val,
         return __zswap_param_set(val, kp, NULL, zswap_compressor);
 }
 
+static int zswap_enabled_param_set(const char *val,
+                                   const struct kernel_param *kp)
+{
+        if (zswap_init_failed) {
+                pr_err("can't enable, initialization failed\n");
+                return -ENODEV;
+        }
+
+        return param_set_bool(val, kp);
+}
+
 /*********************************
 * writeback code
 **********************************/
@@ -1201,6 +1226,9 @@ hp_fail:
 dstmem_fail:
         zswap_entry_cache_destroy();
 cache_fail:
+        /* if built-in, we aren't unloaded on failure; don't allow use */
+        zswap_init_failed = true;
+        zswap_enabled = false;
         return -ENOMEM;
 }
 /* must be late so crypto has time to come up */
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 9c561e683f4b..0854ebd8613e 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -474,7 +474,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
         primary_if = batadv_primary_if_get_selected(bat_priv);
         if (!primary_if) {
                 ret = -EINVAL;
-                goto put_primary_if;
+                goto free_skb;
         }
 
         /* Create one header to be copied to all fragments */
@@ -502,7 +502,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
                 skb_fragment = batadv_frag_create(skb, &frag_header, mtu);
                 if (!skb_fragment) {
                         ret = -ENOMEM;
-                        goto free_skb;
+                        goto put_primary_if;
                 }
 
                 batadv_inc_counter(bat_priv, BATADV_CNT_FRAG_TX);
@@ -511,7 +511,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
                 ret = batadv_send_unicast_skb(skb_fragment, neigh_node);
                 if (ret != NET_XMIT_SUCCESS) {
                         ret = NET_XMIT_DROP;
-                        goto free_skb;
+                        goto put_primary_if;
                 }
 
                 frag_header.no++;
@@ -519,7 +519,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
                 /* The initial check in this function should cover this case */
                 if (frag_header.no == BATADV_FRAG_MAX_FRAGMENTS - 1) {
                         ret = -EINVAL;
-                        goto free_skb;
+                        goto put_primary_if;
                 }
         }
 
@@ -527,7 +527,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
         if (batadv_skb_head_push(skb, header_size) < 0 ||
             pskb_expand_head(skb, header_size + ETH_HLEN, 0, GFP_ATOMIC) < 0) {
                 ret = -ENOMEM;
-                goto free_skb;
+                goto put_primary_if;
         }
 
         memcpy(skb->data, &frag_header, header_size);
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 71c7453268c1..7109b389ea58 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -781,20 +781,6 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
         return 0;
 }
 
-static int br_dev_newlink(struct net *src_net, struct net_device *dev,
-                          struct nlattr *tb[], struct nlattr *data[])
-{
-        struct net_bridge *br = netdev_priv(dev);
-
-        if (tb[IFLA_ADDRESS]) {
-                spin_lock_bh(&br->lock);
-                br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
-                spin_unlock_bh(&br->lock);
-        }
-
-        return register_netdevice(dev);
-}
-
 static int br_port_slave_changelink(struct net_device *brdev,
                                     struct net_device *dev,
                                     struct nlattr *tb[],
@@ -1115,6 +1101,25 @@ static int br_changelink(struct net_device *brdev, struct nlattr *tb[],
         return 0;
 }
 
+static int br_dev_newlink(struct net *src_net, struct net_device *dev,
+                          struct nlattr *tb[], struct nlattr *data[])
+{
+        struct net_bridge *br = netdev_priv(dev);
+        int err;
+
+        if (tb[IFLA_ADDRESS]) {
+                spin_lock_bh(&br->lock);
+                br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
+                spin_unlock_bh(&br->lock);
+        }
+
+        err = br_changelink(dev, tb, data);
+        if (err)
+                return err;
+
+        return register_netdevice(dev);
+}
+
 static size_t br_get_size(const struct net_device *brdev)
 {
         return nla_total_size(sizeof(u32)) +    /* IFLA_BR_FORWARD_DELAY  */
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 1108079d934f..5488e4a6ccd0 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -445,6 +445,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
  * @func: callback function on filter match
  * @data: returned parameter for callback function
  * @ident: string for calling module identification
+ * @sk: socket pointer (might be NULL)
  *
  * Description:
  *  Invokes the callback function with the received sk_buff and the given
@@ -468,7 +469,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
  */
 int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
                     void (*func)(struct sk_buff *, void *), void *data,
-                    char *ident)
+                    char *ident, struct sock *sk)
 {
         struct receiver *r;
         struct hlist_head *rl;
@@ -496,6 +497,7 @@ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
                 r->func    = func;
                 r->data    = data;
                 r->ident   = ident;
+                r->sk      = sk;
 
                 hlist_add_head_rcu(&r->list, rl);
                 d->entries++;
@@ -520,8 +522,11 @@ EXPORT_SYMBOL(can_rx_register);
 static void can_rx_delete_receiver(struct rcu_head *rp)
 {
         struct receiver *r = container_of(rp, struct receiver, rcu);
+        struct sock *sk = r->sk;
 
         kmem_cache_free(rcv_cache, r);
+        if (sk)
+                sock_put(sk);
 }
 
 /**
@@ -596,8 +601,11 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
         spin_unlock(&can_rcvlists_lock);
 
         /* schedule the receiver item for deletion */
-        if (r)
+        if (r) {
+                if (r->sk)
+                        sock_hold(r->sk);
                 call_rcu(&r->rcu, can_rx_delete_receiver);
+        }
 }
 EXPORT_SYMBOL(can_rx_unregister);
 
diff --git a/net/can/af_can.h b/net/can/af_can.h
index fca0fe9fc45a..b86f5129e838 100644
--- a/net/can/af_can.h
+++ b/net/can/af_can.h
@@ -50,13 +50,14 @@
 
 struct receiver {
         struct hlist_node list;
-        struct rcu_head rcu;
         canid_t can_id;
         canid_t mask;
         unsigned long matches;
         void (*func)(struct sk_buff *, void *);
         void *data;
         char *ident;
+        struct sock *sk;
+        struct rcu_head rcu;
 };
 
 #define CAN_SFF_RCV_ARRAY_SZ (1 << CAN_SFF_ID_BITS)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 21ac75390e3d..95d13b233c65 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -734,14 +734,23 @@ static struct bcm_op *bcm_find_op(struct list_head *ops,
 
 static void bcm_remove_op(struct bcm_op *op)
 {
-        hrtimer_cancel(&op->timer);
-        hrtimer_cancel(&op->thrtimer);
-
-        if (op->tsklet.func)
-                tasklet_kill(&op->tsklet);
+        if (op->tsklet.func) {
+                while (test_bit(TASKLET_STATE_SCHED, &op->tsklet.state) ||
+                       test_bit(TASKLET_STATE_RUN, &op->tsklet.state) ||
+                       hrtimer_active(&op->timer)) {
+                        hrtimer_cancel(&op->timer);
+                        tasklet_kill(&op->tsklet);
+                }
+        }
 
-        if (op->thrtsklet.func)
-                tasklet_kill(&op->thrtsklet);
+        if (op->thrtsklet.func) {
+                while (test_bit(TASKLET_STATE_SCHED, &op->thrtsklet.state) ||
+                       test_bit(TASKLET_STATE_RUN, &op->thrtsklet.state) ||
+                       hrtimer_active(&op->thrtimer)) {
+                        hrtimer_cancel(&op->thrtimer);
+                        tasklet_kill(&op->thrtsklet);
+                }
+        }
 
         if ((op->frames) && (op->frames != &op->sframe))
                 kfree(op->frames);
@@ -1216,7 +1225,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                                 err = can_rx_register(dev, op->can_id,
                                                       REGMASK(op->can_id),
                                                       bcm_rx_handler, op,
-                                                      "bcm");
+                                                      "bcm", sk);
 
                                 op->rx_reg_dev = dev;
                                 dev_put(dev);
@@ -1225,7 +1234,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                 } else
                         err = can_rx_register(NULL, op->can_id,
                                               REGMASK(op->can_id),
-                                              bcm_rx_handler, op, "bcm");
+                                              bcm_rx_handler, op, "bcm", sk);
                 if (err) {
                         /* this bcm rx op is broken -> remove it */
                         list_del(&op->list);
diff --git a/net/can/gw.c b/net/can/gw.c
index a54ab0c82104..7056a1a2bb70 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -442,7 +442,7 @@ static inline int cgw_register_filter(struct cgw_job *gwj)
 {
         return can_rx_register(gwj->src.dev, gwj->ccgw.filter.can_id,
                                gwj->ccgw.filter.can_mask, can_can_gw_rcv,
-                               gwj, "gw");
+                               gwj, "gw", NULL);
 }
 
 static inline void cgw_unregister_filter(struct cgw_job *gwj)
diff --git a/net/can/raw.c b/net/can/raw.c
index b075f028d7e2..6dc546a06673 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -190,7 +190,7 @@ static int raw_enable_filters(struct net_device *dev, struct sock *sk,
         for (i = 0; i < count; i++) {
                 err = can_rx_register(dev, filter[i].can_id,
                                       filter[i].can_mask,
-                                      raw_rcv, sk, "raw");
+                                      raw_rcv, sk, "raw", sk);
                 if (err) {
                         /* clean up successfully registered filters */
                         while (--i >= 0)
@@ -211,7 +211,7 @@ static int raw_enable_errfilter(struct net_device *dev, struct sock *sk,
 
         if (err_mask)
                 err = can_rx_register(dev, 0, err_mask | CAN_ERR_FLAG,
-                                      raw_rcv, sk, "raw");
+                                      raw_rcv, sk, "raw", sk);
 
         return err;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 07b307b0b414..7f218e095361 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2795,9 +2795,9 @@ static netdev_features_t harmonize_features(struct sk_buff *skb,
         if (skb->ip_summed != CHECKSUM_NONE &&
             !can_checksum_protocol(features, type)) {
                 features &= ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
-        } else if (illegal_highdma(skb->dev, skb)) {
-                features &= ~NETIF_F_SG;
         }
+        if (illegal_highdma(skb->dev, skb))
+                features &= ~NETIF_F_SG;
 
         return features;
 }
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index e23766c7e3ba..236a21e3c878 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1712,7 +1712,7 @@ static noinline_for_stack int ethtool_get_channels(struct net_device *dev,
 static noinline_for_stack int ethtool_set_channels(struct net_device *dev,
                                                    void __user *useraddr)
 {
-        struct ethtool_channels channels, max;
+        struct ethtool_channels channels, max = { .cmd = ETHTOOL_GCHANNELS };
         u32 max_rx_in_use = 0;
 
         if (!dev->ethtool_ops->set_channels || !dev->ethtool_ops->get_channels)
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index 71bb3e2eca08..b3eef90b2df9 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -386,6 +386,7 @@ static const struct lwtunnel_encap_ops bpf_encap_ops = {
         .fill_encap     = bpf_fill_encap_info,
         .get_encap_size = bpf_encap_nlsize,
         .cmp_encap      = bpf_encap_cmp,
+        .owner          = THIS_MODULE,
 };
 
 static int __init bpf_lwt_init(void)
diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c
index a5d4e866ce88..c23465005f2f 100644
--- a/net/core/lwtunnel.c
+++ b/net/core/lwtunnel.c
@@ -26,6 +26,7 @@
 #include <net/lwtunnel.h>
 #include <net/rtnetlink.h>
 #include <net/ip6_fib.h>
+#include <net/nexthop.h>
 
 #ifdef CONFIG_MODULES
 
@@ -114,25 +115,77 @@ int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
         ret = -EOPNOTSUPP;
         rcu_read_lock();
         ops = rcu_dereference(lwtun_encaps[encap_type]);
+        if (likely(ops && ops->build_state && try_module_get(ops->owner))) {
+                ret = ops->build_state(dev, encap, family, cfg, lws);
+                if (ret)
+                        module_put(ops->owner);
+        }
+        rcu_read_unlock();
+
+        return ret;
+}
+EXPORT_SYMBOL(lwtunnel_build_state);
+
+int lwtunnel_valid_encap_type(u16 encap_type)
+{
+        const struct lwtunnel_encap_ops *ops;
+        int ret = -EINVAL;
+
+        if (encap_type == LWTUNNEL_ENCAP_NONE ||
+            encap_type > LWTUNNEL_ENCAP_MAX)
+                return ret;
+
+        rcu_read_lock();
+        ops = rcu_dereference(lwtun_encaps[encap_type]);
+        rcu_read_unlock();
 #ifdef CONFIG_MODULES
         if (!ops) {
                 const char *encap_type_str = lwtunnel_encap_str(encap_type);
 
                 if (encap_type_str) {
-                        rcu_read_unlock();
+                        __rtnl_unlock();
                         request_module("rtnl-lwt-%s", encap_type_str);
+                        rtnl_lock();
+
                         rcu_read_lock();
                         ops = rcu_dereference(lwtun_encaps[encap_type]);
+                        rcu_read_unlock();
                 }
         }
 #endif
-        if (likely(ops && ops->build_state))
-                ret = ops->build_state(dev, encap, family, cfg, lws);
-        rcu_read_unlock();
+        return ops ? 0 : -EOPNOTSUPP;
+}
+EXPORT_SYMBOL(lwtunnel_valid_encap_type);
 
-        return ret;
+int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int remaining)
+{
+        struct rtnexthop *rtnh = (struct rtnexthop *)attr;
+        struct nlattr *nla_entype;
+        struct nlattr *attrs;
+        struct nlattr *nla;
+        u16 encap_type;
+        int attrlen;
+
+        while (rtnh_ok(rtnh, remaining)) {
+                attrlen = rtnh_attrlen(rtnh);
+                if (attrlen > 0) {
+                        attrs = rtnh_attrs(rtnh);
+                        nla = nla_find(attrs, attrlen, RTA_ENCAP);
+                        nla_entype = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);
+
+                        if (nla_entype) {
+                                encap_type = nla_get_u16(nla_entype);
+
+                                if (lwtunnel_valid_encap_type(encap_type) != 0)
+                                        return -EOPNOTSUPP;
+                        }
+                }
+                rtnh = rtnh_next(rtnh, &remaining);
+        }
+
+        return 0;
 }
-EXPORT_SYMBOL(lwtunnel_build_state);
+EXPORT_SYMBOL(lwtunnel_valid_encap_type_attr);
 
 void lwtstate_free(struct lwtunnel_state *lws)
 {
@@ -144,6 +197,7 @@ void lwtstate_free(struct lwtunnel_state *lws)
         } else {
                 kfree(lws);
         }
+        module_put(ops->owner);
 }
 EXPORT_SYMBOL(lwtstate_free);
 
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index adfc790f7193..c4e879c02186 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -227,7 +227,7 @@ static int dccp_v6_send_response(const struct sock *sk, struct request_sock *req
                 opt = ireq->ipv6_opt;
                 if (!opt)
                         opt = rcu_dereference(np->opt);
-                err = ip6_xmit(sk, skb, &fl6, opt, np->tclass);
+                err = ip6_xmit(sk, skb, &fl6, sk->sk_mark, opt, np->tclass);
                 rcu_read_unlock();
                 err = net_xmit_eval(err);
         }
@@ -281,7 +281,7 @@ static void dccp_v6_ctl_send_reset(const struct sock *sk, struct sk_buff *rxskb)
         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
         if (!IS_ERR(dst)) {
                 skb_dst_set(skb, dst);
-                ip6_xmit(ctl_sk, skb, &fl6, NULL, 0);
+                ip6_xmit(ctl_sk, skb, &fl6, 0, NULL, 0);
                 DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
                 DCCP_INC_STATS(DCCP_MIB_OUTRSTS);
                 return;
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 68c9eea00518..7d4596110851 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1105,10 +1105,8 @@ static int dsa_slave_phy_connect(struct dsa_slave_priv *p,
         /* Use already configured phy mode */
         if (p->phy_interface == PHY_INTERFACE_MODE_NA)
                 p->phy_interface = p->phy->interface;
-        phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link,
-                           p->phy_interface);
-
-        return 0;
+        return phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link,
+                                  p->phy_interface);
 }
 
 static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
@@ -1203,6 +1201,8 @@ int dsa_slave_suspend(struct net_device *slave_dev)
 {
         struct dsa_slave_priv *p = netdev_priv(slave_dev);
 
+        netif_device_detach(slave_dev);
+
         if (p->phy) {
                 phy_stop(p->phy);
                 p->old_pause = -1;
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index eae0332b0e8c..7db2ad2e82d3 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -46,6 +46,7 @@
 #include <net/rtnetlink.h>
 #include <net/xfrm.h>
 #include <net/l3mdev.h>
+#include <net/lwtunnel.h>
 #include <trace/events/fib.h>
 
 #ifndef CONFIG_IP_MULTIPLE_TABLES
@@ -677,6 +678,10 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
                         cfg->fc_mx_len = nla_len(attr);
                         break;
                 case RTA_MULTIPATH:
+                        err = lwtunnel_valid_encap_type_attr(nla_data(attr),
+                                                             nla_len(attr));
+                        if (err < 0)
+                                goto errout;
                         cfg->fc_mp = nla_data(attr);
                         cfg->fc_mp_len = nla_len(attr);
                         break;
@@ -691,6 +696,9 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
                         break;
                 case RTA_ENCAP_TYPE:
                         cfg->fc_encap_type = nla_get_u16(attr);
+                        err = lwtunnel_valid_encap_type(cfg->fc_encap_type);
+                        if (err < 0)
+                                goto errout;
                         break;
                 }
         }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index fac275c48108..b67719f45953 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1629,6 +1629,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
         sk->sk_protocol = ip_hdr(skb)->protocol;
         sk->sk_bound_dev_if = arg->bound_dev_if;
         sk->sk_sndbuf = sysctl_wmem_default;
+        sk->sk_mark = fl4.flowi4_mark;
         err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base,
                              len, 0, &ipc, &rt, MSG_DONTWAIT);
         if (unlikely(err)) {
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index fed3d29f9eb3..0fd1976ab63b 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -313,6 +313,7 @@ static const struct lwtunnel_encap_ops ip_tun_lwt_ops = {
         .fill_encap = ip_tun_fill_encap_info,
         .get_encap_size = ip_tun_encap_nlsize,
         .cmp_encap = ip_tun_cmp_encap,
+        .owner = THIS_MODULE,
 };
 
 static const struct nla_policy ip6_tun_policy[LWTUNNEL_IP6_MAX + 1] = {
@@ -403,6 +404,7 @@ static const struct lwtunnel_encap_ops ip6_tun_lwt_ops = {
         .fill_encap = ip6_tun_fill_encap_info,
         .get_encap_size = ip6_tun_encap_nlsize,
         .cmp_encap = ip_tun_cmp_encap,
+        .owner = THIS_MODULE,
 };
 
 void __init ip_tunnel_core_init(void)
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index a6b8c1a4102b..0a783cd73faf 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -144,7 +144,12 @@ clusterip_config_find_get(struct net *net, __be32 clusterip, int entry)
         rcu_read_lock_bh();
         c = __clusterip_config_find(net, clusterip);
         if (c) {
-                if (!c->pde || unlikely(!atomic_inc_not_zero(&c->refcount)))
+#ifdef CONFIG_PROC_FS
+                if (!c->pde)
+                        c = NULL;
+                else
+#endif
+                if (unlikely(!atomic_inc_not_zero(&c->refcount)))
                         c = NULL;
                 else if (entry)
                         atomic_inc(&c->entries);
diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index f273098e48fd..37fb9552e858 100644
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -63,10 +63,10 @@ static bool rpfilter_lookup_reverse(struct net *net, struct flowi4 *fl4,
         return dev_match || flags & XT_RPFILTER_LOOSE;
 }
 
-static bool rpfilter_is_local(const struct sk_buff *skb)
+static bool
+rpfilter_is_loopback(const struct sk_buff *skb, const struct net_device *in)
 {
-        const struct rtable *rt = skb_rtable(skb);
-        return rt && (rt->rt_flags & RTCF_LOCAL);
+        return skb->pkt_type == PACKET_LOOPBACK || in->flags & IFF_LOOPBACK;
 }
 
 static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
@@ -79,7 +79,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
         info = par->matchinfo;
         invert = info->flags & XT_RPFILTER_INVERT;
 
-        if (rpfilter_is_local(skb))
+        if (rpfilter_is_loopback(skb, xt_in(par)))
                 return true ^ invert;
 
         iph = ip_hdr(skb);
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index fd8220213afc..146d86105183 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -126,6 +126,8 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)
         /* ip_route_me_harder expects skb->dst to be set */
         skb_dst_set_noref(nskb, skb_dst(oldskb));
 
+        nskb->mark = IP4_REPLY_MARK(net, oldskb->mark);
+
         skb_reserve(nskb, LL_MAX_HEADER);
         niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
                                    ip4_dst_hoplimit(skb_dst(nskb)));
diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c
index 965b1a161369..2981291910dd 100644
--- a/net/ipv4/netfilter/nft_fib_ipv4.c
+++ b/net/ipv4/netfilter/nft_fib_ipv4.c
@@ -26,13 +26,6 @@ static __be32 get_saddr(__be32 addr)
         return addr;
 }
 
-static bool fib4_is_local(const struct sk_buff *skb)
-{
-        const struct rtable *rt = skb_rtable(skb);
-
-        return rt && (rt->rt_flags & RTCF_LOCAL);
-}
-
 #define DSCP_BITS     0xfc
 
 void nft_fib4_eval_type(const struct nft_expr *expr, struct nft_regs *regs,
@@ -95,8 +88,10 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
         else
                 oif = NULL;
 
-        if (nft_hook(pkt) == NF_INET_PRE_ROUTING && fib4_is_local(pkt->skb)) {
-                nft_fib_store_result(dest, priv->result, pkt, LOOPBACK_IFINDEX);
+        if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&
+            nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {
+                nft_fib_store_result(dest, priv->result, pkt,
+                                     nft_in(pkt)->ifindex);
                 return;
         }
 
@@ -131,7 +126,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
         switch (res.type) {
         case RTN_UNICAST:
                 break;
-        case RTN_LOCAL: /* should not appear here, see fib4_is_local() above */
+        case RTN_LOCAL: /* Should not see RTN_LOCAL here */
                 return;
         default:
                 break;
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index f51919535ca7..dd2560c83a85 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -205,6 +205,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
          * scaled. So correct it appropriately.
          */
         tp->snd_wnd = ntohs(tcp_hdr(skb)->window);
+        tp->max_window = tp->snd_wnd;
 
         /* Activate the retrans timer so that SYNACK can be retransmitted.
          * The request socket is not added to the ehash
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 6c790754ae3e..41dcbd568cbe 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5078,7 +5078,7 @@ static void tcp_check_space(struct sock *sk)
         if (sock_flag(sk, SOCK_QUEUE_SHRUNK)) {
                 sock_reset_flag(sk, SOCK_QUEUE_SHRUNK);
                 /* pairs with tcp_poll() */
-                smp_mb__after_atomic();
+                smp_mb();
                 if (sk->sk_socket &&
                     test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
                         tcp_new_space(sk);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 1d5331a1b1dc..8ce50dc3ab8c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2518,9 +2518,11 @@ u32 __tcp_select_window(struct sock *sk)
         int full_space = min_t(int, tp->window_clamp, allowed_space);
         int window;
 
-        if (mss > full_space)
+        if (unlikely(mss > full_space)) {
                 mss = full_space;
-
+                if (mss <= 0)
+                        return 0;
+        }
         if (free_space < (full_space >> 1)) {
                 icsk->icsk_ack.quick = 0;
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c1e124bc8e1e..f60e88e56255 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -5540,8 +5540,7 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
         struct net_device *dev;
         struct inet6_dev *idev;
 
-        rcu_read_lock();
-        for_each_netdev_rcu(net, dev) {
+        for_each_netdev(net, dev) {
                 idev = __in6_dev_get(dev);
                 if (idev) {
                         int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
@@ -5550,7 +5549,6 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
                                 dev_disable_change(idev);
                 }
         }
-        rcu_read_unlock();
 }
 
 static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c
index a7bc54ab46e2..13b5e85fe0d5 100644
--- a/net/ipv6/ila/ila_lwt.c
+++ b/net/ipv6/ila/ila_lwt.c
@@ -238,6 +238,7 @@ static const struct lwtunnel_encap_ops ila_encap_ops = {
         .fill_encap = ila_fill_encap_info,
         .get_encap_size = ila_encap_nlsize,
         .cmp_encap = ila_encap_cmp,
+        .owner = THIS_MODULE,
 };
 
 int ila_lwt_init(void)
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 7396e75e161b..75c308239243 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -176,7 +176,7 @@ int inet6_csk_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl_unused
         /* Restore final destination back after routing done */
         fl6.daddr = sk->sk_v6_daddr;
 
-        res = ip6_xmit(sk, skb, &fl6, rcu_dereference(np->opt),
+        res = ip6_xmit(sk, skb, &fl6, sk->sk_mark, rcu_dereference(np->opt),
                        np->tclass);
         rcu_read_unlock();
         return res;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 75b6108234dd..558631860d91 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -582,6 +582,9 @@ static inline int ip6gre_xmit_ipv6(struct sk_buff *skb, struct net_device *dev)
                 return -1;
 
         offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
+        /* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
+        ipv6h = ipv6_hdr(skb);
+
         if (offset > 0) {
                 struct ipv6_tlv_tnl_enc_lim *tel;
                 tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 38122d04fadc..b6a94ff0bbd0 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -172,7 +172,7 @@ int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
  * which are using proper atomic operations or spinlocks.
  */
 int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
-             struct ipv6_txoptions *opt, int tclass)
+             __u32 mark, struct ipv6_txoptions *opt, int tclass)
 {
         struct net *net = sock_net(sk);
         const struct ipv6_pinfo *np = inet6_sk(sk);
@@ -240,7 +240,7 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
 
         skb->protocol = htons(ETH_P_IPV6);
         skb->priority = sk->sk_priority;
-        skb->mark = sk->sk_mark;
+        skb->mark = mark;
 
         mtu = dst_mtu(dst);
         if ((skb->len <= mtu) || skb->ignore_df || skb_is_gso(skb)) {
@@ -1344,7 +1344,7 @@ emsgsize:
          */
         if (transhdrlen && sk->sk_protocol == IPPROTO_UDP &&
             headersize == sizeof(struct ipv6hdr) &&
-            length < mtu - headersize &&
+            length <= mtu - headersize &&
             !(flags & MSG_MORE) &&
             rt->dst.dev->features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM))
                 csummode = CHECKSUM_PARTIAL;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 753d6d0860fb..75fac933c209 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -400,18 +400,19 @@ ip6_tnl_dev_uninit(struct net_device *dev)
 
 __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
 {
-        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw;
-        __u8 nexthdr = ipv6h->nexthdr;
-        __u16 off = sizeof(*ipv6h);
+        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw;
+        unsigned int nhoff = raw - skb->data;
+        unsigned int off = nhoff + sizeof(*ipv6h);
+        u8 next, nexthdr = ipv6h->nexthdr;
 
         while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
-                __u16 optlen = 0;
                 struct ipv6_opt_hdr *hdr;
-                if (raw + off + sizeof(*hdr) > skb->data &&
-                    !pskb_may_pull(skb, raw - skb->data + off + sizeof (*hdr)))
+                u16 optlen;
+
+                if (!pskb_may_pull(skb, off + sizeof(*hdr)))
                         break;
 
-                hdr = (struct ipv6_opt_hdr *) (raw + off);
+                hdr = (struct ipv6_opt_hdr *)(skb->data + off);
                 if (nexthdr == NEXTHDR_FRAGMENT) {
                         struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
                         if (frag_hdr->frag_off)
@@ -422,20 +423,29 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
                 } else {
                         optlen = ipv6_optlen(hdr);
                 }
+                /* cache hdr->nexthdr, since pskb_may_pull() might
+                 * invalidate hdr
+                 */
+                next = hdr->nexthdr;
                 if (nexthdr == NEXTHDR_DEST) {
-                        __u16 i = off + 2;
+                        u16 i = 2;
+
+                        /* Remember : hdr is no longer valid at this point. */
+                        if (!pskb_may_pull(skb, off + optlen))
+                                break;
+
                         while (1) {
                                 struct ipv6_tlv_tnl_enc_lim *tel;
 
                                 /* No more room for encapsulation limit */
-                                if (i + sizeof (*tel) > off + optlen)
+                                if (i + sizeof(*tel) > optlen)
                                         break;
 
-                                tel = (struct ipv6_tlv_tnl_enc_lim *) &raw[i];
+                                tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i);
                                 /* return index of option if found and valid */
                                 if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
                                     tel->length == 1)
-                                        return i;
+                                        return i + off - nhoff;
                                 /* else jump to next option */
                                 if (tel->type)
                                         i += tel->length + 2;
@@ -443,7 +453,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
                                         i++;
                         }
                 }
-                nexthdr = hdr->nexthdr;
+                nexthdr = next;
                 off += optlen;
         }
         return 0;
@@ -1303,6 +1313,8 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowlabel = key->label;
         } else {
                 offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
+                /* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
+                ipv6h = ipv6_hdr(skb);
                 if (offset > 0) {
                         struct ipv6_tlv_tnl_enc_lim *tel;
 
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index d5263dc364a9..b12e61b7b16c 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -72,10 +72,10 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
         return ret;
 }
 
-static bool rpfilter_is_local(const struct sk_buff *skb)
+static bool
+rpfilter_is_loopback(const struct sk_buff *skb, const struct net_device *in)
 {
-        const struct rt6_info *rt = (const void *) skb_dst(skb);
-        return rt && (rt->rt6i_flags & RTF_LOCAL);
+        return skb->pkt_type == PACKET_LOOPBACK || in->flags & IFF_LOOPBACK;
 }
 
 static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
@@ -85,7 +85,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
         struct ipv6hdr *iph;
         bool invert = info->flags & XT_RPFILTER_INVERT;
 
-        if (rpfilter_is_local(skb))
+        if (rpfilter_is_loopback(skb, xt_in(par)))
                 return true ^ invert;
 
         iph = ipv6_hdr(skb);
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index 10090400c72f..eedee5d108d9 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -157,6 +157,7 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)
         fl6.fl6_sport = otcph->dest;
         fl6.fl6_dport = otcph->source;
         fl6.flowi6_oif = l3mdev_master_ifindex(skb_dst(oldskb)->dev);
+        fl6.flowi6_mark = IP6_REPLY_MARK(net, oldskb->mark);
         security_skb_classify_flow(oldskb, flowi6_to_flowi(&fl6));
         dst = ip6_route_output(net, NULL, &fl6);
         if (dst->error) {
@@ -180,6 +181,8 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)
 
         skb_dst_set(nskb, dst);
 
+        nskb->mark = fl6.flowi6_mark;
+
         skb_reserve(nskb, hh_len + dst->header_len);
         ip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
                                     ip6_dst_hoplimit(dst));
diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
index c947aad8bcc6..765facf03d45 100644
--- a/net/ipv6/netfilter/nft_fib_ipv6.c
+++ b/net/ipv6/netfilter/nft_fib_ipv6.c
@@ -18,13 +18,6 @@
 #include <net/ip6_fib.h>
 #include <net/ip6_route.h>
 
-static bool fib6_is_local(const struct sk_buff *skb)
-{
-        const struct rt6_info *rt = (const void *)skb_dst(skb);
-
-        return rt && (rt->rt6i_flags & RTF_LOCAL);
-}
-
 static int get_ifindex(const struct net_device *dev)
 {
         return dev ? dev->ifindex : 0;
@@ -164,8 +157,10 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
 
         lookup_flags = nft_fib6_flowi_init(&fl6, priv, pkt, oif);
 
-        if (nft_hook(pkt) == NF_INET_PRE_ROUTING && fib6_is_local(pkt->skb)) {
-                nft_fib_store_result(dest, priv->result, pkt, LOOPBACK_IFINDEX);
+        if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&
+            nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {
+                nft_fib_store_result(dest, priv->result, pkt,
+                                     nft_in(pkt)->ifindex);
                 return;
         }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 4f6b067c8753..7ea85370c11c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2896,6 +2896,11 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (tb[RTA_MULTIPATH]) {
                 cfg->fc_mp = nla_data(tb[RTA_MULTIPATH]);
                 cfg->fc_mp_len = nla_len(tb[RTA_MULTIPATH]);
+
+                err = lwtunnel_valid_encap_type_attr(cfg->fc_mp,
+                                                     cfg->fc_mp_len);
+                if (err < 0)
+                        goto errout;
         }
 
         if (tb[RTA_PREF]) {
@@ -2909,9 +2914,14 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (tb[RTA_ENCAP])
                 cfg->fc_encap = tb[RTA_ENCAP];
 
-        if (tb[RTA_ENCAP_TYPE])
+        if (tb[RTA_ENCAP_TYPE]) {
                 cfg->fc_encap_type = nla_get_u16(tb[RTA_ENCAP_TYPE]);
 
+                err = lwtunnel_valid_encap_type(cfg->fc_encap_type);
+                if (err < 0)
+                        goto errout;
+        }
+
         if (tb[RTA_EXPIRES]) {
                 unsigned long timeout = addrconf_timeout_fixup(nla_get_u32(tb[RTA_EXPIRES]), HZ);
 
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index b172d85c650a..a855eb325b03 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -176,6 +176,8 @@ static int seg6_genl_set_tunsrc(struct sk_buff *skb, struct genl_info *info)
 
         val = nla_data(info->attrs[SEG6_ATTR_DST]);
         t_new = kmemdup(val, sizeof(*val), GFP_KERNEL);
+        if (!t_new)
+                return -ENOMEM;
 
         mutex_lock(&sdata->lock);
 
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 1d60cb132835..c46f8cbf5ab5 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -422,6 +422,7 @@ static const struct lwtunnel_encap_ops seg6_iptun_ops = {
         .fill_encap = seg6_fill_encap_info,
         .get_encap_size = seg6_encap_nlsize,
         .cmp_encap = seg6_encap_cmp,
+        .owner = THIS_MODULE,
 };
 
 int __init seg6_iptunnel_init(void)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 73bc8fc68acd..cb8929681dc7 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -469,7 +469,7 @@ static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
                 opt = ireq->ipv6_opt;
                 if (!opt)
                         opt = rcu_dereference(np->opt);
-                err = ip6_xmit(sk, skb, fl6, opt, np->tclass);
+                err = ip6_xmit(sk, skb, fl6, sk->sk_mark, opt, np->tclass);
                 rcu_read_unlock();
                 err = net_xmit_eval(err);
         }
@@ -840,7 +840,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32
         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
         if (!IS_ERR(dst)) {
                 skb_dst_set(buff, dst);
-                ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
+                ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass);
                 TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
                 if (rst)
                         TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 9e2641d45587..206698bc93f4 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -40,8 +40,6 @@ void rate_control_rate_init(struct sta_info *sta)
 
         ieee80211_sta_set_rx_nss(sta);
 
-        ieee80211_recalc_min_chandef(sta->sdata);
-
         if (!ref)
                 return;
 
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 15fe97644ffe..5b77377e5a15 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -98,18 +98,19 @@ bool mpls_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
 }
 EXPORT_SYMBOL_GPL(mpls_pkt_too_big);
 
-static u32 mpls_multipath_hash(struct mpls_route *rt,
-                               struct sk_buff *skb, bool bos)
+static u32 mpls_multipath_hash(struct mpls_route *rt, struct sk_buff *skb)
 {
         struct mpls_entry_decoded dec;
+        unsigned int mpls_hdr_len = 0;
         struct mpls_shim_hdr *hdr;
         bool eli_seen = false;
         int label_index;
         u32 hash = 0;
 
-        for (label_index = 0; label_index < MAX_MP_SELECT_LABELS && !bos;
+        for (label_index = 0; label_index < MAX_MP_SELECT_LABELS;
              label_index++) {
-                if (!pskb_may_pull(skb, sizeof(*hdr) * label_index))
+                mpls_hdr_len += sizeof(*hdr);
+                if (!pskb_may_pull(skb, mpls_hdr_len))
                         break;
 
                 /* Read and decode the current label */
@@ -134,37 +135,38 @@ static u32 mpls_multipath_hash(struct mpls_route *rt,
                         eli_seen = true;
                 }
 
-                bos = dec.bos;
-                if (bos && pskb_may_pull(skb, sizeof(*hdr) * label_index +
-                                         sizeof(struct iphdr))) {
+                if (!dec.bos)
+                        continue;
+
+                /* found bottom label; does skb have room for a header? */
+                if (pskb_may_pull(skb, mpls_hdr_len + sizeof(struct iphdr))) {
                         const struct iphdr *v4hdr;
 
-                        v4hdr = (const struct iphdr *)(mpls_hdr(skb) +
-                                                       label_index);
+                        v4hdr = (const struct iphdr *)(hdr + 1);
                         if (v4hdr->version == 4) {
                                 hash = jhash_3words(ntohl(v4hdr->saddr),
                                                     ntohl(v4hdr->daddr),
                                                     v4hdr->protocol, hash);
                         } else if (v4hdr->version == 6 &&
-                                pskb_may_pull(skb, sizeof(*hdr) * label_index +
-                                              sizeof(struct ipv6hdr))) {
+                                   pskb_may_pull(skb, mpls_hdr_len +
+                                                 sizeof(struct ipv6hdr))) {
                                 const struct ipv6hdr *v6hdr;
 
-                                v6hdr = (const struct ipv6hdr *)(mpls_hdr(skb) +
-                                                                label_index);
-
+                                v6hdr = (const struct ipv6hdr *)(hdr + 1);
                                 hash = __ipv6_addr_jhash(&v6hdr->saddr, hash);
                                 hash = __ipv6_addr_jhash(&v6hdr->daddr, hash);
                                 hash = jhash_1word(v6hdr->nexthdr, hash);
                         }
                 }
+
+                break;
         }
 
         return hash;
 }
 
 static struct mpls_nh *mpls_select_multipath(struct mpls_route *rt,
-                                             struct sk_buff *skb, bool bos)
+                                             struct sk_buff *skb)
 {
         int alive = ACCESS_ONCE(rt->rt_nhn_alive);
         u32 hash = 0;
@@ -180,7 +182,7 @@ static struct mpls_nh *mpls_select_multipath(struct mpls_route *rt,
         if (alive <= 0)
                 return NULL;
 
-        hash = mpls_multipath_hash(rt, skb, bos);
+        hash = mpls_multipath_hash(rt, skb);
         nh_index = hash % alive;
         if (alive == rt->rt_nhn)
                 goto out;
@@ -278,17 +280,11 @@ static int mpls_forward(struct sk_buff *skb, struct net_device *dev,
         hdr = mpls_hdr(skb);
         dec = mpls_entry_decode(hdr);
 
-        /* Pop the label */
-        skb_pull(skb, sizeof(*hdr));
-        skb_reset_network_header(skb);
-
-        skb_orphan(skb);
-
         rt = mpls_route_input_rcu(net, dec.label);
         if (!rt)
                 goto drop;
 
-        nh = mpls_select_multipath(rt, skb, dec.bos);
+        nh = mpls_select_multipath(rt, skb);
         if (!nh)
                 goto drop;
 
@@ -297,6 +293,12 @@ static int mpls_forward(struct sk_buff *skb, struct net_device *dev,
         if (!mpls_output_possible(out_dev))
                 goto drop;
 
+        /* Pop the label */
+        skb_pull(skb, sizeof(*hdr));
+        skb_reset_network_header(skb);
+
+        skb_orphan(skb);
+
         if (skb_warn_if_lro(skb))
                 goto drop;
 
diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c
index 2f7ccd934416..1d281c1ff7c1 100644
--- a/net/mpls/mpls_iptunnel.c
+++ b/net/mpls/mpls_iptunnel.c
@@ -215,6 +215,7 @@ static const struct lwtunnel_encap_ops mpls_iptun_ops = {
         .fill_encap = mpls_fill_encap_info,
         .get_encap_size = mpls_encap_nlsize,
         .cmp_encap = mpls_encap_cmp,
+        .owner = THIS_MODULE,
 };
 
 static int __init mpls_iptunnel_init(void)
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 63729b489c2c..bbc45f8a7b2d 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -494,7 +494,7 @@ config NFT_CT
         depends on NF_CONNTRACK
         tristate "Netfilter nf_tables conntrack module"
         help
-          This option adds the "meta" expression that you can use to match
+          This option adds the "ct" expression that you can use to match
           connection tracking information such as the flow state.
 
 config NFT_SET_RBTREE
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 3a073cd9fcf4..4e8083c5e01d 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -85,11 +85,11 @@ static __read_mostly DEFINE_SPINLOCK(nf_conntrack_locks_all_lock);
 static __read_mostly bool nf_conntrack_locks_all;
 
 /* every gc cycle scans at most 1/GC_MAX_BUCKETS_DIV part of table */
-#define GC_MAX_BUCKETS_DIV      64u
-/* upper bound of scan intervals */
-#define GC_INTERVAL_MAX         (2 * HZ)
-/* maximum conntracks to evict per gc run */
-#define GC_MAX_EVICTS           256u
+#define GC_MAX_BUCKETS_DIV      128u
+/* upper bound of full table scan */
+#define GC_MAX_SCAN_JIFFIES     (16u * HZ)
+/* desired ratio of entries found to be expired */
+#define GC_EVICT_RATIO  50u
 
 static struct conntrack_gc_work conntrack_gc_work;
 
@@ -938,6 +938,7 @@ static noinline int early_drop(struct net *net, unsigned int _hash)
 
 static void gc_worker(struct work_struct *work)
 {
+        unsigned int min_interval = max(HZ / GC_MAX_BUCKETS_DIV, 1u);
         unsigned int i, goal, buckets = 0, expired_count = 0;
         struct conntrack_gc_work *gc_work;
         unsigned int ratio, scanned = 0;
@@ -979,8 +980,7 @@ static void gc_worker(struct work_struct *work)
                  */
                 rcu_read_unlock();
                 cond_resched_rcu_qs();
-        } while (++buckets < goal &&
-                 expired_count < GC_MAX_EVICTS);
+        } while (++buckets < goal);
 
         if (gc_work->exiting)
                 return;
@@ -997,27 +997,25 @@ static void gc_worker(struct work_struct *work)
          * 1. Minimize time until we notice a stale entry
          * 2. Maximize scan intervals to not waste cycles
          *
-         * Normally, expired_count will be 0, this increases the next_run time
-         * to priorize 2) above.
+         * Normally, expire ratio will be close to 0.
          *
-         * As soon as a timed-out entry is found, move towards 1) and increase
-         * the scan frequency.
-         * In case we have lots of evictions next scan is done immediately.
+         * As soon as a sizeable fraction of the entries have expired
+         * increase scan frequency.
          */
         ratio = scanned ? expired_count * 100 / scanned : 0;
-        if (ratio >= 90 || expired_count == GC_MAX_EVICTS) {
-                gc_work->next_gc_run = 0;
-                next_run = 0;
-        } else if (expired_count) {
-                gc_work->next_gc_run /= 2U;
-                next_run = msecs_to_jiffies(1);
+        if (ratio > GC_EVICT_RATIO) {
+                gc_work->next_gc_run = min_interval;
         } else {
-                if (gc_work->next_gc_run < GC_INTERVAL_MAX)
-                        gc_work->next_gc_run += msecs_to_jiffies(1);
+                unsigned int max = GC_MAX_SCAN_JIFFIES / GC_MAX_BUCKETS_DIV;
 
-                next_run = gc_work->next_gc_run;
+                BUILD_BUG_ON((GC_MAX_SCAN_JIFFIES / GC_MAX_BUCKETS_DIV) == 0);
+
+                gc_work->next_gc_run += min_interval;
+                if (gc_work->next_gc_run > max)
+                        gc_work->next_gc_run = max;
         }
 
+        next_run = gc_work->next_gc_run;
         gc_work->last_bucket = i;
         queue_delayed_work(system_long_wq, &gc_work->dwork, next_run);
 }
@@ -1025,7 +1023,7 @@ static void gc_worker(struct work_struct *work)
 static void conntrack_gc_work_init(struct conntrack_gc_work *gc_work)
 {
         INIT_DELAYED_WORK(&gc_work->dwork, gc_worker);
-        gc_work->next_gc_run = GC_INTERVAL_MAX;
+        gc_work->next_gc_run = HZ;
         gc_work->exiting = false;
 }
 
@@ -1917,7 +1915,7 @@ int nf_conntrack_init_start(void)
         nf_ct_untracked_status_or(IPS_CONFIRMED | IPS_UNTRACKED);
 
         conntrack_gc_work_init(&conntrack_gc_work);
-        queue_delayed_work(system_long_wq, &conntrack_gc_work.dwork, GC_INTERVAL_MAX);
+        queue_delayed_work(system_long_wq, &conntrack_gc_work.dwork, HZ);
 
         return 0;
 
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 3dca90dc24ad..ffb9e8ada899 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -13,7 +13,6 @@
 /* Internal logging interface, which relies on the real
    LOG target modules */
 
-#define NF_LOG_PREFIXLEN                128
 #define NFLOGGER_NAME_LEN               64
 
 static struct nf_logger __rcu *loggers[NFPROTO_NUMPROTO][NF_LOG_TYPE_MAX] __read_mostly;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 0db5f9782265..1b913760f205 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -928,7 +928,8 @@ static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table,
 }
 
 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
-        [NFTA_CHAIN_TABLE]      = { .type = NLA_STRING },
+        [NFTA_CHAIN_TABLE]      = { .type = NLA_STRING,
+                                    .len = NFT_TABLE_MAXNAMELEN - 1 },
         [NFTA_CHAIN_HANDLE]     = { .type = NLA_U64 },
         [NFTA_CHAIN_NAME]       = { .type = NLA_STRING,
                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
@@ -1854,7 +1855,8 @@ static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain,
 }
 
 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
-        [NFTA_RULE_TABLE]       = { .type = NLA_STRING },
+        [NFTA_RULE_TABLE]       = { .type = NLA_STRING,
+                                    .len = NFT_TABLE_MAXNAMELEN - 1 },
         [NFTA_RULE_CHAIN]       = { .type = NLA_STRING,
                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
         [NFTA_RULE_HANDLE]      = { .type = NLA_U64 },
@@ -2443,7 +2445,8 @@ nft_select_set_ops(const struct nlattr * const nla[],
 }
 
 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
-        [NFTA_SET_TABLE]                = { .type = NLA_STRING },
+        [NFTA_SET_TABLE]                = { .type = NLA_STRING,
+                                            .len = NFT_TABLE_MAXNAMELEN - 1 },
         [NFTA_SET_NAME]                 = { .type = NLA_STRING,
                                             .len = NFT_SET_MAXNAMELEN - 1 },
         [NFTA_SET_FLAGS]                = { .type = NLA_U32 },
@@ -3084,9 +3087,9 @@ static int nf_tables_delset(struct net *net, struct sock *nlsk,
 }
 
 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
-                                        const struct nft_set *set,
+                                        struct nft_set *set,
                                         const struct nft_set_iter *iter,
-                                        const struct nft_set_elem *elem)
+                                        struct nft_set_elem *elem)
 {
         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
         enum nft_registers dreg;
@@ -3192,8 +3195,10 @@ static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
 };
 
 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
-        [NFTA_SET_ELEM_LIST_TABLE]      = { .type = NLA_STRING },
-        [NFTA_SET_ELEM_LIST_SET]        = { .type = NLA_STRING },
+        [NFTA_SET_ELEM_LIST_TABLE]      = { .type = NLA_STRING,
+                                            .len = NFT_TABLE_MAXNAMELEN - 1 },
+        [NFTA_SET_ELEM_LIST_SET]        = { .type = NLA_STRING,
+                                            .len = NFT_SET_MAXNAMELEN - 1 },
         [NFTA_SET_ELEM_LIST_ELEMENTS]   = { .type = NLA_NESTED },
         [NFTA_SET_ELEM_LIST_SET_ID]     = { .type = NLA_U32 },
 };
@@ -3303,9 +3308,9 @@ struct nft_set_dump_args {
 };
 
 static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
-                                  const struct nft_set *set,
+                                  struct nft_set *set,
                                   const struct nft_set_iter *iter,
-                                  const struct nft_set_elem *elem)
+                                  struct nft_set_elem *elem)
 {
         struct nft_set_dump_args *args;
 
@@ -3317,7 +3322,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
         u8 genmask = nft_genmask_cur(net);
-        const struct nft_set *set;
+        struct nft_set *set;
         struct nft_set_dump_args args;
         struct nft_ctx ctx;
         struct nlattr *nla[NFTA_SET_ELEM_LIST_MAX + 1];
@@ -3740,10 +3745,18 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                 goto err5;
         }
 
+        if (set->size &&
+            !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
+                err = -ENFILE;
+                goto err6;
+        }
+
         nft_trans_elem(trans) = elem;
         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
         return 0;
 
+err6:
+        set->ops->remove(set, &elem);
 err5:
         kfree(trans);
 err4:
@@ -3790,15 +3803,9 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
                 return -EBUSY;
 
         nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
-                if (set->size &&
-                    !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact))
-                        return -ENFILE;
-
                 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
-                if (err < 0) {
-                        atomic_dec(&set->nelems);
+                if (err < 0)
                         break;
-                }
         }
         return err;
 }
@@ -3883,9 +3890,9 @@ err1:
 }
 
 static int nft_flush_set(const struct nft_ctx *ctx,
-                         const struct nft_set *set,
+                         struct nft_set *set,
                          const struct nft_set_iter *iter,
-                         const struct nft_set_elem *elem)
+                         struct nft_set_elem *elem)
 {
         struct nft_trans *trans;
         int err;
@@ -3899,9 +3906,10 @@ static int nft_flush_set(const struct nft_ctx *ctx,
                 err = -ENOENT;
                 goto err1;
         }
+        set->ndeact++;
 
-        nft_trans_elem_set(trans) = (struct nft_set *)set;
-        nft_trans_elem(trans) = *((struct nft_set_elem *)elem);
+        nft_trans_elem_set(trans) = set;
+        nft_trans_elem(trans) = *elem;
         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 
         return 0;
@@ -4032,8 +4040,10 @@ struct nft_object *nf_tables_obj_lookup(const struct nft_table *table,
 EXPORT_SYMBOL_GPL(nf_tables_obj_lookup);
 
 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
-        [NFTA_OBJ_TABLE]        = { .type = NLA_STRING },
-        [NFTA_OBJ_NAME]         = { .type = NLA_STRING },
+        [NFTA_OBJ_TABLE]        = { .type = NLA_STRING,
+                                    .len = NFT_TABLE_MAXNAMELEN - 1 },
+        [NFTA_OBJ_NAME]         = { .type = NLA_STRING,
+                                    .len = NFT_OBJ_MAXNAMELEN - 1 },
         [NFTA_OBJ_TYPE]         = { .type = NLA_U32 },
         [NFTA_OBJ_DATA]         = { .type = NLA_NESTED },
 };
@@ -4262,10 +4272,11 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
                                 if (idx > s_idx)
                                         memset(&cb->args[1], 0,
                                                sizeof(cb->args) - sizeof(cb->args[0]));
-                                if (filter->table[0] &&
+                                if (filter && filter->table[0] &&
                                     strcmp(filter->table, table->name))
                                         goto cont;
-                                if (filter->type != NFT_OBJECT_UNSPEC &&
+                                if (filter &&
+                                    filter->type != NFT_OBJECT_UNSPEC &&
                                     obj->type->type != filter->type)
                                         goto cont;
 
@@ -5009,9 +5020,9 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
                                  const struct nft_chain *chain);
 
 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
-                                        const struct nft_set *set,
+                                        struct nft_set *set,
                                         const struct nft_set_iter *iter,
-                                        const struct nft_set_elem *elem)
+                                        struct nft_set_elem *elem)
 {
         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
         const struct nft_data *data;
@@ -5035,7 +5046,7 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
 {
         const struct nft_rule *rule;
         const struct nft_expr *expr, *last;
-        const struct nft_set *set;
+        struct nft_set *set;
         struct nft_set_binding *binding;
         struct nft_set_iter iter;
 
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 7de2f46734a4..049ad2d9ee66 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -98,7 +98,8 @@ out:
 }
 
 static const struct nla_policy nft_dynset_policy[NFTA_DYNSET_MAX + 1] = {
-        [NFTA_DYNSET_SET_NAME]  = { .type = NLA_STRING },
+        [NFTA_DYNSET_SET_NAME]  = { .type = NLA_STRING,
+                                    .len = NFT_SET_MAXNAMELEN - 1 },
         [NFTA_DYNSET_SET_ID]    = { .type = NLA_U32 },
         [NFTA_DYNSET_OP]        = { .type = NLA_U32 },
         [NFTA_DYNSET_SREG_KEY]  = { .type = NLA_U32 },
diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c
index 6271e40a3dd6..6f6e64423643 100644
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -39,7 +39,8 @@ static void nft_log_eval(const struct nft_expr *expr,
 
 static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = {
         [NFTA_LOG_GROUP]        = { .type = NLA_U16 },
-        [NFTA_LOG_PREFIX]       = { .type = NLA_STRING },
+        [NFTA_LOG_PREFIX]       = { .type = NLA_STRING,
+                                    .len = NF_LOG_PREFIXLEN - 1 },
         [NFTA_LOG_SNAPLEN]      = { .type = NLA_U32 },
         [NFTA_LOG_QTHRESHOLD]   = { .type = NLA_U16 },
         [NFTA_LOG_LEVEL]        = { .type = NLA_U32 },
diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index d4f97fa7e21d..e21aea7e5ec8 100644
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -49,7 +49,8 @@ static void nft_lookup_eval(const struct nft_expr *expr,
 }
 
 static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = {
-        [NFTA_LOOKUP_SET]       = { .type = NLA_STRING },
+        [NFTA_LOOKUP_SET]       = { .type = NLA_STRING,
+                                    .len = NFT_SET_MAXNAMELEN - 1 },
         [NFTA_LOOKUP_SET_ID]    = { .type = NLA_U32 },
         [NFTA_LOOKUP_SREG]      = { .type = NLA_U32 },
         [NFTA_LOOKUP_DREG]      = { .type = NLA_U32 },
diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
index 415a65ba2b85..1ae8c49ca4a1 100644
--- a/net/netfilter/nft_objref.c
+++ b/net/netfilter/nft_objref.c
@@ -193,10 +193,12 @@ nft_objref_select_ops(const struct nft_ctx *ctx,
 }
 
 static const struct nla_policy nft_objref_policy[NFTA_OBJREF_MAX + 1] = {
-        [NFTA_OBJREF_IMM_NAME]  = { .type = NLA_STRING },
+        [NFTA_OBJREF_IMM_NAME]  = { .type = NLA_STRING,
+                                    .len = NFT_OBJ_MAXNAMELEN - 1 },
         [NFTA_OBJREF_IMM_TYPE]  = { .type = NLA_U32 },
         [NFTA_OBJREF_SET_SREG]  = { .type = NLA_U32 },
-        [NFTA_OBJREF_SET_NAME]  = { .type = NLA_STRING },
+        [NFTA_OBJREF_SET_NAME]  = { .type = NLA_STRING,
+                                    .len = NFT_SET_MAXNAMELEN - 1 },
         [NFTA_OBJREF_SET_ID]    = { .type = NLA_U32 },
 };
 
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 1e20e2bbb6d9..e36069fb76ae 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -212,7 +212,7 @@ static void nft_hash_remove(const struct nft_set *set,
         rhashtable_remove_fast(&priv->ht, &he->node, nft_hash_params);
 }
 
-static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
+static void nft_hash_walk(const struct nft_ctx *ctx, struct nft_set *set,
                           struct nft_set_iter *iter)
 {
         struct nft_hash *priv = nft_set_priv(set);
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 08376e50f6cd..f06f55ee516d 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -221,7 +221,7 @@ static void *nft_rbtree_deactivate(const struct net *net,
 }
 
 static void nft_rbtree_walk(const struct nft_ctx *ctx,
-                            const struct nft_set *set,
+                            struct nft_set *set,
                             struct nft_set_iter *iter)
 {
         const struct nft_rbtree *priv = nft_set_priv(set);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index b9e1a13b4ba3..3d555c79a7b5 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1976,7 +1976,7 @@ static int packet_rcv_vnet(struct msghdr *msg, const struct sk_buff *skb,
                 return -EINVAL;
         *len -= sizeof(vnet_hdr);
 
-        if (virtio_net_hdr_from_skb(skb, &vnet_hdr, vio_le()))
+        if (virtio_net_hdr_from_skb(skb, &vnet_hdr, vio_le(), true))
                 return -EINVAL;
 
         return memcpy_to_msg(msg, (void *)&vnet_hdr, sizeof(vnet_hdr));
@@ -2237,7 +2237,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
         if (po->has_vnet_hdr) {
                 if (virtio_net_hdr_from_skb(skb, h.raw + macoff -
                                             sizeof(struct virtio_net_hdr),
-                                            vio_le())) {
+                                            vio_le(), true)) {
                         spin_lock(&sk->sk_receive_queue.lock);
                         goto drop_n_account;
                 }
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 970db7a41684..5752789acc13 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -568,9 +568,9 @@ static int fl_set_key(struct net *net, struct nlattr **tb,
                                &mask->icmp.type,
                                TCA_FLOWER_KEY_ICMPV6_TYPE_MASK,
                                sizeof(key->icmp.type));
-                fl_set_key_val(tb, &key->icmp.code, TCA_FLOWER_KEY_ICMPV4_CODE,
+                fl_set_key_val(tb, &key->icmp.code, TCA_FLOWER_KEY_ICMPV6_CODE,
                                &mask->icmp.code,
-                               TCA_FLOWER_KEY_ICMPV4_CODE_MASK,
+                               TCA_FLOWER_KEY_ICMPV6_CODE_MASK,
                                sizeof(key->icmp.code));
         }
 
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index f935429bd5ef..b12bc2abea93 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -16,16 +16,11 @@
 #include <net/sch_generic.h>
 #include <net/pkt_cls.h>
 
-struct cls_mall_filter {
+struct cls_mall_head {
         struct tcf_exts exts;
         struct tcf_result res;
         u32 handle;
-        struct rcu_head rcu;
         u32 flags;
-};
-
-struct cls_mall_head {
-        struct cls_mall_filter *filter;
         struct rcu_head rcu;
 };
 
@@ -33,38 +28,29 @@ static int mall_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                          struct tcf_result *res)
 {
         struct cls_mall_head *head = rcu_dereference_bh(tp->root);
-        struct cls_mall_filter *f = head->filter;
 
-        if (tc_skip_sw(f->flags))
+        if (tc_skip_sw(head->flags))
                 return -1;
 
-        return tcf_exts_exec(skb, &f->exts, res);
+        return tcf_exts_exec(skb, &head->exts, res);
 }
 
 static int mall_init(struct tcf_proto *tp)
 {
-        struct cls_mall_head *head;
-
-        head = kzalloc(sizeof(*head), GFP_KERNEL);
-        if (!head)
-                return -ENOBUFS;
-
-        rcu_assign_pointer(tp->root, head);
-
         return 0;
 }
 
-static void mall_destroy_filter(struct rcu_head *head)
+static void mall_destroy_rcu(struct rcu_head *rcu)
 {
-        struct cls_mall_filter *f = container_of(head, struct cls_mall_filter, rcu);
+        struct cls_mall_head *head = container_of(rcu, struct cls_mall_head,
+                                                  rcu);
 
-        tcf_exts_destroy(&f->exts);
-
-        kfree(f);
+        tcf_exts_destroy(&head->exts);
+        kfree(head);
 }
 
 static int mall_replace_hw_filter(struct tcf_proto *tp,
-                                  struct cls_mall_filter *f,
+                                  struct cls_mall_head *head,
                                   unsigned long cookie)
 {
         struct net_device *dev = tp->q->dev_queue->dev;
@@ -74,7 +60,7 @@ static int mall_replace_hw_filter(struct tcf_proto *tp,
         offload.type = TC_SETUP_MATCHALL;
         offload.cls_mall = &mall_offload;
         offload.cls_mall->command = TC_CLSMATCHALL_REPLACE;
-        offload.cls_mall->exts = &f->exts;
+        offload.cls_mall->exts = &head->exts;
         offload.cls_mall->cookie = cookie;
 
         return dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle, tp->protocol,
@@ -82,7 +68,7 @@ static int mall_replace_hw_filter(struct tcf_proto *tp,
 }
 
 static void mall_destroy_hw_filter(struct tcf_proto *tp,
-                                   struct cls_mall_filter *f,
+                                   struct cls_mall_head *head,
                                    unsigned long cookie)
 {
         struct net_device *dev = tp->q->dev_queue->dev;
@@ -103,29 +89,20 @@ static bool mall_destroy(struct tcf_proto *tp, bool force)
 {
         struct cls_mall_head *head = rtnl_dereference(tp->root);
         struct net_device *dev = tp->q->dev_queue->dev;
-        struct cls_mall_filter *f = head->filter;
 
-        if (!force && f)
-                return false;
+        if (!head)
+                return true;
 
-        if (f) {
-                if (tc_should_offload(dev, tp, f->flags))
-                        mall_destroy_hw_filter(tp, f, (unsigned long) f);
+        if (tc_should_offload(dev, tp, head->flags))
+                mall_destroy_hw_filter(tp, head, (unsigned long) head);
 
-                call_rcu(&f->rcu, mall_destroy_filter);
-        }
-        kfree_rcu(head, rcu);
+        call_rcu(&head->rcu, mall_destroy_rcu);
         return true;
 }
 
 static unsigned long mall_get(struct tcf_proto *tp, u32 handle)
 {
-        struct cls_mall_head *head = rtnl_dereference(tp->root);
-        struct cls_mall_filter *f = head->filter;
-
-        if (f && f->handle == handle)
-                return (unsigned long) f;
-        return 0;
+        return 0UL;
 }
 
 static const struct nla_policy mall_policy[TCA_MATCHALL_MAX + 1] = {
@@ -134,7 +111,7 @@ static const struct nla_policy mall_policy[TCA_MATCHALL_MAX + 1] = {
 };
 
 static int mall_set_parms(struct net *net, struct tcf_proto *tp,
-                          struct cls_mall_filter *f,
+                          struct cls_mall_head *head,
                           unsigned long base, struct nlattr **tb,
                           struct nlattr *est, bool ovr)
 {
@@ -147,11 +124,11 @@ static int mall_set_parms(struct net *net, struct tcf_proto *tp,
                 return err;
 
         if (tb[TCA_MATCHALL_CLASSID]) {
-                f->res.classid = nla_get_u32(tb[TCA_MATCHALL_CLASSID]);
-                tcf_bind_filter(tp, &f->res, base);
+                head->res.classid = nla_get_u32(tb[TCA_MATCHALL_CLASSID]);
+                tcf_bind_filter(tp, &head->res, base);
         }
 
-        tcf_exts_change(tp, &f->exts, &e);
+        tcf_exts_change(tp, &head->exts, &e);
 
         return 0;
 }
@@ -162,21 +139,17 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
                        unsigned long *arg, bool ovr)
 {
         struct cls_mall_head *head = rtnl_dereference(tp->root);
-        struct cls_mall_filter *fold = (struct cls_mall_filter *) *arg;
         struct net_device *dev = tp->q->dev_queue->dev;
-        struct cls_mall_filter *f;
         struct nlattr *tb[TCA_MATCHALL_MAX + 1];
+        struct cls_mall_head *new;
         u32 flags = 0;
         int err;
 
         if (!tca[TCA_OPTIONS])
                 return -EINVAL;
 
-        if (head->filter)
-                return -EBUSY;
-
-        if (fold)
-                return -EINVAL;
+        if (head)
+                return -EEXIST;
 
         err = nla_parse_nested(tb, TCA_MATCHALL_MAX,
                                tca[TCA_OPTIONS], mall_policy);
@@ -189,23 +162,23 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
                         return -EINVAL;
         }
 
-        f = kzalloc(sizeof(*f), GFP_KERNEL);
-        if (!f)
+        new = kzalloc(sizeof(*new), GFP_KERNEL);
+        if (!new)
                 return -ENOBUFS;
 
-        tcf_exts_init(&f->exts, TCA_MATCHALL_ACT, 0);
+        tcf_exts_init(&new->exts, TCA_MATCHALL_ACT, 0);
 
         if (!handle)
                 handle = 1;
-        f->handle = handle;
-        f->flags = flags;
+        new->handle = handle;
+        new->flags = flags;
 
-        err = mall_set_parms(net, tp, f, base, tb, tca[TCA_RATE], ovr);
+        err = mall_set_parms(net, tp, new, base, tb, tca[TCA_RATE], ovr);
         if (err)
                 goto errout;
 
         if (tc_should_offload(dev, tp, flags)) {
-                err = mall_replace_hw_filter(tp, f, (unsigned long) f);
+                err = mall_replace_hw_filter(tp, new, (unsigned long) new);
                 if (err) {
                         if (tc_skip_sw(flags))
                                 goto errout;
@@ -214,39 +187,29 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
                 }
         }
 
-        *arg = (unsigned long) f;
-        rcu_assign_pointer(head->filter, f);
-
+        *arg = (unsigned long) head;
+        rcu_assign_pointer(tp->root, new);
+        if (head)
+                call_rcu(&head->rcu, mall_destroy_rcu);
         return 0;
 
 errout:
-        kfree(f);
+        kfree(new);
         return err;
 }
 
 static int mall_delete(struct tcf_proto *tp, unsigned long arg)
 {
-        struct cls_mall_head *head = rtnl_dereference(tp->root);
-        struct cls_mall_filter *f = (struct cls_mall_filter *) arg;
-        struct net_device *dev = tp->q->dev_queue->dev;
-
-        if (tc_should_offload(dev, tp, f->flags))
-                mall_destroy_hw_filter(tp, f, (unsigned long) f);
-
-        RCU_INIT_POINTER(head->filter, NULL);
-        tcf_unbind_filter(tp, &f->res);
-        call_rcu(&f->rcu, mall_destroy_filter);
-        return 0;
+        return -EOPNOTSUPP;
 }
 
 static void mall_walk(struct tcf_proto *tp, struct tcf_walker *arg)
 {
         struct cls_mall_head *head = rtnl_dereference(tp->root);
-        struct cls_mall_filter *f = head->filter;
 
         if (arg->count < arg->skip)
                 goto skip;
-        if (arg->fn(tp, (unsigned long) f, arg) < 0)
+        if (arg->fn(tp, (unsigned long) head, arg) < 0)
                 arg->stop = 1;
 skip:
         arg->count++;
@@ -255,28 +218,28 @@ skip:
 static int mall_dump(struct net *net, struct tcf_proto *tp, unsigned long fh,
                      struct sk_buff *skb, struct tcmsg *t)
 {
-        struct cls_mall_filter *f = (struct cls_mall_filter *) fh;
+        struct cls_mall_head *head = (struct cls_mall_head *) fh;
         struct nlattr *nest;
 
-        if (!f)
+        if (!head)
                 return skb->len;
 
-        t->tcm_handle = f->handle;
+        t->tcm_handle = head->handle;
 
         nest = nla_nest_start(skb, TCA_OPTIONS);
         if (!nest)
                 goto nla_put_failure;
 
-        if (f->res.classid &&
-            nla_put_u32(skb, TCA_MATCHALL_CLASSID, f->res.classid))
+        if (head->res.classid &&
+            nla_put_u32(skb, TCA_MATCHALL_CLASSID, head->res.classid))
                 goto nla_put_failure;
 
-        if (tcf_exts_dump(skb, &f->exts))
+        if (tcf_exts_dump(skb, &head->exts))
                 goto nla_put_failure;
 
         nla_nest_end(skb, nest);
 
-        if (tcf_exts_dump_stats(skb, &f->exts) < 0)
+        if (tcf_exts_dump_stats(skb, &head->exts) < 0)
                 goto nla_put_failure;
 
         return skb->len;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 5ed8e79bf102..64dfd35ccdcc 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -222,7 +222,8 @@ static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
         SCTP_INC_STATS(sock_net(sk), SCTP_MIB_OUTSCTPPACKS);
 
         rcu_read_lock();
-        res = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt), np->tclass);
+        res = ip6_xmit(sk, skb, fl6, sk->sk_mark, rcu_dereference(np->opt),
+                       np->tclass);
         rcu_read_unlock();
         return res;
 }
diff --git a/net/sctp/offload.c b/net/sctp/offload.c
index 7e869d0cca69..4f5a2b580aa5 100644
--- a/net/sctp/offload.c
+++ b/net/sctp/offload.c
@@ -68,7 +68,7 @@ static struct sk_buff *sctp_gso_segment(struct sk_buff *skb,
                 goto out;
         }
 
-        segs = skb_segment(skb, features | NETIF_F_HW_CSUM);
+        segs = skb_segment(skb, features | NETIF_F_HW_CSUM | NETIF_F_SG);
         if (IS_ERR(segs))
                 goto out;
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 318c6786d653..37eeab7899fc 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -235,8 +235,12 @@ static struct sctp_transport *sctp_addr_id2transport(struct sock *sk,
                                               sctp_assoc_t id)
 {
         struct sctp_association *addr_asoc = NULL, *id_asoc = NULL;
-        struct sctp_transport *transport;
+        struct sctp_af *af = sctp_get_af_specific(addr->ss_family);
         union sctp_addr *laddr = (union sctp_addr *)addr;
+        struct sctp_transport *transport;
+
+        if (sctp_verify_addr(sk, laddr, af->sockaddr_len))
+                return NULL;
 
         addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep,
                                                laddr,
diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
index dc6fb79a361f..25d9a9cf7b66 100644
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -260,7 +260,7 @@ static int gssx_dec_option_array(struct xdr_stream *xdr,
         if (!oa->data)
                 return -ENOMEM;
 
-        creds = kmalloc(sizeof(struct svc_cred), GFP_KERNEL);
+        creds = kzalloc(sizeof(struct svc_cred), GFP_KERNEL);
         if (!creds) {
                 kfree(oa->data);
                 return -ENOMEM;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 1efbe48e794f..1dc9f3bac099 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -336,6 +336,11 @@ out:
 
 static DEFINE_IDA(rpc_clids);
 
+void rpc_cleanup_clids(void)
+{
+        ida_destroy(&rpc_clids);
+}
+
 static int rpc_alloc_clid(struct rpc_clnt *clnt)
 {
         int clid;
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index d1c330a7953a..c73de181467a 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -119,6 +119,7 @@ out:
 static void __exit
 cleanup_sunrpc(void)
 {
+        rpc_cleanup_clids();
         rpcauth_remove_module();
         cleanup_socket_xprt();
         svc_cleanup_xprt_sock();
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 9d2f4c2b08ab..27753325e06e 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -263,6 +263,11 @@ static void tipc_node_write_lock(struct tipc_node *n)
         write_lock_bh(&n->lock);
 }
 
+static void tipc_node_write_unlock_fast(struct tipc_node *n)
+{
+        write_unlock_bh(&n->lock);
+}
+
 static void tipc_node_write_unlock(struct tipc_node *n)
 {
         struct net *net = n->net;
@@ -417,7 +422,7 @@ void tipc_node_subscribe(struct net *net, struct list_head *subscr, u32 addr)
         }
         tipc_node_write_lock(n);
         list_add_tail(subscr, &n->publ_list);
-        tipc_node_write_unlock(n);
+        tipc_node_write_unlock_fast(n);
         tipc_node_put(n);
 }
 
@@ -435,7 +440,7 @@ void tipc_node_unsubscribe(struct net *net, struct list_head *subscr, u32 addr)
         }
         tipc_node_write_lock(n);
         list_del_init(subscr);
-        tipc_node_write_unlock(n);
+        tipc_node_write_unlock_fast(n);
         tipc_node_put(n);
 }
 
diff --git a/net/tipc/server.c b/net/tipc/server.c
index 215849ce453d..3cd6402e812c 100644
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -86,12 +86,12 @@ struct outqueue_entry {
 static void tipc_recv_work(struct work_struct *work);
 static void tipc_send_work(struct work_struct *work);
 static void tipc_clean_outqueues(struct tipc_conn *con);
-static void tipc_sock_release(struct tipc_conn *con);
 
 static void tipc_conn_kref_release(struct kref *kref)
 {
         struct tipc_conn *con = container_of(kref, struct tipc_conn, kref);
-        struct sockaddr_tipc *saddr = con->server->saddr;
+        struct tipc_server *s = con->server;
+        struct sockaddr_tipc *saddr = s->saddr;
         struct socket *sock = con->sock;
         struct sock *sk;
 
@@ -103,9 +103,13 @@ static void tipc_conn_kref_release(struct kref *kref)
                 }
                 saddr->scope = -TIPC_NODE_SCOPE;
                 kernel_bind(sock, (struct sockaddr *)saddr, sizeof(*saddr));
-                tipc_sock_release(con);
                 sock_release(sock);
                 con->sock = NULL;
+
+                spin_lock_bh(&s->idr_lock);
+                idr_remove(&s->conn_idr, con->conid);
+                s->idr_in_use--;
+                spin_unlock_bh(&s->idr_lock);
         }
 
         tipc_clean_outqueues(con);
@@ -128,8 +132,10 @@ static struct tipc_conn *tipc_conn_lookup(struct tipc_server *s, int conid)
 
         spin_lock_bh(&s->idr_lock);
         con = idr_find(&s->conn_idr, conid);
-        if (con)
+        if (con && test_bit(CF_CONNECTED, &con->flags))
                 conn_get(con);
+        else
+                con = NULL;
         spin_unlock_bh(&s->idr_lock);
         return con;
 }
@@ -186,26 +192,15 @@ static void tipc_unregister_callbacks(struct tipc_conn *con)
         write_unlock_bh(&sk->sk_callback_lock);
 }
 
-static void tipc_sock_release(struct tipc_conn *con)
-{
-        struct tipc_server *s = con->server;
-
-        if (con->conid)
-                s->tipc_conn_release(con->conid, con->usr_data);
-
-        tipc_unregister_callbacks(con);
-}
-
 static void tipc_close_conn(struct tipc_conn *con)
 {
         struct tipc_server *s = con->server;
 
         if (test_and_clear_bit(CF_CONNECTED, &con->flags)) {
+                tipc_unregister_callbacks(con);
 
-                spin_lock_bh(&s->idr_lock);
-                idr_remove(&s->conn_idr, con->conid);
-                s->idr_in_use--;
-                spin_unlock_bh(&s->idr_lock);
+                if (con->conid)
+                        s->tipc_conn_release(con->conid, con->usr_data);
 
                 /* We shouldn't flush pending works as we may be in the
                  * thread. In fact the races with pending rx/tx work structs
@@ -458,6 +453,11 @@ int tipc_conn_sendmsg(struct tipc_server *s, int conid,
         if (!con)
                 return -EINVAL;
 
+        if (!test_bit(CF_CONNECTED, &con->flags)) {
+                conn_put(con);
+                return 0;
+        }
+
         e = tipc_alloc_entry(data, len);
         if (!e) {
                 conn_put(con);
@@ -471,12 +471,8 @@ int tipc_conn_sendmsg(struct tipc_server *s, int conid,
         list_add_tail(&e->list, &con->outqueue);
         spin_unlock_bh(&con->outqueue_lock);
 
-        if (test_bit(CF_CONNECTED, &con->flags)) {
-                if (!queue_work(s->send_wq, &con->swork))
-                        conn_put(con);
-        } else {
+        if (!queue_work(s->send_wq, &con->swork))
                 conn_put(con);
-        }
         return 0;
 }
 
@@ -500,7 +496,7 @@ static void tipc_send_to_sock(struct tipc_conn *con)
         int ret;
 
         spin_lock_bh(&con->outqueue_lock);
-        while (1) {
+        while (test_bit(CF_CONNECTED, &con->flags)) {
                 e = list_entry(con->outqueue.next, struct outqueue_entry,
                                list);
                 if ((struct list_head *) e == &con->outqueue)
@@ -623,14 +619,12 @@ int tipc_server_start(struct tipc_server *s)
 void tipc_server_stop(struct tipc_server *s)
 {
         struct tipc_conn *con;
-        int total = 0;
         int id;
 
         spin_lock_bh(&s->idr_lock);
-        for (id = 0; total < s->idr_in_use; id++) {
+        for (id = 0; s->idr_in_use; id++) {
                 con = idr_find(&s->conn_idr, id);
                 if (con) {
-                        total++;
                         spin_unlock_bh(&s->idr_lock);
                         tipc_close_conn(con);
                         spin_lock_bh(&s->idr_lock);
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 0dd02244e21d..9d94e65d0894 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -54,6 +54,8 @@ struct tipc_subscriber {
 
 static void tipc_subscrp_delete(struct tipc_subscription *sub);
 static void tipc_subscrb_put(struct tipc_subscriber *subscriber);
+static void tipc_subscrp_put(struct tipc_subscription *subscription);
+static void tipc_subscrp_get(struct tipc_subscription *subscription);
 
 /**
  * htohl - convert value to endianness used by destination
@@ -123,6 +125,7 @@ void tipc_subscrp_report_overlap(struct tipc_subscription *sub, u32 found_lower,
 {
         struct tipc_name_seq seq;
 
+        tipc_subscrp_get(sub);
         tipc_subscrp_convert_seq(&sub->evt.s.seq, sub->swap, &seq);
         if (!tipc_subscrp_check_overlap(&seq, found_lower, found_upper))
                 return;
@@ -132,30 +135,23 @@ void tipc_subscrp_report_overlap(struct tipc_subscription *sub, u32 found_lower,
 
         tipc_subscrp_send_event(sub, found_lower, found_upper, event, port_ref,
                                 node);
+        tipc_subscrp_put(sub);
 }
 
 static void tipc_subscrp_timeout(unsigned long data)
 {
         struct tipc_subscription *sub = (struct tipc_subscription *)data;
-        struct tipc_subscriber *subscriber = sub->subscriber;
 
         /* Notify subscriber of timeout */
         tipc_subscrp_send_event(sub, sub->evt.s.seq.lower, sub->evt.s.seq.upper,
                                 TIPC_SUBSCR_TIMEOUT, 0, 0);
 
-        spin_lock_bh(&subscriber->lock);
-        tipc_subscrp_delete(sub);
-        spin_unlock_bh(&subscriber->lock);
-
-        tipc_subscrb_put(subscriber);
+        tipc_subscrp_put(sub);
 }
 
 static void tipc_subscrb_kref_release(struct kref *kref)
 {
-        struct tipc_subscriber *subcriber = container_of(kref,
-                                            struct tipc_subscriber, kref);
-
-        kfree(subcriber);
+        kfree(container_of(kref,struct tipc_subscriber, kref));
 }
 
 static void tipc_subscrb_put(struct tipc_subscriber *subscriber)
@@ -168,6 +164,59 @@ static void tipc_subscrb_get(struct tipc_subscriber *subscriber)
         kref_get(&subscriber->kref);
 }
 
+static void tipc_subscrp_kref_release(struct kref *kref)
+{
+        struct tipc_subscription *sub = container_of(kref,
+                                                     struct tipc_subscription,
+                                                     kref);
+        struct tipc_net *tn = net_generic(sub->net, tipc_net_id);
+        struct tipc_subscriber *subscriber = sub->subscriber;
+
+        spin_lock_bh(&subscriber->lock);
+        tipc_nametbl_unsubscribe(sub);
+        list_del(&sub->subscrp_list);
+        atomic_dec(&tn->subscription_count);
+        spin_unlock_bh(&subscriber->lock);
+        kfree(sub);
+        tipc_subscrb_put(subscriber);
+}
+
+static void tipc_subscrp_put(struct tipc_subscription *subscription)
+{
+        kref_put(&subscription->kref, tipc_subscrp_kref_release);
+}
+
+static void tipc_subscrp_get(struct tipc_subscription *subscription)
+{
+        kref_get(&subscription->kref);
+}
+
+/* tipc_subscrb_subscrp_delete - delete a specific subscription or all
+ * subscriptions for a given subscriber.
+ */
+static void tipc_subscrb_subscrp_delete(struct tipc_subscriber *subscriber,
+                                        struct tipc_subscr *s)
+{
+        struct list_head *subscription_list = &subscriber->subscrp_list;
+        struct tipc_subscription *sub, *temp;
+
+        spin_lock_bh(&subscriber->lock);
+        list_for_each_entry_safe(sub, temp, subscription_list,  subscrp_list) {
+                if (s && memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr)))
+                        continue;
+
+                tipc_subscrp_get(sub);
+                spin_unlock_bh(&subscriber->lock);
+                tipc_subscrp_delete(sub);
+                tipc_subscrp_put(sub);
+                spin_lock_bh(&subscriber->lock);
+
+                if (s)
+                        break;
+        }
+        spin_unlock_bh(&subscriber->lock);
+}
+
 static struct tipc_subscriber *tipc_subscrb_create(int conid)
 {
         struct tipc_subscriber *subscriber;
@@ -177,8 +226,8 @@ static struct tipc_subscriber *tipc_subscrb_create(int conid)
                 pr_warn("Subscriber rejected, no memory\n");
                 return NULL;
         }
-        kref_init(&subscriber->kref);
         INIT_LIST_HEAD(&subscriber->subscrp_list);
+        kref_init(&subscriber->kref);
         subscriber->conid = conid;
         spin_lock_init(&subscriber->lock);
 
@@ -187,55 +236,22 @@ static struct tipc_subscriber *tipc_subscrb_create(int conid)
 
 static void tipc_subscrb_delete(struct tipc_subscriber *subscriber)
 {
-        struct tipc_subscription *sub, *temp;
-        u32 timeout;
-
-        spin_lock_bh(&subscriber->lock);
-        /* Destroy any existing subscriptions for subscriber */
-        list_for_each_entry_safe(sub, temp, &subscriber->subscrp_list,
-                                 subscrp_list) {
-                timeout = htohl(sub->evt.s.timeout, sub->swap);
-                if ((timeout == TIPC_WAIT_FOREVER) || del_timer(&sub->timer)) {
-                        tipc_subscrp_delete(sub);
-                        tipc_subscrb_put(subscriber);
-                }
-        }
-        spin_unlock_bh(&subscriber->lock);
-
+        tipc_subscrb_subscrp_delete(subscriber, NULL);
         tipc_subscrb_put(subscriber);
 }
 
 static void tipc_subscrp_delete(struct tipc_subscription *sub)
 {
-        struct tipc_net *tn = net_generic(sub->net, tipc_net_id);
+        u32 timeout = htohl(sub->evt.s.timeout, sub->swap);
 
-        tipc_nametbl_unsubscribe(sub);
-        list_del(&sub->subscrp_list);
-        kfree(sub);
-        atomic_dec(&tn->subscription_count);
+        if (timeout == TIPC_WAIT_FOREVER || del_timer(&sub->timer))
+                tipc_subscrp_put(sub);
 }
 
 static void tipc_subscrp_cancel(struct tipc_subscr *s,
                                 struct tipc_subscriber *subscriber)
 {
-        struct tipc_subscription *sub, *temp;
-        u32 timeout;
-
-        spin_lock_bh(&subscriber->lock);
-        /* Find first matching subscription, exit if not found */
-        list_for_each_entry_safe(sub, temp, &subscriber->subscrp_list,
-                                 subscrp_list) {
-                if (!memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr))) {
-                        timeout = htohl(sub->evt.s.timeout, sub->swap);
-                        if ((timeout == TIPC_WAIT_FOREVER) ||
-                            del_timer(&sub->timer)) {
-                                tipc_subscrp_delete(sub);
-                                tipc_subscrb_put(subscriber);
-                        }
-                        break;
-                }
-        }
-        spin_unlock_bh(&subscriber->lock);
+        tipc_subscrb_subscrp_delete(subscriber, s);
 }
 
 static struct tipc_subscription *tipc_subscrp_create(struct net *net,
@@ -272,6 +288,7 @@ static struct tipc_subscription *tipc_subscrp_create(struct net *net,
         sub->swap = swap;
         memcpy(&sub->evt.s, s, sizeof(*s));
         atomic_inc(&tn->subscription_count);
+        kref_init(&sub->kref);
         return sub;
 }
 
@@ -288,17 +305,16 @@ static void tipc_subscrp_subscribe(struct net *net, struct tipc_subscr *s,
 
         spin_lock_bh(&subscriber->lock);
         list_add(&sub->subscrp_list, &subscriber->subscrp_list);
-        tipc_subscrb_get(subscriber);
         sub->subscriber = subscriber;
         tipc_nametbl_subscribe(sub);
+        tipc_subscrb_get(subscriber);
         spin_unlock_bh(&subscriber->lock);
 
+        setup_timer(&sub->timer, tipc_subscrp_timeout, (unsigned long)sub);
         timeout = htohl(sub->evt.s.timeout, swap);
-        if (timeout == TIPC_WAIT_FOREVER)
-                return;
 
-        setup_timer(&sub->timer, tipc_subscrp_timeout, (unsigned long)sub);
-        mod_timer(&sub->timer, jiffies + msecs_to_jiffies(timeout));
+        if (timeout != TIPC_WAIT_FOREVER)
+                mod_timer(&sub->timer, jiffies + msecs_to_jiffies(timeout));
 }
 
 /* Handle one termination request for the subscriber */
diff --git a/net/tipc/subscr.h b/net/tipc/subscr.h
index be60103082c9..ffdc214c117a 100644
--- a/net/tipc/subscr.h
+++ b/net/tipc/subscr.h
@@ -57,6 +57,7 @@ struct tipc_subscriber;
  * @evt: template for events generated by subscription
  */
 struct tipc_subscription {
+        struct kref kref;
         struct tipc_subscriber *subscriber;
         struct net *net;
         struct timer_list timer;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 127656ebe7be..cef79873b09d 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -995,6 +995,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         unsigned int hash;
         struct unix_address *addr;
         struct hlist_head *list;
+        struct path path = { NULL, NULL };
 
         err = -EINVAL;
         if (sunaddr->sun_family != AF_UNIX)
@@ -1010,9 +1011,20 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 goto out;
         addr_len = err;
 
+        if (sun_path[0]) {
+                umode_t mode = S_IFSOCK |
+                       (SOCK_INODE(sock)->i_mode & ~current_umask());
+                err = unix_mknod(sun_path, mode, &path);
+                if (err) {
+                        if (err == -EEXIST)
+                                err = -EADDRINUSE;
+                        goto out;
+                }
+        }
+
         err = mutex_lock_interruptible(&u->bindlock);
         if (err)
-                goto out;
+                goto out_put;
 
         err = -EINVAL;
         if (u->addr)
@@ -1029,16 +1041,6 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         atomic_set(&addr->refcnt, 1);
 
         if (sun_path[0]) {
-                struct path path;
-                umode_t mode = S_IFSOCK |
-                       (SOCK_INODE(sock)->i_mode & ~current_umask());
-                err = unix_mknod(sun_path, mode, &path);
-                if (err) {
-                        if (err == -EEXIST)
-                                err = -EADDRINUSE;
-                        unix_release_addr(addr);
-                        goto out_up;
-                }
                 addr->hash = UNIX_HASH_SIZE;
                 hash = d_backing_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE - 1);
                 spin_lock(&unix_table_lock);
@@ -1065,6 +1067,9 @@ out_unlock:
         spin_unlock(&unix_table_lock);
 out_up:
         mutex_unlock(&u->bindlock);
+out_put:
+        if (err)
+                path_put(&path);
 out:
         return err;
 }
diff --git a/samples/bpf/tc_l2_redirect_kern.c b/samples/bpf/tc_l2_redirect_kern.c
index 92a44729dbe4..7ef2a12b25b2 100644
--- a/samples/bpf/tc_l2_redirect_kern.c
+++ b/samples/bpf/tc_l2_redirect_kern.c
@@ -4,6 +4,7 @@
  * modify it under the terms of version 2 of the GNU General Public
  * License as published by the Free Software Foundation.
  */
+#define KBUILD_MODNAME "foo"
 #include <uapi/linux/bpf.h>
 #include <uapi/linux/if_ether.h>
 #include <uapi/linux/if_packet.h>
diff --git a/samples/bpf/xdp_tx_iptunnel_kern.c b/samples/bpf/xdp_tx_iptunnel_kern.c
index 85c38ecd3a2d..0f4f6e8c8611 100644
--- a/samples/bpf/xdp_tx_iptunnel_kern.c
+++ b/samples/bpf/xdp_tx_iptunnel_kern.c
@@ -8,6 +8,7 @@
  * encapsulating the incoming packet in an IPv4/v6 header
  * and then XDP_TX it out.
  */
+#define KBUILD_MODNAME "foo"
 #include <uapi/linux/bpf.h>
 #include <linux/in.h>
 #include <linux/if_ether.h>
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index eadcd4d359d9..d883116ebaa4 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -164,6 +164,7 @@ cmd_gensymtypes_c =                                                         \
     $(CPP) -D__GENKSYMS__ $(c_flags) $< |                                   \
     $(GENKSYMS) $(if $(1), -T $(2))                                         \
      $(patsubst y,-s _,$(CONFIG_HAVE_UNDERSCORE_SYMBOL_PREFIX))             \
+     $(patsubst y,-R,$(CONFIG_MODULE_REL_CRCS))                             \
      $(if $(KBUILD_PRESERVE),-p)                                            \
      -r $(firstword $(wildcard $(2:.symtypes=.symref) /dev/null))
 
@@ -337,6 +338,7 @@ cmd_gensymtypes_S =                                                         \
     $(CPP) -D__GENKSYMS__ $(c_flags) -xc - |                                \
     $(GENKSYMS) $(if $(1), -T $(2))                                         \
      $(patsubst y,-s _,$(CONFIG_HAVE_UNDERSCORE_SYMBOL_PREFIX))             \
+     $(patsubst y,-R,$(CONFIG_MODULE_REL_CRCS))                             \
      $(if $(KBUILD_PRESERVE),-p)                                            \
      -r $(firstword $(wildcard $(2:.symtypes=.symref) /dev/null))
 
diff --git a/scripts/genksyms/genksyms.c b/scripts/genksyms/genksyms.c
index 06121ce524a7..c9235d8340f1 100644
--- a/scripts/genksyms/genksyms.c
+++ b/scripts/genksyms/genksyms.c
@@ -44,7 +44,7 @@ char *cur_filename, *source_file;
 int in_source_file;
 
 static int flag_debug, flag_dump_defs, flag_reference, flag_dump_types,
-           flag_preserve, flag_warnings;
+           flag_preserve, flag_warnings, flag_rel_crcs;
 static const char *mod_prefix = "";
 
 static int errors;
@@ -693,7 +693,10 @@ void export_symbol(const char *name)
                         fputs(">\n", debugfile);
 
                 /* Used as a linker script. */
-                printf("%s__crc_%s = 0x%08lx ;\n", mod_prefix, name, crc);
+                printf(!flag_rel_crcs ? "%s__crc_%s = 0x%08lx;\n" :
+                       "SECTIONS { .rodata : ALIGN(4) { "
+                       "%s__crc_%s = .; LONG(0x%08lx); } }\n",
+                       mod_prefix, name, crc);
         }
 }
 
@@ -730,7 +733,7 @@ void error_with_pos(const char *fmt, ...)
 
 static void genksyms_usage(void)
 {
-        fputs("Usage:\n" "genksyms [-adDTwqhV] > /path/to/.tmp_obj.ver\n" "\n"
+        fputs("Usage:\n" "genksyms [-adDTwqhVR] > /path/to/.tmp_obj.ver\n" "\n"
 #ifdef __GNU_LIBRARY__
               "  -s, --symbol-prefix   Select symbol prefix\n"
               "  -d, --debug           Increment the debug level (repeatable)\n"
@@ -742,6 +745,7 @@ static void genksyms_usage(void)
               "  -q, --quiet           Disable warnings (default)\n"
               "  -h, --help            Print this message\n"
               "  -V, --version         Print the release version\n"
+              "  -R, --relative-crc    Emit section relative symbol CRCs\n"
 #else                           /* __GNU_LIBRARY__ */
               "  -s                    Select symbol prefix\n"
               "  -d                    Increment the debug level (repeatable)\n"
@@ -753,6 +757,7 @@ static void genksyms_usage(void)
               "  -q                    Disable warnings (default)\n"
               "  -h                    Print this message\n"
               "  -V                    Print the release version\n"
+              "  -R                    Emit section relative symbol CRCs\n"
 #endif                          /* __GNU_LIBRARY__ */
               , stderr);
 }
@@ -774,13 +779,14 @@ int main(int argc, char **argv)
                 {"preserve", 0, 0, 'p'},
                 {"version", 0, 0, 'V'},
                 {"help", 0, 0, 'h'},
+                {"relative-crc", 0, 0, 'R'},
                 {0, 0, 0, 0}
         };
 
-        while ((o = getopt_long(argc, argv, "s:dwqVDr:T:ph",
+        while ((o = getopt_long(argc, argv, "s:dwqVDr:T:phR",
                                 &long_opts[0], NULL)) != EOF)
 #else                           /* __GNU_LIBRARY__ */
-        while ((o = getopt(argc, argv, "s:dwqVDr:T:ph")) != EOF)
+        while ((o = getopt(argc, argv, "s:dwqVDr:T:phR")) != EOF)
 #endif                          /* __GNU_LIBRARY__ */
                 switch (o) {
                 case 's':
@@ -823,6 +829,9 @@ int main(int argc, char **argv)
                 case 'h':
                         genksyms_usage();
                         return 0;
+                case 'R':
+                        flag_rel_crcs = 1;
+                        break;
                 default:
                         genksyms_usage();
                         return 1;
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 299b92ca1ae0..5d554419170b 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -219,6 +219,10 @@ static int symbol_valid(struct sym_entry *s)
                 "_SDA2_BASE_",          /* ppc */
                 NULL };
 
+        static char *special_prefixes[] = {
+                "__crc_",               /* modversions */
+                NULL };
+
         static char *special_suffixes[] = {
                 "_veneer",              /* arm */
                 "_from_arm",            /* arm */
@@ -259,6 +263,14 @@ static int symbol_valid(struct sym_entry *s)
                 if (strcmp(sym_name, special_symbols[i]) == 0)
                         return 0;
 
+        for (i = 0; special_prefixes[i]; i++) {
+                int l = strlen(special_prefixes[i]);
+
+                if (l <= strlen(sym_name) &&
+                    strncmp(sym_name, special_prefixes[i], l) == 0)
+                        return 0;
+        }
+
         for (i = 0; special_suffixes[i]; i++) {
                 int l = strlen(sym_name) - strlen(special_suffixes[i]);
 
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 29c89a6bad3d..4dedd0d3d3a7 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -621,6 +621,16 @@ static void handle_modversions(struct module *mod, struct elf_info *info,
         if (strncmp(symname, CRC_PFX, strlen(CRC_PFX)) == 0) {
                 is_crc = true;
                 crc = (unsigned int) sym->st_value;
+                if (sym->st_shndx != SHN_UNDEF && sym->st_shndx != SHN_ABS) {
+                        unsigned int *crcp;
+
+                        /* symbol points to the CRC in the ELF object */
+                        crcp = (void *)info->hdr + sym->st_value +
+                               info->sechdrs[sym->st_shndx].sh_offset -
+                               (info->hdr->e_type != ET_REL ?
+                                info->sechdrs[sym->st_shndx].sh_addr : 0);
+                        crc = *crcp;
+                }
                 sym_update_crc(symname + strlen(CRC_PFX), mod, crc,
                                 export);
         }
diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c
index 5e0dea2cdc01..039636ffb6c8 100644
--- a/tools/objtool/arch/x86/decode.c
+++ b/tools/objtool/arch/x86/decode.c
@@ -150,9 +150,9 @@ int arch_decode_instruction(struct elf *elf, struct section *sec,
                 *type = INSN_RETURN;
                 break;
 
-        case 0xc5: /* iret */
         case 0xca: /* retf */
         case 0xcb: /* retf */
+        case 0xcf: /* iret */
                 *type = INSN_CONTEXT_SWITCH;
                 break;
 
diff --git a/tools/testing/selftests/bpf/test_lru_map.c b/tools/testing/selftests/bpf/test_lru_map.c
index b13fed534d76..9f7bd1915c21 100644
--- a/tools/testing/selftests/bpf/test_lru_map.c
+++ b/tools/testing/selftests/bpf/test_lru_map.c
@@ -67,21 +67,23 @@ static int map_equal(int lru_map, int expected)
         return map_subset(lru_map, expected) && map_subset(expected, lru_map);
 }
 
-static int sched_next_online(int pid, int next_to_try)
+static int sched_next_online(int pid, int *next_to_try)
 {
         cpu_set_t cpuset;
+        int next = *next_to_try;
+        int ret = -1;
 
-        if (next_to_try == nr_cpus)
-                return -1;
-
-        while (next_to_try < nr_cpus) {
+        while (next < nr_cpus) {
                 CPU_ZERO(&cpuset);
-                CPU_SET(next_to_try++, &cpuset);
-                if (!sched_setaffinity(pid, sizeof(cpuset), &cpuset))
+                CPU_SET(next++, &cpuset);
+                if (!sched_setaffinity(pid, sizeof(cpuset), &cpuset)) {
+                        ret = 0;
                         break;
+                }
         }
 
-        return next_to_try;
+        *next_to_try = next;
+        return ret;
 }
 
 /* Size of the LRU amp is 2
@@ -96,11 +98,12 @@ static void test_lru_sanity0(int map_type, int map_flags)
 {
         unsigned long long key, value[nr_cpus];
         int lru_map_fd, expected_map_fd;
+        int next_cpu = 0;
 
         printf("%s (map_type:%d map_flags:0x%X): ", __func__, map_type,
                map_flags);
 
-        assert(sched_next_online(0, 0) != -1);
+        assert(sched_next_online(0, &next_cpu) != -1);
 
         if (map_flags & BPF_F_NO_COMMON_LRU)
                 lru_map_fd = create_map(map_type, map_flags, 2 * nr_cpus);
@@ -183,6 +186,7 @@ static void test_lru_sanity1(int map_type, int map_flags, unsigned int tgt_free)
         int lru_map_fd, expected_map_fd;
         unsigned int batch_size;
         unsigned int map_size;
+        int next_cpu = 0;
 
         if (map_flags & BPF_F_NO_COMMON_LRU)
                 /* Ther percpu lru list (i.e each cpu has its own LRU
@@ -196,7 +200,7 @@ static void test_lru_sanity1(int map_type, int map_flags, unsigned int tgt_free)
         printf("%s (map_type:%d map_flags:0x%X): ", __func__, map_type,
                map_flags);
 
-        assert(sched_next_online(0, 0) != -1);
+        assert(sched_next_online(0, &next_cpu) != -1);
 
         batch_size = tgt_free / 2;
         assert(batch_size * 2 == tgt_free);
@@ -262,6 +266,7 @@ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free)
         int lru_map_fd, expected_map_fd;
         unsigned int batch_size;
         unsigned int map_size;
+        int next_cpu = 0;
 
         if (map_flags & BPF_F_NO_COMMON_LRU)
                 /* Ther percpu lru list (i.e each cpu has its own LRU
@@ -275,7 +280,7 @@ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free)
         printf("%s (map_type:%d map_flags:0x%X): ", __func__, map_type,
                map_flags);
 
-        assert(sched_next_online(0, 0) != -1);
+        assert(sched_next_online(0, &next_cpu) != -1);
 
         batch_size = tgt_free / 2;
         assert(batch_size * 2 == tgt_free);
@@ -370,11 +375,12 @@ static void test_lru_sanity3(int map_type, int map_flags, unsigned int tgt_free)
         int lru_map_fd, expected_map_fd;
         unsigned int batch_size;
         unsigned int map_size;
+        int next_cpu = 0;
 
         printf("%s (map_type:%d map_flags:0x%X): ", __func__, map_type,
                map_flags);
 
-        assert(sched_next_online(0, 0) != -1);
+        assert(sched_next_online(0, &next_cpu) != -1);
 
         batch_size = tgt_free / 2;
         assert(batch_size * 2 == tgt_free);
@@ -430,11 +436,12 @@ static void test_lru_sanity4(int map_type, int map_flags, unsigned int tgt_free)
         int lru_map_fd, expected_map_fd;
         unsigned long long key, value[nr_cpus];
         unsigned long long end_key;
+        int next_cpu = 0;
 
         printf("%s (map_type:%d map_flags:0x%X): ", __func__, map_type,
                map_flags);
 
-        assert(sched_next_online(0, 0) != -1);
+        assert(sched_next_online(0, &next_cpu) != -1);
 
         if (map_flags & BPF_F_NO_COMMON_LRU)
                 lru_map_fd = create_map(map_type, map_flags,
@@ -502,9 +509,8 @@ static void do_test_lru_sanity5(unsigned long long last_key, int map_fd)
 static void test_lru_sanity5(int map_type, int map_flags)
 {
         unsigned long long key, value[nr_cpus];
-        int next_sched_cpu = 0;
+        int next_cpu = 0;
         int map_fd;
-        int i;
 
         if (map_flags & BPF_F_NO_COMMON_LRU)
                 return;
@@ -519,27 +525,20 @@ static void test_lru_sanity5(int map_type, int map_flags)
         key = 0;
         assert(!bpf_map_update(map_fd, &key, value, BPF_NOEXIST));
 
-        for (i = 0; i < nr_cpus; i++) {
+        while (sched_next_online(0, &next_cpu) != -1) {
                 pid_t pid;
 
                 pid = fork();
                 if (pid == 0) {
-                        next_sched_cpu = sched_next_online(0, next_sched_cpu);
-                        if (next_sched_cpu != -1)
-                                do_test_lru_sanity5(key, map_fd);
+                        do_test_lru_sanity5(key, map_fd);
                         exit(0);
                 } else if (pid == -1) {
-                        printf("couldn't spawn #%d process\n", i);
+                        printf("couldn't spawn process to test key:%llu\n",
+                               key);
                         exit(1);
                 } else {
                         int status;
 
-                        /* It is mostly redundant and just allow the parent
-                         * process to update next_shced_cpu for the next child
-                         * process
-                         */
-                        next_sched_cpu = sched_next_online(pid, next_sched_cpu);
-
                         assert(waitpid(pid, &status, 0) == pid);
                         assert(status == 0);
                         key++;
@@ -547,6 +546,8 @@ static void test_lru_sanity5(int map_type, int map_flags)
         }
 
         close(map_fd);
+        /* At least one key should be tested */
+        assert(key > 0);
 
         printf("Pass\n");
 }